diff --git a/.gitattributes b/.gitattributes
index 19f3e8920a..017dd6d47b 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -10,6 +10,9 @@ patches/*.patch text eol=lf
 # can't leave a trailing `\r` on every entry and make every tag mismatch.
 apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt text eol=lf
 
+# The Windows smoke-test runs this under Git Bash; a CRLF checkout breaks `set -euo pipefail`.
+.github/scripts/wait-for-npm-version.sh text eol=lf
+
 # Generated artifacts. `linguist-generated` keeps these out of GitHub's language
 # statistics and collapses them in pull request diffs -- they are build output to
 # be regenerated, not code to review, and together they outweigh the hand-written
diff --git a/.github/MAINTAINERS.md b/.github/MAINTAINERS.md
index 25c044e909..50ec58f4c5 100644
--- a/.github/MAINTAINERS.md
+++ b/.github/MAINTAINERS.md
@@ -187,6 +187,7 @@ Fast-forward PRs are the deploy PR (`develop` → `main`), the major cut
 (`next` → `develop`), and the two sync PRs.
 
 **Dispatch guards.** `release.yml` refuses `channel=next` off `next`,
+`channel=next` while `next` has no commits beyond `develop`,
 `channel=maintenance` off `v<N>.x`, `beta`/`stable` on `next` or `v<N>.x`, a
 non-dry-run `stable` outside `main`, and a `version` that is not
 `X.Y.Z[-prerelease]`.
diff --git a/.github/ai-review/README.md b/.github/ai-review/README.md
index 300372d67f..fb408be8a8 100644
--- a/.github/ai-review/README.md
+++ b/.github/ai-review/README.md
@@ -74,6 +74,12 @@ shown as `--remerge-diff`. Both sides were reviewed in their own PRs, so the
 prompts limit findings to what the resolution introduced; `pr.diff` stays the
 anchor for inline comments.
 
+### Breaking changes
+
+Only the Claude prompt asks for `breaking-change` findings, because only its job
+has `pr.json` with the title and branches. They post as `major` and ask for a
+`!` title, plus a retarget to `next` on `develop`.
+
 ## Once-per-PR semantics and manual re-runs
 
 New commits never re-trigger a review — `resolve.ts`'s dedup guard skips a
diff --git a/.github/ai-review/adjudicate-prompt.md b/.github/ai-review/adjudicate-prompt.md
index ef6951d1b0..f37a3e0085 100644
--- a/.github/ai-review/adjudicate-prompt.md
+++ b/.github/ai-review/adjudicate-prompt.md
@@ -71,6 +71,16 @@ when that file shows work on `next` the PR would fundamentally conflict with. If
 the file is absent, refute it. Keep the category `next-impact` and a severity no
 higher than `minor`; these findings are advisory and never block the PR.
 
+### Breaking-change findings
+
+Verify each `breaking-change` finding against the behavior the PR changes:
+refute it only when no released, non-experimental use fails or changes meaning,
+when the change only rejects a value that never had a meaning, or when the
+change matches the old `SIDE_EFFECTS.md`. The PR's intent, tests and
+`SIDE_EFFECTS.md` edits are not counter-evidence. Keep the category
+`breaking-change`, severity `major` and the request ending its `claim`, even
+when merged with a Codex finding.
+
 ### Merge into one deduplicated list
 
 - When a Claude finding and a Codex finding concern the same file/line/
diff --git a/.github/ai-review/claude-review-prompt.md b/.github/ai-review/claude-review-prompt.md
index 79273c84e7..5ce275addf 100644
--- a/.github/ai-review/claude-review-prompt.md
+++ b/.github/ai-review/claude-review-prompt.md
@@ -76,6 +76,19 @@ higher than `minor`. These findings are advisory and never block the PR. Do not
 flag ordinary merge conflicts or style differences, and report nothing when the
 file does not exist.
 
+## Breaking changes
+
+Only when `pr.json` has `baseRefName` `develop` or `next`, a `headRefName` other
+than `next` or `sync/*`, and no `!` before the title's colon: report any change
+that makes existing use of a released command, flag, config key, env var or exit
+code fail or change meaning, for example removing a fallback so a command now
+errors, even when that is the fix the PR set out to make. Use category
+`breaking-change`, with severity `major`, and end the `claim` by asking for a
+`type(scope)!:` title, a `BREAKING CHANGE:` line in the PR description and, on
+`develop`, a retarget to `next`. Do not report internal code, tests, CI,
+additive changes, experimental commands, newly rejected values that never had a
+meaning, or fixes that match the old `SIDE_EFFECTS.md`.
+
 ## Output
 
 Your final response must be ONLY the JSON object described by the provided
diff --git a/.github/scripts/wait-for-npm-version.sh b/.github/scripts/wait-for-npm-version.sh
new file mode 100755
index 0000000000..dfb6e07ad7
--- /dev/null
+++ b/.github/scripts/wait-for-npm-version.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Usage: wait-for-npm-version.sh <version> <package>...
+#
+# npm lists a new version minutes after publish, and the registry CDN caches each packument per
+# region and Accept header, so both the npm client and the abbreviated packument must serve it.
+set -euo pipefail
+
+if [[ $# -lt 2 ]]; then
+  echo "usage: $0 <version> <package>..." >&2
+  exit 2
+fi
+
+version="$1"
+shift
+timeout="${WAIT_TIMEOUT_SECONDS:-900}"
+
+npm_serves_version() {
+  local pkg="$1"
+  npm view "${pkg}@${version}" version --prefer-online --fetch-timeout=30000 --fetch-retries=0 > /dev/null &&
+    curl -fsSL --max-time 30 -H 'Accept: application/vnd.npm.install-v1+json' "https://registry.npmjs.org/${pkg//\//%2f}" |
+    jq -e --arg v "$version" '.versions | has($v)' > /dev/null
+}
+
+deadline=$((SECONDS + timeout))
+for pkg in "$@"; do
+  while true; do
+    if (( SECONDS >= deadline )); then
+      echo "::error::npm does not serve ${pkg}@${version} after ${timeout} seconds"
+      exit 1
+    fi
+    npm_serves_version "$pkg" && break
+    echo "Waiting for npm to serve ${pkg}@${version}..."
+    sleep 15
+  done
+done
diff --git a/.github/workflows/propose-release-notes.yml b/.github/workflows/propose-release-notes.yml
index 3ba3ad70fc..8ddc40d29c 100644
--- a/.github/workflows/propose-release-notes.yml
+++ b/.github/workflows/propose-release-notes.yml
@@ -62,7 +62,6 @@ jobs:
           client-id: ${{ vars.GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
           permission-contents: write
-          permission-issues: read
           permission-pull-requests: write
 
       - uses: useblacksmith/checkout@6fd481652155169ed4d2f25ebaf97464f685175f # v1
diff --git a/.github/workflows/release-shared.yml b/.github/workflows/release-shared.yml
index 32bde58beb..45c2b4d04d 100644
--- a/.github/workflows/release-shared.yml
+++ b/.github/workflows/release-shared.yml
@@ -275,7 +275,7 @@ jobs:
     # count as self-hosted from sigstore's POV, so this job must stay on a github-hosted runner
     # (it's short and not compute-bound, so the cost is negligible).
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 60
     env:
       CHANNEL: ${{ inputs.channel }}
       NPM_TAG: ${{ inputs.npm_tag }}
@@ -283,6 +283,7 @@ jobs:
       LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY: ${{ secrets.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY }}
       LINEAR_CLI_BETA_RELEASE_ACCESS_KEY: ${{ secrets.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY }}
     permissions:
+      attestations: write
       contents: write
       id-token: write
     steps:
@@ -409,6 +410,16 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}"
 
+      # Lets installers such as aqua and mise verify each asset with `gh attestation verify`; the
+      # unversioned tarball aliases share their versioned twin's digest, so they are covered too.
+      - name: Attest release assets
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: |
+            dist/supabase_${{ inputs.version }}_*
+            dist/checksums.txt
+            install
+
       - name: Publish GitHub Release (immutable)
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/release-smoke-test.yml b/.github/workflows/release-smoke-test.yml
index 0aa4ff6b17..d4521493ab 100644
--- a/.github/workflows/release-smoke-test.yml
+++ b/.github/workflows/release-smoke-test.yml
@@ -35,6 +35,7 @@ jobs:
     # dry_run here, but GitHub validates nested-workflow permissions at startup.
     permissions:
       actions: read
+      attestations: write
       contents: write
       id-token: write
       pull-requests: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1a1ce8040a..6f32d098ac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,9 +47,36 @@ permissions:
   contents: read
 
 jobs:
+  # semantic-release reads channel notes per commit (semantic-release/semantic-release#4073), so
+  # releasing `next` on a commit develop already tagged misreads both tags.
+  next-ahead:
+    name: Check next has its own commits
+    if: github.ref_name == 'next'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      ahead: ${{ steps.compare.outputs.ahead }}
+    steps:
+      - id: compare
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          ahead_by="$(gh api "repos/${REPO}/compare/develop...${SHA}" --jq .ahead_by)"
+          if [[ "$ahead_by" -gt 0 ]]; then
+            echo "ahead=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ahead=false" >> "$GITHUB_OUTPUT"
+          fi
+
   test-next:
     name: Test next
-    if: github.event_name == 'push' && github.ref_name == 'next'
+    needs: next-ahead
+    if: github.event_name == 'push' && github.ref_name == 'next' && needs.next-ahead.outputs.ahead == 'true'
     permissions:
       contents: read
       actions: read
@@ -61,12 +88,20 @@ jobs:
 
   plan:
     name: Plan release
-    needs: test-next
-    # A skipped test-next (every non-next trigger) makes the implicit success() false, so the
-    # result is checked explicitly.
-    if: ${{ !cancelled() && contains(fromJSON('["success","skipped"]'), needs.test-next.result) }}
+    needs: [next-ahead, test-next]
+    # Skipped next-ahead and test-next jobs (every non-next trigger) make the implicit success()
+    # false, so their results are checked explicitly. A next push with no commits beyond develop
+    # plans nothing.
+    if: >-
+      ${{ !cancelled() &&
+      contains(fromJSON('["success","skipped"]'), needs.next-ahead.result) &&
+      contains(fromJSON('["success","skipped"]'), needs.test-next.result) &&
+      !(github.event_name == 'push' && github.ref_name == 'next' && needs.next-ahead.outputs.ahead != 'true') }}
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 135
+    permissions:
+      contents: read
+      actions: read
     outputs:
       should_release: ${{ steps.compute.outputs.should_release }}
       version: ${{ steps.compute.outputs.version }}
@@ -78,6 +113,59 @@ jobs:
       dry_run: ${{ steps.compute.outputs.dry_run }}
       channel: ${{ steps.compute.outputs.channel }}
     steps:
+      - name: Refuse a next dispatch with no commits beyond develop
+        if: ${{ github.event_name == 'workflow_dispatch' && github.ref_name == 'next' && needs.next-ahead.outputs.ahead != 'true' }}
+        run: |
+          echo "::error::next has no commits beyond develop, so a next release would tag a commit develop already released"
+          exit 1
+      # The stable tag is pushed by main's publish job, so a prerelease planned before that job
+      # finishes misses it. The rest of the run (brew, scoop, smoke tests) does not affect the plan.
+      - name: Wait for an in-flight stable release
+        if: ${{ (github.ref_name == 'develop' || github.ref_name == 'next') && (github.event_name == 'push' || inputs.version == '') }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          deadline=$((SECONDS + 7200))
+          while true; do
+            pending=0
+            if run_ids="$(gh run list --repo "$REPO" --workflow release.yml --branch main --json databaseId,status --jq '.[] | select(.status != "completed") | .databaseId')"; then
+              for run_id in $run_ids; do
+                publish_status="$(gh api "repos/${REPO}/actions/runs/${run_id}/jobs" --paginate --jq '.jobs[] | select(.name == "Release / publish") | .status')" || publish_status=unknown
+                if [[ "$publish_status" != completed ]]; then
+                  pending=$((pending + 1))
+                fi
+              done
+            else
+              echo "::warning::Could not list Release runs on main; retrying."
+              pending=1
+            fi
+            if [[ "$pending" -eq 0 ]]; then
+              break
+            fi
+            if (( SECONDS >= deadline )); then
+              echo "::error::The publish job of a Release run on main is still in progress after 120 minutes. Re-run this job once it finishes."
+              exit 1
+            fi
+            echo "Waiting for the publish job of ${pending} Release run(s) on main to finish..."
+            sleep 30
+          done
+      # A major cut can fast-forward develop onto next while the tests and the wait above run.
+      - id: next-still-ahead
+        if: ${{ github.ref_name == 'next' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          ahead_by="$(gh api "repos/${REPO}/compare/develop...${SHA}" --jq .ahead_by)"
+          if [[ "$ahead_by" -gt 0 ]]; then
+            echo "ahead=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ahead=false" >> "$GITHUB_OUTPUT"
+          fi
       # semantic-release runs `git push --dry-run HEAD:<branch>` as part of verifyAuth even in
       # `dry_run: true` mode, so the token needs push access to the protected develop/main
       # branches — the default GITHUB_TOKEN doesn't have it.
@@ -110,6 +198,7 @@ jobs:
           DISPATCH_CHANNEL: ${{ inputs.channel }}
           DISPATCH_VERSION: ${{ inputs.version }}
           DISPATCH_DRY_RUN: ${{ inputs.dry_run }}
+          NEXT_AHEAD: ${{ steps.next-still-ahead.outputs.ahead }}
           SR_PUBLISHED: ${{ steps.semantic-release.outputs.new_release_published }}
           SR_VERSION: ${{ steps.semantic-release.outputs.new_release_version }}
         run: |
@@ -126,6 +215,15 @@ jobs:
             next) natural=next ;;
             *) [[ "$REF_NAME" =~ $maint_re ]] && natural=maintenance ;;
           esac
+          if [[ "$REF_NAME" == next && "$NEXT_AHEAD" != true ]]; then
+            if [[ "$EVENT" == "workflow_dispatch" ]]; then
+              echo "::error::next has no commits beyond develop, so a next release would tag a commit develop already released"
+              exit 1
+            fi
+            echo "::notice::next has no commits beyond develop, so there is nothing to release"
+            echo "should_release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           if [[ "$EVENT" == "workflow_dispatch" ]]; then
             channel="$DISPATCH_CHANNEL"
             dry_run="$DISPATCH_DRY_RUN"
@@ -243,6 +341,7 @@ jobs:
     # those granted to the calling job, so this must be declared here too.
     permissions:
       actions: read
+      attestations: write
       contents: write
       id-token: write
       pull-requests: write
@@ -394,13 +493,14 @@ jobs:
       SLACK_RELEASE_WEBHOOK: ${{ secrets.SLACK_RELEASE_WEBHOOK }}
 
   # Reports a broken release on every channel. `failure()` evaluates against the full `needs`
-  # chain, so this fires whenever `test-next`, `plan` or `release` (including the reusable
-  # release-shared workflow) fails. Skipped jobs don't count as failures. Dry runs are excluded
-  # via the dispatch input directly, so even a plan job that dies before recording its `dry_run`
-  # output stays quiet. A failed `test-next` skips `plan`, so the channel falls back to the ref.
+  # chain, so this fires whenever `next-ahead`, `test-next`, `plan` or `release` (including the
+  # reusable release-shared workflow) fails. Skipped jobs don't count as failures. Dry runs are
+  # excluded via the dispatch input directly, so even a plan job that dies before recording its
+  # `dry_run` output stays quiet. A failed `next-ahead` or `test-next` skips `plan`, so the
+  # channel falls back to the ref.
   notify-slack-failure:
     name: Notify Slack (failure)
-    needs: [test-next, plan, release]
+    needs: [next-ahead, test-next, plan, release]
     if: ${{ failure() && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}
     uses: ./.github/workflows/slack-notify.yml
     with:
diff --git a/.github/workflows/setup-cli-smoke-test.yml b/.github/workflows/setup-cli-smoke-test.yml
index 5e00dad37b..7250265fcd 100644
--- a/.github/workflows/setup-cli-smoke-test.yml
+++ b/.github/workflows/setup-cli-smoke-test.yml
@@ -1,9 +1,11 @@
 name: setup-cli Smoke Test
 
 # Smoke test for the `supabase/setup-cli` GitHub Action against a specific published CLI
-# version. Runs automatically after every beta release and also manually via workflow_dispatch
-# when debugging setup-cli regressions. Catches regressions like supabase/setup-cli#427, where
-# musl libc + archive layout changes silently broke the action on Alpine.
+# version. Runs automatically after every published release and also manually via
+# workflow_dispatch when debugging setup-cli regressions. Catches regressions like
+# supabase/setup-cli#427, where musl libc + archive layout changes silently broke the action on
+# Alpine. v3 installs from npm: each v3 runner first waits until npm serves the version, and the
+# job fails if setup-cli fell back to the GitHub release. A separate job forces that fallback.
 
 on:
   workflow_call:
@@ -39,7 +41,7 @@ jobs:
           - v2
           - v3
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 10
+    timeout-minutes: 25
     env:
       VERSION: ${{ inputs.version }}
     steps:
@@ -53,9 +55,24 @@ jobs:
         uses: supabase/setup-cli@afb1b15109756ea5cf9d8985a359d9095235ca2b # v2.1.2
         with:
           version: ${{ inputs.version }}
+      - name: Checkout the npm wait script
+        if: matrix.major-version == 'v3'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: .smoke-tooling
+          sparse-checkout: .github/scripts
+          persist-credentials: false
+      - name: Wait for npm to serve the version
+        if: matrix.major-version == 'v3'
+        shell: bash
+        run: |
+          set -euo pipefail
+          platform="$(node -p 'process.platform + "-" + process.arch')"
+          bash .smoke-tooling/.github/scripts/wait-for-npm-version.sh "${VERSION#v}" supabase "@supabase/cli-${platform/win32/windows}"
       - name: Install Supabase CLI via setup-cli@v3
+        id: setup-cli-v3
         if: matrix.major-version == 'v3'
-        uses: supabase/setup-cli@45a513f8c64c0bc8e0e3dfe572b5c95be85f6359 # v3.0.1
+        uses: supabase/setup-cli@689adcfb80d947100a1eab127289b97d1fb07b13 # v3.2.0
         with:
           version: ${{ inputs.version }}
       - name: Verify supabase --version matches the expected version
@@ -72,6 +89,17 @@ jobs:
             echo "Version mismatch: expected ${expected}, got ${actual}" >&2
             exit 1
           fi
+      - name: Verify setup-cli installed from npm
+        if: matrix.major-version == 'v3'
+        shell: bash
+        env:
+          INSTALL_SOURCE: ${{ steps.setup-cli-v3.outputs.install-source }}
+        run: |
+          set -euo pipefail
+          if [ "${INSTALL_SOURCE}" != "npm" ]; then
+            echo "::error::setup-cli fell back to ${INSTALL_SOURCE} because installing supabase@${VERSION#v} from npm failed; check the setup-cli step log"
+            exit 1
+          fi
 
   # A separate job because GitHub Actions only honours `container:` on Linux runners, and mixing
   # container + non-container entries in one matrix is fragile when the value is empty. The
@@ -87,7 +115,7 @@ jobs:
           - v2
           - v3
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 25
     # `node:20-alpine` ships a musl-linked Node, required for JavaScript-based actions to launch
     # here — the runner's mounted glibc Node won't execute inside an Alpine container.
     container:
@@ -99,7 +127,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Install Alpine prerequisites
-        run: apk add --no-cache bash curl tar
+        run: apk add --no-cache bash curl git jq tar
       - name: Install Supabase CLI via setup-cli@v1
         if: matrix.major-version == 'v1'
         uses: supabase/setup-cli@1dedf2c611547ede7232d26866dd3c56ab903bbb # v1.7.3
@@ -110,9 +138,64 @@ jobs:
         uses: supabase/setup-cli@afb1b15109756ea5cf9d8985a359d9095235ca2b # v2.1.2
         with:
           version: ${{ inputs.version }}
+      - name: Checkout the npm wait script
+        if: matrix.major-version == 'v3'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: .smoke-tooling
+          sparse-checkout: .github/scripts
+          persist-credentials: false
+      - name: Wait for npm to serve the version
+        if: matrix.major-version == 'v3'
+        shell: bash
+        run: |
+          set -euo pipefail
+          platform="$(node -p 'process.platform + "-" + process.arch')"
+          bash .smoke-tooling/.github/scripts/wait-for-npm-version.sh "${VERSION#v}" supabase "@supabase/cli-${platform}-musl"
       - name: Install Supabase CLI via setup-cli@v3
+        id: setup-cli-v3
+        if: matrix.major-version == 'v3'
+        uses: supabase/setup-cli@689adcfb80d947100a1eab127289b97d1fb07b13 # v3.2.0
+        with:
+          version: ${{ inputs.version }}
+      - name: Verify supabase --version matches the expected version
+        shell: bash
+        run: |
+          set -euo pipefail
+          # `supabase --version` prints the version without the leading `v`,
+          # while release tags / setup-cli inputs include it, so strip it
+          # before comparing.
+          expected="${VERSION#v}"
+          actual="$(supabase --version | tr -d '\r' | head -n1)"
+          echo "supabase --version: ${actual}"
+          if [ "${actual}" != "${expected}" ]; then
+            echo "Version mismatch: expected ${expected}, got ${actual}" >&2
+            exit 1
+          fi
+      - name: Verify setup-cli installed from npm
         if: matrix.major-version == 'v3'
-        uses: supabase/setup-cli@45a513f8c64c0bc8e0e3dfe572b5c95be85f6359 # v3.0.1
+        shell: bash
+        env:
+          INSTALL_SOURCE: ${{ steps.setup-cli-v3.outputs.install-source }}
+        run: |
+          set -euo pipefail
+          if [ "${INSTALL_SOURCE}" != "npm" ]; then
+            echo "::error::setup-cli fell back to ${INSTALL_SOURCE} because installing supabase@${VERSION#v} from npm failed; check the setup-cli step log"
+            exit 1
+          fi
+
+  setup-cli-smoke-test-github-release:
+    name: setup-cli v3 GitHub release fallback (ubuntu-latest)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      VERSION: ${{ inputs.version }}
+      # An npm executable that always fails sends setup-cli down its GitHub release fallback.
+      SUPABASE_SETUP_CLI_NPM: "false"
+    steps:
+      - name: Install Supabase CLI via setup-cli@v3
+        id: setup-cli-v3
+        uses: supabase/setup-cli@689adcfb80d947100a1eab127289b97d1fb07b13 # v3.2.0
         with:
           version: ${{ inputs.version }}
       - name: Verify supabase --version matches the expected version
@@ -129,3 +212,13 @@ jobs:
             echo "Version mismatch: expected ${expected}, got ${actual}" >&2
             exit 1
           fi
+      - name: Verify setup-cli installed from the GitHub release
+        shell: bash
+        env:
+          INSTALL_SOURCE: ${{ steps.setup-cli-v3.outputs.install-source }}
+        run: |
+          set -euo pipefail
+          if [ "${INSTALL_SOURCE}" != "github-release" ]; then
+            echo "::error::setup-cli installed from ${INSTALL_SOURCE} instead of falling back to the GitHub release with npm disabled"
+            exit 1
+          fi
diff --git a/.github/workflows/sync-branches.yml b/.github/workflows/sync-branches.yml
index 5ab7797833..176beef600 100644
--- a/.github/workflows/sync-branches.yml
+++ b/.github/workflows/sync-branches.yml
@@ -364,6 +364,10 @@ jobs:
               break
             fi
           done
+          # download-artifact extracts a lone matching artifact into the path itself, not a subdirectory.
+          if [ -z "$stage" ] && [ -f "$ARTIFACTS/comment.md" ]; then
+            stage="$ARTIFACTS"
+          fi
           if [ "$RESOLVED" = true ]; then
             export REPO_DIR="$GITHUB_WORKSPACE" OUTPUT_DIR="$stage" HEAD_SHA
             if ! {
diff --git a/.oxlintrc.effect.json b/.oxlintrc.effect.json
deleted file mode 100644
index d3209edd72..0000000000
--- a/.oxlintrc.effect.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "$schema": "./node_modules/@effect/tsgo/oxlint-schema.json",
-  "extends": ["./.oxlintrc.json", "./node_modules/@effect/tsgo/oxlint-presets/recommended.json"],
-  "options": {
-    "denyWarnings": true
-  },
-  "ignorePatterns": [
-    "**",
-    "!packages/api/**",
-    "!packages/config/**",
-    "!packages/stack/**",
-    "!apps/cli-e2e/**",
-    "!apps/cli/**",
-    "!apps/docs/**",
-    "!packages/cli-test-helpers/**",
-    "!tools/**",
-    // Last match wins across the whole list: keep bare re-exclusions after every
-    // `!` entry that would otherwise re-include them.
-    "apps/cli/src/shared/cli/bin.ts",
-    "apps/cli/src/shared/compute/stacks/**",
-    "apps/cli/src/shared/feedback/database.types.ts",
-    "apps/cli/src/command-internal/db-bootstrap/local-db-running.ts",
-    "packages/api/src/generated/contracts.ts"
-  ]
-}
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 51bff7da6a..f48e4f2a84 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -1,15 +1,28 @@
 {
-  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "$schema": "./node_modules/@effect/tsgo/oxlint-schema.json",
+  "extends": ["./node_modules/@effect/tsgo/oxlint-presets/recommended.json"],
   "options": {
     "typeAware": true,
     "denyWarnings": true
   },
   "ignorePatterns": [
+    /* Reference submodules, populated by `repos:install`. */
     ".repos",
+    /* Generated from the OpenAPI spec by `packages/api/scripts/generate.ts`. */
+    "packages/api/src/generated/contracts.ts",
     // Generated by `supabase gen types` (see `gen:feedback-types` in apps/cli).
     "apps/cli/src/shared/feedback/database.types.ts",
+    /* Standalone Node shim built with `bun build --target node` that does not use Effect. */
+    "apps/cli/src/shared/cli/bin.ts",
+    // Templates that run inside the user's deployed container, not in the CLI process.
+    "apps/cli/src/shared/compute/stacks",
+    /* Standalone CI automation, not Effect code. `github-scripts-ci.yml` type-checks and tests it. */
+    ".github/scripts",
+    /* Static JSON fixtures served by the e2e replay server. */
     "apps/cli-e2e/fixtures",
+    /* Test fixtures and golden snapshots. */
     "**/testdata",
+    /* Build, coverage and docs output. */
     "**/dist",
     "**/coverage",
     "**/.next",
@@ -51,11 +64,7 @@
       "excludeFiles": [
         "apps/cli/src/**/*.test.ts",
         "apps/cli/src/shared/config/cli-config-provider.layer.ts",
-        "apps/cli/src/shared/config/cli-config-env.ts",
-        // Standalone node shim built with `bun build --target node`; it cannot import effect.
-        "apps/cli/src/shared/cli/bin.ts",
-        // Templates that run inside the user's deployed container, not in the CLI process.
-        "apps/cli/src/shared/compute/stacks/**"
+        "apps/cli/src/shared/config/cli-config-env.ts"
       ],
       "rules": {
         "no-restricted-properties": [
@@ -78,15 +87,6 @@
         ]
       }
     },
-    {
-      // `.github/scripts` is the only `bun:test` consumer; `@types/bun`'s shared `Matchers<T>`
-      // types `.rejects.toThrow(...)` as returning `void`, even though it must be awaited at
-      // runtime. Removing the `await` would make the assertion racy.
-      "files": [".github/scripts/**"],
-      "rules": {
-        "typescript/await-thenable": "off"
-      }
-    },
     {
       // The namespace owns paths, leases, artifact pins, and port reservations; everywhere
       // in the repo, outside `src/namespace/**` itself, reaches that state through
@@ -118,8 +118,6 @@
         "apps/cli/src/**/*.test.ts",
         "apps/cli/src/shared/config/cli-config-provider.layer.ts",
         "apps/cli/src/shared/config/cli-config-env.ts",
-        "apps/cli/src/shared/cli/bin.ts",
-        "apps/cli/src/shared/compute/stacks/**",
         "apps/cli/src/cli/complete.ts",
         "apps/cli/src/command-internal/colors.ts",
         "apps/cli/src/command-internal/db-config.parse.ts",
@@ -574,6 +572,13 @@
           }
         ]
       }
+    },
+    {
+      /* The Docker Engine probe needs `node:http`'s `socketPath` for unix and npipe sockets. */
+      "files": ["apps/cli/src/command-internal/db-bootstrap/local-db-running.ts"],
+      "rules": {
+        "effecttsgo/node-builtin-import": "off"
+      }
     }
   ]
 }
diff --git a/AGENTS.md b/AGENTS.md
index 3afcece062..ad5787f493 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,7 +14,7 @@ Bun monorepo with workspaces under `apps/` and `packages/`. `pnpm` is the packag
 
 Use an existing TypeScript/Bun workspace, especially `packages/api`, as the package-structure
 reference. Published `apps/cli` and `packages/config` are not private; `apps/docs` and
-`packages/cli-*` have their own shapes. Generic lint, format, and unused-code tooling is
+`packages/cli-*` have their own shapes. Lint, format, and unused-code tooling is
 root-owned.
 
 ### Config Naming Vocabulary
@@ -35,8 +35,10 @@ all TypeScript runtime code in Effect. Promise-returning APIs are allowed only a
 for consumers that do not use Effect.
 The skill is authoritative for Effect coding practices when repository instructions conflict.
 
-Effect linting uses oxlint via `.oxlintrc.effect.json`; run `pnpm lint:effect:check` or
-`pnpm lint:effect:fix` from the repository root.
+Effect linting is part of the repo lint (`.oxlintrc.json` extends the Effect oxlint preset); run
+`pnpm lint:check` or `pnpm lint:fix` from the repository root; `lint:fix` also applies suggestion
+fixes, so review its diff. `ignorePatterns` keeps `.github/scripts`, the npm launcher shim, compute
+stack templates and the generated API contracts and feedback types out of the lint.
 
 Instrument by default: when you add or change code that does I/O (HTTP, SQL, filesystem beyond a
 small read, child processes, containers, waits) or millisecond-scale work, give it a named span
@@ -67,9 +69,9 @@ Keep the local feedback loop fast; full CI runs for ready PRs targeting `develop
 Use `pnpm test` only when its scope fits the change; the CLI's aggregate script includes full E2E,
 so use `pnpm run test:unit` and `pnpm run test:integration` with affected test files locally.
 When repo-wide validation is warranted, use root `pnpm check:all` or `pnpm fix:all`. These are the
-repo-wide quality entrypoints: `check:all` runs generic and Effect lint, format, knip, type, and
+repo-wide quality entrypoints: `check:all` runs lint, format, knip, type, and
 GitHub Actions workflow checks (jactionlint and shellcheck, installed by mise); `fix:all` applies
-generic and Effect lint, format, and knip fixes. Do not use production `as` casts to silence type
+lint, format, and knip fixes. Do not use production `as` casts to silence type
 errors.
 
 Use root Turbo entrypoints for live and auxiliary workflows:
diff --git a/apps/cli-e2e/AGENTS.md b/apps/cli-e2e/AGENTS.md
index 0b75112979..0ee5456bfc 100644
--- a/apps/cli-e2e/AGENTS.md
+++ b/apps/cli-e2e/AGENTS.md
@@ -80,7 +80,7 @@ The `workspace` fixture is what triggers scenario setup — if you destructure `
 
 Always return `runE2e(...)` from the body: Vitest does not run a returned Effect, so the harness fails a test that requests `run` or `runNoProjectId` and passes without executing it. A custom runner added with `testBehaviour.extend` gets the same check by wrapping its CLI Effect in `runGuard.track(...)`, as `stackRun` does. Pass the test's `signal` so a Vitest timeout interrupts the body.
 
-This workspace is under the Effect lint (`.oxlintrc.effect.json`, warnings are errors), which rejects `async` test bodies, global `fetch`, `process.env` and `JSON.parse` in Effect code. Decode JSON stdout with `decodeJsonOutput(schema)(result.stdout)`, which reports a stdout excerpt on failure.
+This workspace is under the Effect lint (`.oxlintrc.json`, warnings are errors), which rejects `async` test bodies, global `fetch`, `process.env` and `JSON.parse` in Effect code. Decode JSON stdout with `decodeJsonOutput(schema)(result.stdout)`, which reports a stdout excerpt on failure.
 
 Available fixtures:
 
diff --git a/apps/cli-e2e/fixtures/pg/toast-sizes.json b/apps/cli-e2e/fixtures/pg/toast-sizes.json
new file mode 100644
index 0000000000..296e33254f
--- /dev/null
+++ b/apps/cli-e2e/fixtures/pg/toast-sizes.json
@@ -0,0 +1,15 @@
+{
+  "columns": [
+    "name",
+    "total_size",
+    "heap_size",
+    "toast_size",
+    "toast_live_chunks",
+    "toast_dead_chunks",
+    "toast_dead_pct",
+    "last_autovacuum",
+    "last_vacuum"
+  ],
+  "typeOids": [25, 25, 25, 25, 20, 20, 1700, 25, 25],
+  "rows": [["public.documents", "4200 MB", "800 MB", "3400 MB", "250000", "18000", "6.7", "2026-04-23 12:00", ""]]
+}
diff --git a/apps/cli-e2e/fixtures/scenarios/inspect-db-toast-sizes-exits-non-zero-on-connection-refused/interactions.json b/apps/cli-e2e/fixtures/scenarios/inspect-db-toast-sizes-exits-non-zero-on-connection-refused/interactions.json
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/apps/cli-e2e/fixtures/scenarios/inspect-db-toast-sizes-exits-non-zero-on-connection-refused/interactions.json
@@ -0,0 +1 @@
+[]
diff --git a/apps/cli-e2e/fixtures/scenarios/inspect-db-toast-sizes-renders-query-results-as-a-table/interactions.json b/apps/cli-e2e/fixtures/scenarios/inspect-db-toast-sizes-renders-query-results-as-a-table/interactions.json
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/apps/cli-e2e/fixtures/scenarios/inspect-db-toast-sizes-renders-query-results-as-a-table/interactions.json
@@ -0,0 +1 @@
+[]
diff --git a/apps/cli-e2e/src/tests/inspect.e2e.test.ts b/apps/cli-e2e/src/tests/inspect.e2e.test.ts
index 12f3e4d9d2..441b3888a3 100644
--- a/apps/cli-e2e/src/tests/inspect.e2e.test.ts
+++ b/apps/cli-e2e/src/tests/inspect.e2e.test.ts
@@ -29,6 +29,7 @@ const SUBCOMMANDS = [
   { name: "vacuum-stats", fixtureKey: "vacuum-stats", assertValue: "public.events" },
   { name: "table-stats", fixtureKey: "table-stats", assertValue: "public.orders" },
   { name: "traffic-profile", fixtureKey: "traffic-profile", assertValue: "sessions" },
+  { name: "toast-sizes", fixtureKey: "toast-sizes", assertValue: "public.documents" },
 ] as const;
 
 describe("inspect:flags", () => {
diff --git a/apps/cli/AGENTS.md b/apps/cli/AGENTS.md
index 7f16660f9a..255aa73a61 100644
--- a/apps/cli/AGENTS.md
+++ b/apps/cli/AGENTS.md
@@ -271,6 +271,11 @@ Keep CLI tests hermetic: real filesystem layers that use `RuntimeInfo.homeDir` o
 or credentials layers also use `isolatedHomeLayer` so ambient `SUPABASE_HOME`, `SUPABASE_PROFILE`,
 and tokens cannot leak.
 
+Cross-backend consumer behavior lives in `tests/contract/`: `cases.ts` holds supabase-js cases per
+service that run unchanged against legacy, stack/container and stack/native, one
+`contract.<setup>.integration.test.ts` runner per setup. A parity fix adds the case it makes pass
+there; a new service adds its case list next to the others.
+
 Use `*.unit.test.ts` for pure logic and narrow edge cases, `*.integration.test.ts` for handlers and
 service behavior with realistic layered replacements, `*.e2e.test.ts` for local subprocess and
 Docker-stack behavior, and `*.live.test.ts` only when the command reaches the real platform or
diff --git a/apps/cli/bench/workloads.full.json b/apps/cli/bench/workloads.full.json
index 90fef53a28..0b17661da1 100644
--- a/apps/cli/bench/workloads.full.json
+++ b/apps/cli/bench/workloads.full.json
@@ -48,7 +48,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 90
+      "estimatedSeconds": 220
     },
     {
       "id": "db-query",
@@ -61,7 +61,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 90
+      "estimatedSeconds": 220
     },
     {
       "id": "db-reset",
@@ -90,7 +90,7 @@
       "warmup": 1,
       "traceRuns": 1,
       "timeoutSeconds": 120,
-      "estimatedSeconds": 60
+      "estimatedSeconds": 180
     },
     {
       "id": "gen-types-small",
@@ -104,7 +104,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 90
+      "estimatedSeconds": 220
     },
     {
       "id": "gen-types-medium",
@@ -118,7 +118,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 90
+      "estimatedSeconds": 220
     },
     {
       "id": "gen-types-large",
@@ -132,7 +132,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 100
+      "estimatedSeconds": 250
     },
     {
       "id": "db-diff-cold",
@@ -183,7 +183,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 100
+      "estimatedSeconds": 250
     },
     {
       "id": "db-lint",
@@ -197,7 +197,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 90
+      "estimatedSeconds": 220
     },
     {
       "id": "migration-up",
@@ -239,7 +239,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 90
+      "estimatedSeconds": 220
     },
     {
       "id": "stack-start-docker",
@@ -266,7 +266,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 60
+      "estimatedSeconds": 150
     },
     {
       "id": "stack-stop-docker",
@@ -294,7 +294,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 60
+      "estimatedSeconds": 150
     },
     {
       "id": "stack-db-reset-docker",
@@ -336,7 +336,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 60
+      "estimatedSeconds": 150
     },
     {
       "id": "stack-stop-native",
@@ -364,7 +364,7 @@
       "runs": 10,
       "warmup": 1,
       "traceRuns": 2,
-      "estimatedSeconds": 60
+      "estimatedSeconds": 150
     },
     {
       "id": "stack-db-reset-native",
diff --git a/apps/cli/docs/analytics.md b/apps/cli/docs/analytics.md
index fe808b4684..f56f6bc8c3 100644
--- a/apps/cli/docs/analytics.md
+++ b/apps/cli/docs/analytics.md
@@ -78,8 +78,12 @@ sanitized error classification:
 - `has_suggestion`
 - `suggestion_type`
 - `suggested_command` (only when the remediation is an allowlisted command)
+- `config_key` (only on `invalid_config` failures from config resolution: the failing config key
+  path, such as `inbucket` or `auth.email.smtp.port`, comma-joined when several removed keys fail;
+  keys only, never values, file paths or user-chosen names, which collapse to their nearest known
+  parent key)
 
-These values come exclusively from the closed taxonomy in
+Apart from `config_key`, these values come exclusively from the closed taxonomy in
 `src/shared/telemetry/error-actionability.ts` — never from raw error text —
 and the KPI query semantics (strict recovery, repeat errors, internal/unknown
 bug rate) are documented there in `CliErrorActionabilityMetricDefinitions`.
@@ -101,6 +105,15 @@ Local-runtime commands also carry properties that split error rates by runtime:
 - `orioledb` (boolean) once the command resolves local database config, `true` when the project
   selects an OrioleDB image (`db.orioledb_version` on a 15/17 project). It describes local config
   only; for `--remote` targets it says nothing about the remote database
+- `serve_end_reason` on the Docker-runtime `functions serve`, set once its final outcome is known:
+  `signal` (the CLI received a shutdown signal), `container_stopped` (an external supervisor
+  stopped the Edge Runtime container, e.g. `supabase stop`), `container_exited` (the container
+  exited on its own with code 0), `container_removed` (the container disappeared), or
+  `container_crashed` (the container exited with a crash code, which also fails the command). A
+  restart records nothing; only the final end does
+- `edge_runtime_exit_code` (number) alongside `serve_end_reason` when the container's exit code is
+  known: its stop code for `container_stopped`, `0` for `container_exited`, its crash code for
+  `container_crashed`
 
 Flag capture is intentionally conservative: `flags` records only flags changed on the command
 line, and redacts each value unless it is boolean, a choice flag, or listed in the command's
diff --git a/apps/cli/docs/compute-commands.md b/apps/cli/docs/compute-commands.md
index ae8b3a4395..d755a93c1a 100644
--- a/apps/cli/docs/compute-commands.md
+++ b/apps/cli/docs/compute-commands.md
@@ -39,6 +39,12 @@ When enabled, the CLI exposes:
 - `supabase compute logs`
 - `supabase compute delete`
 
+`supabase compute logs` remains available until v4 with its existing `--tail`,
+`--kind`, and `-f/--follow` options. It prints a deprecation warning on stderr.
+For the new log browser, read Compute logs with `supabase logs --remote --service compute`. Use
+`--resource <name>` to select an application and `--kind app|requests|builds` to
+select its log stream. Press `L` in the interactive browser to load more logs.
+
 Compute source directories live under `supabase/compute/<name>/`.
 
 `compute new` edits TOML configuration. It refuses projects whose authoritative
diff --git a/apps/cli/docs/release-process.md b/apps/cli/docs/release-process.md
index 55cc60a409..7ade1efbf7 100644
--- a/apps/cli/docs/release-process.md
+++ b/apps/cli/docs/release-process.md
@@ -213,7 +213,7 @@ Production releases live in a single `[.github/workflows/release.yml](../../../.
 | next        | push: next (after `Test next` passes) | `next`        | none                                    | prerelease              | `X.Y.Z-next.N` |
 | maintenance | manual dispatch on a `v<N>.x` ref     | `v<N>.stable` | `supabase@<N>` / `supabase-v<N>-stable` | published, never latest | `N.Y.Z`        |
 
-`beta` auto-publishes on every merge to `develop` (CLI). `stable` auto-publishes after a develop→main fast-forward, which itself happens when the weekly `[deploy.yml](../../../.github/workflows/deploy.yml)` cron PR is approved (the FF push to `main` re-fires `release.yml` via the `push: branches: [main]` trigger). `next` auto-publishes on every push to the `next` branch, and `maintenance` is dispatched by hand (see [Maintenance lines](#maintenance-lines)).
+`beta` auto-publishes on every merge to `develop` (CLI). `stable` auto-publishes after a develop→main fast-forward, which itself happens when the weekly `[deploy.yml](../../../.github/workflows/deploy.yml)` cron PR is approved (the FF push to `main` re-fires `release.yml` via the `push: branches: [main]` trigger). `next` auto-publishes on every push to the `next` branch that carries commits beyond `develop` (see [The `next` channel](#the-next-channel)), and `maintenance` is dispatched by hand (see [Maintenance lines](#maintenance-lines)).
 
 Versions are computed by `cycjimmy/semantic-release-action` from the first line of each squash commit (the PR title). Conventional commit titles use `feat:` → minor, `fix:`, `perf:`, or `revert:` → patch, and `!` after the type or scope (`feat!:` / `fix(scope)!:`) → major. Commit bodies, including `BREAKING CHANGE` notes, are ignored for version calculation. The `release` config lives in `apps/cli/package.json`: `develop` is a `beta` prerelease branch, `next` is a `next` prerelease branch, `main` emits plain `X.Y.Z`, and a wildcard entry `v+([0-9]).x` turns every `v<N>.x` branch into a maintenance line on the `v<N>.stable` channel (the entry is ignored while no such branch exists).
 
@@ -245,7 +245,7 @@ flowchart LR
 flowchart TD
     pushDev[push: develop] --> plan
     pushMain[push: main] --> plan
-    pushNext[push: next] --> testNext["Test next<br/>test.yml (reusable)"]
+    pushNext[push: next] -->|"only with commits beyond develop"| testNext["Test next<br/>test.yml (reusable)"]
     testNext -->|passes| plan
     pr["approved PR<br/>develop→main, next→develop, sync/*"] --> ff["fast-forward.yml<br/>checks + git push via App token"]
     ff --> pushMain
@@ -281,11 +281,14 @@ gh workflow run release.yml \
 
 Auto-trigger paths leave `version` empty: semantic-release computes it from commits since the last tag. A dispatch with an empty `version` does the same for the dispatched ref, and fails if the channel does not match the ref or if semantic-release computes no release.
 
+The `develop` and `next` plans wait, up to 120 minutes, until the `publish` job of any in-flight `Release` run on `main` has finished before reading tags: that job pushes the stable tag after the npm publish, so a prerelease planned earlier would miss it and compute a stale version. The rest of the `main` run (Homebrew, Scoop, smoke tests) does not delay the plan. If the wait times out, the plan job fails; re-run it once that job has finished.
+
 The plan job refuses a dispatch when:
 
 - `channel=next` is not on the `next` ref, or `channel=maintenance` is not on a `v<N>.x` ref;
 - `next` or a `v<N>.x` ref is dispatched with `beta` or `stable` (those refs release only their own channel);
 - `channel=stable` is not a dry run and the ref is not `main` (any other ref, including `hotfix/*`, may only dry-run);
+- `channel=next` is dispatched while `next` has no commits beyond `develop` (see [The `next` channel](#the-next-channel));
 - a non-empty `version` is not semver (no `v` prefix, no build metadata) or does not match the channel: `next` needs `X.Y.Z-next.N`, `beta` needs `X.Y.Z-beta.N`, and `stable` and `maintenance` need plain `X.Y.Z`.
 
 ### Hotfix release flow
@@ -315,9 +318,11 @@ Do not use `workflow_dispatch dry_run=false` as a hotfix path. A stable release
 
 `next` is one long-lived branch reused for every future major. Breaking PRs target `next` instead of `develop`, with a `type(scope)!:` title; they use the same merge queue, required checks, and review as `develop`. The `Lint Pull Request` check fails any `!` title whose base is not `next`, with one exception: the `next` → `develop` cut PR.
 
-Every push to `next` first runs the full `test.yml` suite (the `Test next` job in `release.yml`). Only when it passes does the pipeline plan and publish `X.Y.Z-next.N` to the npm `next` dist-tag and a GitHub prerelease. `next` has no Homebrew, Scoop, or Linear publication. It does get the raw semantic-release changelog on its GitHub Release (`backfill-release-notes`); the LLM-proposed notes PR is stable-only, and `apply-release-notes` still accepts `-next` tags for a manual proposal.
+Every push to `next` that carries commits beyond `develop` first runs the full `test.yml` suite (the `Test next` job in `release.yml`). Only when it passes does the pipeline plan and publish `X.Y.Z-next.N` to the npm `next` dist-tag and a GitHub prerelease. `next` has no Homebrew, Scoop, or Linear publication. It does get the raw semantic-release changelog on its GitHub Release (`backfill-release-notes`); the LLM-proposed notes PR is stable-only, and `apply-release-notes` still accepts `-next` tags for a manual proposal.
+
+`next` publishes use the `next` prerelease identifier so versions never collide with `beta` on npm after a cut. After a stable release, semantic-release on `next` computes past it on the following push with commits beyond `develop`. The npm `next` dist-tag is not moved by the stable release, because publishing is OIDC-only and `npm dist-tag add` needs a token the pipeline does not hold; `supabase@next` catches up on the next release from `next`, which needs commits beyond `develop`. A release can be re-cut by dispatching `release.yml` with `channel=next` on the `next` ref.
 
-`next` publishes use the `next` prerelease identifier so versions never collide with `beta` on npm after a cut. After a stable release, semantic-release on `next` computes past it on the following push. The npm `next` dist-tag is not moved by the stable release, because publishing is OIDC-only and `npm dist-tag add` needs a token the pipeline does not hold; `supabase@next` catches up on the next push to `next`. A release can be re-cut by dispatching `release.yml` with `channel=next` on the `next` ref.
+A push to `next` with no commits beyond `develop` skips `Test next` and the release. That is the usual state between majors, because the sync fast-forwards `next` onto `develop`. semantic-release reads channel notes per commit ([semantic-release#4073](https://github.com/semantic-release/semantic-release/issues/4073)), so a `next` tag on a commit `develop` already tagged misreads both tags. `supabase@next` stays on the last `next` release until a breaking change lands on `next`, and `supabase@beta` carries the newest code meanwhile. A `channel=next` dispatch is refused in that state.
 
 The nightly live e2e run covers `main`, `develop`, and `next`.
 
@@ -529,7 +534,7 @@ Both updaters run automatically from `release-shared.yml`'s `publish-homebrew` a
 
 Once the channels are live, two reusable workflows run automatically (last in `release-shared.yml`, non-gating — by the time they run the artifacts are already published, so a failure surfaces as a red post-release signal rather than blocking distribution):
 
-- `[setup-cli-smoke-test.yml](../../../.github/workflows/setup-cli-smoke-test.yml)` (`setup-cli-smoke` job) — installs the released version through `supabase/setup-cli` v1 and v2 (the GitHub Release download path) and v3 (the npm package) on Linux, macOS, Windows, and Alpine.
+- `[setup-cli-smoke-test.yml](../../../.github/workflows/setup-cli-smoke-test.yml)` (`setup-cli-smoke` job) — installs the released version through `supabase/setup-cli` v1 and v2 (the GitHub Release download path) and v3 (the npm package) on Linux, macOS, Windows, and Alpine. v3 waits on each runner until npm serves the version (up to 15 minutes) and fails unless setup-cli installed from npm; one ubuntu job forces the GitHub release fallback.
 - `[verify-install-channels.yml](../../../.github/workflows/verify-install-channels.yml)` (`verify-install-channels` job) — runs a **real** `brew install` (macOS **and** Linux, so both the `on_macos` and `on_linux` stanzas of the formula are exercised), `scoop install`, and `curl|bash` install of the **published** install script (fetched from the release asset, not the repo checkout) against the just-published Homebrew tap, Scoop bucket, and GitHub Release. Each leg then asserts `supabase --version` matches and runs `supabase --help` to exercise the actual command tree. brew, scoop, and the install script each verify the published `sha256`/`hash` against the downloaded tarball, so this is the signal that would have caught CLI v2.107.0 (where the brew/scoop manifests shipped checksums that did not match the release tarballs and every `brew install` / `scoop install` failed). It only runs for `beta`/`stable`/`maintenance` (the channels that publish brew/scoop) and can be dispatched manually against any already-published version via the Actions tab.
 
 ### Code signing (macOS)
diff --git a/apps/cli/docs/stack-commands.md b/apps/cli/docs/stack-commands.md
index e26d1f5ed9..d2128923cc 100644
--- a/apps/cli/docs/stack-commands.md
+++ b/apps/cli/docs/stack-commands.md
@@ -226,20 +226,25 @@ commands retain their existing behavior.
 `functions serve` requires a running project stack. It attaches to the existing Functions member,
 waking it when needed. If Functions was excluded, it creates a temporary standalone Functions
 instance on the stack's API listener without changing the saved composition. Ctrl-C destroys that
-temporary instance; an existing member remains available. `--no-verify-jwt` and `--env-file` apply
-for the serving session and the previous configuration is restored on exit. Ordinary code edits
+temporary instance; an existing member remains available. On a running stack, any difference
+between the configuration serve resolves (env files, per-function `.env`, `[functions.<name>]`
+settings, `--env-file`, `--debug`, `--no-verify-jwt`) and the saved one restarts Functions for
+the serving session, and the saved configuration is restored on exit. Edits made while serving
+apply on the next `functions serve`, because the stack backend does not watch files. Ordinary code edits
 are picked up by the next invocation without a runtime restart. Import-map and inspector flags
-and multiline environment values are currently unsupported on this backend. Normal exit owns cleanup; forcibly killing the CLI
+are currently unsupported on this backend. Normal exit owns cleanup; forcibly killing the CLI
 cannot guarantee restoration or removal of its temporary instance. Concurrent override sessions
 for the same Functions instance are unsupported. Cleanup waits for submitted lifecycle operations;
 additional signals do not force it to abandon cleanup. Restoration restores configuration and keeps
 the service running; it does not return it to a sleeping state.
 
-Stack mode reads the shared `supabase/functions/.env` file when creating Functions; `--env-file`
-replaces those custom values for the session. A normal `start` applies changes to the shared file
-and restores default JWT verification on the same Functions instance. Per-function
-`.env` files are not loaded. Reserved
-`SUPABASE_*` values in these files are ignored because the runtime supplies them. With
+Stack mode resolves the Functions env like legacy `start` and `functions serve`: the shared
+`supabase/functions/.env` file overrides `[edge_runtime.secrets]`, and `functions serve` also
+reads each enabled function's own `.env` on every invocation; `--env-file` replaces those files
+for the session. Multiline values are supported. `start` applies changes to the shared file and
+restores default JWT verification only when it creates or replans the stack; a `start` against a
+running stack keeps the current Functions configuration. Reserved `SUPABASE_*`
+values in these files are skipped with a warning because the runtime supplies them. With
 `--output-format stream-json`, readiness emits a result containing the instance ID and URL,
 followed by live log events.
 
@@ -275,6 +280,31 @@ lint transaction (always rolled back). It does not launch a client binary.
 
 ## Reading stack logs
 
+`supabase logs` reads retained stdout/stderr from composition members and `gateway`
+request lines from the shared API port. Interactive terminals open a browser; press `L`
+to load more records. Pipes and machine output perform one finite read and exit.
+
+Select `--stack <name>` or `--stack-id <id>`. Repeat `--service <kind>` to select
+services, use `--service postgres` for the database, or `--resource <instance-id>`
+for one instance. `--service gateway` reads only request lines. Reads work while
+the stack is stopped and never start an owner or service.
+
+`--limit N` (default 100, maximum 1000) selects the initial newest lines. `--since`
+accepts a duration (`10m`, `1h30m`), an ISO-8601 time, or `start` for each service's
+latest launch. The default is the last hour. The requested lower bound stays fixed
+when you load newer logs, and the header shows the captured end of each successful
+load. Failed loads preserve the displayed rows and window.
+
+Use `--output-format json` for an array of retained records, or `stream-json` for
+`log-entry` and `log-marker` events. Each event's `data` preserves the retained
+record, including instance IDs, launch IDs, and positions. Missing stacks and
+unmatched services fail with status 1. Browser interruption exits 130.
+
+The deprecated `supabase stack logs` keeps its existing `--tail` and `--follow`
+behavior until removal in v4.
+
+### Legacy stack logs
+
 `supabase stack logs` prints the retained stdout/stderr of composition members, plus
 the `gateway` request lines of the shared API port, and exits; `-f/--follow` then
 streams new lines until interrupted. Select `--stack <name>` or `--stack-id <id>`; the
@@ -296,6 +326,9 @@ prints the history as one array and does not accept `--follow`. Missing stacks,
 unmatched services, and `--follow` without an owner fail with status 1; interruption
 exits 130.
 
+The command emits a deprecation warning on stderr and remains available until v4.
+Stream JSON also includes a `data` object containing the original retained record.
+
 ## Data and configuration
 
 The backends own separate state and databases. Enabling the flag does not import, copy, seed from,
@@ -352,8 +385,8 @@ format, or comes from a newer CLI always fails the start. The lock's JSON Schema
 `https://supabase.com/schemas/supabase-lock/v1.json`. A database with initialized data keeps
 its build: any change other than a new `-rN` revision of the same build (a different upstream build,
 release line or major) is refused. The refusal offers to keep the data by pinning the recorded build with
-`[local.services.database] version`, setting `[db] major_version` back when the major differs and removing any
-`[db] orioledb_version` when an OrioleDB build is requested, or to run `supabase stack destroy` and recreate it. `supabase link`
+`local.services.database.version` in your config file, setting `db.major_version` back when the major differs and removing any
+`db.orioledb_version` when an OrioleDB build is requested, or to run `supabase stack destroy` and recreate it. `supabase link`
 and `supabase stack update` warn when the versions they lock would be refused by an existing stack's
 data. A database that never initialized adopts the change. See the [`start` side
 effects](../src/commands/experimental/stack/start/SIDE_EFFECTS.md#service-versions-and-the-lock) for
@@ -441,7 +474,7 @@ unavailable fails with `StackStorageUnavailableError`, guiding the user to run `
 status`/`supabase stack restart`, or `supabase start` when the stack has never been configured.
 Missing Storage HTTP endpoints fail with `StackStorageCapabilityError`, as do other Storage
 capability failures. A stack-gateway 502/503 encountered while Storage activates is reported as
-`StackStorageCapabilityError` guiding the user to `supabase stack logs` then `supabase stack
+`StackStorageCapabilityError` guiding the user to `supabase logs --service storage` then `supabase stack
 restart`, not as a raw status body — but only for a local target; a `--remote` failure passes
 through unchanged. All of these failures exit `1` for
 `storage`/`seed buckets`, and no HTTP
diff --git a/apps/cli/docs/supabase/inspect/db-toast-sizes.md b/apps/cli/docs/supabase/inspect/db-toast-sizes.md
new file mode 100644
index 0000000000..2a0debf6e9
--- /dev/null
+++ b/apps/cli/docs/supabase/inspect/db-toast-sizes.md
@@ -0,0 +1,13 @@
+# db-toast-sizes
+
+This command displays TOAST table sizes and dead chunk counts for every ordinary user table that has a TOAST relation (materialized views and partitioned parents are not listed). When a row exceeds ~2 kB, Postgres compresses and/or moves its largest variable-length values (TEXT, JSONB, bytea) out-of-line into a companion TOAST table. TOAST Size includes the TOAST index; Total Size also includes the table's own indexes. Autovacuum runs on the TOAST table independently from the main heap, so it can accumulate dead chunks even when the parent table looks healthy by its own dead-tuple count.
+
+A table that appears fine by `vacuum-stats` or `bloat` alone can still have significant TOAST bloat that wastes disk space and slows reads. High `TOAST Dead %` values indicate that autovacuum is not keeping up with the TOAST table and a manual `VACUUM` may be needed.
+
+```
+         TABLE          │ TOTAL SIZE │ HEAP SIZE │ TOAST SIZE │ TOAST LIVE CHUNKS │ TOAST DEAD CHUNKS │ TOAST DEAD % │  LAST AUTOVACUUM   │ LAST VACUUM
+────────────────────────┼────────────┼───────────┼────────────┼───────────────────┼───────────────────┼──────────────┼────────────────────┼─────────────
+ public.documents       │ 4350 MB    │ 800 MB    │ 3400 MB    │            250000 │             18000 │          6.7 │ 2024-03-01 04:12   │
+ public.media_assets    │ 905 MB     │ 120 MB    │ 770 MB     │             80000 │               200 │          0.2 │ 2024-03-02 01:45   │
+ public.messages        │ 365 MB     │ 280 MB    │ 60 MB      │             95000 │                 0 │          0.0 │ 2024-03-02 03:10   │
+```
diff --git a/apps/cli/docs/supabase/inspect/db-xid-age.md b/apps/cli/docs/supabase/inspect/db-xid-age.md
new file mode 100644
index 0000000000..88a8479929
--- /dev/null
+++ b/apps/cli/docs/supabase/inspect/db-xid-age.md
@@ -0,0 +1,13 @@
+# db-xid-age
+
+This command lists user tables sorted by their transaction ID (XID) age, oldest first. PostgreSQL's transaction ID space wraps around at about 2.1 billion transactions. Once a table's XID age passes `autovacuum_freeze_max_age` (200 million by default), autovacuum forces a freeze on it; if the age keeps growing toward the wraparound limit, PostgreSQL stops assigning new transaction IDs to protect the data. `transactions_remaining` is the headroom to a 2 billion threshold, kept below the real limit as a safety margin.
+
+Tables with an XID age above 1.5 billion transactions (`transactions_remaining` below 500 million) should be treated as urgent: manual `VACUUM FREEZE` or a tuned autovacuum run is needed. The list covers ordinary user tables only: it leaves out materialized views, TOAST tables and Supabase-managed schemas, so it does not show the database-wide age. Check `SELECT age(datfrozenxid) FROM pg_database WHERE datname = current_database()` for that.
+
+```
+          TABLE          │  XID AGE  │ TRANSACTIONS REMAINING
+─────────────────────────┼───────────┼────────────────────────
+ public.events           │ 800000000 │           1200000000
+ public.users            │ 500000000 │           1500000000
+ public.sessions         │ 120000000 │           1880000000
+```
diff --git a/apps/cli/docs/supabase/login.md b/apps/cli/docs/supabase/login.md
index 5dbc7df448..66aef424d2 100644
--- a/apps/cli/docs/supabase/login.md
+++ b/apps/cli/docs/supabase/login.md
@@ -7,3 +7,5 @@ Your access token is stored securely in native credentials storage (the operatin
 > If this behavior is not desired, such as in a CI environment, you may skip login by specifying the `SUPABASE_ACCESS_TOKEN` environment variable in other commands.
 
 The Supabase CLI uses the stored token to access Management APIs for projects, functions, secrets, etc.
+
+> The Management API client retries retryable failures up to 5 times by default. Set `SUPABASE_API_MAX_RETRIES` to change that. It counts retries after the first attempt, so `0` sends each request once.
diff --git a/apps/cli/docs/tracing-monitoring.md b/apps/cli/docs/tracing-monitoring.md
index cdc4b92766..c42cee4b1e 100644
--- a/apps/cli/docs/tracing-monitoring.md
+++ b/apps/cli/docs/tracing-monitoring.md
@@ -178,9 +178,14 @@ the timing ranges, API calls per command, and the slowest phases. It reports:
   responses (the build did not follow the recorded scenario), non-zero or differing exit codes,
   missing traces, and too few runs for a timing verdict. Other count changes, such as 1 to 2 calls, appear in the API calls table with the
   changed endpoints but are not flagged.
-- Wall time: base ("before") and branch ("after") medians and ranges. A verdict of slower or faster needs the branch
-  median outside the base min-max range, a change of at least 5 percent and 5 ms, and at least 5
-  measured runs; otherwise it reads "within noise", or "not comparable" when a build failed.
+- Wall time: base ("before") and branch ("after") medians and ranges. A verdict of slower or faster needs a
+  change of at least 5 percent and 5 ms that is also larger than 1.5 times the wider build's
+  interquartile range, a branch median beyond the base min-max range for run-scoped workloads, and
+  at least 5 measured runs; otherwise it reads "within noise", or "not
+  comparable" when a build failed. Block-scoped workloads record a block index per launch and, from
+  three paired blocks, judge block medians instead: the median per-block change must pass the same
+  tests and more than half of the blocks must move the same way past the floor, so one outlier
+  stack session can neither flag nor hide a change.
   Thresholds are named constants in `bench-report.ts`.
 - API calls per workload, base and branch.
 - Phase deltas: the three largest span deltas for each workload with a slower or faster verdict.
@@ -297,7 +302,7 @@ described above:
 | Field                                | Meaning                                                                                                                |
 | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- |
 | `setup`, `teardown`                  | Lists of CLI arguments run untimed with the build under test. `teardown` always runs, even after a failure or timeout. |
-| `setupScope`                         | `run` (default) repeats setup and teardown for every launch; `block` starts one stack per block of five launches.      |
+| `setupScope`                         | `run` (default) repeats setup and teardown for every launch; `block` starts one stack per block of two launches.       |
 | `stack`                              | Sets `SUPABASE_EXPERIMENTAL_STACK=1` on every launch of the workload, the only variable a workload can set.            |
 | `runtime`                            | `docker` or `native`. A stack workload must pass the same `--runtime` to every `stack start`.                          |
 | `fixture`                            | A directory under `apps/cli/bench/fixtures/` copied into the project's `supabase/` directory after `init`.             |
diff --git a/apps/cli/package.json b/apps/cli/package.json
index b4693fbbec..6f2dda5d0e 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -60,7 +60,7 @@
     "@supabase/pg-topo": "1.0.0-alpha.8",
     "@supabase/stack": "workspace:*",
     "@supabase/supabase-js": "catalog:",
-    "@supabase/typegen": "0.3.1",
+    "@supabase/typegen": "0.3.2",
     "@tsconfig/bun": "catalog:",
     "@types/bun": "catalog:",
     "@types/pg": "^8.23.1",
diff --git a/apps/cli/scripts/backfill-release-notes.e2e.test.ts b/apps/cli/scripts/backfill-release-notes.e2e.test.ts
new file mode 100644
index 0000000000..3323fcc37c
--- /dev/null
+++ b/apps/cli/scripts/backfill-release-notes.e2e.test.ts
@@ -0,0 +1,180 @@
+import { BunFileSystem, BunPath } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Layer, Path, Schema } from "effect";
+import { fileURLToPath } from "node:url";
+
+const scriptPath = fileURLToPath(new URL("./backfill-release-notes.ts", import.meta.url));
+const cliPackagePath = fileURLToPath(new URL("../package.json", import.meta.url));
+const analyzerPath = fileURLToPath(new URL("./analyze-commits-title.js", import.meta.url));
+const platformLayer = Layer.mergeAll(BunFileSystem.layer, BunPath.layer);
+
+const decodeCliPackage = Schema.decodeUnknownEffect(
+  Schema.fromJsonString(Schema.Struct({ release: Schema.Unknown })),
+);
+const encodePackage = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown));
+
+const isolatedGit = {
+  GIT_CONFIG_GLOBAL: "/dev/null",
+  GIT_CONFIG_NOSYSTEM: "1",
+  GIT_AUTHOR_NAME: "seed",
+  GIT_AUTHOR_EMAIL: "seed@example.com",
+  GIT_COMMITTER_NAME: "seed",
+  GIT_COMMITTER_EMAIL: "seed@example.com",
+};
+
+const spawn = (argv: ReadonlyArray<string>, cwd: string, env: Record<string, string | undefined>) =>
+  Effect.acquireUseRelease(
+    Effect.sync(() => Bun.spawn([...argv], { cwd, env, stdout: "pipe", stderr: "pipe" })),
+    (child) =>
+      Effect.gen(function* () {
+        const [exitCode, stdout, stderr] = yield* Effect.all(
+          [
+            Effect.promise(() => child.exited),
+            Effect.promise(() => new Response(child.stdout).text()),
+            Effect.promise(() => new Response(child.stderr).text()),
+          ],
+          { concurrency: "unbounded" },
+        );
+        return { exitCode, stdout, stderr };
+      }),
+    (child) =>
+      child.exitCode === null && child.signalCode === null
+        ? Effect.sync(() => child.kill()).pipe(Effect.andThen(Effect.promise(() => child.exited)))
+        : Effect.void,
+  );
+
+interface SeedHistory {
+  readonly git: (...args: ReadonlyArray<string>) => Effect.Effect<string>;
+  readonly commit: (message: string) => Effect.Effect<string>;
+  readonly release: (tag: string, channels: string) => Effect.Effect<void>;
+}
+
+/**
+ * A working repository on `main` with an `origin` bare remote, `v1.0.0` on its first commit and
+ * the history `seed` adds on top. Every branch and tag is pushed, and every release also gets
+ * the per-tag channel note ref the release pipeline pushes.
+ */
+const repositoryWithHistory = (seed: (history: SeedHistory) => Effect.Effect<void>) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const root = yield* fs.makeTempDirectoryScoped({ prefix: "backfill-release-notes-" });
+    const origin = path.join(root, "origin.git");
+    const work = path.join(root, "work");
+    const env = { ...process.env, ...isolatedGit };
+
+    const git = (cwd: string, ...args: ReadonlyArray<string>) =>
+      Effect.gen(function* () {
+        const result = yield* spawn(["git", ...args], cwd, env);
+        expect(result.exitCode, result.stderr).toBe(0);
+        return result.stdout;
+      });
+    const commit = (message: string) =>
+      git(work, "commit", "--quiet", "--allow-empty", "-m", message);
+    const release = (tag: string, channels: string) =>
+      Effect.gen(function* () {
+        yield* git(work, "tag", "-a", tag, "-m", `Release ${tag}`);
+        yield* git(
+          work,
+          "notes",
+          `--ref=semantic-release-${tag}`,
+          "add",
+          "-m",
+          `{"channels":${channels}}`,
+          `${tag}^{commit}`,
+        );
+      });
+
+    const cliPackage = yield* decodeCliPackage(yield* fs.readFileString(cliPackagePath));
+    const packageJson = yield* encodePackage({
+      name: "supabase",
+      version: "0.0.0-automated",
+      repository: { type: "git", url: "https://github.com/supabase/cli" },
+      release: cliPackage.release,
+    });
+    yield* fs.makeDirectory(path.join(work, "apps/cli/scripts"), { recursive: true });
+    yield* fs.writeFileString(path.join(work, "apps/cli/package.json"), `${packageJson}\n`);
+    yield* fs.copyFile(analyzerPath, path.join(work, "apps/cli/scripts/analyze-commits-title.js"));
+
+    yield* git(root, "init", "--quiet", "--bare", "--initial-branch=main", origin);
+    yield* git(work, "init", "--quiet", "--initial-branch=main");
+    yield* git(work, "remote", "add", "origin", origin);
+    yield* git(work, "add", "-A");
+    yield* commit("feat: initial");
+    yield* release("v1.0.0", "[null]");
+
+    yield* seed({ git: (...args) => git(work, ...args), commit, release });
+
+    yield* git(
+      work,
+      "push",
+      "--quiet",
+      "origin",
+      "refs/heads/*:refs/heads/*",
+      "refs/tags/*:refs/tags/*",
+      "refs/notes/*:refs/notes/*",
+    );
+
+    const bunExecutable = Bun.which("bun");
+    if (!bunExecutable) throw new Error("Bun executable not found");
+    const { FORCE_COLOR: _forceColor, NO_COLOR: _noColor, ...inherited } = process.env;
+
+    return {
+      backfill: (tag: string) =>
+        spawn([bunExecutable, scriptPath, "--tag", tag], work, { ...inherited, ...isolatedGit }),
+    };
+  });
+
+/**
+ * `develop` and `next` share the commit that carries both `v1.1.0-beta.1` and `v1.1.0-next.1`
+ * (`next` is fast-forwarded onto `develop`), and `develop` moves on to `v1.1.0-beta.2`.
+ */
+const sharedBetaAndNextHistory = repositoryWithHistory(({ git, commit, release }) =>
+  Effect.gen(function* () {
+    yield* git("switch", "--quiet", "--create", "develop");
+    yield* commit("feat: add shared thing");
+    yield* release("v1.1.0-beta.1", '["beta"]');
+    yield* release("v1.1.0-next.1", '["next"]');
+    yield* git("branch", "next");
+    yield* commit("fix: patch beta");
+    yield* release("v1.1.0-beta.2", '["beta"]');
+  }),
+);
+
+const forcedMaintenanceHistory = repositoryWithHistory(({ git, commit, release }) =>
+  Effect.gen(function* () {
+    yield* commit("feat!: drop the legacy flag");
+    yield* release("v2.0.0", "[null]");
+    yield* git("switch", "--quiet", "--create", "v1.x", "v1.0.0");
+    yield* commit("ci: pin the runner image");
+    yield* release("v1.0.1", '["v1.stable"]');
+  }),
+);
+
+describe("backfill-release-notes.ts on a repository whose beta and next tags share a commit", () => {
+  it.live("backfills the next beta from the beta line instead of the next channel's tags", () =>
+    Effect.gen(function* () {
+      const repository = yield* sharedBetaAndNextHistory;
+
+      const { exitCode, stdout, stderr } = yield* repository.backfill("v1.1.0-beta.2");
+
+      expect(exitCode, stderr).toBe(0);
+      expect(stdout, stderr).toContain("compare/v1.1.0-beta.1...v1.1.0-beta.2");
+      expect(stdout, stderr).toContain("patch beta");
+      expect(stdout, stderr).not.toContain("add shared thing");
+    }).pipe(Effect.provide(platformLayer)),
+  );
+});
+
+describe("backfill-release-notes.ts on a maintenance line", () => {
+  it.live("backfills a forced maintenance release whose commits imply no release", () =>
+    Effect.gen(function* () {
+      const repository = yield* forcedMaintenanceHistory;
+
+      const { exitCode, stdout, stderr } = yield* repository.backfill("v1.0.1");
+
+      expect(exitCode, stderr).toBe(0);
+      expect(stdout, stderr).toContain("compare/v1.0.0...v1.0.1");
+    }).pipe(Effect.provide(platformLayer)),
+  );
+});
diff --git a/apps/cli/scripts/backfill-release-notes.ts b/apps/cli/scripts/backfill-release-notes.ts
index e5b81aed56..265b9b9874 100644
--- a/apps/cli/scripts/backfill-release-notes.ts
+++ b/apps/cli/scripts/backfill-release-notes.ts
@@ -20,11 +20,16 @@
 //            Without it, raw markdown notes are printed to stdout.
 import { BunFileSystem, BunPath } from "@effect/platform-bun";
 import { $ } from "bun";
-import { Console, Data, Effect, FileSystem, Layer, Path, Schema } from "effect";
+import { Array as Arr, Console, Data, Effect, FileSystem, Layer, Path, Schema } from "effect";
 import process from "node:process";
 import { parseArgs } from "node:util";
-import semanticRelease from "semantic-release";
-import { channelForTag, releaseBranchForTag } from "./release-channels.ts";
+import semanticRelease, { type AnalyzeCommitsContext } from "semantic-release";
+import {
+  channelForTag,
+  isInChannelHistory,
+  releaseBranchForTag,
+  releaseTypeBetween,
+} from "./release-channels.ts";
 
 class JsonParseFailed extends Data.TaggedError("JsonParseFailed")<{ readonly cause: unknown }> {}
 
@@ -151,19 +156,6 @@ const main = Effect.gen(function* () {
         $`git -C ${repoRoot} remote get-url origin`.text(),
       )).trim();
 
-      // Notes refs aren't fetched by `git clone`. Pull from the source repo first
-      // (network-free), then from origin so even tags whose notes haven't been
-      // sync'd locally yet are available.
-      yield* shell(() =>
-        $`git -C ${clone} fetch --no-tags --quiet ${repoRoot} +refs/notes/*:refs/notes/*`
-          .nothrow()
-          .quiet(),
-      );
-      yield* shell(() =>
-        $`git -C ${clone} fetch --no-tags --quiet ${originUrl} +refs/notes/*:refs/notes/*`
-          .nothrow()
-          .quiet(),
-      );
       // One fetch per branch: git aborts a multi-ref fetch when any named ref is missing, and `next`
       // may not exist. The `v*.x` glob matches zero or more branches without failing.
       for (const branchSpec of ["main", "develop", "next", "v*.x"]) {
@@ -207,6 +199,13 @@ const main = Effect.gen(function* () {
       for (const ct of coincidentTags) {
         yield* shell(() => $`git -C ${clone} tag -d ${ct}`.quiet().nothrow());
       }
+      const targetChannel = channelForTag(tag);
+      const tagsOutsideChannel = (yield* shell(() => $`git -C ${clone} tag --list`.text()))
+        .split("\n")
+        .filter((t) => t && !isInChannelHistory(t, targetChannel));
+      if (tagsOutsideChannel.length > 0) {
+        yield* shell(() => $`git -C ${clone} tag -d ${tagsOutsideChannel}`.quiet());
+      }
       yield* shell(() => $`git -C ${clone} checkout -B ${branch} ${sha} --quiet`);
 
       // The clone only carries refs/heads/$BRANCH locally; seed the other
@@ -224,23 +223,34 @@ const main = Effect.gen(function* () {
         }
       }
 
-      // semantic-release's notes reader returns channels=[null] for any tag
-      // missing an annotation, and the prerelease filter drops those tags
-      // entirely — walking lastRelease back far enough to drag unrelated commits
-      // into the changelog. Seed a channel note for every reachable tag that
-      // lacks one, inferring the channel from the tag name.
+      // semantic-release reads one channel note per commit (semantic-release/semantic-release#4073),
+      // so the clone keeps only this channel's prereleases and rebuilds one note per tagged
+      // commit from tag names.
       const mergedTagsOut = yield* shell(() =>
         $`git -C ${clone} tag --merged HEAD --sort=v:refname`.text(),
       );
       const mergedTags = mergedTagsOut.split("\n").filter((t) => t && t !== tag);
-      for (const prevTag of mergedTags) {
-        const noteCheck = yield* shell(() =>
-          $`git -C ${clone} notes --ref semantic-release show ${prevTag}`.nothrow().quiet(),
+      const taggedCommits = (yield* shell(() =>
+        $`git -C ${clone} rev-parse ${mergedTags.map((t) => `refs/tags/${t}^{commit}`)}`.text(),
+      ))
+        .split("\n")
+        .filter(Boolean);
+      if (taggedCommits.length !== mergedTags.length) {
+        yield* Console.error(
+          `Resolved ${taggedCommits.length} commits for ${mergedTags.length} tags merged into ${tag}`,
         );
-        if (noteCheck.exitCode === 0) continue;
-        const payload = yield* encodeJson({ channels: [channelForTag(prevTag)] });
+        return yield* Effect.sync(() => process.exit(1));
+      }
+      const channelByCommit = new Map<string, ReturnType<typeof channelForTag>>();
+      for (const [prevTag, commit] of Arr.zip(mergedTags, taggedCommits)) {
+        if (prevTag.includes("-") || !channelByCommit.has(commit)) {
+          channelByCommit.set(commit, channelForTag(prevTag));
+        }
+      }
+      for (const [commit, channel] of channelByCommit) {
+        const payload = yield* encodeJson({ channels: [channel] });
         yield* shell(() =>
-          $`git -C ${clone} notes --ref semantic-release add -f -m ${payload} ${prevTag}^{commit}`.quiet(),
+          $`git -C ${clone} notes --ref semantic-release add -f -m ${payload} ${commit}`.quiet(),
         );
       }
 
@@ -280,10 +290,25 @@ const main = Effect.gen(function* () {
         delete childEnv[key];
       }
 
+      const expected = tag.replace(/^v/, "");
+      // A dispatch `version` can force a release its commits do not imply (e.g. only `ci:` commits).
+      const releaseFloor = {
+        analyzeCommits: (_config: unknown, context: AnalyzeCommitsContext) =>
+          releaseTypeBetween(context.lastRelease.version, expected),
+      };
+      const configuredPlugins = Array.isArray(rootPkg.release?.plugins)
+        ? rootPkg.release.plugins
+        : [];
+
       const result = yield* Effect.tryPromise({
         try: () =>
           semanticRelease(
-            { dryRun: true, noCi: true, repositoryUrl: repoUrl },
+            {
+              dryRun: true,
+              noCi: true,
+              repositoryUrl: repoUrl,
+              plugins: [...configuredPlugins, releaseFloor],
+            },
             {
               cwd: path.join(clone, "apps/cli"),
               env: childEnv,
@@ -299,7 +324,6 @@ const main = Effect.gen(function* () {
         return yield* Effect.sync(() => process.exit(1));
       }
 
-      const expected = tag.replace(/^v/, "");
       if (result.nextRelease.version !== expected) {
         yield* Console.error(
           `semantic-release computed v${result.nextRelease.version} but expected ${tag}; ` +
diff --git a/apps/cli/scripts/bench-cli.integration.test.ts b/apps/cli/scripts/bench-cli.integration.test.ts
index 6744dbe420..0254e056bd 100644
--- a/apps/cli/scripts/bench-cli.integration.test.ts
+++ b/apps/cli/scripts/bench-cli.integration.test.ts
@@ -204,13 +204,21 @@ describe("runWorkloadBench", () => {
         expect(report.base).toHaveLength(6);
         expect(report.branch).toHaveLength(6);
         const boots = calls.filter((call) => call.command === "boot");
-        expect(boots.map((call) => call.build)).toEqual(["base", "branch", "branch", "base"]);
-        expect(calls.filter((call) => call.command === "halt")).toHaveLength(4);
-        // One warmup plus five measured launches share the first block's stack.
+        expect(boots.map((call) => call.build)).toEqual([
+          "base",
+          "branch",
+          "branch",
+          "base",
+          "base",
+          "branch",
+        ]);
+        expect(calls.filter((call) => call.command === "halt")).toHaveLength(6);
+        expect(report.base.map((sample) => sample.block)).toEqual([0, 0, 1, 1, 2, 2]);
+        // One warmup plus two measured launches share the first block's stack.
         const firstBlock = calls.filter((call) => call.home === boots[0]?.home);
         expect(firstBlock.map((call) => call.command)).toEqual([
           "boot",
-          ...Array.from({ length: 6 }, () => "work"),
+          ...Array.from({ length: 3 }, () => "work"),
           "halt",
         ]);
       }),
diff --git a/apps/cli/scripts/bench-cli.ts b/apps/cli/scripts/bench-cli.ts
index a048619fa6..5f8cc7c8ca 100644
--- a/apps/cli/scripts/bench-cli.ts
+++ b/apps/cli/scripts/bench-cli.ts
@@ -463,11 +463,13 @@ interface LaunchOutcome {
 /** Planned units of work for one build: a run-scoped unit holds one launch, a block-scoped one many. */
 export interface PlannedUnit {
   readonly build: Build;
+  /** Block index for block-scoped units. */
+  readonly block?: number;
   readonly launches: ReadonlyArray<"warmup" | "timed">;
 }
 
 /** Measured launches per block for `block`-scoped workloads. */
-export const BLOCK_SIZE = 5;
+export const BLOCK_SIZE = 2;
 
 /**
  * Units in execution order. `run` scope reuses {@link buildRunPlan}, one launch per unit.
@@ -495,7 +497,7 @@ export function buildUnitPlan(
       ...Array.from({ length: measured }, () => "timed" as const),
     ];
     const order: ReadonlyArray<Build> = block % 2 === 0 ? ["base", "branch"] : ["branch", "base"];
-    for (const build of order) units.push({ build, launches });
+    for (const build of order) units.push({ build, block, launches });
   }
   return units;
 }
@@ -644,7 +646,7 @@ export const runWorkloadBench = (
     const plan = buildUnitPlan(runs, warmup, scope);
     const started = yield* Clock.currentTimeNanos;
 
-    const timed: Record<Build, Array<{ wallMs: number; exitCode: number }>> = {
+    const timed: Record<Build, Array<{ wallMs: number; exitCode: number; block?: number }>> = {
       base: [],
       branch: [],
     };
@@ -668,10 +670,14 @@ export const runWorkloadBench = (
           (options.cpuProf && build === "branch" && !alreadyProfiled),
       );
 
-    const record = (build: Build, outcomes: ReadonlyArray<LaunchOutcome>) => {
+    const record = (build: Build, outcomes: ReadonlyArray<LaunchOutcome>, block?: number) => {
       for (const outcome of outcomes) {
         if (outcome.kind === "timed") {
-          timed[build].push({ wallMs: outcome.wallMs, exitCode: outcome.exitCode });
+          timed[build].push({
+            wallMs: outcome.wallMs,
+            exitCode: outcome.exitCode,
+            ...(block === undefined ? {} : { block }),
+          });
         } else if (outcome.kind === "traced") {
           traced[build].push({ exitCode: outcome.exitCode, trace: outcome.trace });
         }
@@ -728,6 +734,7 @@ export const runWorkloadBench = (
           teardownFailures,
           onProfile,
         }),
+        planned.block,
       );
     }
 
diff --git a/apps/cli/scripts/bench-cli.unit.test.ts b/apps/cli/scripts/bench-cli.unit.test.ts
index 15f8b80855..f577d8aa74 100644
--- a/apps/cli/scripts/bench-cli.unit.test.ts
+++ b/apps/cli/scripts/bench-cli.unit.test.ts
@@ -137,6 +137,21 @@ describe("buildUnitPlan", () => {
   });
 });
 
+describe("buildUnitPlan block sizing", () => {
+  it("gives ten runs five blocks per build by default, each tagged with its block index", () => {
+    const plan = buildUnitPlan(10, 1, "block");
+
+    for (const build of ["base", "branch"] as const) {
+      expect(plan.filter((unit) => unit.build === build).map((unit) => unit.block)).toEqual([
+        0, 1, 2, 3, 4,
+      ]);
+    }
+    expect(
+      plan.every((unit) => unit.launches.filter((kind) => kind === "timed").length === 2),
+    ).toBe(true);
+  });
+});
+
 describe("parseBenchArgs for stack runs", () => {
   it("lets explicit --runs and --warmup override the manifest, and defaults otherwise", () => {
     expect(parseBenchArgs(required)).toMatchObject({
diff --git a/apps/cli/scripts/bench-report.ts b/apps/cli/scripts/bench-report.ts
index a866d304d2..dede4dc6a0 100644
--- a/apps/cli/scripts/bench-report.ts
+++ b/apps/cli/scripts/bench-report.ts
@@ -29,8 +29,13 @@ export interface TimingSummary {
   readonly min: number;
   readonly max: number;
   readonly p90: number;
+  readonly iqr: number;
 }
 
+/** Interquartile range by nearest rank, so one extreme value at either end cannot move it. */
+const iqr = (values: ReadonlyArray<number>): number =>
+  percentile(values, 75) - percentile(values, 25);
+
 export function summarizeTimings(values: ReadonlyArray<number>): TimingSummary {
   const sorted = [...values].sort((a, b) => a - b);
   return {
@@ -38,6 +43,7 @@ export function summarizeTimings(values: ReadonlyArray<number>): TimingSummary {
     min: round(sorted[0] ?? 0),
     max: round(sorted[sorted.length - 1] ?? 0),
     p90: round(percentile(sorted, 90)),
+    iqr: round(iqr(sorted)),
   };
 }
 
@@ -289,6 +295,8 @@ const TraceSample = Schema.Struct({
 
 const RunSample = Schema.Struct({
   wallMs: Schema.Finite,
+  /** Block index of a launch from a block-scoped workload; absent for run-scoped launches. */
+  block: Schema.optionalKey(Schema.Finite),
   exitCode: Schema.Finite,
   /** Exit code of the traced launch, recorded even when no spans could be decoded. */
   tracedExitCode: Schema.optionalKey(Schema.Finite),
@@ -345,27 +353,88 @@ export const encodeBenchReport = Schema.encodeEffect(BenchReportJson);
 export const VERDICT_MIN_PCT = 5;
 export const VERDICT_MIN_MS = 5;
 export const VERDICT_MIN_SAMPLES = 5;
+/** Paired blocks needed before the block, not the launch, is the unit of evidence for a verdict. */
+export const VERDICT_MIN_BLOCKS = 3;
+export const VERDICT_IQR_FACTOR = 1.5;
 export const PHASE_ROWS = 3;
 
 export type TimingVerdict = "slower" | "faster" | "within noise" | "not comparable";
 
+/** Median wall time of one block for each build, paired by block index. */
+export interface BlockPair {
+  readonly base: number;
+  readonly branch: number;
+}
+
+const exceedsFloor = (delta: Delta): boolean =>
+  Math.abs(delta.pct) >= VERDICT_MIN_PCT && Math.abs(delta.ms) >= VERDICT_MIN_MS;
+
 /**
- * "slower" or "faster" only when the branch median is outside the base min-max range and the
- * change is at least {@link VERDICT_MIN_PCT} percent and {@link VERDICT_MIN_MS} ms.
+ * "slower" or "faster" only when the median change passes the {@link VERDICT_MIN_PCT} percent and
+ * {@link VERDICT_MIN_MS} ms floor and is larger than {@link VERDICT_IQR_FACTOR} times the wider
+ * build's interquartile range, so one extreme sample cannot fake a change. Run-scoped timings
+ * also need the branch median beyond the base range; with at least {@link VERDICT_MIN_BLOCKS}
+ * paired blocks the spread test runs on block medians instead, and a strict majority of blocks
+ * must pass the floor in the same direction.
  */
 export function timingVerdict(
   base: TimingSummary,
   branch: TimingSummary,
-  context: { readonly comparable: boolean; readonly samples: number },
+  context: {
+    readonly comparable: boolean;
+    readonly samples: number;
+    readonly blocks?: ReadonlyArray<BlockPair>;
+  },
 ): TimingVerdict {
   if (!context.comparable || context.samples < VERDICT_MIN_SAMPLES) return "not comparable";
+  const blocks = context.blocks;
+  if (blocks !== undefined && blocks.length >= VERDICT_MIN_BLOCKS) {
+    const baseMedians = blocks.map((block) => block.base);
+    const branchMedians = blocks.map((block) => block.branch);
+    const reference = median(baseMedians);
+    const ms = median(blocks.map((block) => block.branch - block.base));
+    const pct = reference === 0 ? 0 : (ms / reference) * 100;
+    if (!exceedsFloor({ ms: round(ms), pct: round(pct) })) return "within noise";
+    const agreeing = blocks.filter((block) => {
+      const blockDelta = deltaOf(block.base, block.branch);
+      return exceedsFloor(blockDelta) && blockDelta.ms > 0 === ms > 0;
+    }).length;
+    if (agreeing * 2 <= blocks.length) return "within noise";
+    if (Math.abs(ms) <= VERDICT_IQR_FACTOR * Math.max(iqr(baseMedians), iqr(branchMedians))) {
+      return "within noise";
+    }
+    return ms > 0 ? "slower" : "faster";
+  }
   const delta = deltaOf(base.median, branch.median);
-  if (Math.abs(delta.pct) < VERDICT_MIN_PCT || Math.abs(delta.ms) < VERDICT_MIN_MS) {
+  if (!exceedsFloor(delta)) return "within noise";
+  const outsideRange = delta.ms > 0 ? branch.median > base.max : branch.median < base.min;
+  if (!outsideRange) return "within noise";
+  if (Math.abs(delta.ms) <= VERDICT_IQR_FACTOR * Math.max(base.iqr, branch.iqr)) {
     return "within noise";
   }
-  if (branch.median > base.max) return "slower";
-  if (branch.median < base.min) return "faster";
-  return "within noise";
+  return delta.ms > 0 ? "slower" : "faster";
+}
+
+/** Pairs the per-block medians of both builds; empty unless every sample carries a block index. */
+export function pairBlocks(
+  base: ReadonlyArray<RunSample>,
+  branch: ReadonlyArray<RunSample>,
+): ReadonlyArray<BlockPair> {
+  const group = (samples: ReadonlyArray<RunSample>): Map<number, Array<number>> | undefined => {
+    const blocks = new Map<number, Array<number>>();
+    for (const sample of samples) {
+      if (sample.block === undefined) return undefined;
+      blocks.set(sample.block, [...(blocks.get(sample.block) ?? []), sample.wallMs]);
+    }
+    return blocks;
+  };
+  const baseBlocks = group(base);
+  const branchBlocks = group(branch);
+  if (baseBlocks === undefined || branchBlocks === undefined) return [];
+  return [...baseBlocks.entries()].flatMap(([block, values]) => {
+    const other = branchBlocks.get(block);
+    return other === undefined ? [] : [{ base: median(values), branch: median(other) }];
+  });
 }
 
 export interface ApiSummary {
@@ -559,6 +628,7 @@ export function analyzeWorkload(workload: WorkloadReport, traced: boolean): Work
   const verdict = timingVerdict(base.timing, branch.timing, {
     comparable: !differ && runsCleanly(base) && runsCleanly(branch),
     samples: Math.min(base.samples, branch.samples),
+    blocks: pairBlocks(workload.base, workload.branch),
   });
   const spans =
     base.spans === undefined || branch.spans === undefined
diff --git a/apps/cli/scripts/bench-report.unit.test.ts b/apps/cli/scripts/bench-report.unit.test.ts
index 9f41a41d98..00743cebae 100644
--- a/apps/cli/scripts/bench-report.unit.test.ts
+++ b/apps/cli/scripts/bench-report.unit.test.ts
@@ -13,6 +13,7 @@ import {
   parseWorkloadManifest,
   summarizeSpanRun,
   summarizeTimings,
+  pairBlocks,
   timingVerdict,
   validateWorkloads,
   type BenchReport,
@@ -51,6 +52,7 @@ describe("summarizeTimings", () => {
       min: 10,
       max: 50,
       p90: 50,
+      iqr: 20,
     });
   });
 });
@@ -180,34 +182,116 @@ describe("classifyHttpSpans", () => {
   });
 });
 
+const timings = (values: ReadonlyArray<number>) => summarizeTimings(values);
+const repeat = (count: number, value: number) => Array.from({ length: count }, () => value);
+
 describe("timingVerdict", () => {
-  const base = { median: 100, min: 95, max: 108, p90: 107 };
   const context = { comparable: true, samples: 10 };
 
   it.each([
-    { branch: { median: 120, min: 115, max: 125, p90: 124 }, expected: "slower" },
-    { branch: { median: 80, min: 78, max: 90, p90: 88 }, expected: "faster" },
-    { branch: { median: 103, min: 99, max: 110, p90: 109 }, expected: "within noise" },
-    { branch: { median: 107, min: 99, max: 118, p90: 117 }, expected: "within noise" },
-  ])("calls a branch median of $branch.median $expected", ({ branch, expected }) => {
-    expect(timingVerdict(base, branch, context)).toBe(expected);
+    { branch: 120, expected: "slower" },
+    { branch: 80, expected: "faster" },
+    { branch: 103, expected: "within noise" },
+  ])("calls a steady branch of $branch ms $expected", ({ branch, expected }) => {
+    expect(timingVerdict(timings(repeat(10, 100)), timings(repeat(10, branch)), context)).toBe(
+      expected,
+    );
   });
 
   it("ignores a large percentage change that is under the absolute floor", () => {
-    expect(
-      timingVerdict(
-        { median: 10, min: 9, max: 11, p90: 11 },
-        { median: 14, min: 13, max: 15, p90: 15 },
-        context,
-      ),
-    ).toBe("within noise");
+    expect(timingVerdict(timings(repeat(10, 10)), timings(repeat(10, 14)), context)).toBe(
+      "within noise",
+    );
   });
 
   it("declines to compare when runs are not comparable or too few", () => {
-    const slow = { median: 200, min: 190, max: 210, p90: 209 };
+    const base = timings(repeat(10, 100));
+    const slow = timings(repeat(10, 200));
     expect(timingVerdict(base, slow, { comparable: false, samples: 10 })).toBe("not comparable");
     expect(timingVerdict(base, slow, { comparable: true, samples: 3 })).toBe("not comparable");
   });
+
+  it("flags slower although one branch launch was fast", () => {
+    const branch = timings([...repeat(9, 125), 90]);
+    expect(timingVerdict(timings(repeat(10, 100)), branch, context)).toBe("slower");
+  });
+
+  it("reads a branch median inside a noisy base range as noise on real five-run data", () => {
+    const base = timings([328, 234, 228, 229, 237]);
+    const branch = timings([303, 317, 273, 268, 313]);
+    expect(timingVerdict(base, branch, { comparable: true, samples: 5 })).toBe("within noise");
+  });
+
+  it("reads a change past the floor but within 1.5 times the wider spread as noise", () => {
+    const base = timings([88, 92, 95, 100, 100, 100, 103, 107, 110, 112]);
+    const branch = timings([105, 110, 112, 115, 115, 115, 118, 120, 122, 125]);
+    expect(base.iqr).toBe(12);
+    expect(branch.iqr).toBe(8);
+    expect(branch.median).toBeGreaterThan(base.max);
+    expect(timingVerdict(base, branch, context)).toBe("within noise");
+  });
+});
+
+describe("timingVerdict with blocks", () => {
+  const context = { comparable: true, samples: 10 };
+  const unused = timings(repeat(10, 100));
+  const pairs = (...branchMedians: ReadonlyArray<number>) =>
+    branchMedians.map((branch) => ({ base: 100, branch }));
+
+  it("flags slower when four of five blocks are clearly slower and one is fast", () => {
+    expect(
+      timingVerdict(unused, unused, { ...context, blocks: pairs(125, 126, 124, 125, 80) }),
+    ).toBe("slower");
+  });
+
+  it("flags faster when most blocks are clearly faster", () => {
+    expect(timingVerdict(unused, unused, { ...context, blocks: pairs(75, 74, 76, 75, 120) })).toBe(
+      "faster",
+    );
+  });
+
+  it("reads mixed-sign blocks as within noise", () => {
+    expect(timingVerdict(unused, unused, { ...context, blocks: pairs(180, 70, 130, 75, 85) })).toBe(
+      "within noise",
+    );
+  });
+
+  it("reads block medians with wide spread as noise", () => {
+    const blocks = [
+      [222, 276],
+      [224, 252],
+      [227, 225],
+      [233, 299],
+      [222, 291],
+    ].map(([base, branch]) => ({ base: base!, branch: branch! }));
+    expect(timingVerdict(unused, unused, { ...context, blocks })).toBe("within noise");
+  });
+
+  it("falls back to the run path below three blocks", () => {
+    const branch = timings(repeat(10, 130));
+    expect(timingVerdict(unused, branch, { ...context, blocks: pairs(60, 60) })).toBe("slower");
+  });
+});
+
+describe("pairBlocks", () => {
+  const at = (block: number, wallMs: number) => ({
+    wallMs,
+    exitCode: 0,
+    block,
+  });
+
+  it("pairs per-block medians of both builds by block index", () => {
+    expect(
+      pairBlocks([at(0, 10), at(0, 20), at(1, 30)], [at(0, 40), at(0, 60), at(1, 50)]),
+    ).toEqual([
+      { base: 15, branch: 50 },
+      { base: 30, branch: 50 },
+    ]);
+  });
+
+  it("returns no pairs when a sample has no block index", () => {
+    expect(pairBlocks([{ wallMs: 10, exitCode: 0 }], [at(0, 10)])).toEqual([]);
+  });
 });
 
 const sample = (
diff --git a/apps/cli/scripts/compile-options.ts b/apps/cli/scripts/compile-options.ts
index 93797ca83c..41c9be4d24 100644
--- a/apps/cli/scripts/compile-options.ts
+++ b/apps/cli/scripts/compile-options.ts
@@ -1,6 +1,6 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { stackSourceDigest } from "@supabase/stack/internal/release";
-import { Effect } from "effect";
+import { Effect, Layer } from "effect";
 
 /**
  * Shared compile options keep release, local, and E2E builds exercising the shipped binary
@@ -21,6 +21,8 @@ export const compileOptions = {
  * started from the same stack sources, whether compiled or run from source.
  */
 export const stackReleaseDefine = () =>
-  Effect.runPromise(stackSourceDigest.pipe(Effect.provide(BunServices.layer))).then((digest) => ({
+  Effect.runPromise(
+    stackSourceDigest.pipe(Effect.provide(Layer.merge(BunServices.layer, BunCrypto.layerDigest))),
+  ).then((digest) => ({
     SUPABASE_STACK_BUILD_ID: JSON.stringify(digest),
   }));
diff --git a/apps/cli/scripts/npm-registry.ts b/apps/cli/scripts/npm-registry.ts
index 3759b8858c..2f4863be96 100644
--- a/apps/cli/scripts/npm-registry.ts
+++ b/apps/cli/scripts/npm-registry.ts
@@ -2,7 +2,7 @@ import { Data, Effect, Ref, Schedule, Schema } from "effect";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 
 const POLL_INTERVAL = "10 seconds";
-const POLL_BUDGET = "15 minutes";
+const POLL_BUDGET = "30 minutes";
 const PROBE_TIMEOUT = "30 seconds";
 const RETRYABLE_CLIENT_STATUSES = new Set([404, 408, 429]);
 
diff --git a/apps/cli/scripts/npm-registry.unit.test.ts b/apps/cli/scripts/npm-registry.unit.test.ts
index f2639a2822..56923cd397 100644
--- a/apps/cli/scripts/npm-registry.unit.test.ts
+++ b/apps/cli/scripts/npm-registry.unit.test.ts
@@ -108,7 +108,7 @@ describe("waitUntilInstallable", () => {
         onInstallable: (pkg) => Effect.sync(() => void installable.push(pkg.name)),
       }).pipe(Effect.flip, Effect.forkChild({ startImmediately: true }));
 
-      yield* TestClock.adjust("14 minutes");
+      yield* TestClock.adjust("29 minutes");
       expect(fiber.pollUnsafe()).toBeUndefined();
 
       yield* TestClock.adjust("2 minutes");
diff --git a/apps/cli/scripts/published-schemas.ts b/apps/cli/scripts/published-schemas.ts
index 31f2ca2073..3f190b008f 100644
--- a/apps/cli/scripts/published-schemas.ts
+++ b/apps/cli/scripts/published-schemas.ts
@@ -1,3 +1,4 @@
+import { withoutSafeIntegerBounds } from "@supabase/config/internal";
 import { HOSTED_LOCK_SCHEMA_URL, Lock, LOCK_SCHEMA_URL } from "@supabase/stack/effect";
 import { JsonSchema, Predicate, Schema } from "effect";
 
@@ -60,8 +61,13 @@ const acceptHostedSchemaUrl = (schema: JsonSchema.JsonSchema): JsonSchema.JsonSc
 
 /** The draft-07 JSON Schema of `supabase/supabase.lock`, rendered from the stack's `Lock` schema. */
 export const lockSchemaDocument = () => {
+  const generated = Schema.toJsonSchemaDocument(Lock);
   const { schema, definitions } = dedupeDefinitions(
-    JsonSchema.toDocumentDraft07(Schema.toJsonSchemaDocument(Lock)),
+    JsonSchema.toDocumentDraft07({
+      ...generated,
+      schema: withoutSafeIntegerBounds(generated.schema),
+      definitions: withoutSafeIntegerBounds(generated.definitions),
+    }),
   );
   return {
     $schema: JsonSchema.META_SCHEMA_URI_DRAFT_07,
diff --git a/apps/cli/scripts/release-channels.ts b/apps/cli/scripts/release-channels.ts
index bf3746c553..b3c31384e3 100644
--- a/apps/cli/scripts/release-channels.ts
+++ b/apps/cli/scripts/release-channels.ts
@@ -1,3 +1,5 @@
+import { semver } from "bun";
+
 const MAINTENANCE_TAG = /^v[1-9]\d*\.stable$/;
 const PUBLISHABLE_TAGS = new Set(["latest", "alpha", "beta", "next"]);
 
@@ -38,3 +40,31 @@ export function channelForTag(tag: string): "beta" | "next" | "alpha" | "latest"
   if (tag.includes("-alpha.")) return "alpha";
   return "latest";
 }
+
+/** Whether `tag` is a CLI release tag in `channel`'s history: stable tags always, prereleases only on their own channel. */
+export function isInChannelHistory(
+  tag: string,
+  channel: ReturnType<typeof channelForTag>,
+): boolean {
+  return /^v\d/.test(tag) && (!tag.includes("-") || channelForTag(tag) === channel);
+}
+
+function versionBase(version: string): readonly [number, number, number] | undefined {
+  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(version);
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : undefined;
+}
+
+/** The smallest release type that takes `lastVersion` to `version`, or null unless `version` is later by SemVer precedence. */
+export function releaseTypeBetween(
+  lastVersion: string | undefined,
+  version: string,
+): "major" | "minor" | "patch" | null {
+  if (lastVersion === undefined || semver.order(version, lastVersion) !== 1) return null;
+  const last = versionBase(lastVersion);
+  const next = versionBase(version);
+  if (!last || !next) return null;
+
+  if (next[0] !== last[0]) return "major";
+  if (next[1] !== last[1]) return "minor";
+  return "patch";
+}
diff --git a/apps/cli/scripts/release-channels.unit.test.ts b/apps/cli/scripts/release-channels.unit.test.ts
index 5a157f5517..439c21c027 100644
--- a/apps/cli/scripts/release-channels.unit.test.ts
+++ b/apps/cli/scripts/release-channels.unit.test.ts
@@ -3,8 +3,10 @@ import {
   channelForTag,
   homebrewClassName,
   homebrewConflictsLine,
+  isInChannelHistory,
   isPublishableNpmTag,
   releaseBranchForTag,
+  releaseTypeBetween,
 } from "./release-channels.ts";
 
 describe("isPublishableNpmTag", () => {
@@ -72,3 +74,45 @@ describe("channelForTag", () => {
     expect(channelForTag(tag)).toBe(expected);
   });
 });
+
+describe("isInChannelHistory", () => {
+  test.each([
+    ["v3.1.0-beta.1", "beta", true],
+    ["v3.0.0", "beta", true],
+    ["v3.1.0-next.1", "beta", false],
+    ["v2.99.0-alpha.1", "beta", false],
+    ["v3.1.0-next.1", "next", true],
+    ["v3.0.0", "next", true],
+    ["v3.1.0-beta.1", "next", false],
+    ["v2.99.0-alpha.1", "next", false],
+    ["v3.0.0", "latest", true],
+    ["v2.151.1", "latest", true],
+    ["v3.1.0-beta.1", "latest", false],
+    ["v3.1.0-next.1", "latest", false],
+    ["v2.99.0-alpha.1", "latest", false],
+    ["config-v1.2.0", "latest", false],
+    ["apps/cli-go/pkg/v1.0.0", "latest", false],
+    ["config-v1.2.0", "beta", false],
+  ] as const)("%s in the %s history -> %s", (tag, channel, expected) => {
+    expect(isInChannelHistory(tag, channel)).toBe(expected);
+  });
+});
+
+describe("releaseTypeBetween", () => {
+  test.each([
+    ["2.122.0", "2.122.1", "patch"],
+    ["2.122.1", "2.123.0", "minor"],
+    ["2.123.4", "3.0.0", "major"],
+    ["3.1.0-beta.4", "3.1.0-beta.5", "patch"],
+    ["3.0.0", "3.1.0-beta.1", "minor"],
+    ["2.151.0", "3.0.0-beta.1", "major"],
+    [undefined, "3.0.0", null],
+    ["2.122.1", "2.122.1", null],
+    ["2.122.1", "2.122.0", null],
+    ["3.1.0", "2.151.0", null],
+    ["3.1.0-beta.5", "3.1.0-beta.4", null],
+    ["3.1.0", "3.1.0-beta.1", null],
+  ] as const)("%s -> %s requires %s", (lastVersion, version, expected) => {
+    expect(releaseTypeBetween(lastVersion, version)).toBe(expected);
+  });
+});
diff --git a/apps/cli/src/SIDE_EFFECTS_TEMPLATE.md b/apps/cli/src/SIDE_EFFECTS_TEMPLATE.md
index 1dec99b0f8..11b03f843e 100644
--- a/apps/cli/src/SIDE_EFFECTS_TEMPLATE.md
+++ b/apps/cli/src/SIDE_EFFECTS_TEMPLATE.md
@@ -58,10 +58,11 @@
 <!-- List every env var the command reads, directly or via a service.
      Required?: "yes" / "no (falls back to …)" -->
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
+| Variable                   | Purpose                                                                                    | Required?                                               |
+| -------------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN`    | auth token (bypasses credential file/keyring lookup)                                       | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROFILE`         | built-in profile name or YAML file path                                                    | no (falls back to `~/.supabase/profile` -> `supabase`)  |
+| `SUPABASE_API_MAX_RETRIES` | Management API client retries after the first attempt (`0` = send once), not command loops | no (falls back to 5)                                    |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/auth/command-platform-api.layer.ts b/apps/cli/src/auth/command-platform-api.layer.ts
index 112f224e19..fce96774e1 100644
--- a/apps/cli/src/auth/command-platform-api.layer.ts
+++ b/apps/cli/src/auth/command-platform-api.layer.ts
@@ -67,6 +67,7 @@ export const makeCommandPlatformApi = Effect.gen(function* () {
     },
     {
       transformClient,
+      retry: { maxRetries: Option.getOrUndefined(cliSettings.apiMaxRetries) },
     },
   );
 }).pipe(Effect.withSpan("CommandPlatformApi.build"));
diff --git a/apps/cli/src/auth/command-platform-api.layer.unit.test.ts b/apps/cli/src/auth/command-platform-api.layer.unit.test.ts
index ac98a9add2..944256b937 100644
--- a/apps/cli/src/auth/command-platform-api.layer.unit.test.ts
+++ b/apps/cli/src/auth/command-platform-api.layer.unit.test.ts
@@ -38,6 +38,7 @@ function mockCliSettings(opts: {
   userAgent?: string;
   profile?: string;
   projectHost?: string;
+  apiMaxRetries?: number;
 }) {
   return Layer.succeed(CommandSettings, {
     githubToken: Option.none(),
@@ -55,6 +56,7 @@ function mockCliSettings(opts: {
     workdir: "/tmp",
     explicitWorkdir: false,
     userAgent: opts.userAgent ?? "SupabaseCLI/0.0.0-dev",
+    apiMaxRetries: Option.fromUndefinedOr(opts.apiMaxRetries),
   });
 }
 
@@ -184,7 +186,7 @@ function withBaseDeps(
     );
 }
 
-function captureRequests(responseHeaders: Record<string, string> = {}) {
+function captureRequests(responseHeaders: Record<string, string> = {}, status = 200) {
   const requests: Array<{
     url: string;
     headers: Readonly<Record<string, string | undefined>>;
@@ -195,7 +197,7 @@ function captureRequests(responseHeaders: Record<string, string> = {}) {
       HttpClientResponse.fromWeb(
         request,
         new Response(JSON.stringify([]), {
-          status: 200,
+          status,
           headers: { "content-type": "application/json", ...responseHeaders },
         }),
       ),
@@ -306,6 +308,39 @@ describe("commandPlatformApiLayer", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect("sends a failing request once when SUPABASE_API_MAX_RETRIES is 0", () => {
+    // `Retry-After: 0` keeps any retry from waiting on the test clock.
+    const http = captureRequests({ "Retry-After": "0" }, 500);
+    const layer = commandPlatformApiLayer.pipe(
+      Layer.provide(mockCliSettings({ accessToken: VALID_TOKEN, apiMaxRetries: 0 })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const api = yield* CommandPlatformApi;
+      const exit = yield* Effect.exit(api.v1.listAllProjects());
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(http.requests).toHaveLength(1);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("keeps the client's default retries when SUPABASE_API_MAX_RETRIES is unset", () => {
+    const http = captureRequests({ "Retry-After": "0" }, 500);
+    const layer = commandPlatformApiLayer.pipe(
+      Layer.provide(mockCliSettings({ accessToken: VALID_TOKEN })),
+      Layer.provide(mockCredentials(Option.none())),
+      Layer.provide(http.layer),
+      withBaseDeps(),
+    );
+    return Effect.gen(function* () {
+      const api = yield* CommandPlatformApi;
+      const exit = yield* Effect.exit(api.v1.listAllProjects());
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(http.requests).toHaveLength(6);
+    }).pipe(Effect.provide(layer));
+  });
+
   it.effect("targets the configured apiUrl rather than SUPABASE_API_URL env", () => {
     const http = captureRequests();
     const layer = commandPlatformApiLayer.pipe(
diff --git a/apps/cli/src/cli/complete.ts b/apps/cli/src/cli/complete.ts
index 190c764622..ff8ba4b3b2 100644
--- a/apps/cli/src/cli/complete.ts
+++ b/apps/cli/src/cli/complete.ts
@@ -1,14 +1,12 @@
 import { BunCrypto, BunServices } from "@effect/platform-bun";
-import { Cause, Clock, Crypto, DateTime, Effect, Layer, Option } from "effect";
+import { Cause, Clock, DateTime, Effect, Layer, Option } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { FetchHttpClient } from "effect/http";
 import { GlobalFlag } from "effect/cli";
 import type { Command, Param, Primitive } from "effect/cli";
 import type { PlatformError } from "effect/PlatformError";
 import process from "node:process";
-import {
-  QUERY_OUTPUT_FORMATS,
-  RESOURCE_OUTPUT_FORMATS,
-} from "../command-internal/output-formats.ts";
+import { outputFormatsForCommand } from "../command-internal/output-formats.ts";
 import { unwrapParam } from "../command-internal/param-introspection.ts";
 import { REMOTE_FLAG_NAME } from "../command-internal/target/remote-vocabulary.ts";
 import { isValidBase0Int64, parseUintBase0 } from "../shared/config/parse-uint.ts";
@@ -650,18 +648,6 @@ function isValidCsvFlagValue(value: string): boolean {
   }
 }
 
-/**
- * `--output` is modeled as one global flag whose `choiceKeys` is the union of two distinct
- * enums (`env|pretty|json|toml|yaml` everywhere else, `json|table|csv` for `db query`), so
- * `flag.choiceKeys` alone can't tell which applies at the resolved command. This restores
- * per-command validation.
- */
-function outputFlagChoiceKeys(matchedPath: ReadonlyArray<string>): ReadonlyArray<string> {
-  return matchedPath.length === 2 && matchedPath[0] === "db" && matchedPath[1] === "query"
-    ? QUERY_OUTPUT_FORMATS
-    : RESOURCE_OUTPUT_FORMATS;
-}
-
 function remoteTakesWord(
   remoteLeaf: RemoteArgvLeaf | undefined,
   trimmedArgs: ReadonlyArray<string>,
@@ -709,7 +695,7 @@ function isValidFlagValue(
       return parseBoolLiteral(value) !== undefined;
     case "Choice":
       if (flag.name === "output") {
-        return outputFlagChoiceKeys(matchedPath).includes(value);
+        return outputFormatsForCommand(matchedPath).includes(value);
       }
       return flag.choiceKeys !== undefined && flag.choiceKeys.includes(value);
     case "Int":
@@ -1122,10 +1108,10 @@ export function formatCompletionResponse(
 export function captureCompleteTelemetryEffect(
   exitCode: number,
   durationMs: number,
-): Effect.Effect<void, PlatformError, Analytics | Crypto.Crypto> {
+): Effect.Effect<void, PlatformError, Analytics | SecureRandom.SecureRandom> {
   return Effect.gen(function* () {
-    const crypto = yield* Crypto.Crypto;
-    const commandRunId = yield* crypto.randomUUIDv4;
+    const crypto = yield* SecureRandom.SecureRandom;
+    const commandRunId = yield* crypto.uuidV4();
     const analytics = yield* Analytics;
     yield* analytics
       .capture(EventCommandExecuted, {
@@ -1162,7 +1148,7 @@ const completeAnalyticsLayer = (mode: ProjectStateMode) =>
     Layer.provide(FetchHttpClient.layer),
     Layer.provide(cliConfigProviderLayer),
     Layer.provide(BunServices.layer),
-    Layer.merge(BunCrypto.layer),
+    Layer.provideMerge(BunCrypto.layerSecureRandom),
   );
 
 /**
diff --git a/apps/cli/src/cli/complete.unit.test.ts b/apps/cli/src/cli/complete.unit.test.ts
index e8cc3f4505..aeb903f191 100644
--- a/apps/cli/src/cli/complete.unit.test.ts
+++ b/apps/cli/src/cli/complete.unit.test.ts
@@ -529,6 +529,25 @@ describe("respondToComplete", () => {
   });
 
   describe("--output's choice values are validated per-command, not the widened global union (CLI-1965 review)", () => {
+    it.each([
+      { path: ["logs"], format: "table" },
+      { path: ["logs"], format: "csv" },
+      { path: ["logs", "sources"], format: "table" },
+      { path: ["logs", "sources"], format: "csv" },
+      { path: ["logs"], format: "env" },
+    ])("rejects $path -o $format with a valid output-format control", ({ path, format }) => {
+      const control = respondToComplete(rootCommand, [
+        "__complete",
+        ...path,
+        "--output-format",
+        "json",
+        "--rem",
+      ]);
+      expect(control?.candidates.map((candidate) => candidate.name)).toContain("--remote=");
+      const result = respondToComplete(rootCommand, ["__complete", ...path, "-o", format, "--rem"]);
+      expect(result).toEqual({ candidates: [], directive: CompletionDirective.Default });
+    });
+
     it("rejects db query's own local values (table/csv) everywhere else", () => {
       const result = respondToComplete(rootCommand, ["__complete", "--output", "table", ""]);
       expect(result).toEqual({ candidates: [], directive: CompletionDirective.Default });
diff --git a/apps/cli/src/cli/root.ts b/apps/cli/src/cli/root.ts
index 93baf60356..9e41bc8ff5 100644
--- a/apps/cli/src/cli/root.ts
+++ b/apps/cli/src/cli/root.ts
@@ -31,6 +31,7 @@ import { initCommand } from "../commands/init/init.command.ts";
 import { inspectCommand } from "../commands/inspect/inspect.command.ts";
 import { issueCommand } from "../commands/issue/issue.command.ts";
 import { linkCommand } from "../commands/link/link.command.ts";
+import { logsCommandFor } from "../commands/logs/logs.command.ts";
 import { loginCommand } from "../commands/login/login.command.ts";
 import { logoutCommand } from "../commands/logout/logout.command.ts";
 import { migrationCommand } from "../commands/migration/migration.command.ts";
@@ -179,6 +180,7 @@ export const rootCommandForFeatures = (options: RootCommandFeatures = {}) =>
       linkCommand,
       loginCommand,
       logoutCommand,
+      logsCommandFor(),
       migrationCommand,
       networkBansCommand,
       networkRestrictionsCommand,
diff --git a/apps/cli/src/command-internal/bundled-postgres-client.integration.test.ts b/apps/cli/src/command-internal/bundled-postgres-client.integration.test.ts
index 5cf56eaa7d..b26708d63f 100644
--- a/apps/cli/src/command-internal/bundled-postgres-client.integration.test.ts
+++ b/apps/cli/src/command-internal/bundled-postgres-client.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Ref } from "effect";
 
@@ -23,7 +23,7 @@ const processControl = Layer.succeed(ProcessControl, {
   getExitCode: Effect.undefined,
 });
 
-const base = Layer.mergeAll(BunServices.layer, processControl);
+const base = Layer.mergeAll(BunServices.layer, BunCrypto.layer, processControl);
 const docker = dockerRunLayer.pipe(Layer.provide(base));
 const client = bundledPostgresClientLayer.pipe(
   Layer.provide(Layer.mergeAll(base, docker, mockOutput().layer)),
diff --git a/apps/cli/src/command-internal/bundled-postgres-client.ts b/apps/cli/src/command-internal/bundled-postgres-client.ts
index e30c5ae3f7..10215da982 100644
--- a/apps/cli/src/command-internal/bundled-postgres-client.ts
+++ b/apps/cli/src/command-internal/bundled-postgres-client.ts
@@ -1,7 +1,6 @@
 import {
   Context,
   Config,
-  Crypto,
   Effect,
   FileSystem,
   Layer,
@@ -10,6 +9,7 @@ import {
   PlatformError,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { FetchHttpClient } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import {
@@ -216,7 +216,8 @@ export const bundledPostgresClientLayer: Layer.Layer<
   never,
   | FileSystem.FileSystem
   | Path.Path
-  | Crypto.Crypto
+  | SecureRandom.SecureRandom
+  | Digest.Digest
   | ChildProcessSpawner.ChildProcessSpawner
   | DockerRun
   | RuntimeInfo
@@ -228,7 +229,8 @@ export const bundledPostgresClientLayer: Layer.Layer<
   Effect.gen(function* () {
     const fileSystem = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
+    const digest = yield* Digest.Digest;
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     const docker = yield* DockerRun;
     const runtimeInfo = yield* RuntimeInfo;
@@ -258,7 +260,8 @@ export const bundledPostgresClientLayer: Layer.Layer<
             Effect.provide(FetchHttpClient.layer),
             Effect.provideService(FileSystem.FileSystem, fileSystem),
             Effect.provideService(Path.Path, path),
-            Effect.provideService(Crypto.Crypto, crypto),
+            Effect.provideService(SecureRandom.SecureRandom, crypto),
+            Effect.provideService(Digest.Digest, digest),
             Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
             Effect.mapError(mapArtifactError),
           );
diff --git a/apps/cli/src/command-internal/colors.ts b/apps/cli/src/command-internal/colors.ts
index 3eed599f46..f5c13f1c88 100644
--- a/apps/cli/src/command-internal/colors.ts
+++ b/apps/cli/src/command-internal/colors.ts
@@ -93,3 +93,7 @@ export function blue(text: string, stream: ColorStream = process.stderr): string
 export function dim(text: string, stream: ColorStream = process.stderr): string {
   return supportsColor(stream) ? styleText("dim", text, { validateStream: false }) : text;
 }
+
+export function inverse(text: string, stream: ColorStream = process.stderr): string {
+  return supportsColor(stream) ? styleText("inverse", text, { validateStream: false }) : text;
+}
diff --git a/apps/cli/src/command-internal/colors.unit.test.ts b/apps/cli/src/command-internal/colors.unit.test.ts
index 44c7550096..502c0c744d 100644
--- a/apps/cli/src/command-internal/colors.unit.test.ts
+++ b/apps/cli/src/command-internal/colors.unit.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { ColorStream } from "./colors.ts";
-import { aqua, bold, green, red, yellow } from "./colors.ts";
+import { aqua, bold, green, red, yellow, inverse } from "./colors.ts";
 
 // Bun's `util.styleText` ignores `validateStream`, so `colors.ts` implements the colour gate
 // itself. These tests pin that gate deterministically with fake streams and stubbed env vars.
@@ -25,6 +25,7 @@ afterEach(() => {
 describe("colors TTY gating (termenv parity)", () => {
   it("styles on a colour-capable TTY", () => {
     expect(aqua("supabase", colorTty)).toBe("\u001b[36msupabase\u001b[39m");
+    expect(inverse("selected", colorTty)).toBe("\u001b[7mselected\u001b[27m");
     expect(bold("text", colorTty)).toBe("\u001b[1mtext\u001b[22m");
     expect(yellow("warning", colorTty)).toBe("\u001b[33mwarning\u001b[39m");
     expect(red("error", colorTty)).toBe("\u001b[31merror\u001b[39m");
@@ -33,6 +34,7 @@ describe("colors TTY gating (termenv parity)", () => {
 
   it("renders plain on a piped stream (no hasColors), like lipgloss's Ascii profile", () => {
     expect(aqua("supabase", piped)).toBe("supabase");
+    expect(inverse("selected", piped)).toBe("selected");
     expect(bold("text", piped)).toBe("text");
     expect(yellow("warning", piped)).toBe("warning");
     expect(red("error", piped)).toBe("error");
@@ -47,6 +49,7 @@ describe("colors TTY gating (termenv parity)", () => {
     vi.stubEnv("NO_COLOR", "1");
     vi.stubEnv("CLICOLOR_FORCE", "1");
     expect(aqua("supabase", colorTty)).toBe("supabase");
+    expect(inverse("selected", colorTty)).toBe("selected");
   });
 
   it("CLICOLOR=0 disables colour on a capable TTY", () => {
diff --git a/apps/cli/src/command-internal/command-permissions/command-permissions.unit.test.ts b/apps/cli/src/command-internal/command-permissions/command-permissions.unit.test.ts
index 7cdd957a98..527cd603aa 100644
--- a/apps/cli/src/command-internal/command-permissions/command-permissions.unit.test.ts
+++ b/apps/cli/src/command-internal/command-permissions/command-permissions.unit.test.ts
@@ -73,20 +73,39 @@ describe("command permission mapping completeness", () => {
 
   for (const { name, tree } of trees) {
     describe(name, () => {
-      const leaves = [...tree].filter(([, node]) => node.isLeaf);
+      const executableCommands = [...tree].filter(([, node]) => node.isExecutable);
 
-      it("declares permissions on every leaf", () => {
-        for (const [path, node] of leaves) {
+      it("requires hosted log access only for the executable viewer, not the source catalog", () => {
+        const viewer = tree.get("logs");
+        const sources = tree.get("logs sources");
+        expect(viewer?.isLeaf).toBe(false);
+        expect(viewer?.isExecutable).toBe(true);
+        const viewerPermissions = viewer === undefined ? undefined : declarationOf(viewer);
+        const sourcePermissions = sources === undefined ? undefined : declarationOf(sources);
+        expect(viewerPermissions?.status).toBe("mapped");
+        expect(sourcePermissions?.status).toBe("mapped");
+        if (viewerPermissions?.status !== "mapped" || sourcePermissions?.status !== "mapped")
+          throw new Error("Log permission declarations are missing");
+        expect(viewerPermissions.operations.map((entry) => entry.operationId)).toContain(
+          "v1-get-project-logs",
+        );
+        expect(sourcePermissions.operations.map((entry) => entry.operationId)).not.toContain(
+          "v1-get-project-logs",
+        );
+      });
+
+      it("declares permissions on every executable command", () => {
+        for (const [path, node] of executableCommands) {
           expect(declarationOf(node), `"${path}" declares no permissions`).toBeDefined();
         }
       });
 
-      it("declares permissions only on leaf commands", () => {
+      it("declares permissions only on executable commands", () => {
         for (const [path, node] of tree) {
-          if (node.isLeaf) continue;
+          if (node.isExecutable) continue;
           expect(
             declarationOf(node),
-            `"${path}" is a command group; declare permissions on its leaves instead`,
+            `"${path}" is a command group without a handler; declare permissions on its executable commands instead`,
           ).toBeUndefined();
         }
       });
@@ -94,7 +113,7 @@ describe("command permission mapping completeness", () => {
       it("classifies every flag a mapped leaf accepts, and only references flags that exist", () => {
         const globalFlags = new Set(GLOBAL_NO_API_EFFECT_FLAGS);
 
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const permissions = declarationOf(node);
           if (permissions?.status !== "mapped") continue;
 
@@ -195,7 +214,7 @@ describe("command permission mapping completeness", () => {
       });
 
       it("references only operationIds that exist in the bundled spec and declare FGA permissions", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const permissions = declarationOf(node);
           if (permissions?.status !== "mapped") continue;
           for (const entry of permissions.operations) {
@@ -213,7 +232,7 @@ describe("command permission mapping completeness", () => {
       });
 
       it("composes branch resolution on every leaf that accepts --remote, except the branches that act on a parent project", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const permissions = declarationOf(node);
           if (permissions?.status !== "mapped") continue;
           if (!node.flags.has("remote") || path.startsWith("branches ")) continue;
@@ -226,7 +245,7 @@ describe("command permission mapping completeness", () => {
       });
 
       it("only marks a leaf unmapped when it's on the known go-delegation allowlist", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const permissions = declarationOf(node);
           if (permissions?.status !== "unmapped") continue;
           expect(
@@ -242,7 +261,7 @@ describe("command permission mapping completeness", () => {
     for (const path of GO_DELEGATED_PATHS) {
       const declared = trees
         .flatMap(({ tree }) => [tree.get(path)])
-        .filter((node) => node?.isLeaf === true)
+        .filter((node) => node?.isExecutable === true)
         .map((node) => (node === undefined ? undefined : declarationOf(node)));
       expect(
         declared.length,
diff --git a/apps/cli/src/command-internal/command-permissions/help-section.tree.unit.test.ts b/apps/cli/src/command-internal/command-permissions/help-section.tree.unit.test.ts
index a506950c1f..a8b801f817 100644
--- a/apps/cli/src/command-internal/command-permissions/help-section.tree.unit.test.ts
+++ b/apps/cli/src/command-internal/command-permissions/help-section.tree.unit.test.ts
@@ -39,7 +39,7 @@ describe("permission help section across the command tree", () => {
     describe(name, () => {
       const tree = commandTreeFor(variant);
       const rootFlags = permissionFlagsOf(userGlobalFlagParams(rootCommandForFeatures(variant)));
-      const leaves = [...tree].filter(([, node]) => node.isLeaf);
+      const executableCommands = [...tree].filter(([, node]) => node.isExecutable);
 
       // Help lists only visible flags of a parent group, but the command's own flags come with
       // their hidden ones from what `withPermissions` recorded.
@@ -71,7 +71,7 @@ describe("permission help section across the command tree", () => {
 
       it.effect("gives a flag a default only when parsing no arguments yields that value", () =>
         Effect.gen(function* () {
-          for (const [path, node] of leaves) {
+          for (const [path, node] of executableCommands) {
             const declared = Option.getOrUndefined(readPermissions(node.command));
             if (declared?.status !== "mapped") continue;
             const params = paramsFor(path);
@@ -106,7 +106,7 @@ describe("permission help section across the command tree", () => {
       );
 
       it("never tests the presence of a text flag that has a default", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const declared = Option.getOrUndefined(readPermissions(node.command));
           if (declared?.status !== "mapped") continue;
           const catalog = catalogFor(path);
@@ -124,7 +124,7 @@ describe("permission help section across the command tree", () => {
 
       it.effect("never turns on by default a switch a condition tests", () =>
         Effect.gen(function* () {
-          for (const [path, node] of leaves) {
+          for (const [path, node] of executableCommands) {
             const declared = Option.getOrUndefined(readPermissions(node.command));
             if (declared?.status !== "mapped") continue;
             const params = paramsFor(path);
@@ -148,7 +148,7 @@ describe("permission help section across the command tree", () => {
       );
 
       it("records every flag a command accepts when it declares its permissions", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const recorded = Context.getOption(node.command.annotations, CommandFlagsAnnotation);
           const expected = permissionFlagsOf(ownParams(node.command)).map((flag) => flag.name);
           expect(Option.isSome(recorded), `"${path}" records no flags`).toBe(true);
@@ -164,7 +164,7 @@ describe("permission help section across the command tree", () => {
       // Help sees a parent group's flags only as visible names, so a condition cannot depend on
       // a parent's hidden flag or on its choice values.
       it("only conditions on flags a parent group shares when help can describe them", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const declared = Option.getOrUndefined(readPermissions(node.command));
           if (declared?.status !== "mapped") continue;
           const parts = path.split(" ");
@@ -193,7 +193,7 @@ describe("permission help section across the command tree", () => {
       });
 
       it("renders a section for every command that calls an API operation", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const declared = Option.getOrUndefined(readPermissions(node.command));
           if (declared === undefined) continue;
           const section = resolvePermissionSection(declared, catalogFor(path));
@@ -216,7 +216,7 @@ describe("permission help section across the command tree", () => {
       });
 
       it("names only flags the command shows in its help", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const declared = Option.getOrUndefined(readPermissions(node.command));
           if (declared === undefined) continue;
           const catalog = catalogFor(path);
@@ -233,7 +233,7 @@ describe("permission help section across the command tree", () => {
       });
 
       it("prints each heading once, and never lists a row as both required and optional", () => {
-        for (const [path, node] of leaves) {
+        for (const [path, node] of executableCommands) {
           const declared = Option.getOrUndefined(readPermissions(node.command));
           if (declared === undefined) continue;
           const section = resolvePermissionSection(declared, catalogFor(path));
diff --git a/apps/cli/src/command-internal/config-advice.ts b/apps/cli/src/command-internal/config-advice.ts
new file mode 100644
index 0000000000..c512c1ac5b
--- /dev/null
+++ b/apps/cli/src/command-internal/config-advice.ts
@@ -0,0 +1,63 @@
+import type { ConfigFormat } from "@supabase/config/effect";
+import { cliConfigFormatForPath } from "@supabase/config/internal";
+import type { Path } from "effect";
+
+/** The project config file a message points at: its format and workdir-relative path. */
+export interface ConfigFileRef {
+  readonly format: ConfigFormat;
+  readonly path: string;
+}
+
+/** Where `supabase init` writes the config, so the file a project without one will get. */
+export const DEFAULT_CONFIG_FILE: ConfigFileRef = {
+  format: "toml",
+  path: "supabase/config.toml",
+};
+
+/** A config file's workdir-relative path as messages show it, with `/` separators on every platform. */
+export const configDisplayPath = (path: Path.Path, workdir: string, filePath: string): string =>
+  path.relative(workdir, filePath).replaceAll("\\", "/");
+
+/** The config file at an absolute `configPath`; `undefined` reads as no file. */
+export const configFileRefFromPath = (
+  path: Path.Path,
+  workdir: string,
+  configPath: string | undefined,
+): ConfigFileRef =>
+  configPath === undefined
+    ? DEFAULT_CONFIG_FILE
+    : {
+        format: cliConfigFormatForPath(configPath),
+        path: configDisplayPath(path, workdir, configPath),
+      };
+
+export const configFileRefOf = (
+  path: Path.Path,
+  workdir: string,
+  resolvedConfig: {
+    readonly hasConfigFile: boolean;
+    readonly loaded: { readonly path: string };
+  },
+): ConfigFileRef =>
+  configFileRefFromPath(
+    path,
+    workdir,
+    resolvedConfig.hasConfigFile ? resolvedConfig.loaded.path : undefined,
+  );
+
+/** A setting as advice reads it: `[section] key = value` in TOML, `` `section.key` to `value` `` in JSON. */
+export const configSetting = (
+  format: ConfigFormat,
+  section: string,
+  key: string,
+  value: string,
+): string =>
+  format === "json" ? `\`${section}.${key}\` to \`${value}\`` : `[${section}] ${key} = ${value}`;
+
+/** A setting's key as advice names it: `[section].key` in TOML, `section.key` in JSON. */
+export const configKey = (format: ConfigFormat, section: string, key: string): string =>
+  format === "json" ? `${section}.${key}` : `[${section}].${key}`;
+
+/** The config file name without its directory, as "not declared" notes name it. */
+export const configFileName = (configPath: string): string =>
+  configPath.split(/[\\/]/).pop() ?? configPath;
diff --git a/apps/cli/src/command-internal/config-advice.unit.test.ts b/apps/cli/src/command-internal/config-advice.unit.test.ts
new file mode 100644
index 0000000000..da673736d0
--- /dev/null
+++ b/apps/cli/src/command-internal/config-advice.unit.test.ts
@@ -0,0 +1,57 @@
+import { Path } from "effect";
+import { BunPath } from "@effect/platform-bun";
+import { describe, expect, it } from "vitest";
+import { Effect } from "effect";
+import {
+  configFileName,
+  configFileRefFromPath,
+  configKey,
+  configSetting,
+  DEFAULT_CONFIG_FILE,
+} from "./config-advice.ts";
+import { schemaPathsTransitionWarning } from "./diff-engine.ts";
+import { enableLocalWebhooksSuggestion } from "./pg-net-guidance.ts";
+
+const json = { format: "json", path: "supabase/config.json" } as const;
+
+describe("config advice", () => {
+  it("renders a setting as TOML section syntax or a JSON dotted key", () => {
+    expect(configSetting("toml", "storage", "enabled", "true")).toBe("[storage] enabled = true");
+    expect(configSetting("json", "storage", "enabled", "true")).toBe("`storage.enabled` to `true`");
+    expect(configKey("toml", "db", "password")).toBe("[db].password");
+    expect(configKey("json", "db", "password")).toBe("db.password");
+  });
+
+  it("maps a config path to its format and workdir-relative display path", () =>
+    Effect.gen(function* () {
+      const path = yield* Path.Path;
+      expect(configFileRefFromPath(path, "/work", "/work/supabase/config.jsonc")).toEqual({
+        format: "json",
+        path: "supabase/config.jsonc",
+      });
+      expect(configFileRefFromPath(path, "/work", undefined)).toEqual(DEFAULT_CONFIG_FILE);
+      expect(configFileName("supabase/config.json")).toBe("config.json");
+    }).pipe(Effect.provide(BunPath.layer), Effect.runSync));
+
+  it("names the config path with forward slashes on Windows", () =>
+    Effect.gen(function* () {
+      const path = yield* Path.Path;
+      expect(configFileRefFromPath(path, "C:\\work", "C:\\work\\supabase\\config.toml")).toEqual({
+        format: "toml",
+        path: "supabase/config.toml",
+      });
+    }).pipe(Effect.provide(BunPath.layerWin32), Effect.runSync));
+
+  it("keeps TOML guidance text and gives JSON projects a JSON snippet", () => {
+    expect(enableLocalWebhooksSuggestion()).toBe(
+      "Add the following to supabase/config.toml and retry:\n\n[experimental.webhooks]\nenabled = true",
+    );
+    expect(enableLocalWebhooksSuggestion(json)).toContain(
+      '{\n  "experimental": {\n    "webhooks": {\n      "enabled": true',
+    );
+    expect(schemaPathsTransitionWarning()).toContain("[db.migrations].schema_paths");
+    expect(schemaPathsTransitionWarning(json)).toContain(
+      "`experimental.pgdelta.enabled` to `false`",
+    );
+  });
+});
diff --git a/apps/cli/src/command-internal/config-file-ref.ts b/apps/cli/src/command-internal/config-file-ref.ts
new file mode 100644
index 0000000000..8401ea95be
--- /dev/null
+++ b/apps/cli/src/command-internal/config-file-ref.ts
@@ -0,0 +1,23 @@
+import { findCliProjectPaths } from "@supabase/config/effect";
+import { Effect, Option, Path } from "effect";
+import { CliConfigValues } from "../config/cli-config-values.service.ts";
+import { configFileRefFromPath, configFileRefOf, DEFAULT_CONFIG_FILE } from "./config-advice.ts";
+
+/** The workdir's config file, from the memoised resolved config; a failed load reads as no file. */
+export const loadConfigFileRef = Effect.fnUntraced(function* (workdir: string) {
+  const path = yield* Path.Path;
+  const values = yield* CliConfigValues;
+  return yield* values.load({ workdir, projectRef: Option.none() }).pipe(
+    Effect.map((resolvedConfig) => configFileRefOf(path, workdir, resolvedConfig)),
+    Effect.orElseSucceed(() => DEFAULT_CONFIG_FILE),
+  );
+});
+
+/** The workdir's config file found on disk (no resolved-config load); no file reads as the default. */
+export const findConfigFileRef = Effect.fnUntraced(function* (workdir: string) {
+  const path = yield* Path.Path;
+  const found = yield* findCliProjectPaths(workdir, { search: false }).pipe(
+    Effect.orElseSucceed(() => null),
+  );
+  return configFileRefFromPath(path, workdir, found?.configPath);
+});
diff --git a/apps/cli/src/command-internal/config-pull-run.ts b/apps/cli/src/command-internal/config-pull-run.ts
index 6588290991..b5c934d23e 100644
--- a/apps/cli/src/command-internal/config-pull-run.ts
+++ b/apps/cli/src/command-internal/config-pull-run.ts
@@ -35,6 +35,7 @@ import {
   configIsRecord,
   configPathKey,
 } from "../commands/config/config.paths.ts";
+import { configFileName } from "./config-advice.ts";
 import { loadDeclaredFileConfig, relativeConfigPath } from "../commands/config/config.load.ts";
 import {
   CONFIG_CLASS_LABELS,
@@ -833,10 +834,10 @@ function writtenCount(plan: ConfigPullPlan, outcome: ConfigPullOutcome): number
   return outcome.dryRun || outcome.declined ? 0 : plan.writes.length;
 }
 
-function renderLocal(local: unknown, declared: boolean): string {
+function renderLocal(local: unknown, declared: boolean, configPath: string): string {
   const value = configRenderValue(local, "(unset)");
   return local !== undefined && !declared
-    ? `${value} (schema default — not declared in config.toml)`
+    ? `${value} (schema default — not declared in ${configFileName(configPath)})`
     : value;
 }
 
@@ -942,7 +943,7 @@ export function renderConfigPullText(
       change.envVariables === undefined
         ? ""
         : ` (from env ${sanitizeInlineName(change.envVariables.join(", "))})`;
-    lines.push(`  local:  ${renderLocal(change.local, change.declared)}${env}`);
+    lines.push(`  local:  ${renderLocal(change.local, change.declared, configPath)}${env}`);
     lines.push(`  remote: ${configRenderValue(change.remote, "(not returned)")}`);
     lines.push("");
   }
diff --git a/apps/cli/src/command-internal/config-validate.parity.unit.test.ts b/apps/cli/src/command-internal/config-validate.parity.unit.test.ts
index 662b9e3d9b..0a8ea60460 100644
--- a/apps/cli/src/command-internal/config-validate.parity.unit.test.ts
+++ b/apps/cli/src/command-internal/config-validate.parity.unit.test.ts
@@ -1,5 +1,5 @@
 import { unusedStackServices } from "../../tests/helpers/unused-stack.ts";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { CliConfigSchema, type CliConfig } from "@supabase/config";
 import { stringify as stringifyToml } from "smol-toml";
@@ -7,7 +7,7 @@ import { Effect, Exit, FileSystem, Layer, Path, Schema } from "effect";
 
 import { withEnvVar, mockCommandSettings } from "../../tests/helpers/command-mocks.ts";
 import { CommandPlatformApiFactory } from "../auth/command-platform-api-factory.service.ts";
-import { readDbToml } from "./db-config.toml-read.ts";
+import { readDbConfig } from "./db-config.read.ts";
 import { resolveStorageCredentials } from "./storage-credentials.ts";
 import { resolveLocalConfigValues } from "./local-config-values.ts";
 import { runtimeInfoLayer } from "../shared/runtime/runtime-info.layer.ts";
@@ -17,7 +17,7 @@ const stringifyJson = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
 
 /**
  * Cross-caller parity coverage: for a table of shared misconfigurations, drives both real
- * pipelines — D (`readDbToml`, Effect/raw-TOML) and L (`resolveLocalConfigValues`,
+ * pipelines — D (`readDbConfig`, Effect/raw-TOML) and L (`resolveLocalConfigValues`,
  * `@supabase/config`-decoded) — and asserts they fail with the same error-message substring,
  * since both route through the single `validateResolvedConfig`. A third caller, the
  * storage-credentials resolver (S), shares the `api.port`/`api.tls` presence branches and the
@@ -25,7 +25,7 @@ const stringifyJson = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
  * that pipeline.
  *
  * D's harness replicates the `withConfig`/`read`/`failsWith` pattern from
- * `db-config.toml-read.unit.test.ts` (file-local there, not exported). L's harness replicates
+ * `db-config.read.unit.test.ts` (file-local there, not exported). L's harness replicates
  * the `baseConfig`/`WORKDIR` pattern from `local-config-values.unit.test.ts`.
  */
 
@@ -37,14 +37,16 @@ const withConfig = (content: string) =>
     yield* fs.makeDirectory(path.join(dir, "supabase"), { recursive: true });
     yield* fs.writeFileString(path.join(dir, "supabase", "config.toml"), content);
     return dir;
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const readD = (workdir: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    return yield* readDbToml(fs, path, workdir);
-  }).pipe(Effect.provide(Layer.merge(BunServices.layer, cliConfigValuesTestLayer)));
+    return yield* readDbConfig(fs, path, workdir);
+  }).pipe(
+    Effect.provide(Layer.mergeAll(BunServices.layer, BunCrypto.layer, cliConfigValuesTestLayer)),
+  );
 
 /** Drives D's real pipeline and asserts the failure message contains `message`. */
 function failsWithD(tomlLines: ReadonlyArray<string>, message: string) {
@@ -77,7 +79,7 @@ function failsWithL(
       resolveLocalConfigValues(config, "127.0.0.1", WORKDIR, document),
     );
     expect(error.message).toContain(message);
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 }
 
 interface ParityScenario {
@@ -344,6 +346,7 @@ describe("shared api + auth validation branches, cross-caller parity (S vs L)",
             unusedStackServices,
             cliConfigValuesTestLayer,
             BunServices.layer,
+            BunCrypto.layer,
             runtimeInfoLayer,
             mockCommandSettings({ workdir: dir }),
             // Local-path parity only — the remote branch (and with it the
diff --git a/apps/cli/src/command-internal/config-validate.ts b/apps/cli/src/command-internal/config-validate.ts
index dbec5fff8b..a525f82a81 100644
--- a/apps/cli/src/command-internal/config-validate.ts
+++ b/apps/cli/src/command-internal/config-validate.ts
@@ -15,7 +15,7 @@ import { parseUrl } from "./storage-url.ts";
 /**
  * Single home for config validation, shared by the two config readers:
  *
- * - **D** = `db-config.toml-read.ts`: raw TOML document, Effect-based, fails with
+ * - **D** = `db-config.read.ts`: raw TOML document, Effect-based, fails with
  *   `DbConfigLoadError`.
  * - **L** = `local-config-values.ts`: decoded `@supabase/config` `CliConfig`, Effect-based,
  *   fails with an `Error`.
@@ -191,6 +191,8 @@ export interface ExperimentalInput {
  * `studio`/`localSmtp` entirely; both D and L omit `auth` when auth is disabled).
  */
 export interface ConfigValidationInput {
+  /** The config file's name for messages that name it; defaults to `config.toml`. */
+  readonly configFileName?: string;
   /** L only — D doesn't validate `project_id` here. */
   readonly projectId?: string;
   /** L only — D has no `[api]` section. */
@@ -545,7 +547,7 @@ export function validateResolvedConfig(input: ConfigValidationInput): void {
     }
     if (input.analytics.gcpJwtPath.length === 0) {
       throw new ConfigValidateError(
-        "Path to GCP Service Account Key must be provided in config, relative to config.toml: analytics.gcp_jwt_path",
+        `Path to GCP Service Account Key must be provided in config, relative to ${input.configFileName ?? "config.toml"}: analytics.gcp_jwt_path`,
       );
     }
   }
@@ -609,7 +611,15 @@ export function signingKeysDecodeErrorMessage(cause: unknown): string {
  * project root all fail. This applies unconditionally to every caller (config validation,
  * `config push` content loading, `start`'s pre-Docker containment pass) — there is no opt-out.
  */
-export const resolveEmailTemplateContentPath = Effect.fnUntraced(function* (args: {
+export const resolveEmailTemplateContentPath = (
+  args: Parameters<typeof resolveEmailTemplatePaths>[0],
+) => resolveEmailTemplatePaths(args).pipe(Effect.map((paths) => paths?.canonical));
+
+/**
+ * {@link resolveEmailTemplateContentPath} with the configured candidate it validated, resolved
+ * once, which the stack reads per fetch so an in-root link may retarget.
+ */
+export const resolveEmailTemplatePaths = Effect.fnUntraced(function* (args: {
   readonly section: "template" | "notification";
   readonly name: string;
   /** Post-env-expand; `""` = absent. */
@@ -627,12 +637,7 @@ export const resolveEmailTemplateContentPath = Effect.fnUntraced(function* (args
     return undefined;
   }
   const path = yield* Path.Path;
-  const candidate =
-    args.section === "notification"
-      ? yield* resolveNotificationContentPath(args.base, args.contentPath)
-      : path.isAbsolute(args.contentPath)
-        ? args.contentPath
-        : path.join(args.base, args.contentPath);
+  const candidate = yield* emailTemplateCandidatePath(args.section, args.base, args.contentPath);
   const resolvedCanonical = yield* canonicalPathForContainment(candidate);
   const canonicalBase = yield* canonicalPathForContainment(args.base);
   if (!isPathContainedInRoot(path, canonicalBase, resolvedCanonical)) {
@@ -645,7 +650,19 @@ export const resolveEmailTemplateContentPath = Effect.fnUntraced(function* (args
         `move the file inside the project, or use a relative path that stays inside it.`,
     );
   }
-  return resolvedCanonical;
+  return { candidate, canonical: resolvedCanonical };
+});
+
+/* A non-empty `content_path` as configured, joined to `base` but not dereferenced, with the
+   notification fallback below. */
+const emailTemplateCandidatePath = Effect.fnUntraced(function* (
+  section: "template" | "notification",
+  base: string,
+  contentPath: string,
+) {
+  const path = yield* Path.Path;
+  if (section === "notification") return yield* resolveNotificationContentPath(base, contentPath);
+  return path.isAbsolute(contentPath) ? contentPath : path.join(base, contentPath);
 });
 
 /**
diff --git a/apps/cli/src/command-internal/config-validate.unit.test.ts b/apps/cli/src/command-internal/config-validate.unit.test.ts
index daf5921a8f..405a13d0e3 100644
--- a/apps/cli/src/command-internal/config-validate.unit.test.ts
+++ b/apps/cli/src/command-internal/config-validate.unit.test.ts
@@ -97,7 +97,7 @@ describe("CLERK_DOMAIN_PATTERN", () => {
 });
 
 // Direct coverage for the containment check shared by every caller (config push's
-// loadAuthEmailContent, db-config.toml-read.ts, local-config-values.ts, start.handler.ts's
+// loadAuthEmailContent, db-config.read.ts, local-config-values.ts, start.handler.ts's
 // pre-Docker pass), cheaper to pin here than to re-derive through every caller's own fixtures.
 layer(BunServices.layer)("resolveEmailTemplateContentPath", (it) => {
   const tempDir = (prefix: string) =>
diff --git a/apps/cli/src/command-internal/connect-errors.ts b/apps/cli/src/command-internal/connect-errors.ts
index 7fd6054e1f..69a6260429 100644
--- a/apps/cli/src/command-internal/connect-errors.ts
+++ b/apps/cli/src/command-internal/connect-errors.ts
@@ -55,6 +55,13 @@ export function isIPv6ConnectivityError(message: string): boolean {
 export const SUGGEST_ENV_VAR =
   "Connect to your database by setting the env var correctly: SUPABASE_DB_PASSWORD";
 
+/**
+ * Hint shown when the server certificate does not verify against the CA the connection trusts,
+ * which on a hosted project is the bundled Supabase CA unless the user chose a trust setting.
+ */
+export const SUGGEST_CA_VERIFICATION =
+  "The server certificate did not verify against the trusted CA (the bundled Supabase CA on a hosted project). Behind a TLS-inspecting proxy, set PGSSLROOTCERT to a CA bundle that trusts it, or set PGSSLMODE=require to skip certificate verification.";
+
 /**
  * Shown instead of the remote-only "Network Restrictions" hint when `ctx.isLocal` is true — a
  * refused `--local` connection (Docker/Postgres not running) needs a different fix than an
@@ -70,13 +77,16 @@ export function localStackSuggestion(linkedCheckout: boolean | undefined): strin
     : SUGGEST_LOCAL_STACK;
 }
 
+export const SUGGEST_NETWORK_RESTRICTIONS =
+  "Make sure your local IP is allowed in Network Restrictions and Network Bans.";
+
 /**
  * Remote-only "Network Restrictions" hint, shown for a connection refused or blocked by IP
  * allow-listing. Shared by both the always-remote `Address not in tenant allow_list` branch
  * and the non-local `ECONNREFUSED`/`connection refused` branch in `connectSuggestion`.
  */
-function suggestNetworkRestrictions(dashboardUrl: string): string {
-  return `Make sure your local IP is allowed in Network Restrictions and Network Bans.\n${dashboardUrl}/project/_/database/settings`;
+export function suggestNetworkRestrictions(dashboardUrl: string): string {
+  return `${SUGGEST_NETWORK_RESTRICTIONS}\n${dashboardUrl}/project/_/database/settings`;
 }
 
 /** Context the connect-suggestion needs but cannot derive from the error alone. */
@@ -221,6 +231,31 @@ const TLS_ERROR_CODES = new Set([
   "CERT_REJECTED",
   "HOSTNAME_MISMATCH",
 ]);
+
+const CERT_VERIFICATION_CODES: ReadonlySet<string> = new Set([
+  ...[...TLS_ERROR_CODES].filter((code) => code !== "OUT_OF_MEM"),
+  // Node and Bun's `checkServerIdentity` failure, which `verify-full` raises on a hostname mismatch.
+  "ERR_TLS_CERT_ALTNAME_INVALID",
+]);
+
+/**
+ * Whether the remote pooler rejected the caller's IP for project network restrictions. Only
+ * the allow-list changing can fix it, so it sets `DbConnectError.networkRestricted`, which the
+ * temp-role probe keys off to stop retrying.
+ */
+export function isNetworkRestrictionFailure(error: unknown): boolean {
+  return collectConnectErrorText(error).includes("Address not in tenant allow_list");
+}
+
+/**
+ * Whether a connect failure is an X509 certificate-verification rejection. It is deterministic:
+ * the same server certificate fails the same way on every attempt. Sets
+ * `DbConnectError.certificateRejected`, which the temp-role probe keys off to stop retrying.
+ */
+export function isCertificateVerificationFailure(error: unknown): boolean {
+  const cause = deepestConnectCause(error);
+  return hasStringCode(cause) && CERT_VERIFICATION_CODES.has(cause.code);
+}
 // node-postgres' own message when the server answers `N` to SSLRequest
 // (`pg/lib/connection.js`); rendered as `tls error (server refused TLS connection)`.
 const SERVER_REFUSED_SSL = "The server does not support SSL connections";
@@ -233,6 +268,35 @@ const SERVER_REFUSED_SSL = "The server does not support SSL connections";
 // post-handshake `read ECONNRESET` is not phase-specific and stays verbatim.
 const TLS_DISCONNECT_MESSAGE =
   "Client network socket disconnected before secure TLS connection was established";
+// node-postgres' message when the server answers the SSLRequest with anything but `S`/`N`.
+const SSL_NEGOTIATION_ERROR = "There was an error establishing an SSL connection";
+// Handshake failures that carry no TLS-specific code: Node's `EPROTO` for a malformed TLS record,
+// and Bun's `ERR_SOCKET_CLOSED` when the server hangs up after accepting the SSLRequest.
+const TLS_HANDSHAKE_ERRNOS = new Set(["EPROTO", "ERR_SOCKET_CLOSED"]);
+
+const isTlsStageCause = (text: unknown, code: unknown): boolean =>
+  text === SERVER_REFUSED_SSL ||
+  text === TLS_DISCONNECT_MESSAGE ||
+  (typeof code === "string" &&
+    (TLS_ERROR_CODES.has(code) || code.startsWith("ERR_TLS") || code.startsWith("ERR_SSL")));
+
+/**
+ * Whether a connect failure came from negotiating TLS (the server declined or botched the
+ * SSLRequest, or the handshake failed) rather than from dialing, authenticating, or a server
+ * error. The `sslmode=prefer` plaintext fallback retries on these.
+ */
+export function isTlsNegotiationFailure(error: unknown): boolean {
+  const cause = deepestConnectCause(error);
+  if (typeof cause !== "object" || cause === null) return false;
+  const message = Reflect.get(cause, "message");
+  const code = Reflect.get(cause, "code");
+  return (
+    isTlsStageCause(message, code) ||
+    message === SSL_NEGOTIATION_ERROR ||
+    (typeof code === "string" && TLS_HANDSHAKE_ERRNOS.has(code))
+  );
+}
+
 // A Postgres SQLSTATE is exactly five uppercase alphanumerics. Combined with the
 // `severity` field this identifies a node-postgres `DatabaseError` (a server
 // ErrorResponse), never a node system error (whose codes are longer `E…` names).
@@ -281,12 +345,7 @@ function connectCauseDetail(cause: unknown): string {
   if (syscall === "connect" || (typeof code === "string" && DIAL_ERROR_CODES.has(code))) {
     return `dial error (${text})`;
   }
-  if (
-    text === SERVER_REFUSED_SSL ||
-    text === TLS_DISCONNECT_MESSAGE ||
-    (typeof code === "string" &&
-      (TLS_ERROR_CODES.has(code) || code.startsWith("ERR_TLS") || code.startsWith("ERR_SSL")))
-  ) {
+  if (isTlsStageCause(text, code)) {
     return `tls error (${text})`;
   }
   return text;
@@ -354,7 +413,7 @@ export function connectSuggestion(
   const text = collectConnectErrorText(error);
   // "Address not in tenant allow_list" only ever comes from the remote pooler rejecting the
   // caller's IP, so it always means network restrictions.
-  if (text.includes("Address not in tenant allow_list")) {
+  if (isNetworkRestrictionFailure(error)) {
     return suggestNetworkRestrictions(ctx.dashboardUrl);
   }
   // Don't send the user to the dashboard's Network Restrictions page for a --local connection.
@@ -363,6 +422,7 @@ export function connectSuggestion(
       ? localStackSuggestion(ctx.linkedCheckout)
       : suggestNetworkRestrictions(ctx.dashboardUrl);
   }
+  if (isCertificateVerificationFailure(error)) return SUGGEST_CA_VERIFICATION;
   if (
     text.includes("SCRAM exchange: Wrong password") ||
     text.includes("failed SASL auth") ||
@@ -370,8 +430,8 @@ export function connectSuggestion(
   ) {
     return SUGGEST_ENV_VAR;
   }
-  // An unset `sslmode` negotiates TLS and fails rather than downgrading, so a server without
-  // TLS needs the caller to opt into plaintext explicitly.
+  // Reached when plaintext is not an allowed fallback (`sslmode=require` or stricter), so the
+  // caller must opt into plaintext explicitly.
   if (text.includes(SERVER_REFUSED_SSL) || text.includes("server refused TLS connection")) {
     return "This server does not accept TLS. Set `sslmode=disable` on the connection string to connect in plaintext.";
   }
diff --git a/apps/cli/src/command-internal/connect-errors.unit.test.ts b/apps/cli/src/command-internal/connect-errors.unit.test.ts
index 3b31e9d043..33f6c0f953 100644
--- a/apps/cli/src/command-internal/connect-errors.unit.test.ts
+++ b/apps/cli/src/command-internal/connect-errors.unit.test.ts
@@ -3,14 +3,18 @@ import * as Pg from "pg";
 import { describe, expect, it } from "vitest";
 
 import {
+  SUGGEST_CA_VERIFICATION,
   SUGGEST_ENV_VAR,
   SUGGEST_LOCAL_STACK,
   connectFailureMessage,
   connectSuggestion,
   ipv6Suggestion,
+  isCertificateVerificationFailure,
+  isNetworkRestrictionFailure,
   isDialFailure,
   isIPv6ConnectivityError,
   isIPv6ConnectivityErrorCause,
+  isTlsNegotiationFailure,
 } from "./connect-errors.ts";
 
 // The real `@effect/sql` wrapper produced by the connect probe
@@ -269,6 +273,13 @@ describe("connectSuggestion", () => {
     );
   });
 
+  it("maps a certificate-verification failure to the CA hint", () => {
+    const err = sqlError(
+      systemError("self-signed certificate in certificate chain", "SELF_SIGNED_CERT_IN_CHAIN"),
+    );
+    expect(connectSuggestion(err, ctx)).toBe(SUGGEST_CA_VERIFICATION);
+  });
+
   it("maps a refused local connection to the local stack hint", () => {
     const err = sqlError(systemError("connect ECONNREFUSED 127.0.0.1:54322", "ECONNREFUSED"));
     expect(connectSuggestion(err, { ...ctx, isLocal: true })).toBe(SUGGEST_LOCAL_STACK);
@@ -421,6 +432,34 @@ describe("connectSuggestion", () => {
   });
 });
 
+describe("isCertificateVerificationFailure", () => {
+  it("matches the X509 verification codes but not other TLS or dial failures", () => {
+    const withCode = (code: string) =>
+      realSqlConnectError(Object.assign(new Error("failure"), { code }));
+    expect(isCertificateVerificationFailure(withCode("SELF_SIGNED_CERT_IN_CHAIN"))).toBe(true);
+    expect(isCertificateVerificationFailure(withCode("CERT_HAS_EXPIRED"))).toBe(true);
+    expect(isCertificateVerificationFailure(withCode("ERR_TLS_CERT_ALTNAME_INVALID"))).toBe(true);
+    expect(isCertificateVerificationFailure(withCode("OUT_OF_MEM"))).toBe(false);
+    expect(isCertificateVerificationFailure(withCode("ECONNREFUSED"))).toBe(false);
+    expect(isCertificateVerificationFailure(withCode("ECONNRESET"))).toBe(false);
+    expect(isCertificateVerificationFailure(authFailedError())).toBe(false);
+  });
+});
+
+describe("isNetworkRestrictionFailure", () => {
+  it("matches the pooler's allow-list rejection but not other failures", () => {
+    expect(
+      isNetworkRestrictionFailure(
+        realSqlConnectError(new Error("Address not in tenant allow_list: 1.2.3.4")),
+      ),
+    ).toBe(true);
+    expect(isNetworkRestrictionFailure(authFailedError())).toBe(false);
+    expect(isNetworkRestrictionFailure(realSqlConnectError(new Error("some other failure")))).toBe(
+      false,
+    );
+  });
+});
+
 describe("isDialFailure", () => {
   it("classifies dial errno failures", () => {
     expect(isDialFailure(realSqlConnectError(dialError("ECONNREFUSED", "127.0.0.1", 54322)))).toBe(
@@ -530,3 +569,30 @@ describe("isIPv6ConnectivityErrorCause", () => {
     ).toBe(true);
   });
 });
+
+describe("isTlsNegotiationFailure (sslmode=prefer plaintext fallback gate)", () => {
+  it("is true for a declined SSLRequest, a botched reply, and TLS handshake failures", () => {
+    for (const cause of [
+      new Error("The server does not support SSL connections"),
+      new Error("There was an error establishing an SSL connection"),
+      new Error("Client network socket disconnected before secure TLS connection was established"),
+      Object.assign(new Error("wrong version number"), { code: "ERR_SSL_WRONG_VERSION_NUMBER" }),
+      Object.assign(new Error("write EPROTO wrong version number"), { code: "EPROTO" }),
+      Object.assign(new Error("Socket is closed"), { code: "ERR_SOCKET_CLOSED" }),
+    ]) {
+      expect(isTlsNegotiationFailure(realSqlConnectError(cause))).toBe(true);
+    }
+  });
+
+  it("is false for dial, timeout, authentication and unclassified failures", () => {
+    for (const cause of [
+      dialError("ECONNREFUSED", "127.0.0.1", 5432),
+      new Error("Connection terminated unexpectedly"),
+      new Error("timeout expired"),
+      Object.assign(new Error("password authentication failed"), { code: "28P01" }),
+    ]) {
+      expect(isTlsNegotiationFailure(realSqlConnectError(cause))).toBe(false);
+    }
+    expect(isTlsNegotiationFailure("boom")).toBe(false);
+  });
+});
diff --git a/apps/cli/src/command-internal/container-cli.ts b/apps/cli/src/command-internal/container-cli.ts
index c6f165ea50..5371f4ba02 100644
--- a/apps/cli/src/command-internal/container-cli.ts
+++ b/apps/cli/src/command-internal/container-cli.ts
@@ -307,18 +307,35 @@ function isDockerApiVersionAtLeast(version: string, minVersion: string): boolean
  * fall back to Podman, whose `volume prune` has no `--all` flag to gate.
  */
 export const dockerSupportsVolumePruneAllFlag = (spawner: Spawner) =>
+  dockerApiVersionsSatisfy(spawner, (version) => isDockerApiVersionAtLeast(version, "1.42"));
+
+/**
+ * `docker create --health-start-interval` needs API >= 1.44 on both ends and is a hard failure
+ * below that. The Podman CLI rejects the flag, and a `docker` shim for it fails this format or
+ * prints Podman's own `6.x`, so a major other than 1 is not Docker's API. The real `docker` client
+ * on a Podman socket reporting 1.44 passes: Podman keeps the start period and drops the start
+ * interval.
+ */
+export const dockerSupportsHealthStartInterval = (spawner: Spawner) =>
+  dockerApiVersionsSatisfy(
+    spawner,
+    (version) => version.startsWith("1.") && isDockerApiVersionAtLeast(version, "1.44"),
+  );
+
+/* Reads the client's own and effective API versions and the daemon's, `false` on any failure.
+   `DOCKER_API_VERSION` can lift the effective one past what the client binary supports. */
+const dockerApiVersionsSatisfy = (spawner: Spawner, supported: (version: string) => boolean) =>
   Effect.scoped(
     Effect.gen(function* () {
-      const child = yield* spawner.spawn(
-        ChildProcess.make(
-          "docker",
-          ["version", "--format", "{{.Client.APIVersion}} {{.Server.APIVersion}}"],
-          {
-            stdin: "ignore",
-            stdout: "pipe",
-            stderr: "ignore",
-          },
-        ),
+      const child = yield* spawnRuntime(
+        spawner,
+        "docker",
+        [
+          "version",
+          "--format",
+          "{{.Client.DefaultAPIVersion}} {{.Client.APIVersion}} {{.Server.APIVersion}}",
+        ],
+        { stdin: "ignore", stdout: "pipe", stderr: "ignore" },
       );
       const [exitCode, stdout] = yield* Effect.all(
         [child.exitCode.pipe(Effect.map(Number)), collectText(child.stdout)],
@@ -326,9 +343,6 @@ export const dockerSupportsVolumePruneAllFlag = (spawner: Spawner) =>
       );
       if (exitCode !== 0) return false;
       const versions = stdout.trim().split(/\s+/);
-      return (
-        versions.length === 2 &&
-        versions.every((version) => isDockerApiVersionAtLeast(version, "1.42"))
-      );
+      return versions.length === 3 && versions.every(supported);
     }),
   ).pipe(Effect.orElseSucceed(() => false));
diff --git a/apps/cli/src/command-internal/container-cli.unit.test.ts b/apps/cli/src/command-internal/container-cli.unit.test.ts
index d65317e74c..01fbd0fdf9 100644
--- a/apps/cli/src/command-internal/container-cli.unit.test.ts
+++ b/apps/cli/src/command-internal/container-cli.unit.test.ts
@@ -6,6 +6,7 @@ import {
   containerCliExitCode,
   containerRuntimeNotFoundMessage,
   describeContainerCliFailure,
+  dockerSupportsHealthStartInterval,
   dockerSupportsVolumePruneAllFlag,
   isContainerNotFoundMessage,
   spawnContainerCli,
@@ -17,7 +18,11 @@ function mockSpawner(
     readonly bothMissing?: boolean;
     readonly exitCode?: number;
     readonly stdout?: string;
-    readonly apiVersions?: { readonly client: string; readonly server: string };
+    readonly apiVersions?: {
+      readonly clientDefault?: string;
+      readonly client: string;
+      readonly server: string;
+    };
   } = {},
 ) {
   const spawned: Array<{ readonly command: string; readonly args: ReadonlyArray<string> }> = [];
@@ -25,7 +30,7 @@ function mockSpawner(
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
       const cmd = command._tag === "StandardCommand" ? command.command : "";
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push({ command: cmd, args });
 
       if ((opts.dockerMissing && cmd === "docker") || opts.bothMissing === true) {
@@ -40,6 +45,10 @@ function mockSpawner(
       const stdout =
         opts.apiVersions !== undefined && args[0] === "version"
           ? (args[args.indexOf("--format") + 1] ?? "")
+              .replaceAll(
+                "{{.Client.DefaultAPIVersion}}",
+                opts.apiVersions.clientDefault ?? opts.apiVersions.client,
+              )
               .replaceAll("{{.Client.APIVersion}}", opts.apiVersions.client)
               .replaceAll("{{.Server.APIVersion}}", opts.apiVersions.server)
           : opts.stdout;
@@ -229,6 +238,57 @@ describe("container CLI process spans", () => {
   );
 });
 
+describe("dockerSupportsHealthStartInterval", () => {
+  it.live.each([
+    { name: "both ends at the 1.44 minimum", client: "1.44", server: "1.44" },
+    { name: "a new client against a newer daemon", client: "1.47", server: "1.56" },
+    { name: "a three-part API version", client: "1.44.0", server: "1.44.0" },
+  ])("returns true for $name", ({ client, server }) => {
+    const mock = mockSpawner({ apiVersions: { client, server } });
+    return dockerSupportsHealthStartInterval(mock.spawner).pipe(
+      Effect.map((supported) => {
+        expect(supported).toBe(true);
+      }),
+    );
+  });
+
+  it.live.each([
+    {
+      name: "a client below API 1.44",
+      options: { apiVersions: { client: "1.43", server: "1.56" } },
+    },
+    {
+      name: "an old client with DOCKER_API_VERSION forced up",
+      options: { apiVersions: { clientDefault: "1.43", client: "1.44", server: "1.56" } },
+    },
+    {
+      name: "a daemon below API 1.44",
+      options: { apiVersions: { client: "1.56", server: "1.43" } },
+    },
+    {
+      name: "a docker shim printing Podman's own version",
+      options: { apiVersions: { client: "6.1.3", server: "6.1.3" } },
+    },
+    {
+      name: "a shim whose major starts with a 1",
+      options: { apiVersions: { client: "10.1.0", server: "10.1.0" } },
+    },
+    { name: "fewer than three versions", options: { stdout: "1.56 1.56" } },
+    {
+      name: "the version command exiting non-zero",
+      options: { exitCode: 1, stdout: "1.56 1.56 1.56" },
+    },
+    { name: "docker not being installed", options: { dockerMissing: true } },
+  ])("returns false for $name", ({ options }) => {
+    const mock = mockSpawner(options);
+    return dockerSupportsHealthStartInterval(mock.spawner).pipe(
+      Effect.map((supported) => {
+        expect(supported).toBe(false);
+      }),
+    );
+  });
+});
+
 describe("dockerSupportsVolumePruneAllFlag", () => {
   it.live(
     "returns true when the client and daemon both report an API version at or above 1.42",
@@ -240,7 +300,11 @@ describe("dockerSupportsVolumePruneAllFlag", () => {
           expect(mock.spawned).toEqual([
             {
               command: "docker",
-              args: ["version", "--format", "{{.Client.APIVersion}} {{.Server.APIVersion}}"],
+              args: [
+                "version",
+                "--format",
+                "{{.Client.DefaultAPIVersion}} {{.Client.APIVersion}} {{.Server.APIVersion}}",
+              ],
             },
           ]);
         }),
@@ -266,8 +330,8 @@ describe("dockerSupportsVolumePruneAllFlag", () => {
       name: "versions that only compare above 1.42 lexicographically",
       options: { apiVersions: { client: "1.9", server: "1.9" } },
     },
-    { name: "a single version instead of a client and daemon pair", options: { stdout: "1.51" } },
-    { name: "more than two versions", options: { stdout: "1.51 1.51 1.51" } },
+    { name: "a single version", options: { stdout: "1.51" } },
+    { name: "more than three versions", options: { stdout: "1.51 1.51 1.51 1.51" } },
     { name: "empty output", options: { stdout: "" } },
   ])("returns false for $name", ({ options }) => {
     const mock = mockSpawner(options);
diff --git a/apps/cli/src/command-internal/db-bootstrap/await-storage-ready.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/await-storage-ready.unit.test.ts
index cb35de6488..52a45f9678 100644
--- a/apps/cli/src/command-internal/db-bootstrap/await-storage-ready.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/await-storage-ready.unit.test.ts
@@ -19,7 +19,7 @@ function mockSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push(args);
       const result = handler(args);
 
diff --git a/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.ts b/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.ts
index 85457f9137..e5246a7cc1 100644
--- a/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.ts
@@ -34,6 +34,7 @@ import {
 import {
   buildStartContainerCreateArgs,
   applyBitbucketStartContainerFilter,
+  applyHealthStartInterval,
   isDockerClientEnvKey,
   type StartContainerSpec,
 } from "./docker-create-args.ts";
@@ -124,6 +125,11 @@ export interface ContainerOpts {
   readonly projectId: string;
   /** Passed in (rather than read via env here) so this module stays a pure effect orchestrator. */
   readonly isBitbucketPipeline: boolean;
+  /**
+   * Whether the engine takes `--health-start-interval`, probed once per run by each command that
+   * reads Docker's health status. Shadow databases leave it unset: nothing reads theirs.
+   */
+  readonly healthStartInterval?: boolean;
   /**
    * Stamped onto every created container as {@link CLI_WORKDIR_LABEL} so a later `stop` or
    * {@link rollbackStart} can find this directory from the container's own label alone, without
@@ -183,7 +189,7 @@ function portConflictSuggestion(hostPort: string, serviceLabel: string): string
   return (
     `\nTry stopping the project or container already using ${hostPort} ` +
     "(`docker ps` lists what's bound to it, or `supabase stop` for another local Supabase project), " +
-    `or configure a different ${serviceLabel} port in supabase/config.toml.`
+    `or configure a different ${serviceLabel} port in your config file.`
   );
 }
 
@@ -716,7 +722,10 @@ export function createContainer(
       }
     }
 
-    const finalSpec = applyBitbucketStartContainerFilter(labeledSpec, opts.isBitbucketPipeline);
+    const finalSpec = applyHealthStartInterval(
+      applyBitbucketStartContainerFilter(labeledSpec, opts.isBitbucketPipeline),
+      opts.healthStartInterval === true,
+    );
 
     const createArgs = buildStartContainerCreateArgs(finalSpec);
     // `isDockerClientEnvKey` keys are already emitted inline as `-e KEY=value` above; see
diff --git a/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.unit.test.ts
index 648474c306..0cf21ec579 100644
--- a/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.unit.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Deferred, Effect, PlatformError, Sink, Stream } from "effect";
+import { Deferred, Effect, PlatformError, type Redacted, Sink, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 
 import {
@@ -31,14 +31,14 @@ function mockSpawner(
   const spawned: Array<ReadonlyArray<string>> = [];
   const spawnedOptions: Array<{
     readonly args: ReadonlyArray<string>;
-    readonly env: Record<string, string | undefined> | undefined;
+    readonly env: Record<string, string | Redacted.Redacted<string> | undefined> | undefined;
     readonly extendEnv: boolean | undefined;
     readonly stdin: ChildProcess.CommandInput | ChildProcess.StdinConfig | undefined;
   }> = [];
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push(args);
       if (command._tag === "StandardCommand") {
         spawnedOptions.push({
@@ -297,6 +297,65 @@ describe("createContainer", () => {
     );
   });
 
+  describe("Docker's first health check", () => {
+    const steady = { test: ["CMD", "true"], intervalSeconds: 10, timeoutSeconds: 2, retries: 3 };
+    const steadyFlags = {
+      "--health-cmd": "true",
+      "--health-interval": "10s",
+      "--health-timeout": "2s",
+      "--health-retries": "3",
+    };
+    const startFlags = { "--health-start-period": "10s", "--health-start-interval": "1s" };
+
+    it.live.each([
+      {
+        name: "adds start flags where the engine takes them",
+        healthcheck: steady,
+        supported: true,
+        expected: { ...steadyFlags, ...startFlags },
+      },
+      {
+        name: "keeps a service's own start period",
+        healthcheck: { ...steady, startPeriodSeconds: 20 },
+        supported: true,
+        expected: { ...steadyFlags, ...startFlags, "--health-start-period": "20s" },
+      },
+      {
+        name: "adds none where the engine rejects them",
+        healthcheck: steady,
+        supported: false,
+        expected: steadyFlags,
+      },
+      {
+        name: "adds none for a caller that never asked",
+        healthcheck: steady,
+        expected: steadyFlags,
+      },
+      { name: "adds none without a healthcheck", supported: true, expected: {} },
+    ])("$name", ({ healthcheck, supported, expected }) => {
+      const mock = alwaysSucceed();
+      return createContainer(
+        mock.spawner,
+        { ...baseSpec, binds: [], ...(healthcheck === undefined ? {} : { healthcheck }) },
+        {
+          projectId: "proj",
+          isBitbucketPipeline: false,
+          workdir: workdir.current,
+          extraHosts: [],
+          ...(supported === undefined ? {} : { healthStartInterval: supported }),
+        },
+      ).pipe(
+        Effect.map(() => {
+          const args = mock.spawned.find((spawned) => spawned[0] === "create") ?? [];
+          const flags = args.flatMap((arg, index) =>
+            arg.startsWith("--health-") ? [[arg, args[index + 1]]] : [],
+          );
+          expect(Object.fromEntries(flags)).toEqual(expected);
+        }),
+      );
+    });
+  });
+
   it.live("fails with ContainerStartError, unmodified, on a plain start failure", () => {
     const mock = mockSpawner((args) => {
       if (args[0] === "create") return { exitCode: 0, stdout: "abc\n" };
@@ -346,7 +405,7 @@ describe("createContainer", () => {
           expect(error).toBeInstanceOf(ContainerStartError);
           expect(error.message).toContain('failed to start docker container "supabase_db_proj"');
           expect(error.message).toContain("0.0.0.0:5432");
-          expect(error.message).toContain("db port in supabase/config.toml");
+          expect(error.message).toContain("db port in your config file");
         }),
       );
     },
diff --git a/apps/cli/src/command-internal/db-bootstrap/db-setup.ts b/apps/cli/src/command-internal/db-bootstrap/db-setup.ts
index d823034fb0..b3f5fccbe1 100644
--- a/apps/cli/src/command-internal/db-bootstrap/db-setup.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/db-setup.ts
@@ -30,7 +30,7 @@ import type {
 } from "../../config/cli-config.errors.ts";
 import type { ProjectRefReadError } from "../../shared/config/legacy-project-state.service.ts";
 import { DbConfigLoadError } from "../db-config.errors.ts";
-import { checkDbToml } from "../db-config.toml-read.ts";
+import { checkDbConfig } from "../db-config.read.ts";
 import { CLI_PROJECT_LABEL, localDbContainerId } from "../docker-ids.ts";
 import { DockerRun, type DockerRunOpts } from "../docker-run.service.ts";
 import { migrateAndSeed } from "../migrate-and-seed.ts";
@@ -851,10 +851,10 @@ export const startSetupLocalDatabase = (
   Effect.gen(function* () {
     const { session, fs, path, workdir } = input;
 
-    // `warnOnUnresolvedEnv: false`: the caller's own handler already ran an earlier `checkDbToml`
+    // `warnOnUnresolvedEnv: false`: the caller's own handler already ran an earlier `checkDbConfig`
     // pass before reaching this fresh-volume setup, which already printed any unresolved-env
     // warning. Without this, this module's own duplicate config-load pass would print it twice.
-    const toml = yield* checkDbToml(fs, path, workdir, undefined, {
+    const toml = yield* checkDbConfig(fs, path, workdir, undefined, {
       warnOnUnresolvedEnv: false,
     });
 
@@ -874,6 +874,7 @@ export const startSetupLocalDatabase = (
       pgDeltaEnabled: toml.pgDelta.enabled,
       schemaPaths: toml.schemaPaths,
       localDatabaseWebhooksEnabled: toml.webhooksEnabled,
+      configFile: toml.configFile,
     });
   });
 
diff --git a/apps/cli/src/command-internal/db-bootstrap/docker-create-args.ts b/apps/cli/src/command-internal/db-bootstrap/docker-create-args.ts
index d379bc7a39..1c38d17ae1 100644
--- a/apps/cli/src/command-internal/db-bootstrap/docker-create-args.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/docker-create-args.ts
@@ -23,6 +23,8 @@ interface StartHealthcheckSpec {
   readonly retries?: number;
   /** Emitted as `--health-start-period <n>s`; omitted when unset. */
   readonly startPeriodSeconds?: number;
+  /** Emitted as `--health-start-interval <n>s`; see {@link applyHealthStartInterval}. */
+  readonly startIntervalSeconds?: number;
 }
 
 /** One `-p <hostPort>:<containerPort>[/<protocol>]` entry. */
@@ -203,6 +205,12 @@ function buildHealthcheckArgs(healthcheck: StartHealthcheckSpec): ReadonlyArray<
   if (healthcheck.startPeriodSeconds !== undefined) {
     args.push("--health-start-period", formatDockerDurationSeconds(healthcheck.startPeriodSeconds));
   }
+  if (healthcheck.startIntervalSeconds !== undefined) {
+    args.push(
+      "--health-start-interval",
+      formatDockerDurationSeconds(healthcheck.startIntervalSeconds),
+    );
+  }
   return args;
 }
 
@@ -288,3 +296,26 @@ export function applyBitbucketStartContainerFilter(
     securityOpt: [],
   };
 }
+
+/* Docker returns to `--health-interval` after the first pass or the end of the start period. */
+const HEALTH_START_INTERVAL_SECONDS = 1;
+/* The start interval only runs inside a start period, whose failures do not count. One steady
+   interval keeps `unhealthy` where it was, or one interval later if a slow probe straddles it. */
+const HEALTH_START_PERIOD_SECONDS = 10;
+
+/* Runs a container's first health checks right after it starts instead of a full interval later.
+   `supported` comes from `dockerSupportsHealthStartInterval`; without it the spec is unchanged. */
+export function applyHealthStartInterval(
+  spec: StartContainerSpec,
+  supported: boolean,
+): StartContainerSpec {
+  if (!supported || spec.healthcheck === undefined) return spec;
+  return {
+    ...spec,
+    healthcheck: {
+      ...spec.healthcheck,
+      startPeriodSeconds: spec.healthcheck.startPeriodSeconds ?? HEALTH_START_PERIOD_SECONDS,
+      startIntervalSeconds: HEALTH_START_INTERVAL_SECONDS,
+    },
+  };
+}
diff --git a/apps/cli/src/command-internal/db-bootstrap/health-check.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/health-check.unit.test.ts
index 81aba24804..a92c938686 100644
--- a/apps/cli/src/command-internal/db-bootstrap/health-check.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/health-check.unit.test.ts
@@ -79,7 +79,7 @@ function mockHealthSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       const binary = command._tag === "StandardCommand" ? command.command : "";
       // Mirrors a host where only one runtime is installed: `spawnContainerCli`
       // tries `docker` first and falls back to `podman` when the spawn fails.
diff --git a/apps/cli/src/command-internal/db-bootstrap/image-prepull.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/image-prepull.unit.test.ts
index 2e4835d52e..53bc69f843 100644
--- a/apps/cli/src/command-internal/db-bootstrap/image-prepull.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/image-prepull.unit.test.ts
@@ -15,7 +15,7 @@ function mockSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push(args);
       const result = handler(args);
 
@@ -114,7 +114,7 @@ describe("ensureImagesCached", () => {
 
       const spawner = ChildProcessSpawner.make((command) =>
         Effect.gen(function* () {
-          const args = command._tag === "StandardCommand" ? command.args : [];
+          const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
           if (args[0] === "image" && args[1] === "inspect") {
             const count = yield* Ref.updateAndGet(inFlight, (n) => n + 1);
             yield* Ref.update(peak, (n) => Math.max(n, count));
diff --git a/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.precedence.integration.test.ts b/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.precedence.integration.test.ts
index 3cb27f822b..e772c960fc 100644
--- a/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.precedence.integration.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.precedence.integration.test.ts
@@ -1,9 +1,10 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, it } from "@effect/vitest";
 import { ConfigProvider, Effect, FileSystem, Layer, Option, Path } from "effect";
 import { ChildProcessSpawner } from "effect/process";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
+import { catalogPins } from "@supabase/stack/internal/artifacts";
 
 import { cliConfigValuesTestLayer } from "../../../tests/helpers/config-values-layer.ts";
 import { mockRuntimeInfo } from "../../../tests/helpers/mocks.ts";
@@ -16,6 +17,9 @@ import { buildLocalDbContainerInputs } from "./local-container-inputs.ts";
 
 const TARGET_REF = "abcdefghijklmnopqrst";
 const GOLDEN_DIR = "./testdata/config-precedence/local-container-inputs";
+const DEFAULT_POSTGRES_IMAGE = catalogPins().find(
+  (entry) => entry.service === "database" && entry.isDefault,
+)!.pin.upstreamImage;
 
 const BASE_CONFIG = `project_id = "golden-shadow"
 
@@ -142,6 +146,7 @@ describe("local container inputs precedence goldens", () => {
 
         const layer = Layer.mergeAll(
           BunServices.layer,
+          BunCrypto.layer,
           cliConfigValuesTestLayer,
           Layer.succeed(ConfigEnvPins, fixture.shellEnv ?? {}),
           mockRuntimeInfo({ platform: "linux" }),
@@ -192,7 +197,10 @@ describe("local container inputs precedence goldens", () => {
             projectEnvValues: configEnvOnly(setup.projectEnvValues ?? {}),
           },
         };
-        const goldenText = yield* goldenJson(golden, { [workdir]: "<WORKDIR>" });
+        const goldenText = (yield* goldenJson(golden, { [workdir]: "<WORKDIR>" })).replaceAll(
+          `"${DEFAULT_POSTGRES_IMAGE}"`,
+          `"<DEFAULT_POSTGRES_IMAGE>"`,
+        );
         yield* Effect.promise(() =>
           ctx.expect(goldenText).toMatchFileSnapshot(`${GOLDEN_DIR}/${fixture.golden}.json`),
         );
diff --git a/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.ts b/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.ts
index 6986dff839..d0766f0f17 100644
--- a/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.ts
@@ -8,7 +8,8 @@
  * separately-resolved `--experimental` gate (needed earlier, before `cfg.isLocal` is known).
  */
 
-import { Crypto, Effect, FileSystem, Option, Path } from "effect";
+import { Effect, FileSystem, Option, Path } from "effect";
+import { Digest } from "effect/crypto";
 import { HttpClient } from "effect/http";
 import type { ChildProcessSpawner } from "effect/process/ChildProcessSpawner";
 import type { GlobalFlag } from "effect/cli";
@@ -93,7 +94,7 @@ export const buildLocalDbContainerInputs = (
   | FileSystem.FileSystem
   | Path.Path
   | RuntimeInfo
-  | Crypto.Crypto
+  | Digest.Digest
   | GlobalFlag.Setting.Identifier<"experimental">
   | CliArgs
   | HttpClient.HttpClient
@@ -111,9 +112,13 @@ export const buildLocalDbContainerInputs = (
     const document = resolvedConfig.loaded.document ?? {};
     const experimental = yield* resolveExperimentalWithProjectEnv(projectEnvValues);
 
-    const values = yield* resolveLocalConfigValues(config, hostname, workdir, document).pipe(
-      Effect.mapError((cause) => mapError(cause.message)),
-    );
+    const values = yield* resolveLocalConfigValues(
+      config,
+      hostname,
+      workdir,
+      document,
+      resolvedConfig.hasConfigFile ? resolvedConfig.loaded.path : undefined,
+    ).pipe(Effect.mapError((cause) => mapError(cause.message)));
 
     const bootstrapConfig = yield* resolveDbBootstrapConfig(
       fs,
diff --git a/apps/cli/src/command-internal/db-bootstrap/local-db-running.integration.test.ts b/apps/cli/src/command-internal/db-bootstrap/local-db-running.integration.test.ts
index c04f53fada..6e91a82c81 100644
--- a/apps/cli/src/command-internal/db-bootstrap/local-db-running.integration.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/local-db-running.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunHttpServer, BunServices, BunSocketServer } from "@effect/platform-bun";
+import { BunCrypto, BunHttpServer, BunServices, BunSocketServer } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { ConfigProvider, Effect, FileSystem, Layer, Option, Path, Schedule, Stream } from "effect";
 import { HttpServerRequest, HttpServerResponse } from "effect/http";
@@ -121,7 +121,7 @@ const missingSocketEndpoint = Effect.gen(function* () {
 });
 
 const localDockerEngineTestLayer = localDockerEngineLayer.pipe(
-  Layer.provide(BunServices.layer),
+  Layer.provide([BunServices.layer, BunCrypto.layer]),
   Layer.provide(runtimeInfoLayer),
 );
 
@@ -151,7 +151,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
           expect(answer).toEqual(Option.some({ exists: true, running: true, status: "running" }));
           expect(engine.requestedUrls).toEqual(["/containers/supabase_db_engine-probe/json"]);
         }),
-      ).pipe(Effect.provide(BunServices.layer)),
+      ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live.each([
@@ -182,7 +182,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
             );
             expect(answer).toEqual(Option.some({ exists: true, running, status }));
           }),
-        ).pipe(Effect.provide(BunServices.layer)),
+        ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live("answers absent for an Engine 404", () =>
@@ -197,7 +197,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
           );
           expect(answer).toEqual(Option.some({ exists: false }));
         }),
-      ).pipe(Effect.provide(BunServices.layer)),
+      ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live("gives no answer for a responder that does not identify as a Docker engine", () =>
@@ -238,7 +238,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
           expect(absent).toEqual(Option.none());
           expect(viaServerHeader).toEqual(Option.some({ exists: false }));
         }),
-      ).pipe(Effect.provide(BunServices.layer)),
+      ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live("gives no answer for an empty or malformed Engine 200 body", () =>
@@ -263,7 +263,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
           expect(empty).toEqual(Option.none());
           expect(malformed).toEqual(Option.none());
         }),
-      ).pipe(Effect.provide(BunServices.layer)),
+      ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live(
@@ -280,7 +280,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
             );
             expect(answer).toEqual(Option.none());
           }),
-        ).pipe(Effect.provide(BunServices.layer)),
+        ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live(
@@ -295,7 +295,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
             );
             expect(answer).toEqual(Option.none());
           }),
-        ).pipe(Effect.provide(BunServices.layer)),
+        ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       15_000,
     );
 
@@ -311,7 +311,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
           );
           expect(answer).toEqual(Option.none());
         }),
-      ).pipe(Effect.provide(BunServices.layer)),
+      ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live("gives no answer when the peer resets after the headers", () =>
@@ -327,7 +327,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
           );
           expect(answer).toEqual(Option.none());
         }),
-      ).pipe(Effect.provide(BunServices.layer)),
+      ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live("traces the request, the decline, and the fallback through DebugLogger", () => {
@@ -379,7 +379,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
             lines.some((l) => l.startsWith("debug:") && l.includes("no definitive Engine answer")),
           ).toBe(true);
         }),
-      ).pipe(Effect.provide(BunServices.layer));
+      ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
 
     it.live(
@@ -406,7 +406,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
             );
             expect(answer).toEqual(Option.none());
           }),
-        ).pipe(Effect.provide(BunServices.layer)),
+        ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       15_000,
     );
   });
@@ -420,7 +420,7 @@ describe("LocalDockerEngine (direct Engine-API transport)", () => {
         );
         expect(answer).toEqual(Option.none());
       }),
-    ).pipe(Effect.provide(BunServices.layer)),
+    ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("gives no answer for an endpoint the transport cannot address (ssh)", () =>
@@ -592,7 +592,7 @@ describe("isLocalDbRunning", () => {
             ["container", "inspect", "supabase_db_engine-probe"],
           ]);
         }),
-      ).pipe(Effect.provide(BunServices.layer));
+      ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
     },
   );
 });
diff --git a/apps/cli/src/command-internal/db-bootstrap/local-db-running.ts b/apps/cli/src/command-internal/db-bootstrap/local-db-running.ts
index df89a0d462..80098d71bd 100644
--- a/apps/cli/src/command-internal/db-bootstrap/local-db-running.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/local-db-running.ts
@@ -1,6 +1,7 @@
 import http from "node:http";
 
-import { Context, Crypto, Data, Effect, FileSystem, Layer, Option, Path } from "effect";
+import { Context, Data, Effect, FileSystem, Layer, Option, Path } from "effect";
+import { Digest } from "effect/crypto";
 import type { ChildProcessSpawner } from "effect/process/ChildProcessSpawner";
 
 import {
@@ -271,19 +272,19 @@ const inspectContainerOverSocket = (
 export const localDockerEngineLayer: Layer.Layer<
   LocalDockerEngine,
   never,
-  Crypto.Crypto | FileSystem.FileSystem | Path.Path | RuntimeInfo
+  Digest.Digest | FileSystem.FileSystem | Path.Path | RuntimeInfo
 > = Layer.effect(
   LocalDockerEngine,
   Effect.gen(function* () {
     const runtime = yield* RuntimeInfo;
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* Digest.Digest;
     const resolveEndpoint = resolveDockerDaemonEndpoint().pipe(
       Effect.provideService(RuntimeInfo, runtime),
       Effect.provideService(FileSystem.FileSystem, fs),
       Effect.provideService(Path.Path, path),
-      Effect.provideService(Crypto.Crypto, crypto),
+      Effect.provideService(Digest.Digest, crypto),
       Effect.orElseSucceed(() => Option.none<string>()),
     );
     const debugLogger = yield* Effect.serviceOption(DebugLogger);
@@ -390,16 +391,14 @@ export function localDbState(
       if (!isContainerNotFoundMessage(stderr)) {
         // Surface the Docker install hint instead of raw stderr when the daemon is unreachable.
         const daemonDown = isDockerDaemonUnreachable(stderr);
-        return yield* Effect.fail(
-          new LocalDbRunningError({
-            message:
-              stderr.length > 0
-                ? `failed to inspect service: ${stderr}`
-                : "failed to inspect service",
-            daemonDown,
-            ...(daemonDown ? { suggestion: SUGGEST_DOCKER_INSTALL } : {}),
-          }),
-        );
+        return yield* new LocalDbRunningError({
+          message:
+            stderr.length > 0
+              ? `failed to inspect service: ${stderr}`
+              : "failed to inspect service",
+          daemonDown,
+          ...(daemonDown ? { suggestion: SUGGEST_DOCKER_INSTALL } : {}),
+        });
       }
       return { exists: false } satisfies LocalDbState;
     }),
diff --git a/apps/cli/src/command-internal/db-bootstrap/postgres.service.ts b/apps/cli/src/command-internal/db-bootstrap/postgres.service.ts
index ac8db9b61b..9bd3aaf722 100644
--- a/apps/cli/src/command-internal/db-bootstrap/postgres.service.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/postgres.service.ts
@@ -10,7 +10,6 @@
 import type { CliConfig } from "@supabase/config";
 
 import { localDbContainerId } from "../docker-ids.ts";
-import { toDockerMountPath } from "../docker-path.ts";
 import { encodeToml } from "../output.encoders.ts";
 import { POSTGRES_DEFAULT_ROOT_KEY } from "../local-config-values.ts";
 import type { StartContainerSpec } from "./docker-create-args.ts";
@@ -314,9 +313,7 @@ export function buildPostgresStartContainerSpec(
     binds: [
       `${containerName}:${POSTGRES_DATA_DIR}`,
       // The backup file bind is appended only on the `fromBackup` branch.
-      ...(input.fromBackup === undefined
-        ? []
-        : [`${toDockerMountPath(input.fromBackup)}:/etc/backup.sql:ro`]),
+      ...(input.fromBackup === undefined ? [] : [`${input.fromBackup}:/etc/backup.sql:ro`]),
     ],
     // Tmpfs is keyed on `isPg14OrEarlier` alone, independent of `isRestore`.
     ...(isPg14OrEarlier ? { tmpfs: { "/docker-entrypoint-initdb.d": "" } } : {}),
diff --git a/apps/cli/src/command-internal/db-bootstrap/postgres.service.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/postgres.service.unit.test.ts
index 47f7bf755c..df486ec49b 100644
--- a/apps/cli/src/command-internal/db-bootstrap/postgres.service.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/postgres.service.unit.test.ts
@@ -295,11 +295,11 @@ describe("buildPostgresStartContainerSpec", () => {
     ]);
   });
 
-  test("--from-backup: converts a Windows-style host path through toDockerMountPath for the backup bind", () => {
+  test("--from-backup: keeps the Windows drive in the backup bind source", () => {
     const spec = buildPostgresStartContainerSpec(
       baseInput({ fromBackup: "C:\\Users\\me\\backup.sql" }),
     );
-    expect(spec.binds).toContain("/Users/me/backup.sql:/etc/backup.sql:ro");
+    expect(spec.binds).toContain("C:\\Users\\me\\backup.sql:/etc/backup.sql:ro");
   });
 
   test("no --from-backup: binds only the data volume, matching the pre-existing behavior", () => {
diff --git a/apps/cli/src/command-internal/db-bootstrap/realtime-env.ts b/apps/cli/src/command-internal/db-bootstrap/realtime-env.ts
index 9bb7c2bc98..19983243a0 100644
--- a/apps/cli/src/command-internal/db-bootstrap/realtime-env.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/realtime-env.ts
@@ -6,6 +6,7 @@
 
 import type { CliConfig } from "@supabase/config";
 import {
+  DEFAULT_ERL_MAX_PORTS,
   DEFAULT_LOCAL_SERVICE_SECRET_KEY_BASE,
   DEFAULT_REALTIME_DB_ENCRYPTION_KEY,
 } from "@supabase/stack/defaults";
@@ -56,6 +57,7 @@ export function buildRealtimeEnv(input: RealtimeEnvInput): Record<string, string
     APP_NAME: "realtime",
     SECRET_KEY_BASE: REALTIME_SECRET_KEY_BASE,
     ERL_AFLAGS: input.ipVersion === "IPv6" ? "-proto_dist inet6_tcp" : "-proto_dist inet_tcp",
+    ERL_MAX_PORTS: DEFAULT_ERL_MAX_PORTS,
     // Two literal single-quote characters, not an empty string.
     DNS_NODES: "''",
     RLIMIT_NOFILE: "",
diff --git a/apps/cli/src/command-internal/db-bootstrap/realtime-env.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/realtime-env.unit.test.ts
index a4f456cd5f..0ce30ba342 100644
--- a/apps/cli/src/command-internal/db-bootstrap/realtime-env.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/realtime-env.unit.test.ts
@@ -32,6 +32,7 @@ describe("buildRealtimeEnv", () => {
       DB_ENC_KEY: "supabaserealtime",
       APP_NAME: "realtime",
       SECRET_KEY_BASE: "EAx3IQ/wRG1v47ZD4NE4/9RzBI8Jmil3x0yhcW4V2NHBP6c2iPIzwjofi2Ep4HIG",
+      ERL_MAX_PORTS: "65536",
       DNS_NODES: "''",
       RLIMIT_NOFILE: "",
       SEED_SELF_HOST: "true",
diff --git a/apps/cli/src/command-internal/db-bootstrap/recreate-local-database.ts b/apps/cli/src/command-internal/db-bootstrap/recreate-local-database.ts
index ce496f87c0..6d18a459c3 100644
--- a/apps/cli/src/command-internal/db-bootstrap/recreate-local-database.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/recreate-local-database.ts
@@ -23,8 +23,8 @@ import {
   ErrorActionabilityId,
 } from "../../shared/telemetry/error-actionability.ts";
 import { isSqlState } from "../connect-errors.ts";
-import { isContainerNotFoundMessage } from "../container-cli.ts";
-import { checkDbToml } from "../db-config.toml-read.ts";
+import { dockerSupportsHealthStartInterval, isContainerNotFoundMessage } from "../container-cli.ts";
+import { checkDbConfig } from "../db-config.read.ts";
 import { DbConnection, type DbSession } from "../db-connection.service.ts";
 import { DbExecError, type DbConnectError } from "../db-connection.errors.ts";
 import { CLI_PROJECT_LABEL } from "../docker-ids.ts";
@@ -292,7 +292,10 @@ const recreateLocalDatabase15 = <E>(
       ...input.postgresSpec,
       image: resolvedPostgresImage,
     });
-    yield* createContainer(spawner, postgresSpec, input.containerOpts);
+    yield* createContainer(spawner, postgresSpec, {
+      ...input.containerOpts,
+      healthStartInterval: yield* dockerSupportsHealthStartInterval(spawner),
+    });
 
     // Never swallowed — reset has no `--from-backup`-equivalent gate.
     yield* waitForPostgresReady(
@@ -373,7 +376,7 @@ const recreateLocalDatabase14 = <E>(
   Effect.gen(function* () {
     const { setup, fs, path, workdir } = input;
     const dbPassword = startInternalDbPassword(setup.dbUrl);
-    const toml = yield* checkDbToml(fs, path, workdir);
+    const toml = yield* checkDbConfig(fs, path, workdir);
     const dbConnection = yield* DbConnection;
     const output = yield* Output;
 
@@ -447,6 +450,7 @@ const recreateLocalDatabase14 = <E>(
           pgDeltaEnabled: toml.pgDelta.enabled,
           schemaPaths: toml.schemaPaths,
           localDatabaseWebhooksEnabled: toml.webhooksEnabled,
+          configFile: toml.configFile,
         });
       }),
     );
diff --git a/apps/cli/src/command-internal/db-bootstrap/reset-local-database.ts b/apps/cli/src/command-internal/db-bootstrap/reset-local-database.ts
index b41987edda..843b7e3bf0 100644
--- a/apps/cli/src/command-internal/db-bootstrap/reset-local-database.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/reset-local-database.ts
@@ -30,7 +30,7 @@ import {
 } from "../../shared/telemetry/error-actionability.ts";
 import { aqua, yellow } from "../colors.ts";
 import { CommandSettings } from "../../config/command-settings.service.ts";
-import { checkDbToml, loadProjectEnvValues, readDbToml } from "../db-config.toml-read.ts";
+import { checkDbConfig, loadProjectEnvValues, readDbConfig } from "../db-config.read.ts";
 import { loadLocalProjectContext } from "../local-project-context.ts";
 import { hasConfiguredBuckets, seedBucketsRun } from "../seed-buckets.ts";
 import { awaitStorageReady } from "./await-storage-ready.ts";
@@ -42,10 +42,12 @@ import { stackOpenReadyProject } from "../stack-local-database.ts";
 import {
   classifyStorageCapability,
   describeStorageCapability,
+  enableStorageAdvice,
   StackStorageCapabilityError,
   StackStorageUnavailableError,
   stackStorageEndpointFor,
 } from "../stack-storage.ts";
+import { configFileRefOf } from "../config-advice.ts";
 import { loadStackConfig } from "../stack-config.ts";
 import { readSelectionOrBundled } from "../stack-lock.ts";
 import { catalogDatabaseServices, StackCatalogSetup } from "../stack-catalog-setup.ts";
@@ -116,7 +118,7 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
   const experimental = yield* resolveExperimentalWithProjectEnv(projectEnv);
 
   // Abort on a bad config before wiping the local database.
-  yield* checkDbToml(fs, path, workdir);
+  yield* checkDbConfig(fs, path, workdir);
   yield* Effect.annotateCurrentSpan("stack.backend", backend.kind);
 
   if (backend.kind === "stack") {
@@ -128,7 +130,7 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
     const config = yield* loadStackConfig(workdir, { selection: readSelectionOrBundled }).pipe(
       Effect.mapError((cause) => resetFailed(cause.message, cause)),
     );
-    const toml = yield* readDbToml(fs, path, workdir);
+    const toml = yield* readDbConfig(fs, path, workdir);
     const databaseStatus = yield* opened.value.database.status.pipe(
       Effect.mapError((cause) => resetFailed(`failed to inspect stack: ${cause.message}`)),
     );
@@ -235,18 +237,19 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
     yield* Effect.gen(function* () {
       const context = yield* loadLocalProjectContext(workdir, (message) => resetFailed(message));
       if (!hasConfiguredBuckets(context.config)) return;
+      const configFile = configFileRefOf(path, workdir, context.resolvedConfig);
       const capability = storage === undefined ? undefined : yield* storage.status;
       const decision = classifyStorageCapability(capability);
       if (decision !== "proceed") {
         yield* skipSeeding(
           describeStorageCapability(capability),
           decision === "disabled"
-            ? "Set [storage] enabled = true in supabase/config.toml, run supabase stack stop followed by supabase stack start without -x storage, then supabase seed buckets."
+            ? `${enableStorageAdvice(configFile)}, run supabase stack stop followed by supabase stack start without -x storage, then supabase seed buckets.`
             : undefined,
         );
         return;
       }
-      const credentials = yield* stackStorageEndpointFor(opened.value.stack);
+      const credentials = yield* stackStorageEndpointFor(opened.value.stack, configFile);
       yield* seedBucketsRun({
         projectRef: "",
         emitSummary: false,
@@ -259,6 +262,7 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
         },
         projectEnvValues: projectEnv,
         workdir,
+        configFile,
       });
     }).pipe(
       Effect.catch((error) => skipSeeding(error.message, suggestionOf(error))),
@@ -354,6 +358,7 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
       resolvedConfig: { config, document: resolvedConfig.loaded.document },
       // The same nested-dotenv walk already resolved for `yes`/`experimental` above.
       projectEnvValues: projectEnv,
+      configFile: configFileRefOf(path, workdir, resolvedConfig),
     }).pipe(
       // An invalid bucket entry (bad name, unparseable `file_size_limit`, …) can't abort here —
       // recreate already dropped/rebuilt the DB — so warn and skip buckets instead.
diff --git a/apps/cli/src/command-internal/db-bootstrap/restart-services.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/restart-services.unit.test.ts
index 3d861c826f..66f824418b 100644
--- a/apps/cli/src/command-internal/db-bootstrap/restart-services.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/restart-services.unit.test.ts
@@ -17,7 +17,7 @@ function mockSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push(args);
       const result = handler(args);
 
@@ -122,7 +122,7 @@ describe("restartServicesAndReloadKong", () => {
 
       const spawner = ChildProcessSpawner.make((command) =>
         Effect.gen(function* () {
-          const args = command._tag === "StandardCommand" ? command.args : [];
+          const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
           if (args[0] === "restart") {
             restarted.push(args[1] ?? "");
             inFlight++;
diff --git a/apps/cli/src/command-internal/db-bootstrap/rollback.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/rollback.unit.test.ts
index ff072f9066..35f8c3d5c3 100644
--- a/apps/cli/src/command-internal/db-bootstrap/rollback.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/rollback.unit.test.ts
@@ -33,7 +33,7 @@ function mockSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push(args);
       const result = opts.respond?.(args) ?? opts;
 
diff --git a/apps/cli/src/command-internal/db-bootstrap/shadow-database.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/shadow-database.unit.test.ts
index 0467e64888..3c0a6575c8 100644
--- a/apps/cli/src/command-internal/db-bootstrap/shadow-database.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/shadow-database.unit.test.ts
@@ -110,7 +110,7 @@ function mockSpawner() {
   const encoder = new TextEncoder();
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.sync(() => {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push(args);
       // `ensureNetwork` probes with `network inspect` first; report it as missing so
       // `createShadowDatabase` actually reaches `network create` instead of short-circuiting.
diff --git a/apps/cli/src/command-internal/db-bootstrap/start-local-database.ts b/apps/cli/src/command-internal/db-bootstrap/start-local-database.ts
index 37ac986ec0..082fdb4ea6 100644
--- a/apps/cli/src/command-internal/db-bootstrap/start-local-database.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/start-local-database.ts
@@ -15,7 +15,7 @@ import { Output } from "../../shared/output/output.service.ts";
 import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
 import { NetworkIdFlag, resolveDebugWithProjectEnv } from "../global-flags.ts";
 import { CommandSettings } from "../../config/command-settings.service.ts";
-import { checkDbToml } from "../db-config.toml-read.ts";
+import { checkDbConfig } from "../db-config.read.ts";
 import { DbConfigLoadError } from "../db-config.errors.ts";
 import {
   resolveAuthExternalProviders,
@@ -28,6 +28,7 @@ import { parseUrl } from "../storage-url.ts";
 import { loadLocalProjectContext } from "../local-project-context.ts";
 import { cliProjectFilterValue, localDbContainerId } from "../docker-ids.ts";
 import { isBitbucketPipeline } from "../bitbucket-pipeline.ts";
+import { dockerSupportsHealthStartInterval } from "../container-cli.ts";
 import { holdProjectLifecycleLock } from "../project-lifecycle-lock.ts";
 import { dbNotRunningError } from "../status-errors.ts";
 import { buildLocalDbContainerInputs } from "./local-container-inputs.ts";
@@ -75,9 +76,9 @@ const startLocalDatabaseInScope = Effect.fn("DbBootstrap.startLocalDatabase")(fu
 
   // Config is loaded first thing: a missing config is tolerated (defaults), but a present config
   // that is malformed, references an undecryptable `encrypted:` secret, or fails validation
-  // aborts before any container work. `checkDbToml` does that load+validate, not
+  // aborts before any container work. `checkDbConfig` does that load+validate, not
   // `isLocalDbRunning`'s best-effort read, which swallows config errors.
-  const dbTomlValues = yield* checkDbToml(fs, path, cliSettings.workdir);
+  const dbTomlValues = yield* checkDbConfig(fs, path, cliSettings.workdir);
 
   // Threaded into `rollbackDatabaseStart`'s own teardown (gates its `Pruned …:` stderr reports) and into
   // `buildLocalDbContainerInputs`'s own `setup.debug`, so a failed fresh-volume migrate job tees
@@ -172,6 +173,7 @@ const startLocalDatabaseInScope = Effect.fn("DbBootstrap.startLocalDatabase")(fu
     hostnameForValidation,
     cliSettings.workdir,
     document,
+    resolvedConfig.hasConfigFile ? resolvedConfig.loaded.path : undefined,
   ).pipe(Effect.mapError((cause) => new DbConfigLoadError({ message: cause.message })));
 
   // Held until this call returns, after any rollback has run.
@@ -267,7 +269,10 @@ const startLocalDatabaseInScope = Effect.fn("DbBootstrap.startLocalDatabase")(fu
     hostname,
     dbContainerId,
     dbPort: values.dbPort,
-    containerOpts,
+    containerOpts: {
+      ...containerOpts,
+      healthStartInterval: yield* dockerSupportsHealthStartInterval(spawner),
+    },
     // `db reset` has no `fromBackup` concept at all, so `postgresSpecBase` omits it.
     postgresSpec: { ...postgresSpecBase, fromBackup },
     // Only the `db` container's own image, resolved lazily, right where it would be
diff --git a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote-with-project-id-env.json b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote-with-project-id-env.json
index dce71ff5c6..cbb5b4258a 100644
--- a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote-with-project-id-env.json
+++ b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote-with-project-id-env.json
@@ -5,8 +5,8 @@
     "dbHealthTimeoutSeconds": 120,
     "majorVersion": 17,
     "orioledbVersion": null,
-    "postgresConfigImage": "supabase/postgres:17.11.0.011",
-    "postgresImage": "supabase/postgres:17.11.0.011",
+    "postgresConfigImage": "<DEFAULT_POSTGRES_IMAGE>",
+    "postgresImage": "<DEFAULT_POSTGRES_IMAGE>",
     "realtimeEnabledForSetup": true,
     "realtimeIpVersion": "IPv4",
     "realtimeMaxHeaderLength": 4096,
@@ -32,7 +32,7 @@
   "experimental": false,
   "networkId": "supabase_network_shell-project-id",
   "postgresSpecBase": {
-    "configImage": "supabase/postgres:17.11.0.011",
+    "configImage": "<DEFAULT_POSTGRES_IMAGE>",
     "db": {
       "health_timeout": "2m",
       "major_version": 17,
@@ -138,6 +138,7 @@
           "notification": {},
           "otp_expiry": 3600,
           "otp_length": 6,
+          "require_current_password": false,
           "secure_password_change": false,
           "smtp": {
             "enabled": false
diff --git a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote-with-shell-env.json b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote-with-shell-env.json
index 4272d72177..020b32c15a 100644
--- a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote-with-shell-env.json
+++ b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote-with-shell-env.json
@@ -5,8 +5,8 @@
     "dbHealthTimeoutSeconds": 120,
     "majorVersion": 17,
     "orioledbVersion": null,
-    "postgresConfigImage": "supabase/postgres:17.11.0.011",
-    "postgresImage": "supabase/postgres:17.11.0.011",
+    "postgresConfigImage": "<DEFAULT_POSTGRES_IMAGE>",
+    "postgresImage": "<DEFAULT_POSTGRES_IMAGE>",
     "realtimeEnabledForSetup": false,
     "realtimeIpVersion": "IPv4",
     "realtimeMaxHeaderLength": 4096,
@@ -32,7 +32,7 @@
   "experimental": false,
   "networkId": "supabase_network_abcdefghijklmnopqrst",
   "postgresSpecBase": {
-    "configImage": "supabase/postgres:17.11.0.011",
+    "configImage": "<DEFAULT_POSTGRES_IMAGE>",
     "db": {
       "health_timeout": "2m",
       "major_version": 17,
@@ -138,6 +138,7 @@
           "notification": {},
           "otp_expiry": 3600,
           "otp_length": 6,
+          "require_current_password": false,
           "secure_password_change": false,
           "smtp": {
             "enabled": false
diff --git a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote.json b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote.json
index 980df2596f..83e8204e77 100644
--- a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote.json
+++ b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/matched-remote.json
@@ -5,8 +5,8 @@
     "dbHealthTimeoutSeconds": 120,
     "majorVersion": 17,
     "orioledbVersion": null,
-    "postgresConfigImage": "supabase/postgres:17.11.0.011",
-    "postgresImage": "supabase/postgres:17.11.0.011",
+    "postgresConfigImage": "<DEFAULT_POSTGRES_IMAGE>",
+    "postgresImage": "<DEFAULT_POSTGRES_IMAGE>",
     "realtimeEnabledForSetup": true,
     "realtimeIpVersion": "IPv4",
     "realtimeMaxHeaderLength": 4096,
@@ -32,7 +32,7 @@
   "experimental": false,
   "networkId": "supabase_network_abcdefghijklmnopqrst",
   "postgresSpecBase": {
-    "configImage": "supabase/postgres:17.11.0.011",
+    "configImage": "<DEFAULT_POSTGRES_IMAGE>",
     "db": {
       "health_timeout": "2m",
       "major_version": 17,
@@ -138,6 +138,7 @@
           "notification": {},
           "otp_expiry": 3600,
           "otp_length": 6,
+          "require_current_password": false,
           "secure_password_change": false,
           "smtp": {
             "enabled": false
diff --git a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/no-overrides.json b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/no-overrides.json
index 2f86ba9c79..e7cfb518fa 100644
--- a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/no-overrides.json
+++ b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/no-overrides.json
@@ -5,8 +5,8 @@
     "dbHealthTimeoutSeconds": 120,
     "majorVersion": 17,
     "orioledbVersion": null,
-    "postgresConfigImage": "supabase/postgres:17.11.0.011",
-    "postgresImage": "supabase/postgres:17.11.0.011",
+    "postgresConfigImage": "<DEFAULT_POSTGRES_IMAGE>",
+    "postgresImage": "<DEFAULT_POSTGRES_IMAGE>",
     "realtimeEnabledForSetup": true,
     "realtimeIpVersion": "IPv4",
     "realtimeMaxHeaderLength": 4096,
@@ -32,7 +32,7 @@
   "experimental": false,
   "networkId": "supabase_network_golden-shadow",
   "postgresSpecBase": {
-    "configImage": "supabase/postgres:17.11.0.011",
+    "configImage": "<DEFAULT_POSTGRES_IMAGE>",
     "db": {
       "health_timeout": "2m",
       "major_version": 17,
@@ -138,6 +138,7 @@
           "notification": {},
           "otp_expiry": 3600,
           "otp_length": 6,
+          "require_current_password": false,
           "secure_password_change": false,
           "smtp": {
             "enabled": false
diff --git a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/project-dotenv.json b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/project-dotenv.json
index 3d85d0db5a..95d14e1655 100644
--- a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/project-dotenv.json
+++ b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/project-dotenv.json
@@ -5,8 +5,8 @@
     "dbHealthTimeoutSeconds": 120,
     "majorVersion": 17,
     "orioledbVersion": null,
-    "postgresConfigImage": "supabase/postgres:17.11.0.011",
-    "postgresImage": "supabase/postgres:17.11.0.011",
+    "postgresConfigImage": "<DEFAULT_POSTGRES_IMAGE>",
+    "postgresImage": "<DEFAULT_POSTGRES_IMAGE>",
     "realtimeEnabledForSetup": false,
     "realtimeIpVersion": "IPv4",
     "realtimeMaxHeaderLength": 4096,
@@ -32,7 +32,7 @@
   "experimental": false,
   "networkId": "supabase_network_golden-shadow",
   "postgresSpecBase": {
-    "configImage": "supabase/postgres:17.11.0.011",
+    "configImage": "<DEFAULT_POSTGRES_IMAGE>",
     "db": {
       "health_timeout": "2m",
       "major_version": 17,
@@ -145,6 +145,7 @@
           "notification": {},
           "otp_expiry": 3600,
           "otp_length": 6,
+          "require_current_password": false,
           "secure_password_change": false,
           "smtp": {
             "enabled": false
diff --git a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/shell-env.json b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/shell-env.json
index a49d200a86..913d7a795f 100644
--- a/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/shell-env.json
+++ b/apps/cli/src/command-internal/db-bootstrap/testdata/config-precedence/local-container-inputs/shell-env.json
@@ -5,8 +5,8 @@
     "dbHealthTimeoutSeconds": 120,
     "majorVersion": 17,
     "orioledbVersion": null,
-    "postgresConfigImage": "supabase/postgres:17.11.0.011",
-    "postgresImage": "supabase/postgres:17.11.0.011",
+    "postgresConfigImage": "<DEFAULT_POSTGRES_IMAGE>",
+    "postgresImage": "<DEFAULT_POSTGRES_IMAGE>",
     "realtimeEnabledForSetup": false,
     "realtimeIpVersion": "IPv4",
     "realtimeMaxHeaderLength": 4096,
@@ -32,7 +32,7 @@
   "experimental": false,
   "networkId": "supabase_network_golden-shadow",
   "postgresSpecBase": {
-    "configImage": "supabase/postgres:17.11.0.011",
+    "configImage": "<DEFAULT_POSTGRES_IMAGE>",
     "db": {
       "health_timeout": "2m",
       "major_version": 17,
@@ -138,6 +138,7 @@
           "notification": {},
           "otp_expiry": 3600,
           "otp_length": 6,
+          "require_current_password": false,
           "secure_password_change": false,
           "smtp": {
             "enabled": false
diff --git a/apps/cli/src/command-internal/db-config.errors.ts b/apps/cli/src/command-internal/db-config.errors.ts
index 530baed442..9772a5fc57 100644
--- a/apps/cli/src/command-internal/db-config.errors.ts
+++ b/apps/cli/src/command-internal/db-config.errors.ts
@@ -1,6 +1,8 @@
 import { Data } from "effect";
 import {
   actionability,
+  CliErrorCategory,
+  CliErrorKind,
   type CliErrorActionabilityDeclaration,
   CliSuggestionType,
   ErrorActionabilityId,
@@ -74,6 +76,23 @@ export class DbConfigLoginRoleStatusError extends Data.TaggedError("DbConfigLogi
   }
 }
 
+/**
+ * The Management API could not mint a login role because the project database lacks
+ * `supabase_privileged_role` (Postgres `42501`); the dedicated tag isolates these projects in telemetry.
+ */
+export class DbConfigLoginRoleMissingPrivilegedRoleError extends Data.TaggedError(
+  "DbConfigLoginRoleMissingPrivilegedRoleError",
+)<{ readonly message: string; readonly suggestion: string; readonly projectRef: string }> {
+  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
+    return {
+      error_kind: CliErrorKind.ExternalService,
+      error_category: CliErrorCategory.ApiStatus,
+      has_suggestion: true,
+      suggestion_type: CliSuggestionType.SetEnvVar,
+    };
+  }
+}
+
 /** Transport failure listing network bans (`V1ListAllNetworkBans`). */
 export class DbConfigListBansNetworkError extends Data.TaggedError("DbConfigListBansNetworkError")<{
   readonly message: string;
diff --git a/apps/cli/src/command-internal/db-config.integration.test.ts b/apps/cli/src/command-internal/db-config.integration.test.ts
index 192a7440c6..a972f6e8f2 100644
--- a/apps/cli/src/command-internal/db-config.integration.test.ts
+++ b/apps/cli/src/command-internal/db-config.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -85,8 +85,15 @@ import type { DbConnectionInput } from "./db-config.types.ts";
 import { hostedMutationPreapproval } from "./hosted-consent/hosted-consent.ts";
 import type { HostedMutationConsent } from "./hosted-consent/hosted-consent.token.ts";
 import type { ResolvedTarget } from "./target/resolve-target.ts";
+import {
+  SUGGEST_CA_VERIFICATION,
+  SUGGEST_ENV_VAR,
+  SUGGEST_NETWORK_RESTRICTIONS,
+} from "./connect-errors.ts";
 import { DbConnectError } from "./db-connection.errors.ts";
+import { toConnectError } from "./db-connection.sql-pg.layer.ts";
 import { DbConnection, type DbSession, type PgConnInput } from "./db-connection.service.ts";
+import { rootCaBundle } from "./supabase-tls.ts";
 import { StackApi } from "./stack-api.ts";
 import { stackBackendLayer } from "./stack-backend.ts";
 import { selection } from "../../tests/helpers/pins.ts";
@@ -279,7 +286,7 @@ describe("dbConfigResolver (local + db-url)", () => {
       const dir = yield* withWorkdir('[api]\nschemas = ["app", "public"]');
       const result = yield* resolveConnection(dir, inputFor(target));
       expect(result.exposedSchemas).toEqual(["app", "public"]);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("local mode: uses 127.0.0.1 with config.toml db.port/password and is local", () =>
@@ -308,7 +315,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -326,7 +333,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -344,7 +351,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         );
         const r = yield* resolveConnection(dir, inputFor(localTarget));
         expect(r.conn.suggestionContext).toMatchObject({ linkedCheckout: true });
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -356,7 +363,7 @@ describe("dbConfigResolver (local + db-url)", () => {
           projectId: "abcdefghijklmnopqrst",
         });
         expect(r.conn.suggestionContext).toMatchObject({ linkedCheckout: true });
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("local mode on an unlinked checkout adds no --linked pointer", () =>
@@ -364,7 +371,7 @@ describe("dbConfigResolver (local + db-url)", () => {
       const dir = yield* withWorkdir();
       const r = yield* resolveConnection(dir, inputFor(localTarget));
       expect(r.conn.suggestionContext?.linkedCheckout).toBeUndefined();
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("local mode: falls back to default port/password without a config.toml", () =>
@@ -380,7 +387,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -409,7 +416,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -427,7 +434,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -445,7 +452,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -465,7 +472,7 @@ describe("dbConfigResolver (local + db-url)", () => {
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       ),
   );
 
@@ -485,7 +492,7 @@ describe("dbConfigResolver (local + db-url)", () => {
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       ),
   );
 
@@ -506,7 +513,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -527,7 +534,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -554,7 +561,7 @@ describe("dbConfigResolver (local + db-url)", () => {
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       );
     },
   );
@@ -573,7 +580,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 
@@ -595,7 +602,7 @@ describe("dbConfigResolver (local + db-url)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     ),
   );
 
@@ -625,7 +632,7 @@ describe("dbConfigResolver (local + db-url)", () => {
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       );
     },
   );
@@ -741,14 +748,14 @@ describe("dbConfigResolver (db-url under the stack backend)", () => {
         stackApi: projectStackApi(dir, "running"),
       }).pipe(Effect.provide(stackBackendLayer("stack")));
       expect(resolved.exposedSchemas).toEqual(["app", "public"]);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("treats the url printed by `stack status --env` as the local database", () =>
     Effect.gen(function* () {
       const resolved = yield* resolveOnStack(yield* withWorkdir(), stackUrl(STACK_SQL_PORT));
       expect(resolved.isLocal).toBe(true);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fills a passwordless stack url from the stack's credentials, not [db].password", () =>
@@ -760,14 +767,14 @@ describe("dbConfigResolver (db-url under the stack backend)", () => {
       );
       expect(resolved.isLocal).toBe(true);
       expect(resolved.conn.password).toBe("stack-password");
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
-  it.effect("keeps a loopback url on another port remote so it still requires TLS", () =>
+  it.effect("keeps a loopback url on another port remote so it still negotiates TLS", () =>
     Effect.gen(function* () {
       const resolved = yield* resolveOnStack(yield* withWorkdir(), stackUrl(STACK_SQL_PORT + 1));
       expect(resolved.isLocal).toBe(false);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fills from the stack's credentials when the stack port is also [db].port", () =>
@@ -781,7 +788,7 @@ describe("dbConfigResolver (db-url under the stack backend)", () => {
       );
       expect(resolved.isLocal).toBe(true);
       expect(resolved.conn.password).toBe("stack-password");
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   for (const state of ["unregistered", "stopped"] as const) {
@@ -794,7 +801,7 @@ describe("dbConfigResolver (db-url under the stack backend)", () => {
           projectStackApi(dir, state),
         );
         expect(resolved.isLocal).toBe(false);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   }
 
@@ -806,7 +813,7 @@ describe("dbConfigResolver (db-url under the stack backend)", () => {
       );
       expect(resolved.conn.fallbacks).toEqual([{ host: "db.example.com", port: 5432 }]);
       expect(resolved.isLocal).toBe(false);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("does not consult the stack for a non-loopback host", () =>
@@ -824,7 +831,7 @@ describe("dbConfigResolver (db-url under the stack backend)", () => {
         untouchedStackApi,
       );
       expect(resolved.isLocal).toBe(false);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
 
@@ -861,7 +868,7 @@ describe("dbConfigResolver (linked config ordering)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 
@@ -984,6 +991,8 @@ describe("dbConfigResolver (linked config ordering)", () => {
             user: `cli_login_role.${adHocRef}`,
             password: "temporary-role-password",
             database: "postgres",
+            sslmode: "require",
+            sslrootcertInline: rootCaBundle(),
             suggestionContext: {
               dashboardUrl: "https://supabase.com/dashboard",
               profileName: "supabase",
@@ -1008,6 +1017,8 @@ describe("dbConfigResolver (linked config ordering)", () => {
                 user: `cli_login_role.${adHocRef}`,
                 password: "temporary-role-password",
                 database: "postgres",
+                sslmode: "require",
+                sslrootcertInline: rootCaBundle(),
               },
               isLocal: false,
               dnsResolver: "native",
@@ -1021,7 +1032,7 @@ describe("dbConfigResolver (linked config ordering)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 
@@ -1149,6 +1160,8 @@ describe("dbConfigResolver (linked config ordering)", () => {
                 user: `cli_login_role.${adHocRef}`,
                 password: "temporary-role-password",
                 database: "postgres",
+                sslmode: "require",
+                sslrootcertInline: rootCaBundle(),
                 suggestionContext: {
                   dashboardUrl: "https://supabase.com/dashboard",
                   profileName: "supabase",
@@ -1173,6 +1186,8 @@ describe("dbConfigResolver (linked config ordering)", () => {
                   user: `cli_login_role.${adHocRef}`,
                   password: "temporary-role-password",
                   database: "postgres",
+                  sslmode: "require",
+                  sslrootcertInline: rootCaBundle(),
                 },
                 isLocal: false,
                 dnsResolver: "native",
@@ -1186,7 +1201,7 @@ describe("dbConfigResolver (linked config ordering)", () => {
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       );
     },
   );
@@ -1293,6 +1308,8 @@ describe("dbConfigResolver (linked config ordering)", () => {
               user: `postgres.${linkedRef}`,
               password: "linked-password",
               database: "postgres",
+              sslmode: "require",
+              sslrootcertInline: rootCaBundle(),
               suggestionContext: {
                 dashboardUrl: "https://supabase.com/dashboard",
                 profileName: "supabase",
@@ -1314,7 +1331,7 @@ describe("dbConfigResolver (linked config ordering)", () => {
         }),
       ),
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 });
@@ -1403,6 +1420,8 @@ describe("dbConfigResolver (an explicit --project-ref fetches the pooler config)
               user: `postgres.${ref}`,
               password: "ambient-password",
               database: "postgres",
+              sslmode: "require",
+              sslrootcertInline: rootCaBundle(),
               suggestionContext: {
                 dashboardUrl: "https://supabase.com/dashboard",
                 profileName: "supabase",
@@ -1421,7 +1440,7 @@ describe("dbConfigResolver (an explicit --project-ref fetches the pooler config)
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       );
     },
   );
@@ -1521,6 +1540,8 @@ describe("dbConfigResolver (an explicit --project-ref fetches the pooler config)
               user: `postgres.${targetRef}`,
               password: "flag-password",
               database: "postgres",
+              sslmode: "require",
+              sslrootcertInline: rootCaBundle(),
               suggestionContext: {
                 dashboardUrl: "https://supabase.com/dashboard",
                 profileName: "supabase",
@@ -1539,7 +1560,7 @@ describe("dbConfigResolver (an explicit --project-ref fetches the pooler config)
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       );
     },
   );
@@ -1589,7 +1610,7 @@ describe("dbConfigResolver (an explicit --project-ref fetches the pooler config)
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       );
     },
   );
@@ -1640,7 +1661,7 @@ describe("dbConfigResolver (an explicit --project-ref fetches the pooler config)
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       );
     },
   );
@@ -1673,7 +1694,7 @@ describe("dbConfigResolver (Management API calls)", () => {
       const r = yield* resolveConnection(dir, inputFor(localTarget));
       expect(r.isLocal).toBe(true);
       noApiCalls(requests, { local: true });
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   it.effect("--db-url makes no Management API request and the block declares none", () => {
@@ -1687,7 +1708,7 @@ describe("dbConfigResolver (Management API calls)", () => {
       );
       expect(r.isLocal).toBe(false);
       noApiCalls(requests, { "db-url": true });
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   it.effect(
@@ -1729,7 +1750,7 @@ describe("dbConfigResolver (Management API calls)", () => {
           }),
         ),
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       );
     },
   );
@@ -1781,7 +1802,7 @@ describe("dbConfigResolver (Management API calls)", () => {
         `/v1/projects/${ref}/cli/login-role`,
       );
       assertDbConfigDrift(requests, { linked: true, "project-ref": ref, password: "" });
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   for (const forbidden of ["retrieve", "delete"] as const) {
@@ -1862,7 +1883,7 @@ describe("dbConfigResolver (Management API calls)", () => {
               : { method: "DELETE", path: `/v1/projects/${ref}/network-bans` },
           );
           assertDbConfigDrift(requests, { linked: true, "project-ref": ref });
-        }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+        }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
       },
     );
   }
@@ -1919,6 +1940,8 @@ describe("dbConfigResolver (container pooler fallback)", () => {
           host: "aws-0-us-east-1.pooler.supabase.com",
           user: `cli_login_role.${ref}`,
           password: "temporary-role-password",
+          sslmode: "require",
+          sslrootcertInline: rootCaBundle(),
         });
       }
       expect(requests).toEqual([
@@ -1926,7 +1949,57 @@ describe("dbConfigResolver (container pooler fallback)", () => {
         { method: "POST", path: loginRolePath },
       ]);
       assertFallbackDrift(requests, { linked: true });
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
+  });
+
+  it.effect(
+    "reports a missing supabase_privileged_role when the login-role mint fails with 42501",
+    () => {
+      const requests: Array<{ readonly method: string; readonly path: string }> = [];
+      return Effect.gen(function* () {
+        yield* stubManagementApi(requests, (method, path) => {
+          if (method === "GET" && path === poolerPath)
+            return Response.json(primaryPoolerConfigs(ref));
+          if (method === "POST" && path === loginRolePath) {
+            return Response.json(
+              { message: "Failed to create login role: permission denied to alter role" },
+              { status: 400 },
+            );
+          }
+          return undefined;
+        });
+        const dir = yield* withWorkdir();
+        const error = yield* resolvePoolerFallback(dir, inputFor(explicitRefTarget(ref)), {
+          dbConnection: connects,
+          configEnv: { SUPABASE_ACCESS_TOKEN: VALID_TOKEN },
+        }).pipe(Effect.flip);
+        expect(error._tag).toBe("DbConfigLoginRoleMissingPrivilegedRoleError");
+        expect(error).toMatchObject({ suggestion: expect.stringContaining("--password") });
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
+    },
+  );
+
+  it.effect("keeps the generic status error for an unrelated login-role 400", () => {
+    const requests: Array<{ readonly method: string; readonly path: string }> = [];
+    return Effect.gen(function* () {
+      yield* stubManagementApi(requests, (method, path) => {
+        if (method === "GET" && path === poolerPath)
+          return Response.json(primaryPoolerConfigs(ref));
+        if (method === "POST" && path === loginRolePath) {
+          return Response.json(
+            { message: "42501: permission denied for table x" },
+            { status: 400 },
+          );
+        }
+        return undefined;
+      });
+      const dir = yield* withWorkdir();
+      const error = yield* resolvePoolerFallback(dir, inputFor(explicitRefTarget(ref)), {
+        dbConnection: connects,
+        configEnv: { SUPABASE_ACCESS_TOKEN: VALID_TOKEN },
+      }).pipe(Effect.flip);
+      expect(error._tag).toBe("DbConfigLoginRoleStatusError");
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   it.effect("fetches the pooler config but mints no login role when a password is set", () => {
@@ -1948,7 +2021,7 @@ describe("dbConfigResolver (container pooler fallback)", () => {
       );
       expect(requests).toEqual([{ method: "GET", path: poolerPath }]);
       assertFallbackDrift(requests, { linked: true, password: "secret" });
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   it.effect("returns no pooler when the pooler config is forbidden", () => {
@@ -1967,7 +2040,7 @@ describe("dbConfigResolver (container pooler fallback)", () => {
       expect(Option.isNone(pooler)).toBe(true);
       expect(requests).toEqual([{ method: "GET", path: poolerPath }]);
       assertFallbackDrift(requests, { linked: true });
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   it.effect("--local returns no pooler and makes no Management API request", () => {
@@ -1979,7 +2052,7 @@ describe("dbConfigResolver (container pooler fallback)", () => {
       expect(Option.isNone(pooler)).toBe(true);
       expect(requests).toEqual([]);
       assertFallbackDrift(requests, { local: true });
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 });
 
@@ -2023,6 +2096,8 @@ describe("resolveLinkedConn libpq TLS", () => {
       readonly reachable?: boolean;
       readonly password?: Option.Option<string>;
       readonly poolerUrl?: string;
+      readonly profile?: string;
+      readonly projectHost?: string;
     } = {},
   ) =>
     withConfigEnv(
@@ -2032,11 +2107,16 @@ describe("resolveLinkedConn libpq TLS", () => {
         return yield* resolveLinkedConn(
           ref,
           opts.workdir ?? (yield* projectWorkdir([])),
-          "invalid",
+          opts.profile ?? "supabase",
+          opts.projectHost ?? "invalid",
           "supabase.com",
           "native",
           opts.password ?? Option.some("secret"),
-          { removeNetworkBans: false, poolerUrl: Option.fromNullishOr(opts.poolerUrl) },
+          {
+            removeNetworkBans: false,
+            poolerUrl: Option.fromNullishOr(opts.poolerUrl),
+            dashboardUrl: "https://supabase.com/dashboard",
+          },
         );
       }),
     ).pipe(Effect.scoped);
@@ -2118,6 +2198,163 @@ describe("resolveLinkedConn libpq TLS", () => {
     }).pipe(Effect.scoped, Effect.provide(linkedConnLayer)),
   );
 
+  const pinned = { sslmode: "require", sslrootcertInline: rootCaBundle() };
+  const serviceFileWith = (content: string) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const dir = yield* fs.makeTempDirectoryScoped({ prefix: "cli-linked-service-" });
+      const serviceFile = path.join(dir, "pg_service.conf");
+      yield* fs.writeFileString(serviceFile, content);
+      return { PGSERVICE: "svc", PGSERVICEFILE: serviceFile };
+    });
+  const hostedPoolerUrl = `postgres://postgres.${ref}:[YOUR-PASSWORD]@${poolerHost}:6543/postgres`;
+
+  describe("Supabase CA pin", () => {
+    for (const [profile, projectHost] of [
+      ["supabase", "supabase.co"],
+      ["supabase-staging", "supabase.red"],
+      ["snap", "snapcloud.dev"],
+    ] as const) {
+      it.effect(`pins the bundled CA on the ${profile} direct host when TLS is unset`, () =>
+        Effect.gen(function* () {
+          const conn = yield* linkedConn({}, { profile, projectHost });
+          expect(conn).toMatchObject({ host: `db.${ref}.${projectHost}`, ...pinned });
+        }).pipe(Effect.provide(linkedConnLayer)),
+      );
+    }
+
+    it.effect("pins the bundled CA on the direct host before minting a login role", () =>
+      Effect.gen(function* () {
+        const conn = yield* linkedConn(
+          {},
+          { projectHost: "supabase.co", password: Option.some("") },
+        );
+        expect(conn).toMatchObject({ user: "cli_login_x", password: "temp", ...pinned });
+      }).pipe(Effect.provide(linkedConnLayer)),
+    );
+
+    it.effect("keeps verify-full with the user's own root cert", () =>
+      Effect.gen(function* () {
+        const conn = yield* linkedConn(
+          { PGSSLMODE: "verify-full", PGSSLROOTCERT: "/ca.pem" },
+          { projectHost: "supabase.co" },
+        );
+        expect(conn).toMatchObject({ sslmode: "verify-full", sslrootcert: "/ca.pem" });
+        expect(conn.sslrootcertInline).toBeUndefined();
+      }).pipe(Effect.provide(linkedConnLayer)),
+    );
+
+    it.effect("keeps PGSSLMODE=disable", () =>
+      Effect.gen(function* () {
+        const conn = yield* linkedConn({ PGSSLMODE: "disable" }, { projectHost: "supabase.co" });
+        expect(conn.sslmode).toBe("disable");
+        expect(conn.sslrootcertInline).toBeUndefined();
+      }).pipe(Effect.provide(linkedConnLayer)),
+    );
+
+    it.effect("verifies against a PGSSLROOTCERT with no sslmode instead of the bundled CA", () =>
+      Effect.gen(function* () {
+        const conn = yield* linkedConn(
+          { PGSSLROOTCERT: "/ca.pem" },
+          { projectHost: "supabase.co" },
+        );
+        expect(conn).toMatchObject({ sslmode: "require", sslrootcert: "/ca.pem" });
+        expect(conn.sslrootcertInline).toBeUndefined();
+      }).pipe(Effect.provide(linkedConnLayer)),
+    );
+
+    it.effect("keeps a service-file sslmode", () =>
+      Effect.gen(function* () {
+        const env = yield* serviceFileWith("[svc]\nsslmode=require\n");
+        const conn = yield* linkedConn(env, { projectHost: "supabase.co" });
+        expect(conn.sslmode).toBe("require");
+        expect(conn.sslrootcertInline).toBeUndefined();
+      }).pipe(Effect.scoped, Effect.provide(linkedConnLayer)),
+    );
+
+    it.effect("pins the bundled CA on the pooler when TLS is unset", () =>
+      Effect.gen(function* () {
+        const conn = yield* linkedConn(
+          {},
+          { reachable: false, poolerUrl: hostedPoolerUrl, password: Option.some("secret") },
+        );
+        expect(conn).toMatchObject({ host: poolerHost, ...pinned });
+      }).pipe(Effect.scoped, Effect.provide(linkedConnLayer)),
+    );
+
+    it.effect("keeps an explicit sslmode in the saved pooler URL", () =>
+      Effect.gen(function* () {
+        const conn = yield* linkedConn(
+          {},
+          {
+            reachable: false,
+            poolerUrl: `${hostedPoolerUrl}?sslmode=disable`,
+            password: Option.some("secret"),
+          },
+        );
+        expect(conn.sslmode).toBe("disable");
+        expect(conn.sslrootcertInline).toBeUndefined();
+      }).pipe(Effect.scoped, Effect.provide(linkedConnLayer)),
+    );
+
+    it.effect("pins the temp-role probe connection through the pooler", () => {
+      const probed: Array<PgConnInput> = [];
+      const probeSession: DbSession = {
+        exec: () => Effect.void,
+        execBatch: () => Effect.void,
+        query: () => Effect.succeed([]),
+        extensionExists: () => Effect.succeed(false),
+        copyToCsv: () => Effect.succeed(new Uint8Array()),
+        queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "SELECT 1" }),
+      };
+      return Effect.gen(function* () {
+        const conn = yield* linkedConn(
+          {},
+          { reachable: false, poolerUrl: hostedPoolerUrl, password: Option.some("") },
+        );
+        expect(probed).toHaveLength(1);
+        expect(probed[0]).toMatchObject({
+          host: poolerHost,
+          user: `cli_login_x.${ref}`,
+          ...pinned,
+        });
+        expect(conn).toMatchObject(pinned);
+      }).pipe(
+        Effect.scoped,
+        Effect.provideService(DbConnection, {
+          connect: (conn) => {
+            probed.push(conn);
+            return Effect.succeed(probeSession);
+          },
+        }),
+        Effect.provide(linkedConnLayer),
+      );
+    });
+
+    for (const [profile, projectHost] of [
+      ["supabase-local", "supabase.red"],
+      ["my-profile", "supabase.co"],
+    ] as const) {
+      it.effect(`does not pin the ${profile} profile`, () =>
+        Effect.gen(function* () {
+          const conn = yield* linkedConn({}, { profile, projectHost });
+          expect(conn.host).toBe(`db.${ref}.${projectHost}`);
+          expect(conn.sslmode).toBeUndefined();
+          expect(conn.sslrootcertInline).toBeUndefined();
+        }).pipe(Effect.provide(linkedConnLayer)),
+      );
+    }
+
+    it.effect("does not pin a host outside the profile's domains", () =>
+      Effect.gen(function* () {
+        const conn = yield* linkedConn({}, { profile: "supabase", projectHost: "supabase.red" });
+        expect(conn.sslmode).toBeUndefined();
+        expect(conn.sslrootcertInline).toBeUndefined();
+      }).pipe(Effect.provide(linkedConnLayer)),
+    );
+  });
+
   it.effect("names the libpq variables when PGSSLMODE is invalid on a reachable direct host", () =>
     Effect.gen(function* () {
       const error = yield* linkedConn({ PGSSLMODE: "verifyfull" }).pipe(Effect.flip);
@@ -2230,7 +2467,7 @@ describe("dbConfigResolver.resolveConnection", () => {
       expect(r.isLocal).toBe(true);
       expect(r.target).toEqual({ kind: "local" });
       expect(output.stderrText).toBe("Target: local stack (127.0.0.1:55555)\n");
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("db-url target announces the host and never the credentials", () =>
@@ -2242,7 +2479,7 @@ describe("dbConfigResolver.resolveConnection", () => {
       expect(r.conn).toMatchObject({ host: "db.example.com", port: 6543, user: "alice" });
       expect(r.isLocal).toBe(false);
       expect(output.stderrText).toBe("Target: custom Postgres (db.example.com:6543)\n");
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("a db-url that fails to parse echoes the url with the password redacted", () =>
@@ -2252,7 +2489,7 @@ describe("dbConfigResolver.resolveConnection", () => {
       const exit = yield* Effect.exit(resolveConnection(dir, inputFor({ kind: "db-url", url })));
       expect(failureText(exit)).toContain("DbConfigParseUrlError");
       expect(failureText(exit)).not.toContain("secret");
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   const directTargets: ReadonlyArray<readonly [string, ResolvedTarget]> = [
@@ -2272,14 +2509,14 @@ describe("dbConfigResolver.resolveConnection", () => {
         );
         expect(failureText(exit)).toContain("TargetPasswordConflictError");
         expect(output.stderrText).toBe("");
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(`accepts an empty --password for a ${label} target`, () =>
       Effect.gen(function* () {
         const dir = yield* withWorkdir();
         yield* resolveConnection(dir, inputFor(target, { password: Option.some("") }));
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   }
 
@@ -2309,7 +2546,7 @@ describe("dbConfigResolver.resolveConnection", () => {
       expect(r.target).toEqual(target);
       expect(requests).toEqual([]);
       expect(output.stderrText).toBe("");
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   it.effect(
@@ -2338,7 +2575,7 @@ describe("dbConfigResolver.resolveConnection", () => {
           { method: "GET", path: `/v1/projects/${ref}/config/database/pooler` },
         ]);
         assertDbConfigDrift(requests, { remote: true });
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
     },
   );
 
@@ -2376,7 +2613,7 @@ describe("dbConfigResolver.resolveConnection", () => {
             }),
           ),
           Effect.scoped,
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         );
       },
     );
@@ -2415,7 +2652,7 @@ describe("dbConfigResolver.resolveConnection", () => {
       expect(requests).toEqual([
         { method: "GET", path: `/v1/projects/${ref}/config/database/pooler` },
       ]);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   describe("network bans on the temporary login role", () => {
@@ -2447,19 +2684,23 @@ describe("dbConfigResolver.resolveConnection", () => {
         }
         return undefined;
       });
-    const failingConnect = (failures: number) => {
+    const failingConnect = (
+      failures: number,
+      failure: (cfg: PgConnInput) => DbConnectError = () =>
+        new DbConnectError({ message: "password authentication failed" }),
+    ) => {
       const attempts = { count: 0 };
       const layer = Layer.succeed(DbConnection, {
-        connect: () =>
+        connect: (cfg) =>
           Effect.suspend(() => {
             attempts.count += 1;
-            return attempts.count <= failures
-              ? Effect.fail(new DbConnectError({ message: "password authentication failed" }))
-              : Effect.succeed(session);
+            return attempts.count <= failures ? Effect.fail(failure(cfg)) : Effect.succeed(session);
           }),
       });
       return { attempts, layer };
     };
+    const driverFailure = (code: string, message: string) => (cfg: PgConnInput) =>
+      toConnectError(cfg, false, Object.assign(new Error(message), { code }));
     const forkResolve = (
       input: DbConnectionInput,
       connection: Layer.Layer<DbConnection>,
@@ -2515,10 +2756,130 @@ describe("dbConfigResolver.resolveConnection", () => {
           );
           expect(connection.attempts.count).toBe(9);
           expect(requests.some((request) => request.method === "DELETE")).toBe(false);
-        }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+        }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
       },
     );
 
+    it.effect(
+      "keeps looking for bans when the dial fails, as a ban surfaces as a dial failure",
+      () => {
+        const requests: Array<{ readonly method: string; readonly path: string }> = [];
+        const connection = failingConnect(
+          Number.POSITIVE_INFINITY,
+          driverFailure("ETIMEDOUT", "connect ETIMEDOUT 203.0.113.9:6543"),
+        );
+        return Effect.gen(function* () {
+          yield* bannedRequests(requests, ["203.0.113.7"]);
+          const { fiber, advance } = yield* forkResolve(
+            inputFor(linkedTarget(ref, { source: "flag", matchesLinkedRef: false })),
+            connection.layer,
+          );
+          yield* advance(8);
+          const exit = yield* Fiber.await(fiber);
+          expect(failureText(exit)).toContain("LinkedDbNetworkBannedError");
+          expect(connection.attempts.count).toBe(9);
+        }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
+      },
+    );
+
+    it.effect("fails at once on a rejected server certificate and names the CA setting", () => {
+      const requests: Array<{ readonly method: string; readonly path: string }> = [];
+      const connection = failingConnect(
+        Number.POSITIVE_INFINITY,
+        driverFailure("SELF_SIGNED_CERT_IN_CHAIN", "self-signed certificate in certificate chain"),
+      );
+      return Effect.gen(function* () {
+        yield* bannedRequests(requests, ["203.0.113.7"]);
+        const { fiber } = yield* forkResolve(
+          inputFor(linkedTarget(ref, { source: "flag", matchesLinkedRef: false })),
+          connection.layer,
+        );
+        const exit = yield* Fiber.await(fiber);
+        const error = Exit.isFailure(exit) ? Cause.findErrorOption(exit.cause) : Option.none();
+        expect(error).toEqual(
+          Option.some(
+            expect.objectContaining({
+              _tag: "DbConfigConnectTempRoleError",
+              message: expect.stringContaining("tls error (self-signed certificate"),
+              suggestion: SUGGEST_CA_VERIFICATION,
+            }),
+          ),
+        );
+        expect(SUGGEST_CA_VERIFICATION).not.toBe(SUGGEST_ENV_VAR);
+        expect(connection.attempts.count).toBe(1);
+        expect(requests.some((request) => request.path.includes("network-bans"))).toBe(false);
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
+    });
+
+    it.effect("stops retrying authentication failures once the certificate is rejected", () => {
+      const requests: Array<{ readonly method: string; readonly path: string }> = [];
+      const connection = failingConnect(Number.POSITIVE_INFINITY, (cfg) =>
+        connection.attempts.count <= 2
+          ? new DbConnectError({ message: "password authentication failed" })
+          : driverFailure("CERT_HAS_EXPIRED", "certificate has expired")(cfg),
+      );
+      return Effect.gen(function* () {
+        yield* bannedRequests(requests, []);
+        const { fiber, advance } = yield* forkResolve(
+          inputFor(linkedTarget(ref, { source: "flag", matchesLinkedRef: false })),
+          connection.layer,
+        );
+        yield* advance(2);
+        const exit = yield* Fiber.await(fiber);
+        expect(failureText(exit)).toContain("DbConfigConnectTempRoleError");
+        expect(connection.attempts.count).toBe(3);
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
+    });
+
+    it.effect("fails at once on an IP rejected by network restrictions and lists no bans", () => {
+      const requests: Array<{ readonly method: string; readonly path: string }> = [];
+      const connection = failingConnect(
+        Number.POSITIVE_INFINITY,
+        () =>
+          new DbConnectError({
+            message: "failed to connect to postgres: Address not in tenant allow_list",
+            networkRestricted: true,
+          }),
+      );
+      return Effect.gen(function* () {
+        yield* bannedRequests(requests, ["203.0.113.7"]);
+        const { fiber } = yield* forkResolve(
+          inputFor(linkedTarget(ref, { source: "flag", matchesLinkedRef: false })),
+          connection.layer,
+        );
+        const exit = yield* Fiber.await(fiber);
+        const error = Exit.isFailure(exit) ? Cause.findErrorOption(exit.cause) : Option.none();
+        expect(error).toEqual(
+          Option.some(
+            expect.objectContaining({
+              _tag: "DbConfigConnectTempRoleError",
+              message: expect.stringContaining("Address not in tenant allow_list"),
+              suggestion: `${SUGGEST_NETWORK_RESTRICTIONS}\nhttps://supabase.com/dashboard/project/_/database/settings`,
+            }),
+          ),
+        );
+        expect(connection.attempts.count).toBe(1);
+        expect(requests.some((request) => request.path.includes("network-bans"))).toBe(false);
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
+    });
+
+    it.effect("retries a plain authentication failure to the end and lists no ban", () => {
+      const requests: Array<{ readonly method: string; readonly path: string }> = [];
+      const connection = failingConnect(Number.POSITIVE_INFINITY);
+      return Effect.gen(function* () {
+        yield* bannedRequests(requests, []);
+        const { fiber, advance } = yield* forkResolve(
+          inputFor(linkedTarget(ref, { source: "flag", matchesLinkedRef: false })),
+          connection.layer,
+        );
+        yield* advance(8);
+        const exit = yield* Fiber.await(fiber);
+        expect(failureText(exit)).toContain("DbConfigConnectTempRoleError");
+        expect(connection.attempts.count).toBe(9);
+        expect(requests.some((request) => request.method === "DELETE")).toBe(false);
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
+    });
+
     it.effect("connects without removing bans that are not blocking the caller", () => {
       const requests: Array<{ readonly method: string; readonly path: string }> = [];
       const connection = failingConnect(3);
@@ -2533,7 +2894,7 @@ describe("dbConfigResolver.resolveConnection", () => {
         expect(r.conn).toMatchObject({ user: `cli_login_role.${ref}` });
         expect(connection.attempts.count).toBe(4);
         expect(requests.some((request) => request.method === "DELETE")).toBe(false);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
 
     it.effect("keeps retrying without removing anything when no ban is listed", () => {
@@ -2550,7 +2911,7 @@ describe("dbConfigResolver.resolveConnection", () => {
         expect(r.conn).toMatchObject({ user: `cli_login_role.${ref}` });
         expect(connection.attempts.count).toBe(4);
         expect(requests.some((request) => request.method === "DELETE")).toBe(false);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
 
     it.effect("removes the bans and says so once the caller holds a --yes approval", () => {
@@ -2576,7 +2937,7 @@ describe("dbConfigResolver.resolveConnection", () => {
         });
         expect(output.stderrText).toContain("Removing network bans (203.0.113.7)...\n");
         assertDbConfigDrift(requests, { linked: true, "project-ref": ref });
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
 
     it.effect("does not remove bans for an approval obtained by prompting", () => {
@@ -2599,7 +2960,7 @@ describe("dbConfigResolver.resolveConnection", () => {
         const exit = yield* Fiber.await(fiber);
         expect(failureText(exit)).toContain("LinkedDbNetworkBannedError");
         expect(requests.some((request) => request.method === "DELETE")).toBe(false);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
 
     it.effect(
@@ -2629,7 +2990,7 @@ describe("dbConfigResolver.resolveConnection", () => {
           );
           expect(failureText(exit)).not.toContain("--yes");
           expect(connection.attempts.count).toBe(9);
-        }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+        }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
       },
     );
 
@@ -2649,7 +3010,7 @@ describe("dbConfigResolver.resolveConnection", () => {
         expect(failureText(exit)).toContain("DbConfigConnectTempRoleError");
         expect(failureText(exit)).not.toContain("--yes");
         expect(requests.some((request) => request.method === "DELETE")).toBe(false);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
 
     it.effect("keeps a failed removal when a later listing fails under --yes", () => {
@@ -2688,7 +3049,7 @@ describe("dbConfigResolver.resolveConnection", () => {
         const exit = yield* Fiber.await(fiber);
         expect(failureText(exit)).toContain("DbConfigUnbanStatusError");
         expect(listCalls).toBeGreaterThan(1);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
   });
 });
diff --git a/apps/cli/src/command-internal/db-config.layer.ts b/apps/cli/src/command-internal/db-config.layer.ts
index f42092c3fe..99f4ee6c1c 100644
--- a/apps/cli/src/command-internal/db-config.layer.ts
+++ b/apps/cli/src/command-internal/db-config.layer.ts
@@ -1,7 +1,6 @@
 import * as net from "node:net";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import {
-  Crypto,
   Duration,
   Effect,
   FileSystem,
@@ -12,6 +11,7 @@ import {
   Redacted,
   Struct,
 } from "effect";
+import { Digest } from "effect/crypto";
 
 import { CommandPlatformApiFactory } from "../auth/command-platform-api-factory.service.ts";
 import { CliArgs } from "../shared/cli/cli-args.service.ts";
@@ -33,7 +33,12 @@ import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
 import { Tty } from "../shared/runtime/tty.service.ts";
 import { Analytics } from "../shared/telemetry/analytics.service.ts";
 import { TelemetryRuntime } from "../shared/telemetry/runtime.service.ts";
-import { type ConnectSuggestionContext, SUGGEST_ENV_VAR } from "./connect-errors.ts";
+import {
+  type ConnectSuggestionContext,
+  SUGGEST_CA_VERIFICATION,
+  SUGGEST_ENV_VAR,
+  suggestNetworkRestrictions,
+} from "./connect-errors.ts";
 import { DbConnection, type PgConnInput } from "./db-connection.service.ts";
 import { IdentityStitch } from "./identity-stitch.ts";
 import {
@@ -49,7 +54,7 @@ import {
   redactConnectionString,
 } from "./db-config.parse.ts";
 import { DbConfigResolver, type DbConfigError } from "./db-config.service.ts";
-import { loadProjectEnvValues, readDbToml } from "./db-config.toml-read.ts";
+import { loadProjectEnvValues, readDbConfig } from "./db-config.read.ts";
 import type { DbConnectionInput } from "./db-config.types.ts";
 import { DebugLogger } from "../shared/output/debug-logger.service.ts";
 import { getHostname } from "./hostname.ts";
@@ -57,6 +62,7 @@ import { mapHttpError } from "./http-errors.ts";
 import { currentStackBackend } from "./stack-backend.ts";
 import { StackApi, stackApiLayer } from "./stack-api.ts";
 import { stackLocalDatabaseConn } from "./stack-local-database.ts";
+import { pinSupabaseTls } from "./supabase-tls.ts";
 import { block, type OperationEntry } from "./command-permissions/model.ts";
 import { renderDbUrlTarget, renderLocalTarget } from "./target/target-identity.ts";
 import { isCheckoutLinked } from "../shared/config/link-snapshot.ts";
@@ -198,6 +204,19 @@ const loginRoleErrorMapper = mapHttpError({
   statusMessage: (status, body) => `unexpected login role status ${status}: ${body}`,
 });
 
+// The Management API surfaces Postgres 42501 from `ALTER ROLE`, which on these projects means
+// `supabase_privileged_role` was never granted to the login-role creator.
+const isMissingPrivilegedRole = (error: Errors.DbConfigLoginRoleStatusError): boolean =>
+  error.status === 400 && /permission denied to alter role/i.test(error.body);
+
+const missingPrivilegedRoleError = (ref: string, error: Errors.DbConfigLoginRoleStatusError) =>
+  new Errors.DbConfigLoginRoleMissingPrivilegedRoleError({
+    projectRef: ref,
+    message: `failed to create a temporary login role, likely because the project database is missing supabase_privileged_role: ${error.body}`,
+    suggestion:
+      "Connect with your database password instead, which skips the temporary login role: --password where the command supports it, SUPABASE_DB_PASSWORD for the linked project, or a Postgres URL that includes the password (--db-url, or --from/--to for db diff). Contact support at https://supabase.com/dashboard/support/new to repair the project's roles.",
+  });
+
 const listBansErrorMapper = mapHttpError({
   networkError: Errors.DbConfigListBansNetworkError,
   statusError: Errors.DbConfigListBansStatusError,
@@ -264,9 +283,12 @@ const initLoginRole = Effect.fn("DbConfig.initLoginRole")(function* (
   const api = yield* (yield* CommandPlatformApiFactory).make;
   // Written to stderr unconditionally (not gated on --debug).
   yield* output.raw("Initialising login role...\n", "stderr");
-  const role = yield* api.v1
-    .createLoginRole({ ref, read_only: false })
-    .pipe(Effect.catch(loginRoleErrorMapper));
+  const role = yield* api.v1.createLoginRole({ ref, read_only: false }).pipe(
+    Effect.catch(loginRoleErrorMapper),
+    Effect.catchTag("DbConfigLoginRoleStatusError", (error) =>
+      Effect.fail(isMissingPrivilegedRole(error) ? missingPrivilegedRoleError(ref, error) : error),
+    ),
+  );
   return { ...conn, user: role.role, password: role.password };
 });
 
@@ -300,12 +322,17 @@ const NO_BANS: BanState = { listed: [], failure: Option.none() };
 
 // Verify-connect with backoff while the pooler refreshes the temp password. From attempt 3 on, look
 // for network bans on the project: with approval they are removed and a failed removal is what the
-// run reports if the retries run out; without it the last listing is reported instead.
+// run reports if the retries run out; without it the last listing is reported instead. A rejected
+// server certificate or an IP rejected by the project's network restrictions ends the loop at
+// once: neither changes between attempts, and bans do not cause them. Every other failure keeps
+// retrying, dial failures included, because a ban surfaces as a dial failure and only the retry
+// path lists bans.
 const waitForTempRole = Effect.fn("DbConfig.waitForTempRole")(function* (
   ref: string,
   conn: PgConnInput,
   dnsResolver: "native" | "https",
   removeNetworkBans: boolean,
+  dashboardUrl: string,
 ) {
   const dbConn = yield* DbConnection;
   const debug = yield* DebugLogger;
@@ -318,6 +345,22 @@ const waitForTempRole = Effect.fn("DbConfig.waitForTempRole")(function* (
     Effect.scoped(dbConn.connect(conn, { isLocal: false, dnsResolver }).pipe(Effect.asVoid)).pipe(
       Effect.ensuring(Effect.annotateCurrentSpan("retry.attempt_count", n)),
       Effect.catch((cause) => {
+        if (cause.certificateRejected === true) {
+          return Effect.fail(
+            new Errors.DbConfigConnectTempRoleError({
+              message: `failed to connect as temp role: ${cause.message}`,
+              suggestion: SUGGEST_CA_VERIFICATION,
+            }),
+          );
+        }
+        if (cause.networkRestricted === true) {
+          return Effect.fail(
+            new Errors.DbConfigConnectTempRoleError({
+              message: `failed to connect as temp role: ${cause.message}`,
+              suggestion: suggestNetworkRestrictions(dashboardUrl),
+            }),
+          );
+        }
         // 8 retries after the initial attempt allows 9 total attempts. `n` is 1-based, so give
         // up only after attempt 9 (`n > MAX_RETRIES`), not at attempt 8.
         if (n > MAX_RETRIES) {
@@ -496,6 +539,7 @@ const fetchApiPoolerUrl = Effect.fn("DbConfig.fetchApiPoolerUrl")(
 const resolvePoolerConn = Effect.fn("DbConfig.resolvePoolerConn")(function* (
   ref: string,
   workdir: string,
+  profile: string,
   poolerHost: string,
   dnsResolver: "native" | "https",
   password: string,
@@ -508,6 +552,7 @@ const resolvePoolerConn = Effect.fn("DbConfig.resolvePoolerConn")(function* (
   ignoreSavedUrl = false,
   resolveVaultSecrets = true,
   removeNetworkBans: boolean,
+  dashboardUrl: string,
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
@@ -515,7 +560,7 @@ const resolvePoolerConn = Effect.fn("DbConfig.resolvePoolerConn")(function* (
   // on the main linked branch rather than validating base config. For an ad-hoc `--project-ref`,
   // skip the saved workdir pooler URL because it belongs to the linked project, not necessarily
   // the explicit ref.
-  yield* readDbToml(fs, path, workdir, ref, {
+  yield* readDbConfig(fs, path, workdir, ref, {
     resolveVaultSecrets,
   });
   let connectionString = ignoreSavedUrl ? undefined : Option.getOrUndefined(savedPoolerUrl);
@@ -535,14 +580,14 @@ const resolvePoolerConn = Effect.fn("DbConfig.resolvePoolerConn")(function* (
     }
   }
   if (Option.isNone(pooler)) return Option.none<PgConnInput>();
-  const poolerConn = pooler.value;
+  const poolerConn = pinSupabaseTls(pooler.value, profile);
   if (password.length > 0) return Option.some({ ...poolerConn, password });
   // Mint a temp role; preserve Supavisor's `<user>.<ref>` tenant suffix.
   const originalUser = poolerConn.user;
   const withRole = yield* initLoginRole(ref, poolerConn);
   const finalUser = originalUser.endsWith(`.${ref}`) ? `${withRole.user}.${ref}` : withRole.user;
   const tempConn = { ...withRole, user: finalUser };
-  yield* waitForTempRole(ref, tempConn, dnsResolver, removeNetworkBans);
+  yield* waitForTempRole(ref, tempConn, dnsResolver, removeNetworkBans, dashboardUrl);
   return Option.some(tempConn);
 });
 
@@ -562,6 +607,7 @@ const resolvePoolerConn = Effect.fn("DbConfig.resolvePoolerConn")(function* (
 export const resolveLinkedConn = Effect.fn("DbConfig.resolveLinkedConn")(function* (
   ref: string,
   workdir: string,
+  profile: string,
   projectHost: string,
   poolerHost: string,
   dnsResolver: "native" | "https",
@@ -569,6 +615,8 @@ export const resolveLinkedConn = Effect.fn("DbConfig.resolveLinkedConn")(functio
   options: {
     /** Whether the temp-role retry may clear listed bans; only a `--yes` approval sets it. */
     readonly removeNetworkBans: boolean;
+    /** The active profile's dashboard, linked from the network restrictions hint. */
+    readonly dashboardUrl: string;
     readonly adHocProjectRef?: boolean;
     readonly resolveVaultSecrets?: boolean;
     /** The pooler URL the link recorded for `ref`, used when the direct host is unreachable. */
@@ -589,6 +637,7 @@ export const resolveLinkedConn = Effect.fn("DbConfig.resolveLinkedConn")(functio
     fetchPoolerFromApi = false,
     hasPasswordFlag = false,
     removeNetworkBans,
+    dashboardUrl,
     poolerUrl = Option.none<string>(),
   } = options;
   const dbPassword = yield* resolveLinkedPassword(ref, workdir, explicitPassword, hasPasswordFlag);
@@ -605,24 +654,28 @@ export const resolveLinkedConn = Effect.fn("DbConfig.resolveLinkedConn")(functio
   yield* Effect.annotateCurrentSpan("db.direct_reachable", reachable);
   if (reachable) {
     /* Same libpq TLS and timeout precedence as the pooler URL; host, port, role and database stay
-       pinned. The empty `passfile=` skips a `.pgpass` read for a password that is discarded. */
+       pinned. The empty `passfile=` skips a `.pgpass` read for a password that is discarded. Absent an
+       explicit `sslmode`/`sslrootcert`, the Supabase CA is pinned, as on the pooler path. */
     const parsed = yield* parseConnectionString(
       `postgresql://postgres@${host}:${DIRECT_PORT}/postgres?passfile=`,
     );
     if (parsed === undefined) {
       return yield* new Errors.DbConfigLibpqEnvError({ message: LIBPQ_ENV_MESSAGE });
     }
-    const direct = {
-      ...base,
-      ...Struct.pick(parsed, [
-        "sslmode",
-        "sslrootcert",
-        "sslcert",
-        "sslkey",
-        "sslpassword",
-        "connectTimeoutSeconds",
-      ]),
-    };
+    const direct = pinSupabaseTls(
+      {
+        ...base,
+        ...Struct.pick(parsed, [
+          "sslmode",
+          "sslrootcert",
+          "sslcert",
+          "sslkey",
+          "sslpassword",
+          "connectTimeoutSeconds",
+        ]),
+      },
+      profile,
+    );
     if (direct.password.length > 0) return direct;
     return yield* initLoginRole(ref, direct);
   }
@@ -633,6 +686,7 @@ export const resolveLinkedConn = Effect.fn("DbConfig.resolveLinkedConn")(functio
   const poolerConn = yield* resolvePoolerConn(
     ref,
     workdir,
+    profile,
     poolerHost,
     dnsResolver,
     base.password,
@@ -641,6 +695,7 @@ export const resolveLinkedConn = Effect.fn("DbConfig.resolveLinkedConn")(functio
     adHocProjectRef,
     resolveVaultSecrets,
     removeNetworkBans,
+    dashboardUrl,
   );
   if (Option.isNone(poolerConn)) {
     return yield* new Errors.DbConfigIpv6Error({
@@ -663,7 +718,7 @@ export const dbConfigResolverLayer = Layer.effect(
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
     const runtimeInfo = yield* RuntimeInfo;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* Digest.Digest;
     const debug = yield* DebugLogger;
     const output = yield* Output;
     const dbConn = yield* DbConnection;
@@ -726,6 +781,7 @@ export const dbConfigResolverLayer = Layer.effect(
         onSome: (value) => Layer.succeed(CliArgs, value),
       }),
       BunServices.layer,
+      BunCrypto.layerSecureRandom,
     );
     // Compile-time guard: if `linkedDbResolverRuntimeLayer`'s requirements ever
     // grow a service not captured above, this assignment fails to type-check (the
@@ -759,7 +815,7 @@ export const dbConfigResolverLayer = Layer.effect(
         Effect.provideService(RuntimeInfo, runtimeInfo),
         Effect.provideService(FileSystem.FileSystem, fs),
         Effect.provideService(Path.Path, path),
-        Effect.provideService(Crypto.Crypto, crypto),
+        Effect.provideService(Digest.Digest, crypto),
         Effect.catchTag("CliConfigLoadError", (error) =>
           Effect.fail(new Errors.DbConfigLoadError({ message: error.message })),
         ),
@@ -768,7 +824,7 @@ export const dbConfigResolverLayer = Layer.effect(
 
     const resolveDbUrl = (dbUrl: string, localHost: string, resolveVaultSecrets: boolean) =>
       Effect.gen(function* () {
-        const tomlValues = yield* readDbToml(fs, path, cliSettings.workdir, undefined, {
+        const tomlValues = yield* readDbConfig(fs, path, cliSettings.workdir, undefined, {
           resolveVaultSecrets,
         });
         // The project `.env*` files populate the environment that the libpq `PG*` fallbacks
@@ -814,7 +870,7 @@ export const dbConfigResolverLayer = Layer.effect(
 
     const resolveLocalStack = (localHost: string, resolveVaultSecrets: boolean) =>
       Effect.gen(function* () {
-        const tomlValues = yield* readDbToml(fs, path, cliSettings.workdir, undefined, {
+        const tomlValues = yield* readDbConfig(fs, path, cliSettings.workdir, undefined, {
           resolveVaultSecrets,
         });
         const backend = yield* currentStackBackend;
@@ -854,12 +910,13 @@ export const dbConfigResolverLayer = Layer.effect(
       },
     ) =>
       Effect.gen(function* () {
-        yield* readDbToml(fs, path, cliSettings.workdir, ref, {
+        yield* readDbConfig(fs, path, cliSettings.workdir, ref, {
           resolveVaultSecrets: options.resolveVaultSecrets,
         });
         return yield* resolveLinkedConn(
           ref,
           cliSettings.workdir,
+          cliSettings.profile,
           cliSettings.projectHost,
           cliSettings.poolerHost,
           options.dnsResolver,
@@ -871,6 +928,7 @@ export const dbConfigResolverLayer = Layer.effect(
             hasPasswordFlag: options.hasPasswordFlag,
             removeNetworkBans: options.removeNetworkBans,
             poolerUrl: options.poolerUrl,
+            dashboardUrl: cliSettings.dashboardUrl,
           },
         );
       });
@@ -894,7 +952,15 @@ export const dbConfigResolverLayer = Layer.effect(
           target.kind === "local" &&
           (yield* isCheckoutLinked(fs, path, cliSettings.workdir, cliSettings.projectId));
         if (target.kind !== "linked") {
-          yield* rejectTargetPassword(target.kind, input.password, linkedCheckout);
+          yield* rejectTargetPassword(
+            target.kind,
+            input.password,
+            linkedCheckout,
+            cliSettings.workdir,
+          ).pipe(
+            Effect.provideService(FileSystem.FileSystem, fs),
+            Effect.provideService(Path.Path, path),
+          );
         }
         const resolveVaultSecrets = input.resolveVaultSecrets ?? true;
         if (target.kind === "linked") {
@@ -952,6 +1018,7 @@ export const dbConfigResolverLayer = Layer.effect(
           return yield* resolvePoolerConn(
             target.ref,
             cliSettings.workdir,
+            cliSettings.profile,
             cliSettings.poolerHost,
             input.dnsResolver,
             password,
@@ -960,6 +1027,7 @@ export const dbConfigResolverLayer = Layer.effect(
             !target.matchesLinkedRef,
             input.resolveVaultSecrets ?? true,
             canRemoveNetworkBans(input),
+            cliSettings.dashboardUrl,
           );
         }).pipe(
           Effect.provide(
diff --git a/apps/cli/src/command-internal/db-config.toml-read.precedence.unit.test.ts b/apps/cli/src/command-internal/db-config.read.precedence.unit.test.ts
similarity index 98%
rename from apps/cli/src/command-internal/db-config.toml-read.precedence.unit.test.ts
rename to apps/cli/src/command-internal/db-config.read.precedence.unit.test.ts
index d75c0cd9ae..beb851d057 100644
--- a/apps/cli/src/command-internal/db-config.toml-read.precedence.unit.test.ts
+++ b/apps/cli/src/command-internal/db-config.read.precedence.unit.test.ts
@@ -6,7 +6,7 @@ import { ConfigEnvPins } from "../../tests/helpers/config-env-pins.ts";
 import { goldenJson, useShellEnvPin } from "../../tests/helpers/config-goldens.ts";
 import { useTempWorkdir } from "../../tests/helpers/command-mocks.ts";
 import { cliConfigValuesTestLayer } from "../../tests/helpers/config-values-layer.ts";
-import { checkDbToml } from "./db-config.toml-read.ts";
+import { checkDbConfig } from "./db-config.read.ts";
 
 const TARGET_REF = "abcdefghijklmnopqrst";
 const OTHER_REF = "zyxwvutsrqponmlkjihg";
@@ -213,7 +213,7 @@ describe("db toml reader precedence goldens", () => {
         }
         pinShellEnv(shell);
 
-        const outcome = yield* checkDbToml(fs, path, workdir, fixture.ref).pipe(
+        const outcome = yield* checkDbConfig(fs, path, workdir, fixture.ref).pipe(
           Effect.provide(cliConfigValuesTestLayer),
           Effect.provideService(ConfigEnvPins, shell),
           Effect.provideService(
diff --git a/apps/cli/src/command-internal/db-config.toml-read.ts b/apps/cli/src/command-internal/db-config.read.ts
similarity index 93%
rename from apps/cli/src/command-internal/db-config.toml-read.ts
rename to apps/cli/src/command-internal/db-config.read.ts
index 56f30ef128..a1957a02ac 100644
--- a/apps/cli/src/command-internal/db-config.toml-read.ts
+++ b/apps/cli/src/command-internal/db-config.read.ts
@@ -27,6 +27,7 @@ import {
   validateAuthSmsProviders,
   validateResolvedConfig,
 } from "./config-validate.ts";
+import { type ConfigFileRef, configFileRefOf } from "./config-advice.ts";
 import { DbConfigLoadError, isPassthroughLoadFailure } from "./db-config.errors.ts";
 import { recordOrioleDbTelemetry, selectsOrioleDb } from "./db-image.ts";
 import { resolveAuthExternalProviders } from "./local-config-values.ts";
@@ -42,7 +43,7 @@ type EnvLookup = (name: string) => string | undefined;
  * defaults; a malformed one aborts the command instead of running against the default local
  * database.
  */
-export interface DbTomlValues {
+export interface DbConfigValues {
   readonly projectEnv: Readonly<Record<string, string>>;
   readonly apiSchemas: ReadonlyArray<string>;
   /** Schemas the Data API serves; empty when `[api].enabled` is false. */
@@ -71,7 +72,7 @@ export interface DbTomlValues {
    * `[experimental.pgdelta]` config, consumed by the declarative-schema commands
    * (`db schema declarative generate` / `sync`).
    */
-  readonly pgDelta: PgDeltaTomlConfig;
+  readonly pgDelta: PgDeltaConfig;
   /** Effective `[experimental.webhooks].enabled`; false when the section is absent. */
   readonly webhooksEnabled: boolean;
   /**
@@ -79,13 +80,13 @@ export interface DbTomlValues {
    * therefore the declarative catalog-cache key (`setupInputsToken`). Drift in
    * any of these must self-invalidate cached catalogs.
    */
-  readonly baseline: BaselineTomlConfig;
+  readonly baseline: BaselineConfig;
   /** `[db.migrations] enabled` (default true) — gates `up`/`down` migration apply. */
   readonly migrationsEnabled: boolean;
   /**
    * `[db.migrations] schema_paths`, default `[]` — resolved (supabase-prefixed
    * when relative) and overridable via `SUPABASE_DB_MIGRATIONS_SCHEMA_PATHS`,
-   * same as {@link DbSeedTomlConfig.sqlPaths}. Resolved unconditionally, not
+   * same as {@link DbSeedConfig.sqlPaths}. Resolved unconditionally, not
    * gated on `migrationsEnabled`.
    */
   readonly schemaPaths: ReadonlyArray<string>;
@@ -98,18 +99,20 @@ export interface DbTomlValues {
    */
   readonly schemaPathPatterns: ReadonlyArray<string>;
   /** `[db.seed]` enabled + supabase-prefixed `sql_paths` globs — used by `down`. */
-  readonly seed: DbSeedTomlConfig;
+  readonly seed: DbSeedConfig;
   /** `[db.vault]` secrets (name → resolved value) — upserted by `up`/`down`. */
-  readonly vault: ReadonlyArray<DbVaultSecretToml>;
+  readonly vault: ReadonlyArray<DbVaultSecret>;
   /**
    * The matched `[remotes.<name>]` block name when a linked ref merged its override
    * (`Loading config override: [remotes.<name>]` line), else `undefined`.
    */
   readonly appliedRemote: string | undefined;
+  /** The config file the values came from, for messages that point at it. */
+  readonly configFile: ConfigFileRef;
 }
 
 /** `[db.seed]` config surfaced for `migration down`'s seed step. */
-interface DbSeedTomlConfig {
+interface DbSeedConfig {
   readonly enabled: boolean;
   /** Glob patterns, each supabase-prefixed when relative. */
   readonly sqlPaths: ReadonlyArray<string>;
@@ -120,14 +123,14 @@ interface DbSeedTomlConfig {
  * decrypted if it was a dotenvx `encrypted:` ciphertext). `resolved` is true
  * once the value is a non-empty, non-`env(...)` string.
  */
-interface DbVaultSecretToml {
+interface DbVaultSecret {
   readonly name: string;
   readonly value: string;
   readonly resolved: boolean;
 }
 
 /** Cache-key inputs from `[auth]`/`[storage]`/`[realtime]`/`[api]`/`[db.vault]`. */
-interface BaselineTomlConfig {
+interface BaselineConfig {
   /** `[auth] enabled`, default true. Gates `initSchema`'s auth service migration. */
   readonly authEnabled: boolean;
   /** `[storage] enabled`, default true. */
@@ -145,7 +148,7 @@ interface BaselineTomlConfig {
 }
 
 /** The `[experimental.pgdelta]` subtree. */
-export interface PgDeltaTomlConfig {
+export interface PgDeltaConfig {
   /** `[experimental.pgdelta] enabled`, default true. */
   readonly enabled: boolean;
   /**
@@ -343,7 +346,7 @@ const toDbConfigLoadError = (error: ResolvedConfigLoadError) => {
   }
 };
 
-const loadDbTomlResolvedConfig = (
+const loadDbResolvedConfig = (
   workdir: string,
   ref: string | undefined,
   ignoreConfigFile: boolean,
@@ -357,14 +360,14 @@ const loadDbTomlResolvedConfig = (
   ).pipe(Effect.mapError(toDbConfigLoadError));
 
 /**
- * Projects the `CliConfigValues` resolved config of `<workdir>/supabase/config.{toml,json}` (flags aside)
- * onto {@link DbTomlValues}. `fs`/`path` are passed in so the resolver can capture them once and
+ * Projects the `CliConfigValues` resolved config of `<workdir>/supabase/config.{toml,json,jsonc}` (flags aside)
+ * onto {@link DbConfigValues}. `fs`/`path` are passed in so the resolver can capture them once and
  * keep its own `R` at `never`.
  *
  * Fails with `DbConfigLoadError` when the config is present but unreadable, undecodable or invalid;
  * an absent file is not an error.
  */
-const readDbTomlCore = Effect.fnUntraced(function* (
+const readDbConfigCore = Effect.fnUntraced(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   workdir: string,
@@ -377,7 +380,7 @@ const readDbTomlCore = Effect.fnUntraced(function* (
   warnOnUnresolvedEnv = true,
   resolveVaultSecrets = true,
 ) {
-  const resolvedConfig = yield* loadDbTomlResolvedConfig(workdir, ref, ignoreConfigFile);
+  const resolvedConfig = yield* loadDbResolvedConfig(workdir, ref, ignoreConfigFile);
   const projectEnv = resolvedConfig.projectEnvValues;
   const { config } = resolvedConfig.materialized;
   const fail = (message: string) => Effect.fail(new DbConfigLoadError({ message }));
@@ -640,7 +643,9 @@ const readDbTomlCore = Effect.fnUntraced(function* (
     webhooksEnabled,
     pgdeltaFormatOptions: pgDeltaConfig?.format_options ?? "",
   };
+  const configFile = configFileRefOf(path, workdir, resolvedConfig);
   const validationInput: ConfigValidationInput = {
+    configFileName: path.basename(configFile.path),
     db: { port, majorVersion },
     storageBucketNames: Object.keys(buckets),
     functionSlugs: Object.keys(config.functions ?? {}),
@@ -668,7 +673,7 @@ const readDbTomlCore = Effect.fnUntraced(function* (
 
   const vaultConfig = config.db.vault ?? {};
   const vaultNames = Object.keys(vaultConfig).sort();
-  const vault: Array<DbVaultSecretToml> = [];
+  const vault: Array<DbVaultSecret> = [];
   if (resolveVaultSecrets) {
     for (const name of vaultNames) {
       const value = vaultConfig[name] ?? "";
@@ -695,7 +700,7 @@ const readDbTomlCore = Effect.fnUntraced(function* (
     ? [...new Set(apiSchemas.map((schema) => schema.trim()).filter((schema) => schema.length > 0))]
     : [];
 
-  const values: DbTomlValues = {
+  const values: DbConfigValues = {
     projectEnv,
     apiSchemas,
     exposedSchemas,
@@ -725,6 +730,7 @@ const readDbTomlCore = Effect.fnUntraced(function* (
     seed: { enabled: seedEnabled, sqlPaths: seedSqlPaths },
     vault,
     appliedRemote: Option.getOrUndefined(resolvedConfig.appliedRemote),
+    configFile,
   };
   return values;
 });
@@ -735,12 +741,12 @@ const readDbTomlCore = Effect.fnUntraced(function* (
  * validation aborts with a matching error. Call this before asserting the stack is
  * running, prompting, or any destructive work.
  */
-export const checkDbToml = (
+export const checkDbConfig = (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   workdir: string,
   ref?: string,
-  // See `readDbTomlCore`'s doc comment. Pass `false` only when an earlier,
+  // See `readDbConfigCore`'s doc comment. Pass `false` only when an earlier,
   // same-invocation call already printed the OrioleDB S3 WARN once.
   opts?: {
     readonly warnOnUnresolvedEnv?: boolean;
@@ -748,7 +754,7 @@ export const checkDbToml = (
     readonly resolveVaultSecrets?: boolean;
   },
 ) =>
-  readDbTomlCore(
+  readDbConfigCore(
     fs,
     path,
     workdir,
@@ -760,12 +766,12 @@ export const checkDbToml = (
 
 /**
  * Reads `config.toml`. Defaults to the same validating behavior as
- * {@link checkDbToml}; pass `{ validate: false }` for a best-effort read that never
+ * {@link checkDbConfig}; pass `{ validate: false }` for a best-effort read that never
  * throws — a config-load failure falls back to pure defaults (env overrides still
  * applied), for callers that only need `projectId` and don't require a fully
  * validated config.
  */
-export const readDbToml = (
+export const readDbConfig = (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   workdir: string,
@@ -779,17 +785,41 @@ export const readDbToml = (
   const warnOnUnresolvedEnv = opts?.warnOnUnresolvedEnv ?? true;
   const resolveVaultSecrets = opts?.resolveVaultSecrets ?? true;
   return opts?.validate === false
-    ? readDbTomlCore(fs, path, workdir, ref, false, warnOnUnresolvedEnv, resolveVaultSecrets).pipe(
+    ? readDbConfigCore(
+        fs,
+        path,
+        workdir,
+        ref,
+        false,
+        warnOnUnresolvedEnv,
+        resolveVaultSecrets,
+      ).pipe(
         // Fall back to the ignore-file defaults path (never re-reads the broken config)
         // so a best-effort caller gets a well-formed defaults result instead of a throw.
         Effect.catchTags({
           DbConfigLoadError: () =>
-            readDbTomlCore(fs, path, workdir, ref, true, warnOnUnresolvedEnv, resolveVaultSecrets),
+            readDbConfigCore(
+              fs,
+              path,
+              workdir,
+              ref,
+              true,
+              warnOnUnresolvedEnv,
+              resolveVaultSecrets,
+            ),
           CliConfigValueError: () =>
-            readDbTomlCore(fs, path, workdir, ref, true, warnOnUnresolvedEnv, resolveVaultSecrets),
+            readDbConfigCore(
+              fs,
+              path,
+              workdir,
+              ref,
+              true,
+              warnOnUnresolvedEnv,
+              resolveVaultSecrets,
+            ),
         }),
       )
-    : readDbTomlCore(fs, path, workdir, ref, false, warnOnUnresolvedEnv, resolveVaultSecrets);
+    : readDbConfigCore(fs, path, workdir, ref, false, warnOnUnresolvedEnv, resolveVaultSecrets);
 };
 
 /**
@@ -798,7 +828,7 @@ export const readDbToml = (
  * default `supabase/schemas`. `path` joins the segments so the separator matches the
  * host platform.
  */
-export function resolveDeclarativeDir(path: Path.Path, pgDelta: PgDeltaTomlConfig): string {
+export function resolveDeclarativeDir(path: Path.Path, pgDelta: PgDeltaConfig): string {
   return Option.getOrElse(pgDelta.declarativeSchemaPath, () =>
     path.join(...DEFAULT_DECLARATIVE_DIR_SEGMENTS),
   );
diff --git a/apps/cli/src/command-internal/db-config.toml-read.unit.test.ts b/apps/cli/src/command-internal/db-config.read.unit.test.ts
similarity index 97%
rename from apps/cli/src/command-internal/db-config.toml-read.unit.test.ts
rename to apps/cli/src/command-internal/db-config.read.unit.test.ts
index 59dbec46a3..00da986f48 100644
--- a/apps/cli/src/command-internal/db-config.toml-read.unit.test.ts
+++ b/apps/cli/src/command-internal/db-config.read.unit.test.ts
@@ -17,12 +17,12 @@ import type { PlatformError } from "effect/PlatformError";
 import { withConfigEnv } from "../../tests/helpers/command-mocks.ts";
 import { cliConfigValuesTestLayer } from "../../tests/helpers/config-values-layer.ts";
 import {
-  checkDbToml,
+  checkDbConfig,
   loadProjectEnvValues,
-  readDbToml,
+  readDbConfig,
   resolveDeclarativeDir,
-  type DbTomlValues,
-} from "./db-config.toml-read.ts";
+  type DbConfigValues,
+} from "./db-config.read.ts";
 import { resolveSeedSqlPath } from "../shared/config/seed-path.ts";
 import { sanitizeProjectId } from "../shared/config/project-id.ts";
 import type { CliConfigValues } from "../config/cli-config-values.service.ts";
@@ -69,14 +69,14 @@ const read = (workdir: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    return yield* readDbToml(fs, path, workdir);
+    return yield* readDbConfig(fs, path, workdir);
   }).pipe(Effect.provide(servicesLive));
 
 const readRef = (workdir: string, ref: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    return yield* readDbToml(fs, path, workdir, ref);
+    return yield* readDbConfig(fs, path, workdir, ref);
   }).pipe(Effect.provide(servicesLive));
 
 const loadEnv = (workdir: string) =>
@@ -97,9 +97,9 @@ describe("read (lenient) vs check (throws) split", () => {
       return yield* run(fs, path);
     }).pipe(Effect.provide(servicesLive));
 
-  it.effect("checkDbToml throws on an undecryptable secret", () => {
+  it.effect("checkDbConfig throws on an undecryptable secret", () => {
     return withConfig('[db]\nroot_key = "encrypted:anything"\n').pipe(
-      Effect.flatMap((dir) => withServices(dir, (fs, path) => checkDbToml(fs, path, dir))),
+      Effect.flatMap((dir) => withServices(dir, (fs, path) => checkDbConfig(fs, path, dir))),
       Effect.exit,
       Effect.tap((exit) =>
         Effect.sync(() => {
@@ -114,10 +114,10 @@ describe("read (lenient) vs check (throws) split", () => {
     );
   });
 
-  it.effect("checkDbToml surfaces an invalid env value as CliConfigValueError", () => {
+  it.effect("checkDbConfig surfaces an invalid env value as CliConfigValueError", () => {
     return withConfig("[db]\nport = 5432\n").pipe(
       Effect.tap((dir) => writeFile(dir, ["supabase", ".env"], "SUPABASE_DB_PORT=notaport\n")),
-      Effect.flatMap((dir) => withServices(dir, (fs, path) => checkDbToml(fs, path, dir))),
+      Effect.flatMap((dir) => withServices(dir, (fs, path) => checkDbConfig(fs, path, dir))),
       Effect.flip,
       Effect.tap((error) =>
         Effect.sync(() => {
@@ -142,7 +142,7 @@ describe("read (lenient) vs check (throws) split", () => {
     ).pipe(
       Effect.flatMap((dir) =>
         withServices(dir, (fs, path) =>
-          checkDbToml(fs, path, dir, undefined, { resolveVaultSecrets: false }),
+          checkDbConfig(fs, path, dir, undefined, { resolveVaultSecrets: false }),
         ),
       ),
       Effect.tap((values) =>
@@ -154,24 +154,31 @@ describe("read (lenient) vs check (throws) split", () => {
     );
   });
 
-  it.effect("readDbToml({ validate: false }) tolerates the same secret, returning defaults", () => {
-    return withConfig('[db]\nroot_key = "encrypted:anything"\n').pipe(
-      Effect.flatMap((dir) =>
-        withServices(dir, (fs, path) => readDbToml(fs, path, dir, undefined, { validate: false })),
-      ),
-      Effect.tap((v) =>
-        Effect.sync(() => {
-          expect(v.vault).toEqual([]);
-          expect(v.port).toBeGreaterThan(0);
-        }),
-      ),
-    );
-  });
+  it.effect(
+    "readDbConfig({ validate: false }) tolerates the same secret, returning defaults",
+    () => {
+      return withConfig('[db]\nroot_key = "encrypted:anything"\n').pipe(
+        Effect.flatMap((dir) =>
+          withServices(dir, (fs, path) =>
+            readDbConfig(fs, path, dir, undefined, { validate: false }),
+          ),
+        ),
+        Effect.tap((v) =>
+          Effect.sync(() => {
+            expect(v.vault).toEqual([]);
+            expect(v.port).toBeGreaterThan(0);
+          }),
+        ),
+      );
+    },
+  );
 
-  it.effect("readDbToml({ validate: false }) still returns a valid config's values", () => {
+  it.effect("readDbConfig({ validate: false }) still returns a valid config's values", () => {
     return withConfig('project_id = "lenientproj"\n').pipe(
       Effect.flatMap((dir) =>
-        withServices(dir, (fs, path) => readDbToml(fs, path, dir, undefined, { validate: false })),
+        withServices(dir, (fs, path) =>
+          readDbConfig(fs, path, dir, undefined, { validate: false }),
+        ),
       ),
       Effect.tap((v) =>
         Effect.sync(() => {
@@ -182,7 +189,7 @@ describe("read (lenient) vs check (throws) split", () => {
   });
 });
 
-describe("readDbToml", () => {
+describe("readDbConfig", () => {
   it.effect("returns defaults when config.toml is absent", () => {
     return Effect.gen(function* () {
       const path = yield* Path.Path;
@@ -341,7 +348,7 @@ describe("readDbToml", () => {
       // A bare leading `/` has no Windows volume name, so it resolves as relative and joins to
       // `supabase/`, unlike Node's `path.win32.isAbsolute`, which treats a leading separator as
       // rooted at the current drive. Tests `resolveSeedSqlPath` directly with
-      // `BunPath.layerWin32` instead of the full `readDbToml` pipeline, since that pipeline
+      // `BunPath.layerWin32` instead of the full `readDbConfig` pipeline, since that pipeline
       // needs the real (POSIX-pathed) `Path.Path` service to open the temp config file on disk.
       const originalPlatform = process.platform;
       Object.defineProperty(process, "platform", { value: "win32" });
@@ -533,7 +540,7 @@ describe("readDbToml", () => {
       table: "db.seed",
       field: "enabled",
       value: "0",
-      read: (v: DbTomlValues) => v.seed.enabled,
+      read: (v: DbConfigValues) => v.seed.enabled,
       expected: false,
     },
     {
@@ -541,7 +548,7 @@ describe("readDbToml", () => {
       table: "db.migrations",
       field: "enabled",
       value: "0",
-      read: (v: DbTomlValues) => v.migrationsEnabled,
+      read: (v: DbConfigValues) => v.migrationsEnabled,
       expected: false,
     },
     {
@@ -549,7 +556,7 @@ describe("readDbToml", () => {
       table: "experimental.pgdelta",
       field: "enabled",
       value: "1",
-      read: (v: DbTomlValues) => v.pgDelta.enabled,
+      read: (v: DbConfigValues) => v.pgDelta.enabled,
       expected: true,
     },
     {
@@ -557,7 +564,7 @@ describe("readDbToml", () => {
       table: "auth",
       field: "enabled",
       value: '"0"',
-      read: (v: DbTomlValues) => v.baseline.authEnabled,
+      read: (v: DbConfigValues) => v.baseline.authEnabled,
       expected: false,
     },
     {
@@ -565,7 +572,7 @@ describe("readDbToml", () => {
       table: "api",
       field: "auto_expose_new_tables",
       value: '"TRUE"',
-      read: (v: DbTomlValues) => Option.getOrNull(v.baseline.apiAutoExposeNewTables),
+      read: (v: DbConfigValues) => Option.getOrNull(v.baseline.apiAutoExposeNewTables),
       expected: true,
     },
   ])("decodes $name as a bool", ({ table, field, value, read: pick, expected }) => {
@@ -584,25 +591,25 @@ describe("readDbToml", () => {
       name: "db.seed.enabled",
       table: "db.seed",
       field: "enabled",
-      read: (v: DbTomlValues) => v.seed.enabled,
+      read: (v: DbConfigValues) => v.seed.enabled,
     },
     {
       name: "db.migrations.enabled",
       table: "db.migrations",
       field: "enabled",
-      read: (v: DbTomlValues) => v.migrationsEnabled,
+      read: (v: DbConfigValues) => v.migrationsEnabled,
     },
     {
       name: "experimental.pgdelta.enabled",
       table: "experimental.pgdelta",
       field: "enabled",
-      read: (v: DbTomlValues) => v.pgDelta.enabled,
+      read: (v: DbConfigValues) => v.pgDelta.enabled,
     },
     {
       name: "api.auto_expose_new_tables",
       table: "api",
       field: "auto_expose_new_tables",
-      read: (v: DbTomlValues) => Option.getOrNull(v.baseline.apiAutoExposeNewTables),
+      read: (v: DbConfigValues) => Option.getOrNull(v.baseline.apiAutoExposeNewTables),
     },
   ])(
     "expands an env() reference in $name through the shell and project .env",
@@ -1789,7 +1796,7 @@ describe("readDbToml", () => {
           Effect.gen(function* () {
             const fs = yield* FileSystem.FileSystem;
             const path = yield* Path.Path;
-            return yield* readDbToml(fs, path, dir, undefined, { warnOnUnresolvedEnv: false });
+            return yield* readDbConfig(fs, path, dir, undefined, { warnOnUnresolvedEnv: false });
           }),
         ),
         Effect.provide(servicesLive),
@@ -2206,7 +2213,7 @@ describe("readDbToml", () => {
   );
 });
 
-describe("readDbToml [experimental.pgdelta]", () => {
+describe("readDbConfig [experimental.pgdelta]", () => {
   it.effect("defaults pg-delta to enabled with no config", () => {
     return withConfig(undefined).pipe(
       Effect.flatMap(read),
@@ -2293,7 +2300,7 @@ describe("resolveDeclarativeDir", () => {
   );
 });
 
-describe("readDbToml auth.Enabled validation", () => {
+describe("readDbConfig auth.Enabled validation", () => {
   // Fails the config load with `message` contained in the surfaced error.
   const failsWith = (
     lines: ReadonlyArray<string>,
@@ -2565,7 +2572,7 @@ describe("readDbToml auth.Enabled validation", () => {
   );
 });
 
-describe("readDbToml encrypted secret decryption", () => {
+describe("readDbConfig encrypted secret decryption", () => {
   // An undecryptable `encrypted:` value anywhere in config.toml aborts the load with
   // `failed to parse config: <error>`.
   const expectFails = (lines: ReadonlyArray<string>, message: string) =>
@@ -2647,7 +2654,7 @@ describe("readDbToml encrypted secret decryption", () => {
   );
 });
 
-describe("readDbToml non-scalar config booleans", () => {
+describe("readDbConfig non-scalar config booleans", () => {
   // A present non-scalar boolean must fail the config load rather than falling through to the
   // schema default, which would let `db reset` prompt and drop schemas.
   const failsInvalid = (lines: ReadonlyArray<string>, field: string) =>
@@ -2667,7 +2674,7 @@ describe("readDbToml non-scalar config booleans", () => {
   );
 });
 
-describe("readDbToml project env scoping", () => {
+describe("readDbConfig project env scoping", () => {
   const LINKED = "linkedlinkedlinkedlin";
   const OTHER = "otherotherotherother";
 
@@ -2721,7 +2728,7 @@ describe("readDbToml project env scoping", () => {
   });
 });
 
-describe("readDbToml empty project_id", () => {
+describe("readDbConfig empty project_id", () => {
   it.effect("rejects a present-but-empty top-level project_id", () => {
     return withConfig('project_id = ""\n').pipe(
       Effect.flatMap(read),
@@ -2751,7 +2758,7 @@ describe("readDbToml empty project_id", () => {
   });
 });
 
-describe("readDbToml [analytics] validation", () => {
+describe("readDbConfig [analytics] validation", () => {
   const failsWith = (lines: ReadonlyArray<string>, message: string) =>
     Effect.gen(function* () {
       const dir = yield* withConfig(lines.join("\n"));
@@ -2823,7 +2830,7 @@ describe("readDbToml [analytics] validation", () => {
   });
 });
 
-describe("readDbToml SUPABASE_PROJECT_ID override", () => {
+describe("readDbConfig SUPABASE_PROJECT_ID override", () => {
   it.effect("overrides the TOML project_id with SUPABASE_PROJECT_ID", () => {
     return withConfig(['project_id = "toml-project"', ""].join("\n")).pipe(
       Effect.flatMap(read),
@@ -2891,7 +2898,7 @@ describe("readDbToml SUPABASE_PROJECT_ID override", () => {
   });
 });
 
-describe("readDbToml OrioleDB telemetry", () => {
+describe("readDbConfig OrioleDB telemetry", () => {
   const recordedAfterRead = (workdir: string) =>
     Effect.gen(function* () {
       const recorded = yield* Ref.make<CommandTelemetryAttributeValues>({});
@@ -2921,7 +2928,7 @@ describe("readDbToml OrioleDB telemetry", () => {
   });
 });
 
-describe("readDbToml Data API exposure", () => {
+describe("readDbConfig Data API exposure", () => {
   it.effect.each([
     {
       name: "disabled in config",
diff --git a/apps/cli/src/command-internal/db-config.service.ts b/apps/cli/src/command-internal/db-config.service.ts
index d2d91992fc..0831ccd838 100644
--- a/apps/cli/src/command-internal/db-config.service.ts
+++ b/apps/cli/src/command-internal/db-config.service.ts
@@ -8,6 +8,7 @@ import type {
   ProjectRefNotLinkedError,
 } from "../config/project-ref.errors.ts";
 import type { ProfileLoadError } from "./profile-load.ts";
+import type { ApiMaxRetriesError } from "../config/command-settings.layer.ts";
 import type { LinkedProjectRefReadError } from "../shared/config/project-link.ts";
 import type { DbConnectError } from "./db-connection.errors.ts";
 import type { LocalDbRunningError } from "./db-bootstrap/local-db-running.ts";
@@ -18,6 +19,7 @@ import type {
   DbConfigListBansNetworkError,
   DbConfigListBansStatusError,
   DbConfigLoadError,
+  DbConfigLoginRoleMissingPrivilegedRoleError,
   DbConfigLoginRoleNetworkError,
   DbConfigLoginRoleStatusError,
   DbConfigParseUrlError,
@@ -47,6 +49,7 @@ export type DbConfigError =
   // A hard linked-ref load surfaces a real link-state read error instead of masking it
   // as not-linked.
   | LinkedProjectRefReadError
+  | DbConfigLoginRoleMissingPrivilegedRoleError
   | DbConfigLoginRoleNetworkError
   | DbConfigLoginRoleStatusError
   | DbConfigListBansNetworkError
@@ -68,8 +71,9 @@ export type DbConfigError =
   // the pooler-config fallback.
   | CommandPlatformApiFactoryError
   // The lazy linked runtime rebuilds `commandSettingsLayer`, whose strict
-  // profile resolution can fail inside the resolver effect the same way.
-  | ProfileLoadError;
+  // profile and `SUPABASE_API_MAX_RETRIES` checks can fail inside the resolver effect the same way.
+  | ProfileLoadError
+  | ApiMaxRetriesError;
 
 // The `--linked` path builds a lazy Management API runtime (so `--local`/`--db-url` never need an
 // access token) from the resolver's captured context, so `resolve`'s R stays `never` and the
diff --git a/apps/cli/src/command-internal/db-connection.errors.ts b/apps/cli/src/command-internal/db-connection.errors.ts
index fc4391d2ac..ca9b241fff 100644
--- a/apps/cli/src/command-internal/db-connection.errors.ts
+++ b/apps/cli/src/command-internal/db-connection.errors.ts
@@ -17,6 +17,16 @@ export class DbConnectError extends Data.TaggedError("DbConnectError")<{
    * fresh-db bootstrap's connect retry keys off this field.
    */
   readonly retryable?: boolean;
+  /**
+   * True when the server certificate failed verification; the temp-role probe keys off this
+   * field to fail fast, since no retry can change the certificate.
+   */
+  readonly certificateRejected?: boolean;
+  /**
+   * True when the pooler rejected the caller's IP for project network restrictions; the
+   * temp-role probe keys off this field to fail fast, since no retry can change the allow list.
+   */
+  readonly networkRestricted?: boolean;
   /**
    * True when the failure is an IPv6 dial failure that an IPv4 pooler retry can recover;
    * `gen types`' pooler fallback keys off this field.
diff --git a/apps/cli/src/command-internal/db-connection.pool-client.ts b/apps/cli/src/command-internal/db-connection.pool-client.ts
index 6cffda0e5b..8285e8a22a 100644
--- a/apps/cli/src/command-internal/db-connection.pool-client.ts
+++ b/apps/cli/src/command-internal/db-connection.pool-client.ts
@@ -30,6 +30,7 @@ export const makePoolSqlClient = (
 ): Effect.Effect<SqlClient.SqlClient, never, Reactivity.Reactivity> =>
   SqlClient.make({
     acquirer: Effect.succeed(new PoolConnection(pool)),
+    driver: "pg",
     compiler: PgClient.makeCompiler(),
     spanAttributes: [
       ["db.system.name", "postgresql"],
diff --git a/apps/cli/src/command-internal/db-connection.service.ts b/apps/cli/src/command-internal/db-connection.service.ts
index e743401536..64712d7ada 100644
--- a/apps/cli/src/command-internal/db-connection.service.ts
+++ b/apps/cli/src/command-internal/db-connection.service.ts
@@ -33,8 +33,8 @@ export interface PgConnInput {
   readonly runtimeParams?: Readonly<Record<string, string>>;
   /**
    * libpq `sslmode`, parsed from a `--db-url` query string. Controls whether the driver layer
-   * negotiates TLS and verifies the server certificate. Absent → TLS without certificate
-   * verification (libpq's `prefer`/`require` default).
+   * negotiates TLS and verifies the server certificate. Absent → TLS first, then plaintext if
+   * that fails (libpq's `prefer` default).
    */
   readonly sslmode?: string;
   /**
diff --git a/apps/cli/src/command-internal/db-connection.sql-pg.integration.test.ts b/apps/cli/src/command-internal/db-connection.sql-pg.integration.test.ts
index 4f4d5264cf..236f621087 100644
--- a/apps/cli/src/command-internal/db-connection.sql-pg.integration.test.ts
+++ b/apps/cli/src/command-internal/db-connection.sql-pg.integration.test.ts
@@ -5,10 +5,16 @@
  * structure, and the connect suggestion must classify real node-postgres error shapes.
  */
 import * as net from "node:net";
+import * as tls from "node:tls";
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Deferred, Duration, Effect, FileSystem, Layer, Path } from "effect";
 
+import {
+  KONG_LOCAL_TLS_CERT,
+  KONG_LOCAL_TLS_KEY,
+} from "../commands/start/templates/kong-local-tls.ts";
+import { mockOutput } from "../../tests/helpers/mocks.ts";
 import { SUGGEST_ENV_VAR, SUGGEST_LOCAL_STACK } from "./connect-errors.ts";
 import type { DbConnectError, DbExecError } from "./db-connection.errors.ts";
 import { type DbSession, type PgConnInput, DbConnection } from "./db-connection.service.ts";
@@ -146,16 +152,27 @@ const EMPTY_QUERY = wireMessage("I", Buffer.alloc(0));
  * A fake Postgres server that completes an auth-less startup handshake, answers every
  * simple-protocol query with `SELECT 1`'s result (satisfying `acquireProbedPool`'s own probe),
  * and records whether the client sent an SSLRequest first — so a test can prove whether TLS was
- * attempted independent of how the attempt is resolved.
+ * attempted independent of how the attempt is resolved. `sslReply` picks how an SSLRequest is
+ * answered: `N` (default, plaintext only), `S` then hang up (a failed handshake), an
+ * immediate hang-up (a failure that is not about TLS negotiation), or `S` with a real handshake
+ * followed by a 28000 rejection (`pg_hba` with only `hostnossl` entries), or `S` with a real
+ * handshake followed by a successful startup (a server that accepts TLS). `rejectPlaintext`
+ * answers a plaintext startup with 28000 too (`pg_hba` with no entry for the client at all).
  */
-const fakeStartupServer = (): Effect.Effect<{
+const fakeStartupServer = (
+  sslReply: "N" | "S-then-hangup" | "hangup" | "S-then-28000" | "S-then-ok" = "N",
+  { rejectPlaintext = false }: { readonly rejectPlaintext?: boolean } = {},
+): Effect.Effect<{
   readonly port: number;
   readonly close: () => void;
   readonly sawSslRequest: () => boolean;
+  readonly connectionCount: () => number;
 }> =>
   Effect.callback((resume) => {
     let sawSslRequest = false;
+    let connectionCount = 0;
     const server = net.createServer((socket) => {
+      connectionCount += 1;
       let sawStartup = false;
       let pending = Buffer.alloc(0);
       socket.on("data", (data: Buffer) => {
@@ -167,7 +184,52 @@ const fakeStartupServer = (): Effect.Effect<{
             if (pending.length < length) return;
             if (pending.readInt32BE(4) === 80877103) {
               sawSslRequest = true;
-              socket.write("N");
+              if (sslReply === "N") socket.write("N");
+              else if (sslReply === "S-then-hangup") socket.end("S");
+              else if (sslReply === "S-then-28000") {
+                socket.write("S");
+                const secure = new tls.TLSSocket(socket, {
+                  isServer: true,
+                  key: KONG_LOCAL_TLS_KEY,
+                  cert: KONG_LOCAL_TLS_CERT,
+                });
+                secure.once("data", () =>
+                  secure.end(
+                    errorResponse({
+                      S: "FATAL",
+                      V: "FATAL",
+                      C: "28000",
+                      M: 'no pg_hba.conf entry for host "127.0.0.1", user "postgres", database "postgres", SSL encryption',
+                    }),
+                  ),
+                );
+                secure.on("error", () => {});
+              } else if (sslReply === "S-then-ok") {
+                socket.write("S");
+                const secure = new tls.TLSSocket(socket, {
+                  isServer: true,
+                  key: KONG_LOCAL_TLS_KEY,
+                  cert: KONG_LOCAL_TLS_CERT,
+                });
+                secure.once("data", () => {
+                  secure.write(Buffer.concat([AUTHENTICATION_OK, READY_FOR_QUERY]));
+                  secure.on("data", () =>
+                    secure.write(Buffer.concat([commandComplete("SELECT 1"), READY_FOR_QUERY])),
+                  );
+                });
+                secure.on("error", () => {});
+              } else socket.destroy();
+              return;
+            } else if (rejectPlaintext) {
+              socket.end(
+                errorResponse({
+                  S: "FATAL",
+                  V: "FATAL",
+                  C: "28000",
+                  M: 'no pg_hba.conf entry for host "127.0.0.1", user "postgres", database "postgres", no encryption',
+                }),
+              );
+              return;
             } else {
               sawStartup = true;
               socket.write(Buffer.concat([AUTHENTICATION_OK, READY_FOR_QUERY]));
@@ -197,6 +259,7 @@ const fakeStartupServer = (): Effect.Effect<{
           port: address.port,
           close: () => server.close(),
           sawSslRequest: () => sawSslRequest,
+          connectionCount: () => connectionCount,
         }),
       );
     });
@@ -925,7 +988,7 @@ describe("a local target's explicit TLS request (CLI-2366: honor --db-url's own
 
   it.live(
     "stays plaintext for a local target with sslmode=prefer (CLI-2366 regression guard: " +
-      "libpq's TLS-then-plaintext fallback is not implemented by sslConfigsFor)",
+      "the loopback stack never gets a wasted TLS attempt)",
     () =>
       Effect.gen(function* () {
         const server = yield* fakeStartupServer();
@@ -1063,3 +1126,190 @@ describe("a local target's explicit TLS request (CLI-2366: honor --db-url's own
     }),
   );
 });
+
+describe("a non-local plaintext-only target follows libpq sslmode semantics", () => {
+  const TLS_FALLBACK_WARNING =
+    "Connected to 127.0.0.1 without TLS: the TLS connection failed or was rejected. Set PGSSLMODE=require (or verify-full) to refuse unencrypted connections.";
+
+  const connectAndQuery = (
+    server: { readonly port: number },
+    sslmode: string | undefined,
+    fallbacks?: PgConnInput["fallbacks"],
+  ) => {
+    const out = mockOutput();
+    return Effect.gen(function* () {
+      const pool = yield* acquirePgPool(
+        {
+          host: "127.0.0.1",
+          port: server.port,
+          user: "postgres",
+          password: "postgres",
+          database: "postgres",
+          ...(sslmode !== undefined ? { sslmode } : {}),
+          ...(fallbacks !== undefined ? { fallbacks } : {}),
+        },
+        { isLocal: false, dnsResolver: "native" },
+      );
+      yield* Effect.tryPromise(() => pool.query("select 1"));
+      return out.messages.filter((message) => message.type === "warn").map((m) => m.message);
+    }).pipe(Effect.scoped, Effect.provide(Layer.merge(BunServices.layer, out.layer)));
+  };
+
+  it.live("tries TLS, then connects in plaintext with a warning when sslmode is unset", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer();
+      const warnings = yield* connectAndQuery(server, undefined).pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.sawSslRequest()).toBe(true);
+      expect(warnings).toEqual([TLS_FALLBACK_WARNING]);
+    }),
+  );
+
+  it.live("connects over TLS without a warning when the server accepts TLS", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer("S-then-ok");
+      const warnings = yield* connectAndQuery(server, "prefer").pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.connectionCount()).toBe(1);
+      expect(warnings).toEqual([]);
+    }),
+  );
+
+  it.live("connects in plaintext without a warning when sslmode=allow", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer();
+      const warnings = yield* connectAndQuery(server, "allow").pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.sawSslRequest()).toBe(false);
+      expect(warnings).toEqual([]);
+    }),
+  );
+
+  it.live("tries TLS, then connects in plaintext when sslmode=prefer", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer();
+      const warnings = yield* connectAndQuery(server, "prefer").pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.sawSslRequest()).toBe(true);
+      expect(warnings).toEqual([TLS_FALLBACK_WARNING]);
+    }),
+  );
+
+  it.live("falls back to plaintext when the TLS handshake fails under sslmode=prefer", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer("S-then-hangup");
+      yield* connectAndQuery(server, "prefer").pipe(Effect.ensuring(Effect.sync(server.close)));
+      expect(server.sawSslRequest()).toBe(true);
+    }),
+  );
+
+  it.live("does not retry in plaintext when the TLS attempt fails for a non-TLS reason", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer("hangup");
+      const error = yield* connectFailure({ port: server.port, sslmode: "prefer" }, false).pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.connectionCount()).toBe(1);
+      expect(error.message).not.toContain("SSL");
+    }),
+  );
+
+  it.live("skips the plaintext retry on a target that failed for a non-TLS reason", () =>
+    Effect.gen(function* () {
+      const hangup = yield* fakeStartupServer("hangup");
+      const plaintextOnly = yield* fakeStartupServer();
+      yield* connectAndQuery(hangup, "prefer", [
+        { host: "127.0.0.1", port: plaintextOnly.port },
+      ]).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            hangup.close();
+            plaintextOnly.close();
+          }),
+        ),
+      );
+      expect(hangup.connectionCount()).toBe(1);
+      expect(plaintextOnly.sawSslRequest()).toBe(true);
+      expect(plaintextOnly.connectionCount()).toBe(2);
+    }),
+  );
+
+  it.live("retries in plaintext when pg_hba rejects the TLS attempt with 28000 under prefer", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer("S-then-28000");
+      const warnings = yield* connectAndQuery(server, "prefer").pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.sawSslRequest()).toBe(true);
+      expect(server.connectionCount()).toBe(2);
+      expect(warnings).toEqual([TLS_FALLBACK_WARNING]);
+    }),
+  );
+
+  it.live("stops at a target that rejects both the TLS and the plaintext attempt with 28000", () =>
+    Effect.gen(function* () {
+      const rejecting = yield* fakeStartupServer("S-then-28000", { rejectPlaintext: true });
+      const next = yield* fakeStartupServer();
+      const error = yield* connectFailure(
+        {
+          port: rejecting.port,
+          sslmode: "prefer",
+          fallbacks: [{ host: "127.0.0.1", port: next.port }],
+        },
+        false,
+      ).pipe(
+        Effect.ensuring(
+          Effect.sync(() => {
+            rejecting.close();
+            next.close();
+          }),
+        ),
+      );
+      expect(rejecting.connectionCount()).toBe(2);
+      expect(next.connectionCount()).toBe(0);
+      expect(error.message).toContain("SQLSTATE 28000");
+      expect(error.message).toContain("SSL encryption");
+      expect(error.message).toContain("no encryption");
+    }),
+  );
+
+  it.live("does not retry a 28000 rejection in plaintext when sslmode=require", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer("S-then-28000");
+      const error = yield* connectFailure({ port: server.port, sslmode: "require" }, false).pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.connectionCount()).toBe(1);
+      expect(error.message).toContain("SQLSTATE 28000");
+    }),
+  );
+
+  it.live("fails with the plaintext hint when sslmode=require", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer();
+      const error = yield* connectFailure({ port: server.port, sslmode: "require" }, false).pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.connectionCount()).toBe(1);
+      expect(error.message).toContain("tls error (The server does not support SSL connections)");
+      expect(error.suggestion).toBe(
+        "This server does not accept TLS. Set `sslmode=disable` on the connection string to connect in plaintext.",
+      );
+    }),
+  );
+
+  it.live("connects in plaintext without an SSLRequest when sslmode=disable", () =>
+    Effect.gen(function* () {
+      const server = yield* fakeStartupServer();
+      const warnings = yield* connectAndQuery(server, "disable").pipe(
+        Effect.ensuring(Effect.sync(server.close)),
+      );
+      expect(server.sawSslRequest()).toBe(false);
+      expect(warnings).toEqual([]);
+    }),
+  );
+});
diff --git a/apps/cli/src/command-internal/db-connection.sql-pg.layer.ts b/apps/cli/src/command-internal/db-connection.sql-pg.layer.ts
index 7f761f07c5..07664e9461 100644
--- a/apps/cli/src/command-internal/db-connection.sql-pg.layer.ts
+++ b/apps/cli/src/command-internal/db-connection.sql-pg.layer.ts
@@ -1,6 +1,6 @@
 import * as net from "node:net";
 import type { ConnectionOptions } from "node:tls";
-import { Cause, Duration, Effect, Exit, FileSystem, Layer, Scope } from "effect";
+import { Cause, Duration, Effect, Exit, FileSystem, Layer, Option, Scope } from "effect";
 import * as Reactivity from "effect/reactivity/Reactivity";
 import { ConnectionError, SqlError } from "effect/sql/SqlError";
 // `pg` drives the pool behind `makePoolSqlClient` and the raw COPY and extended-protocol batch
@@ -10,9 +10,12 @@ import { to as pgCopyTo } from "pg-copy-streams";
 import {
   connectFailureMessage,
   connectSuggestion,
+  isCertificateVerificationFailure,
+  isNetworkRestrictionFailure,
   isDialFailure,
   isIPv6ConnectivityErrorCause,
   isSqlState,
+  isTlsNegotiationFailure,
   localStackSuggestion,
 } from "./connect-errors.ts";
 import { DbConnectError, DbCopyError, DbExecError } from "./db-connection.errors.ts";
@@ -25,6 +28,7 @@ import {
   type DbSession,
   type PgConnInput,
 } from "./db-connection.service.ts";
+import { Output } from "../shared/output/output.service.ts";
 import { resolveHostsOverHttps } from "./db-dns.ts";
 
 // `@types/pg` doesn't declare `queryMode` on `QueryConfig`, `verify` on `PoolConfig` (run for
@@ -86,7 +90,7 @@ function needsRoleStepDown(user: string): boolean {
 
 // These SQLSTATEs terminate the multi-host fallback chain instead of trying the next host,
 // since they indicate the server rejected the attempt rather than being unreachable; `28000`
-// only terminates when the failed attempt used TLS.
+// only terminates once the target has been tried over TLS.
 const TERMINAL_SQLSTATES = new Set(["28P01", "3D000", "42501"]);
 const TLS_GATED_SQLSTATE = "28000";
 
@@ -97,13 +101,16 @@ const TLS_GATED_SQLSTATE = "28000";
  * Postgres SQLSTATE as a `code` property on the server error, carried through `@effect/sql`'s
  * `SqlError.cause`, so this walks the `cause` chain looking for one.
  */
-export function isTerminalConnectError(error: unknown, usedTls: boolean): boolean {
+export function isTerminalConnectError(error: unknown, triedTls: boolean): boolean {
   const code = extractSqlState(error);
   if (code === undefined) return false;
   if (TERMINAL_SQLSTATES.has(code)) return true;
-  return code === TLS_GATED_SQLSTATE && usedTls;
+  return code === TLS_GATED_SQLSTATE && triedTls;
 }
 
+const permitsPlaintextDowngrade = (error: unknown): boolean =>
+  isTlsNegotiationFailure(error) || extractSqlState(error) === TLS_GATED_SQLSTATE;
+
 /**
  * Extracts the Postgres SQLSTATE from a driver error. The `pg` driver attaches the
  * code as a `code` property on the server error, carried through `@effect/sql`'s
@@ -396,9 +403,9 @@ export interface ClientCert {
 }
 
 /**
- * `sslmode` values that demand TLS. `prefer` and `allow` describe a fallback libpq would perform
- * and {@link sslConfigsFor} does not, so neither counts as a demand; treating them as one would
- * turn a plaintext-capable target into a handshake failure.
+ * `sslmode` values that demand TLS. `prefer` and `allow` fall back across plaintext and TLS in
+ * {@link sslConfigsFor}, so neither counts as a demand; treating them as one would turn a
+ * plaintext-capable target into a handshake failure.
  */
 const TLS_DEMANDING_SSLMODES = new Set(["require", "verify-ca", "verify-full"]);
 
@@ -459,11 +466,12 @@ export function sslOptionFor(
 }
 
 /**
- * The ordered list of `ssl` configs to try for a connection: `disable` → plaintext only;
- * `allow` → plaintext then TLS; `prefer`/unset/`require`/`verify-ca`/`verify-full` → TLS only,
- * so a failed handshake on the default `prefer` mode fails loudly rather than silently
- * downgrading to plaintext. `servername` targets the original hostname per dial host when a
- * DoH-resolved IP was substituted; `caCert` promotes `require` to `verify-ca` when set.
+ * The ordered list of `ssl` configs to try for a connection, following libpq: `disable` →
+ * plaintext only; `allow` → plaintext then TLS; `prefer`/unset → TLS then plaintext (the
+ * plaintext retry runs only after a TLS negotiation failure or a `28000` rejection, see
+ * {@link permitsPlaintextDowngrade}); `require`/`verify-ca`/`verify-full` → TLS only.
+ * `servername` targets the original hostname per dial host when a DoH-resolved IP was
+ * substituted; `caCert` promotes `require` to `verify-ca` when set.
  * `isLocal` is the caller's TLS-exemption decision, not the raw target classification: a local
  * target that explicitly set `sslmode`/`sslrootcert` (see {@link tlsExplicitlyRequested}) is not
  * exempt, so the caller passes `false` for it in that case. `allow`'s fallback bypasses that
@@ -495,11 +503,12 @@ export function sslConfigsFor(
   ) {
     return [sslOptionFor(effectiveMode, false, servername, caCert, clientCert)];
   }
-  // prefer (and the unset default) is TLS-only: a failed handshake must error, never downgrade
-  // to plaintext.
-  return [sslOptionFor(sslmode, false, servername, caCert, clientCert)];
+  return [sslOptionFor(sslmode, false, servername, caCert, clientCert), false];
 }
 
+const isTlsConfig = (ssl: boolean | ConnectionOptions | undefined): boolean =>
+  ssl !== undefined && ssl !== false;
+
 /**
  * The raw `pg.ClientConfig` for a dial target: the connection-string form when a libpq
  * `options`/`runtimeParams` payload must reach the server (see {@link buildConnectionUrl}),
@@ -641,15 +650,20 @@ export const toConnectError = (
   cfg: PgConnInput,
   isLocal: boolean,
   error: unknown,
+  tlsError?: unknown,
 ): DbConnectError => {
   const suggestion =
     cfg.suggestionContext === undefined
       ? undefined
       : connectSuggestion(error, { ...cfg.suggestionContext, isLocal });
   return new DbConnectError({
-    message: `failed to connect to postgres: ${connectFailureMessage(cfg, error)}`,
+    message: `failed to connect to postgres: ${
+      tlsError === undefined ? "" : `${connectFailureMessage(cfg, tlsError)}; then without TLS: `
+    }${connectFailureMessage(cfg, error)}`,
     ...(suggestion === undefined ? {} : { suggestion }),
     ...(isDialFailure(error) ? { retryable: true } : {}),
+    ...(isCertificateVerificationFailure(error) ? { certificateRejected: true } : {}),
+    ...(isNetworkRestrictionFailure(error) ? { networkRestricted: true } : {}),
     ...(isIPv6ConnectivityErrorCause(error) ? { ipv6Unreachable: true } : {}),
   });
 };
@@ -776,9 +790,10 @@ const acquirePgPoolConnection = (cfg: PgConnInput, { isLocal, dnsResolver }: DbC
           }
         : undefined;
 
-    // Builds the ordered attempt list: each TLS config from {@link sslConfigsFor} tried against
+    // Builds the ordered attempt list: each `ssl` config from {@link sslConfigsFor} tried against
     // each dial target (host × resolved IPs), with `servername` per target set to the original
-    // hostname when dialing a DoH-resolved IP.
+    // hostname when dialing a DoH-resolved IP. `isTlsDowngrade` marks the plaintext retry that
+    // follows a TLS attempt on the same target.
     const attempts = dialTargets.flatMap(({ dialHost, port, servername }) =>
       sslConfigsFor(
         cfg.sslmode,
@@ -787,11 +802,14 @@ const acquirePgPoolConnection = (cfg: PgConnInput, { isLocal, dnsResolver }: DbC
         caCert,
         dialHost,
         clientCert,
-      ).map((ssl) => ({
+      ).map((ssl, index, configs) => ({
+        host: servername ?? dialHost,
         pool: makePool(dialHost, port, ssl),
-        // The fallback chain only short-circuits on an auth error when the failed attempt used
-        // TLS; a TLS config is any non-plaintext `ssl` value.
-        usedTls: ssl !== undefined && ssl !== false,
+        // A 28000 rejection is final once the target has been tried over TLS: `allow` still
+        // follows a plaintext rejection with its TLS attempt, while a `prefer` plaintext retry
+        // that is rejected too ends the chain instead of moving on to the next host.
+        triedTls: configs.slice(0, index + 1).some(isTlsConfig),
+        isTlsDowngrade: index > 0 && !isTlsConfig(ssl) && isTlsConfig(configs[index - 1]),
         rawConfig: buildRawPgConfig(cfg, dialHost, port, ssl, connectTimeoutSeconds),
       })),
     );
@@ -812,7 +830,7 @@ const acquirePgPoolConnection = (cfg: PgConnInput, { isLocal, dnsResolver }: DbC
         const sessionScope = yield* Scope.Scope;
         const attemptScope = yield* Scope.fork(sessionScope);
         return yield* attempt.pool.pipe(
-          Effect.map((pool) => ({ pool, rawConfig: attempt.rawConfig })),
+          Effect.map((pool) => ({ pool, attempt })),
           Scope.provide(attemptScope),
           Effect.onExit((exit) =>
             Exit.isSuccess(exit) ? Effect.void : Scope.close(attemptScope, exit),
@@ -820,18 +838,55 @@ const acquirePgPoolConnection = (cfg: PgConnInput, { isLocal, dnsResolver }: DbC
         );
       });
     const lastIndex = attempts.length - 1;
-    const { pool, rawConfig: winningRawConfig } = yield* attempts
-      .slice(0, lastIndex)
-      .reduceRight(
-        (next, attempt) =>
-          probe(attempt).pipe(
-            Effect.catch((error) =>
-              isTerminalConnectError(error, attempt.usedTls) ? Effect.fail(error) : next,
-            ),
-          ),
-        probe(attempts[lastIndex]!),
-      )
-      .pipe(Effect.mapError((error) => toConnectError(cfg, isLocal, error)));
+    // A failed attempt falls through to the next one unless its error is terminal. The plaintext
+    // retry after a TLS attempt (libpq's `prefer`) runs only when the server could not do TLS:
+    // negotiation failed or `pg_hba` has no TLS entry for the client (28000). Otherwise it is
+    // skipped, so an unreachable host or a wrong password is not retried in plaintext.
+    const run = (
+      index: number,
+    ): Effect.Effect<
+      Effect.Success<ReturnType<typeof probe>>,
+      {
+        readonly error: Effect.Error<ReturnType<typeof probe>>;
+        readonly index: number;
+        readonly tlsError?: unknown;
+      },
+      Effect.Services<ReturnType<typeof probe>>
+    > =>
+      probe(attempts[index]!).pipe(
+        Effect.catch((error) => {
+          if (index === lastIndex) return Effect.fail({ error, index });
+          const next = attempts[index + 1]!;
+          if (next.isTlsDowngrade && permitsPlaintextDowngrade(error)) {
+            return run(index + 1).pipe(
+              Effect.mapError((failure) =>
+                failure.index === index + 1 && extractSqlState(error) === TLS_GATED_SQLSTATE
+                  ? { ...failure, tlsError: error }
+                  : failure,
+              ),
+            );
+          }
+          if (isTerminalConnectError(error, attempts[index]!.triedTls)) {
+            return Effect.fail({ error, index });
+          }
+          const nextIndex = next.isTlsDowngrade ? index + 2 : index + 1;
+          return nextIndex > lastIndex ? Effect.fail({ error, index }) : run(nextIndex);
+        }),
+      );
+    const { pool, attempt: winner } = yield* run(0).pipe(
+      Effect.mapError(({ error, tlsError }) => toConnectError(cfg, isLocal, error, tlsError)),
+    );
+    const winningRawConfig = winner.rawConfig;
+    // libpq downgrades silently. Surfacing it tells a user who expected TLS (every hosted project
+    // offers it) that this connection is unencrypted, so a refused TLS attempt does not go unseen.
+    if (winner.isTlsDowngrade) {
+      const output = yield* Effect.serviceOption(Output);
+      if (Option.isSome(output)) {
+        yield* output.value.warn(
+          `Connected to ${winner.host} without TLS: the TLS connection failed or was rejected. Set PGSSLMODE=require (or verify-full) to refuse unencrypted connections.`,
+        );
+      }
+    }
 
     // Steps down from the temp/privileged login role before any further SQL, remote
     // connections only; a local `--db-url` using `supabase_admin`/`cli_login_*` must not run it.
diff --git a/apps/cli/src/command-internal/db-connection.sql-pg.unit.test.ts b/apps/cli/src/command-internal/db-connection.sql-pg.unit.test.ts
index 500139e65e..e07fb25f94 100644
--- a/apps/cli/src/command-internal/db-connection.sql-pg.unit.test.ts
+++ b/apps/cli/src/command-internal/db-connection.sql-pg.unit.test.ts
@@ -226,9 +226,15 @@ describe("sslConfigsFor (fallback list)", () => {
     expect(sslConfigsFor("allow", true, undefined)).toEqual([false, { rejectUnauthorized: false }]);
   });
 
-  it("prefer and unset are TLS only (ConnectByUrl strips the plaintext fallback)", () => {
-    expect(sslConfigsFor("prefer", false, undefined)).toEqual([{ rejectUnauthorized: false }]);
-    expect(sslConfigsFor(undefined, false, undefined)).toEqual([{ rejectUnauthorized: false }]);
+  it("prefer and unset try TLS first, then plaintext (libpq)", () => {
+    expect(sslConfigsFor("prefer", false, undefined)).toEqual([
+      { rejectUnauthorized: false },
+      false,
+    ]);
+    expect(sslConfigsFor(undefined, false, undefined)).toEqual([
+      { rejectUnauthorized: false },
+      false,
+    ]);
   });
 
   it("require / verify-* are TLS only (no fallback)", () => {
@@ -254,7 +260,10 @@ describe("sslConfigsFor (fallback list)", () => {
 
   it("does not attach a CA to non-verifying modes", () => {
     const ca = "ca-bundle";
-    expect(sslConfigsFor("prefer", false, undefined, ca)).toEqual([{ rejectUnauthorized: false }]);
+    expect(sslConfigsFor("prefer", false, undefined, ca)).toEqual([
+      { rejectUnauthorized: false },
+      false,
+    ]);
   });
 
   it("forces a single plaintext attempt for a unix-socket host regardless of sslmode", () => {
@@ -556,7 +565,7 @@ describe("isTerminalConnectError (fallback termination)", () => {
     expect(isTerminalConnectError({ code: "42501" }, false)).toBe(true);
   });
 
-  it("gates 28000 on the attempt having used TLS (a TLS attempt is required)", () => {
+  it("gates 28000 on the target having been tried over TLS", () => {
     expect(isTerminalConnectError({ code: "28000" }, true)).toBe(true);
     expect(isTerminalConnectError({ code: "28000" }, false)).toBe(false);
   });
diff --git a/apps/cli/src/command-internal/db-password-rejection.integration.test.ts b/apps/cli/src/command-internal/db-password-rejection.integration.test.ts
index dc052493e1..9d65c83070 100644
--- a/apps/cli/src/command-internal/db-password-rejection.integration.test.ts
+++ b/apps/cli/src/command-internal/db-password-rejection.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Layer, Path } from "effect";
 import { CliOutput, Command } from "effect/cli";
@@ -99,7 +99,8 @@ const runCommand = (
           Layer.succeed(CliArgs, { args }),
           mockOutput({ format: "text" }).layer,
           BunServices.layer,
-          legacyProjectStateLayer.pipe(Layer.provide(BunServices.layer)),
+          BunCrypto.layer,
+          legacyProjectStateLayer.pipe(Layer.provide([BunServices.layer, BunCrypto.layer])),
           mockRuntimeInfo(),
           mockAnalytics().layer,
           mockTelemetryRuntime(),
@@ -111,7 +112,7 @@ const runCommand = (
       Effect.exit,
     );
     return Exit.isFailure(exit) ? Cause.squash(exit.cause) : undefined;
-  }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+  }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 describe("--password with a direct database target", () => {
   it("is discovered on commands that accept a direct target", () => {
diff --git a/apps/cli/src/command-internal/db-pull-run.ts b/apps/cli/src/command-internal/db-pull-run.ts
index 09ed990e67..3082c1f9fa 100644
--- a/apps/cli/src/command-internal/db-pull-run.ts
+++ b/apps/cli/src/command-internal/db-pull-run.ts
@@ -19,7 +19,7 @@ import type { ResolvedTarget } from "./target/resolve-target.ts";
 import { flagsForTarget } from "./target/target-flags.ts";
 import { resolveDbImage } from "./db-image.ts";
 import { DbConnection, type PgConnInput } from "./db-connection.service.ts";
-import { loadProjectEnvValues, readDbToml, resolveDeclarativeDir } from "./db-config.toml-read.ts";
+import { loadProjectEnvValues, readDbConfig, resolveDeclarativeDir } from "./db-config.read.ts";
 import { makeDir } from "./make-dir.ts";
 import { toPostgresURL } from "./postgres-url.ts";
 import { buildLocalDbContainerInputs } from "./db-bootstrap/local-container-inputs.ts";
@@ -156,7 +156,7 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
 
     // Read the config for the matching `[remotes.<ref>]` block before connecting, so a
     // connection failure still reports which override matched.
-    const toml = yield* readDbToml(fs, path, cliSettings.workdir, linkedRef);
+    const toml = yield* readDbConfig(fs, path, cliSettings.workdir, linkedRef);
     if (toml.appliedRemote !== undefined) {
       yield* output.raw(`Loading config override: [remotes.${toml.appliedRemote}]\n`, "stderr");
     }
@@ -314,7 +314,7 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
 
         // pg-delta ignores schema_paths in favor of the migrations baseline.
         if (usePgDeltaDiff && toml.schemaPaths !== undefined && toml.schemaPaths.length > 0) {
-          yield* output.raw(schemaPathsTransitionWarning, "stderr");
+          yield* output.raw(schemaPathsTransitionWarning(toml.configFile), "stderr");
         }
 
         // Migration-file path.
@@ -492,7 +492,7 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
               targetLocal: resolved.isLocal,
               migrationMode,
               // `toml.schemaPathPatterns` is used here, not the raw `@supabase/config` field on
-              // `localInputs`, since only `toml` (via `readDbToml`) resolves the
+              // `localInputs`, since only `toml` (via `readDbConfig`) resolves the
               // `SUPABASE_DB_MIGRATIONS_SCHEMA_PATHS` env override.
               schemaPaths: toml.schemaPathPatterns,
               pgDelta: toml.pgDelta,
diff --git a/apps/cli/src/command-internal/db-push-core.ts b/apps/cli/src/command-internal/db-push-core.ts
index b42c8104fe..f72919df75 100644
--- a/apps/cli/src/command-internal/db-push-core.ts
+++ b/apps/cli/src/command-internal/db-push-core.ts
@@ -18,7 +18,8 @@ import {
   DbPushRolesError,
 } from "../commands/db/push/push.errors.ts";
 import { aqua, bold } from "./colors.ts";
-import type { DbTomlValues } from "./db-config.toml-read.ts";
+import { configFileName } from "./config-advice.ts";
+import type { DbConfigValues } from "./db-config.read.ts";
 import { DbConnection, type PgConnInput } from "./db-connection.service.ts";
 import { applyMigrations, seedGlobals } from "./migration-apply.ts";
 import { listRemoteMigrations, suggestRevertHistory } from "./migration-history.ts";
@@ -75,8 +76,8 @@ export interface DbPushCoreInput {
   readonly seed: DbSeedPlan;
   readonly includeVault: boolean;
   readonly dnsResolver: "native" | "https";
-  /** Already loaded + validated `config.toml`, e.g. via `checkDbToml`. */
-  readonly toml: DbTomlValues;
+  /** Already loaded + validated `config.toml`, e.g. via `checkDbConfig`. */
+  readonly toml: DbConfigValues;
   /** Consent the caller already obtained; `None` asks once after the plan (never for local). */
   readonly preapproved: Option.Option<HostedMutationConsent>;
   /**
@@ -127,7 +128,7 @@ export const dbPushCore = Effect.fn("DbPush.run")(function* (input: DbPushCoreIn
       let pending: ReadonlyArray<string> = [];
       if (!toml.migrationsEnabled) {
         yield* output.raw(
-          `Skipping migrations because it is disabled in config.toml for project: ${projectRef}\n`,
+          `Skipping migrations because it is disabled in ${configFileName(toml.configFile.path)} for project: ${projectRef}\n`,
           "stderr",
         );
       } else {
@@ -160,7 +161,7 @@ export const dbPushCore = Effect.fn("DbPush.run")(function* (input: DbPushCoreIn
       if (includeSeed) {
         if (!seed.input.enabled) {
           yield* output.raw(
-            `Skipping seed because it is disabled in config.toml for project: ${projectRef}\n`,
+            `Skipping seed because it is disabled in ${configFileName(toml.configFile.path)} for project: ${projectRef}\n`,
             "stderr",
           );
         } else {
@@ -234,7 +235,7 @@ export const dbPushCore = Effect.fn("DbPush.run")(function* (input: DbPushCoreIn
                   ? [
                       `Apply these migrations:\n${confirmPushAll(pending.map((p) => path.basename(p))).trimEnd()}`,
                       ...(includeVault && vaultSecrets.some((secret) => secret.resolved)
-                        ? ["Update vault secrets from config.toml"]
+                        ? [`Update vault secrets from ${configFileName(toml.configFile.path)}`]
                         : []),
                     ]
                   : []),
diff --git a/apps/cli/src/command-internal/diff-engine.ts b/apps/cli/src/command-internal/diff-engine.ts
index b6ff5b8430..3822eacc0c 100644
--- a/apps/cli/src/command-internal/diff-engine.ts
+++ b/apps/cli/src/command-internal/diff-engine.ts
@@ -1,8 +1,17 @@
 // Pure diff-engine resolution shared by `db diff` and `db pull`. No Effect / service
 // dependencies — unit-tested directly.
 
-export const schemaPathsTransitionWarning =
-  "WARNING: [db.migrations].schema_paths no longer changes the migrations baseline used by db diff or migration-style db pull. These commands always compare local migrations with the selected database. `supabase db schema declarative sync` reads declarative_schema_path (default supabase/schemas), not schema_paths: move those files there or point declarative_schema_path at them. Only migra (--use-migra, --diff-engine migra, or [experimental.pgdelta] enabled = false) still reads schema_paths, and only for local targets.\n";
+import {
+  type ConfigFileRef,
+  configKey,
+  configSetting,
+  DEFAULT_CONFIG_FILE,
+} from "./config-advice.ts";
+
+export const schemaPathsTransitionWarning = (
+  configFile: ConfigFileRef = DEFAULT_CONFIG_FILE,
+): string =>
+  `WARNING: ${configKey(configFile.format, "db.migrations", "schema_paths")} no longer changes the migrations baseline used by db diff or migration-style db pull. These commands always compare local migrations with the selected database. \`supabase db schema declarative sync\` reads declarative_schema_path (default supabase/schemas), not schema_paths: move those files there or point declarative_schema_path at them. Only migra (--use-migra, --diff-engine migra, or ${configSetting(configFile.format, "experimental.pgdelta", "enabled", "false")}) still reads schema_paths, and only for local targets.\n`;
 
 /**
  * Reports whether `db diff` should run in pg-delta mode. A true `--use-migra` or `--use-pgadmin`
diff --git a/apps/cli/src/command-internal/docker-image-resolve.unit.test.ts b/apps/cli/src/command-internal/docker-image-resolve.unit.test.ts
index 3615514ab6..a2bd44af0f 100644
--- a/apps/cli/src/command-internal/docker-image-resolve.unit.test.ts
+++ b/apps/cli/src/command-internal/docker-image-resolve.unit.test.ts
@@ -26,7 +26,7 @@ function mockSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
 
       if (args[0] === "image" && args[1] === "inspect") {
         if (command._tag === "StandardCommand") imageInspectOptions.push(command.options);
diff --git a/apps/cli/src/command-internal/docker-lifecycle.unit.test.ts b/apps/cli/src/command-internal/docker-lifecycle.unit.test.ts
index f6491f3792..85c977a6de 100644
--- a/apps/cli/src/command-internal/docker-lifecycle.unit.test.ts
+++ b/apps/cli/src/command-internal/docker-lifecycle.unit.test.ts
@@ -33,7 +33,7 @@ function mockSpawner(
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
       const cmd = command._tag === "StandardCommand" ? command.command : "";
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push({ command: cmd, args });
 
       const exitDeferred = yield* Deferred.make<ChildProcessSpawner.ExitCode>();
@@ -343,6 +343,22 @@ describe("inspectContainerState", () => {
     );
   });
 
+  it.live.each([
+    "failed to connect to the docker API at unix:///var/run/docker.sock; check if the path is correct and if the daemon is running: dial unix /var/run/docker.sock: connect: no such file or directory",
+    "error during connect: Get http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/supabase_db_my-app/json: open //./pipe/docker_engine: The system cannot find the file specified.",
+    "Is the docker daemon running?",
+    "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.51/containers/supabase_db_my-app/json: dial unix /var/run/docker.sock: connect: permission denied",
+  ])("flags the daemon as down for the newer Docker message: %s", (stderr) => {
+    const mock = mockSpawner({ exitCode: 1, stderr: `${stderr}\n` });
+    return inspectContainerState(mock.spawner, "supabase_db_my-app").pipe(
+      Effect.flip,
+      Effect.map((error) => {
+        expect(error.daemonDown).toBe(true);
+        expect(classifyCliErrorActionability(error).error_category).toBe("docker_not_running");
+      }),
+    );
+  });
+
   it.live(
     "fails with DockerLifecycleInspectError with a generic message when stderr is empty",
     () => {
diff --git a/apps/cli/src/command-internal/docker-suggest.ts b/apps/cli/src/command-internal/docker-suggest.ts
index 0054fb9d16..483ae36735 100644
--- a/apps/cli/src/command-internal/docker-suggest.ts
+++ b/apps/cli/src/command-internal/docker-suggest.ts
@@ -12,17 +12,20 @@ export const SUGGEST_DOCKER_START =
 export const SUGGEST_CONTAINER_MEMORY_LIMIT =
   "The container ran out of memory and was killed. Raise the memory allocated to your container runtime (Docker Desktop: Settings > Resources), or free up memory on the host, and try again.";
 
+/** Docker CLI wordings for a daemon that cannot be reached, shared by every daemon-down matcher. */
+export const DOCKER_DAEMON_CONNECTION_FAILURE_PATTERN =
+  /failed to connect to the docker api|error during connect|is the docker daemon running|permission denied while trying to connect/iu;
+
 /**
  * Whether a container-CLI stderr indicates the daemon is unreachable. Matches the docker/podman
- * "cannot connect"/"is the docker daemon running" messages, a socket permission-denied message,
- * the generic "error during connect" wrapper (which also covers Windows npipe daemon-down text),
- * and {@link containerRuntimeNotFoundMessage} — a missing CLI binary gets the same install hint
+ * "cannot connect" messages, {@link DOCKER_DAEMON_CONNECTION_FAILURE_PATTERN}, and
+ * {@link containerRuntimeNotFoundMessage} — a missing CLI binary gets the same install hint
  * as a missing daemon.
  */
 export function isDockerDaemonUnreachable(stderr: string): boolean {
   return (
-    /cannot connect to the docker daemon|cannot connect to podman|is the docker daemon running|permission denied while trying to connect|error during connect/iu.test(
-      stderr,
-    ) || stderr.includes(containerRuntimeNotFoundMessage)
+    /cannot connect to the docker daemon|cannot connect to podman/iu.test(stderr) ||
+    DOCKER_DAEMON_CONNECTION_FAILURE_PATTERN.test(stderr) ||
+    stderr.includes(containerRuntimeNotFoundMessage)
   );
 }
diff --git a/apps/cli/src/command-internal/docker-suggest.unit.test.ts b/apps/cli/src/command-internal/docker-suggest.unit.test.ts
index 52791dcf4d..df045863d3 100644
--- a/apps/cli/src/command-internal/docker-suggest.unit.test.ts
+++ b/apps/cli/src/command-internal/docker-suggest.unit.test.ts
@@ -28,6 +28,11 @@ describe("isDockerDaemonUnreachable", () => {
         "error during connect: in the default daemon configuration on Windows, the docker client must be run with elevated privileges to connect: open //./pipe/docker_engine: Access is denied.",
       ),
     ).toBe(true);
+    expect(
+      isDockerDaemonUnreachable(
+        "failed to connect to the docker API at unix:///var/run/docker.sock; check if the path is correct and if the daemon is running: dial unix /var/run/docker.sock: connect: no such file or directory",
+      ),
+    ).toBe(true);
   });
 
   it("does not flag an unrelated inspect failure", () => {
diff --git a/apps/cli/src/command-internal/edge-runtime-script.layer.integration.test.ts b/apps/cli/src/command-internal/edge-runtime-script.layer.integration.test.ts
index 535e628a85..322ed5c109 100644
--- a/apps/cli/src/command-internal/edge-runtime-script.layer.integration.test.ts
+++ b/apps/cli/src/command-internal/edge-runtime-script.layer.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Exit, FileSystem, Layer, Option, Path } from "effect";
 import { vi } from "vitest";
 
@@ -58,6 +58,7 @@ function makeCliSettings(workdir = "/nonexistent-workdir") {
     workdir,
     explicitWorkdir: false,
     userAgent: "test",
+    apiMaxRetries: Option.none(),
   });
 }
 
@@ -224,7 +225,7 @@ describe("edgeRuntimeScriptLayer sentinel handling", () => {
         yield* runScript().pipe(Effect.provide(Layer.merge(layer, projectStateModeLayer("stack"))));
 
         expect(docker.lastOpts?.image).toContain("edge-runtime:v1.99.0");
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -271,7 +272,7 @@ describe("edgeRuntimeScriptLayer sentinel handling", () => {
         expect(docker.lastOpts?.image).toBe(lockedImage);
       }).pipe(
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
         Effect.ensuring(Effect.sync(() => vi.unstubAllEnvs())),
       ),
   );
diff --git a/apps/cli/src/command-internal/edge-runtime-script.layer.ts b/apps/cli/src/command-internal/edge-runtime-script.layer.ts
index 9762108961..5986d723a5 100644
--- a/apps/cli/src/command-internal/edge-runtime-script.layer.ts
+++ b/apps/cli/src/command-internal/edge-runtime-script.layer.ts
@@ -5,7 +5,7 @@ import { DebugFlag, NetworkIdFlag } from "./global-flags.ts";
 import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
 import { CommandSettings } from "../config/command-settings.service.ts";
 import { CliConfigValues } from "../config/cli-config-values.service.ts";
-import { readDbToml } from "./db-config.toml-read.ts";
+import { readDbConfig } from "./db-config.read.ts";
 import { getRegistryImageUrl } from "./docker-registry.ts";
 import { DockerRun } from "./docker-run.service.ts";
 import { resolveEdgeRuntimeImage, resolveLockedEdgeRuntimeImage } from "./edge-runtime-image.ts";
@@ -81,7 +81,7 @@ export const edgeRuntimeScriptLayer = Layer.effect(
           const workdir = opts.workdir ?? cliSettings.workdir;
           const denoVersion =
             opts.denoVersion ??
-            (yield* readDbToml(fs, path, workdir).pipe(
+            (yield* readDbConfig(fs, path, workdir).pipe(
               Effect.provideService(CliConfigValues, configValues),
               Effect.mapError((error) => new EdgeRuntimeScriptError({ message: error.message })),
             )).denoVersion;
diff --git a/apps/cli/src/command-internal/functions-local-config.ts b/apps/cli/src/command-internal/functions-local-config.ts
index 8ded3eed41..cf4f29dae6 100644
--- a/apps/cli/src/command-internal/functions-local-config.ts
+++ b/apps/cli/src/command-internal/functions-local-config.ts
@@ -26,6 +26,7 @@ export const functionsLocalConfigLoader: FunctionsLocalConfigLoader = {
         context.hostname,
         projectRoot,
         context.resolvedConfig.loaded.document,
+        context.resolvedConfig.hasConfigFile ? context.resolvedConfig.loaded.path : undefined,
       ).pipe(Effect.mapError(toError));
       return {
         loaded: { config: context.config, document: context.resolvedConfig.loaded.document },
diff --git a/apps/cli/src/command-internal/git-status.unit.test.ts b/apps/cli/src/command-internal/git-status.unit.test.ts
index 21a1ee4cea..fd708f228d 100644
--- a/apps/cli/src/command-internal/git-status.unit.test.ts
+++ b/apps/cli/src/command-internal/git-status.unit.test.ts
@@ -21,7 +21,7 @@ function mockSpawner(
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
       const cmd = command._tag === "StandardCommand" ? command.command : "";
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       const cwd = command._tag === "StandardCommand" ? command.options.cwd : undefined;
       spawned.push({ command: cmd, args, cwd });
 
diff --git a/apps/cli/src/command-internal/glob.unit.test.ts b/apps/cli/src/command-internal/glob.unit.test.ts
index a424671c2e..a7b4a1bc47 100644
--- a/apps/cli/src/command-internal/glob.unit.test.ts
+++ b/apps/cli/src/command-internal/glob.unit.test.ts
@@ -81,7 +81,7 @@ function fakeFileInfo(type: FileSystem.File.Type): FileSystem.File.Info {
     mtime: Option.none(),
     atime: Option.none(),
     birthtime: Option.none(),
-    dev: 0,
+    dev: 0n,
     ino: Option.none(),
     mode: 0,
     nlink: Option.none(),
diff --git a/apps/cli/src/command-internal/hostname.ts b/apps/cli/src/command-internal/hostname.ts
index 857353d9b1..ab32548820 100644
--- a/apps/cli/src/command-internal/hostname.ts
+++ b/apps/cli/src/command-internal/hostname.ts
@@ -1,4 +1,5 @@
-import { Config, Crypto, Effect, FileSystem, Option, Path, Schema } from "effect";
+import { Config, Effect, FileSystem, Option, Path, Schema } from "effect";
+import { Digest } from "effect/crypto";
 
 import type { ResolvedCliConfig } from "../config/cli-config-values.service.ts";
 import type { CliConfigLoadError } from "../shared/config/cli-config-load.errors.ts";
@@ -73,15 +74,10 @@ const dockerContextEndpointHost = (contextName: string) => {
   return Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* Digest.Digest;
     const configDir = yield* dockerConfigDir();
-    const digest = yield* crypto
-      .digest("SHA-256", new TextEncoder().encode(contextName))
-      .pipe(Effect.option);
-    if (Option.isNone(digest)) return Option.none<string>();
-    const contextId = Array.from(digest.value, (byte) => byte.toString(16).padStart(2, "0")).join(
-      "",
-    );
+    const digest = yield* crypto.digest(Digest.sha256, new TextEncoder().encode(contextName));
+    const contextId = Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
     const metaPath = path.join(configDir, "contexts", "meta", contextId, "meta.json");
     const content = yield* fs.readFileString(metaPath).pipe(Effect.option);
     if (Option.isNone(content)) return Option.none<string>();
@@ -120,7 +116,7 @@ export function platformDefaultDockerHost(platform: NodeJS.Platform): string {
 export const resolveDockerDaemonEndpoint = Effect.fnUntraced(function* (): Effect.fn.Return<
   Option.Option<string>,
   Config.ConfigError,
-  RuntimeInfo | FileSystem.FileSystem | Path.Path | Crypto.Crypto
+  RuntimeInfo | FileSystem.FileSystem | Path.Path | Digest.Digest
 > {
   const runtime = yield* RuntimeInfo;
   const dockerHost = yield* shellOption("DOCKER_HOST");
@@ -138,7 +134,7 @@ export const getHostname = (
 ): Effect.Effect<
   string,
   Config.ConfigError | CliConfigLoadError,
-  RuntimeInfo | FileSystem.FileSystem | Path.Path | Crypto.Crypto
+  RuntimeInfo | FileSystem.FileSystem | Path.Path | Digest.Digest
 > =>
   Effect.gen(function* () {
     const { SUPABASE_SERVICES_HOSTNAME: override } = yield* resolvedConfig.envValues([
diff --git a/apps/cli/src/command-internal/hostname.unit.test.ts b/apps/cli/src/command-internal/hostname.unit.test.ts
index 72d6f8d273..471a51b39f 100644
--- a/apps/cli/src/command-internal/hostname.unit.test.ts
+++ b/apps/cli/src/command-internal/hostname.unit.test.ts
@@ -1,18 +1,9 @@
 import { createHash } from "node:crypto";
 
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import {
-  Config,
-  ConfigProvider,
-  Crypto,
-  Effect,
-  FileSystem,
-  Layer,
-  Option,
-  Path,
-  Schema,
-} from "effect";
+import { Config, ConfigProvider, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
+import { Digest } from "effect/crypto";
 import type { CliConfigLoadError } from "../shared/config/cli-config-load.errors.ts";
 import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
 import {
@@ -36,7 +27,7 @@ const runtimeLayer = Layer.succeed(
   }),
 );
 
-type HostnameServices = RuntimeInfo | FileSystem.FileSystem | Path.Path | Crypto.Crypto;
+type HostnameServices = RuntimeInfo | FileSystem.FileSystem | Path.Path | Digest.Digest;
 
 /** A resolved config whose env-tier lookup yields `env`; the real tier order is covered by the config service tests. */
 const resolvedConfigWith = (env: Readonly<Record<string, string>> = {}) => ({
@@ -55,6 +46,7 @@ const noConfig = resolvedConfigWith();
 function configLayer(env: Readonly<Record<string, string | undefined>>) {
   return Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     runtimeLayer,
     ConfigProvider.layer(ConfigProvider.fromEnvRecord(env, { preserveEmptyStrings: true })),
   );
@@ -93,7 +85,7 @@ function withDockerConfig<A>(
   run: () => Effect.Effect<A, Config.ConfigError | CliConfigLoadError, HostnameServices>,
 ) {
   return writeDockerConfigDir(options).pipe(
-    Effect.provide(BunServices.layer),
+    Effect.provide([BunServices.layer, BunCrypto.layer]),
     Effect.flatMap((configDir) =>
       run().pipe(Effect.provide(configLayer({ ...env, DOCKER_CONFIG: configDir }))),
     ),
@@ -241,6 +233,7 @@ describe("getHostname", () => {
       Effect.provide(
         Layer.mergeAll(
           BunServices.layer,
+          BunCrypto.layer,
           runtimeLayer,
           ConfigProvider.layer(
             ConfigProvider.fromEnvRecord({ DOCKER_HOST: "unix:///docker.sock" }),
diff --git a/apps/cli/src/command-internal/link-services-core.ts b/apps/cli/src/command-internal/link-services-core.ts
index 7cbd5e28b6..37bf717237 100644
--- a/apps/cli/src/command-internal/link-services-core.ts
+++ b/apps/cli/src/command-internal/link-services-core.ts
@@ -44,7 +44,9 @@ export interface LinkServicesInput {
  * storage-version}`. Each probe is independently best-effort — an
  * unreachable service never fails the caller. Does not write `project-ref`,
  * the linked-project cache, or fire `cli_project_linked`; the `link` command
- * owns those, and `bootstrap` calls this directly to skip them.
+ * owns those, and `bootstrap` calls this directly to skip them. Unless the saved
+ * `project-ref` is `ref`, the files above except `pooler-url` are removed first,
+ * since their readers do no ref check.
  */
 export const linkServicesCore = Effect.fn("LinkServices.write")(function* (
   input: LinkServicesInput,
@@ -58,6 +60,19 @@ export const linkServicesCore = Effect.fn("LinkServices.write")(function* (
   const state = yield* LegacyProjectState;
   const { workdir } = input;
 
+  const refChanged = yield* state.readProjectRef(workdir).pipe(
+    Effect.map((linked) => !Option.contains(linked, input.ref)),
+    Effect.orElseSucceed(() => true),
+  );
+  yield* Effect.annotateCurrentSpan("link.ref_changed", refChanged);
+  if (refChanged) {
+    yield* Effect.forEach(
+      ["storageMigration", "restVersion", "gotrueVersion", "storageVersion"] as const,
+      (file) => state.remove(workdir, file).pipe(Effect.ignore),
+      { discard: true },
+    );
+  }
+
   yield* linkStorageMigration(api, input.ref, state, workdir);
   yield* linkPooler({ api, ref: input.ref, skipPooler: input.skipPooler, state, workdir });
   if (input.serviceKey.length === 0) return;
diff --git a/apps/cli/src/command-internal/local-config-values.ts b/apps/cli/src/command-internal/local-config-values.ts
index 878e44541b..740e870a03 100644
--- a/apps/cli/src/command-internal/local-config-values.ts
+++ b/apps/cli/src/command-internal/local-config-values.ts
@@ -28,6 +28,7 @@ import {
   ErrorActionabilityId,
 } from "../shared/telemetry/error-actionability.ts";
 import { resolveApiExternalUrl } from "./api-url.ts";
+import { configFileName } from "./config-advice.ts";
 import { sanitizeProjectId } from "../shared/config/project-id.ts";
 import {
   apiTlsCertReadErrorMessage,
@@ -773,6 +774,8 @@ export const resolveLocalConfigValues = Effect.fnUntraced(function* (
    * (not the always-defaulted decoded value). `undefined` callers skip those checks.
    */
   document?: Readonly<Record<string, unknown>>,
+  /** The loaded config file's path, so messages name it; `undefined` reads as `config.toml`. */
+  configPath?: string,
 ) {
   const resolvedProjectId = config.project_id ?? "";
 
@@ -954,6 +957,7 @@ export const resolveLocalConfigValues = Effect.fnUntraced(function* (
     edgeRuntimeDenoVersion: denoVersion,
     analytics: analyticsInput,
     experimental: experimentalInput,
+    configFileName: configPath === undefined ? undefined : configFileName(configPath),
   };
   yield* attempt(() => validateResolvedConfig(input));
   if (authEnabled) {
diff --git a/apps/cli/src/command-internal/local-project-context.ts b/apps/cli/src/command-internal/local-project-context.ts
index 57ac81dba7..d024d1bbde 100644
--- a/apps/cli/src/command-internal/local-project-context.ts
+++ b/apps/cli/src/command-internal/local-project-context.ts
@@ -1,5 +1,6 @@
 import type { CliConfig } from "@supabase/config";
-import { Crypto, Effect, FileSystem, Option, Path } from "effect";
+import { Effect, FileSystem, Option, Path } from "effect";
+import { Digest } from "effect/crypto";
 
 import { CliConfigValues, type ResolvedCliConfig } from "../config/cli-config-values.service.ts";
 import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
@@ -30,7 +31,7 @@ export const loadLocalProjectContext = <E>(
 ): Effect.Effect<
   LocalProjectContext,
   E,
-  FileSystem.FileSystem | Path.Path | RuntimeInfo | Crypto.Crypto | CliConfigValues
+  FileSystem.FileSystem | Path.Path | RuntimeInfo | Digest.Digest | CliConfigValues
 > =>
   Effect.gen(function* () {
     const { resolvedConfig, config, projectEnvValues, hostname, projectId } =
diff --git a/apps/cli/src/command-internal/local-project-context.unit.test.ts b/apps/cli/src/command-internal/local-project-context.unit.test.ts
index 1b121b4c5e..a62d989d0c 100644
--- a/apps/cli/src/command-internal/local-project-context.unit.test.ts
+++ b/apps/cli/src/command-internal/local-project-context.unit.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Config, ConfigProvider, Data, Effect, FileSystem, Layer, Option, Path } from "effect";
 
@@ -51,11 +51,13 @@ const layerWithShellEnv = (env: Readonly<Record<string, string>> = {}) =>
   Layer.fresh(
     Layer.mergeAll(
       BunServices.layer,
+      BunCrypto.layer,
       runtimeInfoLayer,
       cliConfigValuesLayer.pipe(
         Layer.provide(
           Layer.mergeAll(
             BunServices.layer,
+            BunCrypto.layer,
             mockOutput().layer,
             Layer.succeed(CliConfigFlagInputs, makeCliConfigFlagInputs()),
           ),
diff --git a/apps/cli/src/command-internal/login-api.layer.integration.test.ts b/apps/cli/src/command-internal/login-api.layer.integration.test.ts
index 6e7da75165..4e3175b4da 100644
--- a/apps/cli/src/command-internal/login-api.layer.integration.test.ts
+++ b/apps/cli/src/command-internal/login-api.layer.integration.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Layer, Option } from "effect";
+import * as HttpClientResponse from "effect/http/HttpClientResponse";
 
 import { LoginApi } from "../commands/login/login-api.service.ts";
 import {
@@ -13,11 +14,14 @@ import { loginApiLayer, loginProfile } from "./login-api.layer.ts";
 
 const PROFILE = { gotrue_id: "gotrue-user-123", primary_email: "a@b.co", username: "ab" };
 
-function setup(opts: Parameters<typeof mockCommandPlatformApi>[0]) {
+function setup(
+  opts: Parameters<typeof mockCommandPlatformApi>[0],
+  apiMaxRetries = Option.none<number>(),
+) {
   const api = mockCommandPlatformApi(opts);
   const layer = loginApiLayer.pipe(
     Layer.provide(api.httpClientLayer),
-    Layer.provide(mockCommandSettings({ workdir: "/unused-workdir" })),
+    Layer.provide(mockCommandSettings({ workdir: "/unused-workdir", apiMaxRetries })),
   );
   return { api, layer };
 }
@@ -59,4 +63,26 @@ describe("loginApiLayer", () => {
       expect(api.requests).toHaveLength(1);
     }).pipe(Effect.provide(layer));
   });
+
+  it.effect("looks the profile up once when SUPABASE_API_MAX_RETRIES is 0", () => {
+    const { api, layer } = setup(
+      {
+        // `Retry-After: 0` keeps any retry from waiting on the test clock.
+        handler: (request) =>
+          Effect.succeed(
+            HttpClientResponse.fromWeb(
+              request,
+              new Response("{}", { status: 500, headers: { "Retry-After": "0" } }),
+            ),
+          ),
+      },
+      Option.some(0),
+    );
+    return Effect.gen(function* () {
+      const loginApi = yield* LoginApi;
+      const gotrueId = yield* loginApi.fetchGotrueId(DEFAULT_API_URL, VALID_TOKEN);
+      expect(gotrueId).toEqual(Option.none());
+      expect(api.requests).toHaveLength(1);
+    }).pipe(Effect.provide(layer));
+  });
 });
diff --git a/apps/cli/src/command-internal/login-api.layer.ts b/apps/cli/src/command-internal/login-api.layer.ts
index 14c78dbe13..f94ae30aee 100644
--- a/apps/cli/src/command-internal/login-api.layer.ts
+++ b/apps/cli/src/command-internal/login-api.layer.ts
@@ -88,11 +88,10 @@ export const loginApiLayer = Layer.effect(
       // host and token.
       fetchGotrueId: (apiHost: string, token: string) =>
         Effect.gen(function* () {
-          const api = yield* makeApiClient({
-            baseUrl: apiHost,
-            accessToken: token,
-            userAgent: cliSettings.userAgent,
-          });
+          const api = yield* makeApiClient(
+            { baseUrl: apiHost, accessToken: token, userAgent: cliSettings.userAgent },
+            { retry: { maxRetries: Option.getOrUndefined(cliSettings.apiMaxRetries) } },
+          );
           const profile = yield* api.v1.getProfile();
           return profile.gotrue_id.length > 0
             ? Option.some(profile.gotrue_id)
diff --git a/apps/cli/src/command-internal/logs/local-history.ts b/apps/cli/src/command-internal/logs/local-history.ts
new file mode 100644
index 0000000000..b3d843c02a
--- /dev/null
+++ b/apps/cli/src/command-internal/logs/local-history.ts
@@ -0,0 +1,130 @@
+import type { LogPosition, LogRecord, StackLogRecord } from "@supabase/stack/effect";
+
+const isLine = (record: LogRecord) => record.kind === "stdout" || record.kind === "stderr";
+
+export interface LogWindow {
+  readonly records: ReadonlyArray<StackLogRecord>;
+  readonly shown: number;
+  readonly total: number;
+}
+
+const tailWindow = (records: ReadonlyArray<StackLogRecord>, tail: number): LogWindow => {
+  const total = records.filter(isLine).length;
+  if (total <= tail) return { records, shown: total, total };
+  let seen = 0;
+  let start = records.length;
+  while (seen < tail && start > 0) {
+    start -= 1;
+    const record = records[start];
+    if (record !== undefined && isLine(record)) seen += 1;
+  }
+  return { records: seen === 0 ? [] : records.slice(start), shown: seen, total };
+};
+
+const comparePositions = (left: LogPosition, right: LogPosition) =>
+  left.generation - right.generation || left.byteOffset - right.byteOffset;
+
+const origin: LogPosition = { generation: 0, byteOffset: 0 };
+const compareText = (left: string, right: string) => (left < right ? -1 : left > right ? 1 : 0);
+const compareRecords = (left: StackLogRecord, right: StackLogRecord) =>
+  compareText(left.timestamp, right.timestamp) ||
+  compareText(left.service, right.service) ||
+  compareText(left.instanceId, right.instanceId) ||
+  comparePositions(
+    left.position ?? left.resumeAt ?? origin,
+    right.position ?? right.resumeAt ?? origin,
+  );
+
+interface Launch {
+  readonly id: number;
+  readonly timestamp: string;
+}
+
+interface InstanceTail {
+  records: Array<StackLogRecord>;
+  head: number;
+  lines: number;
+  total: number;
+  launch: Launch | undefined;
+}
+
+export const isFromLaunch = (record: LogRecord, launchId: number | undefined) =>
+  launchId === undefined || record.launchId === undefined || record.launchId >= launchId;
+
+const fromLaunch = (record: StackLogRecord, launch: Launch) =>
+  record.launchId === undefined
+    ? record.timestamp >= launch.timestamp
+    : isFromLaunch(record, launch.id);
+
+export const makeHistoryCollector = (tail: number, fromLatestLaunch: boolean) => {
+  const instances = new Map<string, InstanceTail>();
+  const positions = new Map<string, LogPosition>();
+  const launches = new Map<string, number>();
+  const push = (record: StackLogRecord) => {
+    const position = record.position;
+    const last = positions.get(record.instanceId);
+    if (position !== undefined && (last === undefined || comparePositions(position, last) > 0))
+      positions.set(record.instanceId, position);
+    let state = instances.get(record.instanceId);
+    if (state === undefined) {
+      state = { records: [], head: 0, lines: 0, total: 0, launch: undefined };
+      instances.set(record.instanceId, state);
+    }
+    if (fromLatestLaunch) {
+      const latest = state.launch;
+      if (
+        record.kind === "launch" &&
+        record.launchId !== undefined &&
+        (latest === undefined || record.launchId > latest.id)
+      ) {
+        const launch = { id: record.launchId, timestamp: record.timestamp };
+        state.records = state.records.slice(state.head).filter((kept) => fromLaunch(kept, launch));
+        state.head = 0;
+        state.lines = state.records.filter(isLine).length;
+        state.total = state.lines;
+        state.launch = launch;
+        launches.set(record.instanceId, launch.id);
+      } else if (latest !== undefined && !fromLaunch(record, latest)) return;
+    }
+    const line = isLine(record);
+    if (line) state.total += 1;
+    const oldest = state.records[state.head];
+    if (state.lines >= tail && oldest !== undefined && compareRecords(record, oldest) < 0) return;
+    let low = state.head;
+    let high = state.records.length;
+    while (low < high) {
+      const middle = (low + high) >>> 1;
+      const kept = state.records[middle];
+      if (kept !== undefined && compareRecords(kept, record) <= 0) low = middle + 1;
+      else high = middle;
+    }
+    if (low === state.records.length) state.records.push(record);
+    else state.records.splice(low, 0, record);
+    if (line) state.lines += 1;
+    while (state.lines > tail && state.head < state.records.length) {
+      const dropped = state.records[state.head];
+      state.head += 1;
+      if (dropped !== undefined && isLine(dropped)) state.lines -= 1;
+    }
+    if (state.head > 1024 && state.head * 2 > state.records.length) {
+      state.records = state.records.slice(state.head);
+      state.head = 0;
+    }
+  };
+  const finish = (): {
+    readonly window: LogWindow;
+    readonly positions: typeof positions;
+    readonly launches: ReadonlyMap<string, number>;
+  } => {
+    const kept = [...instances.values()].flatMap((state) => state.records.slice(state.head));
+    const total = [...instances.values()].reduce((sum, state) => sum + state.total, 0);
+    const window = tailWindow(kept.toSorted(compareRecords), tail);
+    return { window: { ...window, total }, positions, launches };
+  };
+  return { push, finish };
+};
+
+export const isAfter = (record: LogRecord, printed: LogPosition | undefined) =>
+  printed === undefined ||
+  record.position === undefined ||
+  comparePositions(record.position, printed) > 0;
diff --git a/apps/cli/src/command-internal/logs/local-sources.ts b/apps/cli/src/command-internal/logs/local-sources.ts
new file mode 100644
index 0000000000..28f6d08b69
--- /dev/null
+++ b/apps/cli/src/command-internal/logs/local-sources.ts
@@ -0,0 +1,8 @@
+import { sharesApiEndpoint, type SavedStack } from "@supabase/stack/effect";
+
+export const hasGatewayLogs = (definition: SavedStack): boolean => {
+  const members = new Set(definition.composition.members.map(({ id }) => id));
+  return definition.instances.some(
+    ({ id, creation }) => members.has(id) && sharesApiEndpoint(creation),
+  );
+};
diff --git a/apps/cli/src/command-internal/logs/since.ts b/apps/cli/src/command-internal/logs/since.ts
new file mode 100644
index 0000000000..5f204863d4
--- /dev/null
+++ b/apps/cli/src/command-internal/logs/since.ts
@@ -0,0 +1,34 @@
+import { DateTime, Option } from "effect";
+
+export type SinceBound =
+  | { readonly kind: "time"; readonly iso: string }
+  | { readonly kind: "start" };
+
+const durationShape = /^(?:\d+(?:\.\d+)?(?:ms|s|m|h|d))+$/u;
+const durationPart = /(\d+(?:\.\d+)?)(ms|s|m|h|d)/gu;
+const unitMillis: Readonly<Record<string, number>> = {
+  ms: 1,
+  s: 1_000,
+  m: 60_000,
+  h: 3_600_000,
+  d: 86_400_000,
+};
+const isoDate = /^\d{4}-\d{2}-\d{2}/u;
+
+export const parseSince = (value: string, nowMillis: number): SinceBound | undefined => {
+  if (value === "start") return { kind: "start" };
+  if (durationShape.test(value)) {
+    let millis = 0;
+    for (const [, amount, unit] of value.matchAll(durationPart))
+      millis += Number(amount) * (unitMillis[unit ?? ""] ?? 0);
+    return Option.match(DateTime.make(nowMillis - millis), {
+      onNone: () => undefined,
+      onSome: (time) => ({ kind: "time", iso: DateTime.formatIso(time) }),
+    });
+  }
+  if (!isoDate.test(value)) return undefined;
+  return Option.match(DateTime.make(value), {
+    onNone: () => undefined,
+    onSome: (time) => ({ kind: "time", iso: DateTime.formatIso(time) }),
+  });
+};
diff --git a/apps/cli/src/command-internal/migrate-and-seed.ts b/apps/cli/src/command-internal/migrate-and-seed.ts
index 1bf8470264..adf396e587 100644
--- a/apps/cli/src/command-internal/migrate-and-seed.ts
+++ b/apps/cli/src/command-internal/migrate-and-seed.ts
@@ -5,7 +5,13 @@ import type { DbSession } from "./db-connection.service.ts";
 import type { DbExecError } from "./db-connection.errors.ts";
 import { MigrationApplyError, applyMigrationFile, applySchemaFiles } from "./migration-apply.ts";
 import { loadPartialMigrations } from "./migration-history.ts";
-import { ENABLE_LOCAL_WEBHOOKS_SUGGESTION, isPgNetUnavailableError } from "./pg-net-guidance.ts";
+import { enableLocalWebhooksSuggestion, isPgNetUnavailableError } from "./pg-net-guidance.ts";
+import {
+  type ConfigFileRef,
+  configKey,
+  configSetting,
+  DEFAULT_CONFIG_FILE,
+} from "./config-advice.ts";
 import { applySeedFiles, type SeedConfig } from "./seed.ts";
 
 /** Config consumed by `migrateAndSeed`. */
@@ -27,12 +33,15 @@ export interface MigrateAndSeedConfig {
    * this is not a local start/reset replay and disables local-only remediation.
    */
   readonly localDatabaseWebhooksEnabled?: boolean;
+  /** The project config file the guidance points at; absent means `config.toml`. */
+  readonly configFile?: ConfigFileRef | undefined;
 }
 
 const migrationApplyError = (
   message: string,
   dbError: DbExecError | undefined,
   localDatabaseWebhooksEnabled: boolean | undefined,
+  configFile: ConfigFileRef | undefined,
 ): MigrationApplyError => {
   const pgNetUnavailable =
     localDatabaseWebhooksEnabled === false &&
@@ -40,14 +49,16 @@ const migrationApplyError = (
     isPgNetUnavailableError(dbError);
   return new MigrationApplyError({
     message,
-    suggestion: pgNetUnavailable ? ENABLE_LOCAL_WEBHOOKS_SUGGESTION : undefined,
+    suggestion: pgNetUnavailable ? enableLocalWebhooksSuggestion(configFile) : undefined,
     reason: pgNetUnavailable ? "local_pg_net_unavailable" : undefined,
   });
 };
 
 /** Warns a versionless `--experimental` rebuild that `schema_paths` is ignored while pg-delta is on. */
-export const experimentalSchemaPathsIgnoredWarning =
-  "WARNING: [db.migrations].schema_paths is not applied while pg-delta is enabled (the default). Set [experimental.pgdelta] enabled = false to apply schema_paths files.\n";
+export const experimentalSchemaPathsIgnoredWarning = (
+  configFile: ConfigFileRef = DEFAULT_CONFIG_FILE,
+): string =>
+  `WARNING: ${configKey(configFile.format, "db.migrations", "schema_paths")} is not applied while pg-delta is enabled (the default). Set ${configSetting(configFile.format, "experimental.pgdelta", "enabled", "false")} to apply schema_paths files.\n`;
 
 /** Whether {@link experimentalSchemaPathsIgnoredWarning} applies to this rebuild. */
 export const ignoresExperimentalSchemaPaths = (inputs: {
@@ -81,7 +92,7 @@ export const migrateAndSeed = (
   Effect.gen(function* () {
     const output = yield* Output;
     if (ignoresExperimentalSchemaPaths({ ...config, version })) {
-      yield* output.raw(experimentalSchemaPathsIgnoredWarning, "stderr");
+      yield* output.raw(experimentalSchemaPathsIgnoredWarning(config.configFile), "stderr");
     }
     if (config.experimental && version.length === 0 && !config.pgDeltaEnabled) {
       yield* applySchemaFiles(
@@ -100,7 +111,12 @@ export const migrateAndSeed = (
       for (const migrationPath of pending) {
         yield* output.raw(`Applying migration ${path.basename(migrationPath)}...\n`, "stderr");
         yield* applyMigrationFile(session, fs, path, migrationPath, (message, dbError) =>
-          migrationApplyError(message, dbError, config.localDatabaseWebhooksEnabled),
+          migrationApplyError(
+            message,
+            dbError,
+            config.localDatabaseWebhooksEnabled,
+            config.configFile,
+          ),
         );
       }
     }
diff --git a/apps/cli/src/command-internal/migration-apply.ts b/apps/cli/src/command-internal/migration-apply.ts
index 40eb63121c..ce101df88b 100644
--- a/apps/cli/src/command-internal/migration-apply.ts
+++ b/apps/cli/src/command-internal/migration-apply.ts
@@ -311,7 +311,7 @@ const TYPE_NAME_PATTERN = /type "([^"]+)" does not exist/;
 
 /**
  * Renders a failed statement's error context: the `^` caret under the server-reported error
- * position, the `Detail` line when present, the SQLSTATE-42704 extension hint, then
+ * position, the `Detail` line when present, the SQLSTATE-42704 or 25P01 hint, then
  * `At statement: <index>` and the caret-marked statement text. The structured `detail`/`position`
  * fields are only set by the driver for real server error responses.
  *
@@ -334,6 +334,12 @@ export const formatExecBatchError = (e: DbExecError, index: number, stat: string
     msg.push(`        CREATE TABLE example (col extensions.${typeName});`);
     msg.push("      Learn more: supabase migration new --help");
   }
+  if (e.code === "25P01") {
+    msg.push("");
+    msg.push("Hint: This statement must run inside an explicit BEGIN; ... COMMIT; block;");
+    msg.push("      the CLI adds none. Review any existing transaction boundaries.");
+    msg.push("      Move each non-transactional statement (e.g. VACUUM) to its own file.");
+  }
   msg.push(`At statement: ${index}`, marked);
   return formattedExecBatchFailure(`${errorMessage(e)}\n${msg.join("\n")}`, e);
 };
diff --git a/apps/cli/src/command-internal/migration-apply.unit.test.ts b/apps/cli/src/command-internal/migration-apply.unit.test.ts
index 224e8f2618..a18f432ec4 100644
--- a/apps/cli/src/command-internal/migration-apply.unit.test.ts
+++ b/apps/cli/src/command-internal/migration-apply.unit.test.ts
@@ -712,7 +712,7 @@ describe("hasTransactionControl", () => {
 });
 
 layer(BunServices.layer)("migration failure rendering", (it) => {
-  // Error message layout: `<pg error>\n[Detail]\n[42704 hint]\n` then
+  // Error message layout: `<pg error>\n[Detail]\n[42704 or 25P01 hint]\n` then
   // `At statement: <i>\n<caret-marked statement>`.
   const failing = (
     sql: string,
@@ -765,7 +765,7 @@ layer(BunServices.layer)("migration failure rendering", (it) => {
     }),
   );
 
-  it.effect("skips the hint when the SQLSTATE is not 42704", () =>
+  it.effect("skips the 42704 hint when the SQLSTATE is not 42704", () =>
     Effect.gen(function* () {
       const stat = "CREATE TABLE test (path ltree NOT NULL)";
       const message = yield* failing(stat, {
@@ -795,6 +795,25 @@ layer(BunServices.layer)("migration failure rendering", (it) => {
     }),
   );
 
+  it.effect("recommends an authored BEGIN/COMMIT when LOCK TABLE needs a transaction block", () =>
+    Effect.gen(function* () {
+      const stat = "LOCK TABLE public.t IN ACCESS EXCLUSIVE MODE";
+      const message = yield* failing(stat, {
+        message: "ERROR: LOCK TABLE can only be used in transaction blocks (SQLSTATE 25P01)",
+        code: "25P01",
+      });
+      expect(message).toBe(
+        "ERROR: LOCK TABLE can only be used in transaction blocks (SQLSTATE 25P01)\n" +
+          "\n" +
+          "Hint: This statement must run inside an explicit BEGIN; ... COMMIT; block;\n" +
+          "      the CLI adds none. Review any existing transaction boundaries.\n" +
+          "      Move each non-transactional statement (e.g. VACUUM) to its own file.\n" +
+          "At statement: 0\n" +
+          "LOCK TABLE public.t IN ACCESS EXCLUSIVE MODE",
+      );
+    }),
+  );
+
   it.effect("keeps the plain layout for errors without position or detail", () =>
     Effect.gen(function* () {
       const stat = "ALTER TABLE a ADD COLUMN b int";
diff --git a/apps/cli/src/command-internal/migration-fetch-run.ts b/apps/cli/src/command-internal/migration-fetch-run.ts
index 45bf6ec894..bf66853271 100644
--- a/apps/cli/src/command-internal/migration-fetch-run.ts
+++ b/apps/cli/src/command-internal/migration-fetch-run.ts
@@ -7,7 +7,7 @@ import { CommandSettings } from "../config/command-settings.service.ts";
 import { bold } from "./colors.ts";
 import { DbConfigResolver } from "./db-config.service.ts";
 import { DbConnection } from "./db-connection.service.ts";
-import { loadProjectEnvValues } from "./db-config.toml-read.ts";
+import { loadProjectEnvValues } from "./db-config.read.ts";
 import { announcedTarget, hostedMutationPreapproval } from "./hosted-consent/hosted-consent.ts";
 import { readMigrationTable } from "./migration-history.ts";
 import { promptYesNo } from "./prompt-yes-no.ts";
diff --git a/apps/cli/src/command-internal/output-formats.ts b/apps/cli/src/command-internal/output-formats.ts
index 52d4e85d8b..3cffaa89f3 100644
--- a/apps/cli/src/command-internal/output-formats.ts
+++ b/apps/cli/src/command-internal/output-formats.ts
@@ -18,6 +18,15 @@ export const RESOURCE_OUTPUT_FORMATS = ["env", "pretty", "json", "toml", "yaml"]
 /** Accepted `-o`/`--output` values for `db query`. */
 export const QUERY_OUTPUT_FORMATS = ["json", "table", "csv"] as const;
 
+const commandOutputFormats: Readonly<Record<string, ReadonlyArray<string>>> = {
+  "db query": QUERY_OUTPUT_FORMATS,
+  logs: [],
+  "logs sources": [],
+};
+
+export const outputFormatsForCommand = (path: ReadonlyArray<string>): ReadonlyArray<string> =>
+  commandOutputFormats[path.join(" ")] ?? RESOURCE_OUTPUT_FORMATS;
+
 /**
  * Raised when `-o`/`--output` carries a value the active command doesn't accept. The message
  * has the form `invalid argument "<value>" for "<flag>" flag: <reason>`.
diff --git a/apps/cli/src/command-internal/pg-dump.native.integration.test.ts b/apps/cli/src/command-internal/pg-dump.native.integration.test.ts
index 09d9b28825..a63ba731cb 100644
--- a/apps/cli/src/command-internal/pg-dump.native.integration.test.ts
+++ b/apps/cli/src/command-internal/pg-dump.native.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { FetchHttpClient } from "effect/http";
 import { Effect, FileSystem, Layer, Option, Redacted, Ref, Stream } from "effect";
@@ -16,7 +16,7 @@ import { destroyTestStack } from "../../tests/helpers/stack-cleanup.ts";
 import { selection } from "../../tests/helpers/pins.ts";
 
 const runtimes = ["native", "docker"] as const;
-const liveStackApi = stackApiLayer.pipe(Layer.provide(BunServices.layer));
+const liveStackApi = stackApiLayer.pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
 
 describe("managed pg_dump against a live stack", { timeout: 180_000 }, () => {
   for (const runtime of runtimes) {
diff --git a/apps/cli/src/command-internal/pg-net-guidance.ts b/apps/cli/src/command-internal/pg-net-guidance.ts
index 600dfa1714..419926b750 100644
--- a/apps/cli/src/command-internal/pg-net-guidance.ts
+++ b/apps/cli/src/command-internal/pg-net-guidance.ts
@@ -1,10 +1,16 @@
+import { type ConfigFileRef, DEFAULT_CONFIG_FILE } from "./config-advice.ts";
 import type { DbExecError } from "./db-connection.errors.ts";
 
 /** Canonical remediation when local migrations need pg_net but webhooks are disabled. */
-export const ENABLE_LOCAL_WEBHOOKS_SUGGESTION =
-  "Add the following to supabase/config.toml and retry:\n\n" +
-  "[experimental.webhooks]\n" +
-  "enabled = true";
+export const enableLocalWebhooksSuggestion = (
+  configFile: ConfigFileRef = DEFAULT_CONFIG_FILE,
+): string =>
+  `Add the following to ${configFile.path} and retry:\n\n` +
+  (configFile.format === "json"
+    ? '{\n  "experimental": {\n    "webhooks": {\n      "enabled": true\n    }\n  }\n}'
+    : "[experimental.webhooks]\nenabled = true");
+
+export const ENABLE_LOCAL_WEBHOOKS_SUGGESTION = enableLocalWebhooksSuggestion();
 
 const MISSING_NET_SCHEMA_PATTERN = /schema "net" does not exist/iu;
 const MISSING_PG_NET_FUNCTION_PATTERN = /function net\.http_[a-z0-9_]*\([^)]*\) does not exist/iu;
diff --git a/apps/cli/src/command-internal/pgdelta-ssl.ts b/apps/cli/src/command-internal/pgdelta-ssl.ts
deleted file mode 100644
index 9d981842c0..0000000000
--- a/apps/cli/src/command-internal/pgdelta-ssl.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * The Supabase CA bundle for TLS-requiring remote Postgres endpoints (staging + production +
- * snapshot roots, concatenated). The migra engine passes it to its edge-runtime script as
- * `SSL_CA` when the SSL probe reports the server requires TLS.
- */
-export const PG_DELTA_CA_BUNDLE =
-  "-----BEGIN CERTIFICATE-----\nMIID1DCCArygAwIBAgIUbYRdq/8/uNq8G9stMCdOFSBgA2MwDQYJKoZIhvcNAQEL\nBQAwczELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5l\ndyBDYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEmMCQGA1UEAwwdU3VwYWJh\nc2UgU3RhZ2luZyBSb290IDIwMjEgQ0EwHhcNMjEwNDI4MTAzNjEzWhcNMzEwNDI2\nMTAzNjEzWjBzMQswCQYDVQQGEwJVUzEQMA4GA1UECAwHRGVsd2FyZTETMBEGA1UE\nBwwKTmV3IENhc3RsZTEVMBMGA1UECgwMU3VwYWJhc2UgSW5jMSYwJAYDVQQDDB1T\ndXBhYmFzZSBTdGFnaW5nIFJvb3QgMjAyMSBDQTCCASIwDQYJKoZIhvcNAQEBBQAD\nggEPADCCAQoCggEBAN0AKRE8a56O8LaZxiOAcHFUFnwiKUvPoXPq26Ifw+Nv+7zg\nN2V5WnMZbbw24q61Os60ZUn0XmbVtuIeJ+stPHsO7qxxuL+bmPR+qU5tkDrIOyEe\nYD/2u8/q6ssVv42k4XcXbhM6RVz7CkCDY0TiBm1bMtRZso3xB6E9wAjxDf43XfV5\nPAGs3JI+Zo/vyqCDlN0hHOrB/aBl01JXqQWI84Gia5ooucq4SjA1CyawBcQ2IAvG\nrXuy1BouY+xM3zRuNvtfFP6rb5Mta+jCYEMh1AZ8yP8sYUWAyhxX6k9EbOb009wQ\naZljbUCh/UglGWuBxdzePavx+zPjzWXB1NyVkpkCAwEAAaNgMF4wCwYDVR0PBAQD\nAgEGMB0GA1UdDgQWBBQFx+PHLf27iIo/PMfIfGqXF7Zb+DAfBgNVHSMEGDAWgBQF\nx+PHLf27iIo/PMfIfGqXF7Zb+DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEB\nCwUAA4IBAQB/xIiz5dDqzGXjqYqXZYx4iSfSxsVayeOPDMfmaiCfSMJEUG4cUiwG\nOvMPGztaUEYeip5SCvSKuAAjVkXyP7ahKR7t7lZ9mErVXyxSZoVLbOd578CuYiZk\nOgT17UjPv66WMzEKEr8wGpomTYWWfEkuqt8ENdiM1Z4LNFahdKj36+jm6/a+9R8K\n25VIL68DTaQpBxFWG6ixC1HRMHJ12lDhKsshIi099BVpkGibESlxPrQOdKKqBB/J\nvIX+/Hb+mS4H5zYMeK2wX0onp+GBcD6X9L1UJuXMVd+BRan8RFidXL5s3++xXjQq\nNzbc6lnA69urKffvcT07YwMsY/OmHzVa\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDxDCCAqygAwIBAgIUbLxMod62P2ktCiAkxnKJwtE9VPYwDQYJKoZIhvcNAQEL\nBQAwazELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5l\ndyBDYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJh\nc2UgUm9vdCAyMDIxIENBMB4XDTIxMDQyODEwNTY1M1oXDTMxMDQyNjEwNTY1M1ow\nazELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5ldyBD\nYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJhc2Ug\nUm9vdCAyMDIxIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQXW\nQyHOB+qR2GJobCq/CBmQ40G0oDmCC3mzVnn8sv4XNeWtE5XcEL0uVih7Jo4Dkx1Q\nDmGHBH1zDfgs2qXiLb6xpw/CKQPypZW1JssOTMIfQppNQ87K75Ya0p25Y3ePS2t2\nGtvHxNjUV6kjOZjEn2yWEcBdpOVCUYBVFBNMB4YBHkNRDa/+S4uywAoaTWnCJLUi\ncvTlHmMw6xSQQn1UfRQHk50DMCEJ7Cy1RxrZJrkXXRP3LqQL2ijJ6F4yMfh+Gyb4\nO4XajoVj/+R4GwywKYrrS8PrSNtwxr5StlQO8zIQUSMiq26wM8mgELFlS/32Uclt\nNaQ1xBRizkzpZct9DwIDAQABo2AwXjALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFKjX\nuXY32CztkhImng4yJNUtaUYsMB8GA1UdIwQYMBaAFKjXuXY32CztkhImng4yJNUt\naUYsMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAB8spzNn+4VU\ntVxbdMaX+39Z50sc7uATmus16jmmHjhIHz+l/9GlJ5KqAMOx26mPZgfzG7oneL2b\nVW+WgYUkTT3XEPFWnTp2RJwQao8/tYPXWEJDc0WVQHrpmnWOFKU/d3MqBgBm5y+6\njB81TU/RG2rVerPDWP+1MMcNNy0491CTL5XQZ7JfDJJ9CCmXSdtTl4uUQnSuv/Qx\nCea13BX2ZgJc7Au30vihLhub52De4P/4gonKsNHYdbWjg7OWKwNv/zitGDVDB9Y2\nCMTyZKG3XEu5Ghl1LEnI3QmEKsqaCLv12BnVjbkSeZsMnevJPs1Ye6TjjJwdik5P\no/bKiIz+Fq8=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDxzCCAq+gAwIBAgIUeX+gpfmsRW9asFkRvjyXjHxbfgcwDQYJKoZIhvcNAQEL\nBQAwazELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5l\ndyBDYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJh\nc2UgUm9vdCAyMDIxIENBMB4XDTI1MDkwMzA4MDEyNVoXDTM1MDkwMTA4MDEyNVow\nazELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0RlbHdhcmUxEzARBgNVBAcMCk5ldyBD\nYXN0bGUxFTATBgNVBAoMDFN1cGFiYXNlIEluYzEeMBwGA1UEAwwVU3VwYWJhc2Ug\nUm9vdCAyMDIxIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5Ve7\ni9UAmc7luUilELPtqzEk8nGHxg7nY0aCStr625M7+K4OPO6RUllTsHh47k1jWyzm\nLXLlyYwCsYCjQp+3vn06H+F/HRUxBt6CK2B7bNng230exTunk0xFvfkX6YgHR7B3\n1B7L25Rq3PhuRFPV4hnGYRam2XBZC4UNPqoAgrhV0HOYzXXAVoTr2yaBTMnB331Z\nRwOmINh7eqTCk/JRZbb6vfZOhZRAVAe9AoRLoG8aKwmeoLGwlu0UuFx6z3E+6bmA\nfSNa8Lx02GEoCdPLw9IRKUFq/SgBpQUKm44H1fDwTjH2CMM0N4p0mL/6wXnNeHvt\nC40MmKZ0RcVmHE5wBwIDAQABo2MwYTAdBgNVHQ4EFgQUjvEE541toZcwtXQlZlcB\nYOBRTnowHwYDVR0jBBgwFoAUjvEE541toZcwtXQlZlcBYOBRTnowDwYDVR0TAQH/\nBAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBACD5IcGP\nXKvS9qg0CgEQPFqYavt5c7P+0xxFgiZe+xoG8fUw58yNeK2APtgGPRpxEOGfAlNx\nz9HDt4gcyHEE00B3qAVDm49pqNxioFWzNqU2LGfM/HL1QmN6urR7hCOkVCJddvOc\nFhFX4nZDuRfaBboDvS5HlK3Pzxddp9hvrJi2bemr8HLqYc3HzmVckgPGSLML6t+h\n4LRCXSlQsDgQ1LZ4KHsl4cq7K51N6FOXQBLB5q4lMKhs0VUhCT8Pdsj12+84laCV\nc22q6p2mdT9SaernCSRnWazXWisgpjv3H7Ex4S1DCYjJIwn3PUToGFv1r8YRN2/S\nO19yVSxxCIf64Sg=\n-----END CERTIFICATE-----\n";
diff --git a/apps/cli/src/command-internal/pgdelta-ssl.unit.test.ts b/apps/cli/src/command-internal/pgdelta-ssl.unit.test.ts
deleted file mode 100644
index 68844c665d..0000000000
--- a/apps/cli/src/command-internal/pgdelta-ssl.unit.test.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { PG_DELTA_CA_BUNDLE } from "./pgdelta-ssl.ts";
-
-describe("PG_DELTA_CA_BUNDLE", () => {
-  it("concatenates the three Supabase CA certificates", () => {
-    expect(PG_DELTA_CA_BUNDLE.match(/BEGIN CERTIFICATE/g)).toHaveLength(3);
-  });
-});
diff --git a/apps/cli/src/command-internal/pgdelta.ts b/apps/cli/src/command-internal/pgdelta.ts
index 2e8e35090a..3ee8f4488f 100644
--- a/apps/cli/src/command-internal/pgdelta.ts
+++ b/apps/cli/src/command-internal/pgdelta.ts
@@ -16,7 +16,7 @@ export interface PgDeltaContext {
    * forwarded to the edge-runtime container so migra runs under the configured Deno image.
    */
   readonly denoVersion: number;
-  /** The project's parsed `supabase/.env` (`readDbToml`'s `projectEnv`). */
+  /** The project's parsed `supabase/.env` (`readDbConfig`'s `projectEnv`). */
   readonly projectEnv: Readonly<Record<string, string>>;
 }
 
diff --git a/apps/cli/src/command-internal/project-lifecycle-lock.integration.test.ts b/apps/cli/src/command-internal/project-lifecycle-lock.integration.test.ts
index e38174ca5c..11676f8740 100644
--- a/apps/cli/src/command-internal/project-lifecycle-lock.integration.test.ts
+++ b/apps/cli/src/command-internal/project-lifecycle-lock.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Deferred, Effect, Exit, Fiber, FileSystem, Layer, Option, Path } from "effect";
 import * as HttpClient from "effect/http/HttpClient";
@@ -197,7 +197,7 @@ describe("project lifecycle lock", () => {
         yield* Fiber.join(stopping);
         expect(docker.containerNames()).toEqual([]);
         expect(docker.networkNames()).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     10_000,
   );
 
@@ -229,7 +229,7 @@ describe("project lifecycle lock", () => {
         yield* Fiber.join(stopping);
         expect(docker.containerNames()).toEqual([]);
         expect(docker.networkNames()).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     10_000,
   );
 
@@ -263,7 +263,7 @@ describe("project lifecycle lock", () => {
         yield* Fiber.join(stopping);
         yield* Fiber.join(starting);
         expect(docker.networkNames()).toEqual([NETWORK]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     10_000,
   );
 
@@ -296,7 +296,7 @@ describe("project lifecycle lock", () => {
         yield* Fiber.join(startingBeta);
         expect(docker.containerNames()).toContain("supabase_db_alpha");
         expect(docker.networkNames()).toEqual(["supabase_network_alpha", "supabase_network_beta"]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     10_000,
   );
 
@@ -337,7 +337,7 @@ describe("project lifecycle lock", () => {
         yield* Fiber.join(secondStarting);
         expect(docker.networkNames()).toEqual([NETWORK]);
         expect(docker.containerNames()).toContain("supabase_auth_demo");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     10_000,
   );
 
@@ -370,7 +370,7 @@ describe("project lifecycle lock", () => {
         yield* Fiber.join(yield* runStop(stopper));
         expect(docker.containerNames()).toEqual([]);
         expect(docker.networkNames()).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     10_000,
   );
 
@@ -402,7 +402,7 @@ describe("project lifecycle lock", () => {
 
       expect(yield* Fiber.join(blocked)).toBeInstanceOf(ProjectLifecycleLockBusyError);
       expect(docker.networkNames()).toEqual([NETWORK]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   for (const format of ["json", "stream-json"] as const) {
@@ -428,7 +428,7 @@ describe("project lifecycle lock", () => {
 
         expect(yield* Fiber.join(blocked)).toBeInstanceOf(ProjectLifecycleLockBusyError);
         expect(waiter.out.rawChunks).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   }
 
@@ -451,7 +451,7 @@ describe("project lifecycle lock", () => {
 
         expect(docker.containerNames()).toContain("supabase_db_demo");
         expect(cli.out.stderrText).not.toContain("Waiting for another Supabase CLI command");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("stops the stack without the lock", () =>
@@ -468,7 +468,7 @@ describe("project lifecycle lock", () => {
 
         expect(docker.containerNames()).toEqual([]);
         expect(docker.networkNames()).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 });
diff --git a/apps/cli/src/command-internal/project-lifecycle-lock.ts b/apps/cli/src/command-internal/project-lifecycle-lock.ts
index 609f176ca7..34fb543d8d 100644
--- a/apps/cli/src/command-internal/project-lifecycle-lock.ts
+++ b/apps/cli/src/command-internal/project-lifecycle-lock.ts
@@ -5,17 +5,8 @@ import {
   isLockBusy,
   type NamespaceError,
 } from "@supabase/stack/effect";
-import {
-  Clock,
-  Crypto,
-  Data,
-  Duration,
-  Effect,
-  FileSystem,
-  Option,
-  Path,
-  type Scope,
-} from "effect";
+import { Clock, Data, Duration, Effect, FileSystem, Option, Path, type Scope } from "effect";
+import { Digest } from "effect/crypto";
 
 import { CommandSettings } from "../config/command-settings.service.ts";
 import { Output } from "../shared/output/output.service.ts";
@@ -65,7 +56,7 @@ export const holdProjectLifecycleLock = Effect.fn("ProjectLifecycleLock.hold")(f
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const output = yield* Output;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* Digest.Digest;
   const debugLogger = yield* Effect.serviceOption(DebugLogger);
 
   const allProjects = projectId.length === 0;
@@ -115,7 +106,7 @@ export const holdProjectLifecycleLock = Effect.fn("ProjectLifecycleLock.hold")(f
     }
 
     const digest = yield* crypto.digest(
-      "SHA-256",
+      Digest.sha256,
       new TextEncoder().encode(cliProjectFilterValue(projectId)),
     );
     const key = Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
diff --git a/apps/cli/src/command-internal/resolve-token.unit.test.ts b/apps/cli/src/command-internal/resolve-token.unit.test.ts
index e52ce3b99c..32830931bd 100644
--- a/apps/cli/src/command-internal/resolve-token.unit.test.ts
+++ b/apps/cli/src/command-internal/resolve-token.unit.test.ts
@@ -22,6 +22,7 @@ const settings = (accessToken: Option.Option<Redacted.Redacted<string>>) =>
     workdirEnvValue: Option.none(),
     githubToken: Option.none(),
     userAgent: "SupabaseCLI/test",
+    apiMaxRetries: Option.none(),
   });
 
 const credentials = (
diff --git a/apps/cli/src/command-internal/resolved-config-context.ts b/apps/cli/src/command-internal/resolved-config-context.ts
index dfd48e1982..bffb5a5ba5 100644
--- a/apps/cli/src/command-internal/resolved-config-context.ts
+++ b/apps/cli/src/command-internal/resolved-config-context.ts
@@ -79,7 +79,9 @@ export const describeConfigLoadFailure = (cause: unknown): string =>
           cause._tag === "CliConfigFlagConflictError" ||
           cause._tag === "CliConfigLoadError" ||
           cause._tag === "CliConfigRemovedKeyError" ||
-          cause._tag === "CliConfigRemovedEnvError") &&
+          cause._tag === "CliConfigRemovedEnvError" ||
+          cause._tag === "CliConfigFileConflictError" ||
+          cause._tag === "CliConfigSchemaVersionError") &&
         "message" in cause &&
         typeof cause.message === "string"
       ? cause.message
diff --git a/apps/cli/src/command-internal/resolved-config-context.unit.test.ts b/apps/cli/src/command-internal/resolved-config-context.unit.test.ts
index 893c5dc73d..e9fa44ffe8 100644
--- a/apps/cli/src/command-internal/resolved-config-context.unit.test.ts
+++ b/apps/cli/src/command-internal/resolved-config-context.unit.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Path } from "effect";
 
@@ -18,18 +18,20 @@ const writeProjectEnv = (workdir: string, contents: string) =>
     const supabaseDir = path.join(workdir, "supabase");
     yield* fs.makeDirectory(supabaseDir, { recursive: true });
     yield* fs.writeFileString(path.join(supabaseDir, ".env"), contents);
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 /** Runs against a shell environment of exactly `env`, with the real config service and an empty Docker config dir. */
 const layerWithShellEnv = (workdir: string, env: Readonly<Record<string, string>> = {}) =>
   Layer.fresh(
     Layer.mergeAll(
       BunServices.layer,
+      BunCrypto.layer,
       runtimeInfoLayer,
       cliConfigValuesLayer.pipe(
         Layer.provide(
           Layer.mergeAll(
             BunServices.layer,
+            BunCrypto.layer,
             mockOutput().layer,
             Layer.succeed(CliConfigFlagInputs, makeCliConfigFlagInputs()),
           ),
diff --git a/apps/cli/src/command-internal/scratch-paths.integration.test.ts b/apps/cli/src/command-internal/scratch-paths.integration.test.ts
index ae63a8112e..f7c2f46feb 100644
--- a/apps/cli/src/command-internal/scratch-paths.integration.test.ts
+++ b/apps/cli/src/command-internal/scratch-paths.integration.test.ts
@@ -1,6 +1,6 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect } from "effect";
+import { Effect, Layer } from "effect";
 
 import { mockCommandSettings } from "../../tests/helpers/command-mocks.ts";
 import { pgdeltaScratchDir, scratchDir } from "./scratch-paths.ts";
@@ -12,7 +12,7 @@ const resolve = (kind: "legacy" | "stack", workdir: string) =>
     pgdelta: pgdeltaScratchDir(workdir),
   }).pipe(
     Effect.provide([
-      BunServices.layer,
+      Layer.merge(BunServices.layer, BunCrypto.layer),
       mockCommandSettings({ workdir, supabaseHome: "/home/.supabase" }),
       stackBackendLayer(kind),
     ]),
diff --git a/apps/cli/src/command-internal/scratch-paths.ts b/apps/cli/src/command-internal/scratch-paths.ts
index db9d3a1697..1f21b5d1d4 100644
--- a/apps/cli/src/command-internal/scratch-paths.ts
+++ b/apps/cli/src/command-internal/scratch-paths.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect, Path } from "effect";
+import { Effect, Path } from "effect";
+import { Digest } from "effect/crypto";
 
 import { CommandSettings } from "../config/command-settings.service.ts";
 import { legacyProjectStatePaths } from "../shared/config/legacy-project-state.paths.ts";
@@ -19,8 +20,8 @@ export const pgdeltaScratchDir = Effect.fnUntraced(function* (projectRoot: strin
   const path = yield* Path.Path;
   const root = path.join(yield* scratchDir(projectRoot), "pgdelta");
   if (!(yield* usesStackState)) return root;
-  const digest = yield* (yield* Crypto.Crypto).digest(
-    "SHA-256",
+  const digest = yield* (yield* Digest.Digest).digest(
+    Digest.sha256,
     new TextEncoder().encode(path.resolve(projectRoot)),
   );
   return path.join(
diff --git a/apps/cli/src/command-internal/seed-buckets.ts b/apps/cli/src/command-internal/seed-buckets.ts
index 8e0ced02b7..f7a8efd92d 100644
--- a/apps/cli/src/command-internal/seed-buckets.ts
+++ b/apps/cli/src/command-internal/seed-buckets.ts
@@ -18,6 +18,7 @@ import {
   type StorageCredentials,
 } from "./storage-credentials.ts";
 import { currentStackBackend } from "./stack-backend.ts";
+import { type ConfigFileRef, configFileRefOf, DEFAULT_CONFIG_FILE } from "./config-advice.ts";
 import { withStackStorageGuidance } from "./stack-storage.ts";
 import { parseFileSizeLimit, resolveBucketProps } from "./storage-bucket-config.ts";
 import {
@@ -39,7 +40,6 @@ import { bucketObjectKey } from "../commands/seed/buckets/buckets.upload.ts";
 // same tag `seedBucketsRun` itself fails with, without importing across command boundaries.
 export { SeedConfigLoadError };
 
-const CONFIG_PATH = "supabase/config.toml";
 const UPLOAD_CONCURRENCY = 5;
 
 /** Whether `[storage.buckets]` or `[storage.vector.buckets]` declares anything to seed. */
@@ -150,6 +150,8 @@ export const seedBucketsRun = Effect.fnUntraced(function* <
   readonly credentials?: StorageCredentials;
   /** Explicit project root for config/env loading and `objects_path` resolution. */
   readonly workdir?: string;
+  /** The project config file named in prune messages; defaults to the loaded config, else `supabase/config.toml`. */
+  readonly configFile?: ConfigFileRef;
   /**
    * When true, overwrite/prune decisions resolve from consent alone and no prompt runs, so the
    * caller cannot consume a line of its parent's stdin. `start` sets this: it has already
@@ -208,6 +210,11 @@ export const seedBucketsRun = Effect.fnUntraced(function* <
     ));
   // `--yes` OR `SUPABASE_YES`.
   const yes = opts.yes ?? (yield* resolveYesWithProjectEnv(projectEnvValues));
+  const configPath =
+    opts.configFile?.path ??
+    (context === undefined
+      ? DEFAULT_CONFIG_FILE.path
+      : configFileRefOf(path, workdir, context.resolvedConfig).path);
   const config = opts.resolvedConfig?.config ?? context?.config ?? decodeDefaultCliConfig({});
   const document = opts.resolvedConfig?.document ?? context?.document;
 
@@ -281,7 +288,13 @@ export const seedBucketsRun = Effect.fnUntraced(function* <
     // A hosted run never prompts per item: one consent covers every overwrite and prune.
     const confirmHostedWrites = projectRef === "" ? undefined : opts.confirmHostedWrites;
     if (confirmHostedWrites !== undefined) {
-      const details = yield* planHostedWrites(gateway, config, bucketPropsByName, existingBuckets);
+      const details = yield* planHostedWrites(
+        gateway,
+        config,
+        bucketPropsByName,
+        existingBuckets,
+        configPath,
+      );
       if (details.length > 0) yield* confirmHostedWrites(details);
     }
     const approved = confirmHostedWrites !== undefined || yes;
@@ -309,6 +322,7 @@ export const seedBucketsRun = Effect.fnUntraced(function* <
         gateway,
         Object.keys(config.storage.analytics.buckets),
         summary,
+        configPath,
       );
     }
 
@@ -323,6 +337,7 @@ export const seedBucketsRun = Effect.fnUntraced(function* <
         gateway,
         vectorBucketNames,
         summary,
+        configPath,
       ).pipe(Effect.catch((error) => handleVectorError(output, error, summary)));
     }
 
@@ -426,6 +441,7 @@ const upsertVectorBuckets = Effect.fnUntraced(function* (
   gateway: StorageGateway,
   configuredNames: ReadonlyArray<string>,
   summary: SeedSummary,
+  configPath: string,
 ) {
   const existing = yield* gateway.listVectorBuckets;
   const existingSet = new Set(existing);
@@ -448,14 +464,14 @@ const upsertVectorBuckets = Effect.fnUntraced(function* (
       : yield* promptYesNo(
           output,
           yes,
-          `Bucket ${bold(name)} not found in ${bold(CONFIG_PATH)}. Do you want to prune it?`,
+          `Bucket ${bold(name)} not found in ${bold(configPath)}. Do you want to prune it?`,
           false,
           interactive,
         );
     if (!prune) {
       if (promptless) {
         yield* output.raw(
-          `Keeping vector bucket ${bold(name)}: not declared in ${bold(CONFIG_PATH)}. Run ${bold("supabase seed buckets")} to prune.\n`,
+          `Keeping vector bucket ${bold(name)}: not declared in ${bold(configPath)}. Run ${bold("supabase seed buckets")} to prune.\n`,
           "stderr",
         );
       }
@@ -475,6 +491,7 @@ const upsertAnalyticsBuckets = Effect.fnUntraced(function* (
   gateway: StorageGateway,
   configuredNames: ReadonlyArray<string>,
   summary: SeedSummary,
+  configPath: string,
 ) {
   const existing = yield* gateway.listAnalyticsBuckets;
   const existingSet = new Set(existing);
@@ -497,14 +514,14 @@ const upsertAnalyticsBuckets = Effect.fnUntraced(function* (
       : yield* promptYesNo(
           output,
           yes,
-          `Bucket ${bold(name)} not found in ${bold(CONFIG_PATH)}. Do you want to prune it?`,
+          `Bucket ${bold(name)} not found in ${bold(configPath)}. Do you want to prune it?`,
           false,
           interactive,
         );
     if (!prune) {
       if (promptless) {
         yield* output.raw(
-          `Keeping analytics bucket ${bold(name)}: not declared in ${bold(CONFIG_PATH)}. Run ${bold("supabase seed buckets")} to prune.\n`,
+          `Keeping analytics bucket ${bold(name)}: not declared in ${bold(configPath)}. Run ${bold("supabase seed buckets")} to prune.\n`,
           "stderr",
         );
       }
@@ -527,6 +544,7 @@ const planHostedWrites = Effect.fnUntraced(function* (
   config: CliConfig,
   propsByName: ReadonlyMap<string, UpsertBucketProps>,
   existingBuckets: ReadonlyArray<ExistingBucket>,
+  configPath: string,
 ) {
   const details: Array<string> = [];
   const existing = new Set(existingBuckets.map((bucket) => bucket.name));
@@ -553,7 +571,7 @@ const planHostedWrites = Effect.fnUntraced(function* (
     const pruned = [...present].filter((name) => !declared.includes(name));
     if (created.length > 0) details.push(`Create analytics buckets: ${joinNames(created)}`);
     if (pruned.length > 0) {
-      details.push(`Delete analytics buckets not declared in ${CONFIG_PATH}: ${joinNames(pruned)}`);
+      details.push(`Delete analytics buckets not declared in ${configPath}: ${joinNames(pruned)}`);
     }
   }
 
@@ -574,7 +592,7 @@ const planHostedWrites = Effect.fnUntraced(function* (
       const pruned = listed.value.filter((name) => !declaredVector.includes(name));
       if (created.length > 0) details.push(`Create vector buckets: ${joinNames(created)}`);
       if (pruned.length > 0) {
-        details.push(`Delete vector buckets not declared in ${CONFIG_PATH}: ${joinNames(pruned)}`);
+        details.push(`Delete vector buckets not declared in ${configPath}: ${joinNames(pruned)}`);
       }
     }
   }
diff --git a/apps/cli/src/command-internal/stack-api.ts b/apps/cli/src/command-internal/stack-api.ts
index a69db5c5ad..38c191188b 100644
--- a/apps/cli/src/command-internal/stack-api.ts
+++ b/apps/cli/src/command-internal/stack-api.ts
@@ -1,4 +1,5 @@
-import { Context, Crypto, Effect, FileSystem, Layer, Option, Path, Scope } from "effect";
+import { Context, Effect, FileSystem, Layer, Option, Path, Scope } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { FetchHttpClient, HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
 import {
@@ -39,14 +40,16 @@ export const stackApiLayer = Layer.effect(
   Effect.gen(function* () {
     const fileSystem = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
+    const digest = yield* Digest.Digest;
     const childProcess = yield* ChildProcessSpawner.ChildProcessSpawner;
     const http = yield* HttpClient.HttpClient;
     const provideServices = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
       effect.pipe(
         Effect.provideService(FileSystem.FileSystem, fileSystem),
         Effect.provideService(Path.Path, path),
-        Effect.provideService(Crypto.Crypto, crypto),
+        Effect.provideService(SecureRandom.SecureRandom, crypto),
+        Effect.provideService(Digest.Digest, digest),
         Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, childProcess),
         Effect.provideService(HttpClient.HttpClient, http),
       );
diff --git a/apps/cli/src/command-internal/stack-auth-config.ts b/apps/cli/src/command-internal/stack-auth-config.ts
index 524c0644b8..dc594fc690 100644
--- a/apps/cli/src/command-internal/stack-auth-config.ts
+++ b/apps/cli/src/command-internal/stack-auth-config.ts
@@ -74,6 +74,7 @@ export const resolveAuthConfig = Effect.fn("StackAuthConfig.resolve")(
           double_confirm_changes: auth.email.double_confirm_changes,
           enable_confirmations: auth.email.enable_confirmations,
           secure_password_change: auth.email.secure_password_change,
+          require_current_password: auth.email.require_current_password,
           max_frequency: auth.email.max_frequency,
           otp_length: auth.email.otp_length,
           otp_expiry: auth.email.otp_expiry,
diff --git a/apps/cli/src/command-internal/stack-bootstrap.ts b/apps/cli/src/command-internal/stack-bootstrap.ts
index 6c7724111d..efb82990b2 100644
--- a/apps/cli/src/command-internal/stack-bootstrap.ts
+++ b/apps/cli/src/command-internal/stack-bootstrap.ts
@@ -4,7 +4,7 @@ import { Output } from "../shared/output/output.service.ts";
 import { applyDatabaseWebhooks, ensureStackWebhookSchema } from "./db-bootstrap/db-setup.ts";
 import { parseConnectionString } from "./db-config.parse.ts";
 import { DbConnection, type DbSession } from "./db-connection.service.ts";
-import type { DbTomlValues } from "./db-config.toml-read.ts";
+import type { DbConfigValues } from "./db-config.read.ts";
 import { migrateAndSeed } from "./migrate-and-seed.ts";
 import { StackCatalogSetup, type StackCatalogSetupInput } from "./stack-catalog-setup.ts";
 
@@ -86,8 +86,8 @@ export const applyStackWebhooksOnly = (
 interface StackMigrations {
   readonly workdir: string;
   readonly toml: Pick<
-    DbTomlValues,
-    "migrationsEnabled" | "seed" | "pgDelta" | "schemaPaths" | "webhooksEnabled"
+    DbConfigValues,
+    "migrationsEnabled" | "seed" | "pgDelta" | "schemaPaths" | "webhooksEnabled" | "configFile"
   >;
   readonly experimental: boolean;
   /** Applies migrations up to this version; omitted applies all of them. */
@@ -116,6 +116,7 @@ const applyStackMigrateAndSeed = (
           pgDeltaEnabled: toml.pgDelta.enabled,
           schemaPaths: toml.schemaPaths,
           localDatabaseWebhooksEnabled: toml.webhooksEnabled,
+          configFile: toml.configFile,
         });
       }),
     "postgres",
@@ -123,7 +124,7 @@ const applyStackMigrateAndSeed = (
 
 /** The catalog overlay declared by a project's `config.toml`. */
 export const projectCatalogOverlay = (
-  toml: Pick<DbTomlValues, "webhooksEnabled" | "baseline" | "vault">,
+  toml: Pick<DbConfigValues, "webhooksEnabled" | "baseline" | "vault">,
   workdir: string,
 ): StackCatalogSetupInput["overlay"] => ({
   webhooks: "config",
diff --git a/apps/cli/src/command-internal/stack-catalog-setup.integration.test.ts b/apps/cli/src/command-internal/stack-catalog-setup.integration.test.ts
index dac1a0cd9e..a750f7389b 100644
--- a/apps/cli/src/command-internal/stack-catalog-setup.integration.test.ts
+++ b/apps/cli/src/command-internal/stack-catalog-setup.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Deferred,
@@ -357,7 +357,7 @@ describe("stack catalog setup", { timeout: 180_000 }, () => {
               buildOutput.layer,
               stackCatalogSetupLayer,
               dbConnectionLayer,
-            ).pipe(Layer.provideMerge(BunServices.layer)),
+            ).pipe(Layer.provideMerge(Layer.merge(BunServices.layer, BunCrypto.layer))),
           ),
         );
       },
diff --git a/apps/cli/src/command-internal/stack-config.precedence.integration.test.ts b/apps/cli/src/command-internal/stack-config.precedence.integration.test.ts
index bdaf084706..a7f8d75890 100644
--- a/apps/cli/src/command-internal/stack-config.precedence.integration.test.ts
+++ b/apps/cli/src/command-internal/stack-config.precedence.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, it } from "@effect/vitest";
 import { ConfigProvider, Effect, FileSystem, Layer, Path } from "effect";
 
@@ -153,6 +153,7 @@ describe("stack config precedence goldens", () => {
 
         const layer = Layer.mergeAll(
           BunServices.layer,
+          BunCrypto.layer,
           runtimeInfoLayer,
           mockCommandSettings({ workdir, supabaseHome: workdir }),
           cliConfigValuesTestLayer,
diff --git a/apps/cli/src/command-internal/stack-config.ts b/apps/cli/src/command-internal/stack-config.ts
index 2f89f78f36..23c8f839e7 100644
--- a/apps/cli/src/command-internal/stack-config.ts
+++ b/apps/cli/src/command-internal/stack-config.ts
@@ -8,7 +8,8 @@ import {
 } from "@supabase/stack/defaults";
 import { type ServiceCreationInput as ServiceCreationType } from "@supabase/stack/effect";
 import { type ArtifactSelection } from "@supabase/stack/internal/artifacts";
-import { Crypto, Effect, Data, FileSystem, Option, Path, Redacted, Schema } from "effect";
+import { Effect, Data, FileSystem, Option, Path, Redacted, Schema } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { FetchHttpClient } from "effect/http";
 
 import { CliConfigKeys, type AnyCliConfigKey } from "../config/cli-config-keys.ts";
@@ -20,6 +21,7 @@ import type {
 import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
 import { CLI_VERSION } from "../shared/cli/version.ts";
 import { decryptSecretMap } from "../shared/config/vault-decrypt.ts";
+import { toEdgeRuntimeSecretsEnv } from "../shared/functions/functions-config.ts";
 import {
   describeConfigLoadFailure,
   loadResolvedConfigContext,
@@ -42,6 +44,7 @@ import {
   resolveAuthExternalProviders,
 } from "./local-config-values.ts";
 import { generateAsymmetricLocalJwt } from "./local-jwt.ts";
+import { resolveEmailTemplatePaths } from "./config-validate.ts";
 import { recordOrioleDbTelemetry } from "./db-image.ts";
 import {
   resolveRemoteJwks,
@@ -96,7 +99,7 @@ type StackConfigEffect<E, R> = Effect.Effect<
   | FileSystem.FileSystem
   | Path.Path
   | RuntimeInfo
-  | Crypto.Crypto
+  | SecureRandom.SecureRandom
   | CommandSettings
   | CliConfigValues
   | R
@@ -118,7 +121,7 @@ interface StackConfigOptions<E, R> {
   ) => Effect.Effect<
     ArtifactSelection,
     StackConfigError | LockResolutionError | E,
-    FileSystem.FileSystem | Path.Path | Crypto.Crypto | R
+    FileSystem.FileSystem | Path.Path | SecureRandom.SecureRandom | R
   >;
   /** Fails with `frozen-missing` when there is no `supabase/config.toml` to lock. */
   readonly frozen?: boolean;
@@ -231,14 +234,6 @@ const firstDifference = (left: unknown, right: unknown, path: string): string |
 
 const configValidationError = (config: CliConfig): string | undefined => {
   const defaults = getDefaultCliConfig();
-  if (config.auth.enabled) {
-    for (const [name, template] of Object.entries(config.auth.email.template))
-      if (template.content_path !== "")
-        return `auth.email.template.${name}.content_path requires template serving, which is not supported by the experimental stack`;
-    for (const [name, notification] of Object.entries(config.auth.email.notification))
-      if (notification.enabled && notification.content_path !== "")
-        return `auth.email.notification.${name}.content_path requires template serving, which is not supported by the experimental stack`;
-  }
   for (const { path, active } of unsupportedConfigPaths) {
     if (!active(config)) continue;
     const value = pathValue(config, path);
@@ -467,13 +462,13 @@ export const loadStackConfig = Effect.fn("StackConfig.load")(
           ),
         catch: (cause) => new StackConfigError({ message: String(cause) }),
       });
+      const resolvedSecrets = yield* resolveConfigSubtree(
+        resolvedConfig,
+        validatedConfig.edge_runtime.secrets ?? {},
+        "edge_runtime.secrets",
+      ).pipe(Effect.mapError(toStackConfigError));
       const functionsEnvResult = decryptSecretMap(
-        Object.fromEntries(
-          Object.entries(validatedConfig.edge_runtime.secrets ?? {}).map(([key, value]) => [
-            key,
-            value ?? "",
-          ]),
-        ),
+        toEdgeRuntimeSecretsEnv(resolvedSecrets),
         resolvedConfig.dotenvPrivateKeys,
       );
       if (!functionsEnvResult.ok)
@@ -544,10 +539,48 @@ export const loadStackConfig = Effect.fn("StackConfig.load")(
         config: {},
         endpoints: { http: endpoint(undefined) },
       };
+      const { template, notification } = validatedConfig.auth.email;
+      const emailTemplates = Effect.forEach(
+        !validatedConfig.auth.enabled
+          ? []
+          : [
+              ...Object.entries(template).map(([name, entry]) => ({
+                section: "template" as const,
+                name,
+                id: name,
+                contentPath: entry.content_path,
+              })),
+              ...Object.entries(notification)
+                .filter(([, entry]) => entry.enabled)
+                .map(([name, entry]) => ({
+                  section: "notification" as const,
+                  name,
+                  id: `${name}_notification`,
+                  contentPath: entry.content_path,
+                })),
+            ],
+        ({ section, name, id, contentPath }) =>
+          resolveEmailTemplatePaths({
+            section,
+            name,
+            contentPath,
+            contentPresent: false,
+            base: projectRoot,
+          }).pipe(
+            Effect.map((paths) =>
+              paths === undefined ? [] : [{ id, path: paths.candidate, root: projectRoot }],
+            ),
+          ),
+      ).pipe(
+        Effect.map((templates) => templates.flat()),
+        Effect.provideService(FileSystem.FileSystem, yield* FileSystem.FileSystem),
+        Effect.provideService(Path.Path, path),
+        Effect.mapError(toStackConfigError),
+      );
       const createCreations = (
         stackId: string,
       ): Effect.Effect<ReadonlyArray<ServiceCreationType>, StackConfigError> =>
-        Effect.sync(() => {
+        Effect.map(emailTemplates, (templates) => {
           return [
             {
               service: "database",
@@ -617,6 +650,7 @@ export const loadStackConfig = Effect.fn("StackConfig.load")(
                     config: {
                       ...authConfig,
                       ...(jwtSecret === undefined ? {} : { jwtSecret: Redacted.value(jwtSecret) }),
+                      ...(templates.length === 0 ? {} : { templates }),
                     },
                     endpoints: { http: endpoint(apiPort) },
                   } satisfies ServiceCreationType,
diff --git a/apps/cli/src/command-internal/stack-functions-env.ts b/apps/cli/src/command-internal/stack-functions-env.ts
index 4d7c33290e..09924f91a3 100644
--- a/apps/cli/src/command-internal/stack-functions-env.ts
+++ b/apps/cli/src/command-internal/stack-functions-env.ts
@@ -1,73 +1,27 @@
-import { Data, Effect, FileSystem, Predicate } from "effect";
+import { Effect, Option } from "effect";
 import type { ServiceCreationInput } from "@supabase/stack/effect";
-import { parseDotEnv } from "../shared/config/dotenv.ts";
-import {
-  actionability,
-  type CliErrorActionabilityDeclaration,
-  ErrorActionabilityId,
-} from "../shared/telemetry/error-actionability.ts";
+import { resolveFunctionsEnv } from "../shared/functions/functions-config.ts";
 
-export class StackFunctionsEnvError extends Data.TaggedError("StackFunctionsEnvError")<{
-  readonly message: string;
-  readonly path: string;
-  readonly cause?: unknown;
-}> {
-  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
-    return actionability.invalidConfig;
-  }
-}
-
-/** Reads a Functions dotenv file and removes reserved Stack-provided variables. */
-export const readStackFunctionsEnv = Effect.fn("StackFunctionsEnv.read")(function* (
-  filePath: string,
-  optional: boolean,
-) {
-  const fs = yield* FileSystem.FileSystem;
-  const contents = yield* fs.readFileString(filePath).pipe(
-    Effect.catchTag("PlatformError", (error) =>
-      optional && Predicate.isTagged(error.reason, "NotFound")
-        ? Effect.succeed("")
-        : Effect.fail(
-            new StackFunctionsEnvError({
-              path: filePath,
-              message: `Unable to load environment file ${filePath}: ${error.message}`,
-              cause: error,
-            }),
-          ),
-    ),
-  );
-  const parsed = yield* Effect.try({
-    try: () => parseDotEnv(contents),
-    catch: (cause) =>
-      new StackFunctionsEnvError({
-        path: filePath,
-        message: `Unable to parse environment file ${filePath}: ${cause instanceof Error ? cause.message : String(cause)}`,
-        cause,
-      }),
-  });
-  const env = Object.fromEntries(
-    Object.entries(parsed).filter(([key]) => !key.startsWith("SUPABASE_")),
-  );
-  if (Object.keys(env).some((key) => !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)))
-    return yield* new StackFunctionsEnvError({
-      path: filePath,
-      message: `Environment names in ${filePath} must start with a letter or underscore and contain only letters, digits, and underscores.`,
-    });
-  if (Object.values(env).some((value) => /[\0\r\n]/u.test(value)))
-    return yield* new StackFunctionsEnvError({
-      path: filePath,
-      message: `Multiline environment values in ${filePath} are not supported by the stack backend.`,
-    });
-  return env;
-});
-
-/** Adds the project Functions dotenv values to a Functions creation; configured values win. */
-export const withProjectFunctionsEnv = (creation: ServiceCreationInput) =>
+/** Adds the project Functions env, plus `debug` when set, to a Functions creation. */
+export const withProjectFunctionsConfig = (
+  creation: ServiceCreationInput,
+  options: { readonly warn: boolean; readonly debug: boolean },
+) =>
   creation.service === "functions"
-    ? readStackFunctionsEnv(`${creation.config.functionsRoot}/.env`, true).pipe(
-        Effect.map((env): ServiceCreationInput => ({
+    ? resolveFunctionsEnv({
+        secrets: creation.config.env ?? {},
+        functionsDir: creation.config.functionsRoot,
+        envFile: Option.none(),
+        functionSlugs: [],
+        warn: options.warn,
+      }).pipe(
+        Effect.map(({ shared }): ServiceCreationInput => ({
           ...creation,
-          config: { ...creation.config, env: { ...env, ...creation.config.env } },
+          config: {
+            ...creation.config,
+            env: shared,
+            ...(options.debug ? { debug: true } : {}),
+          },
         })),
       )
     : Effect.succeed(creation);
diff --git a/apps/cli/src/command-internal/stack-local-database.ts b/apps/cli/src/command-internal/stack-local-database.ts
index ed610c193c..969b7ac379 100644
--- a/apps/cli/src/command-internal/stack-local-database.ts
+++ b/apps/cli/src/command-internal/stack-local-database.ts
@@ -14,7 +14,7 @@ import { currentStackBackend } from "./stack-backend.ts";
 import { StackApi } from "./stack-api.ts";
 import { loadStackConfig } from "./stack-config.ts";
 import { lockedSelection } from "./stack-lock.ts";
-import { readDbToml } from "./db-config.toml-read.ts";
+import { readDbConfig } from "./db-config.read.ts";
 import { catalogDatabaseServices } from "./stack-catalog-setup.ts";
 import { resolveExperimentalWithProjectEnv } from "./global-flags.ts";
 import {
@@ -230,7 +230,7 @@ export const stackEnsurePostgresOnlyStarted = Effect.fn(
   const config = yield* loadStackConfig(settings.workdir, {
     selection: lockedSelection({ frozen: false, output }),
   }).pipe(Effect.mapError(startFailed));
-  const toml = yield* readDbToml(fs, path, settings.workdir).pipe(Effect.mapError(startFailed));
+  const toml = yield* readDbConfig(fs, path, settings.workdir).pipe(Effect.mapError(startFailed));
   const experimental = yield* resolveExperimentalWithProjectEnv({ ...toml.projectEnv });
   const existing = yield* stackForProject(api, settings, path).pipe(Effect.mapError(startFailed));
   const keys =
diff --git a/apps/cli/src/command-internal/stack-lock.integration.test.ts b/apps/cli/src/command-internal/stack-lock.integration.test.ts
index d5f5aef027..adfedc24ed 100644
--- a/apps/cli/src/command-internal/stack-lock.integration.test.ts
+++ b/apps/cli/src/command-internal/stack-lock.integration.test.ts
@@ -1,8 +1,9 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { LOCK_SCHEMA_URL, writeLock, type Lock } from "@supabase/stack/effect";
 import type { ArtifactPin } from "@supabase/stack/internal/artifacts";
-import { Crypto, Effect, FileSystem, Path } from "effect";
+import { Effect, FileSystem, Path } from "effect";
+import { Digest } from "effect/crypto";
 
 import {
   database15,
@@ -22,12 +23,12 @@ import { selectionForRequest } from "./stack-project-selection.ts";
 const inProject = <A, E>(
   body: (
     projectRoot: string,
-  ) => Effect.Effect<A, E, FileSystem.FileSystem | Path.Path | Crypto.Crypto>,
+  ) => Effect.Effect<A, E, FileSystem.FileSystem | Path.Path | Digest.Digest>,
 ) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     return yield* body(yield* fs.makeTempDirectoryScoped({ prefix: "stack-lock-int-" }));
-  }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+  }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const requestFor = (
   projectRoot: string,
diff --git a/apps/cli/src/command-internal/stack-lock.ts b/apps/cli/src/command-internal/stack-lock.ts
index 2cd70b06bc..17eb781389 100644
--- a/apps/cli/src/command-internal/stack-lock.ts
+++ b/apps/cli/src/command-internal/stack-lock.ts
@@ -29,7 +29,6 @@ import {
 import {
   Clock,
   Config,
-  Crypto,
   DateTime,
   Effect,
   FileSystem,
@@ -39,6 +38,7 @@ import {
   Result,
   Schema,
 } from "effect";
+import { Digest } from "effect/crypto";
 import { FetchHttpClient } from "effect/http";
 
 import { ensureGitignore, readProjectLink } from "../shared/config/project-link.ts";
@@ -747,7 +747,7 @@ export const withProjectLease = <A, E, R>(projectRoot: string, effect: Effect.Ef
   holdLease(projectRoot).pipe(Effect.andThen(effect), Effect.scoped);
 
 /**
- * Fails a project without `supabase/config.toml` that is frozen, explicitly or by `CI` with a
+ * Fails a project without a config file that is frozen, explicitly or by `CI` with a
  * lock present: with no config the lock cannot be checked, so the bundled versions must not
  * silently stand in for it. An explicitly frozen project with no lock fails on the missing lock.
  */
@@ -758,7 +758,7 @@ export const rejectFrozenWithoutConfig = Effect.fn("StackLock.rejectFrozenWithou
     if (Option.isSome(lock))
       return yield* new LockResolutionError({
         reason: "frozen-missing",
-        message: `supabase/config.toml not found, so ${LOCK_FILE} cannot be checked; commit supabase/config.toml next to it`,
+        message: `supabase/config.toml, config.json or config.jsonc not found, so ${LOCK_FILE} cannot be checked; commit your config file next to it`,
       });
     if (frozen)
       return yield* new LockResolutionError({
@@ -1000,7 +1000,7 @@ export const lockedResolution = (options: {
   ): Effect.fn.Return<
     LockedResolution,
     StackConfigError | LockResolutionError,
-    FileSystem.FileSystem | Path.Path | Crypto.Crypto
+    FileSystem.FileSystem | Path.Path | Digest.Digest
   > {
     const requests = yield* requestsOf(request);
     const ci = yield* continuousIntegration;
@@ -1111,7 +1111,7 @@ export const updatedLock = <E, R>(options: {
   ): Effect.fn.Return<
     LockUpdate,
     StackConfigError | LockResolutionError | E,
-    FileSystem.FileSystem | Path.Path | Crypto.Crypto | CommandSettings | R
+    FileSystem.FileSystem | Path.Path | Digest.Digest | CommandSettings | R
   > {
     const requests = yield* requestsOf(request);
     const { update, published } = yield* Effect.gen(function* () {
@@ -1266,7 +1266,7 @@ export const linkedLock = <E, R, E2, R2>(options: {
   ): Effect.fn.Return<
     LinkedLock,
     StackConfigError | LockResolutionError | E | E2,
-    FileSystem.FileSystem | Path.Path | Crypto.Crypto | CommandSettings | R | R2
+    FileSystem.FileSystem | Path.Path | Digest.Digest | CommandSettings | R | R2
   > {
     const requests = yield* requestsOf(request);
     const ci = yield* continuousIntegration;
@@ -1390,7 +1390,7 @@ export const outdatedServices = Effect.fn("StackLock.outdated")(function* (reque
     const newest: Effect.Effect<
       ResolvedPin | undefined,
       StackConfigError | LockResolutionError,
-      Crypto.Crypto
+      Digest.Digest
     > =
       reason !== undefined || isExactRelease(requested)
         ? Effect.undefined
diff --git a/apps/cli/src/command-internal/stack-log-events.ts b/apps/cli/src/command-internal/stack-log-events.ts
index f8ef296b09..e8c483a79c 100644
--- a/apps/cli/src/command-internal/stack-log-events.ts
+++ b/apps/cli/src/command-internal/stack-log-events.ts
@@ -5,7 +5,10 @@ import type { StreamEvent } from "../shared/output/types.ts";
 export type LogSource = "history" | "live";
 
 /** The `log-entry` or `log-marker` event of a record. */
-export const logEvent = (record: StackLogRecord, source: LogSource): StreamEvent => {
+export const logEvent = (
+  record: StackLogRecord,
+  source: LogSource,
+): Extract<StreamEvent, { readonly type: "log-entry" | "log-marker" }> => {
   const subject = { service: record.service, instance_id: record.instanceId };
   if (record.kind === "stdout" || record.kind === "stderr")
     return {
diff --git a/apps/cli/src/command-internal/stack-shadow.integration.test.ts b/apps/cli/src/command-internal/stack-shadow.integration.test.ts
index d16481ab95..c90e162bf9 100644
--- a/apps/cli/src/command-internal/stack-shadow.integration.test.ts
+++ b/apps/cli/src/command-internal/stack-shadow.integration.test.ts
@@ -5,7 +5,7 @@ import {
   type Stack,
 } from "@supabase/stack/effect";
 import { CliConfigSchema } from "@supabase/config";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Deferred, Effect, FileSystem, Layer, Option, Path, Ref, Schema } from "effect";
 import { mockOutput } from "../../tests/helpers/mocks.ts";
@@ -327,7 +327,7 @@ describe("stack shadow databases", () => {
           const api = yield* StackApi;
           expect(yield* api.discover({ stateRoot: path.join(root, "stacks") })).toEqual([]);
         }).pipe(Effect.provide(layers));
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     420_000,
   );
 
@@ -370,7 +370,7 @@ describe("stack shadow databases", () => {
         }).pipe(Effect.provide(layers));
         for (const shadowRoot of roots) expect(yield* fs.exists(shadowRoot)).toBe(false);
         expect(output.stderrText).not.toContain("Failed to destroy");
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     180_000,
   );
 
@@ -430,7 +430,7 @@ describe("stack shadow databases", () => {
             }),
           );
         }).pipe(Effect.provide(layers));
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     180_000,
   );
 
@@ -467,7 +467,7 @@ describe("stack shadow databases", () => {
         expect(output.stderrText).not.toContain("Failed to destroy");
         expect(roots).toHaveLength(1);
         for (const root of roots) expect(yield* fs.exists(root)).toBe(false);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     120_000,
   );
 
@@ -506,7 +506,7 @@ describe("stack shadow databases", () => {
                 ),
             });
           }),
-        ).pipe(Layer.provide(stackApiLayer), Layer.provide(BunServices.layer));
+        ).pipe(Layer.provide(stackApiLayer), Layer.provide([BunServices.layer, BunCrypto.layer]));
 
         yield* stackWithShadowDatabase(input(fs, path, root), () => Effect.void, {
           runtime: "native",
@@ -616,7 +616,7 @@ describe("stack shadow databases", () => {
         );
 
         expect(pins).toEqual([target.pin]);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   }
 
@@ -731,7 +731,7 @@ describe("stack shadow databases", () => {
         );
 
         expect(pins).toEqual([remote.pin]);
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   }
 
@@ -767,6 +767,6 @@ describe("stack shadow databases", () => {
         "db.orioledb_version (or SUPABASE_DB_ORIOLEDB_VERSION) = 17.0.0.000 is not an OrioleDB build this CLI ships",
       );
       expect(roots).toEqual([]);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/command-internal/stack-storage.native.integration.test.ts b/apps/cli/src/command-internal/stack-storage.native.integration.test.ts
index 77f0170d10..8dbc746934 100644
--- a/apps/cli/src/command-internal/stack-storage.native.integration.test.ts
+++ b/apps/cli/src/command-internal/stack-storage.native.integration.test.ts
@@ -1,6 +1,7 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Crypto, Effect, FileSystem, Layer, Option, Path, Stream } from "effect";
+import { Effect, FileSystem, Layer, Option, Path, Stream } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { FetchHttpClient } from "effect/http";
 
 import { CommandPlatformApiFactory } from "../auth/command-platform-api-factory.service.ts";
@@ -12,11 +13,7 @@ import {
   stackStorageEndpointFor,
 } from "./stack-storage.ts";
 import { makeStorageGateway } from "./storage-gateway.ts";
-import {
-  StackApi,
-  stackApiLayer,
-  stackTargetResolverLayer,
-} from "../commands/experimental/stack/stack.shared.ts";
+import { StackApi, stackApiLayer, stackTargetResolverLayer } from "./stack-target.ts";
 import {
   mockCommandSettings,
   mockTelemetryStateTracked,
@@ -25,7 +22,7 @@ import { mockOutput, mockTty } from "../../tests/helpers/mocks.ts";
 import { CliArgs } from "../shared/cli/cli-args.service.ts";
 import { stdinLayer } from "../shared/runtime/stdin.layer.ts";
 import { runtimeInfoLayer } from "../shared/runtime/runtime-info.layer.ts";
-import { ExperimentalFlag, YesFlag } from "./global-flags.ts";
+import { DebugFlag, ExperimentalFlag, YesFlag } from "./global-flags.ts";
 import { stackStart } from "../commands/experimental/stack/start/start.handler.ts";
 import { destroyTestStacks } from "../../tests/helpers/stack-cleanup.ts";
 import { cliConfigValuesTestLayer } from "../../tests/helpers/config-values-layer.ts";
@@ -92,6 +89,7 @@ const makeLayers = (root: string) => {
     stackCatalogSetupLayer,
     dbConnectionLayer,
     Layer.succeed(ExperimentalFlag, false),
+    Layer.succeed(DebugFlag, false),
     Layer.succeed(YesFlag, false),
     Layer.succeed(CliArgs, { args: ["stack", "start"] }),
     Layer.succeed(CommandPlatformApiFactory, { make: Effect.die("unused") }),
@@ -134,8 +132,8 @@ describe("native stack Storage gateway", () => {
               apiKey: credentials.apiKey,
               userAgent: "stack-storage-native-integration",
             });
-            const crypto = yield* Crypto.Crypto;
-            const bucket = `native-${(yield* crypto.randomUUIDv4).slice(0, 8)}`;
+            const crypto = yield* SecureRandom.SecureRandom;
+            const bucket = `native-${(yield* crypto.uuidV4()).slice(0, 8)}`;
             const local = path.join(root, "payload.txt");
             yield* fs.writeFileString(local, "native storage payload");
 
@@ -181,7 +179,7 @@ describe("native stack Storage gateway", () => {
             yield* destroyTestStacks(api, path.join(root, "stacks"), path.join(root, "cache"));
           }),
         ).pipe(Effect.provide(layers));
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     { timeout: 180_000 },
   );
 });
diff --git a/apps/cli/src/command-internal/stack-storage.ts b/apps/cli/src/command-internal/stack-storage.ts
index 45b8fc9d84..3b0cec84c5 100644
--- a/apps/cli/src/command-internal/stack-storage.ts
+++ b/apps/cli/src/command-internal/stack-storage.ts
@@ -3,7 +3,7 @@
  * endpoint; lazy Storage members may be woken by the first gateway request.
  */
 
-import { Data, Effect, Match, Option, Path } from "effect";
+import { Data, Effect, FileSystem, Match, Option, Path } from "effect";
 import type { Observation, ServiceInstance, Stack } from "@supabase/stack/effect";
 import {
   actionability,
@@ -17,10 +17,18 @@ import { stackOpenProjectBy } from "./stack-local-database.ts";
 import { sanitizeInlineName } from "./http-errors.ts";
 import { StorageGatewayStatusError } from "./storage-gateway.errors.ts";
 import type { StorageCredentials } from "./storage-credentials.ts";
+import { type ConfigFileRef, configSetting } from "./config-advice.ts";
+import { findConfigFileRef } from "./config-file-ref.ts";
 
 const INSPECT_OR_RESTART_SUGGESTION =
   "Run supabase stack status to inspect the stack, or supabase stack restart.";
 
+/** The instruction to enable Storage; without a known config file it stays format-neutral. */
+export const enableStorageAdvice = (configFile: ConfigFileRef | undefined): string =>
+  configFile === undefined
+    ? "Set `storage.enabled` to `true` in your config file"
+    : `Set ${configSetting(configFile.format, "storage", "enabled", "true")} in ${configFile.path}`;
+
 /** The stack cannot currently be reached to serve Storage requests. */
 export class StackStorageUnavailableError extends Data.TaggedError("StackStorageUnavailableError")<{
   readonly message: string;
@@ -139,6 +147,7 @@ const storageCredentialsFrom = (
 /** Resolves the composition Storage endpoint without launching the owner or any member. */
 export const stackStorageEndpointFor = (
   stack: Stack,
+  configFile?: ConfigFileRef,
 ): Effect.Effect<StorageCredentials, StackStorageUnavailableError | StackStorageCapabilityError> =>
   Effect.gen(function* () {
     const composition = yield* stack.composition.describe.pipe(
@@ -155,8 +164,7 @@ export const stackStorageEndpointFor = (
     if (storage === undefined)
       return yield* new StackStorageCapabilityError({
         message: "Storage is disabled for this stack.",
-        suggestion:
-          "Set [storage] enabled = true in supabase/config.toml, then run supabase start without --exclude storage.",
+        suggestion: `${enableStorageAdvice(configFile)}, then run supabase start without --exclude storage.`,
         disabled: true,
       });
     const database = members.find((instance) => instance.service === "database");
@@ -203,7 +211,7 @@ export const stackStorageEndpointFor = (
 export const stackStorageEndpoint: Effect.Effect<
   StorageCredentials,
   StackStorageUnavailableError | StackStorageCapabilityError,
-  CommandSettings | StackApi | Path.Path
+  CommandSettings | StackApi | Path.Path | FileSystem.FileSystem
 > = Effect.gen(function* () {
   const opened = yield* stackOpenProjectBy(
     (cause) => new StackStorageUnavailableError({ message: cause.message }),
@@ -213,7 +221,9 @@ export const stackStorageEndpoint: Effect.Effect<
       message: "No stack is registered for this project.",
       suggestion: "Run supabase start to create it.",
     });
-  return yield* stackStorageEndpointFor(opened.value);
+  const settings = yield* CommandSettings;
+  const configFile = yield* findConfigFileRef(settings.workdir);
+  return yield* stackStorageEndpointFor(opened.value, configFile);
 }).pipe(Effect.scoped);
 
 /**
@@ -239,7 +249,8 @@ export const withStackStorageGuidance = <A, E, R>(
             message: `The stack gateway returned HTTP ${error.status} for Storage${
               body.length === 0 ? "." : `: ${body}`
             }`,
-            suggestion: "Run supabase stack logs to inspect Storage, then supabase stack restart.",
+            suggestion:
+              "Run supabase logs --service storage to inspect Storage, then supabase stack restart.",
             cause: error,
           }),
         );
diff --git a/apps/cli/src/commands/experimental/stack/stack.shared.ts b/apps/cli/src/command-internal/stack-target.ts
similarity index 96%
rename from apps/cli/src/commands/experimental/stack/stack.shared.ts
rename to apps/cli/src/command-internal/stack-target.ts
index d27ce4fa6c..7c2d502513 100644
--- a/apps/cli/src/commands/experimental/stack/stack.shared.ts
+++ b/apps/cli/src/command-internal/stack-target.ts
@@ -5,17 +5,14 @@ import {
   type StackError,
 } from "@supabase/stack/effect";
 import { Context, Data, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
-import { CommandSettings } from "../../../config/command-settings.service.ts";
+import { CommandSettings } from "../config/command-settings.service.ts";
 import {
   actionability,
   type CliErrorActionabilityDeclaration,
   ErrorActionabilityId,
-} from "../../../shared/telemetry/error-actionability.ts";
-import { StackApi, stackApiLayer } from "../../../command-internal/stack-api.ts";
-import {
-  recordStackRuntimeTelemetry,
-  type StackRuntime,
-} from "../../../command-internal/stack-runtime.ts";
+} from "../shared/telemetry/error-actionability.ts";
+import { StackApi, stackApiLayer } from "./stack-api.ts";
+import { recordStackRuntimeTelemetry, type StackRuntime } from "./stack-runtime.ts";
 
 export { StackApi, stackApiLayer };
 
diff --git a/apps/cli/src/command-internal/status-values.ts b/apps/cli/src/command-internal/status-values.ts
index 530e8146a9..8ffe97b92a 100644
--- a/apps/cli/src/command-internal/status-values.ts
+++ b/apps/cli/src/command-internal/status-values.ts
@@ -239,6 +239,8 @@ export const resolveStatusLocalState = Effect.fnUntraced(function* (
   projectEnvValues?: Readonly<Record<string, string>>,
   /** `LoadedCliConfig.document` — see {@link resolveLocalConfigValues}'s doc comment. */
   document?: Readonly<Record<string, unknown>>,
+  /** The loaded config file's path, so messages name it; `undefined` reads as `config.toml`. */
+  configPath?: string,
   /**
    * An already-resolved {@link resolveLocalConfigValues} result to reuse instead of
    * re-deriving one. Callers that resolved `local` earlier in the same process (e.g.
@@ -250,7 +252,8 @@ export const resolveStatusLocalState = Effect.fnUntraced(function* (
   precomputedLocal?: LocalConfigValues,
 ) {
   const local =
-    precomputedLocal ?? (yield* resolveLocalConfigValues(config, hostname, workdir, document));
+    precomputedLocal ??
+    (yield* resolveLocalConfigValues(config, hostname, workdir, document, configPath));
 
   const apiEnabled = config.api.enabled;
   const studioSectionEnabled = config.studio.enabled;
diff --git a/apps/cli/src/command-internal/storage-credentials.integration.test.ts b/apps/cli/src/command-internal/storage-credentials.integration.test.ts
index 4a8448d787..e9980637e4 100644
--- a/apps/cli/src/command-internal/storage-credentials.integration.test.ts
+++ b/apps/cli/src/command-internal/storage-credentials.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { ConfigProvider, Effect, Layer } from "effect";
 
@@ -33,6 +33,7 @@ describe("resolveStorageCredentials for a remote project", () => {
           mockRuntimeInfo(),
           unusedStackServices,
           BunServices.layer,
+          BunCrypto.layer,
         ),
       ),
     );
diff --git a/apps/cli/src/command-internal/storage-gateway.ts b/apps/cli/src/command-internal/storage-gateway.ts
index 6190f17106..0a8a3d8995 100644
--- a/apps/cli/src/command-internal/storage-gateway.ts
+++ b/apps/cli/src/command-internal/storage-gateway.ts
@@ -147,7 +147,7 @@ function localGatewayHint(port: string): string {
   return (
     "The local Supabase API gateway did not return a valid HTTP response. " +
     `Another process may be listening on the configured API port ${port}. ` +
-    `Check the port with \`lsof -nP -iTCP:${port} -sTCP:LISTEN\`, then stop the conflicting process or set a different \`api.port\` in supabase/config.toml.`
+    `Check the port with \`lsof -nP -iTCP:${port} -sTCP:LISTEN\`, then stop the conflicting process or set a different \`api.port\` in your config file.`
   );
 }
 
diff --git a/apps/cli/src/command-internal/storage-gateway.unit.test.ts b/apps/cli/src/command-internal/storage-gateway.unit.test.ts
index 0ae48a9be2..48fb95bd7b 100644
--- a/apps/cli/src/command-internal/storage-gateway.unit.test.ts
+++ b/apps/cli/src/command-internal/storage-gateway.unit.test.ts
@@ -7,7 +7,7 @@ import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import type * as HttpClientRequest from "effect/http/HttpClientRequest";
 
 import { withEnvVar } from "../../tests/helpers/command-mocks.ts";
-import caProd2021 from "../commands/gen/types/templates/prod-ca-2021.ts";
+import caProd2021 from "./supabase-ca-templates/prod-ca-2021.ts";
 import {
   KONG_LOCAL_TLS_CERT,
   KONG_LOCAL_TLS_KEY,
diff --git a/apps/cli/src/commands/gen/types/templates/prod-ca-2021.ts b/apps/cli/src/command-internal/supabase-ca-templates/prod-ca-2021.ts
similarity index 100%
rename from apps/cli/src/commands/gen/types/templates/prod-ca-2021.ts
rename to apps/cli/src/command-internal/supabase-ca-templates/prod-ca-2021.ts
diff --git a/apps/cli/src/commands/gen/types/templates/prod-ca-2025.ts b/apps/cli/src/command-internal/supabase-ca-templates/prod-ca-2025.ts
similarity index 100%
rename from apps/cli/src/commands/gen/types/templates/prod-ca-2025.ts
rename to apps/cli/src/command-internal/supabase-ca-templates/prod-ca-2025.ts
diff --git a/apps/cli/src/commands/gen/types/templates/staging-ca-2021.ts b/apps/cli/src/command-internal/supabase-ca-templates/staging-ca-2021.ts
similarity index 100%
rename from apps/cli/src/commands/gen/types/templates/staging-ca-2021.ts
rename to apps/cli/src/command-internal/supabase-ca-templates/staging-ca-2021.ts
diff --git a/apps/cli/src/command-internal/supabase-tls.ts b/apps/cli/src/command-internal/supabase-tls.ts
new file mode 100644
index 0000000000..138bdd995d
--- /dev/null
+++ b/apps/cli/src/command-internal/supabase-tls.ts
@@ -0,0 +1,36 @@
+import { getDomain } from "tldts";
+
+import type { PgConnInput } from "./db-connection.service.ts";
+import { isDirectDbHost } from "./pooler-fallback.ts";
+import { poolerHost, projectHost } from "./profile.ts";
+import caProd2021 from "./supabase-ca-templates/prod-ca-2021.ts";
+import caProd2025 from "./supabase-ca-templates/prod-ca-2025.ts";
+import caStaging2021 from "./supabase-ca-templates/staging-ca-2021.ts";
+
+export function rootCaBundle() {
+  return `${caStaging2021}${caProd2021}${caProd2025}`;
+}
+
+/** Built-in profiles whose database servers chain to {@link rootCaBundle}. */
+const PINNED_PROFILES: ReadonlySet<string> = new Set(["supabase", "supabase-staging", "snap"]);
+
+/**
+ * Pins the bundled Supabase CA (`require` plus an inline root CA, which the driver promotes to
+ * `verify-ca`) on a connection to a hosted Supabase database of the active built-in profile. A
+ * root CA set without `sslmode` replaces the bundle but keeps `require`, since the unset default
+ * (`prefer`) would ignore it. A connection that sets `sslmode` from any source, a host outside
+ * the profile's project and pooler domains, and every other profile (`supabase-local`, YAML) are
+ * returned unchanged.
+ */
+export function pinSupabaseTls(conn: PgConnInput, profile: string): PgConnInput {
+  if (!PINNED_PROFILES.has(profile) || conn.sslmode !== undefined) return conn;
+  const host = conn.host.toLowerCase().replace(/\.$/, "");
+  const domain = getDomain(host);
+  const hosted =
+    isDirectDbHost(host, projectHost(profile)) ||
+    (domain !== null && domain.toLowerCase() === poolerHost(profile));
+  if (!hosted) return conn;
+  return conn.sslrootcert !== undefined || conn.sslrootcertInline !== undefined
+    ? { ...conn, sslmode: "require" }
+    : { ...conn, sslmode: "require", sslrootcertInline: rootCaBundle() };
+}
diff --git a/apps/cli/src/command-internal/supabase-tls.unit.test.ts b/apps/cli/src/command-internal/supabase-tls.unit.test.ts
new file mode 100644
index 0000000000..c3bec69a6e
--- /dev/null
+++ b/apps/cli/src/command-internal/supabase-tls.unit.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it } from "vitest";
+
+import type { PgConnInput } from "./db-connection.service.ts";
+import { pinSupabaseTls, rootCaBundle } from "./supabase-tls.ts";
+
+const conn = (host: string, overrides: Partial<PgConnInput> = {}): PgConnInput => ({
+  host,
+  port: 5432,
+  user: "postgres",
+  password: "pw",
+  database: "postgres",
+  ...overrides,
+});
+
+describe("pinSupabaseTls host matching", () => {
+  it.each([
+    "db.ref.supabase.co",
+    "DB.REF.SUPABASE.CO",
+    "db.ref.supabase.co.",
+    "aws-0-us-east-1.pooler.supabase.com",
+    "AWS-0-US-EAST-1.POOLER.SUPABASE.COM.",
+  ])("pins %s", (host) => {
+    expect(pinSupabaseTls(conn(host), "supabase")).toMatchObject({
+      sslmode: "require",
+      sslrootcertInline: rootCaBundle(),
+    });
+  });
+
+  it.each([
+    "db.x.evilsupabase.co",
+    "db.ref.supabase.co.evil.com",
+    "supabase.co",
+    "localhost",
+    "127.0.0.1",
+    "::1",
+    "2600:1f18::1",
+  ])("leaves %s unpinned", (host) => {
+    const input = conn(host);
+    expect(pinSupabaseTls(input, "supabase")).toBe(input);
+  });
+
+  it("leaves a connection that chose its own sslmode unchanged", () => {
+    const input = conn("db.ref.supabase.co", { sslmode: "disable" });
+    expect(pinSupabaseTls(input, "supabase")).toBe(input);
+  });
+
+  it("requires TLS verified against a root CA set without sslmode", () => {
+    const pinned = pinSupabaseTls(
+      conn("db.ref.supabase.co", { sslrootcert: "/ca.pem" }),
+      "supabase",
+    );
+    expect(pinned).toMatchObject({ sslmode: "require", sslrootcert: "/ca.pem" });
+    expect(pinned.sslrootcertInline).toBeUndefined();
+  });
+});
diff --git a/apps/cli/src/command-internal/tabular-output.ts b/apps/cli/src/command-internal/tabular-output.ts
new file mode 100644
index 0000000000..26b670e240
--- /dev/null
+++ b/apps/cli/src/command-internal/tabular-output.ts
@@ -0,0 +1,79 @@
+import { stringWidth } from "./string-width.ts";
+
+// Width counts East Asian Wide as 2 and zero-width/combining as 0, so CJK/emoji cells still
+// align columns and borders; counting JS code points would under-measure them.
+const displayWidth = (text: string): number => stringWidth(text);
+
+/**
+ * Render rows as the established box-layout table (header not upper-cased).
+ * Left aligned, one space of padding each side, Unicode box-drawing borders.
+ * An empty column set renders nothing (established empty-header output).
+ */
+export function renderTablewriter(
+  cols: ReadonlyArray<string>,
+  data: ReadonlyArray<ReadonlyArray<unknown>>,
+  formatCell: (value: unknown, columnIndex: number) => string,
+): string {
+  if (cols.length === 0) return "";
+  const rows = data.map((row) => row.map((cell, columnIndex) => formatCell(cell, columnIndex)));
+  // Column width is the widest visual line, since a multi-line cell splits across stacked lines.
+  const widths = cols.map((col, i) => {
+    let width = displayWidth(col);
+    for (const row of rows) {
+      for (const line of (row[i] ?? "").split("\n")) width = Math.max(width, displayWidth(line));
+    }
+    return width;
+  });
+
+  const segment = (width: number) => "─".repeat(width + 2);
+  const top = `┌${widths.map(segment).join("┬")}┐`;
+  const sep = `├${widths.map(segment).join("┼")}┤`;
+  const bottom = `└${widths.map(segment).join("┴")}┘`;
+  const renderLine = (cells: ReadonlyArray<string>) =>
+    `│${cells
+      .map((cell, i) => {
+        const width = widths[i];
+        return ` ${cell}${width === undefined ? "" : " ".repeat(width - displayWidth(cell))} `;
+      })
+      .join("│")}│`;
+  // A multiline cell splits across stacked bordered lines within the same
+  // logical row (other columns blank on continuation lines), no per-row separator.
+  const renderRow = (cells: ReadonlyArray<string>): string => {
+    const split = cells.map((cell) => cell.split("\n"));
+    const lineCount = Math.max(1, ...split.map((s) => s.length));
+    const visual: string[] = [];
+    for (let j = 0; j < lineCount; j++) {
+      visual.push(renderLine(split.map((s) => s[j] ?? "")));
+    }
+    return visual.join("\n");
+  };
+
+  const lines = [top, renderLine(cols), sep, ...rows.map(renderRow), bottom];
+  return `${lines.join("\n")}\n`;
+}
+
+/** The established CSV field-quoting rule. */
+function csvFieldNeedsQuotes(field: string): boolean {
+  if (field === "") return false;
+  if (field === "\\.") return true;
+  if (/[\n\r",]/.test(field)) return true;
+  return /\s/u.test(field[0] ?? "");
+}
+
+function csvField(field: string): string {
+  if (!csvFieldNeedsQuotes(field)) return field;
+  return `"${field.replaceAll('"', '""')}"`;
+}
+
+/** The established CSV output (RFC4180, `\n` line terminator). */
+export function toCsv(
+  cols: ReadonlyArray<string>,
+  data: ReadonlyArray<ReadonlyArray<unknown>>,
+  formatCell: (value: unknown, columnIndex: number) => string,
+): string {
+  const lines = [cols.map(csvField).join(",")];
+  for (const row of data) {
+    lines.push(row.map((value, columnIndex) => csvField(formatCell(value, columnIndex))).join(","));
+  }
+  return `${lines.join("\n")}\n`;
+}
diff --git a/apps/cli/src/command-internal/target/resolve-project-target.integration.test.ts b/apps/cli/src/command-internal/target/resolve-project-target.integration.test.ts
index 389637ca53..632054924e 100644
--- a/apps/cli/src/command-internal/target/resolve-project-target.integration.test.ts
+++ b/apps/cli/src/command-internal/target/resolve-project-target.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Layer, Option, Path } from "effect";
 
@@ -127,7 +127,9 @@ const runWith = <A, E, R>(
           resolver,
           api.layer,
           mockCommandSettings({ workdir: dir, projectId: Option.none() }),
-          commandRuntimeLayer(["functions", "deploy"]).pipe(Layer.provide(BunServices.layer)),
+          commandRuntimeLayer(["functions", "deploy"]).pipe(
+            Layer.provide([BunServices.layer, BunCrypto.layer]),
+          ),
           options.args === undefined
             ? Layer.empty
             : Layer.succeed(CliArgs, prepareCliArgs(root, options.args)),
@@ -150,7 +152,7 @@ const runWith = <A, E, R>(
       branchRequests: api.requests.length,
       requestedUrls: api.requests.map((request) => request.url),
     };
-  }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+  }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const run = (input: RunInput, options: RunOptions = {}) =>
   runWith(input, options, (flags) => resolveProjectTarget(flags));
diff --git a/apps/cli/src/command-internal/target/resolve-target.integration.test.ts b/apps/cli/src/command-internal/target/resolve-target.integration.test.ts
index 0406d717f4..f8dc4b5d68 100644
--- a/apps/cli/src/command-internal/target/resolve-target.integration.test.ts
+++ b/apps/cli/src/command-internal/target/resolve-target.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -207,7 +207,7 @@ const run = (
       kind: attributes?.get("target.kind"),
       selection: attributes?.get("target.selection"),
     };
-  }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+  }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const succeeded = <A>(exit: Exit.Exit<A, unknown>): A => {
   if (!Exit.isSuccess(exit)) throw new Error(`expected success, got ${stringifyJson(exit)}`);
diff --git a/apps/cli/src/command-internal/target/target-flags.ts b/apps/cli/src/command-internal/target/target-flags.ts
index 00d318ea72..15dbb70973 100644
--- a/apps/cli/src/command-internal/target/target-flags.ts
+++ b/apps/cli/src/command-internal/target/target-flags.ts
@@ -6,7 +6,7 @@ import { REMOTE_FLAG_NAME } from "./remote-vocabulary.ts";
 import type { ResolvedTarget } from "./resolve-target.ts";
 import { remoteFlagText } from "./target-deprecation.ts";
 
-type TargetSubject = "database" | "Storage API";
+type TargetSubject = "database" | "Storage API" | "log source";
 
 interface TargetFlagOptions {
   readonly subject: TargetSubject;
diff --git a/apps/cli/src/command-internal/target/target-password.ts b/apps/cli/src/command-internal/target/target-password.ts
index 7cd076ce5c..529aacb612 100644
--- a/apps/cli/src/command-internal/target/target-password.ts
+++ b/apps/cli/src/command-internal/target/target-password.ts
@@ -1,22 +1,25 @@
 import { Effect, Option } from "effect";
 
+import { configKey } from "../config-advice.ts";
+import { findConfigFileRef } from "../config-file-ref.ts";
+
 import { SUGGEST_LINKED_PROJECT } from "../connect-errors.ts";
 import { TargetPasswordConflictError } from "./target.errors.ts";
 
 /** Fails when a non-empty `--password` accompanies a target that is not a linked project. */
-export const rejectTargetPassword = (
+export const rejectTargetPassword = Effect.fnUntraced(function* (
   target: "local" | "db-url",
   password: Option.Option<string>,
-  linkedCheckout = false,
-): Effect.Effect<void, TargetPasswordConflictError> =>
-  Option.isNone(Option.filter(password, (value) => value.length > 0))
-    ? Effect.void
-    : Effect.fail(
-        new TargetPasswordConflictError({
-          target,
-          message:
-            target === "db-url"
-              ? "--password can't be used with --remote=<db-url>. Put the password in the connection string: postgres://USER:PASSWORD@HOST:PORT/postgres"
-              : `--password only applies to a linked project. The local database uses [db].password from supabase/config.toml.${linkedCheckout ? ` ${SUGGEST_LINKED_PROJECT}` : ""}`,
-        }),
-      );
+  linkedCheckout: boolean,
+  workdir: string,
+) {
+  if (Option.isNone(Option.filter(password, (value) => value.length > 0))) return;
+  const configFile = target === "db-url" ? undefined : yield* findConfigFileRef(workdir);
+  return yield* new TargetPasswordConflictError({
+    target,
+    message:
+      configFile === undefined
+        ? "--password can't be used with --remote=<db-url>. Put the password in the connection string: postgres://USER:PASSWORD@HOST:PORT/postgres"
+        : `--password only applies to a linked project. The local database uses ${configKey(configFile.format, "db", "password")} from ${configFile.path}.${linkedCheckout ? ` ${SUGGEST_LINKED_PROJECT}` : ""}`,
+  });
+});
diff --git a/apps/cli/src/command-internal/test-db.handler.ts b/apps/cli/src/command-internal/test-db.handler.ts
index 05f8b0ca6d..e8289ed013 100644
--- a/apps/cli/src/command-internal/test-db.handler.ts
+++ b/apps/cli/src/command-internal/test-db.handler.ts
@@ -10,7 +10,7 @@ import {
 import { CommandSettings } from "../config/command-settings.service.ts";
 import { TelemetryState } from "../telemetry/telemetry-state.service.ts";
 import { DbConfigResolver } from "./db-config.service.ts";
-import { readDbToml } from "./db-config.toml-read.ts";
+import { readDbConfig } from "./db-config.read.ts";
 import { DbConnection, type PgConnInput } from "./db-connection.service.ts";
 import { LocalDbRunningError } from "./db-bootstrap/local-db-running.ts";
 import { DockerRun } from "./docker-run.service.ts";
@@ -192,7 +192,7 @@ export const testDb = Effect.fn("test.db")(function* (flags: TestDbFlags) {
         ? { _tag: "named" as const, name: networkId }
         : isLocal && backend.kind !== "stack"
           ? yield* Effect.gen(function* () {
-              const toml = yield* readDbToml(fs, path, cliSettings.workdir);
+              const toml = yield* readDbConfig(fs, path, cliSettings.workdir);
               return { _tag: "named" as const, name: `supabase_network_${toml.projectId}` };
             })
           : { _tag: "host" as const };
@@ -289,7 +289,7 @@ export const testDb = Effect.fn("test.db")(function* (flags: TestDbFlags) {
         }
         if (backend.kind === "stack") {
           const bundled = yield* BundledPostgresClient;
-          const toml = yield* readDbToml(fs, path, cliSettings.workdir);
+          const toml = yield* readDbConfig(fs, path, cliSettings.workdir);
           const pin = yield* databaseArtifactPin(String(toml.majorVersion)).pipe(
             Effect.mapError((cause) => new TestDbRunError({ message: cause.message, cause })),
           );
diff --git a/apps/cli/src/command-internal/test-db.layers.unit.test.ts b/apps/cli/src/command-internal/test-db.layers.unit.test.ts
index fd37653934..fa7e111627 100644
--- a/apps/cli/src/command-internal/test-db.layers.unit.test.ts
+++ b/apps/cli/src/command-internal/test-db.layers.unit.test.ts
@@ -8,7 +8,7 @@
  */
 
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer, Option } from "effect";
 
 import {
@@ -77,6 +77,7 @@ function ambientStubs() {
 
   return Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     isolatedHomeLayer(tempRoot.current),
     mockTty(),
     mockProcessControl().layer,
diff --git a/apps/cli/src/command-internal/test-db.native.integration.test.ts b/apps/cli/src/command-internal/test-db.native.integration.test.ts
index e28679863c..df69cbdb4b 100644
--- a/apps/cli/src/command-internal/test-db.native.integration.test.ts
+++ b/apps/cli/src/command-internal/test-db.native.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { FetchHttpClient } from "effect/http";
 import { Cause, Effect, Exit, FileSystem, Layer, Option, Redacted } from "effect";
@@ -33,7 +33,7 @@ import { cliConfigValuesTestLayer } from "../../tests/helpers/config-values-laye
 import { selection } from "../../tests/helpers/pins.ts";
 
 const runtimes = ["native", "docker"] as const;
-const liveStackApi = stackApiLayer.pipe(Layer.provide(BunServices.layer));
+const liveStackApi = stackApiLayer.pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
 
 const databaseCreation = {
   service: "database" as const,
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/a-base-only.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/a-base-only.json
index 69487a0395..76dff623b1 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/a-base-only.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/a-base-only.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/b-matched-remote.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/b-matched-remote.json
index b3411f8000..8201373c7b 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/b-matched-remote.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/b-matched-remote.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/b2-remote-block-without-ref.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/b2-remote-block-without-ref.json
index 69487a0395..76dff623b1 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/b2-remote-block-without-ref.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/b2-remote-block-without-ref.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/c-shell-env.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/c-shell-env.json
index 42ed444410..f8219edbe4 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/c-shell-env.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/c-shell-env.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/d-project-dotenv.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/d-project-dotenv.json
index a8c7202210..d31753b22f 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/d-project-dotenv.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/d-project-dotenv.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/d2-shell-beats-dotenv.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/d2-shell-beats-dotenv.json
index 42ed444410..f8219edbe4 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/d2-shell-beats-dotenv.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/d2-shell-beats-dotenv.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/e-remote-beats-shell.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/e-remote-beats-shell.json
index 5dbaa54e7d..eff666f09d 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/e-remote-beats-shell.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/e-remote-beats-shell.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/e2-remote-beats-dotenv.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/e2-remote-beats-dotenv.json
index 3e04de121e..12238a1728 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/e2-remote-beats-dotenv.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/e2-remote-beats-dotenv.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/f-remote-matched-by-env-project-id.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/f-remote-matched-by-env-project-id.json
index 2f7cf1d7e3..7c86c7eda0 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/f-remote-matched-by-env-project-id.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/f-remote-matched-by-env-project-id.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/f2-remote-env-match-project-id-is-block-literal.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/f2-remote-env-match-project-id-is-block-literal.json
index 2f7cf1d7e3..7c86c7eda0 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/f2-remote-env-match-project-id-is-block-literal.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/f2-remote-env-match-project-id-is-block-literal.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/g-captcha-secret-from-env-only.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/g-captcha-secret-from-env-only.json
index 69487a0395..76dff623b1 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/g-captcha-secret-from-env-only.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/g-captcha-secret-from-env-only.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/h-storage-realtime-env-disable.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/h-storage-realtime-env-disable.json
index 6450d106a5..0f072f9600 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/h-storage-realtime-env-disable.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/h-storage-realtime-env-disable.json
@@ -12,6 +12,10 @@
       "storageEnabled": false,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/i-project-id-env-with-matched-remote.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/i-project-id-env-with-matched-remote.json
index 62551b56f7..1046bb5db1 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/i-project-id-env-with-matched-remote.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/i-project-id-env-with-matched-remote.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/i2-project-id-env-without-remote.json b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/i2-project-id-env-without-remote.json
index 73b419dc35..20f0cd22c2 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/db-toml/i2-project-id-env-without-remote.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/db-toml/i2-project-id-env-without-remote.json
@@ -12,6 +12,10 @@
       "storageEnabled": true,
       "vaultNames": []
     },
+    "configFile": {
+      "format": "toml",
+      "path": "supabase/config.toml"
+    },
     "denoVersion": 2,
     "exposedSchemas": [
       "public",
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/no-overrides.json b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/no-overrides.json
index 31aa4d291e..42b3019a5c 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/no-overrides.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/no-overrides.json
@@ -64,6 +64,7 @@
             "notification": {},
             "otp_expiry": 3600,
             "otp_length": 6,
+            "require_current_password": false,
             "secure_password_change": false,
             "template": {}
           },
@@ -319,6 +320,7 @@
         "notification": {},
         "otp_expiry": 3600,
         "otp_length": 6,
+        "require_current_password": false,
         "secure_password_change": false,
         "smtp": {
           "enabled": false
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/project-dotenv.json b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/project-dotenv.json
index 1ad43f1575..6f4fd64405 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/project-dotenv.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/project-dotenv.json
@@ -55,6 +55,7 @@
             "notification": {},
             "otp_expiry": 3600,
             "otp_length": 6,
+            "require_current_password": false,
             "secure_password_change": false,
             "template": {}
           },
@@ -288,6 +289,7 @@
         "notification": {},
         "otp_expiry": 3600,
         "otp_length": 6,
+        "require_current_password": false,
         "secure_password_change": false,
         "smtp": {
           "enabled": false
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-ignored.json b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-ignored.json
index 4a2f20f873..4c3abc5ee9 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-ignored.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-ignored.json
@@ -64,6 +64,7 @@
             "notification": {},
             "otp_expiry": 3600,
             "otp_length": 6,
+            "require_current_password": false,
             "secure_password_change": false,
             "template": {}
           },
@@ -319,6 +320,7 @@
         "notification": {},
         "otp_expiry": 3600,
         "otp_length": 6,
+        "require_current_password": false,
         "secure_password_change": false,
         "smtp": {
           "enabled": false
@@ -716,6 +718,7 @@
             "notification": {},
             "otp_expiry": 3600,
             "otp_length": 6,
+            "require_current_password": false,
             "secure_password_change": false,
             "smtp": {
               "enabled": false
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-merged-via-context-with-shell-env.json b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-merged-via-context-with-shell-env.json
index 4b6d8a4fcf..6962b0ecc0 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-merged-via-context-with-shell-env.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-merged-via-context-with-shell-env.json
@@ -55,6 +55,7 @@
             "notification": {},
             "otp_expiry": 3600,
             "otp_length": 6,
+            "require_current_password": false,
             "secure_password_change": false,
             "template": {}
           },
@@ -280,6 +281,7 @@
         "notification": {},
         "otp_expiry": 3600,
         "otp_length": 6,
+        "require_current_password": false,
         "secure_password_change": false,
         "smtp": {
           "enabled": false
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-merged-via-context.json b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-merged-via-context.json
index da40f6b4d6..d1258fc988 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-merged-via-context.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/remote-block-merged-via-context.json
@@ -64,6 +64,7 @@
             "notification": {},
             "otp_expiry": 3600,
             "otp_length": 6,
+            "require_current_password": false,
             "secure_password_change": false,
             "template": {}
           },
@@ -304,6 +305,7 @@
         "notification": {},
         "otp_expiry": 3600,
         "otp_length": 6,
+        "require_current_password": false,
         "secure_password_change": false,
         "smtp": {
           "enabled": false
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/shell-beats-dotenv.json b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/shell-beats-dotenv.json
index e8476e18d0..71ea5e2a13 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/shell-beats-dotenv.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/shell-beats-dotenv.json
@@ -55,6 +55,7 @@
             "notification": {},
             "otp_expiry": 3600,
             "otp_length": 6,
+            "require_current_password": false,
             "secure_password_change": false,
             "template": {}
           },
@@ -286,6 +287,7 @@
         "notification": {},
         "otp_expiry": 3600,
         "otp_length": 6,
+        "require_current_password": false,
         "secure_password_change": false,
         "smtp": {
           "enabled": false
diff --git a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/shell-env.json b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/shell-env.json
index 41a7615602..2088819abb 100644
--- a/apps/cli/src/command-internal/testdata/config-precedence/stack-config/shell-env.json
+++ b/apps/cli/src/command-internal/testdata/config-precedence/stack-config/shell-env.json
@@ -55,6 +55,7 @@
             "notification": {},
             "otp_expiry": 3600,
             "otp_length": 6,
+            "require_current_password": false,
             "secure_password_change": false,
             "template": {}
           },
@@ -280,6 +281,7 @@
         "notification": {},
         "otp_expiry": 3600,
         "otp_length": 6,
+        "require_current_password": false,
         "secure_password_change": false,
         "smtp": {
           "enabled": false
diff --git a/apps/cli/src/command-internal/upgrade-notice.ts b/apps/cli/src/command-internal/upgrade-notice.ts
index 9ec18c5941..588cfcdc25 100644
--- a/apps/cli/src/command-internal/upgrade-notice.ts
+++ b/apps/cli/src/command-internal/upgrade-notice.ts
@@ -9,6 +9,7 @@
 
 import { stripVTControlCharacters } from "node:util";
 
+import { findCliProjectRoot } from "@supabase/config/effect";
 import {
   Clock,
   Config,
@@ -197,7 +198,6 @@ const resolveNoticeBaseDir = Effect.fnUntraced(function* (
   env: Readonly<Record<string, string | undefined>>,
   isValueTakingFlagToken?: (token: string) => boolean,
 ) {
-  const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   // A set flag beats the env even when empty; an empty effective value falls
   // through to the ancestor walk.
@@ -206,16 +206,7 @@ const resolveNoticeBaseDir = Effect.fnUntraced(function* (
   if (explicit !== undefined && explicit !== "") {
     return path.resolve(cwd, explicit);
   }
-  let current = cwd;
-  while (true) {
-    for (const configFile of ["config.json", "config.toml"]) {
-      const configPath = path.join(current, "supabase", configFile);
-      if (yield* fs.exists(configPath).pipe(Effect.orElseSucceed(() => false))) return current;
-    }
-    const parent = path.dirname(current);
-    if (parent === current) return cwd;
-    current = parent;
-  }
+  return (yield* findCliProjectRoot(cwd)) ?? cwd;
 });
 
 /**
diff --git a/apps/cli/src/command-internal/workdir-project.ts b/apps/cli/src/command-internal/workdir-project.ts
index 507484650d..81ac899b6c 100644
--- a/apps/cli/src/command-internal/workdir-project.ts
+++ b/apps/cli/src/command-internal/workdir-project.ts
@@ -34,9 +34,9 @@ export function missingProjectConfigMessage(input: {
   readonly explicitWorkdir: boolean;
 }): string {
   if (!input.explicitWorkdir) {
-    return "failed to read supabase/config.toml or supabase/config.json: file not found. Run `supabase init` to create one.";
+    return "failed to read supabase/config.toml, config.json or config.jsonc: file not found. Run `supabase init` to create one.";
   }
-  return `failed to read supabase/config.toml or supabase/config.json in ${sanitizeInlineName(input.workdir)}: file not found. --workdir/SUPABASE_WORKDIR is used exactly as given and no ancestor directory is searched, so it must name the directory that contains your supabase/ folder.`;
+  return `failed to read supabase/config.toml, config.json or config.jsonc in ${sanitizeInlineName(input.workdir)}: file not found. --workdir/SUPABASE_WORKDIR is used exactly as given and no ancestor directory is searched, so it must name the directory that contains your supabase/ folder.`;
 }
 
 /**
diff --git a/apps/cli/src/command-internal/workdir-project.unit.test.ts b/apps/cli/src/command-internal/workdir-project.unit.test.ts
index d82095139a..956cfc29ad 100644
--- a/apps/cli/src/command-internal/workdir-project.unit.test.ts
+++ b/apps/cli/src/command-internal/workdir-project.unit.test.ts
@@ -7,7 +7,7 @@ describe("missingProjectConfigMessage", () => {
     // Pinned byte-for-byte: `diff.e2e.test.ts`/`pull.e2e.test.ts` assert this
     // exact string when run with no `--workdir`.
     expect(missingProjectConfigMessage({ workdir: "/repo/sub", explicitWorkdir: false })).toBe(
-      "failed to read supabase/config.toml or supabase/config.json: file not found. Run `supabase init` to create one.",
+      "failed to read supabase/config.toml, config.json or config.jsonc: file not found. Run `supabase init` to create one.",
     );
   });
 
diff --git a/apps/cli/src/commands/bootstrap/SIDE_EFFECTS.md b/apps/cli/src/commands/bootstrap/SIDE_EFFECTS.md
index 3dfd263281..102f878f26 100644
--- a/apps/cli/src/commands/bootstrap/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/bootstrap/SIDE_EFFECTS.md
@@ -10,28 +10,29 @@ command — see Notes).
 
 ## Files Read
 
-| Path                                                               | Format     | When                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ------------------------------------------------------------------ | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `~/.supabase/access-token`                                         | plain text | ensure-login token miss (env unset and keyring unavailable)                                                                                                                                                                                                                                                                                                                                                                        |
-| `<workdir>/.env.example`                                           | dotenv     | optional; merged into the generated `.env`                                                                                                                                                                                                                                                                                                                                                                                         |
-| `<workdir>/supabase/{.env.<env>.local,.env.local,.env.<env>,.env}` | dotenv     | step I (`loadProjectEnvValues`), before config.toml validation and again inside `checkDbToml`; `<env>` is `SUPABASE_ENV` (default `development`), `.env.local` is skipped when `SUPABASE_ENV=test`; first of the 4 files (in this order) to set a key wins, and this `supabase/` directory tier beats the workdir-root tier below — feeds config.toml `env(VAR)` expansion and the push step's `SUPABASE_YES` auto-confirm default |
-| `<workdir>/{.env.<env>.local,.env.local,.env.<env>,.env}`          | dotenv     | same read as above; lower-precedence fallback tier, only consulted for a key none of the `supabase/` directory's 4 files above already set                                                                                                                                                                                                                                                                                         |
-| `<workdir>/supabase/config.toml`                                   | TOML       | native push step (embedded defaults used when absent)                                                                                                                                                                                                                                                                                                                                                                              |
-| `<workdir>/supabase/.temp/pooler-url`                              | plain text | native push step's connection resolution, only when the direct `db.<ref>.<projectHost>:5432` host is unreachable (IPv4-only network) — `resolveLinkedConn` falls back through the saved pooler URL `link.LinkServices` wrote in the earlier link-services step                                                                                                                                                                     |
-| `<workdir>/supabase/migrations/`                                   | directory  | native push step, when `[db.migrations].enabled` (default true)                                                                                                                                                                                                                                                                                                                                                                    |
-| `<workdir>/supabase/migrations/*.sql`                              | SQL        | native push step, for each pending migration applied                                                                                                                                                                                                                                                                                                                                                                               |
-| seed files from `[db.seed].sql_paths`                              | SQL        | native push step (`--include-seed` is always set; gated on `[db.seed].enabled`)                                                                                                                                                                                                                                                                                                                                                    |
-| `<workdir>/supabase/roles.sql`                                     | SQL        | native push step (`--include-roles` is always set; existence check + apply)                                                                                                                                                                                                                                                                                                                                                        |
-| `PGSSL*` PEM, `pg_service.conf`                                    | PEM, libpq | native push step, remote project, when set; see `db push`                                                                                                                                                                                                                                                                                                                                                                          |
+| Path                                                               | Format     | When                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ------------------------------------------------------------------ | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `~/.supabase/access-token`                                         | plain text | ensure-login token miss (env unset and keyring unavailable)                                                                                                                                                                                                                                                                                                                                                                          |
+| `<workdir>/.env.example`                                           | dotenv     | optional; merged into the generated `.env`                                                                                                                                                                                                                                                                                                                                                                                           |
+| `<workdir>/supabase/{.env.<env>.local,.env.local,.env.<env>,.env}` | dotenv     | step I (`loadProjectEnvValues`), before config.toml validation and again inside `checkDbConfig`; `<env>` is `SUPABASE_ENV` (default `development`), `.env.local` is skipped when `SUPABASE_ENV=test`; first of the 4 files (in this order) to set a key wins, and this `supabase/` directory tier beats the workdir-root tier below — feeds config.toml `env(VAR)` expansion and the push step's `SUPABASE_YES` auto-confirm default |
+| `<workdir>/{.env.<env>.local,.env.local,.env.<env>,.env}`          | dotenv     | same read as above; lower-precedence fallback tier, only consulted for a key none of the `supabase/` directory's 4 files above already set                                                                                                                                                                                                                                                                                           |
+| `<workdir>/supabase/.temp/project-ref`                             | plain text | link-services step, to tell whether it names the new project                                                                                                                                                                                                                                                                                                                                                                         |
+| `<workdir>/supabase/config.toml`                                   | TOML       | native push step (embedded defaults used when absent)                                                                                                                                                                                                                                                                                                                                                                                |
+| `<workdir>/supabase/.temp/pooler-url`                              | plain text | native push step's connection resolution, only when the direct `db.<ref>.<projectHost>:5432` host is unreachable (IPv4-only network) — `resolveLinkedConn` falls back through the saved pooler URL `link.LinkServices` wrote in the earlier link-services step                                                                                                                                                                       |
+| `<workdir>/supabase/migrations/`                                   | directory  | native push step, when `[db.migrations].enabled` (default true)                                                                                                                                                                                                                                                                                                                                                                      |
+| `<workdir>/supabase/migrations/*.sql`                              | SQL        | native push step, for each pending migration applied                                                                                                                                                                                                                                                                                                                                                                                 |
+| seed files from `[db.seed].sql_paths`                              | SQL        | native push step (`--include-seed` is always set; gated on `[db.seed].enabled`)                                                                                                                                                                                                                                                                                                                                                      |
+| `<workdir>/supabase/roles.sql`                                     | SQL        | native push step (`--include-roles` is always set; existence check + apply)                                                                                                                                                                                                                                                                                                                                                          |
+| `PGSSL*` PEM, `pg_service.conf`                                    | PEM, libpq | native push step, remote project, when set; see `db push`                                                                                                                                                                                                                                                                                                                                                                            |
 
 ## Files Written
 
 | Path                                                                                                  | Format     | When                                                                                                                                                       |
 | ----------------------------------------------------------------------------------------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `<workdir>/supabase/config.toml`                                                                      | TOML       | blank/`scratch` path only (via `initProject`)                                                                                                              |
+| `<workdir>/supabase/config.toml`                                                                      | TOML       | blank/`scratch` path only (via `initProject` with `force`, which also removes `supabase/config.json`/`config.jsonc`)                                       |
 | `<workdir>/<template files>`                                                                          | varies     | template path only (GitHub download)                                                                                                                       |
 | `<workdir>/supabase/.temp/project-ref`                                                                | plain text | always (mandatory; fails the command on write error)                                                                                                       |
-| `<workdir>/supabase/.temp/{pooler-url,rest-version,gotrue-version,storage-version,storage-migration}` | plain text | best-effort, from `link.LinkServices`                                                                                                                      |
+| `<workdir>/supabase/.temp/{pooler-url,rest-version,gotrue-version,storage-version,storage-migration}` | plain text | best-effort, from `link.LinkServices`; all but `pooler-url` are **removed** first unless `project-ref` names the new project                               |
 | `<workdir>/.env`                                                                                      | dotenv     | best-effort (write failure prints a warning and continues)                                                                                                 |
 | `<workdir>/supabase/.temp/linked-project.json`                                                        | JSON       | post-run linked-project cache (`Effect.ensuring`); resolves against the bootstrap workdir (the prompted/`--workdir`/env target), not `cliSettings.workdir` |
 | `~/.supabase/telemetry.json`                                                                          | JSON       | post-run telemetry flush (`Effect.ensuring`)                                                                                                               |
diff --git a/apps/cli/src/commands/bootstrap/bootstrap.handler.ts b/apps/cli/src/commands/bootstrap/bootstrap.handler.ts
index a4bc3e4757..32b2f96d0e 100644
--- a/apps/cli/src/commands/bootstrap/bootstrap.handler.ts
+++ b/apps/cli/src/commands/bootstrap/bootstrap.handler.ts
@@ -25,7 +25,8 @@ import { getProjectApiKeys } from "../../command-internal/get-api-keys.ts";
 import { sanitizeErrorBody } from "../../command-internal/http-errors.ts";
 import type { ConnectSuggestionContext } from "../../command-internal/connect-errors.ts";
 import { resolveLinkedConn } from "../../command-internal/db-config.layer.ts";
-import { checkDbToml } from "../../command-internal/db-config.toml-read.ts";
+import { pinSupabaseTls } from "../../command-internal/supabase-tls.ts";
+import { checkDbConfig } from "../../command-internal/db-config.read.ts";
 import { dbPushCore } from "../../command-internal/db-push-core.ts";
 import {
   hostedMutationPreapproval,
@@ -246,7 +247,7 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
 
       // Config load must run before link/health/`.env` steps: a malformed config.toml aborts here
       // rather than after side effects start.
-      const toml = yield* checkDbToml(fs, path, workdir, projectRef).pipe(
+      const toml = yield* checkDbConfig(fs, path, workdir, projectRef).pipe(
         Effect.withSpan("bootstrap.loadConfig"),
       );
       if (toml.appliedRemote !== undefined) {
@@ -372,6 +373,7 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
       const resolvedConn = yield* resolveLinkedConn(
         projectRef,
         workdir,
+        cliSettings.profile,
         cliSettings.projectHost,
         cliSettings.poolerHost,
         dnsResolver,
@@ -379,10 +381,13 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
         {
           removeNetworkBans: Option.isSome(yield* hostedMutationPreapproval),
           poolerUrl: linkSnapshot.poolerUrl,
+          dashboardUrl: cliSettings.dashboardUrl,
         },
       ).pipe(
         Effect.catchTag("DbConfigIpv6Error", (error) =>
-          output.raw(`${error.message}\n`, "stderr").pipe(Effect.as(dbConfig)),
+          output
+            .raw(`${error.message}\n`, "stderr")
+            .pipe(Effect.as(pinSupabaseTls(dbConfig, cliSettings.profile))),
         ),
       );
       const conn = { ...resolvedConn, suggestionContext };
diff --git a/apps/cli/src/commands/bootstrap/bootstrap.integration.test.ts b/apps/cli/src/commands/bootstrap/bootstrap.integration.test.ts
index 31c193bd24..c48366681d 100644
--- a/apps/cli/src/commands/bootstrap/bootstrap.integration.test.ts
+++ b/apps/cli/src/commands/bootstrap/bootstrap.integration.test.ts
@@ -58,6 +58,7 @@ import {
 import { LinkedProjectCache } from "../../telemetry/linked-project-cache.service.ts";
 import { DbConnectError } from "../../command-internal/db-connection.errors.ts";
 import { DbConnection, type PgConnInput } from "../../command-internal/db-connection.service.ts";
+import { rootCaBundle } from "../../command-internal/supabase-tls.ts";
 import { debugLoggerLayer } from "../../command-internal/debug-logger.layer.ts";
 import { TargetPolicy } from "../../command-internal/target/target-policy.ts";
 import { TemplateService, type StarterTemplate } from "./bootstrap.templates.ts";
@@ -768,6 +769,10 @@ describe("bootstrap integration", () => {
         expect(s.pushConnectCalls[0]?.user).toBe("postgres");
         expect(s.pushConnectCalls[0]?.database).toBe("postgres");
         expect(s.pushConnectCalls[0]?.password).toBe("s3cret");
+        expect(s.pushConnectCalls[0]).toMatchObject({
+          sslmode: "require",
+          sslrootcertInline: rootCaBundle(),
+        });
         expect(s.out.stdoutText).toContain("Remote database is up to date.");
       }).pipe(Effect.provide(BunServices.layer)),
   );
diff --git a/apps/cli/src/commands/bootstrap/bootstrap.layers.unit.test.ts b/apps/cli/src/commands/bootstrap/bootstrap.layers.unit.test.ts
index 22f150a60e..e30383c234 100644
--- a/apps/cli/src/commands/bootstrap/bootstrap.layers.unit.test.ts
+++ b/apps/cli/src/commands/bootstrap/bootstrap.layers.unit.test.ts
@@ -1,7 +1,7 @@
 /** See `db/lint/lint.layers.unit.test.ts` for the canonical pattern this test follows. */
 
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer, Option } from "effect";
 
 import {
@@ -89,6 +89,7 @@ function ambientStubs() {
 
   return Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     // Builds the real `commandSettingsLayer` against the real filesystem (see
     // `isolatedHomeLayer`'s docs). `commandPlatformApiLayer` eagerly validates the access token at
     // construction time, so inject a valid one via the isolated env (`SUPABASE_ACCESS_TOKEN`).
diff --git a/apps/cli/src/commands/branches/create/SIDE_EFFECTS.md b/apps/cli/src/commands/branches/create/SIDE_EFFECTS.md
index 001d674f95..a4b49f9ea3 100644
--- a/apps/cli/src/commands/branches/create/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/branches/create/SIDE_EFFECTS.md
@@ -22,13 +22,11 @@ Target: hosted, consent default Yes — see [Command target](../../../../docs/co
 
 ## API Routes
 
-| Method | Path                                            | Auth         | Request body                                                                                                           | Response (used fields)                                                                                                                                                                                      |
-| ------ | ----------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `POST` | `/v1/projects/{ref}/branches`                   | Bearer token | `{branch_name, is_default: false, git_branch?, region?, desired_instance_size?, persistent?, with_data?, notify_url?}` | full `BranchResponse`                                                                                                                                                                                       |
-| `GET`  | `/v1/projects/{ref}` (on 4xx gated)             | Bearer token | none                                                                                                                   | `{organization_slug}`                                                                                                                                                                                       |
-| `GET`  | `/v1/organizations/{slug}/entitlements` (gated) | Bearer token | none                                                                                                                   | `[{feature: {key}, hasAccess, ...}]`                                                                                                                                                                        |
-| `GET`  | `/v1/projects`                                  | Bearer token | none                                                                                                                   | `[{id, name, organization_slug, region, …}]` — no project ref from `--remote=<ref>`, `SUPABASE_PROJECT_ID` or `.temp/project-ref`, with stdin and stdout TTYs and a non-JSON output format (project picker) |
-| `GET`  | `/v1/projects/{ref}`                            | Bearer token | none                                                                                                                   | `{ref, name, organization_id, organization_slug}` — linked-project cache miss only (best-effort, after the command)                                                                                         |
+| Method | Path                          | Auth         | Request body                                                                                                           | Response (used fields)                                                                                                                                                                                      |
+| ------ | ----------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `POST` | `/v1/projects/{ref}/branches` | Bearer token | `{branch_name, is_default: false, git_branch?, region?, desired_instance_size?, persistent?, with_data?, notify_url?}` | full `BranchResponse`                                                                                                                                                                                       |
+| `GET`  | `/v1/projects`                | Bearer token | none                                                                                                                   | `[{id, name, organization_slug, region, …}]` — no project ref from `--remote=<ref>`, `SUPABASE_PROJECT_ID` or `.temp/project-ref`, with stdin and stdout TTYs and a non-JSON output format (project picker) |
+| `GET`  | `/v1/projects/{ref}`          | Bearer token | none                                                                                                                   | `{ref, name, organization_id, organization_slug}` — linked-project cache miss only (best-effort, after the command)                                                                                         |
 
 ## Environment Variables
 
@@ -54,10 +52,10 @@ Target: hosted, consent default Yes — see [Command target](../../../../docs/co
 
 ## Telemetry Events Fired
 
-| Event                   | When                                            | Notable properties / groups                                                                                                                                   |
-| ----------------------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `cli_command_executed`  | post-run, success or failure (via wrapper)      | `exit_code`, `duration_ms`, `flags` (`--remote=<ref>` → the ref, a bare `--remote` → `true`; `--project-ref` whitelisted when ref-shaped, otherwise redacted) |
-| `cli_upgrade_suggested` | on 4xx with `branching_limit` entitlement gated | `{feature_key: "branching_limit", org_slug}`                                                                                                                  |
+| Event                   | When                                                       | Notable properties / groups                                                                                                                                   |
+| ----------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cli_command_executed`  | post-run, success or failure (via wrapper)                 | `exit_code`, `duration_ms`, `flags` (`--remote=<ref>` → the ref, a bare `--remote` → `true`; `--project-ref` whitelisted when ref-shaped, otherwise redacted) |
+| `cli_upgrade_suggested` | on a 4xx whose body is the `entitlement_required` envelope | `{feature_key: "branching_limit", org_slug}`                                                                                                                  |
 
 ## Output
 
diff --git a/apps/cli/src/commands/branches/create/create.command.ts b/apps/cli/src/commands/branches/create/create.command.ts
index e102804ccb..7cc03bdf62 100644
--- a/apps/cli/src/commands/branches/create/create.command.ts
+++ b/apps/cli/src/commands/branches/create/create.command.ts
@@ -4,7 +4,6 @@ import type * as CliCommand from "effect/cli/Command";
 import { withPermissions } from "../../../command-internal/command-permissions/command-permissions.annotation.ts";
 import { compose } from "../../../command-internal/command-permissions/model.ts";
 import { projectRefPicker } from "../../../config/project-ref.layer.ts";
-import { upgradeSuggestion } from "../../../command-internal/upgrade-suggest.ts";
 import { linkedProjectCache } from "../../../telemetry/linked-project-cache.layer.ts";
 import { withJsonErrorHandling } from "../../../shared/output/json-error-handling.ts";
 import { managementApiRuntimeLayer } from "../../../command-internal/management-api-runtime.layer.ts";
@@ -111,7 +110,6 @@ export const branchesCreateCommand = Command.make("create", config).pipe(
       },
       branchesParentTarget,
       projectRefPicker,
-      upgradeSuggestion,
       linkedProjectCache,
     ),
   ),
diff --git a/apps/cli/src/commands/branches/create/create.handler.ts b/apps/cli/src/commands/branches/create/create.handler.ts
index 5443436b87..3294498b62 100644
--- a/apps/cli/src/commands/branches/create/create.handler.ts
+++ b/apps/cli/src/commands/branches/create/create.handler.ts
@@ -104,22 +104,20 @@ export const branchesCreate = Effect.fn("branches.create")(function* (flags: Bra
         Effect.tapError(() => creating?.fail() ?? Effect.void),
         // Runs the plan-gate check before mapping the error, even for a gated 4xx.
         Effect.catch(
-          gateMapError(
-            { projectRef: ref, featureKey: "branching_limit" },
-            (cause, upgradeSuggested) =>
-              mapCreateErrorRaw(cause).pipe(
-                Effect.catchTag("BranchesCreateUnexpectedStatusError", (mapped) =>
-                  Effect.fail(
-                    new BranchesCreateUnexpectedStatusError({
-                      status: mapped.status,
-                      body: mapped.body,
-                      message: mapped.message,
-                      upgradeSuggested,
-                      entitlement: mapped.entitlement,
-                    }),
-                  ),
+          gateMapError({ projectRef: ref }, (cause, upgradeSuggested) =>
+            mapCreateErrorRaw(cause).pipe(
+              Effect.catchTag("BranchesCreateUnexpectedStatusError", (mapped) =>
+                Effect.fail(
+                  new BranchesCreateUnexpectedStatusError({
+                    status: mapped.status,
+                    body: mapped.body,
+                    message: mapped.message,
+                    upgradeSuggested,
+                    entitlement: mapped.entitlement,
+                  }),
                 ),
               ),
+            ),
           ),
         ),
       );
diff --git a/apps/cli/src/commands/branches/create/create.integration.test.ts b/apps/cli/src/commands/branches/create/create.integration.test.ts
index 363440864b..21bca71f14 100644
--- a/apps/cli/src/commands/branches/create/create.integration.test.ts
+++ b/apps/cli/src/commands/branches/create/create.integration.test.ts
@@ -66,19 +66,6 @@ function projectResponse() {
   };
 }
 
-function entitlementResponse(opts: { readonly featureKey: string; readonly hasAccess: boolean }) {
-  return {
-    entitlements: [
-      {
-        feature: { key: opts.featureKey, type: "boolean" as const },
-        hasAccess: opts.hasAccess,
-        type: "boolean" as const,
-        config: { enabled: !opts.hasAccess },
-      },
-    ],
-  };
-}
-
 const tempRoot = useTempWorkdir("supabase-branches-create-int-");
 
 interface SetupOpts {
@@ -87,8 +74,6 @@ interface SetupOpts {
   readonly response?: unknown;
   readonly status?: number;
   readonly network?: "fail";
-  readonly gated?: boolean;
-  readonly featureKey?: string;
   readonly yes?: boolean;
   readonly stdinIsTty?: boolean;
   readonly promptConfirmResponses?: ReadonlyArray<boolean>;
@@ -99,7 +84,6 @@ const hostedCreatePolicy = Layer.succeed(TargetPolicy, { group: "hosted", consen
 function apiOptions(opts: SetupOpts): MockCommandPlatformApiOpts {
   const status = opts.status ?? 201;
   const body = opts.response ?? CREATED;
-  const featureKey = opts.featureKey ?? "branching_limit";
   return {
     network: opts.network,
     handler: (request) =>
@@ -107,16 +91,6 @@ function apiOptions(opts: SetupOpts): MockCommandPlatformApiOpts {
         if (request.method === "POST" && request.url.includes("/branches")) {
           return jsonResponse(request, status, body);
         }
-        if (request.method === "GET" && request.url.endsWith(`/v1/projects/${VALID_REF}`)) {
-          return jsonResponse(request, 200, projectResponse());
-        }
-        if (request.method === "GET" && request.url.includes("/entitlements")) {
-          return jsonResponse(
-            request,
-            200,
-            entitlementResponse({ featureKey, hasAccess: !(opts.gated ?? false) }),
-          );
-        }
         return jsonResponse(request, 200, null);
       }),
   };
@@ -414,22 +388,24 @@ describe("branches create integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
-  it.effect("fires cli_upgrade_suggested with feature_key=branching_limit on 402 gated", () => {
-    const { layer, analytics, api } = setup({ status: 402, gated: true });
+  it.effect("makes one request and suggests no upgrade on a 4xx without the envelope", () => {
+    const { layer, out, analytics, api } = setup({
+      status: 400,
+      response: { message: "Invalid branch name" },
+    });
     return Effect.gen(function* () {
-      yield* Effect.exit(branchesCreate({ ...baseFlags, name: Option.some("feat-x") }));
+      const exit = yield* Effect.exit(
+        branchesCreate({ ...baseFlags, name: Option.some("feat-x") }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(classifyCliCauseActionability(exit.cause).error_category).not.toBe("plan_limit");
+      }
       expect(api.requests.map(({ method, url }) => `${method} ${url}`)).toEqual([
         `POST https://api.supabase.com/v1/projects/${VALID_REF}/branches`,
-        `GET https://api.supabase.com/v1/projects/${VALID_REF}`,
-        `GET https://api.supabase.com/v1/organizations/${ORG_SLUG}/entitlements`,
-      ]);
-      assertPermissionDrift({ command: "branches create", requests: api.requests });
-      expect(analytics.captured).toEqual([
-        {
-          event: "cli_upgrade_suggested",
-          properties: { feature_key: "branching_limit", org_slug: ORG_SLUG },
-        },
       ]);
+      expect(out.stderrText).not.toContain("Upgrade your plan:");
+      expect(analytics.captured).toHaveLength(0);
     }).pipe(Effect.provide(layer));
   });
 
@@ -507,7 +483,17 @@ describe("branches create integration", () => {
   });
 
   it.effect("writes linked-project cache + telemetry on the upgrade-suggest failure path", () => {
-    const { layer, telemetry, cache } = setupTracked({ status: 402, gated: true });
+    const { layer, telemetry, cache } = setupTracked({
+      status: 402,
+      response: {
+        message: "Branching is supported only on the Pro plan or above",
+        error: {
+          code: "entitlement_required",
+          feature: "branching_limit",
+          upgrade_url: "https://supabase.com/dashboard/org/env-org/billing",
+        },
+      },
+    });
     return Effect.gen(function* () {
       yield* Effect.exit(branchesCreate({ ...baseFlags, name: Option.some("feat-x") }));
       expect(telemetry.flushed).toBe(true);
diff --git a/apps/cli/src/commands/completion/bash/bash.integration.test.ts b/apps/cli/src/commands/completion/bash/bash.integration.test.ts
index 774ccdfcb4..85118de58b 100644
--- a/apps/cli/src/commands/completion/bash/bash.integration.test.ts
+++ b/apps/cli/src/commands/completion/bash/bash.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer } from "effect";
 import { Command } from "effect/cli";
 import { mockAnalytics, mockOutput } from "../../../../tests/helpers/mocks.ts";
@@ -49,6 +49,7 @@ describe("completion bash", () => {
         out.layer,
         mockAnalytics().layer,
         BunServices.layer,
+        BunCrypto.layer,
         processControlLayer,
       );
       return Effect.gen(function* () {
@@ -68,6 +69,7 @@ describe("completion bash", () => {
       out.layer,
       analytics.layer,
       BunServices.layer,
+      BunCrypto.layer,
       processControlLayer,
     );
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/completion/fish/fish.integration.test.ts b/apps/cli/src/commands/completion/fish/fish.integration.test.ts
index d4e9bc40b6..4b7cfd05eb 100644
--- a/apps/cli/src/commands/completion/fish/fish.integration.test.ts
+++ b/apps/cli/src/commands/completion/fish/fish.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer } from "effect";
 import { Command } from "effect/cli";
 import { mockAnalytics, mockOutput } from "../../../../tests/helpers/mocks.ts";
@@ -49,6 +49,7 @@ describe("completion fish", () => {
         out.layer,
         mockAnalytics().layer,
         BunServices.layer,
+        BunCrypto.layer,
         processControlLayer,
       );
       return Effect.gen(function* () {
@@ -68,6 +69,7 @@ describe("completion fish", () => {
       out.layer,
       analytics.layer,
       BunServices.layer,
+      BunCrypto.layer,
       processControlLayer,
     );
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/completion/powershell/powershell.integration.test.ts b/apps/cli/src/commands/completion/powershell/powershell.integration.test.ts
index 6663c43311..dbecb5d434 100644
--- a/apps/cli/src/commands/completion/powershell/powershell.integration.test.ts
+++ b/apps/cli/src/commands/completion/powershell/powershell.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer } from "effect";
 import { Command } from "effect/cli";
 import { mockAnalytics, mockOutput } from "../../../../tests/helpers/mocks.ts";
@@ -49,6 +49,7 @@ describe("completion powershell", () => {
         out.layer,
         mockAnalytics().layer,
         BunServices.layer,
+        BunCrypto.layer,
         processControlLayer,
       );
       return Effect.gen(function* () {
@@ -68,6 +69,7 @@ describe("completion powershell", () => {
       out.layer,
       analytics.layer,
       BunServices.layer,
+      BunCrypto.layer,
       processControlLayer,
     );
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/completion/zsh/zsh.integration.test.ts b/apps/cli/src/commands/completion/zsh/zsh.integration.test.ts
index f1fa62165a..5c97c5e976 100644
--- a/apps/cli/src/commands/completion/zsh/zsh.integration.test.ts
+++ b/apps/cli/src/commands/completion/zsh/zsh.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer } from "effect";
 import { Command } from "effect/cli";
 import { mockAnalytics, mockOutput } from "../../../../tests/helpers/mocks.ts";
@@ -49,6 +49,7 @@ describe("completion zsh", () => {
         out.layer,
         mockAnalytics().layer,
         BunServices.layer,
+        BunCrypto.layer,
         processControlLayer,
       );
       return Effect.gen(function* () {
@@ -65,6 +66,7 @@ describe("completion zsh", () => {
       out.layer,
       analytics.layer,
       BunServices.layer,
+      BunCrypto.layer,
       processControlLayer,
     );
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/config/config.format.ts b/apps/cli/src/commands/config/config.format.ts
index b6e713a204..c0cd24f003 100644
--- a/apps/cli/src/commands/config/config.format.ts
+++ b/apps/cli/src/commands/config/config.format.ts
@@ -3,6 +3,7 @@ import { projectConfigApiBlockKeys } from "@supabase/config/internal";
 
 import type { CliConfigKeyOrigin } from "../../config/cli-config-key.ts";
 import { BRANCH_UUID_PATTERN } from "../../command-internal/ref-patterns.ts";
+import { configFileName, DEFAULT_CONFIG_FILE } from "../../command-internal/config-advice.ts";
 import { sanitizeInlineName } from "../../command-internal/http-errors.ts";
 
 /**
@@ -175,13 +176,13 @@ export function configChangePayloadEntry(
   };
 }
 
-function renderLocalChangeValue(change: ConfigChange): string {
+function renderLocalChangeValue(change: ConfigChange, configPath: string): string {
   const value = configRenderValue(change.local, "(unset)");
   // A populated value on an undeclared path is the schema default a `config push` would write.
   // Say so, or "[remote-only]" reads as "exists only remotely", which is false when a schema
   // default exists.
   return change.local !== undefined && !change.declared
-    ? `${value} (schema default — not declared in config.toml)`
+    ? `${value} (schema default — not declared in ${configFileName(configPath)})`
     : value;
 }
 
@@ -193,6 +194,7 @@ function renderLocalChangeValue(change: ConfigChange): string {
 export function configRenderChangeLines(
   changes: ReadonlyArray<ConfigChange>,
   originFor?: ConfigEnvOriginLookup,
+  configPath = DEFAULT_CONFIG_FILE.path,
 ): string {
   return changes
     .map((change) => {
@@ -205,7 +207,7 @@ export function configRenderChangeLines(
             : ` (from env ${sanitizeInlineName(change.envVariables.join(", "))})`;
       const block = [
         `${configRenderPath(change.path)} [${CONFIG_CLASS_LABELS[change.class]}]`,
-        `  local:  ${renderLocalChangeValue(change)}${env}`,
+        `  local:  ${renderLocalChangeValue(change, configPath)}${env}`,
         `  remote: ${configRenderValue(change.remote, "(not returned)")}`,
       ].join("\n");
       return `${block}\n\n`;
diff --git a/apps/cli/src/commands/config/diff/diff.command.ts b/apps/cli/src/commands/config/diff/diff.command.ts
index 6f3477d127..2ebbca65e2 100644
--- a/apps/cli/src/commands/config/diff/diff.command.ts
+++ b/apps/cli/src/commands/config/diff/diff.command.ts
@@ -44,7 +44,7 @@ export const configDiffHandler = (flags: ConfigDiffFlags) =>
 
 export const configDiffCommand = Command.make("diff", config).pipe(
   Command.withDescription(
-    "Shows configuration differences between supabase/config.toml and a remote project or branch. Read-only: never modifies local or remote configuration.",
+    "Shows configuration differences between the project config file and a remote project or branch. Read-only: never modifies local or remote configuration.",
   ),
   Command.withShortDescription("Diff local config against a remote project"),
   Command.withExamples([
diff --git a/apps/cli/src/commands/config/diff/diff.e2e.test.ts b/apps/cli/src/commands/config/diff/diff.e2e.test.ts
index 1b07a1e2c1..6abf008cc6 100644
--- a/apps/cli/src/commands/config/diff/diff.e2e.test.ts
+++ b/apps/cli/src/commands/config/diff/diff.e2e.test.ts
@@ -22,7 +22,7 @@ describe("config diff CLI surface", () => {
       // This hermetic cwd has no config file, so reaching the handler (not just a binary-launch
       // failure) surfaces this load-error text — guarding against a vacuously green regression.
       expect(combined).toContain(
-        "failed to read supabase/config.toml or supabase/config.json: file not found. Run `supabase init` to create one.",
+        "failed to read supabase/config.toml, config.json or config.jsonc: file not found. Run `supabase init` to create one.",
       );
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
diff --git a/apps/cli/src/commands/config/diff/diff.format.ts b/apps/cli/src/commands/config/diff/diff.format.ts
index a45a613a05..183a375917 100644
--- a/apps/cli/src/commands/config/diff/diff.format.ts
+++ b/apps/cli/src/commands/config/diff/diff.format.ts
@@ -83,8 +83,9 @@ export function renderConfigDiffText(
   changeSet: ConfigChangeSet,
   scope: ConfigApiScope,
   originFor?: ConfigEnvOriginLookup,
+  configPath?: string,
 ): string {
-  const changeLines = configRenderChangeLines(changeSet.changes, originFor);
+  const changeLines = configRenderChangeLines(changeSet.changes, originFor, configPath);
 
   const lines: Array<string> = [];
   const { update, remote_only, local_only, total } = changeSet.counts;
diff --git a/apps/cli/src/commands/config/diff/diff.handler.ts b/apps/cli/src/commands/config/diff/diff.handler.ts
index 3319da0ec8..ea32f3e728 100644
--- a/apps/cli/src/commands/config/diff/diff.handler.ts
+++ b/apps/cli/src/commands/config/diff/diff.handler.ts
@@ -171,7 +171,14 @@ export const configDiff = Effect.fn("config.diff")(function* (flags: ConfigDiffF
         yield* withAnnouncedTarget(configDiffPayload(changeSet, scope, context, originFor)),
       );
     } else {
-      yield* output.raw(renderConfigDiffText(changeSet, scope, originFor));
+      yield* output.raw(
+        renderConfigDiffText(
+          changeSet,
+          scope,
+          originFor,
+          relativeConfigPath(cliSettings.workdir, loaded.path),
+        ),
+      );
     }
 
     // `--exit-code` sets exit 2 for drift, distinct from the 1 every other failure uses, so a
diff --git a/apps/cli/src/commands/config/diff/diff.integration.test.ts b/apps/cli/src/commands/config/diff/diff.integration.test.ts
index 25087a0ad4..63d826f0f7 100644
--- a/apps/cli/src/commands/config/diff/diff.integration.test.ts
+++ b/apps/cli/src/commands/config/diff/diff.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { type V1ListAllProjectsOutput } from "@supabase/api/effect";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Layer, Option, Path, Schema, Stdio } from "effect";
@@ -709,7 +709,9 @@ describe("config diff integration", () => {
         const causeText = Cause.pretty(exit.cause);
         expect(causeText).toContain("ConfigDiffLoadConfigError");
         // The config load probes both config.toml and config.json, so the message names both.
-        expect(causeText).toContain("supabase/config.toml or supabase/config.json: file not found");
+        expect(causeText).toContain(
+          "supabase/config.toml, config.json or config.jsonc: file not found",
+        );
         expect(causeText).toContain("supabase init");
       }
       expect(api.requests).toHaveLength(0);
@@ -1435,7 +1437,9 @@ describe("config diff -o/--output wrapper wiring", () => {
       Effect.provide(
         Layer.mergeAll(
           layer,
-          commandRuntimeLayer(["config", "diff"]).pipe(Layer.provide(BunServices.layer)),
+          commandRuntimeLayer(["config", "diff"]).pipe(
+            Layer.provide([BunServices.layer, BunCrypto.layer]),
+          ),
           Stdio.layerTest({ args: Effect.succeed(["config", "diff", "-o", "table"]) }),
         ),
       ),
diff --git a/apps/cli/src/commands/config/pull/SIDE_EFFECTS.md b/apps/cli/src/commands/config/pull/SIDE_EFFECTS.md
index 26debe46b6..bb32407cd6 100644
--- a/apps/cli/src/commands/config/pull/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/config/pull/SIDE_EFFECTS.md
@@ -3,7 +3,7 @@
 Target: hosted, no consent — see [Command target](../../../../docs/command-target.md)
 
 Writes the effective configuration of a remote project or branch back into the local
-`supabase/config.toml`/`config.json` — the write side of `supabase config diff` (same target
+`supabase/config.toml`/`config.json`/`config.jsonc` — the write side of `supabase config diff` (same target
 resolution, fetch, and classification, `../diff/`). Prompts for confirmation before writing on an
 interactive TTY, unless `--yes` is set; `--output-format json|stream-json` never prompts at all and
 returns the confirmation's default value without reading anything. A non-interactive TEXT run (no
@@ -13,23 +13,23 @@ declining any other answer. Never writes on `--dry-run`, on a declined prompt, o
 
 ## Files Read
 
-| Path                                                      | Format                    | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| --------------------------------------------------------- | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `<workdir>/supabase/config.toml` or `config.json`         | TOML/JSON                 | always, before any network call (the config load probes `config.json` first, then `config.toml` — a missing file or parse error aborts, exit 1, naming whichever file actually failed); this first load applies NO `[remotes.*]` overlay, regardless of the eventual target. Its own `LoadedCliConfig.rawText` (the exact bytes the loader itself parsed) is taken as this pull's baseline — never re-read separately, so a concurrent edit landing between the parse and a second read can no longer become the accepted baseline out from under the plan |
-| `<workdir>/supabase/config.toml` or `config.json`         | TOML/JSON                 | re-loaded WITH the `[remotes.*]` overlay applied, only when the resolved target ref matches an EXISTING block (block reuse selects it as the destination, `remoteNameForProjectRef`) — a brand-new block has nothing to overlay yet, so this second load is skipped in that case                                                                                                                                                                                                                                                                           |
-| same file, raw on-disk text (TOCTOU re-read)              | TOML/JSON                 | immediately before writing, once the confirmation prompt has been answered — only reached when at least one change is planned and the run is not `--dry-run`; bytes differing from the earlier read abort the write (`ConfigPullFileChangedError`) instead of overwriting a file that changed while the prompt was on screen                                                                                                                                                                                                                               |
-| `<workdir>/{supabase/,}.env{.<env>.local,.local,.<env>,}` | dotenv                    | always: supplies `env(VAR)` references inside `config.toml`; a `SUPABASE_*` value in these files is not compared (pull compares the file's own declared values). `<env>` is `SUPABASE_ENV` (default `development`); `.env.local` is skipped when `SUPABASE_ENV=test`; the first file to set a key wins and the `supabase/` tier beats the project-root tier                                                                                                                                                                                                |
-| `<workdir>/supabase/.temp/project-ref`                    | plain text                | project-ref fallback (`--remote=<ref>` → `SUPABASE_PROJECT_ID` → this file); parent-ref candidate for a branch-name `--remote` (checked eagerly, BEFORE any spinner or branch lookup)                                                                                                                                                                                                                                                                                                                                                                      |
-| `<workdir>/supabase/.temp/linked-project.json`            | JSON                      | parent-ref candidate for a branch-name `--remote` (same eager pre-check); existence-checked for the telemetry cache write below                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `~/.supabase/access-token`                                | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Path                                                              | Format                    | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ----------------------------------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`, `config.json` or `config.jsonc` | TOML/JSON                 | always, before any network call (the config load probes `config.json` or `config.jsonc` first (both present is an error), then `config.toml` — a missing file or parse error aborts, exit 1, naming whichever file actually failed); this first load applies NO `[remotes.*]` overlay, regardless of the eventual target. Its own `LoadedCliConfig.rawText` (the exact bytes the loader itself parsed) is taken as this pull's baseline — never re-read separately, so a concurrent edit landing between the parse and a second read can no longer become the accepted baseline out from under the plan |
+| `<workdir>/supabase/config.toml`, `config.json` or `config.jsonc` | TOML/JSON                 | re-loaded WITH the `[remotes.*]` overlay applied, only when the resolved target ref matches an EXISTING block (block reuse selects it as the destination, `remoteNameForProjectRef`) — a brand-new block has nothing to overlay yet, so this second load is skipped in that case                                                                                                                                                                                                                                                                                                                        |
+| same file, raw on-disk text (TOCTOU re-read)                      | TOML/JSON/JSONC           | immediately before writing, once the confirmation prompt has been answered — only reached when at least one change is planned and the run is not `--dry-run`; bytes differing from the earlier read abort the write (`ConfigPullFileChangedError`) instead of overwriting a file that changed while the prompt was on screen                                                                                                                                                                                                                                                                            |
+| `<workdir>/{supabase/,}.env{.<env>.local,.local,.<env>,}`         | dotenv                    | always: supplies `env(VAR)` references inside `config.toml`; a `SUPABASE_*` value in these files is not compared (pull compares the file's own declared values). `<env>` is `SUPABASE_ENV` (default `development`); `.env.local` is skipped when `SUPABASE_ENV=test`; the first file to set a key wins and the `supabase/` tier beats the project-root tier                                                                                                                                                                                                                                             |
+| `<workdir>/supabase/.temp/project-ref`                            | plain text                | project-ref fallback (`--remote=<ref>` → `SUPABASE_PROJECT_ID` → this file); parent-ref candidate for a branch-name `--remote` (checked eagerly, BEFORE any spinner or branch lookup)                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `<workdir>/supabase/.temp/linked-project.json`                    | JSON                      | parent-ref candidate for a branch-name `--remote` (same eager pre-check); existence-checked for the telemetry cache write below                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `~/.supabase/access-token`                                        | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 
 ## Files Written
 
-| Path                                              | Format    | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ------------------------------------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `<workdir>/supabase/config.toml` or `config.json` | TOML/JSON | ONLY after the confirmation prompt answers "yes" — `--yes`/`SUPABASE_YES` always answer yes, UNLESS the git dirty guard already aborted first (see Git below — `--yes` never bypasses that guard, on any TTY); otherwise the prompt's default is yes, UNLESS the git dirty guard downgraded it to no (only possible in an interactive TTY text run with no `--yes`) — AND there is at least one value change planned OR a new `[remotes.*]` block would be created (a zero-drift branch/`--remote-label` target still writes the block's own `project_id`, even with no value changes to apply — see Notes). **Never** on `--dry-run`; **never** on a declined prompt; **never** on any error path (including the TOCTOU mismatch above). Written atomically: a temp file in the SAME directory (`<file>.tmp.<Date.now()>.<6-hex-chars>`), the original file's mode copied onto it, then `rename`d over the original; the temp file is removed if anything fails before the rename |
-| `<workdir>/supabase/.temp/linked-project.json`    | JSON      | `Effect.ensuring` after run (success **and** failure), if a target ref resolved                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `~/.supabase/telemetry.json`                      | JSON      | `Effect.ensuring` after run (success **and** failure)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Path                                                              | Format    | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ----------------------------------------------------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`, `config.json` or `config.jsonc` | TOML/JSON | ONLY after the confirmation prompt answers "yes" — `--yes`/`SUPABASE_YES` always answer yes, UNLESS the git dirty guard already aborted first (see Git below — `--yes` never bypasses that guard, on any TTY); otherwise the prompt's default is yes, UNLESS the git dirty guard downgraded it to no (only possible in an interactive TTY text run with no `--yes`) — AND there is at least one value change planned OR a new `[remotes.*]` block would be created (a zero-drift branch/`--remote-label` target still writes the block's own `project_id`, even with no value changes to apply — see Notes). **Never** on `--dry-run`; **never** on a declined prompt; **never** on any error path (including the TOCTOU mismatch above). Written atomically: a temp file in the SAME directory (`<file>.tmp.<Date.now()>.<6-hex-chars>`), the original file's mode copied onto it, then `rename`d over the original; the temp file is removed if anything fails before the rename |
+| `<workdir>/supabase/.temp/linked-project.json`                    | JSON      | `Effect.ensuring` after run (success **and** failure), if a target ref resolved                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `~/.supabase/telemetry.json`                                      | JSON      | `Effect.ensuring` after run (success **and** failure)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 
 ## Git
 
@@ -63,16 +63,16 @@ locally via the file write above).
 
 ## Environment Variables
 
-| Variable                           | Purpose                                                                                                                                                                                                                                                                                                              | Required?                                                                                                                                                                                                                                                                                                                                                    |
-| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `SUPABASE_PROJECT_ID`              | project ref (`--remote=<ref>` → this → `.temp/project-ref` → prompt)                                                                                                                                                                                                                                                 | no                                                                                                                                                                                                                                                                                                                                                           |
-| `SUPABASE_ACCESS_TOKEN`            | auth token (bypasses credential file/keyring lookup)                                                                                                                                                                                                                                                                 | no (falls back to keyring → `~/.supabase/access-token`)                                                                                                                                                                                                                                                                                                      |
-| `SUPABASE_PROFILE`                 | API profile selection                                                                                                                                                                                                                                                                                                | no                                                                                                                                                                                                                                                                                                                                                           |
-| `SUPABASE_WORKDIR`                 | working directory `config.toml`/`.json` is read from and written to (`--workdir` flag takes priority)                                                                                                                                                                                                                | no — when unset, the CLI walks up from cwd looking for `supabase/config.toml` or `supabase/config.json`; when SET (flag or env) the directory is used exactly as given and **no ancestor is searched**, so a path with no `supabase/` of its own fails (with no `supabase init` hint — see the exit-code table) instead of loading a parent project's config |
-| `SUPABASE_<PATH>` config overrides | not applied: pull compares the file's own declared values, with the matched `[remotes.*]` block merged over the base and `env(VAR)` references resolved from the shell and project `.env*` files                                                                                                                     | no                                                                                                                                                                                                                                                                                                                                                           |
-| `SUPABASE_YES`                     | answers the confirmation prompt "yes" (same effect as `--yes`); does **not** bypass the uncommitted-changes guard — only `--force` does                                                                                                                                                                              | no                                                                                                                                                                                                                                                                                                                                                           |
-| `env(VAR)` references              | interpolated into `config.toml` values at load; a change whose LOCAL value resolved from `env()` is always skipped, never overwritten                                                                                                                                                                                | no                                                                                                                                                                                                                                                                                                                                                           |
-| `env(VAR)` references              | a change whose REMOTE value is itself spelled `env(VAR)` is also always skipped (`remote_env_reference`), never written verbatim — the loader would resolve it against THIS machine's environment on the next load, which would otherwise let a remote value smuggle a local secret into `config diff`/`config push` | no                                                                                                                                                                                                                                                                                                                                                           |
+| Variable                           | Purpose                                                                                                                                                                                                                                                                                                              | Required?                                                                                                                                                                                                                                                                                                                                                                             |
+| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `SUPABASE_PROJECT_ID`              | project ref (`--remote=<ref>` → this → `.temp/project-ref` → prompt)                                                                                                                                                                                                                                                 | no                                                                                                                                                                                                                                                                                                                                                                                    |
+| `SUPABASE_ACCESS_TOKEN`            | auth token (bypasses credential file/keyring lookup)                                                                                                                                                                                                                                                                 | no (falls back to keyring → `~/.supabase/access-token`)                                                                                                                                                                                                                                                                                                                               |
+| `SUPABASE_PROFILE`                 | API profile selection                                                                                                                                                                                                                                                                                                | no                                                                                                                                                                                                                                                                                                                                                                                    |
+| `SUPABASE_WORKDIR`                 | working directory `config.toml`/`.json`/`.jsonc` is read from and written to (`--workdir` flag takes priority)                                                                                                                                                                                                       | no — when unset, the CLI walks up from cwd looking for `supabase/config.toml`, `supabase/config.json` or `supabase/config.jsonc`; when SET (flag or env) the directory is used exactly as given and **no ancestor is searched**, so a path with no `supabase/` of its own fails (with no `supabase init` hint — see the exit-code table) instead of loading a parent project's config |
+| `SUPABASE_<PATH>` config overrides | not applied: pull compares the file's own declared values, with the matched `[remotes.*]` block merged over the base and `env(VAR)` references resolved from the shell and project `.env*` files                                                                                                                     | no                                                                                                                                                                                                                                                                                                                                                                                    |
+| `SUPABASE_YES`                     | answers the confirmation prompt "yes" (same effect as `--yes`); does **not** bypass the uncommitted-changes guard — only `--force` does                                                                                                                                                                              | no                                                                                                                                                                                                                                                                                                                                                                                    |
+| `env(VAR)` references              | interpolated into `config.toml` values at load; a change whose LOCAL value resolved from `env()` is always skipped, never overwritten                                                                                                                                                                                | no                                                                                                                                                                                                                                                                                                                                                                                    |
+| `env(VAR)` references              | a change whose REMOTE value is itself spelled `env(VAR)` is also always skipped (`remote_env_reference`), never written verbatim — the loader would resolve it against THIS machine's environment on the next load, which would otherwise let a remote value smuggle a local secret into `config diff`/`config push` | no                                                                                                                                                                                                                                                                                                                                                                                    |
 
 ## Exit Codes
 
@@ -85,7 +85,7 @@ exit `0`: neither is a failure.
 | `0`  | success — including "no differences found", "differences found but none writable", and a declined confirmation prompt                                                                                                                                                                                                                                                                                                                                                       |
 | `1`  | the `-o`/`--output` global flag passed (any value — not supported by this command)                                                                                                                                                                                                                                                                                                                                                                                          |
 | `1`  | resolved `--workdir`/`SUPABASE_WORKDIR` doesn't exist or isn't a directory (`ConfigPullWorkdirError`) — beats the base config load and every network call                                                                                                                                                                                                                                                                                                                   |
-| `1`  | missing or malformed `supabase/config.toml`/`config.json` (`ConfigPullLoadConfigError`) — a missing file suggests `supabase init` only for a DEFAULTED workdir; with an explicit workdir the message names the resolved path instead and never suggests `init`                                                                                                                                                                                                              |
+| `1`  | missing or malformed `supabase/config.toml`/`config.json`/`config.jsonc` (`ConfigPullLoadConfigError`) — a missing file suggests `supabase init` only for a DEFAULTED workdir; with an explicit workdir the message names the resolved path instead and never suggests `init`                                                                                                                                                                                               |
 | `1`  | a flag, `SUPABASE_*` variable, project `.env*` file or config value fails to decode (`CliConfigValueError`) — names the source that supplied it; surfaced as-is, not wrapped in the command's load error                                                                                                                                                                                                                                                                    |
 | `1`  | branch-name `--remote` with no linked parent project (`LinkBranchNotLinkedError`)                                                                                                                                                                                                                                                                                                                                                                                           |
 | `1`  | branch-name `--remote` with a corrupt/invalid linked parent ref (`LinkParentRefInvalidError`)                                                                                                                                                                                                                                                                                                                                                                               |
@@ -191,7 +191,7 @@ the -o/--output flag is not supported by config pull; use --output-format json|s
 ## Notes
 
 - **No hosted-mutation consent.** Pull changes only local files, so the one prompt is the local overwrite question above; `--yes` and `SUPABASE_YES` answer it, and nothing about the linked project is ever modified.
-- Run from the project root (or pass `--workdir`); `config.toml`/`config.json` is read and written
+- Run from the project root (or pass `--workdir`); `config.toml`/`config.json`/`config.jsonc` is read and written
   relative to it.
 - **Scope resolution (ADR 0023) is pure and precedes any network call**: `--remote-label`, when
   passed, is resolved FIRST — even for a ref-shaped target — so its own remedy is never dead;
@@ -204,8 +204,9 @@ the -o/--output flag is not supported by config pull; use --output-format json|s
   rewritten — hard error instead (see the exit-code table) — unless an explicit `--remote-label`
   already settled the destination some other way.
 - **The write is never a full-document regeneration.** `packages/config/src/config-edit.ts`'s
-  `applyConfigEdits` is a character-level scanner that splices only the spans that changed —
-  comments, key ordering, and quoting elsewhere in the file are untouched — verified by re-parsing
+  `applyConfigEdits` splices only the spans that changed (a character-level scanner for TOML,
+  `jsonc-parser` `modify` for JSON/JSONC) — comments, trailing commas, key ordering, and quoting
+  elsewhere in the file are untouched — verified by re-parsing
   the edited text and deep-comparing it against an independently computed expectation before it is
   ever returned; a mismatch refuses the edit rather than writing anything.
 - **Convergence**: a second `config pull` against an ALREADY-TRACKED target (root, or a
diff --git a/apps/cli/src/commands/config/pull/pull.command.ts b/apps/cli/src/commands/config/pull/pull.command.ts
index b87239f104..94c1e66d50 100644
--- a/apps/cli/src/commands/config/pull/pull.command.ts
+++ b/apps/cli/src/commands/config/pull/pull.command.ts
@@ -33,7 +33,7 @@ const config = {
     Flag.withDefault(false),
   ),
   force: Flag.Boolean("force").pipe(
-    Flag.withDescription("Write even when supabase/config.toml has uncommitted changes in git."),
+    Flag.withDescription("Write even when the project config file has uncommitted changes in git."),
     Flag.withDefault(false),
   ),
 } as const;
@@ -54,9 +54,9 @@ const configPullHandler = (flags: ConfigPullFlags) =>
 
 export const configPullCommand = Command.make("pull", config).pipe(
   Command.withDescription(
-    "Writes configuration from a remote project or branch into supabase/config.toml. Prompts for confirmation before writing on an interactive TTY, unless --yes is set; --output-format json|stream-json skips the prompt entirely and takes its default answer, while a non-interactive text run still prints the prompt to stderr and reads one line from piped stdin (y/yes/n/no honored, empty takes the default, anything else declines) — use --dry-run to preview first.",
+    "Writes configuration from a remote project or branch into the project config file. Prompts for confirmation before writing on an interactive TTY, unless --yes is set; --output-format json|stream-json skips the prompt entirely and takes its default answer, while a non-interactive text run still prints the prompt to stderr and reads one line from piped stdin (y/yes/n/no honored, empty takes the default, anything else declines) — use --dry-run to preview first.",
   ),
-  Command.withShortDescription("Pull remote config into supabase/config.toml"),
+  Command.withShortDescription("Pull remote config into the project config file"),
   Command.withExamples([
     {
       command: "supabase config pull",
@@ -64,7 +64,7 @@ export const configPullCommand = Command.make("pull", config).pipe(
     },
     {
       command: "supabase config pull --remote=staging",
-      description: "Pull from the 'staging' branch into [remotes.staging]",
+      description: "Pull from the 'staging' branch into remotes.staging",
     },
     {
       command: "supabase config pull --dry-run",
diff --git a/apps/cli/src/commands/config/pull/pull.e2e.test.ts b/apps/cli/src/commands/config/pull/pull.e2e.test.ts
index 69ccb72ce9..f38f87526c 100644
--- a/apps/cli/src/commands/config/pull/pull.e2e.test.ts
+++ b/apps/cli/src/commands/config/pull/pull.e2e.test.ts
@@ -33,7 +33,7 @@ describe("config pull CLI surface", () => {
       // reached the handler prints this exact load error — a vacuously-green regression (e.g.
       // the binary failing to start) wouldn't.
       expect(combined).toContain(
-        "failed to read supabase/config.toml or supabase/config.json: file not found. Run `supabase init` to create one.",
+        "failed to read supabase/config.toml, config.json or config.jsonc: file not found. Run `supabase init` to create one.",
       );
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
diff --git a/apps/cli/src/commands/config/pull/pull.handler.ts b/apps/cli/src/commands/config/pull/pull.handler.ts
index abb27add44..e5bf0a86d1 100644
--- a/apps/cli/src/commands/config/pull/pull.handler.ts
+++ b/apps/cli/src/commands/config/pull/pull.handler.ts
@@ -35,7 +35,8 @@ import type { ConfigPullFlags } from "./pull.command.ts";
 
 /**
  * `config pull` writes a remote project or branch's configuration into `supabase/config.toml`/
- * `.json` (the config root, or an existing/new `[remotes.*]` block) after a confirmation prompt.
+ * `.json`/`.jsonc` (the config root, or an existing/new `[remotes.*]` block) after a confirmation
+ * prompt.
  * Its target resolution, fetch, and classify steps mirror `config diff`'s, up to the point where
  * the two commands diverge. The plan/apply run-core is hoisted to
  * `command-internal/config-pull-run.ts` so the `supabase pull` orchestrator can reuse it.
diff --git a/apps/cli/src/commands/config/pull/pull.integration.test.ts b/apps/cli/src/commands/config/pull/pull.integration.test.ts
index aad7130413..103950b6a6 100644
--- a/apps/cli/src/commands/config/pull/pull.integration.test.ts
+++ b/apps/cli/src/commands/config/pull/pull.integration.test.ts
@@ -2115,6 +2115,26 @@ describe("config pull integration", () => {
     },
   );
 
+  it.effect(
+    "a commented config.jsonc with a trailing comma keeps its bytes except the drifted value",
+    () => {
+      const before = `{
+  // local overrides
+  "project_id": "test",
+  "api": {
+    "max_rows": 500, /* rows per page */
+  },
+}
+`;
+      const { layer } = setup({ yes: true });
+      return Effect.gen(function* () {
+        yield* writeProjectFile("config.jsonc", before);
+        yield* configPull(noFlags);
+        expect(yield* readProjectFile("config.jsonc")).toBe(before.replace("500", "1000"));
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
   it.effect("a branch-lookup transport failure maps to the branch list network error", () => {
     const { layer } = setup({ toml: 'project_id = "test"\n', branchList: "fail" });
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/config/push/push.auth-email-content.unit.test.ts b/apps/cli/src/commands/config/push/push.auth-email-content.unit.test.ts
index 9d4b8f0170..890db7adb2 100644
--- a/apps/cli/src/commands/config/push/push.auth-email-content.unit.test.ts
+++ b/apps/cli/src/commands/config/push/push.auth-email-content.unit.test.ts
@@ -21,6 +21,7 @@ const emptyEmail = {
   double_confirm_changes: true,
   enable_confirmations: false,
   secure_password_change: false,
+  require_current_password: false,
   max_frequency: "1s",
   otp_length: 6,
   otp_expiry: 3600,
diff --git a/apps/cli/src/commands/config/push/push.command.ts b/apps/cli/src/commands/config/push/push.command.ts
index 4710b75177..2bfb1fe306 100644
--- a/apps/cli/src/commands/config/push/push.command.ts
+++ b/apps/cli/src/commands/config/push/push.command.ts
@@ -33,7 +33,7 @@ const configPushHandler = (flags: ConfigPushFlags) =>
 
 export const configPushCommand = Command.make("push", config).pipe(
   Command.withDescription(
-    "Pushes the properties your local config.toml declares to the linked project or one of its branches. Properties the file does not declare are left unchanged; run `supabase config diff` to preview. Shows the exact diff for every changed resource, then asks once before anything is written (the default answer is no). Piped answers are not read: non-interactive and JSON runs need --yes or a SUPABASE_YES set in the shell. Run `supabase config diff` first to review the changes.",
+    "Pushes the properties your local config file declares to the linked project or one of its branches. Properties the file does not declare are left unchanged; run `supabase config diff` to preview. Shows the exact diff for every changed resource, then asks once before anything is written (the default answer is no). Piped answers are not read: non-interactive and JSON runs need --yes or a SUPABASE_YES set in the shell. Run `supabase config diff` first to review the changes.",
   ),
   Command.withShortDescription("Push local config to linked project"),
   Command.withExamples([
@@ -66,39 +66,39 @@ export const configPushCommand = Command.make("push", config).pipe(
           {
             operationId: "v1-update-postgrest-service-config",
             kind: "required",
-            context: "config.toml's [api] settings differ from the remote's",
+            context: "the config file's api settings differ from the remote's",
           },
           {
             operationId: "v1-update-postgres-config",
             kind: "required",
-            context: "config.toml's [db.settings] differ from the remote's",
+            context: "the config file's db.settings differ from the remote's",
           },
           {
             operationId: "v1-update-network-restrictions",
             kind: "required",
             context:
-              "config.toml sets [db.network_restrictions] enabled = true and its rules differ from the remote's",
+              "the config file sets db.network_restrictions.enabled = true and its rules differ from the remote's",
           },
           {
             operationId: "v1-update-ssl-enforcement-config",
             kind: "required",
-            context: "config.toml declares [db.ssl_enforcement] and it differs from the remote's",
+            context: "the config file declares db.ssl_enforcement and it differs from the remote's",
           },
           {
             operationId: "v1-update-auth-service-config",
             kind: "required",
             context:
-              "config.toml's [auth] settings, a referenced email template file, or a resolved auth secret differ from the remote's",
+              "the config file's auth settings, a referenced email template file, or a resolved auth secret differ from the remote's",
           },
           {
             operationId: "v1-update-storage-config",
             kind: "required",
-            context: "config.toml's [storage] settings differ from the remote's",
+            context: "the config file's storage settings differ from the remote's",
           },
           {
             operationId: "v1-enable-database-webhook",
             kind: "required",
-            context: "config.toml sets [experimental.webhooks] enabled = true",
+            context: "the config file sets experimental.webhooks.enabled = true",
           },
         ],
       },
diff --git a/apps/cli/src/commands/config/push/push.e2e.test.ts b/apps/cli/src/commands/config/push/push.e2e.test.ts
index 17215fc1a1..de09a2c99e 100644
--- a/apps/cli/src/commands/config/push/push.e2e.test.ts
+++ b/apps/cli/src/commands/config/push/push.e2e.test.ts
@@ -86,6 +86,8 @@ describe("supabase config push", () => {
                         max_rows: 500,
                         db_pool: null,
                         db_pool_acquisition_timeout: null,
+                        db_pool_max_lifetime: null,
+                        db_pool_max_idletime: null,
                       });
                     });
                   }
diff --git a/apps/cli/src/commands/config/push/push.encoders.ts b/apps/cli/src/commands/config/push/push.encoders.ts
index 6364d12c66..15a3b6d3b2 100644
--- a/apps/cli/src/commands/config/push/push.encoders.ts
+++ b/apps/cli/src/commands/config/push/push.encoders.ts
@@ -1315,6 +1315,11 @@ export const PUSH_AUTH_LEAF_MAP: ReadonlyArray<PushAuthLeafSpec> = [
     apiKey: "security_update_password_require_reauthentication",
     transform: asBoolean,
   },
+  {
+    configPath: ["auth", "email", "require_current_password"],
+    apiKey: "security_update_password_require_current_password",
+    transform: asBoolean,
+  },
   {
     configPath: ["auth", "email", "max_frequency"],
     apiKey: "smtp_max_frequency",
diff --git a/apps/cli/src/commands/config/push/push.encoders.unit.test.ts b/apps/cli/src/commands/config/push/push.encoders.unit.test.ts
index 60e28b5ee8..1b787e4afa 100644
--- a/apps/cli/src/commands/config/push/push.encoders.unit.test.ts
+++ b/apps/cli/src/commands/config/push/push.encoders.unit.test.ts
@@ -1663,9 +1663,9 @@ describe("auth encoder key-name drift guard", () => {
     ...notificationPairs,
   ];
 
-  it("covers exactly 192 (configPath, apiKey) pairs (47 leaf + 6 smtp + 3 captcha + 18 hooks + 84 providers + 14 sms credentials + 6 template subjects + 14 notifications)", () => {
-    expect(leafPairs.length).toBe(47);
-    expect(allPairs.length).toBe(192);
+  it("covers exactly 193 (configPath, apiKey) pairs (48 leaf + 6 smtp + 3 captcha + 18 hooks + 84 providers + 14 sms credentials + 6 template subjects + 14 notifications)", () => {
+    expect(leafPairs.length).toBe(48);
+    expect(allPairs.length).toBe(193);
   });
 
   it.each(allPairs.map((pair) => [pair.configPath.join("."), pair] as const))(
diff --git a/apps/cli/src/commands/config/push/push.format.ts b/apps/cli/src/commands/config/push/push.format.ts
index 1ec601d888..554f3d23c4 100644
--- a/apps/cli/src/commands/config/push/push.format.ts
+++ b/apps/cli/src/commands/config/push/push.format.ts
@@ -1,5 +1,6 @@
 import type { ConfigChange } from "@supabase/config";
 
+import { configFileName, DEFAULT_CONFIG_FILE } from "../../../command-internal/config-advice.ts";
 import { sanitizeInlineName } from "../../../command-internal/http-errors.ts";
 import {
   configEnvOriginList,
@@ -146,13 +147,13 @@ function renderExtraBlocks(extras: ReadonlyArray<PushExtra>): string {
 /** `[group-write]` blocks — an undeclared companion the target endpoint required alongside a
  *  declared change, sent at its config schema default since the remote returned no current value
  *  (see `pushNotes`'s matching note). */
-function renderForcedBlocks(forced: ReadonlyArray<PushForced>): string {
+function renderForcedBlocks(forced: ReadonlyArray<PushForced>, configPath: string): string {
   return forced
     .map((entry) =>
       renderBlock(
         entry.path,
         "group-write",
-        `${configRenderValue(entry.value, "(unset)")} (schema default — not declared in config.toml)`,
+        `${configRenderValue(entry.value, "(unset)")} (schema default — not declared in ${configFileName(configPath)})`,
         "(not returned)",
       ),
     )
@@ -171,6 +172,8 @@ export interface PushUpdatingLineInput {
   readonly extras: ReadonlyArray<PushExtra>;
   readonly forced: ReadonlyArray<PushForced>;
   readonly originFor?: ConfigEnvOriginLookup;
+  /** The config file named in "not declared" notes; defaults to `supabase/config.toml`. */
+  readonly configPath?: string;
 }
 
 /**
@@ -179,12 +182,13 @@ export interface PushUpdatingLineInput {
  * format `config diff` uses; the combined block always ends on a blank line.
  */
 export function pushUpdatingLine(input: PushUpdatingLineInput): string {
+  const configPath = input.configPath ?? DEFAULT_CONFIG_FILE.path;
   return (
     `${PUSH_UPDATING_PREFIX[input.resource]}\n` +
-    configRenderChangeLines(input.changes, input.originFor) +
+    configRenderChangeLines(input.changes, input.originFor, configPath) +
     renderSecretBlocks(input.secrets, input.secretsEncoded) +
     renderExtraBlocks(input.extras) +
-    renderForcedBlocks(input.forced)
+    renderForcedBlocks(input.forced, configPath)
   );
 }
 
@@ -225,6 +229,8 @@ export interface PushNotesInput {
   readonly secretsNotSet: ReadonlyArray<ReadonlyArray<string>>;
   /** `changeSet.counts.remote_only` — hands-off, informational only. */
   readonly remoteOnly: number;
+  /** The config file named in the remote-only note; defaults to `supabase/config.toml`. */
+  readonly configPath?: string;
 }
 
 /**
@@ -279,7 +285,7 @@ export function pushNotes(input: PushNotesInput): string {
   if (input.remoteOnly > 0) {
     const n = input.remoteOnly;
     lines.push(
-      `Note: ${configPlural(n, "remote property", "remote properties")} ${n === 1 ? "is" : "are"} not declared in supabase/config.toml and ${n === 1 ? "was" : "were"} left unchanged (config push no longer resets undeclared properties to their defaults; run \`supabase config diff\` to inspect).`,
+      `Note: ${configPlural(n, "remote property", "remote properties")} ${n === 1 ? "is" : "are"} not declared in ${input.configPath ?? DEFAULT_CONFIG_FILE.path} and ${n === 1 ? "was" : "were"} left unchanged (config push no longer resets undeclared properties to their defaults; run \`supabase config diff\` to inspect).`,
     );
   }
 
diff --git a/apps/cli/src/commands/config/push/push.handler.ts b/apps/cli/src/commands/config/push/push.handler.ts
index 371a5d764a..a70b4d0988 100644
--- a/apps/cli/src/commands/config/push/push.handler.ts
+++ b/apps/cli/src/commands/config/push/push.handler.ts
@@ -12,7 +12,7 @@ import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import { requireHostedMutationConsent } from "../../../command-internal/hosted-consent/hosted-consent.ts";
 import { withAnnouncedTarget } from "../../../shared/output/command-target.service.ts";
 import { Output } from "../../../shared/output/output.service.ts";
-import { assertDecryptableSecrets } from "../../../command-internal/db-config.toml-read.ts";
+import { assertDecryptableSecrets } from "../../../command-internal/db-config.read.ts";
 import { BRANCH_UUID_PATTERN } from "../../../command-internal/ref-patterns.ts";
 import {
   sanitizeInlineName,
@@ -240,7 +240,7 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
     // call); the matching `[remotes.<name>]` overlay merges before decode in the same call.
     //
     // Needs the fully decoded document and value origins, which the tolerant
-    // `db-config.toml-read.ts` subtree reader does not produce.
+    // `db-config.read.ts` subtree reader does not produce.
     const { loaded, lookup, dotenvPrivateKeys, originFor } = yield* loadPushConfig(
       cliSettings,
       ref,
@@ -253,6 +253,7 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
       );
     }
     const config = loaded.config;
+    const configPath = relativeConfigPath(cliSettings.workdir, loaded.path);
 
     // 3. Assert every `encrypted:` value in the document can be decrypted, even fields `config
     // push` never itself pushes — this must run before the cost matrix or any service is touched.
@@ -547,6 +548,7 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
             extras: encoded.extras,
             forced: encoded.forced,
             originFor,
+            configPath,
           }),
           "stderr",
         );
@@ -672,6 +674,7 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
         ? []
         : secrets.filter((secret) => secret.status === "not_set").map((secret) => secret.path),
       remoteOnly: plan.remoteOnly,
+      configPath,
     });
     if (notes !== "") {
       yield* output.raw(notes, "stderr");
diff --git a/apps/cli/src/commands/config/push/push.integration.test.ts b/apps/cli/src/commands/config/push/push.integration.test.ts
index c7d249597b..5d2f7b9a35 100644
--- a/apps/cli/src/commands/config/push/push.integration.test.ts
+++ b/apps/cli/src/commands/config/push/push.integration.test.ts
@@ -139,6 +139,8 @@ const POSTGREST_WRITE_RESPONSE = {
   max_rows: 0,
   db_pool: null,
   db_pool_acquisition_timeout: null,
+  db_pool_max_lifetime: null,
+  db_pool_max_idletime: null,
 };
 
 /**
@@ -537,7 +539,9 @@ describe("config push integration", () => {
       const message = yield* configPush({ remote: Option.none(), projectRef: Option.none() }).pipe(
         Effect.catchTag("ConfigPushLoadConfigError", (error) => Effect.succeed(error.message)),
       );
-      expect(message).toBe("failed to parse supabase/config.json: JSON Parse error: Expected '}'");
+      expect(message).toBe(
+        "failed to parse supabase/config.json: Invalid symbol (line 1, column 2)",
+      );
       expect(api.requests).toHaveLength(0);
     }).pipe(Effect.provide(layer));
   });
@@ -1195,7 +1199,7 @@ max_rows = 1000
         Effect.catchTag("ConfigPushLoadConfigError", (error) => Effect.succeed(error.message)),
       );
       expect(message).toBe(
-        "failed to read supabase/config.toml or supabase/config.json: file not found. Run `supabase init` to create one.",
+        "failed to read supabase/config.toml, config.json or config.jsonc: file not found. Run `supabase init` to create one.",
       );
     }).pipe(Effect.provide(layer));
   });
@@ -1509,6 +1513,54 @@ otp_expiry = 120
     },
   );
 
+  it.effect("pushes a declared auth.email.require_current_password to the Auth config", () => {
+    const { layer, api } = setup({
+      toml: `project_id = "test"\n[auth.email]\nrequire_current_password = true\n`,
+      format: "json",
+      yes: true,
+    });
+    return Effect.gen(function* () {
+      yield* configPush({ remote: Option.none(), projectRef: Option.none() });
+      const update = api.requests.find(
+        (r) => r.method === "PATCH" && r.url.includes("/config/auth"),
+      );
+      expect(update?.body).toEqual({ security_update_password_require_current_password: true });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect(
+    "leaves a hosted require_current_password toggle on when the file does not declare the key",
+    () => {
+      const { layer, api, out } = setup({
+        toml: `project_id = "test"\n[auth]\nminimum_password_length = 12\n`,
+        v2: {
+          status: 200,
+          body: v2Response({
+            attributes: (a) => ({
+              ...a,
+              auth: {
+                ...asJsonRecord(a["auth"]),
+                security_update_password_require_current_password: true,
+              },
+            }),
+          }),
+        },
+        format: "json",
+        yes: true,
+      });
+      return Effect.gen(function* () {
+        yield* configPush({ remote: Option.none(), projectRef: Option.none() });
+        const update = api.requests.find(
+          (r) => r.method === "PATCH" && r.url.includes("/config/auth"),
+        );
+        expect(update?.body).toEqual({ password_min_length: 12 });
+        const success = out.messages.find((m) => m.type === "success");
+        const data = yield* decodeJsonRecord(success?.data);
+        expect(data["remote_only"]).toBe(1);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
   it.effect(
     "a declared auth.oauth_server.enabled is pushed through the auth endpoint, no longer as unmanaged or unsupported",
     () => {
diff --git a/apps/cli/src/commands/db/diff/SIDE_EFFECTS.md b/apps/cli/src/commands/db/diff/SIDE_EFFECTS.md
index 9f45c72670..fea6fd607e 100644
--- a/apps/cli/src/commands/db/diff/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/diff/SIDE_EFFECTS.md
@@ -29,21 +29,21 @@ it, and JSON `null` disables formatting without disabling safe compaction.
 
 ## Files Read
 
-| Path                                                                                                      | Format                                                                                | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `<workdir>/supabase/config.json` or `config.toml`                                                         | JSON / TOML                                                                           | always, `config.json` preferred (db port/password, `[experimental.pgdelta]`, deno_version)                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `<workdir>/supabase/.env`, `.env.local`, project-root/`SUPABASE_ENV`-selected dotenv file                 | dotenv                                                                                | shadow provisioning (all native targets, including the explicit `--from/--to migrations` shadow)                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `api.tls.cert_path` / `api.tls.key_path` (under `<workdir>/supabase/`)                                    | PEM                                                                                   | shadow provisioning, when `api.enabled && api.tls.enabled`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `auth.email.template.*` / `auth.email.notification.*` `content_path` (config-relative or absolute)        | text (existence/readability only — bytes discarded, used only to validate the config) | only when `auth.enabled`, for every configured template and every notification with `enabled = true` — via the same `readDbToml`/`checkDbToml` `Config.Validate` pipeline shared by every `db`/`migration` subcommand that loads config (`db dump`/`pull`/`reset`/`push`/`schema declarative generate`/`sync`, `migration up`/`down`/`squash` — documented once here rather than duplicated per file, CLI-2339); the resolved path is CONFINED to the project root (symlinks dereferenced using `fs.realPath`) — a path resolving outside it aborts before the read |
-| `<workdir>/supabase/migrations/*.sql`                                                                     | SQL                                                                                   | shadow provisioning (applied to the shadow source) — `--use-pgadmin` too, via the SAME `migrateShadowDatabase`                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `<workdir>/supabase/roles.sql`                                                                            | SQL                                                                                   | shadow provisioning, PG14 and PG15 alike (unlike `db reset`'s PG15-only local path); also hashed into the shadow-baseline cache key on every cache-eligible acquire, warm hits included (where no baseline is applied at all); missing file tolerated                                                                                                                                                                                                                                                                                                               |
-| `~/.supabase/cache/shadow-baseline/shadow-baseline-<key>.tar`                                             | tar                                                                                   | warm shadow-cache hit — the matching snapshot is streamed into the fresh shadow; every cache-eligible acquire (warm hit and successful cold export) also enumerates and `stat`s every `shadow-baseline-*.tar` for LRU keep-3 + 2-day mtime TTL and may delete other keys (`SUPABASE_HOME` overrides the `~/.supabase` root)                                                                                                                                                                                                                                         |
-| managed snapshot key `<key>`                                                                              | backend                                                                               | warm stack-shadow cache hit; managed retention may evict entries and snapshots survive stack destruction                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| `~/.supabase/cache/shadow-baseline/shadow-baseline-<key>.tar.<pid>.partial`                               | tar                                                                                   | abandoned-partial sweep on every cache-eligible acquire (warm hit and cold export) — enumerated and `stat`ed, and removed when older than 5 minutes (a crashed/SIGKILLed earlier export's leftover)                                                                                                                                                                                                                                                                                                                                                                 |
-| `[db.migrations].schema_paths` globs / `<workdir>/supabase/database/**` / `<workdir>/supabase/schemas/**` | SQL                                                                                   | migra engine only, for the local-target declarative-schema fallback; pg-delta always compares the migrations baseline directly to the live target                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `~/.supabase/access-token`                                                                                | plain text                                                                            | a remote project or branch with no `SUPABASE_ACCESS_TOKEN`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `<workdir>/supabase/.temp/project-ref`                                                                    | plain text                                                                            | bare `--remote`, ref resolution — skipped when `SUPABASE_PROJECT_ID` is set; with no selector, only to name the project in the `Target:` hint                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `PGSSL*` PEM, `pg_service.conf`                                                                           | PEM, libpq                                                                            | remote project, when set; under migra or pgAdmin the PEM files are read only on the pooler temp-role probe or migra's OOM-fallback schema listing; see `db push`                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Path                                                                                                      | Format                                                                                | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.json` or `config.toml`                                                         | JSON / TOML                                                                           | always, `config.json` preferred (db port/password, `[experimental.pgdelta]`, deno_version)                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `<workdir>/supabase/.env`, `.env.local`, project-root/`SUPABASE_ENV`-selected dotenv file                 | dotenv                                                                                | shadow provisioning (all native targets, including the explicit `--from/--to migrations` shadow)                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `api.tls.cert_path` / `api.tls.key_path` (under `<workdir>/supabase/`)                                    | PEM                                                                                   | shadow provisioning, when `api.enabled && api.tls.enabled`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `auth.email.template.*` / `auth.email.notification.*` `content_path` (config-relative or absolute)        | text (existence/readability only — bytes discarded, used only to validate the config) | only when `auth.enabled`, for every configured template and every notification with `enabled = true` — via the same `readDbConfig`/`checkDbConfig` `Config.Validate` pipeline shared by every `db`/`migration` subcommand that loads config (`db dump`/`pull`/`reset`/`push`/`schema declarative generate`/`sync`, `migration up`/`down`/`squash` — documented once here rather than duplicated per file, CLI-2339); the resolved path is CONFINED to the project root (symlinks dereferenced using `fs.realPath`) — a path resolving outside it aborts before the read |
+| `<workdir>/supabase/migrations/*.sql`                                                                     | SQL                                                                                   | shadow provisioning (applied to the shadow source) — `--use-pgadmin` too, via the SAME `migrateShadowDatabase`                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `<workdir>/supabase/roles.sql`                                                                            | SQL                                                                                   | shadow provisioning, PG14 and PG15 alike (unlike `db reset`'s PG15-only local path); also hashed into the shadow-baseline cache key on every cache-eligible acquire, warm hits included (where no baseline is applied at all); missing file tolerated                                                                                                                                                                                                                                                                                                                   |
+| `~/.supabase/cache/shadow-baseline/shadow-baseline-<key>.tar`                                             | tar                                                                                   | warm shadow-cache hit — the matching snapshot is streamed into the fresh shadow; every cache-eligible acquire (warm hit and successful cold export) also enumerates and `stat`s every `shadow-baseline-*.tar` for LRU keep-3 + 2-day mtime TTL and may delete other keys (`SUPABASE_HOME` overrides the `~/.supabase` root)                                                                                                                                                                                                                                             |
+| managed snapshot key `<key>`                                                                              | backend                                                                               | warm stack-shadow cache hit; managed retention may evict entries and snapshots survive stack destruction                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `~/.supabase/cache/shadow-baseline/shadow-baseline-<key>.tar.<pid>.partial`                               | tar                                                                                   | abandoned-partial sweep on every cache-eligible acquire (warm hit and cold export) — enumerated and `stat`ed, and removed when older than 5 minutes (a crashed/SIGKILLed earlier export's leftover)                                                                                                                                                                                                                                                                                                                                                                     |
+| `[db.migrations].schema_paths` globs / `<workdir>/supabase/database/**` / `<workdir>/supabase/schemas/**` | SQL                                                                                   | migra engine only, for the local-target declarative-schema fallback; pg-delta always compares the migrations baseline directly to the live target                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `~/.supabase/access-token`                                                                                | plain text                                                                            | a remote project or branch with no `SUPABASE_ACCESS_TOKEN`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `<workdir>/supabase/.temp/project-ref`                                                                    | plain text                                                                            | bare `--remote`, ref resolution — skipped when `SUPABASE_PROJECT_ID` is set; with no selector, only to name the project in the `Target:` hint                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `PGSSL*` PEM, `pg_service.conf`                                                                           | PEM, libpq                                                                            | remote project, when set; under migra or pgAdmin the PEM files are read only on the pooler temp-role probe or migra's OOM-fallback schema listing; see `db push`                                                                                                                                                                                                                                                                                                                                                                                                        |
 
 ## Files Written
 
diff --git a/apps/cli/src/commands/db/diff/diff.handler.ts b/apps/cli/src/commands/db/diff/diff.handler.ts
index f5043d3e0f..e897e45e9a 100644
--- a/apps/cli/src/commands/db/diff/diff.handler.ts
+++ b/apps/cli/src/commands/db/diff/diff.handler.ts
@@ -16,10 +16,10 @@ import { CliConfigKeys } from "../../../config/cli-config-keys.ts";
 import { CliConfigValues } from "../../../config/cli-config-values.service.ts";
 import { aqua, yellow } from "../../../command-internal/colors.ts";
 import {
-  readDbToml,
+  readDbConfig,
   resolveDeclarativeDir,
-  type DbTomlValues,
-} from "../../../command-internal/db-config.toml-read.ts";
+  type DbConfigValues,
+} from "../../../command-internal/db-config.read.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
 import { hostedMutationPreapproval } from "../../../command-internal/hosted-consent/hosted-consent.ts";
 import {
@@ -225,18 +225,20 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
       let mergedLinkedRef: string | undefined;
       // The first migrations endpoint resolved wins: the engine provisions a single migrations
       // shadow/catalog, so only refs resolved before that point should influence it.
-      let migrationsToml: DbTomlValues | undefined;
+      let migrationsToml: DbConfigValues | undefined;
       // The project `remote` names resolves once, so `--from remote --to remote` announces it once.
       let linkedTarget: LinkedTarget | undefined;
       const namedTargets = new Map<string, LinkedTarget>();
       // Each hosted resolution mints a temporary login role that invalidates the previous one for
       // that project, so every ref to a project shares a single connection.
       const hostedEndpoints = new Map<string, PgDeltaDatabaseEndpoint>();
-      let loadedCfg: { readonly ref: string | undefined; readonly toml: DbTomlValues } | undefined;
+      let loadedCfg:
+        | { readonly ref: string | undefined; readonly toml: DbConfigValues }
+        | undefined;
       const loadCfg = Effect.fnUntraced(function* () {
         const ref = mergedLinkedRef;
         if (loadedCfg !== undefined && loadedCfg.ref === ref) return loadedCfg.toml;
-        const toml = yield* readDbToml(fs, path, cliSettings.workdir, ref);
+        const toml = yield* readDbConfig(fs, path, cliSettings.workdir, ref);
         loadedCfg = { ref, toml };
         return toml;
       });
@@ -462,7 +464,7 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
       // fallible) resolve, so the project cache is still written even if a later step fails.
       yield* Ref.set(linkedRefForCache, Option.some(linkedRef));
     }
-    const cfg = yield* readDbToml(fs, path, cliSettings.workdir, linkedRef);
+    const cfg = yield* readDbConfig(fs, path, cliSettings.workdir, linkedRef);
     if (cfg.appliedRemote !== undefined) {
       yield* output.raw(`Loading config override: [remotes.${cfg.appliedRemote}]\n`, "stderr");
     }
@@ -486,7 +488,7 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
       debug,
       // So the shadow's own container spec (image/JWT secret/root key/db.settings/service
       // enabled-for-setup flags) reflects the matching `[remotes.<ref>]` override too, same
-      // as `cfg` above (`readDbToml(..., linkedRef)`).
+      // as `cfg` above (`readDbConfig(..., linkedRef)`).
       linkedRef,
     );
 
@@ -515,7 +517,7 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
     });
     // pg-delta ignores schema_paths when building its migrations baseline.
     if (useDelta && cfg.schemaPaths !== undefined && cfg.schemaPaths.length > 0) {
-      yield* output.raw(schemaPathsTransitionWarning, "stderr");
+      yield* output.raw(schemaPathsTransitionWarning(cfg.configFile), "stderr");
     }
 
     // pgAdmin's own text-mode status lines go to stdout, not stderr, unlike the migra/pg-delta
@@ -636,7 +638,7 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
         migrationMode,
         // `cfg.schemaPathPatterns`, not `localInputs.context.config.db.migrations.schema_paths`:
         // the latter is the raw `@supabase/config` field, which never applies the
-        // `SUPABASE_DB_MIGRATIONS_SCHEMA_PATHS` env override that `cfg` (`readDbToml`) resolves.
+        // `SUPABASE_DB_MIGRATIONS_SCHEMA_PATHS` env override that `cfg` (`readDbConfig`) resolves.
         schemaPaths: cfg.schemaPathPatterns,
         pgDelta: cfg.pgDelta,
       };
diff --git a/apps/cli/src/commands/db/diff/diff.integration.test.ts b/apps/cli/src/commands/db/diff/diff.integration.test.ts
index e634d2951a..12f4e3ab0f 100644
--- a/apps/cli/src/commands/db/diff/diff.integration.test.ts
+++ b/apps/cli/src/commands/db/diff/diff.integration.test.ts
@@ -1,5 +1,5 @@
 import { unusedGateway, unusedStackServices } from "../../../../tests/helpers/unused-stack.ts";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -546,7 +546,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
         yield* fs.writeFileString(path.join(workdir, file), content);
       }
     }),
-  ).pipe(Layer.provide(BunServices.layer));
+  ).pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
 
   const projectHttp = recordingProjectHttpClient(VALID_REF);
   const baseLayer = Layer.mergeAll(
@@ -554,6 +554,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     // Listed first so the fake service layers below (`Layer.mergeAll` is last-wins)
     // override its real implementations, matching `start.integration.test.ts`.
     BunServices.layer,
+    BunCrypto.layer,
     out.layer,
     configValuesLayer({
       output: out.layer,
@@ -1021,7 +1022,7 @@ describe("db diff", () => {
         );
         expect(err).toContain("the configured declarative schema directory are not read");
         expect(err).toContain("or pass --use-migra to diff them with migra");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("omits the migra suggestion for a custom dir migra would not read", () =>
@@ -3625,7 +3626,7 @@ describe("db diff", () => {
         expect(pgDeltaRun.dockerDaemon?.stepCalls("cp-out")).toHaveLength(1);
         expect(yield* publishedTars()).toHaveLength(2);
         expect(yield* publishedTars()).toEqual(expect.arrayContaining(migraTars));
-      }).pipe(Effect.provide(BunServices.layer));
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
   });
 });
@@ -3659,7 +3660,7 @@ describe("db diff permissions through the real resolver and cache", () => {
       });
     }).pipe(
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
     );
   });
@@ -3681,7 +3682,7 @@ describe("db diff permissions through the real resolver and cache", () => {
       });
     }).pipe(
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
     );
   });
@@ -3711,7 +3712,7 @@ describe("db diff permissions through the real resolver and cache", () => {
         });
       }).pipe(
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
         provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
       );
     });
@@ -3739,7 +3740,7 @@ describe("db diff permissions through the real resolver and cache", () => {
       });
     }).pipe(
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
     );
   });
@@ -3762,7 +3763,7 @@ describe("db diff permissions through the real resolver and cache", () => {
       });
     }).pipe(
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
     );
   });
@@ -3786,7 +3787,7 @@ describe("db diff permissions through the real resolver and cache", () => {
         });
       }).pipe(
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
         provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
       );
     },
diff --git a/apps/cli/src/commands/db/diff/diff.stack-cache.e2e.test.ts b/apps/cli/src/commands/db/diff/diff.stack-cache.e2e.test.ts
index 06ef9201d1..238bb1c673 100644
--- a/apps/cli/src/commands/db/diff/diff.stack-cache.e2e.test.ts
+++ b/apps/cli/src/commands/db/diff/diff.stack-cache.e2e.test.ts
@@ -1,6 +1,6 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, FileSystem, Path, Redacted } from "effect";
+import { Effect, FileSystem, Layer, Path, Redacted } from "effect";
 import { FetchHttpClient } from "effect/http";
 import { create as createStack, discover as discoverStacks } from "@supabase/stack/effect";
 import { runSupabaseEffect } from "../../../../tests/helpers/cli.ts";
@@ -132,7 +132,10 @@ describe("supabase db diff (stack shadow baseline cache)", () => {
 
           const registered = yield* discoverStacks({ stateRoot: path.join(home, "stacks") });
           expect(registered.map(({ definition }) => definition.id)).toEqual([stack.id]);
-        }).pipe(Effect.scoped, Effect.provide([BunServices.layer, FetchHttpClient.layer])),
+        }).pipe(
+          Effect.scoped,
+          Effect.provide([Layer.merge(BunServices.layer, BunCrypto.layer), FetchHttpClient.layer]),
+        ),
       { timeout: TEST_TIMEOUT_MS },
     );
   }
diff --git a/apps/cli/src/commands/db/dump/SIDE_EFFECTS.md b/apps/cli/src/commands/db/dump/SIDE_EFFECTS.md
index 8fd54cf5cd..60a2e61772 100644
--- a/apps/cli/src/commands/db/dump/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/dump/SIDE_EFFECTS.md
@@ -112,7 +112,9 @@ shell inherits the suppressing variables and is missed.
 - **TLS settings in `pg_dump`.** A remote target (a remote project or branch, or
   `--remote=<url>`) gets the resolved `sslmode` and connect timeout, the root cert only under
   `require`/`verify-ca`/`verify-full`, and the client cert and key unless the key needs
-  `sslpassword` (libpq reads no passphrase from the environment). `system` pins
+  `sslpassword` (libpq reads no passphrase from the environment). The Supabase CA pin that
+  `db push` describes reaches `pg_dump` as `PGSSLMODE=require` only: the inline CA is not
+  forwarded, so `pg_dump` requires TLS without verifying the server. `system` pins
   `verify-full`. Verifying without a root cert, or with `system`, uses the image's trust
   store in a container and the host's CA bundle for a native `pg_dump`, which keeps
   libpq's `~/.postgresql/root.crt` when no root cert is set, keeps `system` on libpq 16+
diff --git a/apps/cli/src/commands/db/dump/dump.handler.ts b/apps/cli/src/commands/db/dump/dump.handler.ts
index 922941028b..3849c032eb 100644
--- a/apps/cli/src/commands/db/dump/dump.handler.ts
+++ b/apps/cli/src/commands/db/dump/dump.handler.ts
@@ -7,7 +7,7 @@ import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
 import { hostedMutationPreapproval } from "../../../command-internal/hosted-consent/hosted-consent.ts";
 import { resolveTarget } from "../../../command-internal/target/resolve-target.ts";
-import { loadProjectEnvValues, readDbToml } from "../../../command-internal/db-config.toml-read.ts";
+import { loadProjectEnvValues, readDbConfig } from "../../../command-internal/db-config.read.ts";
 import { parseConnectionString } from "../../../command-internal/db-config.parse.ts";
 import { resolveDbImage } from "../../../command-internal/db-image.ts";
 import {
@@ -160,7 +160,7 @@ export const dbDump = Effect.fn("db.dump")(function* (flags: DbDumpFlags) {
 
     // Read before the dry-run print so an invalid merged config fails rather than
     // silently printing a script.
-    const tomlValues = yield* readDbToml(fs, path, cliSettings.workdir, linkedRef);
+    const tomlValues = yield* readDbConfig(fs, path, cliSettings.workdir, linkedRef);
 
     const backend = yield* currentStackBackend;
     const managedProject =
diff --git a/apps/cli/src/commands/db/lint/lint.layers.unit.test.ts b/apps/cli/src/commands/db/lint/lint.layers.unit.test.ts
index 020745f2df..7e65da0977 100644
--- a/apps/cli/src/commands/db/lint/lint.layers.unit.test.ts
+++ b/apps/cli/src/commands/db/lint/lint.layers.unit.test.ts
@@ -12,7 +12,7 @@
  */
 
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer, Option } from "effect";
 
 import {
@@ -98,6 +98,7 @@ function ambientStubs() {
 
   return Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     // The runtime layer under test builds the real `commandSettingsLayer` against the
     // real filesystem — see `isolatedHomeLayer`'s docs.
     isolatedHomeLayer(tempRoot.current),
diff --git a/apps/cli/src/commands/db/pull/SIDE_EFFECTS.md b/apps/cli/src/commands/db/pull/SIDE_EFFECTS.md
index 8078340877..2a349c6e65 100644
--- a/apps/cli/src/commands/db/pull/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/pull/SIDE_EFFECTS.md
@@ -27,7 +27,9 @@ find a shadow left by an abrupt CLI exit. Each shadow owns a unique temporary pr
 and uses an automatically assigned port; `db.shadow_port` applies only to the legacy backend. Migra (`--diff-engine migra`) is rejected in stack mode.
 A `--remote=<url>` whose host and port match the running project stack's SQL endpoint (the `DB_URL`
 from `stack status --env`) is a local target and connects in plaintext, like the default local
-target; a remote or multi-host URL without an explicit `sslmode` still requires TLS.
+target; a remote or multi-host URL without an explicit `sslmode` tries TLS first and falls back to
+plaintext when the server declines it or `pg_hba` rejects the TLS connection, as libpq `prefer`
+does.
 
 Pg-delta runs in-process. Coverage gaps warn; `--strict-coverage` makes them
 fatal, while `PGDELTA_DEBUG` writes diagnostic JSON under
@@ -54,18 +56,18 @@ disables formatting without disabling safe compaction.
 
 ## Files Written
 
-| Path                                                                        | Format  | When                                                                                                                                                                                                                                                                                                                                 |
-| --------------------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `<workdir>/supabase/migrations/<YYYYMMDDHHMMSS>_<name>.sql`                 | SQL     | migration-style pull (non-empty diff, or the initial-migra `pg_dump` seed)                                                                                                                                                                                                                                                           |
-| `<workdir>/supabase/schemas/**`                                             | SQL     | `--declarative` export                                                                                                                                                                                                                                                                                                               |
-| `<workdir>/supabase/schemas/.pgdelta-export.json`                           | JSON    | bundled declarative export metadata                                                                                                                                                                                                                                                                                                  |
-| `<workdir>/supabase/config.toml`                                            | TOML    | declarative export updates `[db.migrations].schema_paths` only when `[experimental.pgdelta] enabled = false`; skipped when `enabled` resolves true (section absent, `enabled` omitted, or `enabled = true` — the default)                                                                                                            |
-| `<workdir>/supabase/.temp/pgdelta/v2/debug/<id>/*.json`                     | JSON    | bundled engine with `PGDELTA_DEBUG`                                                                                                                                                                                                                                                                                                  |
-| `~/.supabase/cache/shadow-baseline/shadow-baseline-<key>.tar`               | tar     | cache-enabled COLD shadow provision creates the current key's snapshot, migration-style pull only (never a declarative export, which provisions no shadow); a warm hit `touch`es its mtime (LRU); every cache-eligible acquire may delete other keys under LRU keep-3 + 2-day mtime TTL — ~90MB (`SUPABASE_HOME` overrides the root) |
-| managed snapshot key `<key>`                                                | backend | stack-mode cache-enabled cold shadow provision saves the database baseline; the last completed save replaces the key                                                                                                                                                                                                                 |
-| `~/.supabase/cache/shadow-baseline/shadow-baseline-<key>.tar.<pid>.partial` | tar     | during a cold export — the in-flight temp file, `rename`d into the tar above on success and removed on failure; only a crash/SIGKILL leaves it behind, and later cold exports / warm hits sweep leftovers older than 5 minutes                                                                                                       |
-| `<workdir>/supabase/.temp/linked-project.json`                              | JSON    | a remote project or branch (post-run cache)                                                                                                                                                                                                                                                                                          |
-| `~/.supabase/telemetry.json`                                                | JSON    | every invocation (post-run)                                                                                                                                                                                                                                                                                                          |
+| Path                                                                        | Format  | When                                                                                                                                                                                                                                                                                                                                                 |
+| --------------------------------------------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/migrations/<YYYYMMDDHHMMSS>_<name>.sql`                 | SQL     | migration-style pull (non-empty diff, or the initial-migra `pg_dump` seed)                                                                                                                                                                                                                                                                           |
+| `<workdir>/supabase/schemas/**`                                             | SQL     | `--declarative` export                                                                                                                                                                                                                                                                                                                               |
+| `<workdir>/supabase/schemas/.pgdelta-export.json`                           | JSON    | bundled declarative export metadata                                                                                                                                                                                                                                                                                                                  |
+| `<workdir>/supabase/config.toml`                                            | TOML    | declarative export updates `[db.migrations].schema_paths` (or `db.migrations.schema_paths` in `config.json`/`config.jsonc`, span-edited with comments kept, when one exists instead) only when `[experimental.pgdelta] enabled = false`; skipped when `enabled` resolves true (section absent, `enabled` omitted, or `enabled = true` — the default) |
+| `<workdir>/supabase/.temp/pgdelta/v2/debug/<id>/*.json`                     | JSON    | bundled engine with `PGDELTA_DEBUG`                                                                                                                                                                                                                                                                                                                  |
+| `~/.supabase/cache/shadow-baseline/shadow-baseline-<key>.tar`               | tar     | cache-enabled COLD shadow provision creates the current key's snapshot, migration-style pull only (never a declarative export, which provisions no shadow); a warm hit `touch`es its mtime (LRU); every cache-eligible acquire may delete other keys under LRU keep-3 + 2-day mtime TTL — ~90MB (`SUPABASE_HOME` overrides the root)                 |
+| managed snapshot key `<key>`                                                | backend | stack-mode cache-enabled cold shadow provision saves the database baseline; the last completed save replaces the key                                                                                                                                                                                                                                 |
+| `~/.supabase/cache/shadow-baseline/shadow-baseline-<key>.tar.<pid>.partial` | tar     | during a cold export — the in-flight temp file, `rename`d into the tar above on success and removed on failure; only a crash/SIGKILL leaves it behind, and later cold exports / warm hits sweep leftovers older than 5 minutes                                                                                                                       |
+| `<workdir>/supabase/.temp/linked-project.json`                              | JSON    | a remote project or branch (post-run cache)                                                                                                                                                                                                                                                                                                          |
+| `~/.supabase/telemetry.json`                                                | JSON    | every invocation (post-run)                                                                                                                                                                                                                                                                                                                          |
 
 ## Docker
 
diff --git a/apps/cli/src/commands/db/pull/pull.command.ts b/apps/cli/src/commands/db/pull/pull.command.ts
index 4a40b06b7c..7da62da174 100644
--- a/apps/cli/src/commands/db/pull/pull.command.ts
+++ b/apps/cli/src/commands/db/pull/pull.command.ts
@@ -72,7 +72,7 @@ const config = {
 export type DbPullFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 const DECLARATIVE_SUGGESTION =
-  "Use --declarative to pull the declarative schema. The diff engine is chosen with --diff-engine or [experimental.pgdelta] enabled in config.toml.";
+  "Use --declarative to pull the declarative schema. The diff engine is chosen with --diff-engine or experimental.pgdelta.enabled in the config file.";
 
 const EXPERIMENTAL_SUGGESTION =
   "Use --declarative to pull per-object schema files, or pass --experimental=false (or unset SUPABASE_EXPERIMENTAL) for a migration pull.";
diff --git a/apps/cli/src/commands/db/pull/pull.handler.ts b/apps/cli/src/commands/db/pull/pull.handler.ts
index 937632f570..e3cc13bb63 100644
--- a/apps/cli/src/commands/db/pull/pull.handler.ts
+++ b/apps/cli/src/commands/db/pull/pull.handler.ts
@@ -1,7 +1,7 @@
 import { Config, ConfigProvider, Effect, FileSystem, Option, Path } from "effect";
 
 import { aqua } from "../../../command-internal/colors.ts";
-import { loadProjectEnvValues } from "../../../command-internal/db-config.toml-read.ts";
+import { loadProjectEnvValues } from "../../../command-internal/db-config.read.ts";
 import {
   resolveExperimentalWithProjectEnv,
   WorkdirFlag,
diff --git a/apps/cli/src/commands/db/pull/pull.integration.test.ts b/apps/cli/src/commands/db/pull/pull.integration.test.ts
index 32353a08ed..3f4ef20d40 100644
--- a/apps/cli/src/commands/db/pull/pull.integration.test.ts
+++ b/apps/cli/src/commands/db/pull/pull.integration.test.ts
@@ -1,5 +1,5 @@
 import { unusedStackServices } from "../../../../tests/helpers/unused-stack.ts";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -478,7 +478,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
         yield* fs.writeFileString(path.join(workdir, file), content);
       }
     }),
-  ).pipe(Layer.provide(BunServices.layer));
+  ).pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
 
   const projectHttp = recordingProjectHttpClient(VALID_REF);
   const engineLayer = Layer.mergeAll(
@@ -486,6 +486,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     // Listed first so the fake service layers below (`Layer.mergeAll` is last-wins)
     // override its real implementations, matching `start.integration.test.ts`.
     BunServices.layer,
+    BunCrypto.layer,
     pgDeltaEngine,
     edge,
     docker,
@@ -1457,7 +1458,7 @@ describe("db pull", () => {
       expect(error.message).toBe(`No schema changes found (debug bundle: ${debugDir})`);
       expect(streamText(s.out, "stderr")).toContain(`Debug information saved to`);
       expect(streamText(s.out, "stderr")).toContain(debugDir);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("asks once before writing and records the migration on yes (tty)", () => {
@@ -2229,7 +2230,7 @@ describe("db pull", () => {
         expect(pgDeltaRun.dockerDaemon?.stepCalls("cp-out")).toHaveLength(1);
         expect(yield* publishedTars()).toHaveLength(2);
         expect(yield* publishedTars()).toEqual(expect.arrayContaining(migraTars));
-      }).pipe(Effect.provide(BunServices.layer));
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
   });
 });
@@ -2275,7 +2276,7 @@ describe("db pull permissions through the real resolver and cache", () => {
       });
     }).pipe(
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
     );
   });
@@ -2308,7 +2309,7 @@ describe("db pull permissions through the real resolver and cache", () => {
       });
     }).pipe(
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
     );
   });
@@ -2334,7 +2335,7 @@ describe("db pull permissions through the real resolver and cache", () => {
         });
       }).pipe(
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
         provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
       );
     },
@@ -2372,7 +2373,7 @@ describe("db pull permissions through the real resolver and cache", () => {
       });
     }).pipe(
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
     );
   });
diff --git a/apps/cli/src/commands/db/pull/pull.removed-flag.integration.test.ts b/apps/cli/src/commands/db/pull/pull.removed-flag.integration.test.ts
index f78992309d..de02809de3 100644
--- a/apps/cli/src/commands/db/pull/pull.removed-flag.integration.test.ts
+++ b/apps/cli/src/commands/db/pull/pull.removed-flag.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { afterEach, beforeEach, describe, expect, it, vi } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Layer, Path, Stdio } from "effect";
 import { CliOutput, Command } from "effect/cli";
@@ -25,7 +25,7 @@ const testRoot = Command.make("supabase").pipe(
 );
 
 const USE_PG_DELTA_SUGGESTION =
-  "Use --declarative to pull the declarative schema. The diff engine is chosen with --diff-engine or [experimental.pgdelta] enabled in config.toml.";
+  "Use --declarative to pull the declarative schema. The diff engine is chosen with --diff-engine or experimental.pgdelta.enabled in the config file.";
 const EXPERIMENTAL_MESSAGE = "The --experimental structured-dump mode of db pull was removed.";
 const EXPERIMENTAL_SUGGESTION =
   "Use --declarative to pull per-object schema files, or pass --experimental=false (or unset SUPABASE_EXPERIMENTAL) for a migration pull.";
@@ -73,7 +73,7 @@ const runDbPull = (
       Effect.exit,
     );
     return { exit, out, analytics, workdir };
-  }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+  }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const removedError = (exit: Exit.Exit<unknown, unknown>) => {
   expect(Exit.isFailure(exit)).toBe(true);
diff --git a/apps/cli/src/commands/db/push/SIDE_EFFECTS.md b/apps/cli/src/commands/db/push/SIDE_EFFECTS.md
index 6b74b50f73..01b28f9cfd 100644
--- a/apps/cli/src/commands/db/push/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/push/SIDE_EFFECTS.md
@@ -144,11 +144,23 @@ project ref and its environment.
   adopted into TS in PR supabase/cli#5671 (landed on develop as `b48fad60`).
 - **Remote-project libpq env.** On every remote-project database connection, `PGSSLMODE`, `PGSSLROOTCERT`,
   `PGSSLCERT`/`PGSSLKEY`/`PGSSLPASSWORD`, `PGCONNECT_TIMEOUT`, and `PGSERVICE`/`PGSERVICEFILE` are
-  read from the shell only, never the project `.env*` (`gen types` keeps its pinned mode and CA,
-  except on the pooler temp-role probe), on the direct host and the IPv4 pooler alike; host, port,
-  role, and database stay pinned. As in libpq, a `PGSERVICE` entry's settings outrank these vars.
+  read from the shell only, never the project `.env*`, on the direct host and the IPv4 pooler
+  alike; host, port, role, and database stay pinned. As in libpq, a `PGSERVICE` entry's settings outrank these vars.
   An invalid mode or `PGCONNECT_TIMEOUT`, an unknown `PGSERVICE`, or a lone `PGSSLCERT`/`PGSSLKEY`
   outside `sslmode=disable` fails with `invalid libpq environment` on either route.
+  **Supabase CA pin (every remote-project connection, shared by all commands that resolve a linked
+  database):** when `sslmode` is not set (query, `pg_service.conf` or `PGSSLMODE`) and the host
+  is a `db.<ref>.<project_host>` direct host or a
+  pooler host of the `supabase`, `supabase-staging` or `snap` built-in profile, the connection uses
+  `sslmode=require` with the bundled Supabase root CA, which the driver verifies as `verify-ca`
+  (chain checked, hostname not). A root cert set without `sslmode` (`PGSSLROOTCERT`, query or
+  service) replaces the bundled CA but keeps `sslmode=require`, so it is verified the same way. This covers the temp-role probe through the pooler and the
+  container pooler fallback. A server certificate that fails verification ends the temp-role probe
+  at once, without its retries, and suggests setting `PGSSLROOTCERT` or `PGSSLMODE=require`. So
+  does a pooler rejection of the caller's IP (`Address not in tenant allow_list`), which suggests
+  checking Network Restrictions and Network Bans and links the dashboard's database settings. Any
+  explicit `sslmode`, `disable` and `verify-full` included, is passed through unchanged. `supabase-local` and YAML profiles are
+  never pinned.
   `sslmode=disable` dials plaintext and reads no CA or client-cert file; otherwise those PEM files
   are read when set and a missing one fails the connection, and a `pg_service.conf` is read
   whenever `PGSERVICE` names a service. The pooler route also reads `.pgpass` (`PGPASSFILE`, else
diff --git a/apps/cli/src/commands/db/push/push.command.ts b/apps/cli/src/commands/db/push/push.command.ts
index 81d91978ac..bc275eae29 100644
--- a/apps/cli/src/commands/db/push/push.command.ts
+++ b/apps/cli/src/commands/db/push/push.command.ts
@@ -30,7 +30,7 @@ const config = {
     description: "Include seed data from your config.",
   }),
   skipVault: Flag.Boolean("skip-vault").pipe(
-    Flag.withDescription("Skip updating vault secrets from config.toml."),
+    Flag.withDescription("Skip updating vault secrets from the config file."),
     Flag.withDefault(false),
   ),
   dryRun: Flag.Boolean("dry-run").pipe(
@@ -52,7 +52,7 @@ export type DbPushFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const dbPushCommand = Command.make("push", config).pipe(
   Command.withDescription(
-    "Push new migrations to a database. Vault secrets from config.toml are updated before migrations unless --skip-vault is set.",
+    "Push new migrations to a database. Vault secrets from the config file are updated before migrations unless --skip-vault is set.",
   ),
   Command.withShortDescription("Push new migrations to a database"),
   withPermissions(
diff --git a/apps/cli/src/commands/db/push/push.handler.ts b/apps/cli/src/commands/db/push/push.handler.ts
index a854682a7c..42ef82f6cd 100644
--- a/apps/cli/src/commands/db/push/push.handler.ts
+++ b/apps/cli/src/commands/db/push/push.handler.ts
@@ -5,7 +5,7 @@ import { Output } from "../../../shared/output/output.service.ts";
 import { CommandSettings } from "../../../config/command-settings.service.ts";
 import { CliConfigValues } from "../../../config/cli-config-values.service.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
-import { checkDbToml } from "../../../command-internal/db-config.toml-read.ts";
+import { checkDbConfig } from "../../../command-internal/db-config.read.ts";
 import { dbPushCore } from "../../../command-internal/db-push-core.ts";
 import { hostedMutationPreapproval } from "../../../command-internal/hosted-consent/hosted-consent.ts";
 import { planDbSeed } from "../../../command-internal/seed-remote-consent.ts";
@@ -47,9 +47,15 @@ export const dbPush = Effect.fn("db.push")(function* (flags: DbPushFlags) {
     // `SUPABASE_*` overrides, merges a matching `[remotes.<ref>]` block, and decrypts
     // `encrypted:` secrets — aborting here on any invalid config, before the
     // connection's network activity, so a remote override prints first.
-    const toml = yield* checkDbToml(fs, path, workdir, projectRef !== "" ? projectRef : undefined, {
-      resolveVaultSecrets: !flags.skipVault,
-    });
+    const toml = yield* checkDbConfig(
+      fs,
+      path,
+      workdir,
+      projectRef !== "" ? projectRef : undefined,
+      {
+        resolveVaultSecrets: !flags.skipVault,
+      },
+    );
     if (toml.appliedRemote !== undefined) {
       yield* output.raw(`Loading config override: [remotes.${toml.appliedRemote}]\n`, "stderr");
     }
diff --git a/apps/cli/src/commands/db/push/push.integration.test.ts b/apps/cli/src/commands/db/push/push.integration.test.ts
index 879b147db6..cdb00d5e7a 100644
--- a/apps/cli/src/commands/db/push/push.integration.test.ts
+++ b/apps/cli/src/commands/db/push/push.integration.test.ts
@@ -987,7 +987,7 @@ describe("db push", () => {
     "decrypts an encrypted vault secret keyed by the project .env (not process.env)",
     () => {
       // `DOTENV_PRIVATE_KEY` present only in the project .env must still decrypt — the
-      // config load merges the project .env into the key set (`checkDbToml`).
+      // config load merges the project .env into the key set (`checkDbConfig`).
       const PRIVATE_KEY = "7fd7210cef8f331ee8c55897996aaaafd853a2b20a4dc73d6d75759f65d2a7eb";
       const ENCRYPTED =
         "encrypted:BKiXH15AyRzeohGyUrmB6cGjSklCrrBjdesQlX1VcXo/Xp20Bi2gGZ3AlIqxPQDmjVAALnhZamKnuY73l8Dz1P+BYiZUgxTSLzdCvdYUyVbNekj2UudbdUizBViERtZkuQwZHIv/";
@@ -1240,7 +1240,7 @@ describe("db push", () => {
       const exit = yield* dbPush(DEFAULT_FLAGS).pipe(Effect.provide(layer), Effect.exit);
       expect(Exit.isFailure(exit)).toBe(true);
       if (Exit.isFailure(exit)) {
-        // Config loads through the shared reader (`checkDbToml`), same as the other db
+        // Config loads through the shared reader (`checkDbConfig`), same as the other db
         // commands.
         expect(Cause.pretty(exit.cause)).toContain("failed to load config");
       }
diff --git a/apps/cli/src/commands/db/push/push.live.test.ts b/apps/cli/src/commands/db/push/push.live.test.ts
index 503a9abbd0..6f9fc3a9cf 100644
--- a/apps/cli/src/commands/db/push/push.live.test.ts
+++ b/apps/cli/src/commands/db/push/push.live.test.ts
@@ -2,7 +2,7 @@ import { BunServices } from "@effect/platform-bun";
 import { Cause, Clock, Effect, Exit, FileSystem, Path, Random } from "effect";
 import { expect } from "vitest";
 
-import { requireLiveSuccess, test, throwWithCleanup } from "../../../../tests/helpers/live.ts";
+import { resetLiveDatabase, test, throwWithCleanup } from "../../../../tests/helpers/live.ts";
 
 test("pushes a local migration to the remote database", ({
   cliEffect,
@@ -31,10 +31,7 @@ test("pushes a local migration to the remote database", ({
         expect(result.stdout).toContain("Finished supabase db push");
       });
 
-      const reset = Effect.gen(function* () {
-        const result = yield* cliEffect(["db", "reset", "--yes", `--remote=${project.dbUrl}`]);
-        requireLiveSuccess(result, "db reset cleanup after db push");
-      });
+      const reset = resetLiveDatabase(cliEffect, project, "db reset cleanup after db push");
 
       return yield* Effect.uninterruptibleMask((restore) =>
         Effect.gen(function* () {
diff --git a/apps/cli/src/commands/db/query/query.format.ts b/apps/cli/src/commands/db/query/query.format.ts
index 7cd5fb0f51..962f28ea9a 100644
--- a/apps/cli/src/commands/db/query/query.format.ts
+++ b/apps/cli/src/commands/db/query/query.format.ts
@@ -1,7 +1,10 @@
 import { DateTime, Option, Predicate } from "effect";
 
 import { formatGeneralFloat } from "../../../command-internal/format-float.ts";
-import { stringWidth } from "../../../command-internal/string-width.ts";
+import {
+  renderTablewriter as renderRowsTable,
+  toCsv as renderRowsCsv,
+} from "../../../command-internal/tabular-output.ts";
 
 // `JSON.rawJSON` (ES2025, in Bun) wraps a string so `JSON.stringify` emits it verbatim as a
 // number token, used for exact int8/bigint precision. TypeScript's bundled lib doesn't declare it.
@@ -243,82 +246,20 @@ export function findNonFiniteJsonValue(
   return undefined;
 }
 
-// Width counts East Asian Wide as 2 and zero-width/combining as 0, so CJK/emoji cells still
-// align columns and borders; counting JS code points would under-measure them.
-const displayWidth = (text: string): number => stringWidth(text);
-
-/**
- * Render rows as the established box-layout table (header not upper-cased).
- * Left aligned, one space of padding each side, Unicode box-drawing borders.
- * An empty column set renders nothing (established empty-header output).
- */
 export function renderTablewriter(
   cols: ReadonlyArray<string>,
   data: ReadonlyArray<ReadonlyArray<unknown>>,
   formatCell: (value: unknown, columnIndex: number) => string = formatValue,
 ): string {
-  if (cols.length === 0) return "";
-  const rows = data.map((row) => row.map((cell, columnIndex) => formatCell(cell, columnIndex)));
-  // Column width is the widest visual line, since a multi-line cell splits across stacked lines.
-  const widths = cols.map((col, i) => {
-    let width = displayWidth(col);
-    for (const row of rows) {
-      for (const line of (row[i] ?? "").split("\n")) width = Math.max(width, displayWidth(line));
-    }
-    return width;
-  });
-
-  const segment = (width: number) => "─".repeat(width + 2);
-  const top = `┌${widths.map(segment).join("┬")}┐`;
-  const sep = `├${widths.map(segment).join("┼")}┤`;
-  const bottom = `└${widths.map(segment).join("┴")}┘`;
-  const renderLine = (cells: ReadonlyArray<string>) =>
-    `│${cells
-      .map((cell, i) => {
-        const width = widths[i];
-        return ` ${cell}${width === undefined ? "" : " ".repeat(width - displayWidth(cell))} `;
-      })
-      .join("│")}│`;
-  // A multiline cell splits across stacked bordered lines within the same
-  // logical row (other columns blank on continuation lines), no per-row separator.
-  const renderRow = (cells: ReadonlyArray<string>): string => {
-    const split = cells.map((cell) => cell.split("\n"));
-    const lineCount = Math.max(1, ...split.map((s) => s.length));
-    const visual: string[] = [];
-    for (let j = 0; j < lineCount; j++) {
-      visual.push(renderLine(split.map((s) => s[j] ?? "")));
-    }
-    return visual.join("\n");
-  };
-
-  const lines = [top, renderLine(cols), sep, ...rows.map(renderRow), bottom];
-  return `${lines.join("\n")}\n`;
-}
-
-/** The established CSV field-quoting rule. */
-function csvFieldNeedsQuotes(field: string): boolean {
-  if (field === "") return false;
-  if (field === "\\.") return true;
-  if (/[\n\r",]/.test(field)) return true;
-  return /\s/u.test(field[0] ?? "");
+  return renderRowsTable(cols, data, formatCell);
 }
 
-function csvField(field: string): string {
-  if (!csvFieldNeedsQuotes(field)) return field;
-  return `"${field.replaceAll('"', '""')}"`;
-}
-
-/** The established CSV output (RFC4180, `\n` line terminator). */
 export function toCsv(
   cols: ReadonlyArray<string>,
   data: ReadonlyArray<ReadonlyArray<unknown>>,
   formatCell: (value: unknown, columnIndex: number) => string = formatValue,
 ): string {
-  const lines = [cols.map(csvField).join(",")];
-  for (const row of data) {
-    lines.push(row.map((value, columnIndex) => csvField(formatCell(value, columnIndex))).join(","));
-  }
-  return `${lines.join("\n")}\n`;
+  return renderRowsCsv(cols, data, formatCell);
 }
 
 /**
diff --git a/apps/cli/src/commands/db/reset/SIDE_EFFECTS.md b/apps/cli/src/commands/db/reset/SIDE_EFFECTS.md
index 021aabc7ac..fd2c6c4d22 100644
--- a/apps/cli/src/commands/db/reset/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/reset/SIDE_EFFECTS.md
@@ -100,6 +100,7 @@ equivalent, PG15) or `InitSchema14`/`ApplyApiPrivileges` (PG14).
 | `docker container inspect supabase_db_<project>`                                                                             | local path                            | `AssertSupabaseDbIsRunning` probe (Podman fallback) — spawned only when the direct Engine-API request over the active local socket/named pipe gives no definitive answer                                                                                  |
 | `docker stop <storage\|auth\|realtime\|pooler container>`                                                                    | local path, PG15                      | stop the satellites before removing the db container so their `unless-stopped` restarts cannot race the one-shot init jobs (issue #6915), not-found tolerated per service                                                                                 |
 | `docker container rm -f supabase_db_<project>` / `docker volume rm -f <same>`                                                | local path, PG15                      | remove the existing container/volume before recreating (Podman fallback)                                                                                                                                                                                  |
+| `docker version --format ...`                                                                                                | local path, PG15                      | once before `docker create`: API >= 1.44 on both ends adds the health start flags (see below)                                                                                                                                                             |
 | `docker network create` / `docker volume create` / `docker create` / `docker start`                                          | local path, PG15                      | recreate the Postgres container (same primitives `db start` uses)                                                                                                                                                                                         |
 | `docker run --rm <realtime\|storage\|gotrue image>`                                                                          | local path, PG15, per enabled service | the one-shot `initSchema15` migrate jobs (`startSetupLocalDatabase`)                                                                                                                                                                                      |
 | `docker restart <db container>`                                                                                              | local path, PG14                      | `RestartDatabase` — pg_cron must restart after `pg_terminate_backend`                                                                                                                                                                                     |
@@ -115,7 +116,10 @@ published Postgres address (2s dial cap). Before the command returns, it waits u
 Docker's first health verdict on the database container (polling `docker container inspect` every
 1s until the status leaves `starting`, the container stops running, or Docker cannot launch its
 health check), so a following `supabase status` does not see `starting`. That wait never fails the
-reset.
+reset. When `docker version` reports API >= 1.44 on both ends, `docker create` also gets
+`--health-start-period 10s --health-start-interval 1s`, so its first check runs about 1s after start
+instead of 10s. Older engines and the Podman CLI get neither flag; the `docker` client on a Podman
+socket reporting API >= 1.44 gets both, Podman drops the interval, and there is no speedup.
 
 No subprocess delegation on either target — the remote path's
 `--experimental` schema-files apply is fully native.
@@ -338,7 +342,7 @@ to those defaults (the usual outcome for an interactive terminal).
   still runs afterward, unconditionally, exactly as on the migrations branch. The
   local target's branch is `migrateAndSeed`, reused by both the PG14 and PG15 recreate
   branches; the remote target's copy of the same branch is `applySchemaFiles`.
-  `encrypted:` vault secrets are NOT skipped on the remote path — `checkDbToml`
+  `encrypted:` vault secrets are NOT skipped on the remote path — `checkDbConfig`
   decrypts them into `toml.vault`, and `upsertVaultSecrets` upserts the
   decrypted values unconditionally, before either branch (schema-files or migrations)
   runs.
diff --git a/apps/cli/src/commands/db/reset/reset.command.ts b/apps/cli/src/commands/db/reset/reset.command.ts
index 27cd073b01..92b02fd7ed 100644
--- a/apps/cli/src/commands/db/reset/reset.command.ts
+++ b/apps/cli/src/commands/db/reset/reset.command.ts
@@ -26,7 +26,7 @@ const config = {
   sqlPaths: CliConfigKeys.db.seed.sqlPaths.flag({
     name: "sql-paths",
     description:
-      "Override [db.seed].sql_paths for this reset. May be repeated; each value accepts a SQL file path or glob pattern relative to the supabase directory and force-enables seeding.",
+      "Override db.seed.sql_paths for this reset. May be repeated; each value accepts a SQL file path or glob pattern relative to the supabase directory and force-enables seeding.",
     also: [[CliConfigKeys.db.seed.enabled, true]],
   }),
   version: Flag.String("version").pipe(
diff --git a/apps/cli/src/commands/db/reset/reset.handler.ts b/apps/cli/src/commands/db/reset/reset.handler.ts
index b6767629a7..da319e969c 100644
--- a/apps/cli/src/commands/db/reset/reset.handler.ts
+++ b/apps/cli/src/commands/db/reset/reset.handler.ts
@@ -17,10 +17,7 @@ import { CliConfigValues } from "../../../config/cli-config-values.service.ts";
 import { aqua, yellow } from "../../../command-internal/colors.ts";
 import { resetLocalDatabase } from "../../../command-internal/db-bootstrap/reset-local-database.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
-import {
-  checkDbToml,
-  loadProjectEnvValues,
-} from "../../../command-internal/db-config.toml-read.ts";
+import { checkDbConfig, loadProjectEnvValues } from "../../../command-internal/db-config.read.ts";
 import { DbConnection } from "../../../command-internal/db-connection.service.ts";
 import {
   experimentalSchemaPathsIgnoredWarning,
@@ -197,7 +194,7 @@ export const dbReset = Effect.fn("db.reset")(function* (flags: DbResetFlags) {
     // Decodes the whole config with env-expansion and weak-typed boolean parsing, applies
     // `SUPABASE_*` overrides, merges a matching `[remotes.<ref>]` block, and decrypts every
     // `encrypted:` secret — aborting here, before the destructive prompt, on any invalid config.
-    const toml = yield* checkDbToml(fs, path, workdir, linkedRef);
+    const toml = yield* checkDbConfig(fs, path, workdir, linkedRef);
     if (toml.appliedRemote !== undefined) {
       yield* output.raw(`Loading config override: [remotes.${toml.appliedRemote}]\n`, "stderr");
     }
@@ -217,7 +214,7 @@ export const dbReset = Effect.fn("db.reset")(function* (flags: DbResetFlags) {
         schemaPaths: toml.schemaPaths,
       })
     ) {
-      yield* output.raw(experimentalSchemaPathsIgnoredWarning, "stderr");
+      yield* output.raw(experimentalSchemaPathsIgnoredWarning(toml.configFile), "stderr");
     }
 
     // Takes the schema-files branch when `--experimental`/`SUPABASE_EXPERIMENTAL` is set, no
diff --git a/apps/cli/src/commands/db/reset/reset.integration.test.ts b/apps/cli/src/commands/db/reset/reset.integration.test.ts
index 9fa7fd6d70..d1fd3a4aae 100644
--- a/apps/cli/src/commands/db/reset/reset.integration.test.ts
+++ b/apps/cli/src/commands/db/reset/reset.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -330,7 +330,7 @@ function mockContainerCliSpawner(route: (args: ReadonlyArray<string>) => RouteRe
     ChildProcessSpawner.ChildProcessSpawner,
     ChildProcessSpawner.make((command) =>
       Effect.gen(function* () {
-        const args = ChildProcess.isStandardCommand(command) ? command.args : [];
+        const args = ChildProcess.isStandardCommand(command) ? command.args.map(String) : [];
         spawned.push({ args });
 
         if (!ChildProcess.isStandardCommand(command)) {
@@ -1000,7 +1000,7 @@ function setup(
         yield* fs.writeFileString(abs, content);
       }
     }),
-  ).pipe(Layer.provide(BunServices.layer));
+  ).pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
 
   const out = mockOutput({
     format: opts.format ?? "text",
@@ -1092,6 +1092,7 @@ function setup(
       : resolver.layer,
     mockCommandSettings({ workdir }),
     BunServices.layer,
+    BunCrypto.layer,
     recorder.layer,
     child.layer,
     mockLocalDockerEngineUnavailableLayer,
@@ -1208,6 +1209,20 @@ describe("db reset", () => {
       );
     });
 
+    it.effect("emits the health-start flags on a supported engine", () => {
+      const base = defaultLocalResetRoute();
+      const { layer, child } = setup(tmp.current, {
+        toml: 'project_id = "test"\n',
+        args: ["db", "reset"],
+        isLocal: true,
+        route: (args) => (args[0] === "version" ? { stdout: ["1.44 1.44 1.56"] } : base(args)),
+      });
+      return Effect.gen(function* () {
+        yield* dbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+        expect(createArgs(child.spawned)).toContain("--health-start-interval");
+      });
+    });
+
     it.effect(
       "recreates when Docker cannot exec the database's health check but it accepts connections",
       () => {
@@ -1474,7 +1489,7 @@ describe("db reset", () => {
         yield* dbReset(DEFAULT_FLAGS).pipe(Effect.provide(layer));
 
         expect(catalogApplied[0]?.target.selection.auth).toEqual(lockedAuth);
-      }).pipe(Effect.provide(BunServices.layer));
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
 
     it.effect(
@@ -1517,7 +1532,7 @@ describe("db reset", () => {
             suggested_command: "supabase start",
             error_fingerprint: "tag:ResetLocalDbFailedError:conflict",
           });
-        }).pipe(Effect.provide(BunServices.layer));
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
       },
     );
 
@@ -2975,7 +2990,7 @@ describe("db reset", () => {
       "resolves db.migrations.schema_paths against supabase/ before applying it on an experimental PG14 reset",
       () => {
         // `recreateLocalDatabase14` must pass the normalized `toml.schemaPaths` (resolved by
-        // `checkDbToml`) into the final `migrateAndSeed` call — the raw `["schema.sql"]` pattern
+        // `checkDbConfig`) into the final `migrateAndSeed` call — the raw `["schema.sql"]` pattern
         // would glob-match against the workdir root instead of `supabase/schema.sql`.
         const { layer, conn } = setup(tmp.current, {
           toml: 'project_id = "test"\n[db]\nmajor_version = 14\n[db.migrations]\nschema_paths = ["schema.sql"]\n\n[experimental.pgdelta]\nenabled = false\n',
@@ -3026,7 +3041,7 @@ describe("db reset", () => {
 
     it.effect("loads an env() boolean in config for a remote reset", () => {
       // Regression: `enabled = "env(VAR)"` must load via env-expansion + boolean
-      // parsing (`checkDbToml`) instead of the strict @supabase/config
+      // parsing (`checkDbConfig`) instead of the strict @supabase/config
       // loader rejecting it.
       const { layer, out } = setup(tmp.current, {
         toml: 'project_id = "test"\n\n[db.migrations]\nenabled = "env(MIGRATIONS_ENABLED)"\n',
@@ -3180,7 +3195,7 @@ describe("db reset", () => {
         });
       }).pipe(
         Effect.scoped,
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
         provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
       );
     });
@@ -3203,7 +3218,7 @@ describe("db reset", () => {
           assertPermissionDrift({ command: "db reset", requests: [], exact: true });
         }).pipe(
           Effect.scoped,
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
           provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
         ),
       );
@@ -3238,7 +3253,7 @@ describe("db reset", () => {
             });
           }).pipe(
             Effect.scoped,
-            Effect.provide(BunServices.layer),
+            Effect.provide([BunServices.layer, BunCrypto.layer]),
             provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
           ),
         );
@@ -3721,7 +3736,7 @@ describe("db reset", () => {
             );
           }
           expect(conn.execs.some((s) => s.includes("create table schema_users"))).toBe(false);
-        }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+        }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
       },
     );
 
@@ -3763,7 +3778,7 @@ describe("db reset", () => {
           }
           expect(conn.execs.some((s) => s.includes("drop schema if exists"))).toBe(true);
           expect(conn.execs.some((s) => s.includes("create table schema_users"))).toBe(false);
-        }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
+        }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer]));
       },
     );
 
@@ -4158,7 +4173,7 @@ describe("db reset", () => {
         expect(out.stderrText).toContain(
           `Seeding data from ${absSeed.replaceAll(path.sep, "/")}...`,
         );
-      }).pipe(Effect.provide(BunServices.layer));
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
     });
 
     it.effect("warns and seeds from --sql-paths overriding config on a remote reset", () => {
diff --git a/apps/cli/src/commands/db/reset/reset.live.test.ts b/apps/cli/src/commands/db/reset/reset.live.test.ts
index d4ff4a3a43..160d57df40 100644
--- a/apps/cli/src/commands/db/reset/reset.live.test.ts
+++ b/apps/cli/src/commands/db/reset/reset.live.test.ts
@@ -2,7 +2,7 @@ import { BunServices } from "@effect/platform-bun";
 import { Cause, Clock, Effect, Exit, FileSystem, Path, Random } from "effect";
 import { expect } from "vitest";
 
-import { requireLiveSuccess, test, throwWithCleanup } from "../../../../tests/helpers/live.ts";
+import { resetLiveDatabase, test, throwWithCleanup } from "../../../../tests/helpers/live.ts";
 
 test("resets the remote database with local migrations", ({
   cliEffect,
@@ -31,10 +31,7 @@ test("resets the remote database with local migrations", ({
         expect(`${result.stdout}${result.stderr}`).toContain("Resetting remote database");
       });
 
-      const resetCleanup = Effect.gen(function* () {
-        const reset = yield* cliEffect(["db", "reset", "--yes", `--remote=${project.dbUrl}`]);
-        requireLiveSuccess(reset, "db reset cleanup");
-      });
+      const resetCleanup = resetLiveDatabase(cliEffect, project, "db reset cleanup");
 
       return yield* Effect.uninterruptibleMask((restore) =>
         Effect.gen(function* () {
diff --git a/apps/cli/src/commands/db/reset/reset.stack.e2e.test.ts b/apps/cli/src/commands/db/reset/reset.stack.e2e.test.ts
index 1e02cb038c..eee3b86f89 100644
--- a/apps/cli/src/commands/db/reset/reset.stack.e2e.test.ts
+++ b/apps/cli/src/commands/db/reset/reset.stack.e2e.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Context, Data, Effect, FileSystem, Layer, Path, Redacted } from "effect";
 import { FetchHttpClient, HttpClient } from "effect/http";
@@ -255,7 +255,9 @@ describe("supabase db reset (stack e2e)", () => {
           const restUrl = restCredentials.url;
           if (restUrl === undefined) return yield* Effect.die("REST URL is missing");
           expect(yield* responseStatus(restUrl)).toBe(200);
-        }).pipe(Effect.provide([BunServices.layer, FetchHttpClient.layer])),
+        }).pipe(
+          Effect.provide([Layer.merge(BunServices.layer, BunCrypto.layer), FetchHttpClient.layer]),
+        ),
       { timeout: TEST_TIMEOUT_MS },
     );
   }
diff --git a/apps/cli/src/commands/db/schema/declarative/declarative.former-default.ts b/apps/cli/src/commands/db/schema/declarative/declarative.former-default.ts
index caa3cb57db..ce37378459 100644
--- a/apps/cli/src/commands/db/schema/declarative/declarative.former-default.ts
+++ b/apps/cli/src/commands/db/schema/declarative/declarative.former-default.ts
@@ -2,18 +2,28 @@ import { Effect, type FileSystem, Option, type Path } from "effect";
 
 import { Output } from "../../../../shared/output/output.service.ts";
 import { yellow } from "../../../../command-internal/colors.ts";
-import type { PgDeltaTomlConfig } from "../../../../command-internal/db-config.toml-read.ts";
-import { resolveDeclarativeDir } from "../../../../command-internal/db-config.toml-read.ts";
+import { type ConfigFileRef, configSetting } from "../../../../command-internal/config-advice.ts";
+import type { PgDeltaConfig } from "../../../../command-internal/db-config.read.ts";
+import { resolveDeclarativeDir } from "../../../../command-internal/db-config.read.ts";
 import { walkSqlFiles } from "../../../../command-internal/glob.ts";
 
 /** The default declarative directory before it moved to `supabase/schemas`. */
 const FORMER_DEFAULT_SEGMENTS = ["supabase", "database"] as const;
 
-const formerDeclarativeDefaultWarning = (formerDirRel: string, defaultDirRel: string): string =>
+const keepFormerTreeAdvice = ({ format, path }: ConfigFileRef): string =>
+  format === "json"
+    ? `Set ${configSetting(format, "experimental.pgdelta", "declarative_schema_path", '"./database"')} in ${path}`
+    : `Set declarative_schema_path = "./database" under [experimental.pgdelta] in ${path}`;
+
+const formerDeclarativeDefaultWarning = (
+  formerDirRel: string,
+  defaultDirRel: string,
+  configFile: ConfigFileRef,
+): string =>
   `${yellow(
     `WARNING: found declarative schema files in ${formerDirRel}, but the default declarative directory is now ${defaultDirRel}.`,
   )}\n${yellow(
-    `Set declarative_schema_path = "./database" under [experimental.pgdelta] in supabase/config.toml to keep using the existing tree, or move it to ${defaultDirRel}.`,
+    `${keepFormerTreeAdvice(configFile)} to keep using the existing tree, or move it to ${defaultDirRel}.`,
   )}\n`;
 
 /**
@@ -29,7 +39,8 @@ export const warnFormerDeclarativeDefault = Effect.fnUntraced(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   workdir: string,
-  pgDelta: PgDeltaTomlConfig,
+  pgDelta: PgDeltaConfig,
+  configFile: ConfigFileRef,
 ) {
   if (Option.isSome(pgDelta.declarativeSchemaPath)) return;
   const defaultDirRel = resolveDeclarativeDir(path, pgDelta);
@@ -49,5 +60,8 @@ export const warnFormerDeclarativeDefault = Effect.fnUntraced(function* (
   if (formerSqlFiles.length === 0 && !formerHasManifest) return;
 
   const output = yield* Output;
-  yield* output.raw(formerDeclarativeDefaultWarning(formerDirRel, defaultDirRel), "stderr");
+  yield* output.raw(
+    formerDeclarativeDefaultWarning(formerDirRel, defaultDirRel, configFile),
+    "stderr",
+  );
 });
diff --git a/apps/cli/src/commands/db/schema/declarative/declarative.gate.ts b/apps/cli/src/commands/db/schema/declarative/declarative.gate.ts
index 78720d6bdd..4795d192ab 100644
--- a/apps/cli/src/commands/db/schema/declarative/declarative.gate.ts
+++ b/apps/cli/src/commands/db/schema/declarative/declarative.gate.ts
@@ -1,6 +1,8 @@
+import type { ConfigFormat } from "@supabase/config/effect";
 import { Effect } from "effect";
 
 import { aqua, bold } from "../../../../command-internal/colors.ts";
+import { configSetting } from "../../../../command-internal/config-advice.ts";
 import { DeclarativeNotEnabledError } from "./declarative.errors.ts";
 
 /**
@@ -13,12 +15,12 @@ export function isPgDeltaEnabled(experimental: boolean, pgDeltaEnabled: boolean)
 }
 
 /**
- * The suggestion shown when the gate is closed. `configPath` is `supabase/config.toml`;
+ * The suggestion shown when the gate is closed. `configPath` is the project config file;
  * `aqua`/`bold` render plain when stderr is not a TTY.
  */
-export function pgDeltaSuggestion(configPath: string): string {
+export function pgDeltaSuggestion(configPath: string, configFormat: ConfigFormat = "toml"): string {
   return `Pass ${aqua("--experimental")} to run declarative commands while ${aqua(
-    "[experimental.pgdelta] enabled = false",
+    configSetting(configFormat, "experimental.pgdelta", "enabled", "false"),
   )} is set in ${bold(configPath)}`;
 }
 
@@ -31,10 +33,11 @@ export const requirePgDelta = Effect.fnUntraced(function* (opts: {
   readonly experimental: boolean;
   readonly pgDeltaEnabled: boolean;
   readonly configPath: string;
+  readonly configFormat?: ConfigFormat;
 }) {
   if (isPgDeltaEnabled(opts.experimental, opts.pgDeltaEnabled)) return;
   return yield* new DeclarativeNotEnabledError({
     message: "declarative commands require --experimental flag or pg-delta enabled in config",
-    suggestion: pgDeltaSuggestion(opts.configPath),
+    suggestion: pgDeltaSuggestion(opts.configPath, opts.configFormat),
   });
 });
diff --git a/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts b/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
index f744383447..4a0eb50b4f 100644
--- a/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
+++ b/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.integration.test.ts
@@ -2,7 +2,7 @@ import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
 
-import type { DbTomlValues } from "../../../../command-internal/db-config.toml-read.ts";
+import type { DbConfigValues } from "../../../../command-internal/db-config.read.ts";
 import {
   PgDeltaEngine,
   type PgDeltaDeclarativePlanInput,
@@ -30,11 +30,11 @@ const ctx = (cwd: string, declarativeDir: string): DeclarativeRunContext => ({
   dnsResolver: "native",
 });
 
-// A minimal, valid `DbTomlValues` — matches `db-config.toml-read.ts`'s
+// A minimal, valid `DbConfigValues` — matches `db-config.read.ts`'s
 // own unconfigured defaults so this fixture doesn't silently drift from what
-// `readDbToml` would resolve for these tests' bare temp dirs (none of them
+// `readDbConfig` would resolve for these tests' bare temp dirs (none of them
 // write a `config.toml`).
-const toml: DbTomlValues = {
+const toml: DbConfigValues = {
   projectEnv: {},
   apiSchemas: ["public", "graphql_public"],
   exposedSchemas: ["public", "graphql_public"],
@@ -64,6 +64,7 @@ const toml: DbTomlValues = {
   seed: { enabled: true, sqlPaths: [] },
   vault: [],
   appliedRemote: undefined,
+  configFile: { format: "toml", path: "supabase/config.toml" },
 };
 
 function jsonParseErrorMessage(raw: string): string {
diff --git a/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.ts b/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.ts
index 0ac2b76df8..f0f5f5febf 100644
--- a/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.ts
+++ b/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.ts
@@ -1,7 +1,7 @@
 import { Effect, FileSystem, Path } from "effect";
 
 import type { PgDeltaContext } from "../../../../command-internal/pgdelta.ts";
-import type { DbTomlValues } from "../../../../command-internal/db-config.toml-read.ts";
+import type { DbConfigValues } from "../../../../command-internal/db-config.read.ts";
 import { findDropStatements } from "../../../../command-internal/sql-split.ts";
 import {
   PgDeltaEngine,
@@ -73,7 +73,7 @@ const formatImplicitExtensionLoadFailure = (
  */
 export const diffDeclarativeToMigrations = Effect.fn("DeclarativeSchema.plan")(function* (
   run: DeclarativeRunContext,
-  toml: DbTomlValues,
+  toml: DbConfigValues,
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
diff --git a/apps/cli/src/commands/db/schema/declarative/declarative.smart-target.ts b/apps/cli/src/commands/db/schema/declarative/declarative.smart-target.ts
index 128d6d6bec..3f1e32de54 100644
--- a/apps/cli/src/commands/db/schema/declarative/declarative.smart-target.ts
+++ b/apps/cli/src/commands/db/schema/declarative/declarative.smart-target.ts
@@ -60,6 +60,7 @@ export const prepareLocalTargetEndpoint = Effect.fn("DeclarativeSchema.localTarg
     "local",
     password,
     yield* isCheckoutLinked(yield* FileSystem.FileSystem, yield* Path.Path, workdir, projectId),
+    workdir,
   );
   const seam = yield* DeclarativeSeam;
   yield* seam.ensureLocalPostgresImageCurrent;
diff --git a/apps/cli/src/commands/db/schema/declarative/generate/generate.handler.ts b/apps/cli/src/commands/db/schema/declarative/generate/generate.handler.ts
index dafc92b7bd..d2e4127e6f 100644
--- a/apps/cli/src/commands/db/schema/declarative/generate/generate.handler.ts
+++ b/apps/cli/src/commands/db/schema/declarative/generate/generate.handler.ts
@@ -10,9 +10,9 @@ import { Output } from "../../../../../shared/output/output.service.ts";
 import { CommandSettings } from "../../../../../config/command-settings.service.ts";
 import {
   loadProjectEnvValues,
-  readDbToml,
+  readDbConfig,
   resolveDeclarativeDir,
-} from "../../../../../command-internal/db-config.toml-read.ts";
+} from "../../../../../command-internal/db-config.read.ts";
 import { resolveTarget } from "../../../../../command-internal/target/resolve-target.ts";
 import { LinkedProjectCache } from "../../../../../telemetry/linked-project-cache.service.ts";
 import { TelemetryState } from "../../../../../telemetry/telemetry-state.service.ts";
@@ -53,13 +53,14 @@ export const dbSchemaDeclarativeGenerate = Effect.fn("db.schema.declarative.gene
   const linkedProjectRef = yield* Ref.make<string | undefined>(undefined);
 
   yield* Effect.gen(function* () {
-    const baseToml = yield* readDbToml(fs, path, cliSettings.workdir);
+    const baseToml = yield* readDbConfig(fs, path, cliSettings.workdir);
     // Gate on the base config: a remote `experimental.pgdelta.enabled = true` must not enable a
     // base-disabled command without `--experimental`.
     yield* requirePgDelta({
       experimental,
       pgDeltaEnabled: baseToml.pgDelta.enabled,
-      configPath: path.join("supabase", "config.toml"),
+      configPath: baseToml.configFile.path,
+      configFormat: baseToml.configFile.format,
     });
 
     const target = yield* resolveTarget(flags);
@@ -69,7 +70,7 @@ export const dbSchemaDeclarativeGenerate = Effect.fn("db.schema.declarative.gene
     let toml = baseToml;
     if (target.kind === "linked") {
       yield* Ref.set(linkedProjectRef, target.ref);
-      toml = yield* readDbToml(fs, path, cliSettings.workdir, target.ref);
+      toml = yield* readDbConfig(fs, path, cliSettings.workdir, target.ref);
     }
 
     // Preserve the selected value for user-facing output: invocation-local `--output` wins,
@@ -92,7 +93,13 @@ export const dbSchemaDeclarativeGenerate = Effect.fn("db.schema.declarative.gene
           "declarative output directory must not be empty, resolve to the project directory, or contain the project directory",
       });
     }
-    yield* warnFormerDeclarativeDefault(fs, path, cliSettings.workdir, toml.pgDelta);
+    yield* warnFormerDeclarativeDefault(
+      fs,
+      path,
+      cliSettings.workdir,
+      toml.pgDelta,
+      toml.configFile,
+    );
     const run: DeclarativeRunContext = {
       pgDelta: {
         projectId: toml.projectId,
diff --git a/apps/cli/src/commands/db/schema/declarative/sync/sync.handler.ts b/apps/cli/src/commands/db/schema/declarative/sync/sync.handler.ts
index b37983c017..c303eba735 100644
--- a/apps/cli/src/commands/db/schema/declarative/sync/sync.handler.ts
+++ b/apps/cli/src/commands/db/schema/declarative/sync/sync.handler.ts
@@ -18,12 +18,12 @@ import { DbConnection } from "../../../../../command-internal/db-connection.serv
 import { getHostname } from "../../../../../command-internal/hostname.ts";
 import {
   loadProjectEnvValues,
-  readDbToml,
+  readDbConfig,
   resolveDeclarativeDir,
-} from "../../../../../command-internal/db-config.toml-read.ts";
+} from "../../../../../command-internal/db-config.read.ts";
 import { makeDir } from "../../../../../command-internal/make-dir.ts";
 import { applyMigrationFile } from "../../../../../command-internal/migration-apply.ts";
-import { ENABLE_LOCAL_WEBHOOKS_SUGGESTION } from "../../../../../command-internal/pg-net-guidance.ts";
+import { enableLocalWebhooksSuggestion } from "../../../../../command-internal/pg-net-guidance.ts";
 import { TelemetryState } from "../../../../../telemetry/telemetry-state.service.ts";
 import { listLocalMigrations } from "../../../../../command-internal/migration-list.ts";
 import { pgdeltaScratchDir } from "../../../../../command-internal/scratch-paths.ts";
@@ -98,13 +98,14 @@ export const dbSchemaDeclarativeSync = Effect.fn("db.schema.declarative.sync")(f
   const seam = yield* DeclarativeSeam;
 
   yield* Effect.gen(function* () {
-    const toml = yield* readDbToml(fs, path, cliSettings.workdir);
+    const toml = yield* readDbConfig(fs, path, cliSettings.workdir);
     // Gate before the mutex check below — order matters; see
     // requirePgDelta's doc comment for why.
     yield* requirePgDelta({
       experimental,
       pgDeltaEnabled: toml.pgDelta.enabled,
-      configPath: path.join("supabase", "config.toml"),
+      configPath: toml.configFile.path,
+      configFormat: toml.configFile.format,
     });
 
     // Mutually-exclusive apply/no-apply group, checked after the gate above. Reject the conflict
@@ -153,7 +154,13 @@ export const dbSchemaDeclarativeSync = Effect.fn("db.schema.declarative.sync")(f
       "Reset local database to match migrations first? (local data will be lost)",
       false,
     );
-    yield* warnFormerDeclarativeDefault(fs, path, cliSettings.workdir, toml.pgDelta);
+    yield* warnFormerDeclarativeDefault(
+      fs,
+      path,
+      cliSettings.workdir,
+      toml.pgDelta,
+      toml.configFile,
+    );
     const declarativeFilesExist = yield* declarativeDirHasFiles(fs, declarativeDir);
     yield* Effect.annotateCurrentSpan({
       "declarative.bootstrap": !declarativeFilesExist,
@@ -309,7 +316,7 @@ export const dbSchemaDeclarativeSync = Effect.fn("db.schema.declarative.sync")(f
             message: [
               "The declarative schema uses pg_net, but Database Webhooks are not enabled in the local project config.",
               "",
-              ENABLE_LOCAL_WEBHOOKS_SUGGESTION,
+              enableLocalWebhooksSuggestion(toml.configFile),
             ].join("\n"),
           });
         }
@@ -359,7 +366,7 @@ export const dbSchemaDeclarativeSync = Effect.fn("db.schema.declarative.sync")(f
           message: [
             "The migrations state includes pg_net, but Database Webhooks are not enabled in the local project config.",
             "",
-            ENABLE_LOCAL_WEBHOOKS_SUGGESTION,
+            enableLocalWebhooksSuggestion(toml.configFile),
           ].join("\n"),
         });
       }
diff --git a/apps/cli/src/commands/db/schema/declarative/sync/sync.integration.test.ts b/apps/cli/src/commands/db/schema/declarative/sync/sync.integration.test.ts
index 7a53c56757..b3ebb1e2ee 100644
--- a/apps/cli/src/commands/db/schema/declarative/sync/sync.integration.test.ts
+++ b/apps/cli/src/commands/db/schema/declarative/sync/sync.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -376,7 +376,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
                 ? undefined
                 : { ...opts.removals, extensions: remainingExtensions },
           };
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     }),
   );
   const recorder = recordingFileSystem();
@@ -416,6 +416,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
       make: CommandPlatformApi.pipe(Effect.provide(platformApi.layer)),
     }),
     BunServices.layer,
+    BunCrypto.layer,
     recorder.layer,
     // `child.layer` must be listed after `BunServices.layer` — `Layer.mergeAll` resolves a
     // duplicate service tag to whichever layer is listed last, so this mock overrides Bun's
@@ -1595,7 +1596,7 @@ describe("db schema declarative sync permissions through the real resolver", ()
       });
     }).pipe(
       Effect.scoped,
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
     );
   });
diff --git a/apps/cli/src/commands/db/shared/migra.ts b/apps/cli/src/commands/db/shared/migra.ts
index 9f07c37a8a..c9e43caa0f 100644
--- a/apps/cli/src/commands/db/shared/migra.ts
+++ b/apps/cli/src/commands/db/shared/migra.ts
@@ -16,7 +16,7 @@ import {
 import { parseConnectionString } from "../../../command-internal/db-config.parse.ts";
 import { DockerRun } from "../../../command-internal/docker-run.service.ts";
 import { EdgeRuntimeScript } from "../../../command-internal/edge-runtime-script.service.ts";
-import { PG_DELTA_CA_BUNDLE } from "../../../command-internal/pgdelta-ssl.ts";
+import { rootCaBundle } from "../../../command-internal/supabase-tls.ts";
 import { PgDeltaSslProbe } from "../../../command-internal/pgdelta-ssl-probe.service.ts";
 import {
   rewriteDumpHostForToolContainer,
@@ -148,7 +148,7 @@ const buildMigraEnv = Effect.fn("Migra.buildEnv")(function* (params: {
   if (yield* isSslDebugEnabled) env["SUPABASE_SSL_DEBUG"] = "true";
   // Probe the target for TLS; if it speaks TLS, inject the embedded CA bundle as SSL_CA.
   const requireSsl = yield* probe.requireSsl(params.target);
-  if (requireSsl) env["SSL_CA"] = PG_DELTA_CA_BUNDLE;
+  if (requireSsl) env["SSL_CA"] = rootCaBundle();
   if (params.schema.length > 0) {
     env["INCLUDED_SCHEMAS"] = params.schema.join(",");
   } else {
diff --git a/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.integration.test.ts b/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.integration.test.ts
index c90929a5de..79aa237174 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.integration.test.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.integration.test.ts
@@ -1,3 +1,4 @@
+import * as BunCrypto from "@effect/platform-bun/BunCrypto";
 import * as BunServices from "@effect/platform-bun/BunServices";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Layer, Option } from "effect";
@@ -10,7 +11,7 @@ import { pgDeltaNextEngineLayer } from "./pgdelta-engine.next.layer.ts";
 import { PgDeltaEngine } from "./pgdelta-engine.service.ts";
 import { PgDeltaNextAdapter } from "./pgdelta-next-adapter.service.ts";
 import { PgDeltaNextShadow } from "./pgdelta-next-shadow.service.ts";
-import type { DbTomlValues } from "../../../command-internal/db-config.toml-read.ts";
+import type { DbConfigValues } from "../../../command-internal/db-config.read.ts";
 
 const common = {
   context: {
@@ -25,7 +26,7 @@ const common = {
   strictCoverage: false,
 } as const;
 
-const toml: DbTomlValues = {
+const toml: DbConfigValues = {
   projectEnv: {},
   apiSchemas: ["public", "graphql_public"],
   exposedSchemas: ["public", "graphql_public"],
@@ -55,6 +56,7 @@ const toml: DbTomlValues = {
   seed: { enabled: true, sqlPaths: [] },
   vault: [],
   appliedRemote: undefined,
+  configFile: { format: "toml", path: "supabase/config.toml" },
 };
 
 function setup() {
@@ -94,6 +96,7 @@ function setup() {
   });
   const dependencies = Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     shadow,
     unusedAdapter,
     debug,
diff --git a/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.ts b/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.ts
index 46ab00eb4a..2becb2d7ef 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.ts
@@ -1,4 +1,5 @@
-import { Clock, Crypto, Effect, FileSystem, Layer, Path, Ref } from "effect";
+import { Clock, Effect, FileSystem, Layer, Path, Ref } from "effect";
+import { Digest } from "effect/crypto";
 import type { Pool } from "pg";
 
 import { CommandSettings } from "../../../config/command-settings.service.ts";
@@ -134,7 +135,7 @@ export const pgDeltaNextEngineLayer = Layer.effect(
     const shadowService = yield* PgDeltaNextShadow;
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* Digest.Digest;
     const debugLogger = yield* DebugLogger;
     const settings = yield* CommandSettings;
     const output = yield* Output;
@@ -152,7 +153,7 @@ export const pgDeltaNextEngineLayer = Layer.effect(
           path,
           yield* pgdeltaScratchDir(workdir).pipe(
             Effect.provideService(CommandSettings, settings),
-            Effect.provideService(Crypto.Crypto, crypto),
+            Effect.provideService(Digest.Digest, crypto),
           ),
           id,
           operation,
diff --git a/apps/cli/src/commands/db/shared/pgdelta-engine.service.ts b/apps/cli/src/commands/db/shared/pgdelta-engine.service.ts
index 4baadd48df..755cad6687 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-engine.service.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-engine.service.ts
@@ -6,7 +6,7 @@ import type {
 } from "../../../command-internal/db-connection.service.ts";
 import type { PgDeltaContext } from "../../../command-internal/pgdelta.ts";
 import type { MigrationTransactionMode } from "../../../command-internal/migration-file.ts";
-import type { DbTomlValues } from "../../../command-internal/db-config.toml-read.ts";
+import type { DbConfigValues } from "../../../command-internal/db-config.read.ts";
 import {
   actionability,
   type CliErrorActionabilityDeclaration,
@@ -127,7 +127,7 @@ export interface PgDeltaExplicitDiffInput extends PgDeltaCommonInput {
   readonly source: PgDeltaEndpoint;
   readonly desired: PgDeltaEndpoint;
   /** Already-loaded config used when a migrations endpoint needs a native shadow. */
-  readonly toml?: DbTomlValues;
+  readonly toml?: DbConfigValues;
 }
 
 export interface PgDeltaDatabaseDiffInput extends PgDeltaCommonInput {
@@ -151,7 +151,7 @@ export interface PgDeltaDeclarativePlanInput extends PgDeltaCommonInput {
   readonly manifest?: PgDeltaExportManifest;
   readonly noCache: boolean;
   /** Already-loaded config used by native shadow/catalog provisioning. */
-  readonly toml: DbTomlValues;
+  readonly toml: DbConfigValues;
 }
 
 interface PgDeltaDeclarativePlanResult extends PgDeltaDiffResult {
diff --git a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.layer.ts b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.layer.ts
index 1636c9384b..b795e99021 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.layer.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.layer.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect, FileSystem, Layer, Option, Path, Schedule } from "effect";
+import { Effect, FileSystem, Layer, Option, Path, Schedule } from "effect";
+import { Digest } from "effect/crypto";
 import * as Net from "node:net";
 import { CliArgs } from "../../../shared/cli/cli-args.service.ts";
 import {
@@ -141,7 +142,7 @@ export const pgDeltaNextShadowLayer = Layer.effect(
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* Digest.Digest;
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     const runtimeInfo = yield* RuntimeInfo;
     const networkIdFlag = yield* NetworkIdFlag;
@@ -160,7 +161,7 @@ export const pgDeltaNextShadowLayer = Layer.effect(
       const deps = Layer.mergeAll(
         Layer.succeed(FileSystem.FileSystem, fs),
         Layer.succeed(Path.Path, path),
-        Layer.succeed(Crypto.Crypto, crypto),
+        Layer.succeed(Digest.Digest, crypto),
         Layer.succeed(DebugFlag, debugFlag),
         Layer.succeed(ExperimentalFlag, experimentalFlag),
         Layer.succeed(NetworkIdFlag, networkIdFlag),
diff --git a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.service.ts b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.service.ts
index 2a713f5562..bc5fdd1951 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.service.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.service.ts
@@ -1,7 +1,7 @@
 import { Context, type Effect, type Scope } from "effect";
 
 import type { DeclarativeShadowDbError } from "./pgdelta.errors.ts";
-import type { DbTomlValues } from "../../../command-internal/db-config.toml-read.ts";
+import type { DbConfigValues } from "../../../command-internal/db-config.read.ts";
 import type { PgDeltaContext } from "../../../command-internal/pgdelta.ts";
 
 /** The live migrated database needed by pg-delta next database diffs. */
@@ -20,7 +20,7 @@ export interface PgDeltaNextPlanShadows extends PgDeltaNextMigrationsShadow {
 
 export interface PgDeltaNextShadowInput {
   readonly context: PgDeltaContext;
-  readonly toml: DbTomlValues;
+  readonly toml: DbConfigValues;
   readonly projectRef?: string;
   /**
    * `db schema declarative sync --no-cache` (and generate's same flag): force a fresh
diff --git a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.stack.integration.test.ts b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.stack.integration.test.ts
index 2aa4fb1e6e..ae5275521c 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.stack.integration.test.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.stack.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { FetchHttpClient } from "effect/http";
 import { Effect, FileSystem, Layer, Option } from "effect";
@@ -22,7 +22,7 @@ import { StackApi, stackApiLayer } from "../../../command-internal/stack-api.ts"
 import { stackBackendLayer } from "../../../command-internal/stack-backend.ts";
 import { pgDeltaNextShadowLayer } from "./pgdelta-next-shadow.layer.ts";
 import { PgDeltaNextShadow } from "./pgdelta-next-shadow.service.ts";
-import type { DbTomlValues } from "../../../command-internal/db-config.toml-read.ts";
+import type { DbConfigValues } from "../../../command-internal/db-config.read.ts";
 
 const toml = {
   projectEnv: {},
@@ -54,7 +54,8 @@ const toml = {
   seed: { enabled: false, sqlPaths: [] },
   vault: [],
   appliedRemote: undefined,
-} satisfies DbTomlValues;
+  configFile: { format: "toml", path: "supabase/config.toml" },
+} satisfies DbConfigValues;
 
 const fakeDocker = Layer.succeed(DockerRun, {
   run: () => Effect.die("Docker is not used by the native stack backend"),
@@ -96,7 +97,7 @@ describe("pg-delta next stack shadow provisioning", () => {
         const output = mockOutput().layer;
         const apiLayer = stackApiLayer.pipe(
           Layer.provide(FetchHttpClient.layer),
-          Layer.provide(BunServices.layer),
+          Layer.provide([BunServices.layer, BunCrypto.layer]),
         );
         const shadowLayer = pgDeltaNextShadowLayer.pipe(
           Layer.provide(apiLayer),
@@ -113,7 +114,7 @@ describe("pg-delta next stack shadow provisioning", () => {
           Layer.provide(Layer.succeed(CliArgs, { args: [] })),
           // Without a reachable container engine, automatic selection keeps the shadows native.
           Layer.provide(engines.hidingLayer),
-          Layer.provide(BunServices.layer),
+          Layer.provide([BunServices.layer, BunCrypto.layer]),
         );
         const services = Layer.mergeAll(
           FetchHttpClient.layer,
diff --git a/apps/cli/src/commands/db/shared/pgdelta.seam.integration.test.ts b/apps/cli/src/commands/db/shared/pgdelta.seam.integration.test.ts
index f1a88857d3..a879d17171 100644
--- a/apps/cli/src/commands/db/shared/pgdelta.seam.integration.test.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta.seam.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, FileSystem, Layer, Option, Path } from "effect";
 import * as HttpClient from "effect/http/HttpClient";
@@ -178,18 +178,19 @@ function setup(
     Layer.provide(Layer.succeed(ExperimentalFlag, false)),
     Layer.provide(Layer.succeed(DebugFlag, false)),
     Layer.provide(Layer.succeed(CliArgs, { args: [] })),
-    // The fake `ChildProcessSpawner` must be provided BEFORE the real `BunServices.layer`
-    // fallback below, so it wins over the real one for whatever `ChildProcessSpawner`
-    // `seam` itself resolves — `Layer.provide` fully resolves each requirement it can
-    // satisfy as it's applied, so `BunServices.layer` only ever fills in `FileSystem`/`Path`.
+    // The fake `ChildProcessSpawner` must be provided before the real `BunServices.layer` and
+    // `BunCrypto.layer` fallback below, so it wins for whatever `ChildProcessSpawner` `seam`
+    // resolves — `Layer.provide` resolves each requirement as it's applied, so the fallback only
+    // fills the remaining platform services (`FileSystem`, `Path`) and crypto (`Digest`, `SecureRandom`).
     Layer.provide(shadowSpawner.layer),
     Layer.provide(engine),
     Layer.provide(unusedStackServices),
-    Layer.provide(BunServices.layer),
+    Layer.provide([BunServices.layer, BunCrypto.layer]),
   );
 
   const layer = Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     out.layer,
     shadowSpawner.layer,
     dbConnection.layer,
diff --git a/apps/cli/src/commands/db/shared/pgdelta.seam.layer.ts b/apps/cli/src/commands/db/shared/pgdelta.seam.layer.ts
index b47fe84d68..3e4604af58 100644
--- a/apps/cli/src/commands/db/shared/pgdelta.seam.layer.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta.seam.layer.ts
@@ -1,4 +1,5 @@
 import { Effect, FileSystem, Layer, Option, Path, Schema, Stream } from "effect";
+import type { SecureRandom } from "effect/crypto";
 import { ChildProcessSpawner } from "effect/process/ChildProcessSpawner";
 
 import { CommandSettings } from "../../../config/command-settings.service.ts";
@@ -8,7 +9,7 @@ import { CliArgs } from "../../../shared/cli/cli-args.service.ts";
 import { ExperimentalFlag } from "../../../command-internal/global-flags.ts";
 import { spawnContainerCli } from "../../../command-internal/container-cli.ts";
 import { resolveDbImage } from "../../../command-internal/db-image.ts";
-import { readDbToml } from "../../../command-internal/db-config.toml-read.ts";
+import { readDbConfig } from "../../../command-internal/db-config.read.ts";
 import { getRegistryImageUrl } from "../../../command-internal/docker-registry.ts";
 import { isDockerDaemonUnreachable } from "../../../command-internal/docker-suggest.ts";
 import { imageDigest, imageTag, isSlimImageRef } from "../../../shared/services/slim-images.ts";
@@ -83,7 +84,7 @@ export const declarativeSeamLayer = Layer.effect(
     const cliArgs = yield* CliArgs;
     const stackCatalogSetup = yield* StackCatalogSetup;
     const cliConfigValues = yield* CliConfigValues;
-    const context = yield* Effect.context<StartLocalDatabaseDeps>();
+    const context = yield* Effect.context<StartLocalDatabaseDeps | SecureRandom.SecureRandom>();
 
     return DeclarativeSeam.of({
       ensureLocalDatabaseStarted: Effect.gen(function* () {
@@ -143,7 +144,7 @@ export const declarativeSeamLayer = Layer.effect(
         if (backend.kind === "stack") return;
         return yield* Effect.scoped(
           Effect.gen(function* () {
-            const toml = yield* readDbToml(fs, path, cliSettings.workdir).pipe(
+            const toml = yield* readDbConfig(fs, path, cliSettings.workdir).pipe(
               Effect.provideService(CliConfigValues, cliConfigValues),
               Effect.mapError(
                 (error) =>
diff --git a/apps/cli/src/commands/db/shared/pgdelta.write.integration.test.ts b/apps/cli/src/commands/db/shared/pgdelta.write.integration.test.ts
new file mode 100644
index 0000000000..9699ff8dc2
--- /dev/null
+++ b/apps/cli/src/commands/db/shared/pgdelta.write.integration.test.ts
@@ -0,0 +1,32 @@
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Path } from "effect";
+
+import { useTempWorkdir } from "../../../../tests/helpers/command-mocks.ts";
+import { updateDeclarativeSchemaPathsConfig } from "./pgdelta.write.ts";
+
+describe("updateDeclarativeSchemaPathsConfig", () => {
+  const tmp = useTempWorkdir("decl-schema-paths-");
+
+  it.effect("sets schema_paths in config.jsonc, keeps comments, and creates no config.toml", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const configPath = path.join(tmp.current, "supabase", "config.jsonc");
+      yield* fs.makeDirectory(path.join(tmp.current, "supabase"), { recursive: true });
+      yield* fs.writeFileString(
+        configPath,
+        ["{", "  // keep this comment", '  "db": { "port": 54322, },', "}", ""].join("\n"),
+      );
+
+      yield* updateDeclarativeSchemaPathsConfig(fs, path, tmp.current, "supabase/schemas");
+
+      const config = yield* fs.readFileString(configPath);
+      expect(config).toContain("// keep this comment");
+      expect(config).toContain('"port": 54322');
+      expect(config).toContain('"schema_paths"');
+      expect(config).toContain('"schemas"');
+      expect(yield* fs.exists(path.join(tmp.current, "supabase", "config.toml"))).toBe(false);
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+});
diff --git a/apps/cli/src/commands/db/shared/pgdelta.write.ts b/apps/cli/src/commands/db/shared/pgdelta.write.ts
index d73c932755..d11c77c862 100644
--- a/apps/cli/src/commands/db/shared/pgdelta.write.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta.write.ts
@@ -1,4 +1,9 @@
-import { Effect, type FileSystem, type Path, Schema } from "effect";
+import {
+  applyConfigEdits,
+  parseCliConfigDocumentFile,
+  writeCliConfigDocumentText,
+} from "@supabase/config/internal";
+import { Effect, type FileSystem, Option, type Path, Schema } from "effect";
 import { classifySqlFiles } from "@supabase/pg-delta/frontends";
 
 import { Output } from "../../../shared/output/output.service.ts";
@@ -270,6 +275,27 @@ export const updateDeclarativeSchemaPathsConfig = Effect.fn(
   const relative = normalized.startsWith("supabase/")
     ? normalized.slice("supabase/".length)
     : normalized;
+  const jsonConfig = yield* parseCliConfigDocumentFile(workdir, { search: false }).pipe(
+    Effect.option,
+  );
+  if (Option.isSome(jsonConfig) && jsonConfig.value?.format === "json") {
+    const document = jsonConfig.value;
+    const outcome = applyConfigEdits(document.rawText, "json", [
+      { path: ["db", "migrations", "schema_paths"], value: [relative] },
+    ]);
+    if (outcome.kind === "refused") {
+      return yield* new DeclarativeWriteError({
+        message: `failed to update config: ${outcome.refusal.detail}`,
+      });
+    }
+    yield* writeCliConfigDocumentText(document.path, outcome.text).pipe(
+      Effect.mapError(
+        (error) =>
+          new DeclarativeWriteError({ message: `failed to save config: ${error.message}` }),
+      ),
+    );
+    return;
+  }
   const block = `\nschema_paths = [\n  "${relative}",\n]\n`;
   const configPath = path.join(workdir, "supabase", "config.toml");
   const existing = yield* fs.readFileString(configPath).pipe(
diff --git a/apps/cli/src/commands/db/shared/shadow-source.ts b/apps/cli/src/commands/db/shared/shadow-source.ts
index 3134f68ed4..87c9ba45db 100644
--- a/apps/cli/src/commands/db/shared/shadow-source.ts
+++ b/apps/cli/src/commands/db/shared/shadow-source.ts
@@ -16,8 +16,8 @@ import { bold } from "../../../command-internal/colors.ts";
 import { DbConnection, type PgConnInput } from "../../../command-internal/db-connection.service.ts";
 import {
   resolveDeclarativeDir,
-  type PgDeltaTomlConfig,
-} from "../../../command-internal/db-config.toml-read.ts";
+  type PgDeltaConfig,
+} from "../../../command-internal/db-config.read.ts";
 import { resolveSeedSqlPath } from "../../../shared/config/seed-path.ts";
 import {
   resolveUnderWorkdir,
@@ -54,7 +54,7 @@ export interface PrepareShadowSourceInput<E> extends ShadowSetupInput<E> {
   readonly migrationMode?: "legacy" | "pgdelta-next";
   /** `db.migrations.schema_paths`, unresolved (raw config value). */
   readonly schemaPaths: ReadonlyArray<string>;
-  readonly pgDelta: PgDeltaTomlConfig;
+  readonly pgDelta: PgDeltaConfig;
 }
 
 /** Every failure {@link prepareShadowSource} can produce, beyond its own `E` (JWKS resolution). */
@@ -290,7 +290,7 @@ export const loadDeclaredSchemas = Effect.fn("ShadowSource.loadDeclaredSchemas")
   path: Path.Path,
   workdir: string,
   schemaPaths: ReadonlyArray<string>,
-  pgDelta: PgDeltaTomlConfig,
+  pgDelta: PgDeltaConfig,
 ): Effect.fn.Return<ReadonlyArray<string>, DeclarativeShadowDbError> {
   if (schemaPaths.length > 0) {
     return yield* globDeclaredSchemaPaths(fs, path, workdir, schemaPaths);
diff --git a/apps/cli/src/commands/db/shared/shadow-source.unit.test.ts b/apps/cli/src/commands/db/shared/shadow-source.unit.test.ts
index c12f114dfe..1bd302a743 100644
--- a/apps/cli/src/commands/db/shared/shadow-source.unit.test.ts
+++ b/apps/cli/src/commands/db/shared/shadow-source.unit.test.ts
@@ -3,9 +3,9 @@ import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, FileSystem, Layer, Option, Path, PlatformError } from "effect";
 
 import { cleanSchemaPath, loadDeclaredSchemas } from "./shadow-source.ts";
-import type { PgDeltaTomlConfig } from "../../../command-internal/db-config.toml-read.ts";
+import type { PgDeltaConfig } from "../../../command-internal/db-config.read.ts";
 
-function pgDelta(overrides: Partial<PgDeltaTomlConfig> = {}): PgDeltaTomlConfig {
+function pgDelta(overrides: Partial<PgDeltaConfig> = {}): PgDeltaConfig {
   return {
     enabled: false,
     declarativeSchemaPath: Option.none(),
diff --git a/apps/cli/src/commands/db/start/SIDE_EFFECTS.md b/apps/cli/src/commands/db/start/SIDE_EFFECTS.md
index 62bdc1dc41..69995b0ccc 100644
--- a/apps/cli/src/commands/db/start/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/start/SIDE_EFFECTS.md
@@ -81,7 +81,11 @@ composition reuses too — see that command's `SIDE_EFFECTS.md`):
 9. Wait up to 15s for Docker's first health verdict, so `supabase db start && supabase status`
    does not see `starting`: poll `docker container inspect` every 1s until the health status
    leaves `starting`, the container stops running, or Docker cannot launch its health check. Never
-   fails the command, whatever the outcome, and is not covered by the rollback below.
+   fails the command, whatever the outcome, and is not covered by the rollback below. When the
+   `docker version` probe reports API >= 1.44 on both ends, `docker create` also gets
+   `--health-start-period 10s --health-start-interval 1s`, so the first check runs about 1s after
+   start instead of 10s. Older engines and the Podman CLI get neither flag; the `docker` client on a
+   Podman socket reporting API >= 1.44 gets both, Podman drops the interval, and there is no speedup.
 
 Any failure from step 1 onward prints `Stopping containers...` to stderr and rolls back via
 `rollbackDatabaseStart`, which only touches what this command creates: the db container
@@ -135,6 +139,7 @@ only spawns on fallback.
 | `docker volume inspect supabase_db_<project>`                                                      | when not already running — the pre-create fresh-volume probe                                                                                               |
 | `docker image inspect` / `docker pull` (registry-fallback resolve)                                 | when not already running — resolves the Postgres image                                                                                                     |
 | `docker volume create --label ...`                                                                 | when not already running, unless a `--from-backup` restore onto an existing volume (fails first)                                                           |
+| `docker version --format ...`                                                                      | when not already running, once: API >= 1.44 on both ends adds the health start flags (see step 9)                                                          |
 | `docker create` + optional `docker cp - <id>:/` + `docker start`                                   | when not already running — `cp` streams one in-memory tar archive containing the pgsodium root key at its exact path when the selected entrypoint needs it |
 | `docker cp <id>:/var/lib/postgresql/data/PG_VERSION -`                                             | when the volume already existed, between `docker create` and `docker start` — the data-directory probe; its stdout is discarded                            |
 | `docker container inspect` (repeated)                                                              | readiness polling every 500ms up to `db.health_timeout`, then health-settle polling every 1s for up to 15s                                                 |
diff --git a/apps/cli/src/commands/db/start/start.integration.test.ts b/apps/cli/src/commands/db/start/start.integration.test.ts
index f60124ae61..e61e2df631 100644
--- a/apps/cli/src/commands/db/start/start.integration.test.ts
+++ b/apps/cli/src/commands/db/start/start.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -101,7 +101,7 @@ function mockContainerCliSpawner(route: (args: ReadonlyArray<string>) => RouteRe
     ChildProcessSpawner.ChildProcessSpawner,
     ChildProcessSpawner.make((command) =>
       Effect.gen(function* () {
-        const args = ChildProcess.isStandardCommand(command) ? command.args : [];
+        const args = ChildProcess.isStandardCommand(command) ? command.args.map(String) : [];
         spawned.push({ args });
 
         if (!ChildProcess.isStandardCommand(command)) {
@@ -482,7 +482,7 @@ function setup(opts: SetupOpts = {}) {
         yield* writeProjectFile(workdir, ".env", opts.projectEnvContents);
       }
     }),
-  ).pipe(Layer.provide(BunServices.layer));
+  ).pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
   const out = mockOutput({ format: opts.format ?? "text" });
   const http = alwaysReadyHttpClient();
   const telemetry = mockTelemetryStateTracked();
@@ -530,6 +530,7 @@ function setup(opts: SetupOpts = {}) {
 
   const layer = Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     out.layer,
     configValuesLayer({ output: out.layer }),
     cliSettings,
@@ -581,13 +582,13 @@ const readCurrentBranch = (workdir: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     return yield* fs.readFileString(yield* currentBranchPath(workdir));
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const currentBranchExists = (workdir: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     return yield* fs.exists(yield* currentBranchPath(workdir));
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 describe("db start", () => {
   beforeEach(() => {
@@ -1039,6 +1040,17 @@ describe("db start", () => {
     });
   });
 
+  it.effect("emits the health-start flags on a supported engine", () => {
+    const base = freshVolumeRoute(defaultRoute());
+    const { layer, child } = setup({
+      route: (args) => (args[0] === "version" ? { stdout: ["1.44 1.44 1.56"] } : base(args)),
+    });
+    return Effect.gen(function* () {
+      yield* dbStart(DEFAULT_FLAGS).pipe(Effect.provide(layer));
+      expect(createArgs(child.spawned)).toContain("--health-start-interval");
+    });
+  });
+
   it.effect("starts when Docker's health check cannot exec but the host can connect", () => {
     const s = setup({ route: execFailedHealthRoute(freshVolumeRoute(defaultRoute())) });
     return Effect.gen(function* () {
@@ -1263,7 +1275,7 @@ describe("db start", () => {
             expect(stateAtConnect.length).toBeGreaterThan(1);
             expect(stateAtConnect.every((state) => state === "busy")).toBe(true);
             expect(yield* gateState(gate)).toBe("free");
-          }).pipe(Effect.provide(BunServices.layer));
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
         },
       );
     }
@@ -1916,7 +1928,7 @@ describe("db start", () => {
             const fs = yield* FileSystem.FileSystem;
             const path = yield* Path.Path;
             return yield* fs.readFileString(path.join(tempRoot.current, "supabase", "config.toml"));
-          }).pipe(Effect.provide(BunServices.layer));
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
           expect(onDiskConfig).toBe(configContents ?? 'project_id = "test"\n');
           expect(out.stderrText).not.toContain("auto_expose_new_tables");
         }
diff --git a/apps/cli/src/commands/db/test/test.integration.test.ts b/apps/cli/src/commands/db/test/test.integration.test.ts
index dd4f5a8981..2cb81c68b4 100644
--- a/apps/cli/src/commands/db/test/test.integration.test.ts
+++ b/apps/cli/src/commands/db/test/test.integration.test.ts
@@ -5,7 +5,7 @@
  * behavior: end-to-end delegation, telemetry recording `"db test"` (not `"test db"`) as the
  * invoked path, and the non-text `onRunFailure` branch.
  */
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, Layer, Option, Stdio } from "effect";
 import { CliOutput, Command } from "effect/cli";
@@ -256,8 +256,9 @@ function setup(opts: SetupOpts = {}) {
     Layer.succeed(OutputFlag, Option.none()),
     mockTty(),
     Stdio.layerTest({ args: Effect.succeed(args) }),
-    commandRuntimeLayer(["db", "test"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["db", "test"]).pipe(Layer.provide([BunServices.layer, BunCrypto.layer])),
     BunServices.layer,
+    BunCrypto.layer,
   );
   return { layer, out, analytics, processControl, connection, docker };
 }
@@ -335,6 +336,7 @@ describe("db test (alias) integration", () => {
         cliConfigValuesTestLayer,
         unusedStackServices,
         BunServices.layer,
+        BunCrypto.layer,
         mockRuntimeInfo(),
         mockTty(),
         mockProcessControl().layer,
diff --git a/apps/cli/src/commands/experimental/compute/compute-backend.integration.test.ts b/apps/cli/src/commands/experimental/compute/compute-backend.integration.test.ts
index 9915518151..2c583f5995 100644
--- a/apps/cli/src/commands/experimental/compute/compute-backend.integration.test.ts
+++ b/apps/cli/src/commands/experimental/compute/compute-backend.integration.test.ts
@@ -147,11 +147,14 @@ describe("resolveComputeEnabled", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
   });
 
-  it.effect("ignores compute configuration for unrelated commands", () =>
+  it.effect.each([
+    ["functions", "list"],
+    ["logs", "--remote", "--sql", "select 1"],
+  ])("ignores compute configuration for unrelated commands %j", (args) =>
     Effect.gen(function* () {
       expect(
         yield* resolve({
-          args: ["functions", "list"],
+          args,
           cwd: "/missing",
           env: { SUPABASE_EXPERIMENTAL_COMPUTE: "invalid" },
         }),
diff --git a/apps/cli/src/commands/experimental/compute/compute-logs.format.ts b/apps/cli/src/commands/experimental/compute/compute-logs.format.ts
index ac43bc6142..edcefdc3ed 100644
--- a/apps/cli/src/commands/experimental/compute/compute-logs.format.ts
+++ b/apps/cli/src/commands/experimental/compute/compute-logs.format.ts
@@ -4,26 +4,10 @@ import { COMPUTE_LOG_STREAMS } from "../../../shared/compute/compute-logs.sql.ts
 import type { ComputeLogEntry } from "../../../shared/compute/compute-logs-api.ts";
 import { stripControlSequences } from "../../../shared/output/strip-control-sequences.ts";
 
-/**
- * Text rendering for `supabase compute logs`.
- *
- * Pure, so line shapes and level derivation are unit-testable directly. Kept
- * apart from `compute.format.ts`, which renders a compute's details as a
- * key/value block rather than a stream of per-line events.
- */
-
 export type ComputeLogLevel = "info" | "warn" | "error";
 
-/**
- * The level for one line, derived rather than read: `severity_text` carries
- * `INFO` on every observed row (including 200s), so it's a pipeline default,
- * not a signal — the platform's own presets derive level from
- * `log_attributes` too. Guest output has no level without parsing tenant
- * text, so it's reported absent rather than guessed.
- */
 export function computeLogLevel(entry: ComputeLogEntry): ComputeLogLevel | undefined {
   if (entry.stream === COMPUTE_LOG_STREAMS.requests) {
-    // `log_attributes` is a Map(String, String), so this is "200", not 200.
     const status = Number(entry.attributes.status);
     if (!Number.isFinite(status)) {
       return undefined;
@@ -39,13 +23,6 @@ export function computeLogLevel(entry: ComputeLogEntry): ComputeLogLevel | undef
   return undefined;
 }
 
-/**
- * Colour for a level, or plain text. The stream is threaded through rather
- * than a boolean since `aqua`/`red`/... already own the colour decision
- * (`NO_COLOR`, `CLICOLOR`, `CLICOLOR_FORCE`, `CI`, `hasColors()`); only
- * `warn`/`error` are coloured, since tinting the overwhelming majority
- * (`info`) would bury the exceptions instead of highlighting them.
- */
 function colourise(text: string, level: ComputeLogLevel | undefined, stream: ColorStream): string {
   if (level === "error") {
     return red(text, stream);
@@ -53,13 +30,6 @@ function colourise(text: string, level: ComputeLogLevel | undefined, stream: Col
   return level === "warn" ? yellow(text, stream) : text;
 }
 
-/**
- * `HH:MM:SS` in the reader's own timezone, matching the only other log-line
- * format this shell prints (the `--debug` HTTP logger). Machine output keeps
- * unambiguous forms instead, carrying an ISO-8601 UTC `timestamp` and raw
- * `timestamp_ms`. Date is omitted since a single invocation's lines all fall
- * inside one day.
- */
 function formatLogTime(timestampMs: number): string {
   return DateTime.formatLocal(DateTime.makeUnsafe(timestampMs), {
     locale: "en-GB",
@@ -70,12 +40,6 @@ function formatLogTime(timestampMs: number): string {
   });
 }
 
-/**
- * The short label for a stream, and the column it sits in. Bracketed and
- * left-aligned so interleaved sources are easy to scan, and padded so
- * messages line up. Abbreviated since the wire names are long internal
- * strings; the words match `--kind`, so what's printed is what the flag accepts.
- */
 const STREAM_TAGS: Readonly<Record<string, string>> = {
   [COMPUTE_LOG_STREAMS.app]: "app",
   [COMPUTE_LOG_STREAMS.requests]: "req",
@@ -84,22 +48,10 @@ const STREAM_TAGS: Readonly<Record<string, string>> = {
 
 const TAG_WIDTH = Math.max(...Object.values(STREAM_TAGS).map((tag) => tag.length)) + 2;
 
-/**
- * An unrecognised stream gets its raw name rather than a placeholder: the log
- * contract is additive-only, so the name is more useful than a `?`.
- */
 function streamTag(stream: string): string {
   return `[${STREAM_TAGS[stream] ?? stream}]`.padEnd(TAG_WIDTH);
 }
 
-/**
- * What one entry says, composed and sanitised but not coloured or prefixed.
- *
- * Split out from the renderer since `stream-json` needs the same sentence:
- * `event_message` alone would drop the status/duration or build reason, which
- * live in `log_attributes` instead. Per-stream layouts, not one shared
- * format, since `event_message` means something different on each stream.
- */
 export function computeLogText(entry: ComputeLogEntry): string {
   if (entry.stream === COMPUTE_LOG_STREAMS.requests) {
     const { status, method, path, duration_ms: duration } = entry.attributes;
@@ -119,28 +71,12 @@ export function computeLogText(entry: ComputeLogEntry): string {
       .join(" ");
   }
 
-  // Guest output, and anything newer — the message is the payload. Every
-  // branch above sanitises too, since a request `path` or build `reason` is
-  // not guaranteed trustworthy either; `stream` needs no sanitising, since
-  // the query only returns one of three literal values.
   return stripControlSequences(entry.message);
 }
 
-/**
- * One rendered line. Per-stream layouts, not one shared format, since
- * `event_message` means something different on each — a single format wide
- * enough for all three would be mostly empty for each of them. An
- * unrecognised stream falls back to the bare message, since the log contract
- * is additive-only.
- */
 export function renderComputeLogLine(
   entry: ComputeLogEntry,
   options: {
-    /**
-     * Whether to prefix the stream tag. False when `--kind` has already pinned
-     * one stream, where every line would carry the same tag and it would be
-     * width spent saying nothing.
-     */
     readonly showStream: boolean;
     readonly colorStream?: ColorStream;
   },
diff --git a/apps/cli/src/commands/experimental/compute/compute-logs.format.unit.test.ts b/apps/cli/src/commands/experimental/compute/compute-logs.format.unit.test.ts
index 87909197d3..cec6e4d03f 100644
--- a/apps/cli/src/commands/experimental/compute/compute-logs.format.unit.test.ts
+++ b/apps/cli/src/commands/experimental/compute/compute-logs.format.unit.test.ts
@@ -1,3 +1,4 @@
+import { DateTime } from "effect";
 import { describe, expect, it } from "@effect/vitest";
 import { afterEach, beforeEach, vi } from "vitest";
 import type { ComputeLogEntry } from "../../../shared/compute/compute-logs-api.ts";
@@ -5,12 +6,6 @@ import { renderComputeLogLine, computeLogLevel } from "./compute-logs.format.ts"
 
 const ESCAPE = "\u001b";
 
-/**
- * Colour depends on both the stream and the environment (`supportsColor`
- * checks NO_COLOR/CLICOLOR/CLICOLOR_FORCE/CI before the stream), so a fake
- * stream alone isn't deterministic — under CI a `hasColors: () => true`
- * stream still renders plain unless the env vars are neutralised too.
- */
 const PLAIN = { hasColors: () => false };
 const COLOURED = { hasColors: () => true };
 
@@ -27,11 +22,9 @@ afterEach(() => {
 const AT = 1_788_187_532_576;
 
 function nativeDate(timestampMs: number): Date {
-  // oxlint-disable-next-line effecttsgo/global-date -- native Date accessors form an independent local-time oracle.
-  return new Date(timestampMs);
+  return DateTime.toDateUtc(DateTime.makeUnsafe(timestampMs));
 }
 
-/** Native Date accessors provide a local-time oracle independent of DateTime.formatLocal. */
 function localTime(timestampMs: number): string {
   const at = nativeDate(timestampMs);
   const pad = (value: number) => String(value).padStart(2, "0");
@@ -85,8 +78,6 @@ describe("computeLogLevel", () => {
   });
 
   it("reports no level for guest output rather than guessing one", () => {
-    // Nothing short of parsing tenant text could tell, so absent is the honest
-    // answer.
     expect(computeLogLevel(entry())).toBeUndefined();
   });
 
@@ -103,8 +94,6 @@ describe("renderComputeLogLine", () => {
   });
 
   it("composes the request line from attributes, not the message", () => {
-    // On the wire `event_message` is only "GET /" - status and duration live in
-    // log_attributes, so the useful line has to be assembled.
     const line = renderComputeLogLine(
       entry({
         stream: "worker_ingress_logs",
@@ -131,7 +120,6 @@ describe("renderComputeLogLine", () => {
   });
 
   it("falls back to the message for an unknown stream", () => {
-    // The log contract is additive-only, so a new stream must still print.
     const line = renderComputeLogLine(
       entry({ stream: "compute_future_logs", message: "something new" }),
       { showStream: false, colorStream: PLAIN },
@@ -141,8 +129,6 @@ describe("renderComputeLogLine", () => {
   });
 
   it("renders local time, not UTC", () => {
-    // Pinned against a fixed offset rather than the ambient zone, so the choice is
-    // asserted on a UTC machine too, where local and UTC would otherwise coincide.
     const utc = nativeDate(AT).toISOString().slice(11, 19);
     const offsetMinutes = nativeDate(AT).getTimezoneOffset();
     const line = renderComputeLogLine(entry(), { showStream: false, colorStream: PLAIN });
@@ -350,7 +336,6 @@ describe("renderComputeLogLine", () => {
       { showStream: true, colorStream: PLAIN },
     );
 
-    // A ragged left edge is harder to scan than a slightly wider one.
     expect(app.indexOf("compute shim")).toBe(build.indexOf("deploy_accepted"));
   });
 
diff --git a/apps/cli/src/commands/experimental/compute/compute.errors.ts b/apps/cli/src/commands/experimental/compute/compute.errors.ts
index 08db18f563..a935242d15 100644
--- a/apps/cli/src/commands/experimental/compute/compute.errors.ts
+++ b/apps/cli/src/commands/experimental/compute/compute.errors.ts
@@ -19,13 +19,6 @@ export class ComputeEnvNotSupportedError extends Data.TaggedError("ComputeEnvNot
   }
 }
 
-/**
- * `--follow` cannot be combined with an output format that promises exactly
- * one terminal payload (`-o json|yaml|toml`, `--output-format json`) — an
- * unbounded tail has no last element to put in it. Refused up front so a
- * query isn't paid for only to fail on the first emission. `--output-format
- * stream-json` is unaffected.
- */
 export class ComputeFollowNotSupportedError extends Data.TaggedError(
   "ComputeFollowNotSupportedError",
 )<{
diff --git a/apps/cli/src/commands/experimental/compute/compute.output.ts b/apps/cli/src/commands/experimental/compute/compute.output.ts
index e2cb8f9ded..83d3d84715 100644
--- a/apps/cli/src/commands/experimental/compute/compute.output.ts
+++ b/apps/cli/src/commands/experimental/compute/compute.output.ts
@@ -62,22 +62,6 @@ export const computeMachineOutputRequested = Effect.fnUntraced(function* () {
   return emitsPayloadFor(Option.getOrUndefined(yield* OutputFlag));
 });
 
-/**
- * The format a run actually renders in, with `-o` given priority over
- * `--output-format`.
- *
- * `-o pretty|table|csv` fall through to text, so branching on `output.format`
- * alone would wrongly emit JSON for `-o pretty --output-format json`.
- * `-o json|yaml|toml|env` are excluded because `emitComputeMachineOutput`
- * already owns those and their stdout.
- */
-export const computeRenderFormat = Effect.fnUntraced(function* () {
-  const output = yield* Output;
-  const outputFlagFormat = Option.getOrUndefined(yield* OutputFlag);
-  const forcesText = outputFlagFormat !== undefined && !emitsPayloadFor(outputFlagFormat);
-  return forcesText ? ("text" as const) : output.format;
-});
-
 /**
  * Refuses `-o env` before the command does anything.
  *
@@ -106,3 +90,10 @@ export const computeRemoteSuffix = (flags: ProjectTargetFlagValues, ref: string)
   Option.isSome(flags.projectRef) || Option.exists(flags.remote, (value) => value._tag !== "Linked")
     ? ` --remote=${ref}`
     : "";
+
+export const computeRenderFormat = Effect.fnUntraced(function* () {
+  const output = yield* Output;
+  const outputFlagFormat = Option.getOrUndefined(yield* OutputFlag);
+  const forcesText = outputFlagFormat !== undefined && !emitsPayloadFor(outputFlagFormat);
+  return forcesText ? ("text" as const) : output.format;
+});
diff --git a/apps/cli/src/commands/experimental/compute/compute.shared.ts b/apps/cli/src/commands/experimental/compute/compute.shared.ts
index d179d39a8a..f132d0b923 100644
--- a/apps/cli/src/commands/experimental/compute/compute.shared.ts
+++ b/apps/cli/src/commands/experimental/compute/compute.shared.ts
@@ -1,4 +1,3 @@
-import { findCliProjectPaths } from "@supabase/config/effect";
 import { Effect, FileSystem, Option, Path } from "effect";
 import { CommandSettings } from "../../../config/command-settings.service.ts";
 import { CliConfigValues } from "../../../config/cli-config-values.service.ts";
@@ -13,10 +12,7 @@ import {
   computeSourceDir,
 } from "../../../shared/compute/compute-paths.ts";
 import { validateComputeNameMessage } from "../../../shared/compute/compute-runtimes.ts";
-import {
-  ComputeJsonConfigUnsupportedError,
-  InvalidComputeNameError,
-} from "../../../shared/compute/compute.errors.ts";
+import { InvalidComputeNameError } from "../../../shared/compute/compute.errors.ts";
 
 /**
  * What every `supabase compute` command needs before it does
@@ -68,25 +64,6 @@ export const loadComputeProject = Effect.gen(function* () {
   } satisfies ComputeProject;
 });
 
-/**
- * As {@link loadComputeProject}, for the `[compute.<name>]` entry writer.
- *
- * `commitComputeEntry` is a TOML text editor, so a JSON project is rejected: appending a
- * `[compute.<name>]` table to `config.json` would make the file unparseable.
- */
-export const loadComputeProjectForEntryWrite = Effect.fnUntraced(function* () {
-  const settings = yield* CommandSettings;
-  const path = yield* Path.Path;
-  const paths = yield* findCliProjectPaths(settings.workdir, { search: false });
-  if (paths !== null && path.basename(paths.configPath) === "config.json") {
-    return yield* new ComputeJsonConfigUnsupportedError({
-      detail: `This project is configured by ${paths.configPath}, which the compute new command cannot edit safely.`,
-      suggestion: `Create the source files manually and add the compute entry to ${paths.configPath}, or convert the whole project configuration to TOML before scaffolding it.`,
-    });
-  }
-  return yield* loadComputeProject;
-});
-
 /**
  * As {@link loadComputeProject}, but never failing on the project config.
  *
diff --git a/apps/cli/src/commands/experimental/compute/delete/delete.command.ts b/apps/cli/src/commands/experimental/compute/delete/delete.command.ts
index afd2adae6d..fb631382ee 100644
--- a/apps/cli/src/commands/experimental/compute/delete/delete.command.ts
+++ b/apps/cli/src/commands/experimental/compute/delete/delete.command.ts
@@ -27,7 +27,7 @@ export type ComputeDeleteFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const computeDeleteCommand = Command.make("delete", config).pipe(
   Command.withDescription(
-    "Delete a compute from the linked Supabase project. Irreversible; its local directory and supabase/config.toml entry are kept.",
+    "Delete a compute from the linked Supabase project. Irreversible; its local directory and config file entry are kept.",
   ),
   Command.withShortDescription("Delete a compute from Supabase"),
   Command.withExamples([
diff --git a/apps/cli/src/commands/experimental/compute/delete/delete.handler.ts b/apps/cli/src/commands/experimental/compute/delete/delete.handler.ts
index f544f933e3..ad50d610db 100644
--- a/apps/cli/src/commands/experimental/compute/delete/delete.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/delete/delete.handler.ts
@@ -168,11 +168,13 @@ export const computeDelete = Effect.fn("compute.delete")(function* (flags: Compu
       // source or entry left, and pointing at `push` there would be a dead end.
       const kept = [
         ...(keptSource === undefined ? [] : [keptSource]),
-        ...(keptEntry ? ["its supabase/config.toml entry"] : []),
+        ...(keptEntry
+          ? [`its ${displayPath(path, project.projectRoot, project.configPath)} entry`]
+          : []),
       ];
       if (kept.length > 0) {
         yield* output.raw(renderComputeDetails([["Kept", kept.join(", ")]]));
-        // Only when the source is still there: a retained `config.toml` entry
+        // Only when the source is still there: a retained config entry
         // alone is not enough to redeploy from, so `push` would fail on the very
         // command this line recommends.
         if (keptSource !== undefined) {
diff --git a/apps/cli/src/commands/experimental/compute/list/list.command.ts b/apps/cli/src/commands/experimental/compute/list/list.command.ts
index ff2538b2a2..28157af0c8 100644
--- a/apps/cli/src/commands/experimental/compute/list/list.command.ts
+++ b/apps/cli/src/commands/experimental/compute/list/list.command.ts
@@ -22,7 +22,7 @@ export type ComputeListFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const computeListCommand = Command.make("list", config).pipe(
   Command.withDescription(
-    "List this project's compute, deployed or not: the union of supabase/config.toml's entries and what the Compute API reports.",
+    "List this project's compute, deployed or not: the union of the project config file's entries and what the Compute API reports.",
   ),
   Command.withShortDescription("List this project's compute"),
   Command.withExamples([
diff --git a/apps/cli/src/commands/experimental/compute/logs/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/compute/logs/SIDE_EFFECTS.md
index 060fdb61a1..914de3fc63 100644
--- a/apps/cli/src/commands/experimental/compute/logs/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/compute/logs/SIDE_EFFECTS.md
@@ -169,3 +169,7 @@ A `worker_guest_logs` message is bytes the tenant's own code printed. Control an
 escape sequences are stripped before it reaches a terminal, so a compute cannot
 reposition the cursor or forge CLI output; interior newlines and indentation are
 preserved so a stack trace survives intact.
+
+## Deprecation
+
+The command prints a warning on stderr before reading logs. It names `supabase logs --remote --service compute --resource <name>` as the replacement and v4 as the removal version. Existing flags, history defaults, follow defaults, and output remain unchanged.
diff --git a/apps/cli/src/commands/experimental/compute/logs/logs.command.ts b/apps/cli/src/commands/experimental/compute/logs/logs.command.ts
index cc36a49839..6a7a40c04a 100644
--- a/apps/cli/src/commands/experimental/compute/logs/logs.command.ts
+++ b/apps/cli/src/commands/experimental/compute/logs/logs.command.ts
@@ -1,3 +1,5 @@
+import { Effect } from "effect";
+import { Output } from "../../../../shared/output/output.service.ts";
 import { Argument, Command, Flag } from "effect/cli";
 import type * as CliCommand from "effect/cli/Command";
 import { withPermissions } from "../../../../command-internal/command-permissions/command-permissions.annotation.ts";
@@ -17,14 +19,6 @@ import { withTargetPolicy } from "../../../../command-internal/target/target-pol
 import { branchResolution } from "../../../../command-internal/target/branch-resolution.ts";
 import { projectTargetFlags } from "../../../../command-internal/target/target-flags.ts";
 
-/**
- * The endpoint's own ceiling is the SQL `LIMIT`, so this bound is the CLI's
- * choice. 1000 is high enough to be a non-issue in practice and low enough that a
- * typo cannot ask for a payload nobody wants.
- *
- * 0 is allowed and means "no history", which only becomes useful alongside
- * `--follow`; on its own it prints nothing and makes no request.
- */
 const MAX_TAIL = 1000;
 
 const config = {
@@ -42,9 +36,7 @@ const config = {
     Flag.withDescription(
       `Keep printing new lines until interrupted, polling every ${COMPUTE_LOG_POLL_SECONDS} seconds.`,
     ),
-    // Required: `Flag.Boolean` alone builds a *required* param, which breaks
-    // invocations that omit the flag. `boolean-flag-defaults.unit.test.ts`
-    // walks the command tree and fails any bare boolean.
+
     Flag.withDefault(false),
   ),
   tail: Flag.Int("tail").pipe(
@@ -63,7 +55,7 @@ export type ComputeLogsFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const computeLogsCommand = Command.make("logs", config).pipe(
   Command.withDescription(
-    "Print a compute's recent logs: its own output, the HTTP requests it served, and its " +
+    "Deprecated; removed in v4. Use supabase logs instead. Print a compute's recent logs: its own output, the HTTP requests it served, and its " +
       "deploy lifecycle events.\n\n" +
       "Covers the last 24 hours, which is the longest window the logs API will answer in one " +
       "query. Lines are printed oldest first.\n\n" +
@@ -114,9 +106,13 @@ export const computeLogsCommand = Command.make("logs", config).pipe(
     ),
   ),
   Command.withHandler((flags) =>
-    computeLogs(flags).pipe(
-      // `config` as well as `flags`: `--kind` is a choice flag, and the wrapper
-      // treats a command's own declared choices as safe to log verbatim.
+    Effect.gen(function* () {
+      yield* (yield* Output).raw(
+        "Warning: compute logs is deprecated and will be removed in v4. Use supabase logs --remote --service compute --resource <name> instead.\n",
+        "stderr",
+      );
+      yield* computeLogs(flags);
+    }).pipe(
       withCommandTelemetry({ flags, config, aliases: { f: "follow" } }),
       withJsonErrorHandling,
     ),
diff --git a/apps/cli/src/commands/experimental/compute/logs/logs.follow.ts b/apps/cli/src/commands/experimental/compute/logs/logs.follow.ts
new file mode 100644
index 0000000000..27d7659f74
--- /dev/null
+++ b/apps/cli/src/commands/experimental/compute/logs/logs.follow.ts
@@ -0,0 +1,15 @@
+import { Effect, Schedule } from "effect";
+import { ProcessControl } from "../../../../shared/runtime/process-control.service.ts";
+
+export const followLogs = Effect.fn("Logs.follow")(function* <A, E, R>(
+  poll: Effect.Effect<A, E, R>,
+  schedule: Schedule.Schedule<unknown>,
+) {
+  const processControl = yield* ProcessControl;
+  yield* Effect.raceFirst(
+    poll.pipe(Effect.repeat(schedule)),
+    processControl
+      .awaitSignal()
+      .pipe(Effect.flatMap((signal) => processControl.setExitCode(signal === "SIGINT" ? 130 : 0))),
+  );
+});
diff --git a/apps/cli/src/commands/experimental/compute/logs/logs.handler.ts b/apps/cli/src/commands/experimental/compute/logs/logs.handler.ts
index 9393a66d75..1f344f5165 100644
--- a/apps/cli/src/commands/experimental/compute/logs/logs.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/logs/logs.handler.ts
@@ -1,3 +1,4 @@
+import { followLogs } from "./logs.follow.ts";
 import { Clock, DateTime, Effect, Option, Ref, Schedule, Stream } from "effect";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { emitSuccessTrailer } from "../../../../shared/cli/success-trailer.ts";
@@ -8,7 +9,6 @@ import {
   computeRemoteSuffix,
 } from "../compute.output.ts";
 import { renderComputeLogLine, computeLogLevel, computeLogText } from "../compute-logs.format.ts";
-import { ProcessControl } from "../../../../shared/runtime/process-control.service.ts";
 import { ComputeFollowNotSupportedError } from "../compute.errors.ts";
 import { CommandPlatformApi } from "../../../../auth/command-platform-api.service.ts";
 import {
@@ -37,54 +37,16 @@ import { validateComputeName } from "../compute.shared.ts";
 import { computeMachineOutputRequested, computeRenderFormat } from "../compute.output.ts";
 import type { ComputeLogsFlags } from "./logs.command.ts";
 
-/**
- * `supabase compute logs <name>` — what the compute has actually been doing.
- *
- * `status` reports the deployment; this reports the runtime. It reads the
- * project's unified logs stream rather than a compute-scoped route — see
- * `compute-logs.sql.ts` for the query and why it filters on `log_attributes`.
- */
-
-/**
- * How many printed ids the follow loop remembers, bounded well above one grace
- * window's worth so it can't cause a repeat while still capping growth for a
- * long-running tail.
- */
 const SEEN_ID_LIMIT = 5000;
 
-/**
- * How many rows one poll asks for per request, independent of `--tail` (which
- * only bounds the history a run opens with). Sharing them meant a small
- * `--tail` polled with the same small limit: a burst larger than that limit
- * came back as its newest rows alone, and the cursor advanced past the rest,
- * dropping them for good.
- */
 const FOLLOW_PAGE_SIZE = 1000;
 
-/**
- * How many requests one poll may spend draining a burst — bounded because the
- * endpoint allows only 10 requests/minute, so an unbounded drain could spend a
- * whole window's allowance on one poll. The drain walks backward from the
- * newest row, so rows past this bound are dropped for good, not just delayed;
- * the tail reports this on stderr rather than silently losing the gap.
- */
 const FOLLOW_MAX_PAGES = 5;
 
-/**
- * How long one poll may keep failing before the tail gives up. Bounded by
- * elapsed time rather than attempts, and spaced, so a 429 or a momentary blip
- * is ridden out without spending the rate limit on retries.
- */
 const FOLLOW_READ_RETRY = Schedule.spaced("5 seconds").pipe(
   Schedule.upTo({ duration: "1 minute" }),
 );
 
-/**
- * Which poll failures are worth spending another request on. Server-side
- * statuses and 408/429 are retryable (the server is asking for exactly that);
- * other client errors answer the same way every time, so retrying just burns
- * the rate limit for a minute with no chance of success.
- */
 function isRetryableFollowFailure(error: unknown): boolean {
   if (error instanceof ComputeApiUnexpectedStatusError) {
     return error.status >= 500 || error.status === 408 || error.status === 429;
@@ -92,19 +54,10 @@ function isRetryableFollowFailure(error: unknown): boolean {
   return (
     error instanceof ComputeLogsRateLimitedError ||
     error instanceof ComputeApiNetworkError ||
-    // The endpoint reports a rejected or timed-out query this way, and its own
-    // suggestion is to retry shortly.
     error instanceof ComputeLogsQueryFailedError
   );
 }
 
-/**
- * Test seams for the follow loop.
- *
- * Both schedules are parameters for the same reason `awaitComputeBuild`'s are: the
- * real ones are spaced in seconds, and a test exercising the cursor, the dedupe,
- * or the retry path should not wait on a wall clock to do it.
- */
 export interface ComputeLogsOptions {
   readonly pollSchedule?: Schedule.Schedule<unknown>;
   readonly retrySchedule?: Schedule.Schedule<unknown>;
@@ -120,13 +73,11 @@ interface FollowCursor {
   readonly page: number;
 }
 
-/** The machine-format row for one line. */
 function toPayloadEntry(entry: ComputeLogEntry) {
   const level = computeLogLevel(entry);
   return {
     id: entry.id,
-    // Both forms: the ISO string is what a human or `jq` wants to read, the raw
-    // epoch value is what a script sorts or diffs on without reparsing.
+
     timestamp: DateTime.formatIso(DateTime.makeUnsafe(entry.timestampMs)),
     timestamp_ms: entry.timestampMs,
     stream: entry.stream,
@@ -144,11 +95,7 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
   const api = yield* CommandPlatformApi;
   const linkedProjectCache = yield* LinkedProjectCache;
   const telemetryState = yield* TelemetryState;
-  const processControl = yield* ProcessControl;
 
-  // Telemetry wraps ref resolution too, since an unlinked non-interactive
-  // checkout fails inside `resolve` after the command has already run. Only the
-  // linked-project cache stays under the ref, since it has nothing to write without one.
   yield* Effect.gen(function* () {
     const projectRef = yield* resolveProjectTarget(flags);
     const refSuffix = computeRemoteSuffix(flags, projectRef);
@@ -156,17 +103,10 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
     yield* Effect.gen(function* () {
       const name = yield* validateComputeName(flags.name);
 
-      // Up front, like the rest of the family: this payload always carries a `logs`
-      // array, so `-o env` can never encode it, and finding that out at emit time
-      // means failing after the query has already been paid for.
       yield* rejectComputeEnvOutput();
 
-      // Resolved once, before anything branches: `-o` outranks `--output-format`,
-      // so `output.format` on its own is not what this run renders in.
       const renderFormat = yield* computeRenderFormat();
 
-      // Also up front: a tail has no single terminal payload, so the bounded
-      // machine formats cannot express it. `stream-json` can, and is allowed.
       if (flags.follow) {
         const machineOutput = yield* computeMachineOutputRequested();
         if (machineOutput || renderFormat === "json") {
@@ -182,17 +122,8 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         options.pollSchedule ?? Schedule.spaced(`${COMPUTE_LOG_POLL_SECONDS} seconds`);
       const readRetrySchedule = options.retrySchedule ?? FOLLOW_READ_RETRY;
 
-      // The stream tag only earns its width when streams are actually mixed; with
-      // `--kind` every line would carry the same one.
       const showStream = Option.isNone(flags.kind);
 
-      /**
-       * Writes a batch of lines out in whichever form the format calls for.
-       *
-       * `stream-json` emits a `log-entry` event per line rather than one terminal
-       * `result`, since a tail has no terminal element; `stream` is derived from
-       * the level, and `source` distinguishes backlog from newly arrived lines.
-       */
       const emitLines = (
         batch: ReadonlyArray<ComputeLogEntry>,
         origin: "history" | "live" = "history",
@@ -209,10 +140,7 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
                 timestamp: DateTime.formatIso(DateTime.makeUnsafe(entry.timestampMs)),
                 service: name,
                 stream: level === "error" || level === "warn" ? "stderr" : "stdout",
-                // The composed sentence, the same one text mode renders: a
-                // request line's status and duration and a build's reason live
-                // in `log_attributes`, and `log-entry` has no field to carry
-                // them separately.
+
                 line: computeLogText(entry),
                 source: origin,
               });
@@ -228,12 +156,8 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         ? [COMPUTE_LOG_STREAMS[flags.kind.value]]
         : ALL_COMPUTE_LOG_STREAMS;
 
-      // Before any request, so a slow history query or deployed-compute check
-      // cannot widen what `followFloorMs` below treats as "already there".
       const startedAtMs = yield* Clock.currentTimeMillis;
 
-      // `--tail 0` is "no history". On its own that is a no-op, but it is the shape
-      // `--follow` will want, and issuing a `limit 0` query would be a 400.
       const entries =
         flags.tail === 0
           ? []
@@ -249,18 +173,7 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
               return rows;
             });
 
-      // Nothing came back, which is two different situations wearing the same face:
-      // a compute that is not deployed at all, and one that is deployed and quiet.
-      // Only worth one extra request, and only in this branch.
-      //
-      // `--tail 0` makes no history query, so zero rows says nothing either way —
-      // but a tail still has to know the compute exists, or a typo waits forever on
-      // logs that can never arrive. A bounded `--tail 0` run prints nothing by
-      // definition and is left alone.
       if (entries.length === 0 && (flags.tail > 0 || flags.follow)) {
-        // Its own task: with `--tail 0` there is no "Fetching logs..." to inherit,
-        // and clearing that one before this request left text mode silent across
-        // a call that can take a moment.
         const checking = yield* output.task("Checking compute...");
         const deployed = yield* getCompute(api, projectRef, name).pipe(
           Effect.tapError(() => checking.fail()),
@@ -286,22 +199,16 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         logs: entries.map(toPayloadEntry),
       };
 
-      // `-o` asks for a machine-readable stdout, so nothing human may be written to
-      // it — `output.success` logs to stdout in text mode. Unreachable while
-      // following, which refuses these formats up front.
       if (!flags.follow && (yield* emitComputeMachineOutput(payload))) {
         return;
       }
 
-      // Only for a bounded (non-follow) read — a tail has no terminal payload; it
-      // emits a `log-entry` event per line via `emitLines` instead.
       if (!flags.follow && renderFormat !== "text") {
         yield* output.success("", payload);
         return;
       }
 
       if (entries.length === 0 && !flags.follow) {
-        // Deployed (the check above would have failed otherwise) and silent.
         yield* output.raw(`No logs for "${name}" in the last 24 hours.\n`);
         yield* emitSuccessTrailer(
           `Check it is running with ${aqua(`supabase compute status ${name}${refSuffix}`)}.\n`,
@@ -309,13 +216,8 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         return;
       }
 
-      // Oldest first: the query orders newest-first so `limit` means "most recent",
-      // but a reader scrolls forwards through time, and a stack trace only makes
-      // sense in the order it was printed.
       yield* emitLines(entries);
 
-      // A tail with nothing to show yet would otherwise look like a hang. On stderr,
-      // so it never lands in piped output.
       if (flags.follow && entries.length === 0 && renderFormat === "text") {
         yield* output.raw(`Waiting for new logs from "${name}". Press Ctrl+C to stop.\n`, "stderr");
       }
@@ -324,12 +226,8 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         return;
       }
 
-      // The cursor is the newest timestamp printed, plus the set of printed ids. Both
-      // live inside this generator, not a closure built once, since an Effect is a
-      // reusable description that may run more than once — shared state across runs
-      // would drop lines.
       const seenIds = yield* Ref.make(new Set(entries.map((entry) => entry.id)));
-      // Same reason: a notice already shown on a previous run would stay silent on the next.
+
       const skipNoticeShown = yield* Ref.make(false);
       const newestEntry = entries.at(-1);
       const newestSeen = yield* Ref.make<DateTime.Utc>(
@@ -338,9 +236,6 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
           : DateTime.makeUnsafe(newestEntry.timestampMs),
       );
 
-      // `--tail 0` asked for no history, but `followWindow` still reaches a grace
-      // period behind the cursor so a late-arriving line is caught; keeping the wide
-      // window and filtering by actual timestamp lets both cases coexist.
       const followFloorMs = flags.tail === 0 ? startedAtMs : Number.NEGATIVE_INFINITY;
 
       const pollAttempts = yield* Ref.make(0);
@@ -348,9 +243,6 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         yield* Ref.update(pollAttempts, (attempts) => attempts + 1);
         const cursor = yield* Ref.get(newestSeen);
 
-        // One request only ever answers with the newest page of its window, so a
-        // burst bigger than a page needs several. Walk `end` backwards while
-        // pages come back full; a short page means the window is drained.
         const pages = yield* Stream.paginate(
           { end: yield* DateTime.now, page: 0 },
           ({ end, page }) =>
@@ -363,16 +255,13 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
               Effect.map(
                 (rows): readonly [ReadonlyArray<FollowPage>, Option.Option<FollowCursor>] => {
                   const oldestRow = rows[0];
-                  // A short page is the only proof the window is empty below this point.
-                  // Both other exits — the page budget running out, and a full page too
-                  // narrow to walk past — leave rows unfetched underneath.
+
                   if (rows.length < FOLLOW_PAGE_SIZE || oldestRow === undefined) {
                     return [[{ rows, drained: true }], Option.none()];
                   }
-                  // Rows arrive oldest-first, so the next page ends where this one began.
+
                   const nextEnd = DateTime.makeUnsafe(oldestRow.timestampMs);
-                  // A full page whose rows all share one timestamp cannot narrow the
-                  // window: re-requesting it would return the same page forever.
+
                   if (
                     page + 1 >= FOLLOW_MAX_PAGES ||
                     DateTime.toEpochMillis(nextEnd) >= DateTime.toEpochMillis(end)
@@ -390,10 +279,6 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         const collected = pages.flatMap(({ rows }) => rows);
         const drained = pages.at(-1)?.drained === true;
 
-        // Shown once per run, not once per poll, so a sustained burst doesn't repeat
-        // this every interval. Emitted in every format (unlike the "Waiting for new
-        // logs" notice below) since it reports data loss a machine consumer can't
-        // infer from the events themselves.
         if (!drained && !(yield* Ref.get(skipNoticeShown))) {
           yield* Ref.set(skipNoticeShown, true);
           yield* output.raw(
@@ -404,13 +289,10 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
           );
         }
 
-        // Windows always overlap — the server rounds to the minute and the cursor
-        // lags behind on purpose — so dedupe is what makes the overlap invisible.
         const printed = yield* Ref.get(seenIds);
         const fresh = collected
           .filter((row) => !printed.has(row.id) && row.timestampMs >= followFloorMs)
-          // Each page is oldest-first but the pages themselves walk backwards, so
-          // the concatenation is not ordered until this runs.
+
           .sort((left, right) => left.timestampMs - right.timestampMs);
         if (fresh.length === 0) {
           return;
@@ -422,9 +304,7 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
           for (const row of fresh) {
             next.add(row.id);
           }
-          // Bounded so a tail left running for hours does not grow it without
-          // limit. Only ids inside the grace window can still be re-offered, so
-          // forgetting the oldest cannot resurrect them.
+
           if (next.size <= SEEN_ID_LIMIT) {
             return next;
           }
@@ -441,32 +321,12 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         );
       });
 
-      // A 429 or a blip should not end a tail the user is watching; the spaced
-      // schedule rides out a transient failure without spending the rate limit.
-      // Anything definitive surfaces on the first attempt.
-      // A tail can run for hours, so polls emit no request spans; the attempt count stands in.
       const poll = pollOnce.pipe(
         Effect.retry({ schedule: readRetrySchedule, while: isRetryableFollowFailure }),
         Effect.withTracerEnabled(false),
       );
 
-      // `repeat` runs the body before applying the schedule, so the first poll is
-      // immediate and the id dedupe discards anything that repeats. Against the
-      // endpoint's 10-requests-per-minute limit, a quiet tail spends about 6; a poll
-      // draining a burst can spend up to `FOLLOW_MAX_PAGES`, reaching 30 and getting
-      // rate limited, which the retry schedule treats as transient rather than fatal.
-      yield* Effect.raceFirst(
-        poll.pipe(Effect.repeat({ schedule: pollSchedule })),
-        // `setExitCode`, not `exit`: the production `exit` calls `process.exit`
-        // synchronously, tearing the runtime down before the linked-project cache is
-        // written, telemetry flushed, or the instrumentation wrapper's post-run event
-        // fires. This lets the race complete normally so those finalizers run.
-        processControl
-          .awaitSignal()
-          .pipe(
-            Effect.flatMap((signal) => processControl.setExitCode(signal === "SIGINT" ? 130 : 0)),
-          ),
-      ).pipe(
+      yield* followLogs(poll, pollSchedule).pipe(
         Effect.ensuring(
           Ref.get(pollAttempts).pipe(
             Effect.flatMap((attempts) =>
diff --git a/apps/cli/src/commands/experimental/compute/logs/logs.integration.test.ts b/apps/cli/src/commands/experimental/compute/logs/logs.integration.test.ts
index 594aae761d..1b8758d6ca 100644
--- a/apps/cli/src/commands/experimental/compute/logs/logs.integration.test.ts
+++ b/apps/cli/src/commands/experimental/compute/logs/logs.integration.test.ts
@@ -1,3 +1,5 @@
+import { parse as parseYaml } from "yaml";
+import { parse as parseToml } from "smol-toml";
 import { BunServices } from "@effect/platform-bun";
 import { assert, describe, expect, it } from "@effect/vitest";
 import {
@@ -78,7 +80,6 @@ function project() {
   });
 }
 
-/** The default flag set; every test overrides only what it is about. */
 function flags(overrides: Partial<Parameters<typeof computeLogs>[0]> = {}) {
   return {
     name: "api",
@@ -91,11 +92,6 @@ function flags(overrides: Partial<Parameters<typeof computeLogs>[0]> = {}) {
   };
 }
 
-/**
- * Follow options that drive the loop instantly and stop after N polls: the real
- * schedule is spaced in seconds, and `recurs` gives the tail an end so a test
- * doesn't need to deliver a signal to finish.
- */
 function followFor(polls: number) {
   return {
     pollSchedule: Schedule.recurs(polls),
@@ -107,10 +103,6 @@ function logsResponse(rows: ReadonlyArray<unknown>) {
   return { status: 200, body: { result: rows, error: null } };
 }
 
-/**
- * The query parameters the handler actually sent, read off the recorded
- * request rather than the URL: `HttpClientRequest` keeps `urlParams` separate.
- */
 function sentQuery(request: { readonly urlParams: Readonly<Record<string, string>> }) {
   return request.urlParams;
 }
@@ -154,6 +146,9 @@ describe("compute logs", () => {
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("ComputeFollowNotSupportedError");
       }
+      expect(out.stderrText.match(/Warning: compute logs is deprecated/g)).toHaveLength(1);
+      expect(out.stderrText).toContain("removed in v4");
+      expect(out.stdoutText).not.toContain("deprecated");
       expect(analytics.captured).toHaveLength(1);
       expect(analytics.captured[0]?.properties.flags).toEqual({
         follow: true,
@@ -163,6 +158,54 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
+  it.live.each(["json", "yaml", "toml"] as const)(
+    "keeps -o %s stdout clean while warning once",
+    (format) =>
+      Effect.gen(function* () {
+        const repo = yield* project();
+        const out = mockOutput({ format: "text" });
+        const args = ["compute", "logs", "api", "--tail", "0", "-o", format];
+        const root = Command.make("supabase").pipe(
+          Command.withSubcommands([computeCommand]),
+          Command.withGlobalFlags(GLOBAL_FLAGS),
+        );
+        yield* Command.runWith(root, { version: "test" })(args).pipe(
+          Effect.provide(
+            Layer.mergeAll(
+              buildTestRuntime({
+                out,
+                api: mockCommandPlatformApi({ response: { status: 200, body: {} } }),
+                cliSettings: mockCommandSettings({ workdir: repo.dir }),
+              }),
+              mockTelemetryRuntime({ configDir: repo.dir }),
+              processEnvLayer({
+                SUPABASE_ACCESS_TOKEN: VALID_TOKEN,
+                SUPABASE_HOME: repo.dir,
+                SUPABASE_NO_KEYRING: "1",
+                SUPABASE_PROJECT_ID: COMPUTE_PROJECT_REF,
+              }),
+              mockRuntimeInfo({ cwd: repo.dir, homeDir: repo.dir }),
+              Stdio.layerTest({ args: Effect.succeed(args) }),
+            ),
+          ),
+        );
+        const payload: unknown =
+          format === "json"
+            ? yield* Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown))(out.stdoutText)
+            : format === "yaml"
+              ? parseYaml(out.stdoutText)
+              : parseToml(out.stdoutText);
+        expect(payload).toMatchObject({
+          compute_name: "api",
+          project_ref: COMPUTE_PROJECT_REF,
+          logs: [],
+        });
+        expect(out.stderrText.match(/Warning: compute logs is deprecated/g)).toHaveLength(1);
+        expect(out.stderrText).toContain("removed in v4");
+        expect(out.stdoutText).not.toContain("deprecated");
+      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
   it.effect("prints a compute's own output oldest first", () =>
     Effect.gen(function* () {
       const repo = yield* project();
@@ -180,8 +223,6 @@ describe("compute logs", () => {
       return yield* Effect.gen(function* () {
         yield* computeLogs(flags());
 
-        // `<time>  [app]    <message>` — the tag is present because no --kind
-        // pinned a stream.
         const messages = out.stdoutText
           .trimEnd()
           .split("\n")
@@ -301,18 +342,15 @@ describe("compute logs", () => {
         const start = query.iso_timestamp_start ?? "";
         const end = query.iso_timestamp_end ?? "";
 
-        // A lone bound yields a one-minute window server-side and sending neither
-        // is an outright error, so both must always be present.
         expect(start).toBeTruthy();
         expect(end).toBeTruthy();
         expect(start.endsWith("Z")).toBe(true);
         expect(end.endsWith("Z")).toBe(true);
-        // Over 24h the server silently clamps to start+24h, returning an older
-        // slice than the one asked for.
+
         expect(
           DateTime.toEpochMillis(DateTime.makeUnsafe(end)) -
             DateTime.toEpochMillis(DateTime.makeUnsafe(start)),
-        ).toBeLessThan(24 * 60 * 60 * 1000);
+        ).toBe(23 * 60 * 60 * 1000 + 59 * 60 * 1000);
       }).pipe(Effect.provide(layer));
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
@@ -666,7 +704,7 @@ describe("compute logs", () => {
   );
 
   // The analytics route is not gated on the alpha's allow-list, so only a body
-  // no other branch claims is left to read as the family's refusal.
+
   it.effect("reports a project outside the alpha for an unclassifiable 404", () =>
     Effect.gen(function* () {
       const repo = yield* project();
@@ -780,7 +818,7 @@ describe("compute logs", () => {
         )(out.stdoutText);
         expect(payload.compute_name).toBe("api");
         expect(payload.logs[0]?.level).toBe("error");
-        // Both timestamp forms, and the raw attributes.
+
         expect(payload.logs[0]?.timestamp).toBe("2026-08-31T14:45:25.212Z");
         expect(payload.logs[0]?.timestamp_ms).toBe(T1);
         const attributes = payload.logs[0]?.attributes;
@@ -824,9 +862,6 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // The command has run by the time the ref fails to resolve, so its post-run
-  // event still has to be written. Resolution sits above the query, so the
-  // failing-query test above does not cover this path.
   it.effect("flushes telemetry when the project ref cannot be resolved", () =>
     Effect.gen(function* () {
       const repo = yield* project();
@@ -863,8 +898,6 @@ describe("compute logs", () => {
           flags({ remote: Option.some({ _tag: "Ref", ref: COMPUTE_PROJECT_REF }) }),
         ).pipe(Effect.flip);
 
-        // A copy-pasted suggestion must not silently re-resolve to whatever this
-        // checkout happens to be linked to.
         const suggestion = error instanceof ComputeNotDeployedError ? error.suggestion : "";
         expect(suggestion).toContain(`--remote=${COMPUTE_PROJECT_REF}`);
       }).pipe(Effect.provide(layer));
@@ -893,8 +926,6 @@ describe("compute logs", () => {
         expect(out.stdoutText).toContain("second");
         expect(out.stdoutText).toContain("third");
 
-        // Every request, history and polls alike, must carry both bounds: a lone
-        // start silently yields a one-minute window and neither is an error.
         for (const request of http.requests) {
           const query = sentQuery(request);
           const start = query.iso_timestamp_start ?? "";
@@ -946,13 +977,9 @@ describe("compute logs", () => {
         Effect.withTracerEnabled(true),
       );
 
-      expect(spans.map((span) => span.name)).toEqual([
-        "compute.logs",
-        "Target.resolveProject",
-        "Target.resolveRemote",
-        "v1GetProjectLogs",
-        "GET",
-      ]);
+      const requestSpans = spans.filter((span) => span.name === "v1GetProjectLogs");
+      expect(requestSpans).toHaveLength(1);
+      expect(spans.map((span) => span.name)).toContain("compute.logs");
       expect(spans[0]?.attributes.get("poll.attempt_count")).toBe(4);
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
@@ -966,7 +993,7 @@ describe("compute logs", () => {
         routes: {
           [LOGS_ROUTE]: [
             logsResponse([computeLogRow({ id: "a", tsMs: T1, message: "only once" })]),
-            // The cursor lags deliberately, so the same row comes back.
+
             logsResponse([
               computeLogRow({ id: "a", tsMs: T1, message: "only once" }),
               computeLogRow({ id: "b", tsMs: T2, message: "and this" }),
@@ -993,7 +1020,7 @@ describe("compute logs", () => {
         routes: {
           [LOGS_ROUTE]: [
             logsResponse([computeLogRow({ id: "a", tsMs: T3, message: "newest first" })]),
-            // Older than the cursor, which is why the cursor lags at all.
+
             logsResponse([computeLogRow({ id: "late", tsMs: T1, message: "arrived late" })]),
           ],
         },
@@ -1013,10 +1040,8 @@ describe("compute logs", () => {
       const { layer, out, http } = setupCompute({
         workdir: repo.dir,
         routes: {
-          // A tail-zero follow still asks whether the compute exists: with no history
-          // query, zero rows would otherwise be indistinguishable from a typo.
           [GET_COMPUTE_ROUTE]: { status: 200, body: { data: computeResource({ name: "api" }) } },
-          // After the run starts, since a tail-zero follow prints only what arrives.
+
           [LOGS_ROUTE]: logsResponse([
             computeLogRow({
               id: "new",
@@ -1031,8 +1056,7 @@ describe("compute logs", () => {
         yield* computeLogs(flags({ follow: true, tail: 0 }), followFor(1));
 
         expect(out.stdoutText).toContain("brand new");
-        // No history request; every log request belongs to the poll loop, and none
-        // may ask for `limit 0`, which the endpoint rejects.
+
         const sql = http.requests.map((request) => sentQuery(request).sql).filter(Boolean);
         expect(sql).not.toHaveLength(0);
         for (const query of sql) {
@@ -1088,21 +1112,17 @@ describe("compute logs", () => {
 
         const entries = out.events.filter((event) => event.type === "log-entry");
         expect(entries).toHaveLength(2);
-        // A tail has no terminal payload, so no single `result` is emitted.
+
         expect(out.events.filter((event) => event.type === "result")).toHaveLength(0);
-        // An error line is routed to stderr so a consumer can split diagnostics.
+
         expect(entries[0]).toMatchObject({ stream: "stderr", source: "history" });
         expect(entries[1]).toMatchObject({ stream: "stdout", source: "live" });
-        // `line` carries the composed sentence, not the raw `event_message`: the
-        // status and duration live in `log_attributes`, and `log-entry` has no
-        // field a consumer could recover them from.
+
         expect(entries[0]).toMatchObject({ line: "500 GET / 23ms" });
       }).pipe(Effect.provide(layer));
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // `-o` outranks `--output-format` when both are set, and `-o pretty` encodes
-  // nothing — so this pair asks for the text rendering, not for JSON.
   it.effect("renders text when -o pretty overrides --output-format json", () =>
     Effect.gen(function* () {
       const repo = yield* project();
@@ -1122,8 +1142,6 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // Same precedence, on the branch that refuses a tail: `-o pretty` means this
-  // run has no single-payload format to be incompatible with.
   it.effect("allows --follow when -o pretty overrides --output-format json", () =>
     Effect.gen(function* () {
       yield* TestClock.setTime(T3);
@@ -1158,16 +1176,13 @@ describe("compute logs", () => {
           );
 
           expect(error).toBeInstanceOf(ComputeFollowNotSupportedError);
-          // Refused before any query is paid for.
+
           expect(setup.http.requests).toHaveLength(0);
         }
       });
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // `--tail 0 --follow` is "skip history, print what arrives". The poll window
-  // still reaches a grace period behind the cursor so late relays are caught, so
-  // the floor has to be the line's own timestamp rather than a narrower window.
   it.effect("does not replay pre-invocation lines for --tail 0 --follow", () =>
     Effect.gen(function* () {
       const repo = yield* project();
@@ -1201,8 +1216,6 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // No history query means zero rows proves nothing, so the tail has to ask
-  // directly — otherwise a typo waits forever on logs that cannot arrive.
   it.effect("still checks the compute exists for --tail 0 --follow", () =>
     Effect.gen(function* () {
       const repo = yield* project();
@@ -1217,7 +1230,7 @@ describe("compute logs", () => {
         );
 
         expect(error).toBeInstanceOf(ComputeNotDeployedError);
-        // Text mode is not silent across that request.
+
         expect(out.progressEvents).toContainEqual(
           expect.objectContaining({ type: "start", message: "Checking compute..." }),
         );
@@ -1225,9 +1238,6 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // `ts_ms` feeds `new Date(...).toISOString()` while the payload is built, which
-  // happens for text runs too. Out of Date range that throws `RangeError`, which
-  // is a defect rather than the typed unreadable-response failure.
   it.effect("fails typed rather than throwing on an out-of-range timestamp", () =>
     Effect.gen(function* () {
       const repo = yield* project();
@@ -1246,8 +1256,6 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // A 404 answers the same way every time. Retrying it held the error back for a
-  // minute and spent the endpoint's ten-per-minute allowance getting nowhere.
   it.effect("surfaces a definitive poll failure without retrying it", () =>
     Effect.gen(function* () {
       yield* TestClock.setTime(T3);
@@ -1262,17 +1270,15 @@ describe("compute logs", () => {
       return yield* Effect.gen(function* () {
         yield* computeLogs(flags({ follow: true }), {
           pollSchedule: Schedule.recurs(0),
-          // Would retry three times over if the failure were treated as transient.
+
           retrySchedule: Schedule.recurs(3),
         }).pipe(Effect.flip);
 
-        // History, then the one poll that failed — no second attempt at it.
         expect(http.requests).toHaveLength(2);
       }).pipe(Effect.provide(layer));
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // A rate limit is the server asking for exactly that, so it still rides out.
   it.effect("retries a rate-limited poll", () =>
     Effect.gen(function* () {
       yield* TestClock.setTime(T3);
@@ -1299,8 +1305,6 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // `--tail` bounds the history a run opens with; reusing it as the poll size
-  // meant `--tail 1 --follow` asked each poll for a single row.
   it.effect("polls with a page size independent of --tail", () =>
     Effect.gen(function* () {
       yield* TestClock.setTime(T3);
@@ -1327,8 +1331,6 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // The query orders newest-first, so a full page means there is more below it.
-  // Advancing the cursor on that page alone dropped the remainder for good.
   it.effect("drains a burst larger than one page before advancing the cursor", () =>
     Effect.gen(function* () {
       yield* TestClock.setTime(AFTER_BURSTS);
@@ -1340,8 +1342,6 @@ describe("compute logs", () => {
         workdir: repo.dir,
         routes: {
           [LOGS_ROUTE]: [
-            // Non-empty, so the run does not spend its second request on the
-            // deployed-compute check that an empty history triggers.
             logsResponse([computeLogRow({ id: "seed", tsMs: T1 - 100_000, message: "seed" })]),
             logsResponse(fullPage),
             logsResponse([computeLogRow({ id: "straggler", tsMs: T1, message: "older line" })]),
@@ -1352,30 +1352,24 @@ describe("compute logs", () => {
       return yield* Effect.gen(function* () {
         yield* computeLogs(flags({ follow: true }), followFor(0));
 
-        // The second page is only requested because the first came back full.
         expect(http.requests).toHaveLength(3);
         expect(out.stdoutText).toContain("older line");
         expect(out.stdoutText).toContain("burst 999");
-        // Oldest first across pages, not merely within each one.
+
         expect(out.stdoutText.indexOf("older line")).toBeLessThan(
           out.stdoutText.indexOf("burst 0"),
         );
-        // The short third page proved the window was empty below it, so nothing
-        // was skipped and the run stays quiet.
+
         expect(out.stderrText).not.toContain("Skipped part of a burst");
       }).pipe(Effect.provide(layer));
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  // The drain walks backwards from the newest rows, so running out of pages
-  // leaves the *oldest* part of the burst unfetched while the cursor advances
-  // past it. Those lines are gone, and a silent hole is worse than a noisy one.
   it.effect("says so on stderr when a burst outruns the page budget", () =>
     Effect.gen(function* () {
       yield* TestClock.setTime(AFTER_BURSTS);
       const repo = yield* project();
-      // Five full pages, each older than the last so every page narrows the window
-      // and the loop runs to its bound rather than stopping early.
+
       const pages = Array.from({ length: 5 }, (_unused, page) =>
         logsResponse(
           Array.from({ length: 1000 }, (_row, index) =>
@@ -1400,12 +1394,11 @@ describe("compute logs", () => {
       return yield* Effect.gen(function* () {
         yield* computeLogs(flags({ follow: true }), followFor(0));
 
-        // The budget, and not one request more: the sixth page is never asked for.
         expect(http.requests).toHaveLength(6);
         expect(out.stderrText).toContain("Skipped part of a burst larger than 5000 lines");
-        // Actionable rather than a bare apology.
+
         expect(out.stderrText).toContain("--kind");
-        // The lines it did reach are still printed.
+
         expect(out.stdoutText).toContain("page 0 line 999");
       }).pipe(Effect.provide(layer));
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
@@ -1440,8 +1433,6 @@ describe("compute logs", () => {
       return yield* Effect.gen(function* () {
         yield* computeLogs(flags({ follow: true }), followFor(1));
 
-        // A sustained burst would otherwise repeat the notice every interval and
-        // bury the very lines it is warning about.
         const notices = out.stderrText.split("Skipped part of a burst").length - 1;
         expect(notices).toBe(1);
       }).pipe(Effect.provide(layer));
@@ -1465,8 +1456,7 @@ describe("compute logs", () => {
         });
 
         expect(processControl.exitCode).toBe(130);
-        // The point of recording rather than exiting: `process.exit` from inside
-        // the race branch would have killed the runtime before this ran.
+
         expect(telemetry.flushed).toBe(true);
         expect(processControl.exitCalls).toEqual([]);
       }).pipe(Effect.provide(layer));
diff --git a/apps/cli/src/commands/experimental/compute/new/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/compute/new/SIDE_EFFECTS.md
index ef89a6e823..2010ab82f5 100644
--- a/apps/cli/src/commands/experimental/compute/new/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/compute/new/SIDE_EFFECTS.md
@@ -14,18 +14,20 @@ and the command handler does not run. See the [Compute command guide](../../../.
 
 ## Files Read
 
-| Path                                     | Format     | When                                                                                                                                                          |
-| ---------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `<workdir>/supabase/config.toml`         | TOML       | when present and no authoritative JSON config was found — decoded to check existing entries, then read as text for the edit                                   |
-| `<workdir>/supabase/config.json`         | JSON       | writer checks existence/selection only; the feature gate reads contents when the environment override is unset or empty. Includes defaulted-workdir ancestors |
-| `<destination>/`                         | dir        | always, to refuse a destination that is not empty                                                                                                             |
-| `<SUPABASE_HOME or ~/.supabase>/profile` | plain text | when neither `--profile` nor `SUPABASE_PROFILE` is set — names the profile, defaulting to `supabase`                                                          |
-| `<SUPABASE_PROFILE>` (YAML)              | YAML       | when `SUPABASE_PROFILE` is a filesystem path rather than a built-in name; a read failure aborts the command                                                   |
+| Path                                     | Format     | When                                                                                                                                                                                |
+| ---------------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`         | TOML       | when it is the selected config — decoded to check existing entries, then read as text for the edit                                                                                  |
+| `<workdir>/supabase/config.json`         | JSON       | when it is the selected config — decoded to check existing entries, then read as text for the edit; the feature gate reads contents when the environment override is unset or empty |
+| `<workdir>/supabase/config.jsonc`        | JSONC      | when it is the selected config — as `config.json`                                                                                                                                   |
+| `<destination>/`                         | dir        | always, to refuse a destination that is not empty                                                                                                                                   |
+| `<SUPABASE_HOME or ~/.supabase>/profile` | plain text | when neither `--profile` nor `SUPABASE_PROFILE` is set — names the profile, defaulting to `supabase`                                                                                |
+| `<SUPABASE_PROFILE>` (YAML)              | YAML       | when `SUPABASE_PROFILE` is a filesystem path rather than a built-in name; a read failure aborts the command                                                                         |
 
 ## Files Written
 
 | Path                                            | Format | When                                                                                                                                                                                                                                                                                           |
 | ----------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.{json,jsonc}`        | JSON   | on success, when it is the selected config — adds `compute.<name>` with the same keys, keeping comments                                                                                                                                                                                        |
 | `<workdir>/supabase/config.toml`                | TOML   | on success — appends `[compute.<name>]` with `runtime`, `size` and `exposure` always, `exclude` whenever the chosen runtime declares default patterns, `instances` only when it differs from the default of 1, and `source` only when `--source` was passed, preserving surrounding formatting |
 | `<workdir>/supabase/compute/<name>/*`           | varies | on success, unless `--source` names another directory                                                                                                                                                                                                                                          |
 | `<workdir>/<source>/*`                          | varies | on success, when `--source` is given                                                                                                                                                                                                                                                           |
@@ -48,20 +50,18 @@ omitted entirely for a runtime that declares no patterns. The chosen list is rep
 `Excluded` row beside the compute's other dials, and carried on the machine-output payload as
 `exclude`.
 
-Compute resources are recorded in `config.toml` only. The project config loader prefers
-`supabase/config.json` when one exists, but the entry writer is a TOML text
-editor. Before prompting or writing, this command refuses a project whose
-authoritative configuration is `config.json`, including a JSON-only ancestor
-found from a defaulted workdir. It cannot append deployment settings to a TOML
-file that readers would ignore. JSON projects can configure Compute entries and
-source files manually. A rendered TOML edit that would not parse is refused
-before anything reaches disk.
-
-The TOML writer is pinned to `<workdir>` with `search: false`. Before loading
-that file, a defaulted workdir also probes ancestor project paths to refuse
-JSON-authoritative projects. An explicit `--workdir` or `SUPABASE_WORKDIR`
-never searches ancestors: pointing it at a bare directory records the Compute
-entry in that directory's own `config.toml`, created if absent.
+Compute resources are recorded in the project config file the loader selects:
+`supabase/config.json`, `supabase/config.jsonc`, or `supabase/config.toml`. A TOML
+file gets the `[compute.<name>]` table appended; a JSON or JSONC file is
+span-edited through `applyConfigEdits`, which keeps comments and trailing commas
+and verifies its own result. A rendered edit that would not parse, or that the
+editor refuses, is refused before anything reaches disk. When no config file
+exists, `config.toml` is created.
+
+The config is loaded from `<workdir>`; an explicit `--workdir` or
+`SUPABASE_WORKDIR` never searches ancestors, so pointing it at a bare directory
+records the Compute entry in that directory's own `config.toml`, created if
+absent.
 
 The name is prompted for when the command line does not carry one, and the
 prompt refuses a name that is not a DNS label or that `config.toml` already
@@ -112,13 +112,12 @@ root.
 | ---- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
 | `0`  | success                                                                                                                                         |
 | `1`  | resolved `--workdir`/`SUPABASE_WORKDIR` doesn't exist or isn't a directory (`ComputeNewWorkdirError`) — beats every prompt and filesystem write |
-| `1`  | authoritative project config is JSON (`ComputeJsonConfigUnsupportedError`)                                                                      |
 | `1`  | invalid compute name — the name must be a DNS label                                                                                             |
 | `1`  | no name given, and nowhere to ask for one — stdin or stdout is not a terminal, or `-o` is in force                                              |
 | `1`  | bad `--source`: outside the project, or a path the CLI owns                                                                                     |
 | `1`  | destination exists and is not empty                                                                                                             |
-| `1`  | the compute is already recorded in `config.toml`, in any form                                                                                   |
-| `1`  | the rendered `config.toml` would not parse, or `[compute]` is a sealed inline table                                                             |
+| `1`  | the compute is already recorded in the project config, in any form                                                                              |
+| `1`  | the rendered config would not parse, the JSON edit is refused, or `[compute]` is a sealed inline table                                          |
 
 ## Environment Variables
 
diff --git a/apps/cli/src/commands/experimental/compute/new/new.command.ts b/apps/cli/src/commands/experimental/compute/new/new.command.ts
index 3a9e4ba7c5..c55f468cc3 100644
--- a/apps/cli/src/commands/experimental/compute/new/new.command.ts
+++ b/apps/cli/src/commands/experimental/compute/new/new.command.ts
@@ -27,19 +27,19 @@ const config = {
   ),
   runtime: Flag.Literals("runtime", COMPUTE_RUNTIMES).pipe(
     Flag.withDescription(
-      "Runtime to scaffold and record in supabase/config.toml. Prompted when omitted.",
+      "Runtime to scaffold and record in the project config file. Prompted when omitted.",
     ),
     Flag.optional,
   ),
   size: Flag.Literals("size", COMPUTE_SIZES).pipe(
     Flag.withDescription(
-      "Instance size to record in supabase/config.toml. Each size implies its own vCPU count, so there is no separate --cpu. Prompted when omitted.",
+      "Instance size to record in the project config file. Each size implies its own vCPU count, so there is no separate --cpu. Prompted when omitted.",
     ),
     Flag.optional,
   ),
   exposure: Flag.Literals("exposure", COMPUTE_EXPOSURES).pipe(
     Flag.withDescription(
-      "Whether the compute is reachable from the internet, recorded as `exposure` in supabase/config.toml. Prompted when omitted.",
+      "Whether the compute is reachable from the internet, recorded as `exposure` in the project config file. Prompted when omitted.",
     ),
     Flag.optional,
   ),
@@ -51,13 +51,13 @@ const config = {
       (instances) => `--instances ${instances} is negative; pass zero or more.`,
     ),
     Flag.withDescription(
-      "Number of instances to record in supabase/config.toml. Not prompted for, and recorded only when it differs from the default of 1.",
+      "Number of instances to record in the project config file. Not prompted for, and recorded only when it differs from the default of 1.",
     ),
     Flag.optional,
   ),
   source: Flag.String("source").pipe(
     Flag.withDescription(
-      "Scaffold the compute here instead of the default compute directory, recorded as `source` in supabase/config.toml.",
+      "Scaffold the compute here instead of the default compute directory, recorded as `source` in the project config file.",
     ),
     Flag.optional,
   ),
@@ -76,7 +76,7 @@ const computeNewRuntimeLayer = Layer.mergeAll(
 
 export const computeNewCommand = Command.make("new", config).pipe(
   Command.withDescription(
-    "Scaffold a compute directory from a runtime's starter files and record the choices in supabase/config.toml. Nothing is deployed.",
+    "Scaffold a compute directory from a runtime's starter files and record the choices in the project config file. Nothing is deployed.",
   ),
   Command.withShortDescription("Scaffold a compute locally"),
   Command.withExamples([
diff --git a/apps/cli/src/commands/experimental/compute/new/new.handler.ts b/apps/cli/src/commands/experimental/compute/new/new.handler.ts
index 8ca807ee72..31daedad16 100644
--- a/apps/cli/src/commands/experimental/compute/new/new.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/new/new.handler.ts
@@ -1,3 +1,4 @@
+import { cliConfigFormatForPath } from "@supabase/config/internal";
 import { Effect, FileSystem, Option, Path } from "effect";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { emitSuccessTrailer } from "../../../../shared/cli/success-trailer.ts";
@@ -45,11 +46,7 @@ import {
   MissingComputeNameError,
   ComputeDirectoryExistsError,
 } from "../../../../shared/compute/compute.errors.ts";
-import {
-  loadComputeProjectForEntryWrite,
-  validateComputeName,
-  type ComputeProject,
-} from "../compute.shared.ts";
+import { loadComputeProject, validateComputeName, type ComputeProject } from "../compute.shared.ts";
 import type { ComputeNewFlags } from "./new.command.ts";
 import { ComputeNewWorkdirError } from "./new.errors.ts";
 
@@ -248,7 +245,7 @@ export const computeNew = Effect.fn("compute.new")(function* (flags: ComputeNewF
       Effect.mapError((error) => new ComputeNewWorkdirError({ message: error.message })),
     );
 
-    const project = yield* loadComputeProjectForEntryWrite();
+    const project = yield* loadComputeProject;
 
     // Decided once, before the first prompt rather than beside the last, since
     // the name is now asked for too — every prompt below shares the answer.
@@ -259,14 +256,18 @@ export const computeNew = Effect.fn("compute.new")(function* (flags: ComputeNewF
     yield* validateComputeName(name);
 
     // Refused before anything is asked or written. `new` creates a compute;
-    // changing one that already exists is a `config.toml` edit, and the file is
+    // changing one that already exists is a config-file edit, and the file is
     // the user's. Checking here rather than only in `planComputeEntry` means the
     // runtime and size prompts never run for a name that was going to be
     // refused anyway; the name prompt rejects it up front for the same reason.
     if (project.section.compute[name] !== undefined) {
+      const entryRef =
+        cliConfigFormatForPath(project.configPath) === "toml"
+          ? `[compute.${name}]`
+          : `compute.${name}`;
       return yield* new ComputeAlreadyConfiguredError({
         detail: `"${name}" is already configured in ${project.configPath}.`,
-        suggestion: `Edit [compute.${name}] in ${project.configPath} yourself, or pick a different compute name.`,
+        suggestion: `Edit ${entryRef} in ${project.configPath} yourself, or pick a different compute name.`,
       });
     }
 
diff --git a/apps/cli/src/commands/experimental/compute/new/new.integration.test.ts b/apps/cli/src/commands/experimental/compute/new/new.integration.test.ts
index ee8ae0130c..e7a89aba1f 100644
--- a/apps/cli/src/commands/experimental/compute/new/new.integration.test.ts
+++ b/apps/cli/src/commands/experimental/compute/new/new.integration.test.ts
@@ -1,6 +1,7 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Option, FileSystem, Path, PlatformError, Predicate, Schema } from "effect";
+import { parseJsonc } from "@supabase/config/internal";
 import * as SmolToml from "smol-toml";
 import { makeComputeProject, setupCompute } from "../../../../../tests/helpers/compute.ts";
 import {
@@ -12,7 +13,6 @@ import {
   InvalidComputeSourceError,
   MissingComputeNameError,
   ComputeDirectoryExistsError,
-  ComputeJsonConfigUnsupportedError,
 } from "../../../../shared/compute/compute.errors.ts";
 import {
   COMPUTE_RUNTIME_EXCLUSIONS,
@@ -483,7 +483,7 @@ describe("compute new", () => {
       }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  it.effect("refuses a JSON-only ancestor even when the name is already configured", () =>
+  it.effect("reads a JSON-only ancestor config and refuses a name it already records", () =>
     Effect.gen(function* () {
       const path = yield* Path.Path;
       const fs = yield* FileSystem.FileSystem;
@@ -506,7 +506,7 @@ describe("compute new", () => {
           flags({ name: Option.some("api"), runtime: Option.some("deno") }),
         ).pipe(Effect.flip);
 
-        expect(Predicate.isTagged(error, "ComputeJsonConfigUnsupportedError")).toBe(true);
+        expect(error).toBeInstanceOf(ComputeAlreadyConfiguredError);
         // Nothing was scaffolded at the subdirectory either.
         expect(yield* fs.exists(path.join(sub, "supabase"))).toBe(false);
       }).pipe(Effect.provide(layer));
@@ -915,58 +915,39 @@ describe("compute new", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
-  it.effect.each([false, true])(
-    "refuses JSON before prompts or writes (TOML present: %s)",
-    (withToml) =>
-      Effect.gen(function* () {
-        const path = yield* Path.Path;
-        const fs = yield* FileSystem.FileSystem;
-        const configJson = '{"project_id":"demo"}\n';
-        const repo = yield* makeComputeProject({
-          "supabase/config.json": configJson,
-          ...(withToml ? { "supabase/config.toml": CONFIG_WITH_COMMENTS } : {}),
-        });
-        const { layer, out } = setupCompute({ workdir: repo.dir });
-        return yield* Effect.gen(function* () {
-          const error = yield* computeNew(flags({ name: Option.none() })).pipe(Effect.flip);
-          expect(error).toBeInstanceOf(ComputeJsonConfigUnsupportedError);
-          expect(out.promptTextCalls).toEqual([]);
-          expect(out.promptSelectCalls).toEqual([]);
-          expect(yield* fs.readFileString(path.join(repo.dir, "supabase", "config.json"))).toBe(
-            configJson,
-          );
-          const tomlPath = path.join(repo.dir, "supabase", "config.toml");
-          if (withToml) expect(yield* fs.readFileString(tomlPath)).toBe(CONFIG_WITH_COMMENTS);
-          else expect(yield* fs.exists(tomlPath)).toBe(false);
-          expect(yield* fs.exists(path.join(repo.dir, "supabase", "compute"))).toBe(false);
-        }).pipe(Effect.provide(layer));
-      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
-  );
-
-  it.effect("refuses an unconfigured JSON-only ancestor before asking for a name", () =>
+  it.effect.each([
+    { file: "config.json", source: '{"project_id":"demo"}\n' },
+    { file: "config.jsonc", source: '// keep me\n{"project_id":"demo",}\n' },
+  ])("records the entry in $file and keeps its comments", ({ file, source }) =>
     Effect.gen(function* () {
       const path = yield* Path.Path;
       const fs = yield* FileSystem.FileSystem;
-      const configJson = '{"project_id":"demo"}\n';
-      const repo = yield* makeComputeProject({ "supabase/config.json": configJson });
-      const child = path.join(repo.dir, "nested");
-      yield* fs.makeDirectory(child);
-      const resolved = yield* resolveWorkdir(Option.none(), Option.none(), child, path);
-      const { layer, out } = setupCompute({
-        workdir: resolved.workdir,
-        explicitWorkdir: resolved.explicit,
-      });
+      const repo = yield* makeComputeProject({ [`supabase/${file}`]: source });
+      const { layer } = setupCompute({ workdir: repo.dir });
       return yield* Effect.gen(function* () {
-        const error = yield* computeNew(flags({ name: Option.none() })).pipe(Effect.flip);
-        expect(error).toBeInstanceOf(ComputeJsonConfigUnsupportedError);
-        expect(out.promptTextCalls).toEqual([]);
-        expect(out.promptSelectCalls).toEqual([]);
-        expect(yield* fs.readFileString(path.join(repo.dir, "supabase", "config.json"))).toBe(
-          configJson,
-        );
-        expect(yield* fs.readDirectory(child)).toEqual([]);
+        yield* computeNew(flags({ name: Option.some("api"), runtime: Option.some("node") }));
+        const written = yield* fs.readFileString(path.join(repo.dir, "supabase", file));
+        const parsed = parseJsonc(written) as { compute: Record<string, { runtime: string }> };
+        expect(parsed.compute["api"]?.runtime).toBe("node");
+        if (file === "config.jsonc") expect(written).toContain("// keep me");
         expect(yield* fs.exists(path.join(repo.dir, "supabase", "config.toml"))).toBe(false);
-        expect(yield* fs.exists(path.join(repo.dir, "supabase", "compute"))).toBe(false);
+        expect(yield* fs.exists(path.join(repo.dir, "supabase", "compute", "api"))).toBe(true);
+      }).pipe(Effect.provide(layer));
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("names the entry in JSON terms when the compute is already in config.json", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject({
+        "supabase/config.json": '{"project_id":"demo","compute":{"api":{"runtime":"node"}}}\n',
+      });
+      const { layer } = setupCompute({ workdir: repo.dir });
+      return yield* Effect.gen(function* () {
+        const error = yield* computeNew(
+          flags({ name: Option.some("api"), runtime: Option.some("node") }),
+        ).pipe(Effect.flip);
+        expect(error).toBeInstanceOf(ComputeAlreadyConfiguredError);
+        expect(error).toMatchObject({ suggestion: expect.stringContaining("Edit compute.api in") });
       }).pipe(Effect.provide(layer));
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
diff --git a/apps/cli/src/commands/experimental/compute/push/push.command.ts b/apps/cli/src/commands/experimental/compute/push/push.command.ts
index 17031c2b3c..ab1096b9e0 100644
--- a/apps/cli/src/commands/experimental/compute/push/push.command.ts
+++ b/apps/cli/src/commands/experimental/compute/push/push.command.ts
@@ -33,7 +33,7 @@ const config = {
       (instances) => `--instances ${instances} is negative; pass zero or more.`,
     ),
     Flag.withDescription(
-      "Number of instances to run, overriding `instances` in supabase/config.toml for this deploy. Falls back to the recorded value, then 1.",
+      "Number of instances to run, overriding `instances` in the project config file for this deploy. Falls back to the recorded value, then 1.",
     ),
     Flag.optional,
   ),
@@ -44,7 +44,7 @@ const config = {
     // `[compute.<name>] exposure` stays a plain string, so a value the API
     // grows before this CLI does can still be recorded there.
     Flag.withDescription(
-      "Whether the compute is reachable from the internet, overriding `exposure` in supabase/config.toml for this deploy. Falls back to the recorded value, then public.",
+      "Whether the compute is reachable from the internet, overriding `exposure` in the project config file for this deploy. Falls back to the recorded value, then public.",
     ),
     Flag.optional,
   ),
@@ -66,7 +66,7 @@ export type ComputePushFlags = CliCommand.Command.Config.Infer<typeof config>;
 export const computePushCommand = Command.make("push", config).pipe(
   Command.withAlias("deploy"),
   Command.withDescription(
-    "Build and deploy compute into the linked Supabase project. Reads each compute's runtime, size, exposure and source directory from supabase/config.toml.",
+    "Build and deploy compute into the linked Supabase project. Reads each compute's runtime, size, exposure and source directory from the project config file.",
   ),
   Command.withShortDescription("Build and deploy compute"),
   Command.withExamples([
diff --git a/apps/cli/src/commands/experimental/compute/push/push.handler.ts b/apps/cli/src/commands/experimental/compute/push/push.handler.ts
index 833f581ac7..a9caeb6351 100644
--- a/apps/cli/src/commands/experimental/compute/push/push.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/push/push.handler.ts
@@ -1,3 +1,4 @@
+import { cliConfigFormatForPath } from "@supabase/config/internal";
 import { Effect, FileSystem, Option, Path, type Schedule } from "effect";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { emitSuccessTrailer } from "../../../../shared/cli/success-trailer.ts";
@@ -9,6 +10,7 @@ import {
   computeRemoteSuffix,
 } from "../compute.output.ts";
 import { aqua } from "../../../../command-internal/colors.ts";
+import { type ConfigFileRef, configSetting } from "../../../../command-internal/config-advice.ts";
 import { CommandPlatformApi } from "../../../../auth/command-platform-api.service.ts";
 import { CommandSettings } from "../../../../config/command-settings.service.ts";
 import { classifyComputeDir } from "../../../../shared/compute/compute-classify.ts";
@@ -71,7 +73,14 @@ import type { ComputePushFlags } from "./push.command.ts";
  * by default; `--no-wait` returns once the deploy is accepted.
  */
 
+const entryRef = ({ format }: ConfigFileRef, name: string): string =>
+  format === "toml" ? `[compute.${name}]` : `compute.${name}`;
+
+const settingRef = ({ format }: ConfigFileRef, name: string, key: string): string =>
+  format === "toml" ? `[compute.${name}] ${key}` : `compute.${name}.${key}`;
+
 const resolveRuntime = Effect.fnUntraced(function* (options: {
+  readonly config: ConfigFileRef;
   readonly name: string;
   readonly recorded: string | undefined;
   readonly sourceDir: string;
@@ -80,8 +89,8 @@ const resolveRuntime = Effect.fnUntraced(function* (options: {
     const recorded = parseComputeRuntime(options.recorded);
     if (recorded === undefined) {
       return yield* new UnknownComputeRuntimeError({
-        detail: `supabase/config.toml records an unknown runtime "${options.recorded}" for "${options.name}".`,
-        suggestion: `Set [compute.${options.name}] runtime to one of: ${COMPUTE_RUNTIMES.join(", ")}.`,
+        detail: `${options.config.path} records an unknown runtime "${options.recorded}" for "${options.name}".`,
+        suggestion: `Set ${settingRef(options.config, options.name, "runtime")} to one of: ${COMPUTE_RUNTIMES.join(", ")}.`,
       });
     }
     return recorded;
@@ -93,13 +102,14 @@ const resolveRuntime = Effect.fnUntraced(function* (options: {
   // payload stdout is carrying.
   yield* output.raw(
     `No runtime configured for ${options.name}: guessed ${classified.runtime} (${classified.reason}). ` +
-      `Set [compute.${options.name}] runtime = "${classified.runtime}" in supabase/config.toml.\n`,
+      `Set ${configSetting(options.config.format, `compute.${options.name}`, "runtime", `"${classified.runtime}"`)} in ${options.config.path}.\n`,
     "stderr",
   );
   return classified.runtime;
 });
 
 const resolveSize = Effect.fnUntraced(function* (options: {
+  readonly config: ConfigFileRef;
   readonly name: string;
   readonly recorded: string | undefined;
 }) {
@@ -109,8 +119,8 @@ const resolveSize = Effect.fnUntraced(function* (options: {
   const recorded = parseComputeSize(options.recorded);
   if (recorded === undefined) {
     return yield* new UnknownComputeSizeError({
-      detail: `supabase/config.toml records an unknown size "${options.recorded}" for "${options.name}".`,
-      suggestion: `Set [compute.${options.name}] size to one of: ${COMPUTE_SIZES.join(", ")}.`,
+      detail: `${options.config.path} records an unknown size "${options.recorded}" for "${options.name}".`,
+      suggestion: `Set ${settingRef(options.config, options.name, "size")} to one of: ${COMPUTE_SIZES.join(", ")}.`,
     });
   }
   return recorded;
@@ -137,6 +147,7 @@ function resolveInstances(options: {
  * otherwise revert it.
  */
 const resolveExposure = Effect.fnUntraced(function* (options: {
+  readonly config: ConfigFileRef;
   readonly name: string;
   readonly recorded: string | undefined;
   readonly configured: boolean;
@@ -155,12 +166,12 @@ const resolveExposure = Effect.fnUntraced(function* (options: {
       // unguarded by format, like the runtime nudge: a CI run is exactly where
       // a one-deploy exposure quietly reverting matters most.
       const message = options.configured
-        ? `--exposure ${chosen} applies to this deploy only: supabase/config.toml ${
+        ? `--exposure ${chosen} applies to this deploy only: ${options.config.path} ${
             options.recorded === undefined
               ? `records no exposure for ${options.name}`
               : `records exposure = "${options.recorded}"`
-          }, so the next bare push will not use ${chosen}. Set [compute.${options.name}] exposure = "${chosen}" in supabase/config.toml.\n`
-        : `--exposure ${chosen} is required for an unconfigured source directory. Record it under [compute.${options.name}] exposure for future pushes.\n`;
+          }, so the next bare push will not use ${chosen}. Set ${configSetting(options.config.format, `compute.${options.name}`, "exposure", `"${chosen}"`)} in ${options.config.path}.\n`
+        : `--exposure ${chosen} is required for an unconfigured source directory. Record it under ${settingRef(options.config, options.name, "exposure")} for future pushes.\n`;
       yield* output.raw(message, "stderr");
     }
     return chosen;
@@ -176,9 +187,9 @@ const resolveExposure = Effect.fnUntraced(function* (options: {
       // there and says nothing.
       detail:
         options.recorded.trim() === ""
-          ? `supabase/config.toml records a blank exposure for "${options.name}".`
-          : `supabase/config.toml records an unknown exposure "${options.recorded}" for "${options.name}".`,
-      suggestion: `Set [compute.${options.name}] exposure to one of: ${COMPUTE_EXPOSURES.join(", ")}.`,
+          ? `${options.config.path} records a blank exposure for "${options.name}".`
+          : `${options.config.path} records an unknown exposure "${options.recorded}" for "${options.name}".`,
+      suggestion: `Set ${settingRef(options.config, options.name, "exposure")} to one of: ${COMPUTE_EXPOSURES.join(", ")}.`,
     });
   }
   return recorded;
@@ -194,14 +205,14 @@ const resolveExposure = Effect.fnUntraced(function* (options: {
 function missingSourceSuggestion(input: {
   readonly name: string;
   readonly sourceDisplay: string;
-  readonly configPath: string;
+  readonly config: ConfigFileRef;
   readonly entry: ComputeEntry | undefined;
 }): string {
   if (input.entry === undefined) {
     return `Scaffold it with \`supabase compute new ${input.name}\`.`;
   }
   if (input.entry.source !== undefined) {
-    return `Create ${input.sourceDisplay}, or correct \`source\` under [compute.${input.name}] in ${input.configPath}.`;
+    return `Create ${input.sourceDisplay}, or correct \`source\` under ${entryRef(input.config, input.name)} in ${input.config.path}.`;
   }
   return `Create ${input.sourceDisplay} and add your compute's code, then run this command again.`;
 }
@@ -246,6 +257,10 @@ const deployOneCompute = Effect.fn("compute.push.deployOne")(function* (input: {
   const compute = yield* describeCompute(project, name);
 
   const sourceDisplay = displayPath(path, project.projectRoot, compute.sourceDir);
+  const config: ConfigFileRef = {
+    format: cliConfigFormatForPath(project.configPath),
+    path: displayPath(path, project.projectRoot, project.configPath),
+  };
 
   // Checked before the runtime is resolved: without this, an unrecorded runtime
   // would be classified and announced for a path that doesn't exist.
@@ -255,7 +270,7 @@ const deployOneCompute = Effect.fn("compute.push.deployOne")(function* (input: {
       suggestion: missingSourceSuggestion({
         name,
         sourceDisplay,
-        configPath: displayPath(path, project.projectRoot, project.configPath),
+        config,
         entry: compute.entry,
       }),
     });
@@ -289,6 +304,7 @@ const deployOneCompute = Effect.fn("compute.push.deployOne")(function* (input: {
   }
 
   const runtime = yield* resolveRuntime({
+    config,
     name,
     recorded: compute.entry?.runtime,
     sourceDir: compute.sourceDir,
@@ -298,7 +314,7 @@ const deployOneCompute = Effect.fn("compute.push.deployOne")(function* (input: {
   // default. Never left unset, because a compute that is actually running always
   // has some concrete size — and never silently coerced, because a size the CLI
   // does not recognize is a config mistake worth naming.
-  const size = yield* resolveSize({ name, recorded: compute.entry?.size });
+  const size = yield* resolveSize({ config, name, recorded: compute.entry?.size });
 
   const instances = resolveInstances({
     recorded: compute.entry?.instances,
@@ -308,6 +324,7 @@ const deployOneCompute = Effect.fn("compute.push.deployOne")(function* (input: {
   // Resolved before anything is packaged or uploaded, so an unrecognized
   // exposure is refused while the refusal is still free.
   const exposure = yield* resolveExposure({
+    config,
     name,
     recorded: compute.entry?.exposure,
     configured: compute.entry !== undefined,
@@ -359,10 +376,10 @@ const deployOneCompute = Effect.fn("compute.push.deployOne")(function* (input: {
       const excludedSomething = packaged.excludedCount > 0;
       return yield* new ComputeSourceMissingError({
         detail: excludedSomething
-          ? `Every file in ${sourceDisplay} is matched by [compute.${name}] exclude, so there is nothing to deploy.`
+          ? `Every file in ${sourceDisplay} is matched by ${settingRef(config, name, "exclude")}, so there is nothing to deploy.`
           : `${sourceDisplay} holds no files to deploy, only empty directories.`,
         suggestion: excludedSomething
-          ? `Narrow [compute.${name}] exclude in supabase/config.toml so the files the build needs are packaged.`
+          ? `Narrow ${settingRef(config, name, "exclude")} in ${config.path} so the files the build needs are packaged.`
           : addYourCode(sourceDisplay),
       });
     }
diff --git a/apps/cli/src/commands/experimental/stack/destroy/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/destroy/SIDE_EFFECTS.md
index 16b76c3d49..7915d66d55 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/destroy/SIDE_EFFECTS.md
@@ -75,7 +75,8 @@ routing/settings can read project configuration and profiles.
 
 Destruction releases this stack's rows in the per-user port registry at
 `<passwd home>/.supabase/ports.sqlite` (independent of `SUPABASE_HOME`, with no
-override) only once cleanup is confirmed complete; a destroy that fails
+override; WAL mode, with `ports.sqlite-wal` and `ports.sqlite-shm` alongside
+while open) only once cleanup is confirmed complete; a destroy that fails
 keeps the stack's automatic reservations, and those ports remain unavailable
 to other stacks until a later destroy succeeds; configured ports are released
 with their listeners. A reservation whose owning
diff --git a/apps/cli/src/commands/experimental/stack/destroy/destroy.errors.ts b/apps/cli/src/commands/experimental/stack/destroy/destroy.errors.ts
index ac5fe598e8..dccf3fe402 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/destroy.errors.ts
+++ b/apps/cli/src/commands/experimental/stack/destroy/destroy.errors.ts
@@ -6,7 +6,10 @@ import {
   ErrorActionabilityId,
   unclassifiedStackFailureActionability,
 } from "../../../../shared/telemetry/error-actionability.ts";
-import { type StackTargetIssue, stackTargetInvalidConfigActionability } from "../stack.shared.ts";
+import {
+  type StackTargetIssue,
+  stackTargetInvalidConfigActionability,
+} from "../../../../command-internal/stack-target.ts";
 
 export class StackCommandDestroyError extends Data.TaggedError("ExperimentalStackDestroyError")<{
   readonly reason:
diff --git a/apps/cli/src/commands/experimental/stack/destroy/destroy.handler.ts b/apps/cli/src/commands/experimental/stack/destroy/destroy.handler.ts
index fe070e4446..adf381f79d 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/destroy.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/destroy/destroy.handler.ts
@@ -15,7 +15,7 @@ import {
   StackTargetResolver,
   mapTargetError,
   validateStackTarget,
-} from "../stack.shared.ts";
+} from "../../../../command-internal/stack-target.ts";
 import type { StackDestroyFlags } from "./destroy.command.ts";
 import { StackCommandDestroyError } from "./destroy.errors.ts";
 
diff --git a/apps/cli/src/commands/experimental/stack/destroy/destroy.integration.test.ts b/apps/cli/src/commands/experimental/stack/destroy/destroy.integration.test.ts
index a1ef37b003..3eee866d5c 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/destroy.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/destroy/destroy.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { StackError } from "@supabase/stack/effect";
 import {
@@ -30,13 +30,17 @@ import {
   mockStdin,
   mockTty,
 } from "../../../../../tests/helpers/mocks.ts";
-import { StackApi, stackApiLayer, stackTargetResolverLayer } from "../stack.shared.ts";
+import {
+  StackApi,
+  stackApiLayer,
+  stackTargetResolverLayer,
+} from "../../../../command-internal/stack-target.ts";
 import { stackDestroyCommand } from "./destroy.command.ts";
 import { stackDestroy } from "./destroy.handler.ts";
 import { selection } from "../../../../../tests/helpers/pins.ts";
 import { stackUploadsDir } from "../../../../command-internal/stack-config.ts";
 
-const live = Layer.provideMerge(stackApiLayer, BunServices.layer);
+const live = Layer.provideMerge(stackApiLayer, Layer.merge(BunServices.layer, BunCrypto.layer));
 const refuseDestroy = (
   api: StackApi["Service"],
   ids: ReadonlyArray<string>,
@@ -80,7 +84,7 @@ const refuseUploadsRemoval = Layer.effect(
           )
         : fs.remove(target, options),
   })),
-).pipe(Layer.provide(BunServices.layer));
+).pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
 const runDestroy = <A, E, R>(layer: Layer.Layer<A, E, R>, argv: ReadonlyArray<string>) =>
   Command.runWith(stackDestroyCommand.pipe(Command.provide(layer)), { version: "0.0.0-test" })(
     argv,
diff --git a/apps/cli/src/commands/experimental/stack/destroy/destroy.runtime-unavailable.integration.test.ts b/apps/cli/src/commands/experimental/stack/destroy/destroy.runtime-unavailable.integration.test.ts
index 4ee7d19865..37cebe9d8d 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/destroy.runtime-unavailable.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/destroy/destroy.runtime-unavailable.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
 import { StackError } from "@supabase/stack/effect";
@@ -9,11 +9,15 @@ import {
   mockTelemetryStateTracked,
 } from "../../../../../tests/helpers/command-mocks.ts";
 import { mockOutput, mockStdin, mockTty } from "../../../../../tests/helpers/mocks.ts";
-import { StackApi, stackApiLayer, stackTargetResolverLayer } from "../stack.shared.ts";
+import {
+  StackApi,
+  stackApiLayer,
+  stackTargetResolverLayer,
+} from "../../../../command-internal/stack-target.ts";
 import { stackDestroy } from "./destroy.handler.ts";
 import { StackCommandDestroyError } from "./destroy.errors.ts";
 
-const live = Layer.provideMerge(stackApiLayer, BunServices.layer);
+const live = Layer.provideMerge(stackApiLayer, Layer.merge(BunServices.layer, BunCrypto.layer));
 
 /**
  * A real registration whose `destroy` fails the way the stack owner reports an unreachable engine:
diff --git a/apps/cli/src/commands/experimental/stack/install/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/install/SIDE_EFFECTS.md
index 840c37fa21..4b2e317ca5 100644
--- a/apps/cli/src/commands/experimental/stack/install/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/install/SIDE_EFFECTS.md
@@ -26,7 +26,7 @@ project lease `supabase/.supabase.lock.lease`:
   version, prints a warning (see `start`).
 - A project without `supabase/config.toml` uses the versions bundled with the CLI and writes no lock.
   Frozen, by `--frozen` or by `CI` with an existing lock, the lock cannot be checked, so it fails
-  with `supabase/config.toml not found` rather than using the bundled versions; `--frozen` without
+  with `supabase/config.toml, config.json or config.jsonc not found` rather than using the bundled versions; `--frozen` without
   a lock fails with `supabase/supabase.lock not found`. Both fail before anything is downloaded.
   Without a lock `CI` changes nothing.
 
diff --git a/apps/cli/src/commands/experimental/stack/install/install.handler.ts b/apps/cli/src/commands/experimental/stack/install/install.handler.ts
index 8bafc43276..160e091a7f 100644
--- a/apps/cli/src/commands/experimental/stack/install/install.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/install/install.handler.ts
@@ -18,7 +18,7 @@ import { CommandSettings } from "../../../../config/command-settings.service.ts"
 import { Output } from "../../../../shared/output/output.service.ts";
 import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
 import { TelemetryState } from "../../../../telemetry/telemetry-state.service.ts";
-import { mapTargetError, rejectStackOutput } from "../stack.shared.ts";
+import { mapTargetError, rejectStackOutput } from "../../../../command-internal/stack-target.ts";
 import type { StackInstallFlags } from "./install.command.ts";
 import {
   StackCommandInstallError,
@@ -51,7 +51,7 @@ const render = (
 ) => {
   const lock =
     resolution === undefined
-      ? "No supabase/config.toml: using the versions bundled with the CLI; no lock written."
+      ? "No supabase/config.toml, config.json or config.jsonc: using the versions bundled with the CLI; no lock written."
       : resolution.written
         ? `Wrote ${LOCK_FILE}.`
         : `${LOCK_FILE} is up to date.`;
diff --git a/apps/cli/src/commands/experimental/stack/install/install.integration.test.ts b/apps/cli/src/commands/experimental/stack/install/install.integration.test.ts
index 45f098c2e9..66679970a7 100644
--- a/apps/cli/src/commands/experimental/stack/install/install.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/install/install.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { readLock } from "@supabase/stack/effect";
 import {
@@ -158,7 +158,7 @@ describe("experimental stack install", () => {
           downloaded: 0,
           cached: 12,
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails a frozen install naming the stale service and leaves the project untouched", () =>
@@ -188,7 +188,7 @@ describe("experimental stack install", () => {
       expect(yield* fs.exists(leasePath(root))).toBe(false);
       expect(yield* cachedFiles(root)).toEqual(cached);
       expect(archiveRequests(host)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("installs under a frozen lock without taking the lease or writing into the project", () =>
@@ -207,7 +207,7 @@ describe("experimental stack install", () => {
       expect(yield* fs.readFileString(lockPath(root))).toBe(written);
       expect(yield* fs.exists(leasePath(root))).toBe(false);
       expect(yield* fs.exists(`${root}/supabase/.gitignore`)).toBe(false);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails a frozen install of a project without config.toml, downloading nothing", () =>
@@ -226,7 +226,7 @@ describe("experimental stack install", () => {
       });
       expect(yield* fs.readDirectory(root)).toEqual([]);
       expect(host.requests).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails an install in CI with a lock but no config.toml, downloading nothing", () =>
@@ -247,11 +247,13 @@ describe("experimental stack install", () => {
         reason: "lock",
         cause: { _tag: "LockResolutionError", reason: "frozen-missing" },
       });
-      expect(error.message).toContain("supabase/config.toml not found");
+      expect(error.message).toContain(
+        "supabase/config.toml, config.json or config.jsonc not found",
+      );
       expect(error.message).not.toContain("supabase.lock not found");
       expect(yield* fs.readFileString(lockPath(root))).toBe(written);
       expect(host.requests).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails a frozen install with a lock but no config.toml on the missing config", () =>
@@ -272,11 +274,13 @@ describe("experimental stack install", () => {
         reason: "lock",
         cause: { _tag: "LockResolutionError", reason: "frozen-missing" },
       });
-      expect(error.message).toContain("supabase/config.toml not found");
+      expect(error.message).toContain(
+        "supabase/config.toml, config.json or config.jsonc not found",
+      );
       expect(error.message).not.toContain("supabase.lock not found");
       expect(yield* fs.readFileString(lockPath(root))).toBe(written);
       expect(host.requests).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("ignores the lease file when it takes the lease for a lock that is already fresh", () =>
@@ -294,7 +298,7 @@ describe("experimental stack install", () => {
       expect(yield* fs.readFileString(lockPath(root))).toBe(written);
       const ignored = (yield* fs.readFileString(`${root}/supabase/.gitignore`)).split("\n");
       expect(ignored).toEqual(expect.arrayContaining(["node_modules", ".supabase.lock.lease"]));
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails with reason invalid-config on a malformed config.toml, writing no lock", () =>
@@ -310,7 +314,7 @@ describe("experimental stack install", () => {
       expect(error).toMatchObject({ reason: "invalid-config" });
       expect(yield* fs.exists(lockPath(root))).toBe(false);
       expect(host.requests).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live(
@@ -331,7 +335,7 @@ describe("experimental stack install", () => {
         expect(error.message).toContain("must remain within the project directory");
         expect(yield* fs.exists(lockPath(root))).toBe(false);
         expect(host.requests).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails with reason flags when the platform has no native artifacts", () =>
@@ -347,6 +351,6 @@ describe("experimental stack install", () => {
       expect(error).toMatchObject({ reason: "flags" });
       expect(host.requests).toEqual([]);
       expect(yield* fs.exists(lockPath(root))).toBe(false);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/commands/experimental/stack/list/list.handler.ts b/apps/cli/src/commands/experimental/stack/list/list.handler.ts
index a0bb647a19..b934348196 100644
--- a/apps/cli/src/commands/experimental/stack/list/list.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/list/list.handler.ts
@@ -4,7 +4,7 @@ import { Output } from "../../../../shared/output/output.service.ts";
 import { OutputFlag } from "../../../../command-internal/global-flags.ts";
 import { renderGlamourTable } from "../../../../output/glamour-table.ts";
 import { TelemetryState } from "../../../../telemetry/telemetry-state.service.ts";
-import { StackApi, rejectStackOutput } from "../stack.shared.ts";
+import { StackApi, rejectStackOutput } from "../../../../command-internal/stack-target.ts";
 import { StackCommandListError } from "./list.errors.ts";
 
 export const stackList = Effect.fn("experimental.stack.list")(function* () {
diff --git a/apps/cli/src/commands/experimental/stack/list/list.integration.test.ts b/apps/cli/src/commands/experimental/stack/list/list.integration.test.ts
index 5cf1817b0b..887eba1c56 100644
--- a/apps/cli/src/commands/experimental/stack/list/list.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/list/list.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
 import { OutputFlag } from "../../../../command-internal/global-flags.ts";
@@ -7,7 +7,7 @@ import {
   mockTelemetryStateTracked,
 } from "../../../../../tests/helpers/command-mocks.ts";
 import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
-import { StackApi, stackApiLayer } from "../stack.shared.ts";
+import { StackApi, stackApiLayer } from "../../../../command-internal/stack-target.ts";
 import { stackList } from "./list.handler.ts";
 
 const registry = Effect.fn("StackListTest.registry")(function* () {
@@ -26,7 +26,7 @@ const registry = Effect.fn("StackListTest.registry")(function* () {
   return { root, api, fs, path, locations, telemetry, layer };
 });
 
-const live = Layer.provideMerge(stackApiLayer, BunServices.layer);
+const live = Layer.provideMerge(stackApiLayer, Layer.merge(BunServices.layer, BunCrypto.layer));
 
 describe("stack list", () => {
   it.effect("lists real saved identities without starting owners in text and machine output", () =>
diff --git a/apps/cli/src/commands/experimental/stack/logs/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/logs/SIDE_EFFECTS.md
index 94d090c096..ff4e0983f9 100644
--- a/apps/cli/src/commands/experimental/stack/logs/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/logs/SIDE_EFFECTS.md
@@ -65,7 +65,10 @@ Stream JSON emits a `log-entry` event per output line with `timestamp`,
 `service`, `instance_id`, `stream` (`stdout` or `stderr`), `line`, and `source`
 (`history` or `live`), and a `log-marker` event per marker with `timestamp`,
 `service`, `instance_id`, `kind` (`launch` or `lost`), `source`, and, for chunks
-lost before they were written, `count` and, when known, `stream`. A `lost` marker without
+lost before they were written, `count` and, when known, `stream`. Each stream-json event also includes a `data` object with the original retained record,
+including its `instanceId`, `service`, `timestamp`, `kind`, and any `text`,
+`launchId`, `position`, `resumeAt`, `count`, or `stream` fields present. The JSON
+array keeps its existing event shape without `data`. A `lost` marker without
 `count` reports segments removed by retention. `--output-format json` prints
 one array of the same objects; it cannot be combined with `--follow`. Lines
 preserve their content in machine output. Legacy `-o/--output` is rejected.
@@ -79,3 +82,7 @@ leaves the owner and services running. History reads and completed follows exit
 Standard command telemetry is retained, with `-f` reported as `follow`; log
 contents are not custom telemetry properties. Telemetry flushes on every exit to
 `<SUPABASE_HOME or ~/.supabase>/telemetry.json`.
+
+## Deprecation
+
+The command prints a warning on stderr before reading logs. It names `supabase logs` as the replacement and v4 as the removal version. Existing flags, history defaults, follow defaults, and JSON array output remain unchanged. Stream JSON adds the `data` field described above.
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.command.ts b/apps/cli/src/commands/experimental/stack/logs/logs.command.ts
index 7d9135218c..eee8201c8f 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.command.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.command.ts
@@ -1,5 +1,6 @@
+import { Effect } from "effect";
+import { Output } from "../../../../shared/output/output.service.ts";
 import { Command, Flag } from "effect/cli";
-import type * as CliCommand from "effect/cli/Command";
 import { withPermissions } from "../../../../command-internal/command-permissions/command-permissions.annotation.ts";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { withCommandTelemetry } from "../../../../telemetry/command-telemetry.ts";
@@ -48,11 +49,9 @@ const config = {
   ),
 } as const;
 
-export type StackLogsFlags = CliCommand.Command.Config.Infer<typeof config>;
-
 export const stackLogsCommand = Command.make("logs", config).pipe(
   Command.withDescription(
-    "Print retained service logs and exit; with --follow, keep streaming new lines. History is readable while the stack is stopped.",
+    "Deprecated; removed in v4. Use supabase logs instead. Print retained service logs and exit; with --follow, keep streaming new lines. History is readable while the stack is stopped.",
   ),
   Command.withShortDescription("Show managed local stack logs"),
   Command.withExamples([
@@ -74,7 +73,13 @@ export const stackLogsCommand = Command.make("logs", config).pipe(
     noApiEffectFlags: ["stack", "stack-id", "service", "follow", "tail", "since"],
   }),
   Command.withHandler((flags) =>
-    stackLogs(flags).pipe(
+    Effect.gen(function* () {
+      yield* (yield* Output).raw(
+        "Warning: stack logs is deprecated and will be removed in v4. Use supabase logs instead.\n",
+        "stderr",
+      );
+      yield* stackLogs(flags);
+    }).pipe(
       withCommandTelemetry({ flags, config, aliases: { f: "follow" } }),
       withJsonErrorHandling,
     ),
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.errors.ts b/apps/cli/src/commands/experimental/stack/logs/logs.errors.ts
index 97741caa2b..a6bf9210bb 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.errors.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.errors.ts
@@ -6,7 +6,10 @@ import {
   ErrorActionabilityId,
   unclassifiedStackFailureActionability,
 } from "../../../../shared/telemetry/error-actionability.ts";
-import { type StackTargetIssue, stackTargetInvalidConfigActionability } from "../stack.shared.ts";
+import {
+  type StackTargetIssue,
+  stackTargetInvalidConfigActionability,
+} from "../../../../command-internal/stack-target.ts";
 
 export class StackCommandLogsError extends Data.TaggedError("ExperimentalStackLogsError")<{
   readonly reason: "flags" | "invalid-config" | "lifecycle" | "stack";
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.format.ts b/apps/cli/src/commands/experimental/stack/logs/logs.format.ts
index 080bf1b05c..f61ce2c78d 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.format.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.format.ts
@@ -1,5 +1,5 @@
 import { DateTime, Option } from "effect";
-import type { LogPosition, LogRecord, StackLogRecord } from "@supabase/stack/effect";
+import type { StackLogRecord } from "@supabase/stack/effect";
 import {
   aqua,
   blue,
@@ -10,182 +10,10 @@ import {
   yellow,
 } from "../../../../command-internal/colors.ts";
 import { stripControlSequences } from "../../../../shared/output/strip-control-sequences.ts";
+import type { LogWindow } from "../../../../command-internal/logs/local-history.ts";
 import { markerText } from "../../../../command-internal/stack-log-events.ts";
 
-/** A `--since` bound: an absolute time, or each instance's latest launch. */
-export type SinceBound =
-  | { readonly kind: "time"; readonly iso: string }
-  | { readonly kind: "start" };
-
-const durationShape = /^(?:\d+(?:\.\d+)?(?:ms|s|m|h|d))+$/u;
-const durationPart = /(\d+(?:\.\d+)?)(ms|s|m|h|d)/gu;
-const unitMillis: Readonly<Record<string, number>> = {
-  ms: 1,
-  s: 1_000,
-  m: 60_000,
-  h: 3_600_000,
-  d: 86_400_000,
-};
-const isoDate = /^\d{4}-\d{2}-\d{2}/u;
-
-/** Parses `start`, a duration before `nowMillis` such as `1h30m`, or an ISO-8601 time. */
-export const parseSince = (value: string, nowMillis: number): SinceBound | undefined => {
-  if (value === "start") return { kind: "start" };
-  if (durationShape.test(value)) {
-    let millis = 0;
-    for (const [, amount, unit] of value.matchAll(durationPart))
-      millis += Number(amount) * (unitMillis[unit ?? ""] ?? 0);
-    return Option.match(DateTime.make(nowMillis - millis), {
-      onNone: () => undefined,
-      onSome: (time) => ({ kind: "time", iso: DateTime.formatIso(time) }),
-    });
-  }
-  if (!isoDate.test(value)) return undefined;
-  return Option.match(DateTime.make(value), {
-    onNone: () => undefined,
-    onSome: (time) => ({ kind: "time", iso: DateTime.formatIso(time) }),
-  });
-};
-
-const isLine = (record: LogRecord) => record.kind === "stdout" || record.kind === "stderr";
-
-/** The newest `tail` output lines, with the markers between them, and how many lines exist. */
-export interface LogWindow {
-  readonly records: ReadonlyArray<StackLogRecord>;
-  readonly shown: number;
-  readonly total: number;
-}
-
-const tailWindow = (records: ReadonlyArray<StackLogRecord>, tail: number): LogWindow => {
-  const total = records.filter(isLine).length;
-  if (total <= tail) return { records, shown: total, total };
-  let seen = 0;
-  let start = records.length;
-  while (seen < tail && start > 0) {
-    start -= 1;
-    const record = records[start];
-    if (record !== undefined && isLine(record)) seen += 1;
-  }
-  return { records: seen === 0 ? [] : records.slice(start), shown: seen, total };
-};
-
-const comparePositions = (left: LogPosition, right: LogPosition) =>
-  left.generation - right.generation || left.byteOffset - right.byteOffset;
-
-const origin: LogPosition = { generation: 0, byteOffset: 0 };
-const compareText = (left: string, right: string) => (left < right ? -1 : left > right ? 1 : 0);
-const compareRecords = (left: StackLogRecord, right: StackLogRecord) =>
-  compareText(left.timestamp, right.timestamp) ||
-  compareText(left.service, right.service) ||
-  compareText(left.instanceId, right.instanceId) ||
-  comparePositions(
-    left.position ?? left.resumeAt ?? origin,
-    right.position ?? right.resumeAt ?? origin,
-  );
-
-interface Launch {
-  readonly id: number;
-  readonly timestamp: string;
-}
-
-interface InstanceTail {
-  records: Array<StackLogRecord>;
-  head: number;
-  lines: number;
-  total: number;
-  launch: Launch | undefined;
-}
-
-/** Whether a record belongs to `launchId` or a later launch; a gap marker carries no launch id. */
-export const isFromLaunch = (record: LogRecord, launchId: number | undefined) =>
-  launchId === undefined || record.launchId === undefined || record.launchId >= launchId;
-
-/** Launch ids increase per instance; a gap marker carries none, so its time decides. */
-const fromLaunch = (record: StackLogRecord, launch: Launch) =>
-  record.launchId === undefined
-    ? record.timestamp >= launch.timestamp
-    : isFromLaunch(record, launch.id);
-
-/**
- * Collects each instance's newest `tail` lines and last position. With `fromLatestLaunch`, it
- * keeps only the records of each instance's highest launch record, which `launches` reports for
- * following.
- */
-export const makeHistoryCollector = (tail: number, fromLatestLaunch: boolean) => {
-  const instances = new Map<string, InstanceTail>();
-  const positions = new Map<string, LogPosition>();
-  const launches = new Map<string, number>();
-  const push = (record: StackLogRecord) => {
-    const position = record.position;
-    const last = positions.get(record.instanceId);
-    if (position !== undefined && (last === undefined || comparePositions(position, last) > 0))
-      positions.set(record.instanceId, position);
-    let state = instances.get(record.instanceId);
-    if (state === undefined) {
-      state = { records: [], head: 0, lines: 0, total: 0, launch: undefined };
-      instances.set(record.instanceId, state);
-    }
-    if (fromLatestLaunch) {
-      const latest = state.launch;
-      if (
-        record.kind === "launch" &&
-        record.launchId !== undefined &&
-        (latest === undefined || record.launchId > latest.id)
-      ) {
-        const launch = { id: record.launchId, timestamp: record.timestamp };
-        state.records = state.records.slice(state.head).filter((kept) => fromLaunch(kept, launch));
-        state.head = 0;
-        state.lines = state.records.filter(isLine).length;
-        state.total = state.lines;
-        state.launch = launch;
-        launches.set(record.instanceId, launch.id);
-      } else if (latest !== undefined && !fromLaunch(record, latest)) return;
-    }
-    const line = isLine(record);
-    if (line) state.total += 1;
-    // Kept records stay in display order; a record older than every kept line of a full window
-    // would be trimmed at once.
-    const oldest = state.records[state.head];
-    if (state.lines >= tail && oldest !== undefined && compareRecords(record, oldest) < 0) return;
-    let low = state.head;
-    let high = state.records.length;
-    while (low < high) {
-      const middle = (low + high) >>> 1;
-      const kept = state.records[middle];
-      if (kept !== undefined && compareRecords(kept, record) <= 0) low = middle + 1;
-      else high = middle;
-    }
-    if (low === state.records.length) state.records.push(record);
-    else state.records.splice(low, 0, record);
-    if (line) state.lines += 1;
-    while (state.lines > tail && state.head < state.records.length) {
-      const dropped = state.records[state.head];
-      state.head += 1;
-      if (dropped !== undefined && isLine(dropped)) state.lines -= 1;
-    }
-    if (state.head > 1024 && state.head * 2 > state.records.length) {
-      state.records = state.records.slice(state.head);
-      state.head = 0;
-    }
-  };
-  const finish = (): {
-    readonly window: LogWindow;
-    readonly positions: typeof positions;
-    readonly launches: ReadonlyMap<string, number>;
-  } => {
-    const kept = [...instances.values()].flatMap((state) => state.records.slice(state.head));
-    const total = [...instances.values()].reduce((sum, state) => sum + state.total, 0);
-    const window = tailWindow(kept.toSorted(compareRecords), tail);
-    return { window: { ...window, total }, positions, launches };
-  };
-  return { push, finish };
-};
-
-/** Whether a followed record comes after the history already printed. */
-export const isAfter = (record: LogRecord, printed: LogPosition | undefined) =>
-  printed === undefined ||
-  record.position === undefined ||
-  comparePositions(record.position, printed) > 0;
+const isLine = (record: StackLogRecord) => record.kind === "stdout" || record.kind === "stderr";
 
 const palette = [aqua, yellow, green, magenta, blue];
 const pad = (value: number, width: number) => String(value).padStart(width, "0");
@@ -199,7 +27,6 @@ const localTime = (iso: string) =>
     },
   });
 
-/** Formats records as `<label> | <local time> <line>`, labels aligned across `instances`. */
 export const makeTextFormatter = (
   instances: ReadonlyArray<{ readonly id: string; readonly service: string }>,
   stream: ColorStream,
@@ -223,6 +50,5 @@ export const makeTextFormatter = (
   };
 };
 
-/** The note printed when the tail hides older lines. */
 export const truncationFooter = (window: LogWindow) =>
   `showing last ${window.shown.toLocaleString("en-US")} of ${window.total.toLocaleString("en-US")} lines, use --tail/--since`;
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.format.unit.test.ts b/apps/cli/src/commands/experimental/stack/logs/logs.format.unit.test.ts
index 559f4180c9..bb7022e87f 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.format.unit.test.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.format.unit.test.ts
@@ -1,7 +1,8 @@
 import { DateTime } from "effect";
 import { describe, expect, it } from "vitest";
 import type { StackLogRecord } from "@supabase/stack/effect";
-import { makeHistoryCollector, parseSince } from "./logs.format.ts";
+import { makeHistoryCollector } from "../../../../command-internal/logs/local-history.ts";
+import { parseSince } from "../../../../command-internal/logs/since.ts";
 
 const now = Date.parse("2026-09-29T12:00:00.000Z");
 
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.handler.ts b/apps/cli/src/commands/experimental/stack/logs/logs.handler.ts
index d1c227a969..d785c3ee5c 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.handler.ts
@@ -1,7 +1,6 @@
-import { Clock, Effect, Option, Path, Stream } from "effect";
+import { Clock, Effect, Option, Path, Schema, Stream } from "effect";
 import {
   gatewayLog,
-  sharesApiEndpoint,
   streamStackLogs,
   type SavedStack,
   type StackLogRecord,
@@ -15,21 +14,29 @@ import {
   StackApi,
   mapTargetError,
   StackTargetResolver,
-  rejectStackOutput,
   validateStackTarget,
-} from "../stack.shared.ts";
+  rejectStackOutput,
+} from "../../../../command-internal/stack-target.ts";
 import { StackCommandLogsError } from "./logs.errors.ts";
-import type { StackLogsFlags } from "./logs.command.ts";
+import { makeTextFormatter, truncationFooter } from "./logs.format.ts";
 import {
   isAfter,
   isFromLaunch,
   makeHistoryCollector,
-  makeTextFormatter,
-  parseSince,
-  truncationFooter,
-} from "./logs.format.ts";
+} from "../../../../command-internal/logs/local-history.ts";
+import { parseSince } from "../../../../command-internal/logs/since.ts";
+import { hasGatewayLogs } from "../../../../command-internal/logs/local-sources.ts";
 import { logEvent, type LogSource } from "../../../../command-internal/stack-log-events.ts";
 
+export interface StackLogsFlags {
+  readonly stack: Option.Option<string>;
+  readonly stackId: Option.Option<string>;
+  readonly service: ReadonlyArray<string>;
+  readonly follow: boolean;
+  readonly tail: number;
+  readonly since: Option.Option<string>;
+}
+
 const targetError = mapTargetError((props) => new StackCommandLogsError(props));
 const logsError = (cause: { readonly message: string }) =>
   new StackCommandLogsError({
@@ -53,10 +60,7 @@ const select = (
     service: creation.service,
   });
   const members = new Set(definition.composition.members.map(({ id }) => id));
-  // The owner records the shared API listener's requests when a member is served on it.
-  const gateway: ReadonlyArray<Selected> = definition.instances.some(
-    ({ id, creation }) => members.has(id) && sharesApiEndpoint(creation),
-  )
+  const gateway: ReadonlyArray<Selected> = hasGatewayLogs(definition)
     ? [{ id: gatewayLog.instanceId, service: gatewayLog.service }]
     : [];
   if (requested.length === 0) {
@@ -165,12 +169,14 @@ export const stackLogs = Effect.fn("experimental.stack.logs")(function* (flags:
 
     if (output.format === "json")
       return yield* output.result(window.records.map((record) => logEvent(record, "history")));
-    // Colour follows the terminal only when stdout is one, so piped logs stay plain.
     const terminal = output.interactive;
     const text = makeTextFormatter(selected, terminal ? process.stdout : {});
     const emit = (record: StackLogRecord, source: LogSource) =>
       output.format === "stream-json"
-        ? output.event(logEvent(record, source))
+        ? Effect.gen(function* () {
+            const data = yield* Schema.decodeEffect(Schema.JsonObject)(record);
+            yield* output.event({ ...logEvent(record, source), data });
+          })
         : output.raw(text(record));
     yield* Effect.forEach(window.records, (record) => emit(record, "history"), { discard: true });
     if (output.format === "text" && flags.tail > 0) {
@@ -212,7 +218,6 @@ export const stackLogs = Effect.fn("experimental.stack.logs")(function* (flags:
             id === gatewayLog.instanceId ? stack.gateway.readLogs : handles.get(id)?.readLogs;
           if (readLogs === undefined) return [];
           const from = printed.get(id);
-          // Without history, the owner pins the start at its end under the writer's lock.
           const start = flags.tail === 0 ? { tail: 0 } : from === undefined ? {} : { from };
           return [
             readLogs({ follow: true, ...start, ...sinceTime }).pipe(
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.integration.test.ts b/apps/cli/src/commands/experimental/stack/logs/logs.integration.test.ts
index 4d52c520f2..7f052661fe 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.integration.test.ts
@@ -1,8 +1,18 @@
-import { BunServices } from "@effect/platform-bun";
+import { commandRuntimeLayer } from "../../../../shared/runtime/command-runtime.layer.ts";
+import { LogsClipboard } from "../../../logs/logs.clipboard.ts";
+import { Command } from "effect/cli";
+import { stackLogsCommand } from "./logs.command.ts";
+import {
+  buildTestRuntime,
+  mockCommandPlatformApi,
+} from "../../../../../tests/helpers/command-mocks.ts";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { TestClock } from "effect/testing";
 import {
   Clock,
+  ConfigProvider,
+  Cause,
   DateTime,
   Deferred,
   Effect,
@@ -15,7 +25,10 @@ import {
   Redacted,
   Ref,
   Schema,
+  Stdio,
   Stream,
+  Queue,
+  Terminal,
 } from "effect";
 import {
   streamStackLogs,
@@ -24,17 +37,32 @@ import {
   type SavedStack,
   type ServiceInstance,
 } from "@supabase/stack/effect";
+import { LinkedProjectCache } from "../../../../telemetry/linked-project-cache.service.ts";
+import { ProjectRefResolver } from "../../../../config/project-ref.service.ts";
+import { Stdin } from "../../../../shared/runtime/stdin.service.ts";
+import { ProcessControl } from "../../../../shared/runtime/process-control.service.ts";
+import { Tty } from "../../../../shared/runtime/tty.service.ts";
 import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
 import {
   mockCommandSettings,
   mockTelemetryStateTracked,
 } from "../../../../../tests/helpers/command-mocks.ts";
-import { StackApi, stackApiLayer, stackTargetResolverLayer } from "../stack.shared.ts";
-import type { StackLogsFlags } from "./logs.command.ts";
+import {
+  StackApi,
+  stackApiLayer,
+  stackTargetResolverLayer,
+} from "../../../../command-internal/stack-target.ts";
+import type { StackLogsFlags } from "./logs.handler.ts";
 import { stackLogs } from "./logs.handler.ts";
+import { logs, logsSources } from "../../../logs/logs.handler.ts";
+import { CommandPlatformApiFactory } from "../../../../auth/command-platform-api-factory.service.ts";
+import { TargetPolicy } from "../../../../command-internal/target/target-policy.ts";
+import { OutputFlag, OutputFormatFlag } from "../../../../command-internal/global-flags.ts";
+import { projectStateModeLayer } from "../../../../shared/config/project-state-mode.ts";
 import { selection } from "../../../../../tests/helpers/pins.ts";
 
-const live = Layer.provideMerge(stackApiLayer, BunServices.layer);
+const decodeRows = Schema.decodeSync(Schema.fromJsonString(Schema.Array(Schema.JsonObject)));
+const live = Layer.provideMerge(stackApiLayer, Layer.merge(BunServices.layer, BunCrypto.layer));
 
 type SavedInstance = SavedStack["instances"][number];
 const mail = (id: string): SavedInstance => ({
@@ -174,22 +202,160 @@ const fixture = Effect.fn("StackLogsTest.fixture")(function* (options: {
         records.map((record) => `${record}\n`).join(""),
       );
     });
-  const run = (flags: Partial<StackLogsFlags>, format: "text" | "stream-json" | "json" = "text") =>
+  const run = (
+    flags: Partial<StackLogsFlags>,
+    format: "text" | "stream-json" | "json" = "text",
+    mode: "reader" | "unified" | "legacy" | "browser" = "reader",
+    legacyOutput?: "json",
+  ) =>
     Effect.gen(function* () {
-      const output = mockOutput({ format, interactive: false });
+      const output = mockOutput({ format, interactive: mode === "browser" });
+      const screens: string[] = [];
+      const input = yield* Queue.unbounded<Terminal.UserInput>();
+      let openedDetails = false;
+      const terminal = Terminal.make({
+        columns: Effect.succeed(100),
+        rows: Effect.succeed(30),
+        size: Queue.unbounded<Terminal.Size, Cause.Done>(),
+        readInput: Effect.succeed(input),
+        readLine: Effect.die("unused"),
+        display: (text) =>
+          Effect.gen(function* () {
+            screens.push(text);
+            if (
+              !openedDetails &&
+              text.includes(" | ready") &&
+              text.includes("local browser payload")
+            ) {
+              openedDetails = true;
+              yield* Queue.offer(input, {
+                input: Option.none(),
+                key: { name: "return", ctrl: false, meta: false, shift: false },
+              });
+            } else if (text.includes("Log details")) {
+              yield* Queue.offer(input, {
+                input: Option.none(),
+                key: { name: "q", ctrl: false, meta: false, shift: false },
+              });
+            }
+          }),
+      });
       const telemetry = mockTelemetryStateTracked();
       const layer = Layer.mergeAll(
+        commandRuntimeLayer(["stack", "logs"]),
         output.layer,
+        Layer.succeed(OutputFlag, Option.fromUndefinedOr(legacyOutput)),
+        Layer.succeed(OutputFormatFlag, Option.none()),
+        ConfigProvider.layer(ConfigProvider.fromUnknown({})),
+        Layer.mock(LogsClipboard, {}),
         telemetry.layer,
+        projectStateModeLayer("stack"),
         Layer.provideMerge(stackTargetResolverLayer, Layer.merge(settings, fakeApi)),
       );
-      const exit = yield* stackLogs({ ...baseFlags(stack.id), ...flags }).pipe(
-        Effect.provide(layer),
-        Effect.exit,
+      const legacyArgs = ["logs", "--stack-id", stack.id];
+      const runLogs = Effect.gen(function* () {
+        if (mode === "legacy")
+          return yield* Command.runWith(
+            Command.make("supabase").pipe(Command.withSubcommands([stackLogsCommand])),
+            { version: "test" },
+          )(legacyArgs).pipe(
+            Effect.provide(
+              Layer.mergeAll(
+                buildTestRuntime({
+                  out: output,
+                  api: mockCommandPlatformApi({ response: { status: 200, body: {} } }),
+                  cliSettings: settings,
+                  commandPath: ["stack", "logs"],
+                }),
+                Stdio.layerTest({ args: Effect.succeed(legacyArgs) }),
+              ),
+            ),
+          );
+        if (mode === "unified" || mode === "browser")
+          return yield* logs({
+            remote: Option.none(),
+            projectRef: Option.none(),
+            local: false,
+            linked: false,
+            stack: Option.none(),
+            stackId: Option.some(stack.id),
+            service: flags.service ?? ["postgres"],
+            resource: Option.none(),
+            kind: Option.none(),
+            level: [],
+            search: Option.none(),
+            since: flags.since ?? Option.some("start"),
+            limit: flags.tail ?? 100,
+            from: Option.none(),
+            to: Option.none(),
+            sql: Option.none(),
+            file: Option.none(),
+          }).pipe(
+            Effect.provide(
+              Layer.mergeAll(
+                Layer.succeed(OutputFlag, Option.none()),
+                Layer.succeed(Stdin, {
+                  isTTY: mode === "browser",
+                  readPipedText: Effect.succeed(Option.none()),
+                  readPipedBytes: Effect.succeed(Option.none()),
+                  pipedBytesStream: Stream.empty,
+                  readLine: () => Effect.succeed(Option.none()),
+                }),
+                Layer.succeed(Tty, {
+                  stdinIsTty: mode === "browser",
+                  stdoutIsTty: mode === "browser",
+                  stdoutIsPipe: false,
+                }),
+                Layer.succeed(Terminal.Terminal, terminal),
+                Layer.mock(LinkedProjectCache, {}),
+                Layer.mock(ProjectRefResolver, {}),
+                Layer.mock(ProcessControl, {}),
+                Layer.succeed(TargetPolicy, {
+                  group: "selectable",
+                  consent: "none",
+                  consentExemptReason: "read logs",
+                }),
+                Layer.succeed(CommandPlatformApiFactory, {
+                  make: Effect.die("local logs must not resolve hosted credentials"),
+                }),
+              ),
+            ),
+          );
+        return yield* stackLogs({ ...baseFlags(stack.id), ...flags });
+      });
+      const exit = yield* runLogs.pipe(Effect.provide(layer), Effect.exit);
+      return { exit, output, telemetry, screens };
+    });
+  const sources = () =>
+    Effect.gen(function* () {
+      const output = mockOutput({ format: "json" });
+      const telemetry = mockTelemetryStateTracked();
+      const layer = Layer.mergeAll(
+        commandRuntimeLayer(["logs", "sources"]),
+        output.layer,
+        telemetry.layer,
+        projectStateModeLayer("stack"),
+        Layer.succeed(OutputFlag, Option.none()),
+        Layer.mock(ProjectRefResolver, {}),
+        Layer.succeed(TargetPolicy, {
+          group: "selectable",
+          consent: "none",
+          consentExemptReason: "Read logs",
+        }),
+        Layer.provideMerge(stackTargetResolverLayer, Layer.merge(settings, fakeApi)),
       );
-      return { exit, output, telemetry };
+      yield* logsSources({
+        remote: Option.none(),
+        projectRef: Option.none(),
+        local: false,
+        linked: false,
+        stack: Option.none(),
+        stackId: Option.some(stack.id),
+        service: Option.none(),
+      }).pipe(Effect.provide(layer));
+      return output.stdoutText;
     });
-  return { stackId: stack.id, stateRoot, opened, writeSegment, run };
+  return { stackId: stack.id, stateRoot, opened, writeSegment, run, sources };
 });
 
 const failure = <E>(exit: Exit.Exit<void, E>) =>
@@ -198,9 +364,134 @@ const lines = (text: string) => text.split("\n").filter((value) => value.length
 const eventLines = (events: ReadonlyArray<{ readonly type: string; readonly line?: unknown }>) =>
   events.filter(({ type }) => type === "log-entry").map(({ line: text }) => text);
 
-describe("stack logs", () => {
+describe("retained local logs", () => {
   const t0 = Date.parse("2026-09-29T10:00:00.000Z");
 
+  it.effect("reads 200 retained lines without a time filter and warns once with legacy JSON", () =>
+    Effect.gen(function* () {
+      const f = yield* fixture({ instances: [mail("mail-a")], members: ["mail-a"] });
+      yield* f.writeSegment("mail", "mail-a", [
+        launch(t0),
+        ...Array.from({ length: 201 }, (_, i) => line(t0 + i + 1, "stdout", `retained ${i}`)),
+      ]);
+      const { exit, output } = yield* f.run({}, "json", "legacy");
+      expect(Exit.isSuccess(exit), Exit.isFailure(exit) ? Cause.pretty(exit.cause) : "").toBe(true);
+      expect(output.stdoutText.startsWith("[{")).toBe(true);
+      const rows = decodeRows(output.stdoutText);
+      expect(rows).toHaveLength(200);
+      expect(rows[0]).toMatchObject({
+        type: "log-entry",
+        timestamp: iso(t0 + 2),
+        source: "history",
+        service: "mail",
+        instance_id: "mail-a",
+        stream: "stdout",
+        line: "retained 1",
+      });
+      expect(output.stderrText.match(/Warning: stack logs is deprecated/g)).toHaveLength(1);
+      expect(output.stderrText).toContain("removed in v4");
+      expect(output.stdoutText).not.toContain("deprecated");
+      expect(yield* Ref.get(f.opened)).toBe(0);
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.effect("browses real retained local records with full positions and instance details", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(t0 + 100);
+      const f = yield* fixture({ instances: [database("db-browser")], members: ["db-browser"] });
+      yield* f.writeSegment("database", "db-browser", [
+        launch(t0),
+        line(t0 + 1, "stdout", "local browser payload"),
+      ]);
+      const { exit, output, screens } = yield* f.run({}, "text", "browser");
+      expect(Exit.isSuccess(exit), Exit.isFailure(exit) ? Cause.pretty(exit.cause) : "").toBe(true);
+      const details = screens.find((screen) => screen.includes("Log details"));
+      expect(details).toContain("local browser payload");
+      expect(details).toContain("db-browser");
+      expect(details).toContain('"byteOffset"');
+      expect(
+        screens.some((screen) =>
+          screen.includes("Sep 29 - 10:00:00 UTC database local browser payload"),
+        ),
+      ).toBe(true);
+      expect(screens.at(-1)).toContain("?1049l");
+      expect(output.stdoutText).toBe("");
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.effect("advertises the accepted local log limit for instances and gateway", () =>
+    Effect.gen(function* () {
+      const f = yield* fixture({
+        instances: [mail("mail-a"), rest("rest-a")],
+        members: ["mail-a", "rest-a"],
+      });
+      const sources = decodeRows(yield* f.sources());
+      const instance = sources.find((source) => source.resource === "mail-a");
+      const gateway = sources.find((source) => source.service === "gateway");
+      expect(instance?.filters).toEqual(["service", "resource", "since", "limit"]);
+      expect(gateway?.filters).toEqual(["service", "since", "limit"]);
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.effect.each([
+    { since: Option.none<string>(), expected: "Window: Nov 03 11:00:00–12:00:00 UTC" },
+    {
+      since: Option.some("2026-11-03T10:00:00Z"),
+      expected: "Window: Nov 03 10:00:00–12:00:00 UTC",
+    },
+    {
+      since: Option.some("start"),
+      expected: "Window: since each service's latest launch → Nov 03 2026 12:00:00 UTC",
+    },
+  ])(
+    "shows the frozen local lower bound and captured snapshot end: $expected",
+    ({ since, expected }) =>
+      Effect.gen(function* () {
+        const readTime = Date.parse("2026-11-03T12:00:00Z");
+        yield* TestClock.setTime(readTime);
+        const f = yield* fixture({ instances: [database("db-window")], members: ["db-window"] });
+        yield* f.writeSegment("database", "db-window", [
+          launch(readTime - 2000),
+          line(readTime - 1000, "stdout", "local browser payload"),
+        ]);
+        const { exit, screens } = yield* f.run({ since }, "text", "browser");
+        expect(Exit.isSuccess(exit)).toBe(true);
+        const windows = screens
+          .filter((screen) => screen.includes("Window:") && !screen.includes("resolving…"))
+          .map((screen) => screen.split("\r\n").find((line) => line.startsWith("Window:")));
+        expect(screens.some((screen) => screen.includes("Local stack "))).toBe(true);
+        expect(windows.length).toBeGreaterThan(0);
+        expect(windows.every((window) => window === expected)).toBe(true);
+      }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.effect("preserves full retained records and markers in native JSON while stopped", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(t0 + 100);
+      const f = yield* fixture({ instances: [database("db-a")], members: ["db-a"] });
+      yield* f.writeSegment("database", "db-a", [
+        launch(t0),
+        line(t0 + 1, "stdout", "retained"),
+        lost(t0 + 2, 3),
+      ]);
+      const { exit, output } = yield* f.run({}, "json", "unified");
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(output.stdoutText.startsWith("[\n  {\n")).toBe(true);
+      const rows = decodeRows(output.stdoutText);
+      expect(rows.map((row) => row.kind)).toEqual(["launch", "stdout", "lost"]);
+      expect(rows[1]).toMatchObject({
+        instanceId: "db-a",
+        service: "database",
+        launchId: 1,
+        text: "retained",
+      });
+      expect(rows[1]?.position).toMatchObject({ generation: 1 });
+      expect(rows[2]).toMatchObject({ count: 3 });
+      expect(output.stderrText).not.toContain("deprecated");
+      expect(yield* Ref.get(f.opened)).toBe(0);
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
   it.effect("prints the newest lines across services with aligned labels, offline", () =>
     Effect.gen(function* () {
       const f = yield* fixture({
@@ -352,10 +643,28 @@ describe("stack logs", () => {
       const finite = yield* f.run({}, "json");
       const text = yield* f.run({});
 
-      expect(streamed.output.events).toEqual(expected);
-      expect(
-        yield* Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown))(finite.output.stdoutText),
-      ).toEqual(expected);
+      expect(streamed.output.events.map(({ data: _data, ...event }) => event)).toEqual(expected);
+      expect(streamed.output.events).toMatchObject([
+        { data: { kind: "launch", launchId: 1, instanceId: "mail-a", service: "mail" } },
+        {
+          data: {
+            kind: "stdout",
+            text: "hello",
+            launchId: 1,
+            instanceId: "mail-a",
+            service: "mail",
+            position: { generation: 1 },
+          },
+        },
+        { data: { kind: "stderr", text: "oops", launchId: 1 } },
+        { data: { kind: "lost", count: 3 } },
+      ]);
+      expect(decodeRows(finite.output.stdoutText)).toMatchObject([
+        { type: "log-marker", kind: "launch", source: "history", service: "mail" },
+        { type: "log-entry", line: "hello", stream: "stdout", source: "history" },
+        { type: "log-entry", line: "oops", stream: "stderr", source: "history" },
+        { type: "log-marker", kind: "lost", count: 3, source: "history" },
+      ]);
       expect(
         lines(text.output.stdoutText).map((value) => value.replace(/\d{2}:\S+ /u, "")),
       ).toEqual([
@@ -367,6 +676,20 @@ describe("stack logs", () => {
     }).pipe(Effect.scoped, Effect.provide(live)),
   );
 
+  it.effect("preserves the legacy output rejection and format suggestion", () =>
+    Effect.gen(function* () {
+      const f = yield* fixture({ instances: [mail("mail-a")], members: ["mail-a"] });
+      const { exit, output } = yield* f.run({}, "text", "reader", "json");
+      expect(failure(exit)).toMatchObject({
+        reason: "flags",
+        message: "The legacy -o/--output flag is not supported here; use --output-format json.",
+        suggestion:
+          "Use --output-format json, --output-format text, or --output-format stream-json.",
+      });
+      expect(output.stdoutText).toBe("");
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
   it.effect("fails --follow without a running owner before printing anything", () =>
     Effect.gen(function* () {
       const f = yield* fixture({ instances: [mail("mail-a")], members: ["mail-a"] });
@@ -415,7 +738,7 @@ describe("stack logs", () => {
                   position: { generation: 1, byteOffset: 1_000_000 },
                 }),
               ),
-              Stream.provide(BunServices.layer),
+              Stream.provide(Layer.merge(BunServices.layer, BunCrypto.layer)),
             ),
           );
       const f = yield* fixture({
@@ -633,6 +956,7 @@ describe("stack logs", () => {
         reason: "lifecycle",
         message:
           "The running stack serves none of the selected services, so there are no new lines to follow.",
+        suggestion: "Run supabase stack logs without --follow to read retained logs.",
       });
     }).pipe(Effect.scoped, Effect.provide(live)),
   );
diff --git a/apps/cli/src/commands/experimental/stack/outdated/outdated.command.ts b/apps/cli/src/commands/experimental/stack/outdated/outdated.command.ts
index b07d11781d..49b56e7b46 100644
--- a/apps/cli/src/commands/experimental/stack/outdated/outdated.command.ts
+++ b/apps/cli/src/commands/experimental/stack/outdated/outdated.command.ts
@@ -9,7 +9,7 @@ import { withTargetPolicy } from "../../../../command-internal/target/target-pol
 
 export const stackOutdatedCommand = Command.make("outdated").pipe(
   Command.withDescription(
-    "Report, for each service in supabase/supabase.lock, the release supabase stack update would lock instead, this CLI's bundled pin, and whether the entry is out of date with config.toml. " +
+    "Report, for each service in supabase/supabase.lock, the release supabase stack update would lock instead, this CLI's bundled pin, and whether the entry is out of date with the project config file. " +
       "Read-only: it writes nothing and downloads no artifacts.",
   ),
   Command.withShortDescription("Show locked service versions with newer releases"),
diff --git a/apps/cli/src/commands/experimental/stack/outdated/outdated.handler.ts b/apps/cli/src/commands/experimental/stack/outdated/outdated.handler.ts
index fb702d1e0b..7bfacc3f3d 100644
--- a/apps/cli/src/commands/experimental/stack/outdated/outdated.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/outdated/outdated.handler.ts
@@ -12,7 +12,7 @@ import { CommandSettings } from "../../../../config/command-settings.service.ts"
 import { renderGlamourTable } from "../../../../output/glamour-table.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { TelemetryState } from "../../../../telemetry/telemetry-state.service.ts";
-import { mapTargetError, rejectStackOutput } from "../stack.shared.ts";
+import { mapTargetError, rejectStackOutput } from "../../../../command-internal/stack-target.ts";
 import { StackCommandOutdatedError } from "./outdated.errors.ts";
 
 const status = (row: OutdatedService) =>
@@ -88,7 +88,8 @@ export const stackOutdated = Effect.fn("experimental.stack.outdated")(function*
     if (rows === undefined)
       return yield* new StackCommandOutdatedError({
         reason: "invalid-config",
-        message: "No supabase/config.toml in this project, so there is no lock to inspect.",
+        message:
+          "No supabase/config.toml, config.json or config.jsonc in this project, so there is no lock to inspect.",
         suggestion: "Run supabase init, then supabase start to create supabase/supabase.lock.",
       });
 
diff --git a/apps/cli/src/commands/experimental/stack/outdated/outdated.integration.test.ts b/apps/cli/src/commands/experimental/stack/outdated/outdated.integration.test.ts
index 7419567fc3..8041e8c950 100644
--- a/apps/cli/src/commands/experimental/stack/outdated/outdated.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/outdated/outdated.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { holdLock, readLock, writeLock } from "@supabase/stack/effect";
 import { catalogPins, type ServiceKind } from "@supabase/stack/internal/artifacts";
@@ -130,7 +130,7 @@ describe("experimental stack outdated", () => {
         expect(yield* fs.readFileString(lockPath(root))).toBe(written);
         expect(host.requests.filter((path) => path.endsWith(".tar.zst"))).toEqual([]);
         expect(host.requests.filter((path) => path.includes("/releases/rest-"))).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("reports a transient release failure on its row and still succeeds", () =>
@@ -149,7 +149,7 @@ describe("experimental stack outdated", () => {
       expect(output.stdoutText).toContain("probe failed");
       expect(output.stdoutText).toContain("auth:");
       expect(output.stdoutText).toContain(`${UPSTREAM}-r1`);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("reports a release outage on a linked entry as a failed probe and keeps its pin", () =>
@@ -200,7 +200,7 @@ describe("experimental stack outdated", () => {
         ]),
       });
       expect(yield* fs.readFileString(lockPath(root))).toBe(written);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails with guidance when the project has no lock yet", () =>
@@ -215,6 +215,6 @@ describe("experimental stack outdated", () => {
       expect(error).toMatchObject({ reason: "lock" });
       expect(yield* fs.exists(lockPath(root))).toBe(false);
       expect(yield* fs.exists(leasePath(root))).toBe(false);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/commands/experimental/stack/restart/restart.errors.ts b/apps/cli/src/commands/experimental/stack/restart/restart.errors.ts
index 86860a8389..09877afe86 100644
--- a/apps/cli/src/commands/experimental/stack/restart/restart.errors.ts
+++ b/apps/cli/src/commands/experimental/stack/restart/restart.errors.ts
@@ -6,7 +6,10 @@ import {
   ErrorActionabilityId,
   unclassifiedStackFailureActionability,
 } from "../../../../shared/telemetry/error-actionability.ts";
-import { type StackTargetIssue, stackTargetInvalidConfigActionability } from "../stack.shared.ts";
+import {
+  type StackTargetIssue,
+  stackTargetInvalidConfigActionability,
+} from "../../../../command-internal/stack-target.ts";
 
 export class StackCommandRestartError extends Data.TaggedError("ExperimentalStackRestartError")<{
   readonly reason: "flags" | "not-found" | "invalid-config" | "lifecycle" | "stack";
diff --git a/apps/cli/src/commands/experimental/stack/restart/restart.handler.ts b/apps/cli/src/commands/experimental/stack/restart/restart.handler.ts
index 2f8f123c1a..903e143b10 100644
--- a/apps/cli/src/commands/experimental/stack/restart/restart.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/restart/restart.handler.ts
@@ -11,7 +11,7 @@ import {
   rejectStackOutput,
   validateStackTarget,
   mapTargetError,
-} from "../stack.shared.ts";
+} from "../../../../command-internal/stack-target.ts";
 import { StackCommandRestartError } from "./restart.errors.ts";
 import type { StackRestartFlags } from "./restart.command.ts";
 
diff --git a/apps/cli/src/commands/experimental/stack/restart/restart.integration.test.ts b/apps/cli/src/commands/experimental/stack/restart/restart.integration.test.ts
index 90c1898a6e..aea20cb6c1 100644
--- a/apps/cli/src/commands/experimental/stack/restart/restart.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/restart/restart.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { StackError } from "@supabase/stack/effect";
 import { Deferred, Effect, Fiber, FileSystem, Layer, Option, Path, Schema, Stream } from "effect";
@@ -8,7 +8,11 @@ import {
   mockCommandSettings,
   mockTelemetryStateTracked,
 } from "../../../../../tests/helpers/command-mocks.ts";
-import { StackApi, stackApiLayer, stackTargetResolverLayer } from "../stack.shared.ts";
+import {
+  StackApi,
+  stackApiLayer,
+  stackTargetResolverLayer,
+} from "../../../../command-internal/stack-target.ts";
 import { stackRestart } from "./restart.handler.ts";
 import { destroyTestStack } from "../../../../../tests/helpers/stack-cleanup.ts";
 import { stackArtifactCacheRoot } from "../../../../../tests/helpers/stack-artifacts.ts";
@@ -16,7 +20,7 @@ import { selection } from "../../../../../tests/helpers/pins.ts";
 
 const live = Layer.provideMerge(
   stackApiLayer,
-  Layer.merge(BunServices.layer, FetchHttpClient.layer),
+  Layer.mergeAll(BunServices.layer, BunCrypto.layer, FetchHttpClient.layer),
 );
 const MailpitInfo = Schema.Struct({ RuntimeStats: Schema.Struct({ SMTPAccepted: Schema.Finite }) });
 
diff --git a/apps/cli/src/commands/experimental/stack/stack-backend.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-backend.integration.test.ts
index 3a11961858..7bbd180542 100644
--- a/apps/cli/src/commands/experimental/stack/stack-backend.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-backend.integration.test.ts
@@ -51,7 +51,7 @@ describe("resolveProjectStateSelection", () => {
     }),
   );
 
-  it.effect("selects the configured backend for top-level start, stop, and status", () => {
+  it.effect("selects the configured backend for managed local commands", () => {
     return withServices(
       Effect.gen(function* () {
         const root = yield* project(`project_id = "stack-routing-test"
@@ -82,10 +82,31 @@ stack = true
         expect(yield* resolve({ args: ["storage", "ls"], cwd: root, env: {} })).toBe("stack");
         expect(yield* resolve({ args: ["seed", "buckets"], cwd: root, env: {} })).toBe("stack");
         expect(yield* resolve({ args: ["services"], cwd: root, env: {} })).toBe("stack");
+        expect(yield* resolve({ args: ["logs"], cwd: root, env: {} })).toBeUndefined();
+        expect(yield* resolve({ args: ["logs", "sources"], cwd: root, env: {} })).toBeUndefined();
       }),
     );
   });
 
+  it.effect.each([
+    ["logs", "--service", "--sql"],
+    ["logs", "--search=--file"],
+    ["logs", "--remote"],
+    ["logs", "sources"],
+    ["help", "logs"],
+    ["__complete", "logs", "--"],
+  ])("defers local logs feature validation until after parsing %j", (args) =>
+    Effect.gen(function* () {
+      const selection = yield* select({
+        args,
+        cwd: "/missing",
+        env: { SUPABASE_EXPERIMENTAL_STACK: "invalid" },
+      });
+      expect(selection.stackBackend).toBeUndefined();
+      expect(selection.projectState?._tag).toBe("Failure");
+    }),
+  );
+
   it.effect("keeps storage on legacy when the feature flag is disabled", () => {
     return withServices(
       Effect.gen(function* () {
@@ -97,6 +118,15 @@ stack = true
             env: { SUPABASE_EXPERIMENTAL_STACK: "0" },
           }),
         ).toBe("legacy");
+        for (const args of [["logs"], ["logs", "sources"]]) {
+          expect(
+            yield* resolve({
+              args,
+              cwd: root,
+              env: { SUPABASE_EXPERIMENTAL_STACK: "0" },
+            }),
+          ).toBeUndefined();
+        }
       }),
     );
   });
@@ -106,6 +136,9 @@ stack = true
       Effect.gen(function* () {
         const root = yield* project("[experimental]\nstack = true\n");
         expect(yield* resolve({ args: ["link"], cwd: root, env: {} })).toBeUndefined();
+        expect(
+          yield* resolve({ args: ["logs", "--remote", "--sql", "select 1"], cwd: root, env: {} }),
+        ).toBeUndefined();
       }),
     );
   });
@@ -193,6 +226,21 @@ stack = true
     );
   });
 
+  it.effect("reads experimental.stack from a commented config.jsonc", () => {
+    return withServices(
+      Effect.gen(function* () {
+        const root = yield* project("[experimental]\nstack = false\n");
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        yield* fs.writeFileString(
+          path.join(root, "supabase", "config.jsonc"),
+          '{\n  // opt in\n  "experimental": { "stack": true, },\n}\n',
+        );
+        expect(yield* resolve({ args: ["start"], cwd: root, env: {} })).toBe("stack");
+      }),
+    );
+  });
+
   it.effect("rejects invalid overrides and bypasses malformed config", () => {
     return withServices(
       Effect.gen(function* () {
diff --git a/apps/cli/src/commands/experimental/stack/stack-command-telemetry.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-command-telemetry.integration.test.ts
index 2927d798ed..a05f8c6e0f 100644
--- a/apps/cli/src/commands/experimental/stack/stack-command-telemetry.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-command-telemetry.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { CliOutput, Command } from "effect/cli";
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
@@ -12,6 +12,7 @@ import {
   mockTty,
   processEnvLayer,
 } from "../../../../tests/helpers/mocks.ts";
+import { legacyProjectStateLayer } from "../../../shared/config/legacy-project-state.layer.ts";
 import { CliArgs } from "../../../shared/cli/cli-args.service.ts";
 import {
   DebugFlag,
@@ -28,7 +29,7 @@ import {
 } from "../../../shared/telemetry/event-catalog.ts";
 import { textCliOutputFormatter } from "../../../shared/output/text-formatter.ts";
 import { stackCommand } from "./stack.command.ts";
-import { stackStopAliasCommand } from "../../../cli/root.ts";
+import { rootCommandForFeatures, stackStopAliasCommand } from "../../../cli/root.ts";
 
 const setup = () =>
   Effect.gen(function* () {
@@ -44,6 +45,7 @@ const setup = () =>
       output,
       layer: Layer.mergeAll(
         BunServices.layer,
+        legacyProjectStateLayer.pipe(Layer.provide(BunServices.layer)),
         CliOutput.layer(textCliOutputFormatter()),
         output.layer,
         analytics.layer,
@@ -87,7 +89,7 @@ describe("stack command telemetry", () => {
           expect(event?.properties[PropCommandRunId]).toEqual(expect.any(String));
         }).pipe(Effect.provide(fixture.layer));
       }),
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 
@@ -116,7 +118,7 @@ describe("stack command telemetry", () => {
           );
         }).pipe(Effect.provide(fixture.layer));
       }),
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 
@@ -136,23 +138,26 @@ describe("stack command telemetry", () => {
           expect(event?.properties[PropCommand]).toBe("stack destroy");
         }).pipe(Effect.provide(fixture.layer));
       }),
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 
   it.effect("records the logs command identity when no stack exists", () => {
     return setup().pipe(
       Effect.flatMap((fixture) => {
-        const command = stackCommand.pipe(Command.provide(fixture.layer));
+        const command = rootCommandForFeatures({ stackBackend: "stack" }).pipe(
+          Command.provide(mockTty({ stdinIsTty: true, stdoutIsTty: false })),
+          Command.provide(fixture.layer),
+        );
         return Effect.gen(function* () {
           yield* Command.runWith(command, { version: "0.0.0-test" })(["logs"]).pipe(Effect.flip);
           const event = fixture.analytics.captured.find(
             (candidate) => candidate.event === EventCommandExecuted,
           );
-          expect(event?.properties[PropCommand]).toBe("stack logs");
+          expect(event?.properties[PropCommand]).toBe("logs");
         }).pipe(Effect.provide(fixture.layer));
       }),
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 
@@ -172,7 +177,7 @@ describe("stack command telemetry", () => {
           expect(event?.properties[PropCommand]).toBe("stack restart");
         }).pipe(Effect.provide(fixture.layer));
       }),
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
     );
   });
 });
diff --git a/apps/cli/src/commands/experimental/stack/stack-config-environment.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-config-environment.integration.test.ts
index 8c91786abb..29da32f8dc 100644
--- a/apps/cli/src/commands/experimental/stack/stack-config-environment.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-config-environment.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, FileSystem, Layer } from "effect";
 import type { ServiceCreationInput } from "@supabase/stack/effect";
@@ -17,13 +17,14 @@ const project = (
   createStackConfigProject(config, {
     prefix: "supabase-stack-config-env-",
     ...options,
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const load = (projectRoot: string) =>
   loadStackConfig(projectRoot).pipe(
     Effect.provide(
       Layer.mergeAll(
         BunServices.layer,
+        BunCrypto.layer,
         runtimeInfoLayer,
         mockCommandSettings({ workdir: projectRoot }),
         cliConfigValuesTestLayer,
@@ -50,7 +51,7 @@ describe("loadStackConfig environment overrides", () => {
       const config = yield* load(root);
       const creations = yield* config.creations("functions-env-malformed");
       expect(service(creations, "database")?.service).toBe("database");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("uses shell > supabase dotenv > project-root dotenv precedence", () =>
diff --git a/apps/cli/src/commands/experimental/stack/stack-config.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-config.integration.test.ts
index c1080a9e6f..697b22ae7f 100644
--- a/apps/cli/src/commands/experimental/stack/stack-config.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-config.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { orioledbVersions } from "@supabase/stack/internal/artifacts";
 import { afterEach, describe, expect, it, vi } from "@effect/vitest";
 import { DEFAULT_SIGNING_KEY } from "@supabase/stack/defaults";
@@ -30,6 +30,7 @@ const load = (projectRoot: string) =>
     Effect.provide(
       Layer.mergeAll(
         BunServices.layer,
+        BunCrypto.layer,
         runtimeInfoLayer,
         mockCommandSettings({ workdir: projectRoot }),
         cliConfigValuesTestLayer,
@@ -39,7 +40,14 @@ const load = (projectRoot: string) =>
 
 const project = (contents: string, options: Parameters<typeof createStackConfigProject>[1] = {}) =>
   createStackConfigProject(contents, options).pipe(
-    Effect.provide(Layer.mergeAll(BunServices.layer, runtimeInfoLayer, cliConfigValuesTestLayer)),
+    Effect.provide(
+      Layer.mergeAll(
+        BunServices.layer,
+        BunCrypto.layer,
+        runtimeInfoLayer,
+        cliConfigValuesTestLayer,
+      ),
+    ),
   );
 
 const publicJwkSchema = Schema.Struct({
@@ -166,7 +174,7 @@ enabled = true
       });
       expect(recipes.has("pgmeta")).toBe(true);
       expect(recipes.has("imgproxy")).toBe(true);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("hands Studio the API settings it mirrors and its snippets folder", () =>
@@ -186,7 +194,7 @@ max_rows = 250
         apiMaxRows: 250,
         cliVersion: CLI_VERSION,
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("leaves stack-opt-in init listeners automatic except disabled pooler", () =>
@@ -197,7 +205,7 @@ max_rows = 250
       expect(services.get("database")?.endpoints).toEqual({ sql: { port: "auto" } });
       expect(services.get("rest")?.endpoints).toEqual({ http: { port: "auto" } });
       expect(services.get("pooler")).toBeUndefined();
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("keeps the shared API port when REST is disabled", () =>
@@ -212,19 +220,107 @@ port = 55431
       expect(recipes.has("rest")).toBe(false);
       expect(recipes.get("auth")?.endpoints).toEqual({ http: { port: 55431 } });
       expect(recipes.get("storage")?.endpoints).toEqual({ http: { port: 55431 } });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
-  it.effect("rejects Auth email template content paths deferred by the stack", () =>
+  it.effect("resolves Auth template and enabled notification files for the stack", () =>
     Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
       const root = yield* project(`project_id = "stack-config-auth-template"
 [auth.email.template.invite]
-content_path = "./templates/invite.html"
+subject = "Join us"
+content_path = "./supabase/templates/invite.html"
+[auth.email.notification.password_changed]
+enabled = true
+subject = "Changed"
+content_path = "./templates/password_changed.txt"
+[auth.email.notification.email_changed]
+enabled = false
+content_path = "./supabase/templates/disabled.html"
 `);
-      const exit = yield* load(root).pipe(Effect.exit);
-      expect(Exit.isFailure(exit)).toBe(true);
-      if (Exit.isFailure(exit)) expect(String(exit.cause)).toContain("auth.email");
-    }).pipe(Effect.provide(BunServices.layer)),
+      const templates = path.join(root, "supabase", "templates");
+      yield* fs.makeDirectory(templates);
+      yield* fs.writeFileString(path.join(templates, "invite.html"), "invite");
+      yield* fs.writeFileString(path.join(templates, "password_changed.txt"), "changed");
+
+      const config = yield* load(root);
+      const auth = byService(yield* config.creations("stack-auth-template")).get("auth");
+      if (auth?.service !== "auth") return yield* Effect.die("Auth creation missing");
+
+      expect(auth.config.templates).toEqual([
+        { id: "invite", path: path.join(templates, "invite.html"), root },
+        {
+          id: "password_changed_notification",
+          path: path.join(templates, "password_changed.txt"),
+          root,
+        },
+      ]);
+      expect(auth.config.settings?.email?.template.invite?.subject).toBe("Join us");
+      expect(auth.config.settings?.email?.notification.password_changed?.subject).toBe("Changed");
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.effect(
+    "keeps an in-root symlinked Auth template, refuses an escaping one, and leaves a missing one to the start check",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const missing = yield* project(`project_id = "stack-config-auth-template-missing"
+[auth.email.template.invite]
+content_path = "./supabase/templates/missing.html"
+`);
+        const unread = byService(yield* (yield* load(missing)).creations("stack-auth-missing"));
+        expect(unread.get("auth")).toMatchObject({
+          config: { templates: [{ id: "invite" }] },
+        });
+
+        const linked = yield* project(`project_id = "stack-config-auth-template-link"
+[auth.email.template.invite]
+content_path = "./supabase/templates/invite.html"
+`);
+        yield* fs.makeDirectory(path.join(linked, "supabase", "templates"));
+        yield* fs.writeFileString(path.join(linked, "shared.html"), "shared");
+        yield* fs.writeFileString(path.join(linked, "retargeted.html"), "retargeted");
+        const link = path.join(linked, "supabase", "templates", "invite.html");
+        yield* fs.symlink("../../shared.html", link);
+        const kept = byService(yield* (yield* load(linked)).creations("stack-auth-link"));
+        expect(kept.get("auth")).toMatchObject({
+          config: { templates: [{ id: "invite", path: link, root: linked }] },
+        });
+        /* The stack reads the configured path per fetch, so a retargeted link serves its new file. */
+        yield* fs.remove(link);
+        yield* fs.symlink("../../retargeted.html", link);
+        const auth = kept.get("auth");
+        const served = auth?.service === "auth" ? auth.config.templates?.[0]?.path : undefined;
+        expect(yield* fs.readFileString(served ?? "")).toBe("retargeted");
+
+        const escaping = yield* project(`project_id = "stack-config-auth-template-escape"
+[auth.email.notification.password_changed]
+enabled = true
+content_path = "./supabase/link.html"
+`);
+        const outside = path.join(yield* fs.makeTempDirectoryScoped(), "outside.html");
+        yield* fs.writeFileString(outside, "outside");
+        yield* fs.symlink(outside, path.join(escaping, "supabase", "link.html"));
+        const config = yield* load(escaping);
+        const failure = yield* Effect.flip(config.creations("stack-auth-template-escape"));
+        expect(failure.message).toContain("resolves outside the project root");
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.effect("ignores Auth template files while Auth is disabled", () =>
+    Effect.gen(function* () {
+      const root = yield* project(`project_id = "stack-config-auth-template-disabled"
+[auth]
+enabled = false
+[auth.email.template.invite]
+content_path = "./supabase/templates/missing.html"
+`);
+      const config = yield* load(root);
+      expect(byService(yield* config.creations("stack-auth-disabled")).has("auth")).toBe(false);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("validates enabled Auth third-party providers", () =>
@@ -237,7 +333,7 @@ project_id = ""
       const exit = yield* load(root).pipe(Effect.exit);
       expect(Exit.isFailure(exit)).toBe(true);
       if (Exit.isFailure(exit)) expect(String(exit.cause)).toContain("auth.third_party");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("loads an empty signing-key file and skips it when Auth is disabled", () =>
@@ -289,7 +385,7 @@ signing_keys_path = "./missing-keys.json"
       expect(envKeys.publicSigningKeys).toBe(disabledKeys.publicSigningKeys);
       expect(envKeys.anonKey).toBeDefined();
       expect(envKeys.serviceRoleKey).toBeDefined();
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fetches third-party JWKS while Auth is disabled", () =>
@@ -337,7 +433,7 @@ issuer_url = ""
       const emptyIssuerKeys = yield* (yield* load(emptyIssuer)).keys;
       expect(emptyIssuerKeys.remoteJwks).toBeUndefined();
       expect(paths).toEqual(["/.well-known/openid-configuration", "/jwks"]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects an analytics backend the stack cannot represent", () =>
@@ -351,7 +447,7 @@ backend = "bigquery"
       expect(Exit.isFailure(exit)).toBe(true);
       if (Exit.isFailure(exit))
         expect(String(exit.cause)).toContain("analytics.backend must be postgres");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects unsupported database versions before creating recipes", () =>
@@ -364,7 +460,7 @@ major_version = 14
       expect(Exit.isFailure(exit)).toBe(true);
       if (Exit.isFailure(exit))
         expect(String(exit.cause)).toContain("db.major_version must be 15 or 17");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("ignores unresolved experimental S3 env placeholders", () => {
@@ -381,7 +477,7 @@ s3_secret_key = "env(S3_SECRET_KEY)"
       const config = yield* load(root);
       const services = yield* config.creations("stack-s3-placeholder");
       expect(services.some((service) => service.service === "database")).toBe(true);
-    }).pipe(Effect.provide(BunServices.layer));
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
   });
 
   it.effect(
@@ -419,7 +515,7 @@ s3_host = "s3.example.test"
           expect(String(orioledbS3Exit.cause)).toContain(
             "experimental.s3_host is unsupported by the experimental stack",
           );
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects the removed experimental.orioledb_version key and its env var", () =>
@@ -446,7 +542,7 @@ orioledb_version = "17.0.0.000"
         expect(String(envExit.cause)).toContain(
           "SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION (set in the shell environment) is no longer supported. Use SUPABASE_DB_ORIOLEDB_VERSION instead.",
         );
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("records OrioleDB selection on the command event before rejecting it", () =>
@@ -475,6 +571,6 @@ orioledb_version = "15.1.1.14"
       const accepted = yield* loadRecordingOrioleDb(standard);
       expect(Exit.isSuccess(accepted.exit)).toBe(true);
       expect(accepted.orioledb).toBe(false);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/commands/experimental/stack/stack-errors.unit.test.ts b/apps/cli/src/commands/experimental/stack/stack-errors.unit.test.ts
index cc6031d330..be233404ee 100644
--- a/apps/cli/src/commands/experimental/stack/stack-errors.unit.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-errors.unit.test.ts
@@ -10,7 +10,7 @@ import { FunctionsServeStackError } from "../../functions/serve/serve.errors.ts"
 import { classifyCliErrorActionability } from "../../../shared/telemetry/error-actionability.ts";
 import { StackCommandDestroyError } from "./destroy/destroy.errors.ts";
 import { StackCommandLogsError } from "./logs/logs.errors.ts";
-import { mapTargetError, StackTargetError } from "./stack.shared.ts";
+import { mapTargetError, StackTargetError } from "../../../command-internal/stack-target.ts";
 import { StackCommandStartError } from "./start/start.errors.ts";
 import { StackCommandStatusError } from "./status/status.errors.ts";
 
diff --git a/apps/cli/src/commands/experimental/stack/stack-forwarding.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-forwarding.integration.test.ts
index da0f5eaa9f..373dd0b694 100644
--- a/apps/cli/src/commands/experimental/stack/stack-forwarding.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-forwarding.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Redacted, Schema } from "effect";
 import { ServiceCreation } from "../../../../../../packages/stack/src/services/Catalog.ts";
@@ -16,6 +16,7 @@ import { cliConfigValuesTestLayer } from "../../../../tests/helpers/config-value
 
 const layer = Layer.mergeAll(
   BunServices.layer,
+  BunCrypto.layer,
   runtimeInfoLayer,
   mockCommandSettings({ workdir: "/unused-stack-forwarding-workdir" }),
   cliConfigValuesTestLayer,
@@ -221,6 +222,29 @@ SHARED = "encrypted:BOsrXIZY2BNTW43BeRhMbfvlOIUjwI7GCyFHxJD/Ik+UQ4mqkgVl2+61WWhE
     }).pipe(Effect.provide(layer)),
   );
 
+  it.effect("uppercases edge runtime secret names and drops unset ones", () =>
+    Effect.gen(function* () {
+      const root = yield* createStackConfigProject(
+        `project_id = "functions-secret-names"
+[edge_runtime.secrets]
+my_lower = "lower-value"
+FROM_ENV = "env(STACK_SECRET_SOURCE)"
+MISSING = "env(STACK_SECRET_UNSET)"
+EMPTY = ""
+supabase_internal_wallclock_limit_sec = "7"
+`,
+        { rootEnv: "STACK_SECRET_SOURCE=from-env\n" },
+      );
+      const config = yield* loadStackConfig(root);
+      const services = yield* config.creations("functions-secret-names");
+      expect(services.find((service) => service.service === "functions")?.config.env).toEqual({
+        MY_LOWER: "lower-value",
+        FROM_ENV: "from-env",
+        SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC: "7",
+      });
+    }).pipe(Effect.provide(layer)),
+  );
+
   it.effect("leaves empty configured secrets for the stack to normalize", () =>
     Effect.gen(function* () {
       const root = yield* createStackConfigProject(`project_id = "empty-secrets"
@@ -242,7 +266,10 @@ root_key = ""
     }).pipe(Effect.provide(layer)),
   );
 
-  it.effect("forwards Auth policies, providers and custom SMTP ahead of local mail", () =>
+  it.effect.each([
+    { secure_password_change: true, require_current_password: false },
+    { secure_password_change: false, require_current_password: true },
+  ])("forwards Auth policies, providers and custom SMTP ahead of local mail with %j", (policy) =>
     Effect.gen(function* () {
       const root = yield* createStackConfigProject(
         `project_id = "auth-forwarding"
@@ -264,7 +291,8 @@ sign_in_sign_ups = 33
 [auth.email]
 enable_confirmations = true
 double_confirm_changes = false
-secure_password_change = true
+secure_password_change = ${policy.secure_password_change}
+require_current_password = ${policy.require_current_password}
 otp_length = 8
 otp_expiry = 120
 max_frequency = "10s"
@@ -375,7 +403,12 @@ allow_dynamic_registration = true
         GOTRUE_RATE_LIMIT_OTP: "33",
         GOTRUE_MAILER_AUTOCONFIRM: "false",
         GOTRUE_MAILER_SECURE_EMAIL_CHANGE_ENABLED: "false",
-        GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION: "true",
+        GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION: String(
+          policy.secure_password_change,
+        ),
+        GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD: String(
+          policy.require_current_password,
+        ),
         GOTRUE_MAILER_OTP_LENGTH: "8",
         GOTRUE_MAILER_OTP_EXP: "120",
         GOTRUE_SMTP_MAX_FREQUENCY: "10s",
diff --git a/apps/cli/src/commands/experimental/stack/stack.command.ts b/apps/cli/src/commands/experimental/stack/stack.command.ts
index c2f54790e7..d8c2fa182f 100644
--- a/apps/cli/src/commands/experimental/stack/stack.command.ts
+++ b/apps/cli/src/commands/experimental/stack/stack.command.ts
@@ -20,7 +20,7 @@ import { stackRestartCommand as stackRestartCommandBase } from "./restart/restar
 import { stackInstallCommand as stackInstallCommandBase } from "./install/install.command.ts";
 import { stackOutdatedCommand as stackOutdatedCommandBase } from "./outdated/outdated.command.ts";
 import { stackUpdateCommand as stackUpdateCommandBase } from "./update/update.command.ts";
-import { stackApiLayer, stackTargetResolverLayer } from "./stack.shared.ts";
+import { stackApiLayer, stackTargetResolverLayer } from "../../../command-internal/stack-target.ts";
 import { configureLoopbackProxyBypass } from "../../../command-internal/hostname.ts";
 
 const stackCommandSettings = commandSettingsLayer.pipe(Layer.provide(debugLoggerLayer));
@@ -40,9 +40,6 @@ export const stackRuntimeLayer = Layer.mergeAll(
   telemetryStateLayer,
 );
 
-// Same static `HttpClient`/Management-API-factory requirement as `dbResetRuntimeLayer` in
-// `commands/db/reset/reset.layers.ts`; scoped to `start` so sibling stack subcommands don't
-// pick up its `--dns-resolver` requirement.
 const startCliSettings = commandSettingsLayer.pipe(Layer.provide(debugLoggerLayer));
 const startHttpClient = httpClientLayer.pipe(Layer.provide(debugLoggerLayer));
 const startCredentials = commandCredentialsLayer.pipe(
diff --git a/apps/cli/src/commands/experimental/stack/stack.flags.ts b/apps/cli/src/commands/experimental/stack/stack.flags.ts
index 0ca89073a1..91c4aaf127 100644
--- a/apps/cli/src/commands/experimental/stack/stack.flags.ts
+++ b/apps/cli/src/commands/experimental/stack/stack.flags.ts
@@ -3,7 +3,7 @@ import { Flag } from "effect/cli";
 /** Fails instead of resolving when `supabase/supabase.lock` is missing or stale. */
 export const frozenFlag = Flag.Boolean("frozen").pipe(
   Flag.withDescription(
-    "Fail instead of updating supabase/supabase.lock when it is missing or out of date with config.toml. Implied when CI is set and the lock exists.",
+    "Fail instead of updating supabase/supabase.lock when it is missing or out of date with the project config file. Implied when CI is set and the lock exists.",
   ),
   Flag.withDefault(false),
 );
diff --git a/apps/cli/src/commands/experimental/stack/stack.shared.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack.shared.integration.test.ts
index 030bbebe9e..3526059e65 100644
--- a/apps/cli/src/commands/experimental/stack/stack.shared.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack.shared.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Path, Ref } from "effect";
 import {
@@ -7,7 +7,7 @@ import {
   StackTargetResolver,
   stackApiLayer,
   stackTargetResolverLayer,
-} from "./stack.shared.ts";
+} from "../../../command-internal/stack-target.ts";
 import { mockCommandSettings } from "../../../../tests/helpers/command-mocks.ts";
 import {
   CommandTelemetryAttributes,
@@ -79,7 +79,7 @@ describe("stack target resolver", () => {
         runtime: "native",
         hostRunning: false,
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects an id prefix that several readable or unreadable saved stacks share", () =>
@@ -110,7 +110,7 @@ describe("stack target resolver", () => {
       expect(failure.message).toContain(id);
       expect(failure.message).toContain(twin);
       expect(failure.message).toContain(broken);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects a stack id shorter than four characters", () =>
@@ -126,7 +126,7 @@ describe("stack target resolver", () => {
 
       expect(failure.reason).toBe("flags");
       expect(failure.message).toContain("prefix of at least 4 characters");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects an explicit id when its saved runtime differs", () =>
@@ -144,7 +144,7 @@ describe("stack target resolver", () => {
       expect(failure.message).toContain("existing stack runtime docker");
       expect(failure.suggestion).toContain("--runtime auto");
       expect(failure.suggestion).toContain("different --stack name");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("selects the saved stack whose identity the project and stack name derive", () =>
@@ -157,7 +157,7 @@ describe("stack target resolver", () => {
 
       expect(target).toMatchObject({ projectRoot: root, id, name: "feature" });
       expect(target.definition?.identity.stackName).toBe("feature");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("records the saved stack's runtime on the command event", () =>
@@ -173,7 +173,7 @@ describe("stack target resolver", () => {
       );
 
       expect((yield* Ref.get(recorded)).stack_runtime).toBe("docker");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("reports no id when the project has no saved stack", () =>
@@ -183,7 +183,7 @@ describe("stack target resolver", () => {
       const target = yield* resolve({ projectRoot: root, runtime: "docker" });
 
       expect(target).toEqual({ projectRoot: root, runtime: "docker", hostRunning: false });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("carries an explicit Podman runtime onto a new stack target and records it", () =>
@@ -199,7 +199,7 @@ describe("stack target resolver", () => {
 
       expect(target).toEqual({ projectRoot: root, runtime: "podman", hostRunning: false });
       expect((yield* Ref.get(recorded)).stack_runtime).toBe("podman");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("returns the canonical project root for a new stack reached through a symlink", () =>
@@ -214,7 +214,7 @@ describe("stack target resolver", () => {
 
       expect(target.projectRoot).toBe(root);
       expect(target.id).toBeUndefined();
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("surfaces an unreadable saved stack instead of reporting it missing", () =>
@@ -230,7 +230,7 @@ describe("stack target resolver", () => {
       expect(failure).toBeInstanceOf(StackTargetError);
       expect(failure).toMatchObject({ reason: "invalid-config", targetIssue: "stack-lookup" });
       expect(failure.message).toContain(id);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -264,7 +264,7 @@ describe("stack target resolver", () => {
             `Remove its directory ${path.join(home, "stacks", id)}`,
           );
         }
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("reports a stack registry that cannot be listed for an id prefix", () =>
@@ -280,7 +280,7 @@ describe("stack target resolver", () => {
       );
 
       expect(failure).toMatchObject({ reason: "invalid-config", targetIssue: "stack-discovery" });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("reports a missing project root as the project root, not as a stack lookup", () =>
@@ -294,7 +294,7 @@ describe("stack target resolver", () => {
       }).pipe(Effect.flip);
 
       expect(failure).toMatchObject({ reason: "invalid-config", targetIssue: "project-root" });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("surfaces an unreadable saved stack that an id prefix selects", () =>
@@ -313,7 +313,7 @@ describe("stack target resolver", () => {
 
       expect(failure).toMatchObject({ reason: "invalid-config", targetIssue: "unreadable-stack" });
       expect(failure.message).toContain(`Stack ${id} could not be read`);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
 
@@ -341,6 +341,6 @@ describe("stack API layer", () => {
       expect(discovered[0]?.definition.id).toBe(created.id);
       expect(discovered[0]?.host).toBeUndefined();
       expect(opened.id).toBe(created.id);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/commands/experimental/stack/start/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/start/SIDE_EFFECTS.md
index e77c42a8da..4ff7cb17c8 100644
--- a/apps/cli/src/commands/experimental/stack/start/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/start/SIDE_EFFECTS.md
@@ -24,15 +24,33 @@ S3 protocol/vector controls are forwarded to their services. Storage receives th
 keys and region, and uses the gateway's `/storage/v1` prefix to verify S3 signatures and to build
 resumable upload URLs. `analytics.vector_port` and `SUPABASE_ANALYTICS_VECTOR_PORT` are accepted
 and ignored: the stack runs no Vector service.
-Encrypted JWT secrets are decrypted before shared credentials are derived, and encrypted
-`[edge_runtime.secrets]` values are decrypted before they reach the Functions service. `db.health_timeout`
+Encrypted JWT secrets are decrypted before shared credentials are derived. `[edge_runtime.secrets]`
+names are uppercased, empty or unresolved `env()` values and `SUPABASE_`-prefixed names are dropped,
+and encrypted values are decrypted before they reach the Functions service. `db.health_timeout`
 controls database readiness; package JWT and PostgreSQL root-key defaults apply when omitted, and
 the effective root key is supplied through a stack-owned key file.
 Studio receives the database connection, the Functions management directory/URL, and Analytics
 credentials when present. Starting with Studio creates `supabase/snippets/`, where Studio saves SQL
 snippets.
-Email template `content_path` values and third-party identity providers remain unsupported: they
-require template serving and shared external JWKS verification respectively.
+Third-party identity providers remain unsupported: they require shared external JWKS verification.
+While Auth is enabled, every `auth.email.template.*` and enabled `auth.email.notification.*`
+`content_path` is held inside the project root, and start reads each one before launch through the
+shared `config.toml` check, because Auth mails its built-in template when a fetch fails. While the
+stack runs, the owner process serves those files at `/email/<id>` on the shared API listener, with
+no new listener or port. Auth gets that address on its runtime host with a random token generated at
+every `stack start`. The route answers only GET on the configured paths with that token, as
+`text/plain` with `nosniff` and no CORS header, and reads the file on every request: the stack
+resolves the configured path on every fetch, so an in-root symlink is served and retargeting it
+applies at the next fetch, and the resolved file must be a regular file inside the project root,
+else 404. The route is as reachable as the API port: Docker and Podman stacks listen on every
+interface, so a LAN peer gets 404 without the token, and native stacks listen on loopback only. The
+token limits who can fetch template source through this route; it does not make template text
+private. A failed fetch or parse puts the token in Auth's logs, masked in shipped Analytics events
+but not in `stack logs`, and a caller reaching the API and Mailpit ports can have a rendered
+template mailed and read it there. A changed `content_path` applies after stop and start. Auth
+sleeps after 60 s idle unless the stack started with `--eager`, and each wake refetches. A replaced
+file reaches mail at the next wake, or once Auth's template cache expires. A deleted file mails
+Auth's cached copy until the next wake, then the built-in template.
 `db.orioledb_version` (or `SUPABASE_DB_ORIOLEDB_VERSION`) is a `local.services.database.version`
 request for that OrioleDB build instead of the stock major, resolved like any other version (see
 "Service versions and the lock"); the two keys must agree when both are set, and `db.major_version`
@@ -64,7 +82,9 @@ secret key (`sb_secret_…`) or a JWT, values that themselves carry such a pair
 URL with a token), and URL userinfo.
 
 Public ports are reserved in one SQLite registry per OS user at `<passwd home>/.supabase/ports.sqlite`,
-which `$SUPABASE_HOME` does not affect and which has no override. A stopped stack's automatic
+which `$SUPABASE_HOME` does not affect and which has no override. The registry uses SQLite's WAL
+mode, so `<passwd home>/.supabase` must be on a local filesystem, and `ports.sqlite-wal` and
+`ports.sqlite-shm` sit next to it while a connection is open. A stopped stack's automatic
 ports stay reserved across every other stack's starts, including in a different state root, and
 starting it again reuses the same ports. A configured port is reserved only while its listener is
 open, so a stopped stack never blocks another project's configured port; a configured port takes
@@ -118,12 +138,14 @@ Changes to activation policy take effect after stopping and starting the stack,
 later invocation omits an earlier `--eager` flag. `--preparation` selects on-demand or background
 artifact preparation.
 
-When Functions is selected, the CLI reads and validates `supabase/functions/.env`, ignoring reserved
-`SUPABASE_*` entries. `edge_runtime.secrets` overrides that file, while `functions.<name>.env`
-provides per-function values from project environment references. Per-function enabled/JWT policies,
-entrypoints, import maps and static files are forwarded to the worker bootstrap. Without a
-configured `import_map`, a function uses its own `deno.json` or `deno.jsonc`; a per-function
-`import_map.json` is not read. Configured paths
+When Functions is selected, the CLI reads and validates `supabase/functions/.env` like legacy
+`start`, skipping reserved `SUPABASE_*` entries with a warning. That file overrides
+`edge_runtime.secrets`, per-function `.env` files are not read, and `functions.<name>.env`
+provides per-function values from project environment references. Multiline values are supported.
+`--debug` runs the Functions runtime verbose; `status` does not report it as drift. Per-function
+enabled/JWT policies, entrypoints, import maps and static files are forwarded to the worker
+bootstrap. Without a configured `import_map`, a function uses its own `deno.json` or `deno.jsonc`; a
+per-function `import_map.json` is not read. Configured paths
 are relative to `supabase/` and must remain within the project; Docker mounts that project read-only.
 The inspector port is retained as an endpoint intent and does not enable debugging by itself.
 Running start calls do not refresh Functions from changed project files; stop the stack and start
@@ -208,7 +230,7 @@ the bundled versions in both cases.
 advising to run `supabase start` locally and commit the lock. When the `CI` environment variable is
 set (not empty, `false` or `0`) and a lock exists, the start is frozen without the flag. A frozen
 start, explicit or by `CI`, of a project with a lock but no `supabase/config.toml` fails with
-`supabase/config.toml not found`, since the lock cannot be checked, instead of using the bundled
+`supabase/config.toml, config.json or config.jsonc not found`, since the lock cannot be checked, instead of using the bundled
 versions; with no lock and no config, `--frozen` fails with `supabase/supabase.lock not found`. A CI
 start with no lock resolves and writes it, then warns to commit it. A lock that is not valid JSON, does
 not match the format or is of a newer format version always fails, frozen or not; the first of
@@ -257,7 +279,7 @@ again in halves; one that is still not stored on its own is skipped with a warni
 stored a later request, and kept otherwise. NUL characters and unpaired
 surrogates in shipped lines are replaced with U+FFFD. Shipping never wakes Analytics
 and does not count as idle activity, so a lazy Analytics still stops on its idle timer while other
-services log. Service log streams and `supabase stack logs` are never blocked by shipping.
+services log. Service log streams and `supabase logs` are never blocked by shipping.
 
 After an explicit stop, start compares the project configuration with the saved composition through
 the stack package's composition plan, ignoring values the composition and stack credentials supply.
@@ -299,9 +321,9 @@ Initialized database data is reused only by a slim-services revision of the buil
 it: the same release line, PostgreSQL major and upstream version, with any `-rN` revision. Every
 start that finds initialized data checks this before preparing or launching the database. A
 different line, major or upstream version fails the start, naming the recorded and requested builds
-and advising to keep the data by pinning `[local.services.database] version = "<recorded build>"` in
-`supabase/config.toml`, with `[db] major_version` set to the recorded major when the major differs and
-any `[db] orioledb_version` removed when an OrioleDB build is requested, or to run `supabase stack destroy`, which permanently deletes the
+and advising to keep the data by pinning `local.services.database.version` to `"<recorded build>"` in
+your config file, with `db.major_version` set to the recorded major when the major differs and
+any `db.orioledb_version` removed when an OrioleDB build is requested, or to run `supabase stack destroy`, which permanently deletes the
 stack's local database data; data with no recorded identity offers only the destroy. A
 first start records its identity in `.supabase-database-identity.json` before initializing data, so
 a first start interrupted before readiness resumes only on that build; initialized data with no
@@ -310,8 +332,8 @@ Auth, Storage, Realtime, Analytics and the pooler own schemas in the database. T
 instance root records the newest upstream version of each in `schema-writers.json`, raised under a
 per-database lock before a service or its one-shot initialization command migrates. A start whose
 selected upstream is older than the recorded one fails, naming the version and advising to keep the
-data by pinning `[local.services.<service>] version = "<recorded version>"` in
-`supabase/config.toml`, or to run `supabase stack destroy` to recreate the stack. Versions order by their leading dotted number
+data by pinning `local.services.<service>.version` to `"<recorded version>"` in
+your config file, or to run `supabase stack destroy` to recreate the stack. Versions order by their leading dotted number
 (`v2.196.0`, `2026.10.05-sha-...`, `17.6.1.054`); a suffix is ignored and an unparseable version
 sorts oldest. Services without schemas (REST, imgproxy, Functions, Studio, pg-meta, mail) accept any
 version change. A missing record means no schema owner has migrated yet. Saving a snapshot stores
diff --git a/apps/cli/src/commands/experimental/stack/start/start-export-pointer.integration.test.ts b/apps/cli/src/commands/experimental/stack/start/start-export-pointer.integration.test.ts
index 2e4261f03f..e4aec80e9e 100644
--- a/apps/cli/src/commands/experimental/stack/start/start-export-pointer.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start-export-pointer.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { CliOutput, Command } from "effect/cli";
 import { Effect, Layer, Option, Redacted, Schema, Stream } from "effect";
@@ -25,7 +25,7 @@ import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
 import { textCliOutputFormatter } from "../../../../shared/output/text-formatter.ts";
 import { GLOBAL_FLAGS, WorkdirFlag } from "../../../../command-internal/global-flags.ts";
 import { CommandSettings } from "../../../../config/command-settings.service.ts";
-import { StackApi, StackTargetResolver } from "../stack.shared.ts";
+import { StackApi, StackTargetResolver } from "../../../../command-internal/stack-target.ts";
 import { stackStatusCommand } from "../status/status.command.ts";
 import { statusEnvPointer } from "./start-summary.format.ts";
 import { selection } from "../../../../../tests/helpers/pins.ts";
@@ -208,6 +208,7 @@ const runStatusEnv = (input: {
           explicitWorkdir: Option.isSome(workdirFlag),
           workdirEnvValue: Option.none(),
           userAgent: "SupabaseCLI/pointer-test",
+          apiMaxRetries: Option.none(),
         });
       }),
     );
@@ -231,6 +232,7 @@ const runStatusEnv = (input: {
       Effect.provide(
         Layer.mergeAll(
           BunServices.layer,
+          BunCrypto.layer,
           CliOutput.layer(textCliOutputFormatter()),
           output.layer,
           analytics.layer,
@@ -247,7 +249,7 @@ const runStatusEnv = (input: {
     return yield* Schema.decodeEffect(
       Schema.fromJsonString(Schema.Record(Schema.String, Schema.String)),
     )(output.rawChunks.map(({ text }) => text).join(""));
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 describe("stack start export pointer", () => {
   it.effect(
diff --git a/apps/cli/src/commands/experimental/stack/start/start.command.ts b/apps/cli/src/commands/experimental/stack/start/start.command.ts
index d87b1b8fdb..037a2e77f0 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.command.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.command.ts
@@ -50,7 +50,7 @@ export type StackStartFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const stackStartCommand = Command.make("start", config).pipe(
   Command.withDescription(
-    "Create or resume a managed local Supabase stack using supabase/config.toml when present. " +
+    "Create or resume a managed local Supabase stack using the project config file when present. " +
       "Without a config file, default settings are used and no file is created. " +
       "For a new stack, auto selects Docker when its engine is reachable, then Podman, then native on supported platforms; the choice is persisted for that stack. " +
       "Explicit runtime choices are honored. Values support explicit env(NAME) references and automatic SUPABASE_* overrides.",
diff --git a/apps/cli/src/commands/experimental/stack/start/start.e2e.test.ts b/apps/cli/src/commands/experimental/stack/start/start.e2e.test.ts
index 04aabe8cdd..01f3bd9df4 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.e2e.test.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.e2e.test.ts
@@ -557,6 +557,43 @@ describe("stack start (compiled e2e)", () => {
                 event.service === "database",
             ),
           ).toBe(true);
+          const unifiedHistory = yield* runSupabaseEffect(
+            [
+              "logs",
+              "--stack-id",
+              idText,
+              "--service",
+              "postgres",
+              "--since",
+              "start",
+              "--limit",
+              "1000",
+              "--output-format",
+              "json",
+            ],
+            stoppedOptions,
+          );
+          expect(
+            unifiedHistory.exitCode,
+            `stdout:\n${unifiedHistory.stdout}\nstderr:\n${unifiedHistory.stderr}`,
+          ).toBe(0);
+          const unifiedRecords = yield* Schema.decodeEffect(
+            Schema.fromJsonString(Schema.Array(Schema.JsonObject)),
+          )(unifiedHistory.stdout);
+          const retainedLine = unifiedRecords.find(
+            (record) =>
+              (record["kind"] === "stdout" || record["kind"] === "stderr") &&
+              typeof record["text"] === "string" &&
+              record["text"].length > 0,
+          );
+          expect(retainedLine).toMatchObject({
+            instanceId: databaseId,
+            service: "database",
+            launchId: expect.any(Number),
+            timestamp: expect.stringMatching(/^\d{4}-\d{2}-\d{2}T/u),
+            text: expect.any(String),
+            position: { generation: expect.any(Number), byteOffset: expect.any(Number) },
+          });
           const stoppedFollow = yield* runSupabaseEffect(
             [...stoppedLogsArgs, "--follow"],
             stoppedOptions,
diff --git a/apps/cli/src/commands/experimental/stack/start/start.errors.ts b/apps/cli/src/commands/experimental/stack/start/start.errors.ts
index ebb98ed577..5a35843c67 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.errors.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.errors.ts
@@ -6,7 +6,10 @@ import {
   ErrorActionabilityId,
   unclassifiedStackFailureActionability,
 } from "../../../../shared/telemetry/error-actionability.ts";
-import { type StackTargetIssue, stackTargetInvalidConfigActionability } from "../stack.shared.ts";
+import {
+  type StackTargetIssue,
+  stackTargetInvalidConfigActionability,
+} from "../../../../command-internal/stack-target.ts";
 
 /** The start check that rejected the project or saved stack configuration. */
 type StartConfigIssue =
diff --git a/apps/cli/src/commands/experimental/stack/start/start.gateway-cors.live.test.ts b/apps/cli/src/commands/experimental/stack/start/start.gateway-cors.live.test.ts
new file mode 100644
index 0000000000..76e2eca1f5
--- /dev/null
+++ b/apps/cli/src/commands/experimental/stack/start/start.gateway-cors.live.test.ts
@@ -0,0 +1,290 @@
+import { randomUUID } from "node:crypto";
+
+import { BunServices } from "@effect/platform-bun";
+import { Cause, Data, Effect, Exit, FileSystem, Layer, Path, Schedule, Schema } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import { describe, expect } from "vitest";
+
+import { overrideStackPorts } from "../../../../../tests/helpers/cli.ts";
+import { type LiveFixtures, test } from "../../../../../tests/helpers/live.ts";
+
+const STACK_TIMEOUT_MS = 15 * 60_000;
+const ALLOWED_ORIGIN = "https://app.example.com";
+const BLOCKED_ORIGIN = "https://evil.example.com";
+
+class GatewayCorsLiveError extends Data.TaggedError("GatewayCorsLiveError")<{
+  readonly message: string;
+}> {}
+
+const functionSource = `const allowedOrigin = ${JSON.stringify(ALLOWED_ORIGIN)};
+Deno.serve((req) => {
+  const allowed = req.headers.get("Origin") === allowedOrigin;
+  const headers = new Headers({ "Access-Control-Allow-Credentials": "true", Vary: "Origin" });
+  if (allowed) headers.set("Access-Control-Allow-Origin", allowedOrigin);
+  if (req.method === "OPTIONS") return new Response(null, { status: allowed ? 204 : 403, headers });
+  return new Response("ok", { headers });
+});
+`;
+
+const ApiKeysSchema = Schema.Array(
+  Schema.Struct({ api_key: Schema.optionalKey(Schema.NullOr(Schema.String)) }),
+);
+const StackStartSchema = Schema.Struct({
+  id: Schema.String,
+  env: Schema.Struct({ API_URL: Schema.String, PUBLISHABLE_KEY: Schema.String }),
+});
+
+const recordedHeaders = [
+  "access-control-allow-origin",
+  "access-control-allow-credentials",
+  "access-control-allow-methods",
+  "access-control-allow-headers",
+  "access-control-expose-headers",
+] as const;
+
+interface Probe {
+  readonly name: string;
+  readonly method: "GET" | "OPTIONS" | "POST";
+  readonly path: string;
+  readonly headers: Record<string, string>;
+}
+
+function gatewayProbes(slug: string, jwtSlug: string, key: string): ReadonlyArray<Probe> {
+  const preflight = {
+    "Access-Control-Request-Method": "POST",
+    "Access-Control-Request-Headers": "authorization, content-type",
+  };
+  const auth = { apikey: key, Authorization: `Bearer ${key}` };
+  return [
+    {
+      name: "OPTIONS function, blocked origin",
+      method: "OPTIONS",
+      path: `/functions/v1/${slug}`,
+      headers: { Origin: BLOCKED_ORIGIN, ...preflight },
+    },
+    {
+      name: "OPTIONS function, allowed origin",
+      method: "OPTIONS",
+      path: `/functions/v1/${slug}`,
+      headers: { Origin: ALLOWED_ORIGIN, ...preflight },
+    },
+    {
+      name: "POST function, blocked origin",
+      method: "POST",
+      path: `/functions/v1/${slug}`,
+      headers: { Origin: BLOCKED_ORIGIN, ...auth },
+    },
+    {
+      name: "POST function, allowed origin",
+      method: "POST",
+      path: `/functions/v1/${slug}`,
+      headers: { Origin: ALLOWED_ORIGIN, ...auth },
+    },
+    {
+      name: "POST missing function",
+      method: "POST",
+      path: `/functions/v1/${slug}-missing`,
+      headers: { Origin: BLOCKED_ORIGIN, ...auth },
+    },
+    {
+      name: "OPTIONS missing function",
+      method: "OPTIONS",
+      path: `/functions/v1/${slug}-missing`,
+      headers: { Origin: BLOCKED_ORIGIN, ...preflight },
+    },
+    {
+      name: "POST verify_jwt function, invalid Bearer",
+      method: "POST",
+      path: `/functions/v1/${jwtSlug}`,
+      headers: { Origin: BLOCKED_ORIGIN, apikey: key, Authorization: "Bearer invalid" },
+    },
+    {
+      name: "OPTIONS /rest/v1/, foreign origin",
+      method: "OPTIONS",
+      path: "/rest/v1/",
+      headers: { Origin: BLOCKED_ORIGIN, "Access-Control-Request-Method": "GET" },
+    },
+    {
+      name: "OPTIONS /rest/v1/ with request headers, foreign origin",
+      method: "OPTIONS",
+      path: "/rest/v1/cors_probe_missing",
+      headers: {
+        Origin: BLOCKED_ORIGIN,
+        "Access-Control-Request-Method": "POST",
+        "Access-Control-Request-Headers": "authorization, x-custom-header",
+      },
+    },
+    {
+      name: "GET missing table, foreign origin",
+      method: "GET",
+      path: "/rest/v1/cors_probe_missing",
+      headers: { Origin: BLOCKED_ORIGIN, ...auth },
+    },
+  ];
+}
+
+const runProbes = (baseUrl: string, probes: ReadonlyArray<Probe>) =>
+  Effect.forEach(probes, (probe) =>
+    Effect.gen(function* () {
+      const client = yield* HttpClient.HttpClient;
+      const response = yield* client.execute(
+        HttpClientRequest.make(probe.method)(`${baseUrl}${probe.path}`).pipe(
+          HttpClientRequest.setHeaders(probe.headers),
+        ),
+      );
+      yield* response.text;
+      return {
+        probe: probe.name,
+        status: response.status,
+        ...Object.fromEntries(
+          recordedHeaders
+            // PostgREST, not the gateway, sets expose-headers on REST responses.
+            .filter(
+              (name) =>
+                !(probe.path.startsWith("/rest/") && name === "access-control-expose-headers"),
+            )
+            .map((name) => [name, response.headers[name] ?? null]),
+        ),
+      };
+    }),
+  );
+
+const requireSuccess = (
+  result: { exitCode: number; stdout: string; stderr: string },
+  step: string,
+) =>
+  result.exitCode === 0
+    ? Effect.succeed(result.stdout)
+    : Effect.fail(
+        new GatewayCorsLiveError({
+          message: `${step} failed (exit ${result.exitCode}):\n${result.stdout}\n${result.stderr}`,
+        }),
+      );
+
+const stackEnv = { SUPABASE_EXPERIMENTAL_STACK: "1" };
+
+function startStack(cliEffect: LiveFixtures["cliEffect"]) {
+  return Effect.acquireRelease(
+    cliEffect(["stack", "start", "--runtime", "docker", "--eager", "--output-format", "json"], {
+      env: stackEnv,
+      exitTimeoutMs: STACK_TIMEOUT_MS,
+    }).pipe(
+      Effect.flatMap((result) => requireSuccess(result, "stack start")),
+      Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(StackStartSchema))),
+    ),
+    (stack) =>
+      cliEffect(["stack", "destroy", "--stack-id", stack.id, "--yes"], { env: stackEnv }).pipe(
+        Effect.flatMap((result) => requireSuccess(result, "stack destroy")),
+        Effect.orDie,
+      ),
+  );
+}
+
+function deployFunctions(cliEffect: LiveFixtures["cliEffect"], ref: string, slugs: string[]) {
+  const deleteAll = Effect.forEach(slugs, (slug) =>
+    cliEffect(["functions", "delete", slug, "--yes", `--remote=${ref}`]).pipe(
+      Effect.flatMap((result) =>
+        /not found|does not exist/iu.test(`${result.stdout}\n${result.stderr}`)
+          ? Effect.void
+          : requireSuccess(result, `functions delete ${slug}`),
+      ),
+      Effect.exit,
+    ),
+  ).pipe(
+    Effect.flatMap((exits) => {
+      const failures = exits.filter(Exit.isFailure);
+      return failures.length === 0
+        ? Effect.void
+        : Effect.die(new AggregateError(failures.map((exit) => Cause.squash(exit.cause))));
+    }),
+  );
+  return Effect.acquireRelease(Effect.void, () => deleteAll).pipe(
+    Effect.andThen(cliEffect(["functions", "deploy", "--yes", `--remote=${ref}`])),
+    Effect.flatMap((result) => requireSuccess(result, "functions deploy")),
+  );
+}
+
+describe("stack gateway CORS (live)", () => {
+  test(
+    "answers function and REST probes like the platform gateway",
+    { timeout: STACK_TIMEOUT_MS * 2 },
+    ({ cliEffect, project, workspace }) =>
+      Effect.runPromise(
+        Effect.scoped(
+          Effect.gen(function* () {
+            const fs = yield* FileSystem.FileSystem;
+            const path = yield* Path.Path;
+            const suffix = randomUUID().slice(0, 8);
+            const slug = `cors-probe-${suffix}`;
+            const jwtSlug = `cors-probe-jwt-${suffix}`;
+            for (const name of [slug, jwtSlug]) {
+              const directory = path.join(workspace.path, "supabase", "functions", name);
+              yield* fs.makeDirectory(directory, { recursive: true });
+              yield* fs.writeFileString(path.join(directory, "index.ts"), functionSource);
+            }
+            const configPath = path.join(workspace.path, "supabase", "config.toml");
+            yield* Effect.promise(() => overrideStackPorts(workspace.path));
+            const config = yield* fs.readFileString(configPath);
+            yield* fs.writeFileString(
+              configPath,
+              `${config.replace("[experimental]\n", "[experimental]\nstack = true\n")}\n[functions.${slug}]\nverify_jwt = false\n\n[functions.${jwtSlug}]\nverify_jwt = true\n`,
+            );
+
+            const keys = yield* cliEffect([
+              "projects",
+              "api-keys",
+              "--output",
+              "json",
+              `--remote=${project.ref}`,
+            ]).pipe(
+              Effect.flatMap((result) => requireSuccess(result, "projects api-keys")),
+              Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(ApiKeysSchema))),
+            );
+            const publishableKey = keys
+              .map((key) => key.api_key)
+              .find((key) => key?.startsWith("sb_publishable_"));
+            if (publishableKey == null) {
+              return yield* new GatewayCorsLiveError({ message: "no publishable key on project" });
+            }
+            const stagingUrl = project.functionsUrl.replace(/\/functions\/v1$/u, "");
+
+            yield* deployFunctions(cliEffect, project.ref, [slug, jwtSlug]);
+            const probes = gatewayProbes(slug, jwtSlug, publishableKey);
+            const readiness = probes.filter(
+              (probe) =>
+                probe.name === "POST function, allowed origin" ||
+                probe.name === "POST verify_jwt function, invalid Bearer",
+            );
+            // A fresh deploy can briefly answer 404 before the edge picks it up.
+            yield* runProbes(stagingUrl, readiness).pipe(
+              Effect.filterOrFail(
+                ([plain, jwt]) => plain?.status === 200 && jwt !== undefined && jwt.status !== 404,
+                (rows) =>
+                  new GatewayCorsLiveError({
+                    message: `functions not ready: ${JSON.stringify(rows)}`,
+                  }),
+              ),
+              Effect.retry({ schedule: Schedule.spaced("5 seconds"), times: 24 }),
+            );
+            const staging = yield* runProbes(stagingUrl, probes);
+
+            const stack = yield* startStack(cliEffect);
+            const local = yield* runProbes(
+              stack.env.API_URL,
+              gatewayProbes(slug, jwtSlug, stack.env.PUBLISHABLE_KEY),
+            );
+
+            expect(local).toEqual(staging);
+          }),
+        ).pipe(
+          Effect.provide(
+            Layer.mergeAll(
+              BunServices.layer,
+              FetchHttpClient.layer,
+              Layer.succeed(HttpClient.TracerPropagationEnabled, false),
+            ),
+          ),
+        ),
+      ),
+  );
+});
diff --git a/apps/cli/src/commands/experimental/stack/start/start.handler.ts b/apps/cli/src/commands/experimental/stack/start/start.handler.ts
index 5bc03323fb..5cd28a592a 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.handler.ts
@@ -14,7 +14,7 @@ import {
 } from "../stack-summary.ts";
 import { gray } from "../../../../command-internal/colors.ts";
 import { currentShellPlatform } from "../../../../command-internal/shell-quote.ts";
-import { withProjectFunctionsEnv } from "../../../../command-internal/stack-functions-env.ts";
+import { withProjectFunctionsConfig } from "../../../../command-internal/stack-functions-env.ts";
 import { statusEnvPointer } from "./start-summary.format.ts";
 import {
   automaticRuntimeNotice,
@@ -23,6 +23,7 @@ import {
   type StackRuntime,
 } from "../../../../command-internal/stack-runtime.ts";
 import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
+import type { ConfigFormat } from "@supabase/config/effect";
 import { Effect, FileSystem, Fiber, Match, Option, Path, Redacted, Ref, Schema } from "effect";
 import {
   apiRoute,
@@ -38,12 +39,18 @@ import {
 import { Output } from "../../../../shared/output/output.service.ts";
 import { MachineErrorContext } from "../../../../shared/output/machine-error-context.service.ts";
 import {
+  DebugFlag,
   OutputFlag,
   resolveExperimentalWithProjectEnv,
 } from "../../../../command-internal/global-flags.ts";
 import { CommandSettings } from "../../../../config/command-settings.service.ts";
 import { TelemetryState } from "../../../../telemetry/telemetry-state.service.ts";
-import { readDbToml } from "../../../../command-internal/db-config.toml-read.ts";
+import {
+  type ConfigFileRef,
+  DEFAULT_CONFIG_FILE,
+} from "../../../../command-internal/config-advice.ts";
+import { loadConfigFileRef } from "../../../../command-internal/config-file-ref.ts";
+import { readDbConfig } from "../../../../command-internal/db-config.read.ts";
 import { catalogDatabaseServices } from "../../../../command-internal/stack-catalog-setup.ts";
 import {
   applyStackWebhooksOnly,
@@ -83,7 +90,7 @@ import {
   mapTargetError,
   rejectStackOutput,
   validateStackTarget,
-} from "../stack.shared.ts";
+} from "../../../../command-internal/stack-target.ts";
 import type { StackStartFlags } from "./start.command.ts";
 import { StackCommandStartError } from "./start.errors.ts";
 import { STACK_START_EXCLUDABLE_CAPABILITIES } from "./start.options.ts";
@@ -122,7 +129,8 @@ const isRecord = (value: unknown): value is Readonly<Record<string, unknown>> =>
 const portConflictSuggestion = (
   conflict: StackError["conflict"],
   requested: ReadonlyArray<{ readonly service: string; readonly endpoints?: unknown }>,
-  portSaved = false,
+  portSaved: boolean,
+  configFile: ConfigFileRef,
 ): string | undefined => {
   if (conflict === undefined) return undefined;
   const settings = new Map<string, StackEndpointKey>();
@@ -136,23 +144,28 @@ const portConflictSuggestion = (
   }
   const [setting, ...rest] = settings.values();
   if (setting === undefined || rest.length > 0) return undefined;
-  const choice = `Set \`${setting.path}\` in supabase/config.toml (or ${setting.env[0]}) to a free port.`;
+  const choice = `Set \`${setting.path}\` in ${configFile.path} (or ${setting.env[0]}) to a free port.`;
   return portSaved
     ? `${choice} The stack already saved this port (any previous automatic port is released), so the next start uses it once it is free.`
     : choice;
 };
 
+interface StackErrorOptions {
+  readonly portSaved?: boolean;
+  readonly configFile?: ConfigFileRef;
+}
+
 const stackError = (
   cause: { readonly message: string } & Partial<Pick<StackError, "outcomes" | "conflict">>,
   members: ReadonlyArray<{ readonly id?: string; readonly service: string }> = [],
   requested: ReadonlyArray<{ readonly service: string; readonly endpoints?: unknown }> = [],
-  portSaved = false,
+  { portSaved = false, configFile = DEFAULT_CONFIG_FILE }: StackErrorOptions = {},
 ) => {
   const detail = failedOutcomesDetail(cause, (id) => {
     const service = members.find((member) => member.id === id)?.service;
     return service === undefined ? id : `${service} (${id})`;
   });
-  const suggestion = portConflictSuggestion(cause.conflict, requested, portSaved);
+  const suggestion = portConflictSuggestion(cause.conflict, requested, portSaved, configFile);
   return new StackCommandStartError({
     reason: "stack",
     message: cause.message,
@@ -184,14 +197,13 @@ const stackAcquireError = (
     readonly creating: boolean;
     /** The creations the owner's startup re-plans, already saved when its claim fails. */
     readonly replanned?: ReadonlyArray<ServiceCreationInput>;
+    readonly configFile: ConfigFileRef;
   },
 ) => {
-  const base = stackError(
-    cause,
-    [],
-    runtimeContext.replanned,
-    runtimeContext.replanned !== undefined,
-  );
+  const base = stackError(cause, [], runtimeContext.replanned, {
+    portSaved: runtimeContext.replanned !== undefined,
+    configFile: runtimeContext.configFile,
+  });
   const { selectedRuntime } = runtimeContext;
   if (cause.reason !== "runtime-unavailable" || selectedRuntime === "native") return base;
   return new StackCommandStartError({
@@ -221,7 +233,7 @@ const loadStartConfig = Effect.fn("experimental.stack.start.loadConfig")(
       publishesLock: true,
     });
     const keys = yield* config.keys;
-    const toml = yield* readDbToml(fs, path, projectRoot);
+    const toml = yield* readDbConfig(fs, path, projectRoot);
     return { config, keys, toml };
   },
   Effect.mapError(
@@ -274,8 +286,9 @@ const majorVersionOf = (version: string): string => version.split(".")[0] ?? ver
 const orioledbVersionOf = (version: string): string =>
   isOrioledbVersion(version) ? orioledbConfigVersion(version) : "unset";
 
-/** Renders a dotted config key as its `config.toml` section/key pair, e.g. `[db] major_version`. */
-const formatConfigPath = (path: string): string => {
+/** Renders a dotted config key as its TOML section/key pair, e.g. `[db] major_version`; JSON keeps the dotted path. */
+const formatConfigPath = (path: string, format: ConfigFormat): string => {
+  if (format === "json") return path;
   const segments = path.split(".");
   const key = segments.pop();
   return `[${segments.join(".")}] ${key}`;
@@ -285,17 +298,18 @@ const formatConfigPath = (path: string): string => {
 const settingKeyLabel = (
   setting: StackEndpointKey,
   originAt: CliConfigMaterialized["originAt"],
+  format: ConfigFormat,
 ): string => {
   const { tier } = originAt(setting.path);
   return tier === "shell" || tier === "projectEnv"
-    ? (setting.env[0] ?? formatConfigPath(setting.path))
-    : formatConfigPath(setting.path);
+    ? (setting.env[0] ?? formatConfigPath(setting.path, format))
+    : formatConfigPath(setting.path, format);
 };
 
 /**
  * One setting behind an incompatible path, reported as the JSON/stream-json error envelope's
  * `stack_changes` entries (contract documented in `SIDE_EFFECTS.md`). `editable` marks whether `key` is a
- * `config.toml` key or env var the user can revert, or plain wording otherwise.
+ * config key or env var the user can revert, or plain wording otherwise.
  */
 interface StructuredSettingChange {
   readonly service: string;
@@ -313,6 +327,7 @@ const describeSettingChange = (
   requestedCreation: ServiceCreationInput | undefined,
   originAt: CliConfigMaterialized["originAt"],
   databaseFromServices: boolean,
+  format: ConfigFormat,
 ): StructuredSettingChange | ReadonlyArray<StructuredSettingChange> => {
   if (service === "database" && path === "pin") {
     const savedVersion = databaseVersionOf(savedCreation);
@@ -326,7 +341,7 @@ const describeSettingChange = (
         {
           service,
           path,
-          key: "[local.services.database] version",
+          key: formatConfigPath("local.services.database.version", format),
           saved: databaseReleaseOf(savedCreation),
           requested: databaseReleaseOf(requestedCreation),
           editable: true,
@@ -337,7 +352,7 @@ const describeSettingChange = (
       changes.push({
         service,
         path,
-        key: settingKeyLabel(stackMajorVersionKey, originAt),
+        key: settingKeyLabel(stackMajorVersionKey, originAt, format),
         saved: savedMajor,
         requested: requestedMajor,
         editable: true,
@@ -346,7 +361,7 @@ const describeSettingChange = (
       changes.push({
         service,
         path,
-        key: settingKeyLabel(CliConfigKeys.db.orioledbVersion, originAt),
+        key: settingKeyLabel(CliConfigKeys.db.orioledbVersion, originAt, format),
         saved: savedOrioledb,
         requested: requestedOrioledb,
         // A catalog upgrade can retire the saved build, which the config then rejects.
@@ -360,12 +375,12 @@ const describeSettingChange = (
     return {
       service,
       path,
-      key: settingKeyLabel(setting, originAt),
+      key: settingKeyLabel(setting, originAt, format),
       saved: endpointPortLabel(savedCreation?.endpoints, endpointName),
       requested: endpointPortLabel(requestedCreation?.endpoints, endpointName),
       editable: true,
     };
-  // No config.toml key or env var covers this path: name it plainly instead of implying a
+  // No config key or env var covers this path: name it plainly instead of implying a
   // setting the user could edit.
   return {
     service,
@@ -391,6 +406,7 @@ const incompatibleSettingChanges = (
   requested: ReadonlyArray<ServiceCreationInput>,
   originAt: CliConfigMaterialized["originAt"],
   databaseFromServices: boolean,
+  format: ConfigFormat,
 ): ReadonlyArray<StructuredSettingChange> =>
   planned
     .filter((entry) => entry.member && entry.change === "incompatible")
@@ -405,6 +421,7 @@ const incompatibleSettingChanges = (
               requested.find((creation) => creation.service === entry.service),
               originAt,
               databaseFromServices,
+              format,
             ),
           )
         : [],
@@ -450,6 +467,7 @@ const incompatibleChange = (
   requested: ReadonlyArray<ServiceCreationInput>,
   originAt: CliConfigMaterialized["originAt"],
   databaseFromServices: boolean,
+  format: ConfigFormat,
   stackIdentity: { readonly id: string; readonly name?: string },
   ownerLive: boolean,
 ):
@@ -466,6 +484,7 @@ const incompatibleChange = (
     requested,
     originAt,
     databaseFromServices,
+    format,
   );
   if (changes.length === 0) return undefined;
   const lines = settingChangeLines(changes);
@@ -559,6 +578,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
     const resolver = yield* StackTargetResolver;
     const stackApi = yield* StackApi;
     const outputFlag = yield* Effect.serviceOption(OutputFlag);
+    const debug = yield* DebugFlag;
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
     yield* rejectStackOutput(outputFlag).pipe(
@@ -577,6 +597,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
         runtime: flags.runtime,
       })
       .pipe(Effect.mapError(mapTargetError((props) => new StackCommandStartError(props))));
+    const configFile = yield* loadConfigFileRef(target.projectRoot);
     const runtime = yield* RuntimeInfo;
     const selectedRuntime = yield* selectStackRuntime(target.runtime).pipe(
       Effect.mapError(
@@ -617,6 +638,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
     const resolveRequested = (
       stackId: string,
       config: Effect.Success<ReturnType<typeof loadStartConfig>>["config"],
+      warn = true,
     ) =>
       Effect.gen(function* () {
         const creations = yield* config.creations(stackId).pipe(
@@ -630,9 +652,8 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
               }),
           ),
         );
-        return yield* Effect.forEach(
-          selectedCreations(creations, exclusions),
-          withProjectFunctionsEnv,
+        return yield* Effect.forEach(selectedCreations(creations, exclusions), (creation) =>
+          withProjectFunctionsConfig(creation, { warn, debug }),
         ).pipe(
           Effect.mapError(
             (cause) =>
@@ -655,7 +676,9 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
     const resolveForReplan = (stackId: string) =>
       Effect.gen(function* () {
         const loaded = yield* startConfig;
-        return yield* resolveRequested(stackId, loaded.config);
+        /* A running owner ignores these creations, so this resolve stays silent. A start that
+           applies the env under that owner resolves it again below and warns there. */
+        return yield* resolveRequested(stackId, loaded.config, !target.hostRunning);
       });
     const requestedForReplan =
       target.id === undefined
@@ -707,6 +730,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
           selectedRuntime,
           runtime,
           creating: target.id === undefined,
+          configFile,
           ...(requestedForReplan === undefined ? {} : { replanned: requestedForReplan }),
         }),
       ),
@@ -855,9 +879,13 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
         suggestion: "Destroy the standalone database before starting this stack.",
       });
     const { config, keys, toml } = yield* startConfig;
-    // Reuses the creations already resolved for the re-plan above instead of reading the
-    // Functions dotenv a second time; only a new or already-running stack has none yet.
-    const requested = requestedForReplan ?? (yield* resolveRequested(stack.id, config));
+    // Reuses the creations resolved for a fresh owner's re-plan above instead of reading the
+    // Functions dotenv a second time. A new stack has none yet, and a live owner's were resolved
+    // silently, so both resolve here with warnings.
+    const requested =
+      requestedForReplan === undefined || target.hostRunning
+        ? yield* resolveRequested(stack.id, config)
+        : requestedForReplan;
     if (studioNeedsRest(requested))
       return yield* new StackCommandStartError({
         reason: "flags",
@@ -934,6 +962,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
       requested,
       config.originAt,
       databasePublishedBy(config.source),
+      configFile.format,
       stackIdentity,
       target.hostRunning,
     );
@@ -993,7 +1022,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
       })
       .pipe(
         Effect.tapError((error) => starting.fail(error.message)),
-        Effect.mapError((error) => stackError(error, requested, requested)),
+        Effect.mapError((error) => stackError(error, requested, requested, { configFile })),
       );
     if (initialComposition) {
       const existingIds = new Set(existingServices.map(({ id }) => id));
@@ -1119,13 +1148,14 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
             resolvedConfig: { config: context.config, document: context.document },
             projectEnvValues: toml.projectEnv,
             workdir: target.projectRoot,
+            configFile,
           }).pipe(Effect.mapError(stackError));
         }
       }
     }
     yield* stack.composition.start.pipe(
       Effect.tapError((error) => starting.fail(error.message)),
-      Effect.mapError((error) => stackError(error, members, requested)),
+      Effect.mapError((error) => stackError(error, members, requested, { configFile })),
     );
     yield* Effect.forEach(preparation, (fiber) => Fiber.join(fiber));
     yield* Ref.set(startupComplete, true);
diff --git a/apps/cli/src/commands/experimental/stack/start/start.integration.test.ts b/apps/cli/src/commands/experimental/stack/start/start.integration.test.ts
index bd63302008..c45503a16f 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.integration.test.ts
@@ -1,5 +1,5 @@
 import { generateKeyPairSync } from "node:crypto";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   ConfigProvider,
@@ -9,6 +9,7 @@ import {
   FileSystem,
   Layer,
   Option,
+  Path,
   Redacted,
   Schema,
   Sink,
@@ -78,7 +79,7 @@ import {
 } from "../../../../command-internal/db-connection.service.ts";
 import { writeProjectLink } from "../../../../shared/config/project-link.ts";
 import { StackCatalogSetup } from "../../../../command-internal/stack-catalog-setup.ts";
-import { ExperimentalFlag, YesFlag } from "../../../../command-internal/global-flags.ts";
+import { DebugFlag, ExperimentalFlag, YesFlag } from "../../../../command-internal/global-flags.ts";
 import { CommandPlatformApiFactory } from "../../../../auth/command-platform-api-factory.service.ts";
 import { causeDeclaration } from "../../../../shared/telemetry/error-actionability.ts";
 import { stdinLayer } from "../../../../shared/runtime/stdin.layer.ts";
@@ -87,7 +88,11 @@ import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { machineErrorContextLayer } from "../../../../shared/output/machine-error-context.layer.ts";
 import { jsonOutputLayer, streamJsonOutputLayer } from "../../../../shared/output/output.layer.ts";
-import { StackApi, stackApiLayer, StackTargetResolver } from "../stack.shared.ts";
+import {
+  StackApi,
+  stackApiLayer,
+  StackTargetResolver,
+} from "../../../../command-internal/stack-target.ts";
 import { stackStart } from "./start.handler.ts";
 import { StackCommandStartError } from "./start.errors.ts";
 import { cliConfigValuesTestLayer } from "../../../../../tests/helpers/config-values-layer.ts";
@@ -615,6 +620,7 @@ const layers = (
     target,
     api,
     Layer.succeed(ExperimentalFlag, false),
+    Layer.succeed(DebugFlag, false),
     ciUnsetLayer,
     Layer.succeed(CliArgs, { args: ["stack", "start"] }),
     Layer.succeed(StackCatalogSetup, {
@@ -704,27 +710,88 @@ const liveIdleOwner = (root: string, fixture: ReturnType<typeof fakeStack>) =>
   );
 
 describe("experimental stack start", () => {
-  it.effect("rejects incompatible Functions env before changing composition", () =>
+  it.effect("starts Functions with the env and debug mode legacy start resolves", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-functions-env-" });
+      yield* fs.makeDirectory(`${root}/supabase/functions/echo`, { recursive: true });
+      yield* fs.writeFileString(`${root}/supabase/functions/echo/index.ts`, "");
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-env"\n[edge_runtime.secrets]\nshared = "secret"\nsecret_pem = "a\\r\\nb"\nSUPABASE_TOML = "x"\nUNSET_NAME = "env(STACK_START_FUNCTIONS_UNSET)"\n',
+      );
+      yield* fs.writeFileString(`${root}/supabase/functions/echo/.env`, "PER_FN=never-read\n");
+      yield* fs.writeFileString(
+        `${root}/supabase/functions/.env`,
+        'SHARED=file\nMULTI="first\nsecond"\nLEGACY.NAME=value\nSUPABASE_SKIP=x\n',
+      );
+      const fixture = fakeStack();
+      const output = mockOutput();
+      yield* stackStart(flags()).pipe(
+        Effect.provide(Layer.merge(layers(root, fixture, output), Layer.succeed(DebugFlag, true))),
+      );
+      const functions = fixture.members.find(({ service }) => service === "functions");
+      if (functions?.service !== "functions") return yield* Effect.die("Functions missing");
+      const status = yield* functions.status;
+      if (status.config.service !== "functions") return yield* Effect.die("Functions missing");
+      expect(status.config.config.env).toEqual({
+        SHARED: "file",
+        SECRET_PEM: "a\r\nb",
+        MULTI: "first\nsecond",
+        "LEGACY.NAME": "value",
+      });
+      expect(status.config.config.functions?.echo).toBeUndefined();
+      expect(status.config.config.debug).toBe(true);
+      expect(output.stderrText).toContain(
+        "Env name cannot start with SUPABASE_, skipping: SUPABASE_SKIP\n",
+      );
+      expect(output.stderrText).toContain(
+        "Env name cannot start with SUPABASE_, skipping: SUPABASE_TOML\n",
+      );
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.effect("rejects a malformed Functions env file before changing composition", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
       const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-functions-env-" });
       yield* fs.makeDirectory(`${root}/supabase/functions`, { recursive: true });
       yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "functions-env"\n');
+      yield* fs.writeFileString(`${root}/supabase/functions/.env`, "API-KEY=secret-value\n");
       const fixture = fakeStack();
-      for (const [contents, message] of [
-        ["INVALID.KEY=value\n", "Environment names"],
-        ['VALUE="first\nsecond"\n', "Multiline"],
-      ] as const) {
-        yield* fs.writeFileString(`${root}/supabase/functions/.env`, contents);
-        const error = yield* stackStart(flags()).pipe(
-          Effect.provide(layers(root, fixture)),
-          Effect.flip,
-        );
-        expect(error).toMatchObject({ reason: "invalid-config" });
-        expect(error.message).toContain(message);
-        expect(fixture.composed).toBe(0);
-      }
-    }).pipe(Effect.provide(BunServices.layer)),
+      const error = yield* stackStart(flags()).pipe(
+        Effect.provide(layers(root, fixture)),
+        Effect.flip,
+      );
+      expect(error).toMatchObject({ reason: "invalid-config" });
+      expect(error.message).toBe(
+        `failed to parse environment file: ${path.join(root, "supabase", "functions", ".env")} (unexpected character '-' in variable name)`,
+      );
+      expect(fixture.composed).toBe(0);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.effect("refuses an unreadable Auth email template before creating a stack", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-template-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        '[auth.email.template.invite]\ncontent_path = "./supabase/templates/missing.html"\n',
+      );
+      const fixture = fakeStack();
+      const error = yield* stackStart(flags()).pipe(
+        Effect.provide(layers(root, fixture)),
+        Effect.flip,
+      );
+      expect(error).toMatchObject({
+        reason: "invalid-config",
+        message: expect.stringContaining("auth.email.template.invite.content_path"),
+      });
+      expect(fixture.composed).toBe(0);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects malformed configuration before creating a stack", () =>
@@ -753,7 +820,7 @@ describe("experimental stack start", () => {
       );
       expect(result).toMatchObject({ reason: "invalid-config" });
       expect(created).toBe(false);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -796,7 +863,7 @@ describe("experimental stack start", () => {
           message: expect.stringContaining("Native artifacts are unsupported on win32/x64"),
         });
         expect(created).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -852,7 +919,7 @@ describe("experimental stack start", () => {
             "Docker didn't answer, so this new stack uses the Podman runtime",
           ),
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("applies capability selection across repeated starts", () =>
@@ -933,7 +1000,7 @@ describe("experimental stack start", () => {
       yield* fixture.stack.composition.stop;
       yield* stackStart(flags(excluded)).pipe(Effect.provide(layers(root, fixture)));
       expect(fixture.composed).toBe(5);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("reports connection details and lazy services once the stack is ready", () =>
@@ -995,7 +1062,7 @@ describe("experimental stack start", () => {
       expect(byPrefix.stdoutText).toContain(
         `Run supabase status --env --workdir ${workdir} --stack-id ${fixture.stack.id} to export`,
       );
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("keeps storage uploads under SUPABASE_HOME and never touches supabase/.temp", () =>
@@ -1015,7 +1082,7 @@ describe("experimental stack start", () => {
 
       expect(yield* fs.exists(`${root}/.supabase/stacks/${fixture.stack.id}/uploads`)).toBe(true);
       expect(legacyStateAccesses(recorder.accessed)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("returns the connection env for an already-running stack in JSON", () =>
@@ -1039,7 +1106,7 @@ describe("experimental stack start", () => {
         MCP_URL: "http://127.0.0.1:23457/mcp",
         DB_URL: "postgresql://postgres:postgres@127.0.0.1:23456/postgres",
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("returns the connection env for a resumed stack in JSON", () =>
@@ -1068,7 +1135,7 @@ describe("experimental stack start", () => {
         DB_URL: "postgresql://postgres:postgres@127.0.0.1:23456/postgres",
         API_URL: "http://127.0.0.1:23457",
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("names the services that failed when the composition start fails", () =>
@@ -1100,7 +1167,7 @@ describe("experimental stack start", () => {
         message: "Composition start had failures",
         detail: "analytics (analytics-member-1): Service health timed out",
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("loads Functions env only when Functions are selected", () =>
@@ -1169,7 +1236,7 @@ describe("experimental stack start", () => {
       const refreshedStatus = yield* refreshed.status;
       if (refreshedStatus.config.service === "functions")
         expect(refreshedStatus.config.config.env).toEqual({ CUSTOM_VALUE: "changed" });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects Studio without REST before changing the composition", () =>
@@ -1187,7 +1254,7 @@ describe("experimental stack start", () => {
       expect(result).toMatchObject({ reason: "flags" });
       expect(fixture.stopped).toBe(0);
       expect(fixture.composed).toBe(0);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("applies signing-key file changes only after the stack is stopped", () =>
@@ -1223,7 +1290,7 @@ describe("experimental stack start", () => {
       expect(fixture.savedCredentials.gotrueJwtKeys).not.toBe(savedKeys);
       expect(fixture.savedCredentials.anonKey).not.toBe(savedAnonKey);
       expect(fixture.members.find(({ service }) => service === "auth")?.service).toBe("auth");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1250,7 +1317,7 @@ describe("experimental stack start", () => {
         expect(fixture.composed).toBe(2);
         expect(fixture.members.map(({ id }) => id)).toEqual(firstIds);
         expect(fixture.catalogApplied).toBe(1);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("creates the supabase_functions schema once when restarting a stack without it", () =>
@@ -1278,7 +1345,7 @@ describe("experimental stack start", () => {
       );
       expect(database.schemaCreations).toBe(1);
       expect(fixture.catalogApplied).toBe(1);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("skips invalid config while running and reports it after stop", () =>
@@ -1311,7 +1378,7 @@ describe("experimental stack start", () => {
       expect(error).toMatchObject({ reason: "invalid-config" });
       expect(fixture.composed).toBe(1);
       expect(fixture.stopped).toBe(1);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects a partially active stack before reading changed config", () =>
@@ -1343,7 +1410,7 @@ describe("experimental stack start", () => {
       });
       expect(fixture.stopped).toBe(0);
       expect(fixture.composed).toBe(1);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects a stack whose database alone was started before reading changed config", () =>
@@ -1375,7 +1442,7 @@ describe("experimental stack start", () => {
       expect(fixture.compositionStarts).toBe(1);
       expect(fixture.composed).toBe(1);
       expect(fixture.stopped).toBe(0);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1437,7 +1504,7 @@ describe("experimental stack start", () => {
             "Resuming the saved stack services. Run `supabase stack stop`, then `supabase stack start` to apply configuration or service-selection changes.",
         });
         expect(output.messages).toContainEqual({ type: "success", message: "Stack is ready." });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1475,7 +1542,7 @@ describe("experimental stack start", () => {
         expect(output.messages.map(({ message }) => message)).not.toContain(
           "Stack is already running with its current services. Run `supabase stack stop`, then `supabase stack start` to apply configuration or service-selection changes.",
         );
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1507,7 +1574,7 @@ describe("experimental stack start", () => {
           expect(fixture.stopped).toBe(1);
           expect(fixture.composed).toBe(1);
         }
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("applies changed service configuration after the stack is stopped", () =>
@@ -1532,7 +1599,7 @@ describe("experimental stack start", () => {
       const status = yield* rest.status;
       expect(status.config.service === "rest" ? status.config.config.maxRows : undefined).toBe(500);
       expect(fixture.composed).toBe(2);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1578,7 +1645,7 @@ describe("experimental stack start", () => {
           Effect.provide(layers(root, fixture, secondOutput)),
         );
         expect(secondOutput.messages.some(({ message }) => message.includes("→"))).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("passes requested creations to a live owner, which ignores them", () =>
@@ -1616,7 +1683,7 @@ describe("experimental stack start", () => {
       expect(result).toBe(fixture.stack.id);
       expect(requested).toEqual([expect.any(Array)]);
       expect(fixture.composed).toBe(1);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("re-plans when the owner it observed running is gone by the time the stack opens", () =>
@@ -1660,7 +1727,7 @@ describe("experimental stack start", () => {
       );
 
       expect(output.messages.map(({ message }) => message)).toContain("api: 23457 → 54999");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("adds endpoint_changes to the json and stream-json success payloads", () =>
@@ -1706,7 +1773,7 @@ describe("experimental stack start", () => {
       yield* stackStart(flags(onlyRest)).pipe(Effect.provide(layer));
       const event = yield* machineEnvelope(stdio.stdout.at(-1));
       expect(event.data).toMatchObject({ endpoint_changes: expected });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1756,7 +1823,7 @@ describe("experimental stack start", () => {
           Array.isArray(data?.endpoint_changes) ? data.endpoint_changes : [],
         );
         expect(change.keys).not.toContain("studio.http");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1787,7 +1854,68 @@ describe("experimental stack start", () => {
           message: expect.stringContaining("[api] port: saved"),
           suggestion: `Run \`supabase stack stop --stack-id ${fixture.stack.id}\`, then \`supabase stack start --stack-id ${fixture.stack.id}\` to apply the new ports.`,
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.effect(
+    "warns once about SUPABASE_ names when a live idle owner applies the Functions env",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({
+          prefix: "stack-start-idle-functions-env-",
+        });
+        yield* fs.makeDirectory(`${root}/supabase/functions`, { recursive: true });
+        yield* fs.writeFileString(
+          `${root}/supabase/config.toml`,
+          'project_id = "idle-functions-env"\n[edge_runtime]\nenabled = true\n',
+        );
+        const fixture = fakeStack();
+        yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+        yield* fs.writeFileString(`${root}/supabase/functions/.env`, "CUSTOM=x\nSUPABASE_SKIP=x\n");
+        // An interrupted db reset leaves the owner live with every member stopped.
+        yield* fixture.stack.composition.stop;
+
+        const warning = "Env name cannot start with SUPABASE_, skipping: SUPABASE_SKIP\n";
+        const output = mockOutput();
+        yield* stackStart(flags()).pipe(
+          Effect.provide(Layer.merge(layers(root, fixture, output), liveIdleOwner(root, fixture))),
+        );
+        expect(output.stderrText.split(warning).length - 1).toBe(1);
+        const functions = fixture.members.find(({ service }) => service === "functions");
+        if (functions?.service !== "functions") return yield* Effect.die("Functions missing");
+        const status = yield* functions.status;
+        if (status.config.service !== "functions") return yield* Effect.die("Functions missing");
+        expect(status.config.config.env).toEqual({ CUSTOM: "x" });
+
+        // An already-running stack keeps its plan, so the same env stays silent.
+        const running = mockOutput();
+        yield* stackStart(flags()).pipe(
+          Effect.provide(Layer.merge(layers(root, fixture, running), liveIdleOwner(root, fixture))),
+        );
+        expect(running.stderrText).not.toContain(warning);
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.effect("warns once about reserved Functions env names when it restarts a stopped stack", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-stopped-env-" });
+      yield* fs.makeDirectory(`${root}/supabase/functions`, { recursive: true });
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "stopped-functions-env"\n[edge_runtime]\nenabled = true\n',
+      );
+      const fixture = fakeStack();
+      yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+      yield* fs.writeFileString(`${root}/supabase/functions/.env`, "CUSTOM=x\nSUPABASE_SKIP=x\n");
+      yield* fixture.stack.composition.stop;
+
+      const output = mockOutput();
+      yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture, output)));
+      const warning = "Env name cannot start with SUPABASE_, skipping: SUPABASE_SKIP\n";
+      expect(output.stderrText.split(warning).length - 1).toBe(1);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1818,7 +1946,7 @@ describe("experimental stack start", () => {
           expect.arrayContaining([expect.objectContaining({ key: "[api] port" })]),
         );
         expect(envelope).not.toHaveProperty("recreate_command");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1852,7 +1980,7 @@ describe("experimental stack start", () => {
         expect(envelope.recreate_command).toBe(
           `supabase stack destroy --stack-id ${fixture.stack.id}`,
         );
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1897,7 +2025,7 @@ describe("experimental stack start", () => {
             /`api\.port` in supabase\/config\.toml.*already saved this port.*previous automatic port is released/,
           ),
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1930,7 +2058,7 @@ describe("experimental stack start", () => {
           reason: "invalid-config",
           message: expect.stringContaining("[api] port: saved 54321, requested 54999"),
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1967,7 +2095,7 @@ describe("experimental stack start", () => {
         expect(error).toBeInstanceOf(StackCommandStartError);
         if (error instanceof StackCommandStartError)
           expect(error.message).not.toContain("[api] port");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1997,7 +2125,7 @@ describe("experimental stack start", () => {
           reason: "invalid-config",
           message: expect.stringContaining("[api] port: saved automatic, requested 54999"),
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   // A saved fixed shared-API port going back to automatic is an incompatible endpoint path, like
@@ -2021,7 +2149,7 @@ describe("experimental stack start", () => {
       // Does not throw: every sibling sharing the "api" port reports a purely-endpoint
       // incompatible path, so the whole composition re-plans instead of rejecting the start.
       yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -2057,7 +2185,7 @@ describe("experimental stack start", () => {
           expect(error.suggestion).toContain(
             "Revert the settings listed to their saved values to keep the stack and its data",
           );
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -2092,7 +2220,7 @@ describe("experimental stack start", () => {
           reason: "invalid-config",
           message: expect.stringContaining("SUPABASE_API_PORT: saved 54321, requested 54999"),
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -2124,7 +2252,7 @@ describe("experimental stack start", () => {
           ),
         });
         expect(error).toMatchObject({ suggestion: expect.stringContaining("database data") });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -2149,7 +2277,7 @@ describe("experimental stack start", () => {
         }
         expect(pins.get("database")).toEqual(database15);
         expect(pins.get("rest")).toEqual(selection.rest);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   const retiredOrioledbPin = (pin: ArtifactPin): ArtifactPin => ({
@@ -2217,7 +2345,7 @@ describe("experimental stack start", () => {
             `${target.revert} to keep the stack and its data, or run \`supabase stack destroy --stack-id ${fixture.stack.id}\``,
           ),
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
   it.effect("offers no revert to an OrioleDB build the catalog no longer pins", () =>
@@ -2248,7 +2376,7 @@ describe("experimental stack start", () => {
           "This CLI release starts a different [db] orioledb_version than the saved stack.",
         ),
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -2297,7 +2425,7 @@ describe("experimental stack start", () => {
             `supabase stack destroy --stack-id ${fixture.stack.id}`,
           );
         }
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("emits structured stack_changes and recreate_command on the JSON error envelope", () =>
@@ -2337,7 +2465,7 @@ describe("experimental stack start", () => {
       expect(envelope.recreate_command).toBe(
         `supabase stack destroy --stack-id ${fixture.stack.id}`,
       );
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("emits the same structured error fields on the stream-json terminal event", () =>
@@ -2374,7 +2502,7 @@ describe("experimental stack start", () => {
         },
       ]);
       expect(event.recreate_command).toBe(`supabase stack destroy --stack-id ${fixture.stack.id}`);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("always suggests --stack-id for a named stack, naming the stack as plain text", () =>
@@ -2416,7 +2544,7 @@ describe("experimental stack start", () => {
       expect(error).toBeInstanceOf(StackCommandStartError);
       if (error instanceof StackCommandStartError)
         expect(error.suggestion).not.toContain("--stack feature-a");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("reuses the saved database member when the selected pin is unchanged", () =>
@@ -2437,7 +2565,7 @@ describe("experimental stack start", () => {
       yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
       expect(fixture.members.find(({ service }) => service === "database")?.id).toBe(database.id);
       expect(fixture.composed).toBe(2);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   const unreachableDocker = [
@@ -2528,7 +2656,7 @@ describe("experimental stack start", () => {
               expect(stacks).toEqual([]);
             }),
           );
-        }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+        }).pipe(Effect.scoped, Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   }
 
@@ -2564,7 +2692,7 @@ describe("experimental stack start", () => {
           expect(fixture.hostStopped).toBe(1);
           expect(fixture.hostDestroyed).toBe(0);
         }
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
 
@@ -2668,7 +2796,7 @@ describe("experimental stack start service lock", () => {
       yield* second.run;
       expect(yield* lockText(root)).toBe(written);
       expect(resolvedReports(second.output)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("resolves a version override through the release host and runs the stack on it", () =>
@@ -2689,7 +2817,7 @@ describe("experimental stack start service lock", () => {
       expect(lock.services.auth.resolved).toEqual(selection.auth);
       expect(memberPin(stack, "rest")).toEqual(lock.services.rest.resolved);
       expect(resolvedReports(output)[0]).toContain("v99.0.0-r1");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("goes back to the bundled version when the override is removed", () =>
@@ -2712,7 +2840,7 @@ describe("experimental stack start service lock", () => {
         rest: undefined,
       });
       expect(resolvedReports(output)[0]).toContain("specifier linked ≠ locked v99.0.0");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("restores the linked version when the override is removed, without a new probe", () =>
@@ -2742,7 +2870,7 @@ describe("experimental stack start service lock", () => {
         linked: { version: "v99.0.0" },
         resolved: { upstreamVersion: "v99.0.0", revision: 1 },
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("warns when the checkout targets another remote than the lock observed", () =>
@@ -2767,7 +2895,7 @@ describe("experimental stack start service lock", () => {
         type: "warn",
         message: `lock observed ${LINKED_MAIN.project}, this checkout targets ${LINKED_MAIN.project}/${LINKED_BRANCH_REF}; run supabase stack update`,
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("warns when this CLI bundles a newer revision of a locked version, offline", () =>
@@ -2803,7 +2931,7 @@ describe("experimental stack start service lock", () => {
         type: "warn",
         message: `This CLI bundles newer revisions of locked versions: ${kind} ${upstreamVersion}-r0 → ${upstreamVersion}-r${revision}. Run supabase stack outdated to review, supabase stack update to adopt them.`,
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails with invalid-config on a missing signing keys file, writing no lock", () =>
@@ -2815,7 +2943,7 @@ describe("experimental stack start service lock", () => {
 
       expect(error).toMatchObject({ reason: "invalid-config" });
       expect(yield* fs.exists(lockPath(root))).toBe(false);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live(
@@ -2847,7 +2975,7 @@ describe("experimental stack start service lock", () => {
           ),
         });
         expect(error.message).not.toContain("[db]");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live(
@@ -2870,7 +2998,7 @@ describe("experimental stack start service lock", () => {
           resolved: { upstreamVersion: "17.0.0.000-orioledb", revision: 0 },
         });
         expect(memberPin(stack, "database")).toEqual(lock.services.database.resolved);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("re-resolves the database when db.major_version changes", () =>
@@ -2889,7 +3017,7 @@ describe("experimental stack start service lock", () => {
         resolved: database15,
       });
       expect(resolvedReports(output)[0]).toContain("db.major_version 15 ≠ locked 17");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails a frozen start on a missing or stale lock and leaves the project untouched", () =>
@@ -2938,7 +3066,7 @@ describe("experimental stack start service lock", () => {
       expect(yield* fs.exists(leasePath(root))).toBe(false);
       expect(stack.composed).toBe(composed);
       expect(host.requests).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails a frozen start on a stale lock while the stack is running", () =>
@@ -2961,7 +3089,7 @@ describe("experimental stack start service lock", () => {
       expect(yield* lockText(root)).toBe(written);
       expect(stack.composed).toBe(composed);
       expect(host.requests).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live.each([
@@ -3014,7 +3142,7 @@ describe("experimental stack start service lock", () => {
       expect(causeDeclaration(error)).toMatchObject({ fingerprint_suffix: row.suffix });
       expect(yield* fs.exists(lockPath(root))).toBe(false);
       expect(stack.composed).toBe(0);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("resolves and warns to commit when CI starts without a lock, then freezes it", () =>
@@ -3042,7 +3170,7 @@ describe("experimental stack start service lock", () => {
       expect(stale.message).toContain("supabase/supabase.lock is stale for: rest");
       expect(yield* lockText(root)).toBe(written);
       expect(host.requests).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("uses a teammate's committed lock as-is, with no probe, link or login", () =>
@@ -3065,7 +3193,7 @@ describe("experimental stack start service lock", () => {
       expect(yield* lockText(teammate)).toBe(yield* lockText(author));
       expect(memberPin(stack, "rest")).toMatchObject({ upstreamVersion: "v99.0.0", revision: 1 });
       expect(yield* fs.exists(`${teammate}/supabase/.link.json`)).toBe(false);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("serializes concurrent starts on the project lease so the versions resolve once", () =>
@@ -3082,7 +3210,7 @@ describe("experimental stack start service lock", () => {
       expect(new Set(sums).size).toBe(sums.length);
       expect(resolvedReports(first.output).length + resolvedReports(second.output).length).toBe(1);
       expect(memberPin(first.stack, "rest")).toEqual(memberPin(second.stack, "rest"));
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("applies default to every service and lets an entry override it", () =>
@@ -3100,7 +3228,7 @@ describe("experimental stack start service lock", () => {
         specifier: "v99.0.0-r1",
         resolved: { upstreamVersion: "v99.0.0", revision: 1 },
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects orioledb_version next to a different database version", () =>
@@ -3114,7 +3242,7 @@ describe("experimental stack start service lock", () => {
         reason: "invalid-config",
         message: expect.stringContaining("conflicts with local.services.database.version"),
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects a database version of another Postgres major than db.major_version", () =>
@@ -3128,7 +3256,7 @@ describe("experimental stack start service lock", () => {
         reason: "invalid-config",
         message: expect.stringContaining("requires db.major_version"),
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("re-resolves a lock whose database pin was edited to contradict its own entry", () =>
@@ -3155,7 +3283,7 @@ describe("experimental stack start service lock", () => {
           selection.database,
         );
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails on a malformed or newer lock whether or not the start is frozen", () =>
@@ -3177,6 +3305,6 @@ describe("experimental stack start service lock", () => {
           expect(yield* lockText(root)).toBe(contents);
         }
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/commands/experimental/stack/start/start.native.integration.test.ts b/apps/cli/src/commands/experimental/stack/start/start.native.integration.test.ts
index 1f1ea1a4e1..a932f6e307 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.native.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.native.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Layer, Option, Path } from "effect";
 import { FetchHttpClient } from "effect/http";
@@ -14,11 +14,15 @@ import { dbConnectionLayer } from "../../../../command-internal/db-connection.sq
 import { DbConnection } from "../../../../command-internal/db-connection.service.ts";
 import { parseConnectionString } from "../../../../command-internal/db-config.parse.ts";
 import { stackCatalogSetupLayer } from "../../../../command-internal/stack-catalog-setup.ts";
-import { StackApi, stackApiLayer, stackTargetResolverLayer } from "../stack.shared.ts";
+import {
+  StackApi,
+  stackApiLayer,
+  stackTargetResolverLayer,
+} from "../../../../command-internal/stack-target.ts";
 import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
 import { stdinLayer } from "../../../../shared/runtime/stdin.layer.ts";
 import { runtimeInfoLayer } from "../../../../shared/runtime/runtime-info.layer.ts";
-import { ExperimentalFlag, YesFlag } from "../../../../command-internal/global-flags.ts";
+import { DebugFlag, ExperimentalFlag, YesFlag } from "../../../../command-internal/global-flags.ts";
 import { stackStart } from "./start.handler.ts";
 import { selection } from "../../../../../tests/helpers/pins.ts";
 import { destroyTestStacks } from "../../../../../tests/helpers/stack-cleanup.ts";
@@ -200,6 +204,7 @@ const makeLayers = (root: string, apiLayer = liveStackApi, workdir = root) => {
       stackCatalogSetupLayer,
       dbConnectionLayer,
       Layer.succeed(ExperimentalFlag, false),
+      Layer.succeed(DebugFlag, false),
       Layer.succeed(YesFlag, false),
       Layer.succeed(CliArgs, { args: ["stack", "start"] }),
       Layer.succeed(CommandPlatformApiFactory, { make: Effect.die("unused") }),
@@ -363,7 +368,7 @@ describe("experimental stack start native lifecycle", () => {
             yield* destroyTestStacks(api, path.join(root, "stacks"), path.join(root, "cache"));
           }),
         ).pipe(Effect.provide(fixture.layer));
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     { timeout: 180_000 },
   );
 
@@ -426,7 +431,7 @@ describe("experimental stack start native lifecycle", () => {
             );
           }),
         ).pipe(Effect.provide(fixture.layer));
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     { timeout: 180_000 },
   );
 
@@ -545,7 +550,7 @@ describe("experimental stack start native lifecycle", () => {
             expect(ownerPids.filter((pid) => pid !== undefined)).toHaveLength(2);
           }),
         ).pipe(Effect.provide(fixture.layer));
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     { timeout: 60_000 },
   );
 
@@ -606,7 +611,7 @@ describe("experimental stack start native lifecycle", () => {
             yield* destroyTestStacks(api, path.join(root, "stacks"), path.join(root, "cache"));
           }),
         ).pipe(Effect.provide(fixture.layer));
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     { timeout: 180_000 },
   );
 
@@ -677,7 +682,7 @@ describe("experimental stack start native lifecycle", () => {
             yield* destroyTestStacks(api, path.join(root, "stacks"), path.join(root, "cache"));
           }),
         ).pipe(Effect.provide(fixture.layer));
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     { timeout: 120_000 },
   );
 
@@ -739,7 +744,7 @@ describe("experimental stack start native lifecycle", () => {
             yield* destroyTestStacks(api, locations.stateRoot, locations.cacheRoot);
           }),
         ).pipe(Effect.provide(fixture.layer));
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     { timeout: 180_000 },
   );
 });
diff --git a/apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md
index 65a6b621e6..f1ad2e6590 100644
--- a/apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md
@@ -23,7 +23,8 @@ stopped or unhealthy member is distinguishable from an unavailable owner.
 
 The command compares the project configuration with the saved configuration of existing
 composition members through the stack package's composition plan. It reads
-`supabase/functions/.env` only when Functions is a saved composition member.
+`supabase/functions/.env` only when Functions is a saved composition member, and compares a
+member saved by `start --debug` with that debug mode.
 Values that the composition or stack credentials supply are ignored, as are changes to membership;
 an excluded service is not considered drift. The comparison reads saved state only, so it is
 available while the owner is unavailable. It reports `config_drift.status` as `unchanged` or
diff --git a/apps/cli/src/commands/experimental/stack/status/status.errors.ts b/apps/cli/src/commands/experimental/stack/status/status.errors.ts
index eb244bb379..b6c117210e 100644
--- a/apps/cli/src/commands/experimental/stack/status/status.errors.ts
+++ b/apps/cli/src/commands/experimental/stack/status/status.errors.ts
@@ -6,7 +6,10 @@ import {
   ErrorActionabilityId,
   unclassifiedStackFailureActionability,
 } from "../../../../shared/telemetry/error-actionability.ts";
-import { type StackTargetIssue, stackTargetInvalidConfigActionability } from "../stack.shared.ts";
+import {
+  type StackTargetIssue,
+  stackTargetInvalidConfigActionability,
+} from "../../../../command-internal/stack-target.ts";
 
 export class StackCommandStatusError extends Data.TaggedError("ExperimentalStackStatusError")<{
   readonly message: string;
diff --git a/apps/cli/src/commands/experimental/stack/status/status.handler.ts b/apps/cli/src/commands/experimental/stack/status/status.handler.ts
index 5671768029..ba860b3776 100644
--- a/apps/cli/src/commands/experimental/stack/status/status.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/status/status.handler.ts
@@ -9,7 +9,7 @@ import { TelemetryState } from "../../../../telemetry/telemetry-state.service.ts
 import type { StackRuntime } from "../../../../command-internal/stack-runtime.ts";
 import { loadStackConfig } from "../../../../command-internal/stack-config.ts";
 import { readLockedSelection } from "../../../../command-internal/stack-lock.ts";
-import { withProjectFunctionsEnv } from "../../../../command-internal/stack-functions-env.ts";
+import { withProjectFunctionsConfig } from "../../../../command-internal/stack-functions-env.ts";
 import { bold, gray, green, red, yellow } from "../../../../command-internal/colors.ts";
 import {
   connectionEnv,
@@ -26,7 +26,7 @@ import {
   mapTargetError,
   rejectStackOutput,
   validateStackTarget,
-} from "../stack.shared.ts";
+} from "../../../../command-internal/stack-target.ts";
 import type { StackStatusFlags } from "./status.command.ts";
 import { StackCommandStatusError } from "./status.errors.ts";
 import { encodeStackEnv, stackEnvOverrides, stackEnvValues } from "./status.env.ts";
@@ -318,12 +318,14 @@ const projectConfigUnavailable = (error: { readonly message: string }) =>
   Effect.succeed(unavailableDrift(`Project configuration could not be compared: ${error.message}`));
 
 const configDrift = Effect.fn("experimental.stack.status.configDrift")(
-  function* (stack: Stack, projectRoot: string, functionsIsMember: boolean) {
+  function* (stack: Stack, projectRoot: string, functionsIsMember: boolean, debug: boolean) {
     const loaded = yield* loadStackConfig(projectRoot, { selection: readLockedSelection });
     const creations = yield* loaded.creations(stack.id);
     // Drift ignores non-members, so a Functions dotenv only matters when Functions is a member.
     const requested = functionsIsMember
-      ? yield* Effect.forEach(creations, withProjectFunctionsEnv)
+      ? yield* Effect.forEach(creations, (creation) =>
+          withProjectFunctionsConfig(creation, { warn: false, debug }),
+        )
       : creations;
     return driftFrom(yield* stack.composition.plan(requested));
   },
@@ -332,7 +334,7 @@ const configDrift = Effect.fn("experimental.stack.status.configDrift")(
       Effect.catchTags({
         StackConfigError: projectConfigUnavailable,
         LockResolutionError: projectConfigUnavailable,
-        StackFunctionsEnvError: projectConfigUnavailable,
+        FunctionsEnvError: projectConfigUnavailable,
         StackError: (error) =>
           Effect.succeed(
             unavailableDrift(`Saved configuration could not be compared: ${error.message}`),
@@ -424,12 +426,18 @@ export const stackStatus = Effect.fn("experimental.stack.status")(function* (
       else yield* output.result(values);
       return;
     }
+    const functionsMember = observed.observed.find(
+      ({ instance }) => memberIds.has(instance.id) && instance.service === "functions",
+    );
+    /* Debug is a start flag, not project config, so the saved mode is requested back. */
+    const savedFunctions = target.definition.instances.find(
+      ({ id }) => id === functionsMember?.instance.id,
+    )?.creation;
     const config = yield* configDrift(
       stack,
       target.definition.identity.projectRoot,
-      observed.observed.some(
-        ({ instance }) => memberIds.has(instance.id) && instance.service === "functions",
-      ),
+      functionsMember !== undefined,
+      savedFunctions?.service === "functions" && savedFunctions.config.debug === true,
     );
     const credentials = yield* summaryCredentials(stack.credentials.get, output.warn);
     const connections = stackConnections(members);
diff --git a/apps/cli/src/commands/experimental/stack/status/status.integration.test.ts b/apps/cli/src/commands/experimental/stack/status/status.integration.test.ts
index e6b74cbc83..c6341788db 100644
--- a/apps/cli/src/commands/experimental/stack/status/status.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/status/status.integration.test.ts
@@ -1,10 +1,11 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Layer, Option, Redacted, Schema, Stream } from "effect";
 import {
   type Observation,
   type PlannedInstance,
   type ServiceCreation,
+  type ServiceCreationInput,
   type StackCredentials,
   StackError,
 } from "@supabase/stack/effect";
@@ -15,7 +16,7 @@ import {
   mockTelemetryStateTracked,
 } from "../../../../../tests/helpers/command-mocks.ts";
 import { runtimeInfoLayer } from "../../../../shared/runtime/runtime-info.layer.ts";
-import { StackApi, StackTargetResolver } from "../stack.shared.ts";
+import { StackApi, StackTargetResolver } from "../../../../command-internal/stack-target.ts";
 import type { StackStatusFlags } from "./status.command.ts";
 import { stackStatus } from "./status.handler.ts";
 import { selection } from "../../../../../tests/helpers/pins.ts";
@@ -163,6 +164,7 @@ const makeStack = (
   credentials: StackCredentials = savedCredentials,
   planned: ReadonlyArray<PlannedInstance> = [],
   credentialsUnavailable = false,
+  requested: Array<ServiceCreationInput> = [],
 ): OpenedStack => ({
   id: stackId,
   services: {
@@ -176,7 +178,11 @@ const makeStack = (
       : Effect.succeed(credentials),
   },
   composition: {
-    plan: () => Effect.succeed(planned),
+    plan: (creations) =>
+      Effect.sync(() => {
+        requested.push(...creations);
+        return planned;
+      }),
     supabase: (_services, _options) => Effect.die("unused"),
     configure: (_config) => Effect.die("unused"),
     describe: Effect.succeed({ members: [...members], dependencies: [] }),
@@ -203,6 +209,7 @@ const runStatus = (input: {
   readonly credentialsUnavailable?: boolean;
   readonly planned?: ReadonlyArray<PlannedInstance>;
   readonly flags?: StackStatusFlags;
+  readonly saved?: ReadonlyArray<{ readonly id: string; readonly creation: ServiceCreation }>;
 }) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
@@ -226,16 +233,18 @@ const runStatus = (input: {
       );
       yield* fs.writeFileString(
         `${root}/supabase/functions/.env`,
-        'PRIVATE_KEY="-----BEGIN KEY-----\nsecret\n-----END KEY-----"\n',
+        'PRIVATE_KEY="-----BEGIN KEY-----\nsecret\n-----END KEY-----"\nSUPABASE_SKIP=x\n',
       );
     }
     const projectRoot = root;
+    const requested: Array<ServiceCreationInput> = [];
     const stack = makeStack(
       input.services,
       input.members ?? input.services.map(({ id }) => ({ id, activation: "lazy" as const })),
       input.stackCredentials,
       input.planned,
       input.credentialsUnavailable ?? false,
+      requested,
     );
     const definition = {
       id: stackId,
@@ -245,10 +254,12 @@ const runStatus = (input: {
         stackName: "status-stack",
       },
       runtime: "native" as const,
-      instances: input.services.map(({ id, service }) => ({
-        id,
-        creation: service === "database" ? database : rest,
-      })),
+      instances:
+        input.saved ??
+        input.services.map(({ id, service }) => ({
+          id,
+          creation: service === "database" ? database : rest,
+        })),
       composition: { members: input.members ?? [], dependencies: [] },
       lifetime: "detached" as const,
     };
@@ -279,13 +290,14 @@ const runStatus = (input: {
       mockCommandSettings({ workdir: projectRoot, supabaseHome: root }),
       cliConfigValuesTestLayer,
       BunServices.layer,
+      BunCrypto.layer,
       runtimeInfoLayer,
     );
     if (input.config === "explicit" || input.config === "multiline-functions-env")
       yield* seedLock(root).pipe(Effect.provide(layer));
     const effect = stackStatus(input.flags ?? flags()).pipe(Effect.provide(layer));
-    return { effect, out, root };
-  }).pipe(Effect.provide(BunServices.layer));
+    return { effect, out, root, requested };
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 it.effect("renders connections and a services summary without internal IDs", () =>
   Effect.gen(function* () {
@@ -693,12 +705,9 @@ it.effect("omits Storage S3 details for a Storage member saved without S3 keys",
   }),
 );
 
-for (const { functionsMember, status } of [
-  { functionsMember: false, status: "unchanged" },
-  { functionsMember: true, status: "unavailable" },
-] as const)
+for (const functionsMember of [false, true])
   it.effect(
-    `reports ${status} drift for a multiline Functions dotenv when Functions is ${functionsMember ? "" : "not "}a member`,
+    `reports unchanged drift for a multiline Functions dotenv when Functions is ${functionsMember ? "" : "not "}a member`,
     () =>
       Effect.gen(function* () {
         const services = [
@@ -717,10 +726,41 @@ for (const { functionsMember, status } of [
         });
         yield* run.effect;
         const result = run.out.messages.find((message) => message.type === "success")?.data;
-        expect(result).toMatchObject({ config_drift: { status } });
+        expect(result).toMatchObject({ config_drift: { status: "unchanged" } });
+        expect(run.out.stderrText).not.toContain("Env name cannot start with SUPABASE_");
+        const requested = run.requested.find(({ service }) => service === "functions");
+        expect(requested?.service === "functions" && requested.config.env).toEqual(
+          functionsMember ? { PRIVATE_KEY: "-----BEGIN KEY-----\nsecret\n-----END KEY-----" } : {},
+        );
       }),
   );
 
+it.effect("plans drift with the saved debug mode of a debug-started stack", () =>
+  Effect.gen(function* () {
+    const saved: ServiceCreation = { ...functions, config: { ...functions.config, debug: true } };
+    const run = yield* runStatus({
+      services: [
+        makeService({ id: "database-id", creation: database, statusCalls: { value: 0 } }),
+        makeService({ id: "functions-id", creation: saved, statusCalls: { value: 0 } }),
+      ],
+      members: [
+        { id: "database-id", activation: "eager" },
+        { id: "functions-id", activation: "eager" },
+      ],
+      saved: [
+        { id: "database-id", creation: database },
+        { id: "functions-id", creation: saved },
+      ],
+      config: "multiline-functions-env",
+      reachable: false,
+      outputFormat: "json",
+    });
+    yield* run.effect;
+    const requested = run.requested.find(({ service }) => service === "functions");
+    expect(requested?.service === "functions" && requested.config.debug).toBe(true);
+  }),
+);
+
 it.effect("reports unavailable owner and does not query service status", () =>
   Effect.gen(function* () {
     const statusCalls = { value: 0 };
diff --git a/apps/cli/src/commands/experimental/stack/stop/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/stop/SIDE_EFFECTS.md
index 36eb5d7241..2ca3a0bcdb 100644
--- a/apps/cli/src/commands/experimental/stack/stop/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/stop/SIDE_EFFECTS.md
@@ -42,7 +42,8 @@ settings may read project configuration and the selected profile. Communicates
 only with local owner endpoints; no hosted API requests. Shutdown updates owned
 runtime resources but preserves persistent instance definitions, data and automatic
 port reservations in the per-user registry at `<passwd home>/.supabase/ports.sqlite`
-(unaffected by `SUPABASE_HOME`); configured ports are released with their listeners.
+(unaffected by `SUPABASE_HOME`; WAL mode, with `ports.sqlite-wal` and `ports.sqlite-shm`
+alongside while open); configured ports are released with their listeners.
 Killing the owner process preserves every reservation, but another stack may take over
 a configured port while no owner runs. No caller-owned upload files are removed.
 
diff --git a/apps/cli/src/commands/experimental/stack/stop/stop.errors.ts b/apps/cli/src/commands/experimental/stack/stop/stop.errors.ts
index b69caedb90..1476117300 100644
--- a/apps/cli/src/commands/experimental/stack/stop/stop.errors.ts
+++ b/apps/cli/src/commands/experimental/stack/stop/stop.errors.ts
@@ -6,7 +6,10 @@ import {
   ErrorActionabilityId,
   unclassifiedStackFailureActionability,
 } from "../../../../shared/telemetry/error-actionability.ts";
-import { type StackTargetIssue, stackTargetInvalidConfigActionability } from "../stack.shared.ts";
+import {
+  type StackTargetIssue,
+  stackTargetInvalidConfigActionability,
+} from "../../../../command-internal/stack-target.ts";
 
 export class StackCommandStopError extends Data.TaggedError("ExperimentalStackStopError")<{
   readonly reason: "flags" | "invalid-config" | "stack";
diff --git a/apps/cli/src/commands/experimental/stack/stop/stop.handler.ts b/apps/cli/src/commands/experimental/stack/stop/stop.handler.ts
index ddcd311e83..0e5fcfa4b4 100644
--- a/apps/cli/src/commands/experimental/stack/stop/stop.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/stop/stop.handler.ts
@@ -10,7 +10,7 @@ import {
   rejectStackOutput,
   validateStackTarget,
   mapTargetError,
-} from "../stack.shared.ts";
+} from "../../../../command-internal/stack-target.ts";
 import type { StackStopFlags } from "./stop.command.ts";
 import { StackCommandStopError } from "./stop.errors.ts";
 
diff --git a/apps/cli/src/commands/experimental/stack/stop/stop.integration.test.ts b/apps/cli/src/commands/experimental/stack/stop/stop.integration.test.ts
index b1ff80586c..cb4d00a135 100644
--- a/apps/cli/src/commands/experimental/stack/stop/stop.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stop/stop.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, FileSystem, Layer, Option, Path, Ref, Scope } from "effect";
 import { StackError } from "@supabase/stack/effect";
@@ -8,7 +8,11 @@ import {
   mockTelemetryStateTracked,
 } from "../../../../../tests/helpers/command-mocks.ts";
 import * as StackNamespace from "../../../../../../../packages/stack/src/StackNamespace.ts";
-import { StackApi, stackApiLayer, stackTargetResolverLayer } from "../stack.shared.ts";
+import {
+  StackApi,
+  stackApiLayer,
+  stackTargetResolverLayer,
+} from "../../../../command-internal/stack-target.ts";
 import { stackStop } from "./stop.handler.ts";
 import { selection } from "../../../../../tests/helpers/pins.ts";
 
@@ -17,7 +21,7 @@ const flags = (id?: string) => ({
   stack: Option.none<string>(),
   stackId: Option.fromUndefinedOr(id),
 });
-const live = Layer.provideMerge(stackApiLayer, BunServices.layer);
+const live = Layer.provideMerge(stackApiLayer, Layer.merge(BunServices.layer, BunCrypto.layer));
 const fixture = Effect.fn("StackStopTest.fixture")(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
diff --git a/apps/cli/src/commands/experimental/stack/update/update.handler.ts b/apps/cli/src/commands/experimental/stack/update/update.handler.ts
index 271832c7f3..a98737607f 100644
--- a/apps/cli/src/commands/experimental/stack/update/update.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/update/update.handler.ts
@@ -15,7 +15,7 @@ import {
 import { CommandSettings } from "../../../../config/command-settings.service.ts";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { TelemetryState } from "../../../../telemetry/telemetry-state.service.ts";
-import { mapTargetError, rejectStackOutput } from "../stack.shared.ts";
+import { mapTargetError, rejectStackOutput } from "../../../../command-internal/stack-target.ts";
 import { StackCommandUpdateError } from "./update.errors.ts";
 import type { StackUpdateFlags } from "./update.command.ts";
 
@@ -117,7 +117,8 @@ export const stackUpdate = Effect.fn("experimental.stack.update")(function* (
     if (result === undefined)
       return yield* new StackCommandUpdateError({
         reason: "invalid-config",
-        message: "No supabase/config.toml in this project, so there is no lock to update.",
+        message:
+          "No supabase/config.toml, config.json or config.jsonc in this project, so there is no lock to update.",
         suggestion: "Run supabase init, then supabase start to create supabase/supabase.lock.",
       });
 
diff --git a/apps/cli/src/commands/experimental/stack/update/update.integration.test.ts b/apps/cli/src/commands/experimental/stack/update/update.integration.test.ts
index 0d3427deb4..8add28147c 100644
--- a/apps/cli/src/commands/experimental/stack/update/update.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/update/update.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { readLock } from "@supabase/stack/effect";
 import {
@@ -133,7 +133,7 @@ describe("experimental stack update", () => {
       expect(output.stdoutText).toContain("1 changed, 11 unchanged");
       expect(host.requests.filter((path) => path.includes("/releases/rest-"))).toEqual([]);
       expect(host.requests.filter((path) => path.endsWith(".tar.zst"))).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live(
@@ -178,7 +178,7 @@ describe("experimental stack update", () => {
             ],
           },
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("rewrites the lock under CI, which does not freeze an explicit update", () =>
@@ -192,7 +192,7 @@ describe("experimental stack update", () => {
       yield* update(root, host, ["auth"], { ci: true }).run;
 
       expect((yield* readServices(root)).auth.resolved.revision).toBe(1);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("resolves every service when the project has no lock yet", () =>
@@ -210,7 +210,7 @@ describe("experimental stack update", () => {
       expect(yield* fs.readFileString(`${root}/supabase/.gitignore`)).toContain(
         ".supabase.lock.lease",
       );
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("leaves the lock byte for byte alone when every entry already answers the config", () =>
@@ -233,7 +233,7 @@ describe("experimental stack update", () => {
       expect(result?.type === "success" ? result.data : undefined).toMatchObject({
         lock: { written: false, changed: [], stale: [] },
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   describe("a service whose specifier changed since the lock was written", () => {
@@ -262,7 +262,7 @@ describe("experimental stack update", () => {
         expect((yield* readServices(root)).rest.resolved.revision).toBe(1);
         expect(output.stdoutText).toContain(`${UPSTREAM}-r0 → ${UPSTREAM}-r1`);
         expect(output.stdoutText).not.toContain("is stale");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live("is reported and left as written when another service is named", () =>
@@ -285,7 +285,7 @@ describe("experimental stack update", () => {
         expect(lock).toEqual({
           lock: expect.objectContaining({ unchanged: expect.not.arrayContaining(["rest"]) }),
         });
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -310,7 +310,7 @@ describe("experimental stack update", () => {
       expect(error).toMatchObject({ reason: "invalid-config" });
       expect(error.message).toContain("must remain within the project directory");
       expect(yield* fs.readFileString(lockPath(root))).toBe(written);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("fails on an unknown service naming the valid ones, and writes nothing", () =>
@@ -331,7 +331,7 @@ describe("experimental stack update", () => {
       expect(error.message).toContain(artifactServiceKinds().join(", "));
       expect(yield* fs.readFileString(lockPath(root))).toBe(written);
       expect(host.requests).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
 
@@ -375,10 +375,10 @@ describe("experimental stack update and saved stack data", () => {
         yield* run;
 
         expect(stackWarnings(output)).toEqual([
-          `stack ${stackId}: the next supabase start refuses these pins: PostgreSQL data was initialized by stock PostgreSQL build ${OLDER_BUILD}, but stock PostgreSQL build ${BUILT} was requested; keep this data by pinning \`[local.services.database] version = "${OLDER_BUILD}"\` in supabase/config.toml, or ${destroy(stackId)}`,
+          `stack ${stackId}: the next supabase start refuses these pins: PostgreSQL data was initialized by stock PostgreSQL build ${OLDER_BUILD}, but stock PostgreSQL build ${BUILT} was requested; keep this data by pinning \`local.services.database.version\` to \`"${OLDER_BUILD}"\` in your config file, or ${destroy(stackId)}`,
         ]);
         expect((yield* readServices(root)).database.resolved.upstreamVersion).toBe(BUILT);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("stays quiet when only a revision of the build that initialized the data moves", () =>
@@ -402,7 +402,7 @@ describe("experimental stack update and saved stack data", () => {
       expect((yield* readServices(root)).database.resolved.revision).toBe(
         selection.database.revision,
       );
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("stays quiet when the lock is already up to date", () =>
@@ -421,7 +421,7 @@ describe("experimental stack update and saved stack data", () => {
 
       expect(output.stdoutText).toContain("already up to date");
       expect(stackWarnings(output)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("still updates the lock when the saved stacks cannot be read", () =>
@@ -438,6 +438,6 @@ describe("experimental stack update and saved stack data", () => {
 
       expect(stackWarnings(output)).toEqual([]);
       expect((yield* readServices(root)).database.resolved.upstreamVersion).toBe(BUILT);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/commands/feedback/add/add.integration.test.ts b/apps/cli/src/commands/feedback/add/add.integration.test.ts
index e86774a08a..f9b2edae05 100644
--- a/apps/cli/src/commands/feedback/add/add.integration.test.ts
+++ b/apps/cli/src/commands/feedback/add/add.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, FileSystem, Layer, Option, Path, Schema, Stdio, Stream } from "effect";
 import { systemError } from "effect/PlatformError";
 import type { FeedbackSubmission } from "../../../shared/feedback/feedback-client.service.ts";
@@ -155,6 +155,7 @@ function setupFeedback(
     // Real filesystem: the handler reads `supabase/.temp/project-ref` from the
     // temp workdir, so this must not be stubbed out.
     BunServices.layer,
+    BunCrypto.layer,
   );
   return { layer, out, submitter, telemetryState };
 }
@@ -171,7 +172,9 @@ function setupFeedbackHandler(
     base.layer,
     analytics.layer,
     processControl.layer,
-    commandRuntimeLayer(["feedback", "add"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["feedback", "add"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     Stdio.layerTest({ args: Effect.succeed([...(opts.args ?? ["feedback", "add"])]) }),
   );
   return { ...base, layer, analytics, processControl };
diff --git a/apps/cli/src/commands/feedback/delete/delete.integration.test.ts b/apps/cli/src/commands/feedback/delete/delete.integration.test.ts
index e031060c74..9b2578d601 100644
--- a/apps/cli/src/commands/feedback/delete/delete.integration.test.ts
+++ b/apps/cli/src/commands/feedback/delete/delete.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, FileSystem, Layer, Option, Path, Schema, Stdio } from "effect";
 import { CliArgs } from "../../../shared/cli/cli-args.service.ts";
 import {
@@ -138,6 +138,7 @@ function setupFeedbackDelete(
     // Real filesystem: the handler reads `supabase/.temp/project-ref` from the
     // temp workdir, so this must not be stubbed out.
     BunServices.layer,
+    BunCrypto.layer,
   );
   return { layer, out, client, telemetryState };
 }
@@ -154,7 +155,9 @@ function setupFeedbackDeleteHandler(
     base.layer,
     analytics.layer,
     processControl.layer,
-    commandRuntimeLayer(["feedback", "delete"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["feedback", "delete"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     Stdio.layerTest({ args: Effect.succeed([...(opts.args ?? ["feedback", "delete", TOKEN])]) }),
   );
   return { ...base, layer, analytics, processControl };
diff --git a/apps/cli/src/commands/functions/deploy/SIDE_EFFECTS.md b/apps/cli/src/commands/functions/deploy/SIDE_EFFECTS.md
index 4ee0ca965b..4074209f75 100644
--- a/apps/cli/src/commands/functions/deploy/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/functions/deploy/SIDE_EFFECTS.md
@@ -66,6 +66,7 @@ Docker bundling may pull or run the configured edge-runtime image and uses the
 | `BITBUCKET_CLONE_DIR`                | when defined (including an empty value), skips creating the named Deno-cache volume and omits its bind mount from the bundler `docker run` (Bitbucket's restricted Docker environment rejects both); project values are passed explicitly to Docker setup                                                                                                        | no                                                      |
 | `SUPABASE_EDGE_RUNTIME_DENO_VERSION` | overrides `edge_runtime.deno_version` (which bundler image tag to use) when set, from the ambient shell or project dotenv — takes effect even with no `config.toml` on disk                                                                                                                                                                                      | no                                                      |
 | `NPM_CONFIG_REGISTRY`                | forwarded into Docker bundling when set (the only npm variable forwarded; `NPM_AUTH_TOKEN` is not)                                                                                                                                                                                                                                                               | no                                                      |
+| `SUPABASE_API_MAX_RETRIES`           | Management API retries after the first attempt (`0` = send once; a duplicated create still becomes one update); also lowers each of this command's own Management API retry loops to at most that value with client retries off inside them, and since those loops nest, a request can be sent more times above `0`                                              | no (unset keeps this command's own retries)             |
 | `DEBUG`                              | enables verbose Docker bundle output when `true`                                                                                                                                                                                                                                                                                                                 | no                                                      |
 
 ## Exit Codes
diff --git a/apps/cli/src/commands/functions/deploy/deploy.command.ts b/apps/cli/src/commands/functions/deploy/deploy.command.ts
index 452fd53222..60fa1546ae 100644
--- a/apps/cli/src/commands/functions/deploy/deploy.command.ts
+++ b/apps/cli/src/commands/functions/deploy/deploy.command.ts
@@ -108,7 +108,7 @@ export const functionsDeployCommand = Command.make("deploy", config).pipe(
             kind: "required",
             when: [{ flag: "no-verify-jwt", is: false }],
             context:
-              "on the API path (--use-api, --use-docker=false, or Docker not running), when an enabled function has no verify_jwt in config.toml",
+              "on the API path (--use-api, --use-docker=false, or Docker not running), when an enabled function has no verify_jwt in the config file",
           },
           {
             operationId: "v1-list-all-functions",
diff --git a/apps/cli/src/commands/functions/deploy/deploy.handler.ts b/apps/cli/src/commands/functions/deploy/deploy.handler.ts
index f6948248cb..4178684703 100644
--- a/apps/cli/src/commands/functions/deploy/deploy.handler.ts
+++ b/apps/cli/src/commands/functions/deploy/deploy.handler.ts
@@ -28,6 +28,7 @@ export const functionsDeploy = Effect.fn("functions.deploy")(function* (
 
   yield* deployFunctions(flags, {
     api,
+    apiMaxRetries: cliSettings.apiMaxRetries,
     cwd: cliSettings.workdir,
     flagCwd: runtimeInfo.cwd,
     projectRoot: cliSettings.workdir,
diff --git a/apps/cli/src/commands/functions/deploy/deploy.integration.test.ts b/apps/cli/src/commands/functions/deploy/deploy.integration.test.ts
index 8bcbff1ee3..8194d1def6 100644
--- a/apps/cli/src/commands/functions/deploy/deploy.integration.test.ts
+++ b/apps/cli/src/commands/functions/deploy/deploy.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -64,6 +64,7 @@ import { functionsLocalConfigLoader } from "../../../command-internal/functions-
 import {
   ConflictingFunctionDeployFlagsError,
   FunctionImportMapSyntaxError,
+  FunctionsDeployFailedError,
   InvalidFunctionDeploySlugError,
   NoFunctionsToDeployError,
 } from "../../../shared/functions/deploy.errors.ts";
@@ -125,7 +126,16 @@ const deployedFunction = (slug: string) => ({
 const removeTempRoot = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   yield* fs.remove(tempRoot.current, { recursive: true, force: true });
-}).pipe(Effect.provide(BunServices.layer), Effect.orDie);
+}).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]), Effect.orDie);
+
+// Each sleep advances the test clock itself, so retry backoff costs no real time.
+const withAdvancingClock = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  Effect.flatMap(TestClock.testClockWith(Effect.succeed), (clock) =>
+    Effect.provideService(effect, Clock.Clock, {
+      ...clock,
+      sleep: (duration) => clock.adjust(duration),
+    }),
+  );
 
 const writeCliConfig = Effect.fnUntraced(function* (
   cwd: string,
@@ -179,7 +189,7 @@ function mockDockerBundleSpawner() {
       const outputPath = resolveDockerOutputPath(record.args);
       yield* fs.makeDirectory(path.dirname(outputPath), { recursive: true });
       yield* fs.writeFileString(outputPath, "eszip-test-output");
-    }).pipe(Effect.provide(BunServices.layer), Effect.orDie);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]), Effect.orDie);
   return mockChildProcessSpawner(spawnerOpts);
 }
 
@@ -475,7 +485,9 @@ describe("functions deploy", () => {
           cliSettings: mockCommandSettings({ workdir: tempRoot.current, projectId: Option.none() }),
           runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
         }),
-        commandRuntimeLayer(["functions", "deploy"]).pipe(Layer.provide(BunServices.layer)),
+        commandRuntimeLayer(["functions", "deploy"]).pipe(
+          Layer.provide([BunServices.layer, BunCrypto.layer]),
+        ),
         approvedHostedMutation,
         cliArgsLayer(prepareCliArgs(rootCommandForFeatures(), args)).pipe(
           Layer.provideMerge(Stdio.layerTest({ args: Effect.succeed(args) })),
@@ -763,9 +775,13 @@ describe("functions deploy", () => {
     handler: ApiHandler,
     args: ReadonlyArray<string> = ["functions", "deploy", "hello-world", "--use-api"],
     rateLimitNotices?: Queue.Enqueue<string>,
+    apiMaxRetries = Option.none<number>(),
   ) {
     const out = mockOutput({ format: "text" });
-    const api = mockCommandPlatformApi({ handler });
+    const api = mockCommandPlatformApi({
+      handler,
+      clientMaxRetries: Option.getOrElse(apiMaxRetries, () => 0),
+    });
     const layer = Layer.mergeAll(
       cliConfigValuesTestLayer,
       buildTestRuntime({
@@ -795,7 +811,7 @@ describe("functions deploy", () => {
                 ).pipe(Layer.provide(out.layer)),
               },
         api,
-        cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+        cliSettings: mockCommandSettings({ workdir: tempRoot.current, apiMaxRetries }),
         runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
       }),
       approvedHostedMutation,
@@ -838,7 +854,7 @@ describe("functions deploy", () => {
     }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
   });
 
-  it.effect("reports a malformed deno.json with the schema decoder's message", () => {
+  it.effect("reports a malformed deno.json with the parse reason and position", () => {
     const { api, layer } = apiDeployHarness(deployedHelloWorld);
 
     return Effect.gen(function* () {
@@ -854,7 +870,10 @@ describe("functions deploy", () => {
       const error = yield* functionsDeploy(baseFlags).pipe(Effect.flip);
 
       expect(error).toBeInstanceOf(FunctionImportMapSyntaxError);
-      expect(error).toMatchObject({ name: "SyntaxError", message: "Expected a valid JSON string" });
+      expect(error).toMatchObject({
+        name: "SyntaxError",
+        message: "Close brace expected (line 1, column 2)",
+      });
       expect(api.requests.some((request) => request.method === "POST")).toBe(false);
     }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
   });
@@ -983,6 +1002,49 @@ describe("functions deploy", () => {
       },
     );
 
+    it.effect("uploads the files a commented deno.jsonc import map points at", () => {
+      const uploaded: Array<{ importMapPath: string; fileNames: Array<string> }> = [];
+      const { layer } = apiDeployHarness((request, recorded) => {
+        if (Predicate.isTagged(request.body, "FormData")) {
+          const metadata = request.body.formData.get("metadata");
+          if (typeof metadata === "string") {
+            uploaded.push({
+              importMapPath: JSON.parse(metadata).import_map_path,
+              fileNames: request.body.formData
+                .getAll("file")
+                .flatMap((part) => (part instanceof File ? [part.name] : [])),
+            });
+          }
+        }
+        return deployedHelloWorld(request, recorded);
+      });
+
+      return Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        yield* writeCliConfig(tempRoot.current);
+        yield* writeLocalFunction(tempRoot.current, "hello-world");
+        yield* fs.remove(`${functionDir("hello-world")}/deno.json`);
+        yield* fs.makeDirectory(`${tempRoot.current}/supabase/shared`, { recursive: true });
+        yield* fs.writeFileString(`${tempRoot.current}/supabase/shared/helper.ts`, "export {}\n");
+        yield* fs.writeFileString(
+          `${functionDir("hello-world")}/deno.jsonc`,
+          `{
+  // shared helper
+  "imports": {
+    "helper": "../../shared/helper.ts", /* trailing comma follows */
+  },
+}
+`,
+        );
+
+        yield* functionsDeploy(baseFlags);
+
+        expect(uploaded).toHaveLength(1);
+        expect(uploaded[0]?.importMapPath).toBe("supabase/functions/hello-world/deno.jsonc");
+        expect(uploaded[0]?.fileNames).toContain("supabase/shared/helper.ts");
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    });
+
     it.effect("deploys with deno.json when the function directory has both files", () => {
       const { importMapPaths, layer } = harnessRecordingImportMapPaths();
 
@@ -1222,6 +1284,112 @@ describe("functions deploy", () => {
     }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
   });
 
+  it.effect("caps a failed function list at SUPABASE_API_MAX_RETRIES", () => {
+    const { layer, api } = apiDeployHarness(
+      (request) => Effect.succeed(jsonResponse(request, 500, { message: "boom" })),
+      undefined,
+      undefined,
+      Option.some(2),
+    );
+
+    return Effect.gen(function* () {
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+      const error = yield* functionsDeploy(baseFlags).pipe(withAdvancingClock, Effect.flip);
+
+      expect(error).toMatchObject({ status: 500 });
+      expect(
+        api.requests.filter((request) => request.url.endsWith(`/${VALID_REF}/functions`)),
+      ).toHaveLength(3);
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
+  it.effect("caps the prune function list at SUPABASE_API_MAX_RETRIES", () => {
+    const { layer, api } = apiDeployHarness(
+      (request) => Effect.succeed(jsonResponse(request, 500, { message: "boom" })),
+      ["functions", "deploy", "hello-world", "--use-api", "--no-verify-jwt", "--prune"],
+      undefined,
+      Option.some(2),
+    );
+
+    return Effect.gen(function* () {
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+      const error = yield* functionsDeploy({ ...baseFlags, noVerifyJwt: true, prune: true }).pipe(
+        withAdvancingClock,
+        Effect.flip,
+      );
+
+      expect(error).toMatchObject({ status: 500 });
+      expect(
+        api.requests.filter((request) => request.url.endsWith(`/${VALID_REF}/functions`)),
+      ).toHaveLength(3);
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
+  it.effect(
+    "waits out a long rate limit on the function list when SUPABASE_API_MAX_RETRIES is set",
+    () => {
+      const { layer, api, out } = apiDeployHarness(
+        (request) =>
+          Effect.succeed(
+            HttpClientResponse.fromWeb(
+              request,
+              new Response("{}", { status: 429, headers: { "retry-after": "30" } }),
+            ),
+          ),
+        undefined,
+        undefined,
+        Option.some(1),
+      );
+
+      return Effect.gen(function* () {
+        yield* writeCliConfig(tempRoot.current);
+        yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+        const error = yield* functionsDeploy(baseFlags).pipe(withAdvancingClock, Effect.flip);
+
+        expect(error).toMatchObject({ status: 429 });
+        expect(
+          api.requests.filter((request) => request.url.endsWith(`/${VALID_REF}/functions`)),
+        ).toHaveLength(2);
+        expect(out.stderrText).toContain(
+          "Rate limit exceeded while listing functions. Retrying in 30s.",
+        );
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    },
+  );
+
+  it.effect("caps a rate-limited deploy at SUPABASE_API_MAX_RETRIES", () => {
+    const { layer, api, out } = apiDeployHarness(
+      (request) =>
+        Effect.succeed(
+          request.method === "GET"
+            ? jsonResponse(request, 200, [])
+            : HttpClientResponse.fromWeb(
+                request,
+                new Response("{}", { status: 429, headers: { "retry-after": "0" } }),
+              ),
+        ),
+      undefined,
+      undefined,
+      Option.some(2),
+    );
+
+    return Effect.gen(function* () {
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+      const error = yield* functionsDeploy(baseFlags).pipe(Effect.flip);
+
+      expect(error).toMatchObject({ status: 429 });
+      expect(api.requests.filter((request) => request.method === "POST")).toHaveLength(3);
+      expect(out.stderrText).toContain("Rate limit exceeded while deploying function hello-world.");
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
   it.effect("gives up on a persistent rate limit after the command's backoff schedule", () =>
     Effect.gen(function* () {
       const notices = yield* Queue.unbounded<string>();
@@ -1883,6 +2051,7 @@ describe("functions deploy", () => {
       readonly deployStatuses: ReadonlyArray<number>;
       readonly bulkStatuses?: ReadonlyArray<number>;
       readonly functionStatuses?: Readonly<Record<string, string>>;
+      readonly apiMaxRetries?: Option.Option<number>;
     }) {
       const out = mockOutput({ format: "text" });
       let deployCalls = 0;
@@ -1934,7 +2103,10 @@ describe("functions deploy", () => {
         buildTestRuntime({
           out,
           api,
-          cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+          cliSettings: mockCommandSettings({
+            workdir: tempRoot.current,
+            apiMaxRetries: opts.apiMaxRetries,
+          }),
           runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
         }),
         approvedHostedMutation,
@@ -1958,7 +2130,7 @@ describe("functions deploy", () => {
           functionNames: ["hello-world", "bye-world"],
         }).pipe(Effect.flip);
 
-        expect(error).toBeInstanceOf(Error);
+        expect(error).toBeInstanceOf(FunctionsDeployFailedError);
         expect(error).toMatchObject({
           message: 'unexpected deploy status 409: {"message":"rejected bye-world"}',
         });
@@ -1979,6 +2151,31 @@ describe("functions deploy", () => {
       }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
     });
 
+    it.effect("caps a failed bulk update at SUPABASE_API_MAX_RETRIES", () => {
+      const { api, layer } = setupBulkDeploy({
+        deployStatuses: [201, 201],
+        bulkStatuses: [500, 500, 200],
+        apiMaxRetries: Option.some(1),
+      });
+
+      return Effect.gen(function* () {
+        yield* writeCliConfig(tempRoot.current);
+        yield* writeLocalFunction(tempRoot.current, "hello-world");
+        yield* writeLocalFunction(tempRoot.current, "bye-world");
+
+        const error = yield* functionsDeploy({
+          ...baseFlags,
+          functionNames: ["hello-world", "bye-world"],
+        }).pipe(withAdvancingClock, Effect.flip);
+
+        expect(error).toBeInstanceOf(FunctionsDeployFailedError);
+        expect(error).toMatchObject({
+          message: 'unexpected bulk update status 500: {"message":"bulk update rejected"}',
+        });
+        expect(api.requests.filter((request) => request.method === "PUT")).toHaveLength(2);
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    });
+
     it.effect("skips the bulk update entirely when every upload fails", () => {
       const { out, api, layer } = setupBulkDeploy({ deployStatuses: [409, 400] });
 
@@ -1992,6 +2189,7 @@ describe("functions deploy", () => {
           functionNames: ["hello-world", "bye-world"],
         }).pipe(Effect.flip);
 
+        expect(error).toBeInstanceOf(FunctionsDeployFailedError);
         expect(error).toMatchObject({
           message: [
             'unexpected deploy status 409: {"message":"rejected hello-world"}',
@@ -2374,6 +2572,7 @@ describe("functions deploy", () => {
           { ...baseFlags, functionNames: [] },
           {
             api: platformApi,
+            apiMaxRetries: Option.none(),
             cwd: tempRoot.current,
             flagCwd: tempRoot.current,
             projectRoot: tempRoot.current,
@@ -2580,6 +2779,122 @@ describe("functions deploy", () => {
       });
     }
 
+    function setupDockerRetries(handler: ApiHandler, apiMaxRetries: number) {
+      const out = mockOutput({ format: "text" });
+      const api = mockCommandPlatformApi({ handler, clientMaxRetries: apiMaxRetries });
+      const layer = Layer.mergeAll(
+        cliConfigValuesTestLayer,
+        buildTestRuntime({
+          out,
+          api,
+          cliSettings: mockCommandSettings({
+            workdir: tempRoot.current,
+            apiMaxRetries: Option.some(apiMaxRetries),
+          }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        approvedHostedMutation,
+        mockDockerBundleSpawner().layer,
+        Stdio.layerTest({
+          args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api=false"]),
+        }),
+      );
+      const writes = () =>
+        api.requests.filter((request) => request.method !== "GET").map((request) => request.method);
+      const gets = () =>
+        api.requests.filter((request) => request.url.endsWith(`/${VALID_REF}/functions`));
+      return { layer, writes, gets, out };
+    }
+
+    const deployThroughDocker = Effect.gen(function* () {
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+      return yield* functionsDeploy({ ...baseFlags, useApi: false, useDocker: true }).pipe(
+        withAdvancingClock,
+        Effect.flip,
+      );
+    });
+
+    it.effect("updates a duplicated function once when SUPABASE_API_MAX_RETRIES is 0", () => {
+      const { layer, writes } = setupDockerRetries(
+        (request) =>
+          Effect.succeed(
+            request.method === "GET"
+              ? jsonResponse(request, 200, [])
+              : request.method === "POST"
+                ? jsonResponse(request, 400, { message: "Duplicated function slug" })
+                : jsonResponse(request, 500, { message: "boom" }),
+          ),
+        0,
+      );
+
+      return Effect.gen(function* () {
+        expect(yield* deployThroughDocker).toMatchObject({ status: 500 });
+        expect(writes()).toEqual(["POST", "PATCH"]);
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    });
+
+    it.effect("caps a rate-limited create at SUPABASE_API_MAX_RETRIES", () => {
+      const { layer, writes, out } = setupDockerRetries(
+        (request) =>
+          Effect.succeed(
+            request.method === "GET"
+              ? jsonResponse(request, 200, [])
+              : HttpClientResponse.fromWeb(
+                  request,
+                  new Response("{}", { status: 429, headers: { "x-ratelimit-reset": "30" } }),
+                ),
+          ),
+        2,
+      );
+
+      return Effect.gen(function* () {
+        expect(yield* deployThroughDocker).toMatchObject({ status: 429 });
+        expect(writes()).toEqual(["POST", "POST", "POST"]);
+        expect(out.stderrText).toContain(
+          "Rate limit exceeded while creating function hello-world. Retrying in 30s.",
+        );
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    });
+
+    it.effect("caps the docker function list at SUPABASE_API_MAX_RETRIES", () => {
+      const { layer, gets } = setupDockerRetries(
+        (request) => Effect.succeed(jsonResponse(request, 500, { message: "boom" })),
+        2,
+      );
+
+      return Effect.gen(function* () {
+        expect(yield* deployThroughDocker).toMatchObject({ status: 500 });
+        expect(gets()).toHaveLength(3);
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    });
+
+    for (const [apiMaxRetries, posts] of [
+      [0, 1],
+      [1, 2],
+      [5, 4],
+    ] as const) {
+      it.effect(
+        `sends a failing create ${posts} times when SUPABASE_API_MAX_RETRIES is ${apiMaxRetries}`,
+        () => {
+          const { layer, writes } = setupDockerRetries(
+            (request) =>
+              Effect.succeed(
+                request.method === "GET"
+                  ? jsonResponse(request, 200, [])
+                  : jsonResponse(request, 502, { message: "bad gateway" }),
+              ),
+            apiMaxRetries,
+          );
+
+          return Effect.gen(function* () {
+            expect(yield* deployThroughDocker).toMatchObject({ status: 502 });
+            expect(writes()).toEqual(Array.from({ length: posts }, () => "POST"));
+          }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+        },
+      );
+    }
+
     it.live(
       "resolves the deno v1 edge-runtime image tag when SUPABASE_EDGE_RUNTIME_DENO_VERSION=1 overrides an unset config value",
       () => {
@@ -3106,6 +3421,7 @@ describe("functions deploy", () => {
           { ...baseFlags, useApi: false, useDocker: true },
           {
             api: platformApi,
+            apiMaxRetries: Option.none(),
             cwd: tempRoot.current,
             flagCwd: tempRoot.current,
             projectRoot: tempRoot.current,
diff --git a/apps/cli/src/commands/functions/download/download.integration.test.ts b/apps/cli/src/commands/functions/download/download.integration.test.ts
index 8d1bf1b15c..dd57c0e578 100644
--- a/apps/cli/src/commands/functions/download/download.integration.test.ts
+++ b/apps/cli/src/commands/functions/download/download.integration.test.ts
@@ -103,7 +103,7 @@ function mockDockerRunSpawnFailure() {
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
       const cmd = ChildProcess.isStandardCommand(command) ? command.command : "";
-      const args = ChildProcess.isStandardCommand(command) ? command.args : [];
+      const args = ChildProcess.isStandardCommand(command) ? command.args.map(String) : [];
       spawned.push({ command: cmd, args });
 
       if (args[0] === "run") {
diff --git a/apps/cli/src/commands/functions/new/SIDE_EFFECTS.md b/apps/cli/src/commands/functions/new/SIDE_EFFECTS.md
index 4ca3f8e4d7..1b416878e8 100644
--- a/apps/cli/src/commands/functions/new/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/functions/new/SIDE_EFFECTS.md
@@ -2,28 +2,29 @@
 
 ## Files Read
 
-| Path                                            | Format     | When                                                                                                                                   |
-| ----------------------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| `~/.supabase/profile`                           | plain text | when `--profile` and `SUPABASE_PROFILE` are both unset                                                                                 |
-| `<profile>.yaml`                                | YAML       | when `SUPABASE_PROFILE` or `--profile` points to a file                                                                                |
-| `<workdir>/supabase/config.toml`                | TOML       | best-effort when resolving template values, detecting existing `[functions.<name>]` declarations, and scanning declared function slugs |
-| `<workdir>/supabase/functions/*/index.ts`       | TypeScript | when checking whether this is the first local function                                                                                 |
-| `<workdir>/.vscode/extensions.json`             | JSONC      | when merging VS Code recommendations into an existing file                                                                             |
-| `<workdir>/.vscode/settings.json`               | JSONC      | when merging Deno settings into an existing file                                                                                       |
-| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON       | when present, before post-run telemetry state is refreshed                                                                             |
+| Path                                                              | Format              | When                                                                                                                                                                                      |
+| ----------------------------------------------------------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `~/.supabase/profile`                                             | plain text          | when `--profile` and `SUPABASE_PROFILE` are both unset                                                                                                                                    |
+| `<profile>.yaml`                                                  | YAML                | when `SUPABASE_PROFILE` or `--profile` points to a file                                                                                                                                   |
+| `<workdir>/supabase/config.json`, `config.jsonc` or `config.toml` | JSON / JSONC / TOML | best-effort when resolving template values, detecting existing `functions.<name>` declarations, and scanning declared function slugs; `config.json`/`config.jsonc` win over `config.toml` |
+| `<workdir>/supabase/functions/*/index.ts`                         | TypeScript          | when checking whether this is the first local function                                                                                                                                    |
+| `<workdir>/.vscode/extensions.json`                               | JSONC               | when merging VS Code recommendations into an existing file                                                                                                                                |
+| `<workdir>/.vscode/settings.json`                                 | JSONC               | when merging Deno settings into an existing file (nested objects merge key by key, template values win)                                                                                   |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json`                   | JSON                | when present, before post-run telemetry state is refreshed                                                                                                                                |
 
 ## Files Written
 
-| Path                                            | Format     | When                                                                                                               |
-| ----------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------ |
-| `<workdir>/supabase/functions/<name>/index.ts`  | TypeScript | always                                                                                                             |
-| `<workdir>/supabase/functions/<name>/deno.json` | JSON       | always                                                                                                             |
-| `<workdir>/supabase/functions/<name>/.npmrc`    | plain text | always                                                                                                             |
-| `<workdir>/supabase/config.toml`                | TOML       | always unless `[functions.<name>]` is already declared                                                             |
-| `<workdir>/.vscode/extensions.json`             | JSON       | text mode only, when this is the first function and VS Code settings are accepted or auto-accepted                 |
-| `<workdir>/.vscode/settings.json`               | JSON       | text mode only, when this is the first function and VS Code settings are accepted or auto-accepted                 |
-| `<workdir>/.idea/deno.xml`                      | XML        | text mode only, when this is the first function, VS Code settings are declined, and IntelliJ settings are accepted |
-| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON       | after command completion, flushed on both success and failure paths                                                |
+| Path                                               | Format       | When                                                                                                                                                |
+| -------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/functions/<name>/index.ts`     | TypeScript   | always                                                                                                                                              |
+| `<workdir>/supabase/functions/<name>/deno.json`    | JSON         | always                                                                                                                                              |
+| `<workdir>/supabase/functions/<name>/.npmrc`       | plain text   | always                                                                                                                                              |
+| `<workdir>/supabase/config.toml`                   | TOML         | always unless `[functions.<name>]` is already declared; skipped when a `config.json`/`config.jsonc` exists                                          |
+| `<workdir>/supabase/config.json` or `config.jsonc` | JSON / JSONC | when one exists, instead of `config.toml`: gains `functions.<name>` unless already declared; comments, trailing commas and untouched bytes are kept |
+| `<workdir>/.vscode/extensions.json`                | JSON         | text mode only, when this is the first function and VS Code settings are accepted or auto-accepted                                                  |
+| `<workdir>/.vscode/settings.json`                  | JSON         | text mode only, when this is the first function and VS Code settings are accepted or auto-accepted                                                  |
+| `<workdir>/.idea/deno.xml`                         | XML          | text mode only, when this is the first function, VS Code settings are declined, and IntelliJ settings are accepted                                  |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json`    | JSON         | after command completion, flushed on both success and failure paths                                                                                 |
 
 ## API Routes
 
@@ -49,7 +50,7 @@
 | `1`  | resolved `--workdir`/`SUPABASE_WORKDIR` doesn't exist or isn't a directory (`FunctionsNewWorkdirError`) — beats slug validation and every filesystem write |
 | `1`  | invalid function name                                                                                                                                      |
 | `1`  | function entrypoint already exists                                                                                                                         |
-| `1`  | local file write failed                                                                                                                                    |
+| `1`  | local file write failed, or the JSON/JSONC config edit was refused (`FunctionsNewWriteError`)                                                              |
 
 ## Telemetry Events Fired
 
@@ -80,5 +81,7 @@ Emits a structured success result event with `path`, `function_name`, and `auth`
 - The `[functions.<name>]` config section is **appended** (`O_APPEND` semantics, `flag: "a"`), never rewritten, so the existing file is left byte-for-byte untouched and a partial write cannot truncate it.
 - Existing-declaration detection scans the raw `config.toml` text (`^\s*\[functions\.<slug>\]\s*$`) rather than a parsed config map. For all well-formed configs the two approaches agree.
 - IDE settings scaffolding (`.vscode`, `.idea`) only runs in `--output-format text`; json / stream-json runs are payload-only.
+- The VS Code settings come from the shared `init` helper, so `.vscode/settings.json` also includes `json.schemaDownload.trustedDomains` trusting `https://supabase.com/schemas/`.
 - No Management API requests are made; all behavior is local filesystem work plus telemetry flush.
 - A non-existent `--workdir`/`SUPABASE_WORKDIR` now fails before any directory or file is created (CLI-2285) — previously a typo'd `--workdir` could scaffold a fresh `supabase/functions/…` tree (plus a new `config.toml`) at the wrong path.
+- With a `config.json`/`config.jsonc` project the `functions.<name>` entry (`enabled`, `verify_jwt`, `import_map`, `entrypoint`) is span-edited into that file via `applyConfigEdits`; the file is never rewritten wholesale and no `config.toml` is created. A refused edit fails the command instead of falling back.
diff --git a/apps/cli/src/commands/functions/new/new.handler.ts b/apps/cli/src/commands/functions/new/new.handler.ts
index 1d5c479b76..a9d33997a4 100644
--- a/apps/cli/src/commands/functions/new/new.handler.ts
+++ b/apps/cli/src/commands/functions/new/new.handler.ts
@@ -1,3 +1,9 @@
+import {
+  applyConfigEdits,
+  parseCliConfigDocumentFile,
+  type ParsedCliConfigDocument,
+  writeCliConfigDocumentText,
+} from "@supabase/config/internal";
 import { defaultPublishableKey } from "../../../shared/stack-constants.ts";
 import { Effect, FileSystem, Option, Path } from "effect";
 
@@ -13,6 +19,7 @@ import { Tty } from "../../../shared/runtime/tty.service.ts";
 import { CommandSettings } from "../../../config/command-settings.service.ts";
 import { CliConfigValues } from "../../../config/cli-config-values.service.ts";
 import { bold } from "../../../command-internal/colors.ts";
+import { configDisplayPath } from "../../../command-internal/config-advice.ts";
 import { validateWorkdirIsDirectory } from "../../../command-internal/workdir-validation.ts";
 import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import type { FunctionsNewFlags } from "./new.command.ts";
@@ -54,6 +61,22 @@ function hasFunctionConfigDeclaration(contents: string, slug: string): boolean {
   return pattern.test(contents);
 }
 
+const locateJsonConfig = Effect.fnUntraced(function* (workdir: string) {
+  const parsed = yield* parseCliConfigDocumentFile(workdir, { search: false }).pipe(Effect.option);
+  return Option.isSome(parsed) && parsed.value !== null && parsed.value.format === "json"
+    ? parsed.value
+    : undefined;
+});
+
+function jsonDeclaredFunctionSlugs(document: ParsedCliConfigDocument): ReadonlySet<string> {
+  const functions = document.rawDocument?.["functions"];
+  return new Set(
+    typeof functions === "object" && functions !== null && !Array.isArray(functions)
+      ? Object.keys(functions)
+      : [],
+  );
+}
+
 const listExistingFunctionSlugs = Effect.fn("functions.new.listExistingSlugs")(function* (
   workdir: string,
 ) {
@@ -76,12 +99,19 @@ const listExistingFunctionSlugs = Effect.fn("functions.new.listExistingSlugs")(f
     }
   }
 
-  const configPath = path.join(workdir, "supabase", "config.toml");
-  const configContents = yield* fs.readFileString(configPath).pipe(Effect.option);
-  if (Option.isSome(configContents)) {
-    for (const slug of readDeclaredFunctionSlugs(configContents.value)) {
+  const jsonConfig = yield* locateJsonConfig(workdir);
+  if (jsonConfig !== undefined) {
+    for (const slug of jsonDeclaredFunctionSlugs(jsonConfig)) {
       slugs.add(slug);
     }
+  } else {
+    const configPath = path.join(workdir, "supabase", "config.toml");
+    const configContents = yield* fs.readFileString(configPath).pipe(Effect.option);
+    if (Option.isSome(configContents)) {
+      for (const slug of readDeclaredFunctionSlugs(configContents.value)) {
+        slugs.add(slug);
+      }
+    }
   }
 
   yield* Effect.annotateCurrentSpan("function.count", slugs.size);
@@ -131,6 +161,50 @@ const promptForIdeSettings = Effect.fn("functions.new.promptIdeSettings")(functi
   }
 });
 
+const writeJsonFunctionConfig = Effect.fn("functions.new.writeJsonConfig")(function* (
+  workdir: string,
+  document: ParsedCliConfigDocument,
+  slug: string,
+  verifyJwt: boolean,
+) {
+  const path = yield* Path.Path;
+  const output = yield* Output;
+  const relPath = configDisplayPath(path, workdir, document.path);
+
+  if (jsonDeclaredFunctionSlugs(document).has(slug)) {
+    yield* output.raw(`functions.${slug} is already declared in ${bold(relPath)}\n`, "stderr");
+    return;
+  }
+
+  const outcome = applyConfigEdits(document.rawText, "json", [
+    {
+      path: ["functions", slug],
+      value: {
+        enabled: true,
+        verify_jwt: verifyJwt,
+        import_map: `./functions/${slug}/deno.json`,
+        entrypoint: `./functions/${slug}/index.ts`,
+      },
+    },
+  ]);
+  if (outcome.kind === "refused") {
+    return yield* new FunctionsNewWriteError({
+      path: relPath,
+      message: `failed to update config: ${outcome.refusal.detail}`,
+    });
+  }
+
+  yield* writeCliConfigDocumentText(document.path, outcome.text).pipe(
+    Effect.mapError(
+      (cause) =>
+        new FunctionsNewWriteError({
+          path: relPath,
+          message: `failed to update config: ${cause.message}`,
+        }),
+    ),
+  );
+});
+
 const appendFunctionConfig = Effect.fnUntraced(function* (
   workdir: string,
   slug: string,
@@ -139,6 +213,12 @@ const appendFunctionConfig = Effect.fnUntraced(function* (
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const output = yield* Output;
+
+  const jsonConfig = yield* locateJsonConfig(workdir);
+  if (jsonConfig !== undefined) {
+    return yield* writeJsonFunctionConfig(workdir, jsonConfig, slug, verifyJwt);
+  }
+
   const relPath = path.join("supabase", "config.toml");
   const configPath = path.join(workdir, relPath);
   const existing = yield* fs.readFileString(configPath).pipe(Effect.option);
diff --git a/apps/cli/src/commands/functions/new/new.integration.test.ts b/apps/cli/src/commands/functions/new/new.integration.test.ts
index eec34a04f2..a69cdeddf2 100644
--- a/apps/cli/src/commands/functions/new/new.integration.test.ts
+++ b/apps/cli/src/commands/functions/new/new.integration.test.ts
@@ -1,6 +1,6 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, FileSystem, Layer, Path } from "effect";
+import { Effect, Exit, FileSystem, Layer, Path, Stdio } from "effect";
 
 import {
   mockCommandSettings,
@@ -8,8 +8,16 @@ import {
   useTempWorkdir,
   withConfigEnv,
 } from "../../../../tests/helpers/command-mocks.ts";
-import { mockOutput, mockStdin, mockTty } from "../../../../tests/helpers/mocks.ts";
+import {
+  mockContextualAnalytics,
+  mockOutput,
+  mockProcessControl,
+  mockStdin,
+  mockTty,
+} from "../../../../tests/helpers/mocks.ts";
 import { CliArgs } from "../../../shared/cli/cli-args.service.ts";
+import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.layer.ts";
+import { withCommandTelemetry } from "../../../telemetry/command-telemetry.ts";
 import { YesFlag } from "../../../command-internal/global-flags.ts";
 import { CliConfigValueError } from "../../../config/cli-config.errors.ts";
 import { configValuesLayer } from "../../../../tests/helpers/config-values-layer.ts";
@@ -192,6 +200,44 @@ describe("functions new integration", () => {
     }).pipe(Effect.provide(layer), (body) => withConfigEnv({ SUPABASE_API_PORT: "abc" }, body));
   });
 
+  it.effect("records the failing config key on the failed command event", () => {
+    const { layer, workdir } = setup();
+    const analytics = mockContextualAnalytics();
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* fs.makeDirectory(path.join(workdir, "supabase"), { recursive: true });
+      yield* fs.writeFileString(
+        path.join(workdir, "supabase", "config.toml"),
+        "[inbucket]\nenabled = true\n",
+      );
+
+      const exit = yield* functionsNew({ functionName: "hello", auth: "apikey" }).pipe(
+        withCommandTelemetry(),
+        Effect.exit,
+      );
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(analytics.captured).toHaveLength(1);
+      expect(analytics.captured[0]?.properties).toMatchObject({
+        command: "functions new",
+        exit_code: 1,
+        error_category: "invalid_config",
+        config_key: "inbucket",
+      });
+    }).pipe(
+      Effect.provide(
+        Layer.mergeAll(
+          layer,
+          analytics.layer,
+          mockProcessControl().layer,
+          Stdio.layerTest({ args: Effect.succeed(["functions", "new", "hello"]) }),
+          commandRuntimeLayer(["functions", "new"]).pipe(Layer.provide(BunCrypto.layer)),
+        ),
+      ),
+    );
+  });
+
   it.effect("warns and skips the config append when the function is already declared", () => {
     const { layer, out, workdir } = setup();
     return Effect.gen(function* () {
@@ -210,6 +256,56 @@ describe("functions new integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  describe("JSONC config", () => {
+    const jsoncSource = [
+      "{",
+      "  // keep this comment",
+      '  "api": { "port": 54321, },',
+      "}",
+      "",
+    ].join("\n");
+
+    it.effect("edits config.jsonc in place and never creates config.toml", () => {
+      const { layer, workdir } = setup();
+      return Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const configPath = path.join(workdir, "supabase", "config.jsonc");
+        yield* fs.makeDirectory(path.join(workdir, "supabase"), { recursive: true });
+        yield* fs.writeFileString(configPath, jsoncSource);
+
+        yield* functionsNew({ functionName: "hello-world", auth: "user" });
+
+        const config = yield* fs.readFileString(configPath);
+        expect(config).toContain("// keep this comment");
+        expect(config).toContain('"api": { "port": 54321, },');
+        expect(config).toContain('"hello-world"');
+        expect(config).toContain('"verify_jwt": true');
+        expect(config).toContain('"entrypoint": "./functions/hello-world/index.ts"');
+        expect(yield* fs.exists(path.join(workdir, "supabase", "config.toml"))).toBe(false);
+      }).pipe(Effect.provide(layer));
+    });
+
+    it.effect("warns and leaves config.jsonc untouched when the function is declared", () => {
+      const { layer, out, workdir } = setup();
+      return Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const configPath = path.join(workdir, "supabase", "config.jsonc");
+        const declared = '{\n  // c\n  "functions": { "hello-world": { "enabled": true } },\n}\n';
+        yield* fs.makeDirectory(path.join(workdir, "supabase"), { recursive: true });
+        yield* fs.writeFileString(configPath, declared);
+
+        yield* functionsNew({ functionName: "hello-world", auth: "apikey" });
+
+        expect(yield* fs.readFileString(configPath)).toBe(declared);
+        expect(out.stderrText).toContain("functions.hello-world is already declared in ");
+        expect(out.stderrText).toContain("config.jsonc");
+        expect(yield* fs.exists(path.join(workdir, "supabase", "config.toml"))).toBe(false);
+      }).pipe(Effect.provide(layer));
+    });
+  });
+
   it.effect("does not auto-generate IDE files when another function already exists", () => {
     const { layer, workdir } = setup();
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/functions/serve/SIDE_EFFECTS.md b/apps/cli/src/commands/functions/serve/SIDE_EFFECTS.md
index 7ca04c2328..f0cf7b2394 100644
--- a/apps/cli/src/commands/functions/serve/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/functions/serve/SIDE_EFFECTS.md
@@ -62,27 +62,27 @@ back to local keys. No scheme/host validation is performed on the discovered URL
 
 ## Exit Codes
 
-| Code | Condition                                                                                                                                                                              |
-| ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `0`  | clean shutdown after `SIGINT` or `SIGTERM`                                                                                                                                             |
-| `0`  | the edge-runtime container stops on its own with exit code `0`                                                                                                                         |
-| `0`  | the edge-runtime container is torn down by an external supervisor — exit `129`/`130`/`131`/`143` (`SIGHUP`/`SIGINT`/`SIGQUIT`/`SIGTERM`), e.g. `supabase stop` run in another terminal |
-| `0`  | the edge-runtime container is already gone by the time a follow-up `docker container inspect` runs after the log stream ended                                                          |
-| `0`  | the edge-runtime container is force-killed (exit `137`, no `State.OOMKilled`) and pruned before the re-inspect that follows a non-OOM `137` completes, e.g. by `supabase stop`         |
-| `0`  | an edge-runtime startup failure or log-stream failure lands within the shutdown grace period (~50ms) of a `SIGINT`/`SIGTERM`                                                           |
-| `1`  | local DB container is not running, or the Docker daemon is unreachable (surfaces from the DB inspect as `failed to inspect service: …` plus the Docker Desktop install suggestion)     |
-| `1`  | invalid inspect flag combination, or a `Config.Validate` failure anywhere in `config.toml` (not just project/auth config)                                                              |
-| `1`  | an enabled function has `import_map.json` but no `deno.json*` or configured import map — startup fails before the container is created                                                 |
-| `1`  | env file, signing key, import map, or function bind resolution failure                                                                                                                 |
-| `1`  | edge-runtime container startup, log streaming, or restart loop failure — including the edge-runtime container crashing with any exit code other than `0` or `129`/`130`/`131`/`143`    |
-| `1`  | the edge-runtime container is killed for exceeding its memory limit — `State.OOMKilled`, typically with exit `137`                                                                     |
-| `1`  | the edge-runtime container is killed from outside the CLI and is still present after a re-inspect — exit `137` without `State.OOMKilled`                                               |
+| Code | Condition                                                                                                                                                                                                                                                                    |
+| ---- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `0`  | clean shutdown after `SIGINT` or `SIGTERM`                                                                                                                                                                                                                                   |
+| `0`  | the edge-runtime container stops on its own with exit code `0`                                                                                                                                                                                                               |
+| `0`  | the edge-runtime container is torn down by an external supervisor — exit `129`/`130`/`131`/`143` (`SIGHUP`/`SIGINT`/`SIGQUIT`/`SIGTERM`) or `15` (edge-runtime's own `SIGTERM` exit), e.g. `supabase stop` run in another terminal                                           |
+| `0`  | the edge-runtime container is already gone by the time a follow-up `docker container inspect` runs after the log stream ended                                                                                                                                                |
+| `0`  | the edge-runtime container is force-killed (exit `137`, no `State.OOMKilled`) and pruned before the re-inspect that follows a non-OOM `137` completes, e.g. by `supabase stop`                                                                                               |
+| `0`  | an edge-runtime startup failure or log-stream failure lands within the shutdown grace period (~50ms) of a `SIGINT`/`SIGTERM`                                                                                                                                                 |
+| `1`  | local DB container is not running, or the Docker daemon is unreachable (surfaces from the DB inspect as `failed to inspect service: …` plus the Docker Desktop install suggestion; the Docker 27+ `failed to connect to the docker API …` wording counts as unreachable too) |
+| `1`  | invalid inspect flag combination, or a `Config.Validate` failure anywhere in `config.toml` (not just project/auth config)                                                                                                                                                    |
+| `1`  | an enabled function has `import_map.json` but no `deno.json*` or configured import map — startup fails before the container is created                                                                                                                                       |
+| `1`  | env file, signing key, import map, or function bind resolution failure                                                                                                                                                                                                       |
+| `1`  | edge-runtime container startup, log streaming, or restart loop failure — including the edge-runtime container crashing with any exit code other than `0`, `15`, or `129`/`130`/`131`/`143`                                                                                   |
+| `1`  | the edge-runtime container is killed for exceeding its memory limit — `State.OOMKilled`, typically with exit `137`                                                                                                                                                           |
+| `1`  | the edge-runtime container is killed from outside the CLI and is still present after a re-inspect — exit `137` without `State.OOMKilled`                                                                                                                                     |
 
 ## Telemetry Events Fired
 
-| Event                  | When                                       | Notable properties / groups         |
-| ---------------------- | ------------------------------------------ | ----------------------------------- |
-| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` |
+| Event                  | When                                       | Notable properties / groups                                                       |
+| ---------------------- | ------------------------------------------ | --------------------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags`, `serve_end_reason`, `edge_runtime_exit_code` |
 
 ## Output
 
@@ -97,7 +97,7 @@ Writes lifecycle text to stderr / stdout while the command is running:
 - in stack mode, `--- <count> <stream or output> chunk(s) lost ---` on stderr when the stack could not persist Functions output
 - `Stopped serving supabase/functions` on a user-initiated shutdown (`SIGINT`/`SIGTERM`)
 - `Edge Runtime exited (code 0). Stopped serving supabase/functions` when the container stops on its own with exit code `0`
-- `Edge Runtime container stopped (exit <code>). Stopped serving supabase/functions` when an external supervisor tears the container down (exit `129`/`130`/`131`/`143`)
+- `Edge Runtime container stopped (exit <code>). Stopped serving supabase/functions` when an external supervisor tears the container down (exit `129`/`130`/`131`/`143`, or `15` from edge-runtime's own `SIGTERM` exit)
 - `Edge Runtime container is no longer available. Stopped serving supabase/functions` when the container is already gone by the time a follow-up inspect runs
 
 ### `--output-format json`
@@ -127,15 +127,25 @@ When `SUPABASE_EXPERIMENTAL_STACK=1` selects the Stack backend, the command open
 project stack and serves its Functions service. A composed Functions service is started or woken
 and readied in place; the stack composition and its other services remain available on shutdown.
 If Functions is excluded from the composition, a temporary standalone Functions instance is
-created under the same stack owner and destroyed with the command scope. `--env-file` and
-`--no-verify-jwt` apply only for the command lifetime and restore the saved composed configuration
-when the owner remains reachable. Import-map and inspector flags are rejected before any stack
-mutation. Stack mode writes no project files and does not stop or restart the whole composition.
-It reads the shared Functions `.env` when creating a temporary service, or the explicit `--env-file`;
-per-function `.env` files are not read, and reserved `SUPABASE_*` entries are ignored.
-For Stack mode, TOML `edge_runtime.secrets` overrides the shared `.env`; an explicit
-`--env-file` overrides matching shared secrets while retaining other saved values.
-Per-function TOML `env` remains the final override for that function.
+created under the same stack owner and destroyed with the command scope. On a running stack,
+any difference between the configuration serve resolves (env files, per-function `.env`,
+`[functions.<name>]` settings, `--env-file`, `--debug`, `--no-verify-jwt`) and the saved one
+restarts Functions for the serving session, and the saved composed configuration is restored on
+exit when the owner remains reachable. Edits made while serving apply on the next
+`functions serve`, because the stack backend does not watch files. Import-map and inspector flags
+are rejected before any stack mutation. Stack mode writes no project files and does not stop or
+restart the whole composition.
+Stack mode resolves the env like legacy serve on every invocation, for a composed or temporary
+service: the shared Functions `.env`, or the explicit `--env-file` instead, overrides the TOML
+`edge_runtime.secrets`, and without `--env-file` each enabled `<function-name>/.env` overrides
+the shared values for that Function only; reserved `SUPABASE_*` entries are skipped with a warning.
+TOML `edge_runtime.secrets` names are uppercased, empty or unresolved `env()` values and
+`SUPABASE_`-prefixed names are dropped, and encrypted values are decrypted; an undecryptable value
+fails the command.
+Per-function TOML `env` remains the final override for that function. Multiline values and names
+the process environment cannot carry reach the runtime through its Functions config. `--debug`
+runs the runtime verbose for the command lifetime. A temporary service uses the API port of a
+running REST, Auth, Storage or Realtime service, else the configured `api.port`.
 Without a configured `import_map`, a function uses its own `deno.json` or `deno.jsonc`; a
 per-function `import_map.json` is not read and does not fail the command.
 
@@ -156,7 +166,7 @@ per-function `import_map.json` is not read and does not fail the command.
 - Config, project dotenv discovery, and function discovery all resolve from `<workdir>` with no ancestor search, so they can never disagree.
 - Before each container (re)start, resolves the edge-runtime image through the same registry-candidate pull-with-retry every native `functions` Docker path uses: `docker image inspect <candidate>` (ECR, then GHCR, then Docker Hub) to check the local cache, then `docker pull <candidate>` with 2 retries (4s/8s backoff) on a miss, after `assertLocalDbRunning` — resolving it earlier would hijack the down-daemon error message that DB-inspect step is responsible for producing.
 - Runs the full `Config.Validate` pipeline (`resolveLocalConfigValues`, same one `start`/`stop`/`status` use) on every startup/restart, before `assertLocalDbRunning` — an invalid config now fails `serve` up front even for fields this command never otherwise reads (e.g. a bad `db.major_version` or malformed auth hook).
-- A container that stops on its own with exit code `0`, or that is torn down by an external supervisor (exit `129`/`130`/`131`/`143`, e.g. `supabase stop` in another terminal), or that is already gone by the time a follow-up inspect runs, all end the command successfully — each prints its own distinct line (see Output above) rather than the user-initiated `Stopped serving …` line, so scrollback can tell "I stopped it" from "the runtime walked out" or "a supervisor tore it down". In a `functions serve &` CI step this means a runtime that exits on its own does not fail the step; the distinct message is the only signal, and a downstream failure otherwise only surfaces later as connection-refused. Exit `137` (SIGKILL) fails the command: `State.OOMKilled` separates a container that hit its memory limit, which reports the memory-allocation remediation, from one killed by something the CLI cannot identify. A non-OOM `137` gets one re-inspect first — if `supabase stop` force-killed a runtime that ignored `SIGTERM` and the follow-up prune has already removed the container, the command still ends successfully instead of failing on a container that is already gone. Any other non-zero container exit fails the command; the error message includes the container id. Only a watched-file change restarts the container itself — none of these outcomes ever restart it.
+- A container that stops on its own with exit code `0`, or that is torn down by an external supervisor (exit `129`/`130`/`131`/`143`, or `15` from edge-runtime's own `SIGTERM` exit, e.g. `supabase stop` or `docker stop` in another terminal), or that is already gone by the time a follow-up inspect runs, all end the command successfully — each prints its own distinct line (see Output above) rather than the user-initiated `Stopped serving …` line, so scrollback can tell "I stopped it" from "the runtime walked out" or "a supervisor tore it down". In a `functions serve &` CI step this means a runtime that exits on its own does not fail the step; the distinct message is the only signal, and a downstream failure otherwise only surfaces later as connection-refused. Exit `137` (SIGKILL) fails the command: `State.OOMKilled` separates a container that hit its memory limit, which reports the memory-allocation remediation, from one killed by something the CLI cannot identify. A non-OOM `137` gets one re-inspect first — if `supabase stop` force-killed a runtime that ignored `SIGTERM` and the follow-up prune has already removed the container, the command still ends successfully instead of failing on a container that is already gone. Any other non-zero container exit fails the command; the error message includes the container id. Only a watched-file change restarts the container itself — none of these outcomes ever restart it.
 - A `docker logs -f` re-attach (the daemon can close the stream while the container keeps running) resumes with `--since <last forwarded log timestamp>` instead of replaying the full log history, and is capped at 5 consecutive re-attaches that forward no new output; exceeding the cap fails the command with a tagged error instead of looping forever.
 - On the log-stream path, the Docker-daemon-unreachable classification comes from a follow-up `docker container inspect` failure, not from `docker logs -f`'s own stderr text. That same follow-up inspect's `State.OOMKilled` also drives the memory-limit remediation on this path, so a `docker logs -f` failure over a container killed for exceeding its memory limit reports the same suggestion as the clean-exit case above, instead of a bare unattributable failure.
 - The worker bootstrap template (`serve.main.ts`) is bundled into a single self-contained module with `jose` and the local path/status helpers inlined, so the edge-runtime worker boots without any network access (supabase/supabase#45570). The bundle is embedded at build time for shipped binaries and produced on demand (esbuild) when running from source. It is delivered into the created (not yet started) container as a `docker cp` stdin tar archive at `/root/index.ts` — never a single-file host bind mount, which materializes as an empty directory on daemons that cannot see the client's filesystem (remote `DOCKER_HOST`/Docker-context daemons, podman machines) and breaks bring-up with edge-runtime's "failed to determine entrypoint" (supabase/cli#6254). Only this bootstrap template is daemon-independent: user function sources, import maps, static files, and the multiline-env script directory (present only when an env value contains a newline) still arrive by host bind mounts, so they require a daemon that can see the project directory.
diff --git a/apps/cli/src/commands/functions/serve/serve.integration.test.ts b/apps/cli/src/commands/functions/serve/serve.integration.test.ts
index 1b1019f1b8..fc03242585 100644
--- a/apps/cli/src/commands/functions/serve/serve.integration.test.ts
+++ b/apps/cli/src/commands/functions/serve/serve.integration.test.ts
@@ -6,6 +6,7 @@ import { describe, expect, it } from "@effect/vitest";
 import { CliConfigParseError } from "@supabase/config";
 import {
   Cause,
+  Clock,
   Deferred,
   Duration,
   Effect,
@@ -16,11 +17,13 @@ import {
   Predicate,
   PubSub,
   Queue,
+  Ref,
   Schema,
   Sink,
   Stream,
 } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { TestClock } from "effect/testing";
 import { beforeEach, vi } from "vitest";
 
 import {
@@ -52,6 +55,10 @@ import { RuntimeInfo } from "../../../shared/runtime/runtime-info.service.ts";
 import { dockerfileServiceImage } from "../../../shared/services/dockerfile-images.ts";
 import { slimImagesEnabled } from "../../../shared/services/slim-images.ts";
 import { getRegistryImageUrl } from "../../../command-internal/docker-registry.ts";
+import {
+  CommandTelemetryAttributes,
+  type CommandTelemetryAttributeValues,
+} from "../../../telemetry/command-telemetry-attributes.ts";
 import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import {
   DockerLogsStreamError,
@@ -64,6 +71,7 @@ import {
   actionability,
   ErrorActionabilityId,
 } from "../../../shared/telemetry/error-actionability.ts";
+import { normalizeCliError } from "../../../shared/output/normalize-error.ts";
 import {
   serveFunctions,
   type FunctionsServeFlags,
@@ -295,9 +303,30 @@ function mockQueuedProcessControl() {
   };
 }
 
-function mockFileWatcher(expectedPaths: ReadonlyArray<string> = []) {
-  const pubsub = Effect.runSync(PubSub.unbounded<ReadonlyArray<FileWatchEvent>>({ replay: 8 }));
+function mockCommandTelemetry() {
+  const records = Ref.makeUnsafe<ReadonlyArray<CommandTelemetryAttributeValues>>([]);
+
+  return {
+    provide: Effect.provideService(CommandTelemetryAttributes, {
+      record: (values: CommandTelemetryAttributeValues) =>
+        Ref.update(records, (current) => [...current, values]),
+    }),
+    recorded: Ref.get(records),
+  };
+}
+
+// `replay: false` delivers an event only to streams already subscribed, so a restart's
+// re-subscription cannot see it again.
+function mockFileWatcher(
+  expectedPaths: ReadonlyArray<string> = [],
+  { replay = true }: { readonly replay?: boolean } = {},
+) {
+  const pubsub = Effect.runSync(
+    PubSub.unbounded<ReadonlyArray<FileWatchEvent>>({ replay: replay ? 8 : 0 }),
+  );
   const expectedWatch = Deferred.makeUnsafe<void>();
+  const expectedSubscription = Deferred.makeUnsafe<void>();
+  const subscribedPaths = new Set<string>();
   const watchCalls: Array<{
     path: string;
     ignore?: ReadonlyArray<string>;
@@ -321,7 +350,19 @@ function mockFileWatcher(expectedPaths: ReadonlyArray<string> = []) {
           ) {
             Deferred.doneUnsafe(expectedWatch, Exit.void);
           }
-          return Stream.fromPubSub(pubsub);
+          return Stream.unwrap(
+            PubSub.subscribe(pubsub).pipe(
+              Effect.tap(() =>
+                Effect.sync(() => {
+                  subscribedPaths.add(path);
+                  if (expectedPaths.every((expectedPath) => subscribedPaths.has(expectedPath))) {
+                    Deferred.doneUnsafe(expectedSubscription, Exit.void);
+                  }
+                }),
+              ),
+              Effect.map(Stream.fromSubscription),
+            ),
+          );
         },
       }),
     ),
@@ -332,6 +373,7 @@ function mockFileWatcher(expectedPaths: ReadonlyArray<string> = []) {
       return watchCalls;
     },
     awaitExpectedWatch: Deferred.await(expectedWatch),
+    awaitExpectedSubscription: Deferred.await(expectedSubscription),
   };
 }
 
@@ -352,7 +394,7 @@ function mockDockerLogSpawner(behaviors: ReadonlyArray<LogProcessBehavior>) {
 
           const record = {
             command: command.command,
-            args: [...command.args],
+            args: command.args.map(String),
           };
           spawned.push(record);
           yield* Effect.acquireRelease(
@@ -489,6 +531,42 @@ function serveWithTimers(flags: FunctionsServeFlags, timers: FunctionsServeTimer
   });
 }
 
+// Opens when serve starts a sleep of `period`, so a test acts inside that window instead of
+// racing it.
+function sleepProbe(period: Duration.Duration, window: string) {
+  const opened = Deferred.makeUnsafe<void>();
+
+  return {
+    period,
+    provide: <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      Clock.clockWith((clock) =>
+        Effect.provideService(effect, Clock.Clock, {
+          currentTimeMillisUnsafe: () => clock.currentTimeMillisUnsafe(),
+          currentTimeMillis: clock.currentTimeMillis,
+          currentTimeNanosUnsafe: () => clock.currentTimeNanosUnsafe(),
+          currentTimeNanos: clock.currentTimeNanos,
+          monotonicTimeNanosUnsafe: () => clock.monotonicTimeNanosUnsafe(),
+          monotonicTimeNanos: clock.monotonicTimeNanos,
+          sleep: (duration) =>
+            Duration.equals(duration, period)
+              ? Deferred.succeed(opened, undefined).pipe(Effect.andThen(clock.sleep(duration)))
+              : clock.sleep(duration),
+        }),
+      ),
+    awaitOpened: Effect.fnUntraced(function* (serving: Fiber.Fiber<unknown, unknown>) {
+      const didOpen = yield* Effect.raceFirst(
+        Deferred.await(opened).pipe(Effect.as(true)),
+        Fiber.await(serving).pipe(Effect.as(false)),
+      );
+      expect(didOpen, `serve ended before the ${window} opened`).toBe(true);
+    }),
+  };
+}
+
+function shutdownGraceProbe() {
+  return sleepProbe(Duration.millis(2_345), "shutdown grace window");
+}
+
 const writeCliConfig = Effect.fnUntraced(function* (content: string) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
@@ -752,6 +830,7 @@ describe("functions serve integration", () => {
         expect(error.message).not.toContain("secret-value");
         expect(error.message).not.toContain('near "API-KEY=secret-value"');
       }
+      expect(normalizeCliError(error).code).toBe("UnknownError");
       expect(
         deployMockState.runCalls.filter(
           (call) => call.command === "docker" && call.args[0] === "create",
@@ -762,6 +841,79 @@ describe("functions serve integration", () => {
     }).pipe(Effect.provide(BunServices.layer));
   });
 
+  it.live(
+    "skips a disabled function and sets up the runtime before a malformed functions/.env fails",
+    () => {
+      return Effect.gen(function* () {
+        yield* writeCliConfig(
+          ['project_id = "test-project"', "[functions.off]", "enabled = false", ""].join("\n"),
+        );
+        yield* writeFunctionFile("hello", "index.ts", 'Deno.serve(() => new Response("hello"))\n');
+        yield* writeProjectFile("supabase/functions/.env", "API-KEY=secret-value\n");
+
+        const { layer, out } = setupServe();
+        const error = yield* functionsServe(baseFlags()).pipe(Effect.provide(layer), Effect.flip);
+
+        expect(error.message).toContain("failed to parse environment file:");
+        expect(out.stderrText).toContain("Skipped serving Function: off\n");
+        expect(deployMockState.volumeCalls).toHaveLength(1);
+        expect(deployMockState.networkCalls).toHaveLength(1);
+      }).pipe(Effect.provide(BunServices.layer));
+    },
+  );
+
+  it.live("reports a missing entrypoint before a missing explicit env file", () => {
+    return Effect.gen(function* () {
+      yield* writeCliConfig(
+        [
+          'project_id = "test-project"',
+          "[functions.hello]",
+          'entrypoint = "./functions/hello/missing.ts"',
+          "",
+        ].join("\n"),
+      );
+      yield* writeFunctionFile("hello", "deno.json", '{"imports":{}}\n');
+
+      const { layer } = setupServe();
+      const error = yield* functionsServe(baseFlags({ envFile: Option.some("missing.env") })).pipe(
+        Effect.provide(layer),
+        Effect.flip,
+      );
+
+      expect(error.message).toContain("failed to read file:");
+      expect(error.message).not.toContain("missing.env");
+      expect(deployMockState.volumeCalls).toHaveLength(0);
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
+  it.live(
+    "reports a malformed function env file before a later function's missing entrypoint",
+    () => {
+      return Effect.gen(function* () {
+        const path = yield* Path.Path;
+        yield* writeCliConfig(
+          [
+            'project_id = "test-project"',
+            "[functions.a]",
+            "[functions.b]",
+            'entrypoint = "./functions/b/missing.ts"',
+            "",
+          ].join("\n"),
+        );
+        yield* writeFunctionFile("a", "index.ts", 'Deno.serve(() => new Response("a"))\n');
+        yield* writeFunctionFile("a", ".env", "API-KEY=secret-value\n");
+        yield* writeFunctionFile("b", "deno.json", '{"imports":{}}\n');
+
+        const { layer } = setupServe();
+        const error = yield* functionsServe(baseFlags()).pipe(Effect.provide(layer), Effect.flip);
+
+        expect(error.message).toContain(
+          `failed to parse environment file: ${path.join(tempRoot.current, "supabase", "functions", "a", ".env")}`,
+        );
+      }).pipe(Effect.provide(BunServices.layer));
+    },
+  );
+
   it.live(
     "starts the runtime from config-defined functions and wires env, binds, and telemetry",
     () => {
@@ -2023,6 +2175,7 @@ describe("functions serve integration", () => {
   it.effect("stops serving cleanly on a process signal", () => {
     const processControl = mockQueuedProcessControl();
     const childSpawner = mockDockerLogSpawner([{ pending: true }]);
+    const telemetry = mockCommandTelemetry();
 
     return Effect.gen(function* () {
       const created = yield* Deferred.make<void>();
@@ -2057,6 +2210,7 @@ describe("functions serve integration", () => {
       const { layer, out } = setupServe({ processControl, childSpawner });
       const fiber = yield* functionsServe(baseFlags()).pipe(
         Effect.provide(layer),
+        telemetry.provide,
         Effect.forkChild({ startImmediately: true }),
       );
 
@@ -2071,6 +2225,7 @@ describe("functions serve integration", () => {
           .replaceAll("\u001b[22m", "")
           .replaceAll("\\", "/"),
       ).toContain("Stopped serving supabase/functions\n");
+      expect(yield* telemetry.recorded).toStrictEqual([{ serve_end_reason: "signal" }]);
     });
   });
 
@@ -2305,30 +2460,25 @@ describe("functions serve integration", () => {
       () => {
         deployMockState.runHandler = baseDockerRunHandler();
         const processControl = mockQueuedProcessControl();
+        const grace = shutdownGraceProbe();
+        const childSpawner = mockDockerLogSpawner([
+          { exitCode: 1, stderr: "docker logs killed by signal" },
+        ]);
 
         return Effect.gen(function* () {
-          const scope = yield* Effect.scope;
-          // Delays the signal past the log-stream failure so only the grace window, not a
-          // same-tick race, can produce a clean exit. A generous injected grace period keeps
-          // this margin independent of the real clock.
-          const childSpawner = mockDockerLogSpawner([
-            {
-              exitCode: 1,
-              stderr: "docker logs killed by signal",
-              onSpawn: () =>
-                Effect.sleep(Duration.millis(15)).pipe(
-                  Effect.andThen(Effect.sync(() => processControl.signal("SIGINT"))),
-                  Effect.forkIn(scope),
-                  Effect.asVoid,
-                ),
-            },
-          ]);
           yield* writeHelloFunction;
 
           const { layer, out } = setupServe({ processControl, childSpawner });
           const fiber = yield* serveWithTimers(baseFlags(), {
-            shutdownSignalGracePeriod: Duration.seconds(2),
-          }).pipe(Effect.provide(layer), Effect.forkChild({ startImmediately: true }));
+            shutdownSignalGracePeriod: grace.period,
+          }).pipe(
+            Effect.provide(layer),
+            grace.provide,
+            Effect.forkChild({ startImmediately: true }),
+          );
+
+          yield* grace.awaitOpened(fiber);
+          processControl.signal("SIGINT");
 
           const exit = yield* Fiber.await(fiber);
           expect(Exit.isSuccess(exit)).toBe(true);
@@ -2346,26 +2496,20 @@ describe("functions serve integration", () => {
       "downgrades a startup failure to a clean shutdown when the signal lands within the grace window",
       () => {
         const processControl = mockQueuedProcessControl();
+        const telemetry = mockCommandTelemetry();
+        const grace = shutdownGraceProbe();
 
         return Effect.gen(function* () {
-          const scope = yield* Effect.scope;
-          // Delays the signal past the startup failure so only the grace window, not a
-          // same-tick race, can produce a clean exit. A generous injected grace period keeps
-          // this margin independent of the real clock.
           deployMockState.runHandler = (command, args) => {
             if (command !== "docker") {
               throw new Error(`unexpected process: ${command}`);
             }
             if (args[0] === "container" && args[1] === "inspect") {
-              return Effect.sleep(Duration.millis(15)).pipe(
-                Effect.andThen(Effect.sync(() => processControl.signal("SIGINT"))),
-                Effect.forkIn(scope),
-                Effect.as({
-                  exitCode: 1,
-                  stdout: "",
-                  stderr: "Error: No such container: supabase_db_test-project",
-                }),
-              );
+              return {
+                exitCode: 1,
+                stdout: "",
+                stderr: "Error: No such container: supabase_db_test-project",
+              };
             }
             throw new Error(`unexpected docker args: ${args.join(" ")}`);
           };
@@ -2373,8 +2517,16 @@ describe("functions serve integration", () => {
 
           const { layer, out } = setupServe({ processControl });
           const fiber = yield* serveWithTimers(baseFlags(), {
-            shutdownSignalGracePeriod: Duration.seconds(2),
-          }).pipe(Effect.provide(layer), Effect.forkChild({ startImmediately: true }));
+            shutdownSignalGracePeriod: grace.period,
+          }).pipe(
+            Effect.provide(layer),
+            telemetry.provide,
+            grace.provide,
+            Effect.forkChild({ startImmediately: true }),
+          );
+
+          yield* grace.awaitOpened(fiber);
+          processControl.signal("SIGINT");
 
           const exit = yield* Fiber.await(fiber);
           expect(Exit.isSuccess(exit)).toBe(true);
@@ -2384,6 +2536,7 @@ describe("functions serve integration", () => {
               .replaceAll("\u001b[22m", "")
               .replaceAll("\\", "/"),
           ).toContain("Stopped serving supabase/functions\n");
+          expect(yield* telemetry.recorded).toStrictEqual([{ serve_end_reason: "signal" }]);
         });
       },
     );
@@ -2398,12 +2551,17 @@ describe("functions serve integration", () => {
           { exitCode: 0 },
           inspectStateBehavior(false, 1),
         ]);
+        const telemetry = mockCommandTelemetry();
 
         return Effect.gen(function* () {
           yield* writeHelloFunction;
 
           const { layer } = setupServe({ childSpawner });
-          const error = yield* functionsServe(baseFlags()).pipe(Effect.provide(layer), Effect.flip);
+          const error = yield* functionsServe(baseFlags()).pipe(
+            Effect.provide(layer),
+            telemetry.provide,
+            Effect.flip,
+          );
 
           expect(error).toBeInstanceOf(EdgeRuntimeContainerCrashedError);
           if (error instanceof EdgeRuntimeContainerCrashedError) {
@@ -2414,28 +2572,75 @@ describe("functions serve integration", () => {
             // and specifically not `unknown`.
             expect(error[ErrorActionabilityId]).toEqual(actionability.runtimeCrash);
           }
+          expect(yield* telemetry.recorded).toStrictEqual([
+            { serve_end_reason: "container_crashed", edge_runtime_exit_code: 1 },
+          ]);
         });
       },
     );
 
-    it.effect(
-      "ends the session successfully, with a distinct message, when a supervisor tears the container down (exit 143)",
-      () => {
+    it.effect.each([143, 15])(
+      "ends the session successfully, with a distinct message, when a supervisor tears the container down (exit %d)",
+      (exitCode) => {
         deployMockState.runHandler = baseDockerRunHandler();
         const childSpawner = mockDockerLogSpawner([
           { exitCode: 0 },
-          inspectStateBehavior(false, 143),
+          inspectStateBehavior(false, exitCode),
         ]);
+        const telemetry = mockCommandTelemetry();
 
         return Effect.gen(function* () {
           yield* writeHelloFunction;
 
           const { layer, out } = setupServe({ childSpawner });
-          const exit = yield* functionsServe(baseFlags()).pipe(Effect.provide(layer), Effect.exit);
+          const exit = yield* functionsServe(baseFlags()).pipe(
+            Effect.provide(layer),
+            telemetry.provide,
+            Effect.exit,
+          );
 
           expect(Exit.isSuccess(exit)).toBe(true);
-          expect(out.stdoutText).toContain("Edge Runtime container stopped (exit 143).");
+          expect(out.stdoutText).toContain(`Edge Runtime container stopped (exit ${exitCode}).`);
           expect(out.stdoutText).toContain("Stopped serving");
+          expect(yield* telemetry.recorded).toStrictEqual([
+            { serve_end_reason: "container_stopped", edge_runtime_exit_code: exitCode },
+          ]);
+        });
+      },
+    );
+
+    it.live(
+      "records the shutdown signal, not a crash, when a signal lands within the grace window of a container crash",
+      () => {
+        deployMockState.runHandler = baseDockerRunHandler();
+        const processControl = mockQueuedProcessControl();
+        const telemetry = mockCommandTelemetry();
+        const grace = shutdownGraceProbe();
+        const childSpawner = mockDockerLogSpawner([
+          { exitCode: 0 },
+          inspectStateBehavior(false, 1),
+        ]);
+
+        return Effect.gen(function* () {
+          yield* writeHelloFunction;
+
+          const { layer } = setupServe({ processControl, childSpawner });
+          const fiber = yield* serveWithTimers(baseFlags(), {
+            shutdownSignalGracePeriod: grace.period,
+          }).pipe(
+            Effect.provide(layer),
+            telemetry.provide,
+            grace.provide,
+            Effect.forkChild({ startImmediately: true }),
+          );
+
+          yield* grace.awaitOpened(fiber);
+          processControl.signal("SIGINT");
+
+          const exit = yield* Fiber.await(fiber);
+          expect(Exit.isSuccess(exit)).toBe(true);
+          expect(containerInspectCalls(childSpawner)).toHaveLength(1);
+          expect(yield* telemetry.recorded).toStrictEqual([{ serve_end_reason: "signal" }]);
         });
       },
     );
@@ -2570,16 +2775,24 @@ describe("functions serve integration", () => {
           { exitCode: 0 },
           inspectStateBehavior(false, 0),
         ]);
+        const telemetry = mockCommandTelemetry();
 
         return Effect.gen(function* () {
           yield* writeHelloFunction;
 
           const { layer, out } = setupServe({ childSpawner });
-          const exit = yield* functionsServe(baseFlags()).pipe(Effect.provide(layer), Effect.exit);
+          const exit = yield* functionsServe(baseFlags()).pipe(
+            Effect.provide(layer),
+            telemetry.provide,
+            Effect.exit,
+          );
 
           expect(Exit.isSuccess(exit)).toBe(true);
           expect(out.stdoutText).toContain("Edge Runtime exited (code 0).");
           expect(out.stdoutText).toContain("Stopped serving");
+          expect(yield* telemetry.recorded).toStrictEqual([
+            { serve_end_reason: "container_exited", edge_runtime_exit_code: 0 },
+          ]);
         });
       },
     );
@@ -2596,20 +2809,72 @@ describe("functions serve integration", () => {
               "Error response from daemon: No such container: supabase_edge_runtime_test-project",
           },
         ]);
+        const telemetry = mockCommandTelemetry();
 
         return Effect.gen(function* () {
           yield* writeHelloFunction;
 
           const { layer, out } = setupServe({ childSpawner });
-          const exit = yield* functionsServe(baseFlags()).pipe(Effect.provide(layer), Effect.exit);
+          const exit = yield* functionsServe(baseFlags()).pipe(
+            Effect.provide(layer),
+            telemetry.provide,
+            Effect.exit,
+          );
 
           expect(Exit.isSuccess(exit)).toBe(true);
           expect(out.stdoutText).toContain("Edge Runtime container is no longer available.");
           expect(out.stdoutText).toContain("Stopped serving");
+          expect(yield* telemetry.recorded).toStrictEqual([
+            { serve_end_reason: "container_removed" },
+          ]);
         });
       },
     );
 
+    it.effect("records only the final end, not the watched-file restart before it", () => {
+      deployMockState.runHandler = baseDockerRunHandler();
+      const childSpawner = mockDockerLogSpawner([
+        { pending: true },
+        { exitCode: 0 },
+        inspectStateBehavior(false, 15),
+      ]);
+      const telemetry = mockCommandTelemetry();
+      const restartDebounce = sleepProbe(Duration.millis(500), "restart debounce window");
+
+      return Effect.gen(function* () {
+        const path = yield* Path.Path;
+        yield* writeHelloFunction;
+        const functionsDir = path.join(tempRoot.current, "supabase", "functions");
+        const fileWatcher = mockFileWatcher([functionsDir], { replay: false });
+
+        const { layer, out } = setupServe({ fileWatcher, childSpawner });
+        const fiber = yield* functionsServe(baseFlags()).pipe(
+          Effect.provide(layer),
+          telemetry.provide,
+          restartDebounce.provide,
+          Effect.forkChild({ startImmediately: true }),
+        );
+
+        yield* fileWatcher.awaitExpectedSubscription;
+        fileWatcher.emit([{ path: path.join(functionsDir, "hello", "index.ts"), type: "update" }]);
+        yield* restartDebounce.awaitOpened(fiber);
+        yield* TestClock.adjust(Duration.millis(500));
+
+        const exit = yield* Fiber.await(fiber);
+        expect(Exit.isSuccess(exit)).toBe(true);
+        expect(
+          deployMockState.runCalls.filter(
+            (call) => call.command === "docker" && call.args[0] === "create",
+          ),
+        ).toHaveLength(2);
+        expect(fileWatcher.watchCalls.filter((call) => call.path === functionsDir)).toHaveLength(2);
+        expect(out.stdoutText).toContain("Edge Runtime container stopped (exit 15).");
+        expect(yield* telemetry.recorded).toStrictEqual([
+          { serve_end_reason: "container_stopped", edge_runtime_exit_code: 15 },
+        ]);
+      }).pipe(Effect.provide(BunServices.layer));
+    });
+
     it.live(
       "re-attaches instead of reporting a graceful exit when docker logs exits 0 but the container is still running",
       () => {
@@ -2685,6 +2950,7 @@ describe("functions serve integration", () => {
         const childSpawner = mockDockerLogSpawner(
           Array.from({ length: 6 }, () => reattachPair).flat(),
         );
+        const telemetry = mockCommandTelemetry();
 
         return Effect.gen(function* () {
           yield* writeHelloFunction;
@@ -2692,7 +2958,7 @@ describe("functions serve integration", () => {
           const { layer } = setupServe({ childSpawner });
           const error = yield* serveWithTimers(baseFlags(), {
             dockerLogRetryDelay: Duration.millis(1),
-          }).pipe(Effect.provide(layer), Effect.flip);
+          }).pipe(Effect.provide(layer), telemetry.provide, Effect.flip);
 
           expect(error).toBeInstanceOf(EdgeRuntimeLogStreamLostError);
           if (error instanceof EdgeRuntimeLogStreamLostError) {
@@ -2701,6 +2967,7 @@ describe("functions serve integration", () => {
             expect(error.message).toContain("5 times");
           }
           expect(childSpawner.maxLiveHandles).toBe(1);
+          expect(yield* telemetry.recorded).toStrictEqual([]);
         });
       },
     );
@@ -2742,12 +3009,17 @@ describe("functions serve integration", () => {
           { exitCode: 1, stderr: "docker logs connection reset" },
           inspectStateBehavior(false, 137, true),
         ]);
+        const telemetry = mockCommandTelemetry();
 
         return Effect.gen(function* () {
           yield* writeHelloFunction;
 
           const { layer } = setupServe({ childSpawner });
-          const error = yield* functionsServe(baseFlags()).pipe(Effect.provide(layer), Effect.flip);
+          const error = yield* functionsServe(baseFlags()).pipe(
+            Effect.provide(layer),
+            telemetry.provide,
+            Effect.flip,
+          );
 
           expect(error).toBeInstanceOf(DockerLogsStreamError);
           if (error instanceof DockerLogsStreamError) {
@@ -2759,6 +3031,39 @@ describe("functions serve integration", () => {
               fingerprint_suffix: "out_of_memory",
             });
           }
+          expect(yield* telemetry.recorded).toStrictEqual([
+            { serve_end_reason: "container_crashed", edge_runtime_exit_code: 137 },
+          ]);
+        });
+      },
+    );
+
+    it.live.each([0, 15])(
+      "fails with the log-stream error without recording a crash when the stopped container exited with %d",
+      (containerExitCode) => {
+        deployMockState.runHandler = baseDockerRunHandler();
+        const childSpawner = mockDockerLogSpawner([
+          { exitCode: 1, stderr: "docker logs connection reset" },
+          inspectStateBehavior(false, containerExitCode),
+        ]);
+        const telemetry = mockCommandTelemetry();
+
+        return Effect.gen(function* () {
+          yield* writeHelloFunction;
+
+          const { layer } = setupServe({ childSpawner });
+          const error = yield* functionsServe(baseFlags()).pipe(
+            Effect.provide(layer),
+            telemetry.provide,
+            Effect.flip,
+          );
+
+          expect(error).toBeInstanceOf(DockerLogsStreamError);
+          if (error instanceof DockerLogsStreamError) {
+            expect(error.message).toBe("docker logs connection reset");
+            expect(error.oomKilled).toBe(false);
+          }
+          expect(yield* telemetry.recorded).toStrictEqual([]);
         });
       },
     );
@@ -4035,6 +4340,7 @@ describe("functions serve integration", () => {
         expect(error.message).toContain(".env");
         expect(error.message).toContain("no such file or directory");
       }
+      expect(normalizeCliError(error).code).toBe("UnknownError");
       expect(
         deployMockState.runCalls.filter(
           (call) => call.command === "docker" && call.args[0] === "create",
diff --git a/apps/cli/src/commands/functions/serve/serve.stack.e2e.test.ts b/apps/cli/src/commands/functions/serve/serve.stack.e2e.test.ts
index 1bc97ba32a..2e7728ecd7 100644
--- a/apps/cli/src/commands/functions/serve/serve.stack.e2e.test.ts
+++ b/apps/cli/src/commands/functions/serve/serve.stack.e2e.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   create as createStack,
@@ -72,6 +72,9 @@ const fixture = Effect.fn("FunctionsServeE2e.fixture")(function* (
       databaseUrl: Deno.env.get("SUPABASE_DB_URL") ?? null,
     }));`,
   );
+  /* serve re-reads this file, so it must hold the member's saved env. */
+  if (included)
+    yield* fs.writeFileString(path.join(functionsRoot, ".env"), "CUSTOM_VALUE=original\n");
   yield* fs.writeFileString(path.join(root, "override.env"), "CUSTOM_VALUE=overridden\n");
   yield* fs.makeDirectory(path.join(home, "cache"), { recursive: true });
   yield* fs.makeDirectory(stackArtifactCacheRoot, { recursive: true });
@@ -109,6 +112,7 @@ const fixture = Effect.fn("FunctionsServeE2e.fixture")(function* (
               functionsRoot,
               jwtSecret,
               verifyJwt: true,
+              functions: {},
               env: { CUSTOM_VALUE: "original" },
             },
             endpoints: { http: { port: "auto" as const } },
@@ -200,7 +204,7 @@ const payload = Effect.fn("FunctionsServeE2e.payload")(function* (
   return yield* Schema.decodeUnknownEffect(Payload)(yield* response.json);
 });
 
-const layer = Layer.mergeAll(BunServices.layer, FetchHttpClient.layer);
+const layer = Layer.mergeAll(BunServices.layer, BunCrypto.layer, FetchHttpClient.layer);
 
 /**
  * Follows a service's statuses from the first one it delivers and returns a fiber that resolves
diff --git a/apps/cli/src/commands/functions/serve/serve.stack.handler.ts b/apps/cli/src/commands/functions/serve/serve.stack.handler.ts
index 142270d2ff..db9f0dae05 100644
--- a/apps/cli/src/commands/functions/serve/serve.stack.handler.ts
+++ b/apps/cli/src/commands/functions/serve/serve.stack.handler.ts
@@ -1,21 +1,35 @@
 import { StackError, type ServiceCreation, type Stack } from "@supabase/stack/effect";
-import { DateTime, Effect, Equal, Fiber, Option, Path, Schema, Stream, type Scope } from "effect";
+import {
+  DateTime,
+  Effect,
+  Equal,
+  Fiber,
+  FileSystem,
+  Option,
+  Path,
+  Schema,
+  Stream,
+  type Scope,
+} from "effect";
+import { inferFunctionsManifest, type CliConfig } from "@supabase/config/effect";
 import { Output } from "../../../shared/output/output.service.ts";
 import { CommandSettings } from "../../../config/command-settings.service.ts";
 import { RuntimeInfo } from "../../../shared/runtime/runtime-info.service.ts";
 import { ProcessControl } from "../../../shared/runtime/process-control.service.ts";
+import { loadConfigFileRef } from "../../../command-internal/config-file-ref.ts";
 import { loadStackConfig, StackConfigError } from "../../../command-internal/stack-config.ts";
+import { FUNCTION_SLUG_PATTERN } from "../../../command-internal/config-validate.ts";
 import {
   LockResolutionError,
   readSelectionOrBundled,
 } from "../../../command-internal/stack-lock.ts";
 import {
-  readStackFunctionsEnv,
-  StackFunctionsEnvError,
-} from "../../../command-internal/stack-functions-env.ts";
+  FunctionsEnvError,
+  resolveFunctionsEnv,
+} from "../../../shared/functions/functions-config.ts";
 import { LocalDbRunningError } from "../../../command-internal/db-bootstrap/local-db-running.ts";
 import { stackOpenReadyProject } from "../../../command-internal/stack-local-database.ts";
-import { OutputFlag } from "../../../command-internal/global-flags.ts";
+import { DebugFlag, OutputFlag } from "../../../command-internal/global-flags.ts";
 import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import type { FunctionsServeFlags } from "../../../shared/functions/serve.ts";
 import { logEvent, markerText } from "../../../command-internal/stack-log-events.ts";
@@ -32,7 +46,7 @@ const serveReason = (cause: { readonly message: string }): FunctionsServeStackEr
   if (Schema.is(StackError)(cause)) return "stack";
   if (Schema.is(LockResolutionError)(cause))
     return cause.reason === "io" ? "runtime" : "invalid-config";
-  if (cause instanceof StackFunctionsEnvError || cause instanceof StackConfigError)
+  if (cause instanceof FunctionsEnvError || cause instanceof StackConfigError)
     return "invalid-config";
   // The session only decodes the stack's saved credentials.
   if (cause instanceof Schema.SchemaError) return "state";
@@ -46,6 +60,37 @@ const runtimeError = (cause: { readonly message: string }) =>
 const invalidConfig = (message: string) =>
   new FunctionsServeStackError({ reason: "invalid-config", message });
 
+/* The env file, or functions/.env, wins over secrets. Without an env file each enabled function
+   also gets its own .env, under its config env. */
+const serveEnv = Effect.fn("functions.serve.env")(function* (
+  workdir: string,
+  envFile: Option.Option<string>,
+  project: CliConfig,
+  base: Pick<FunctionsCreation["config"], "functionsRoot" | "functions" | "env">,
+) {
+  const manifest = Option.isSome(envFile)
+    ? {}
+    : yield* inferFunctionsManifest({ cwd: workdir, config: project, search: false });
+  const resolved = yield* resolveFunctionsEnv({
+    secrets: base.env ?? {},
+    functionsDir: base.functionsRoot,
+    envFile,
+    functionSlugs: Object.entries(manifest).flatMap(([slug, { enabled }]) =>
+      enabled && FUNCTION_SLUG_PATTERN.test(slug) ? [slug] : [],
+    ),
+    warn: true,
+  });
+  const functions = { ...base.functions };
+  for (const [slug, env] of Object.entries(resolved.functions))
+    functions[slug] = { ...functions[slug], env: { ...env, ...functions[slug]?.env } };
+  return {
+    env: resolved.shared,
+    ...(base.functions === undefined && Object.keys(resolved.functions).length === 0
+      ? {}
+      : { functions }),
+  };
+});
+
 const follow = Effect.fn("functions.serve.follow")(function* (
   instance: FunctionsInstance,
   launch: Effect.Effect<void, { readonly message: string }, Scope.Scope>,
@@ -112,6 +157,7 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
   const runtime = yield* RuntimeInfo;
   const path = yield* Path.Path;
   const legacyOutput = yield* OutputFlag;
+  const debug = yield* DebugFlag;
   if (output.format === "json" || Option.isSome(legacyOutput))
     return yield* new FunctionsServeStackError({
       reason: "flags",
@@ -137,15 +183,27 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
       suggestion: "Run supabase start first.",
     });
   const { stack, database } = opened.value;
+  /* The stack saved its paths under the real project root, so a symlinked workdir must resolve
+     to the same root. */
+  const workdir = yield* (yield* FileSystem.FileSystem).realPath(settings.workdir);
   const composition = yield* stack.composition.describe;
   const instances = yield* stack.services.list;
   const members = instances.filter(({ id }) =>
     composition.members.some((member) => member.id === id),
   );
   const existing = members.find((instance) => instance.service === "functions");
-  const envFileOverride = Option.isSome(flags.envFile)
-    ? yield* readStackFunctionsEnv(path.resolve(runtime.cwd, flags.envFile.value), false)
-    : undefined;
+  const envFile = Option.map(flags.envFile, (file) => path.resolve(runtime.cwd, file));
+  const config = yield* loadStackConfig(workdir, { selection: readSelectionOrBundled });
+  const creations = yield* config.creations(stack.id);
+  const source = creations.find(
+    (creation): creation is FunctionsCreation => creation.service === "functions",
+  );
+  if (source === undefined) {
+    const configFile = yield* loadConfigFileRef(workdir);
+    return yield* invalidConfig(
+      `Enable edge_runtime in ${configFile.path} before serving Functions.`,
+    );
+  }
   const cleanupWarning = (message: string, error: { readonly message: string }) =>
     output
       .raw(`${message}: ${error.message}\n`, "stderr")
@@ -156,10 +214,18 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
     if (before.config.service !== "functions")
       return yield* invalidConfig("Invalid saved Functions configuration.");
     const saved = before.config.config;
+    /* Fresh config functions replace saved ones, so a serve that never restored cannot leave stale
+       per-function env behind. Debug follows this command's own flag, not the one `start` saved. */
+    const { functions: _savedFunctions, debug: _savedDebug, ...savedSettings } = saved;
     const desired = {
-      ...saved,
-      ...(envFileOverride === undefined ? {} : { env: { ...saved.env, ...envFileOverride } }),
+      ...savedSettings,
+      ...(yield* serveEnv(workdir, envFile, config.source, {
+        functionsRoot: saved.functionsRoot,
+        env: source.config.env,
+        functions: source.config.functions,
+      })),
       ...(Option.isSome(flags.noVerifyJwt) ? { verifyJwt: !flags.noVerifyJwt.value } : {}),
+      ...(debug ? { debug: true } : {}),
     };
     const changed = !Equal.equals(saved, desired);
     yield* Effect.annotateCurrentSpan({
@@ -210,7 +276,6 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
     return yield* invalidConfig("Invalid saved database configuration.");
   const identity = yield* stack.credentials.get;
   if (identity === undefined) return yield* invalidConfig("The stack has no saved credentials.");
-  const config = yield* loadStackConfig(settings.workdir, { selection: readSelectionOrBundled });
   yield* Effect.annotateCurrentSpan("functions.instance", "temporary");
   const refreshedJwks = yield* config.remoteJwks.pipe(
     Effect.catch((cause) =>
@@ -228,19 +293,14 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
   const remoteKeys =
     refreshedJwks === undefined ? [] : yield* Schema.decodeEffect(JwkArray)(refreshedJwks);
   const jwks = yield* Schema.encodeEffect(JwksDocument)({ keys: [...remoteKeys, ...localKeys] });
-  const creations = yield* config.creations(stack.id);
-  const source = creations.find(
-    (creation): creation is FunctionsCreation => creation.service === "functions",
-  );
-  if (source === undefined)
-    return yield* invalidConfig(
-      "Enable edge_runtime in supabase/config.toml before serving Functions.",
-    );
   const databaseUrl = (yield* database.credentials({ from: "runtime" })).databaseUrl;
   if (databaseUrl === undefined) return yield* invalidConfig("The database has no runtime URL.");
   const apiSource = [...members, ...instances].find(
     (instance) =>
-      instance.service === "rest" || instance.service === "auth" || instance.service === "storage",
+      instance.service === "rest" ||
+      instance.service === "auth" ||
+      instance.service === "storage" ||
+      instance.service === "realtime",
   );
   const apiStatus = apiSource === undefined ? undefined : yield* apiSource.status;
   const savedPort = apiStatus?.endpoints.find(({ name }) => name === "http")?.port;
@@ -254,8 +314,6 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
       ? `http://${databaseAddress.hostname}:${port}`
       : (yield* apiSource.credentials({ from: "runtime" })).apiUrl;
   if (apiUrl === undefined) return yield* invalidConfig("The stack has no runtime API URL.");
-  const env =
-    envFileOverride ?? (yield* readStackFunctionsEnv(`${source.config.functionsRoot}/.env`, true));
   const { jwtSecret: _jwtSecret, ...sourceConfig } = source.config;
   const creation: FunctionsCreation = {
     ...source,
@@ -264,8 +322,9 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
       jwks,
       apiUrl,
       databaseUrl,
-      env: { ...env, ...source.config.env, ...envFileOverride },
+      ...(yield* serveEnv(workdir, envFile, config.source, source.config)),
       ...(Option.isSome(flags.noVerifyJwt) ? { verifyJwt: !flags.noVerifyJwt.value } : {}),
+      ...(debug ? { debug: true } : {}),
     },
     endpoints: { ...source.endpoints, http: { port } },
   };
diff --git a/apps/cli/src/commands/functions/serve/serve.stack.integration.test.ts b/apps/cli/src/commands/functions/serve/serve.stack.integration.test.ts
index 791305d159..f73156e633 100644
--- a/apps/cli/src/commands/functions/serve/serve.stack.integration.test.ts
+++ b/apps/cli/src/commands/functions/serve/serve.stack.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -24,7 +24,7 @@ import {
   type Stack,
 } from "@supabase/stack/effect";
 import { StackApi } from "../../../command-internal/stack-api.ts";
-import { OutputFlag } from "../../../command-internal/global-flags.ts";
+import { DebugFlag, OutputFlag } from "../../../command-internal/global-flags.ts";
 import { mockCommandSettings } from "../../../../tests/helpers/command-mocks.ts";
 import { unusedGateway } from "../../../../tests/helpers/unused-stack.ts";
 import {
@@ -52,6 +52,10 @@ type FunctionsInstance = Extract<
   Effect.Success<ReturnType<Stack["services"]["get"]>>,
   { service: "functions" }
 >;
+type RealtimeInstance = Extract<
+  Effect.Success<ReturnType<Stack["services"]["get"]>>,
+  { service: "realtime" }
+>;
 
 const functionsConfig = (): Extract<ServiceCreation, { service: "functions" }>["config"] => ({
   functionsRoot: "/project/supabase/functions",
@@ -117,8 +121,12 @@ const flags = (overrides: Partial<Parameters<typeof functionsServeStack>[0]> = {
 
 const fixture = (
   options: {
+    readonly debug?: boolean;
     readonly failRestartOn?: number;
+    readonly projectRoot?: string;
     readonly standaloneProjectRoot?: string;
+    readonly realtimeApiPort?: number;
+    readonly savedFunctions?: Partial<ReturnType<typeof functionsConfig>>;
     readonly savedGotrueJwtKeys?: string;
     readonly savedJwks?: string;
     readonly savedRemoteJwks?: string;
@@ -145,7 +153,18 @@ const fixture = (
       resetIdentity: Effect.void,
       clearDistinctId: Effect.void,
     });
-    let currentFunctions = functionsConfig();
+    let currentFunctions = { ...functionsConfig(), ...options.savedFunctions };
+    const projectRoot =
+      options.standaloneProjectRoot ??
+      options.projectRoot ??
+      (yield* FileSystem.FileSystem.pipe(
+        Effect.flatMap((fs) =>
+          fs
+            .makeTempDirectoryScoped({ prefix: "functions-serve-project-" })
+            .pipe(Effect.flatMap((root) => fs.realPath(root))),
+        ),
+        Effect.provide(BunServices.layer),
+      ));
     let restartCount = 0;
     let destroyed = false;
     const databaseCreation: Extract<ServiceCreation, { service: "database" }> = {
@@ -215,6 +234,41 @@ const fixture = (
       followStatus: Stream.never,
       readLogs: () => Stream.never,
     };
+    const realtimeApiPort = options.realtimeApiPort;
+    const realtime: ReadonlyArray<RealtimeInstance> =
+      realtimeApiPort === undefined
+        ? []
+        : [
+            {
+              id: "realtime",
+              service: "realtime",
+              status: Effect.succeed(
+                observation(
+                  "realtime",
+                  {
+                    service: "realtime",
+                    pin: selection.realtime,
+                    config: {},
+                    endpoints: { http: { port: "auto" } },
+                  },
+                  {
+                    endpoints: [
+                      { name: "http", protocol: "http", host: "127.0.0.1", port: realtimeApiPort },
+                    ],
+                  },
+                ),
+              ),
+              credentials: () => Effect.succeed({ apiUrl: `http://127.0.0.1:${realtimeApiPort}` }),
+              start: Effect.void,
+              ready: Effect.void,
+              stop: Effect.void,
+              restart: () => Effect.void,
+              destroy: Effect.void,
+              prepare: Effect.void,
+              followStatus: Stream.never,
+              readLogs: () => Stream.never,
+            },
+          ];
     const functions: FunctionsInstance = {
       id: "functions",
       service: "functions" as const,
@@ -258,7 +312,9 @@ const fixture = (
       id: "a".repeat(64),
       services: {
         list: Effect.succeed(
-          options.standaloneProjectRoot === undefined ? [database, functions] : [database],
+          options.standaloneProjectRoot === undefined
+            ? [database, functions, ...realtime]
+            : [database, ...realtime],
         ),
         get: (id: string) => Effect.succeed(id === "database" ? database : functions),
         create: <Input extends ServiceCreationInput>(
@@ -323,18 +379,17 @@ const fixture = (
     const layer = Layer.mergeAll(
       cliConfigValuesTestLayer,
       BunServices.layer,
+      BunCrypto.layer,
       recorder.layer,
       api,
-      mockCommandSettings({
-        workdir: options.standaloneProjectRoot ?? "/project",
-        supabaseHome: "/home",
-      }),
-      mockRuntimeInfo({ cwd: options.standaloneProjectRoot ?? "/project", homeDir: "/home" }),
+      mockCommandSettings({ workdir: projectRoot, supabaseHome: "/home" }),
+      mockRuntimeInfo({ cwd: projectRoot, homeDir: "/home" }),
       output.layer,
       signalControl.layer,
       telemetry,
       stackBackendLayer("stack"),
       Layer.succeed(OutputFlag, Option.none()),
+      Layer.succeed(DebugFlag, options.debug ?? false),
     );
     return {
       layer,
@@ -396,7 +451,7 @@ describe("experimental Stack Functions serve", () => {
         yield* Deferred.succeed(state.signal, undefined);
         yield* Fiber.join(run);
         expect(state.destroyed).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("runs standalone Functions on the pin the project lock selects", () =>
@@ -431,7 +486,7 @@ describe("experimental Stack Functions serve", () => {
 
       yield* Deferred.succeed(state.signal, undefined);
       yield* Fiber.join(run);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live(
@@ -459,7 +514,95 @@ describe("experimental Stack Functions serve", () => {
 
         yield* Deferred.succeed(state.signal, undefined);
         yield* Fiber.join(run);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("creates standalone Functions with secrets and each function's own .env", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-own-env-standalone-" });
+      for (const slug of ["echo", "_shared"]) {
+        yield* fs.makeDirectory(`${root}/supabase/functions/${slug}`, { recursive: true });
+        yield* fs.writeFileString(`${root}/supabase/functions/${slug}/index.ts`, "");
+      }
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-own-env"\n[edge_runtime.secrets]\nlower_name = "secret"\nSHARED = "secret"\nSUPABASE_TOML = "x"\nUNSET_NAME = "env(FUNCTIONS_SERVE_STACK_UNSET_SECRET)"\n',
+      );
+      yield* fs.writeFileString(`${root}/supabase/functions/.env`, "SHARED=dotenv\n");
+      yield* fs.writeFileString(`${root}/supabase/functions/echo/.env`, "PER_FN=echo\n");
+      yield* fs.writeFileString(`${root}/supabase/functions/_shared/.env`, "BARREL=never-read\n");
+      const state = yield* fixture({ standaloneProjectRoot: root });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild({ startImmediately: true }),
+      );
+      yield* Deferred.await(state.started);
+      expect(state.createdFunctions?.config.env).toEqual({
+        LOWER_NAME: "secret",
+        SHARED: "dotenv",
+      });
+      expect(state.createdFunctions?.config.functions?.echo?.env).toEqual({ PER_FN: "echo" });
+      expect(state.createdFunctions?.config.functions?._shared?.env).toBeUndefined();
+      expect(state.output.stderrText).toContain(
+        "Env name cannot start with SUPABASE_, skipping: SUPABASE_TOML\n",
+      );
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("creates standalone Functions with the explicit env file in place of .env files", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-env-file-standalone-" });
+      yield* fs.makeDirectory(`${root}/supabase/functions/echo`, { recursive: true });
+      yield* fs.writeFileString(`${root}/supabase/functions/echo/index.ts`, "");
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-env-file"\n[edge_runtime.secrets]\nSHARED = "secret"\nSECRET_ONLY = "secret"\n',
+      );
+      yield* fs.writeFileString(`${root}/supabase/functions/.env`, "DOTENV_ONLY=dotenv\n");
+      yield* fs.writeFileString(`${root}/supabase/functions/echo/.env`, "PER_FN=echo\n");
+      const file = `${root}/override.env`;
+      yield* fs.writeFileString(file, 'SHARED=override\nMULTI="first\nsecond"\n');
+      const state = yield* fixture({ standaloneProjectRoot: root });
+      const run = yield* functionsServeStack(flags({ envFile: Option.some(file) })).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild({ startImmediately: true }),
+      );
+      yield* Deferred.await(state.started);
+      expect(state.createdFunctions?.config.env).toEqual({
+        SHARED: "override",
+        SECRET_ONLY: "secret",
+        MULTI: "first\nsecond",
+      });
+      expect(state.createdFunctions?.config.functions?.echo?.env).toBeUndefined();
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("serves standalone Functions on the API port a running Realtime holds", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-realtime-api-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-realtime-api"\n\n[edge_runtime]\nenabled = true\n',
+      );
+      const state = yield* fixture({ standaloneProjectRoot: root, realtimeApiPort: 23848 });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild({ startImmediately: true }),
+      );
+      yield* Deferred.await(state.started);
+      expect(state.createdFunctions?.endpoints?.http?.port).toBe(23848);
+      expect(state.createdFunctions?.config.apiUrl).toBe("http://127.0.0.1:23848");
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("refreshes remote JWKS before creating standalone Functions", () =>
@@ -523,7 +666,7 @@ describe("experimental Stack Functions serve", () => {
 
       yield* Deferred.succeed(state.signal, undefined);
       yield* Fiber.join(run);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("keeps local signing keys and warns when remote JWKS refresh fails", () =>
@@ -582,7 +725,7 @@ describe("experimental Stack Functions serve", () => {
 
       yield* Deferred.succeed(state.signal, undefined);
       yield* Fiber.join(run);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("forwards Functions output written since serve started and reports lost output", () =>
@@ -642,13 +785,180 @@ describe("experimental Stack Functions serve", () => {
     }),
   );
 
-  it.live("merges an explicit env file with saved secrets and restores them on SIGINT", () =>
+  it.live("re-reads the project env files for composed Functions and restores on SIGINT", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-env-files-" });
+      const functionsRoot = `${root}/supabase/functions`;
+      for (const slug of ["echo", "off"]) {
+        yield* fs.makeDirectory(`${functionsRoot}/${slug}`, { recursive: true });
+        yield* fs.writeFileString(`${functionsRoot}/${slug}/index.ts`, "");
+      }
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-env-files"\n[edge_runtime.secrets]\nSHARED = "secret"\nSECRET_ONLY = "secret"\n[functions.echo.env]\nTOML_WINS = "env(FUNCTIONS_SERVE_STACK_TOML_WINS)"\n[functions.off]\nenabled = false\n',
+      );
+      yield* fs.writeFileString(`${root}/.env`, "FUNCTIONS_SERVE_STACK_TOML_WINS=toml\n");
+      yield* fs.writeFileString(`${functionsRoot}/.env`, "SHARED=edited\nSUPABASE_SKIP=x\n");
+      yield* fs.writeFileString(`${functionsRoot}/echo/.env`, "PER_FN=echo\nTOML_WINS=dotenv\n");
+      yield* fs.writeFileString(`${functionsRoot}/off/.env`, "INVALID-KEY=never-read\n");
+      const saved = { functionsRoot };
+      const state = yield* fixture({ projectRoot: root, savedFunctions: saved });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild,
+      );
+      yield* Deferred.await(state.started);
+      expect(state.currentFunctions.env).toEqual({ SHARED: "edited", SECRET_ONLY: "secret" });
+      expect(state.currentFunctions.functions?.echo?.env).toEqual({
+        PER_FN: "echo",
+        TOML_WINS: "toml",
+      });
+      expect(state.currentFunctions.functions?.off?.env).toEqual({});
+      expect(state.output.stderrText).toContain(
+        "Env name cannot start with SUPABASE_, skipping: SUPABASE_SKIP\n",
+      );
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+      expect(state.currentFunctions).toEqual({ ...functionsConfig(), ...saved });
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("serves composed Functions from the stack's real project root through a symlink", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.realPath(
+        yield* fs.makeTempDirectoryScoped({ prefix: "functions-real-root-" }),
+      );
+      const links = yield* fs.makeTempDirectoryScoped({ prefix: "functions-root-link-" });
+      const alias = `${links}/project`;
+      yield* fs.symlink(root, alias);
+      const functionsRoot = `${root}/supabase/functions`;
+      const entrypoint = `${functionsRoot}/echo/index.ts`;
+      yield* fs.makeDirectory(`${functionsRoot}/echo`, { recursive: true });
+      yield* fs.writeFileString(entrypoint, "");
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-root-link"\n[functions.echo]\nentrypoint = "./functions/echo/index.ts"\n',
+      );
+      const saved = { functionsRoot, functions: { echo: { entrypoint } } };
+      const state = yield* fixture({ projectRoot: alias, savedFunctions: saved });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild,
+      );
+      yield* Deferred.await(state.started);
+      expect(state.currentFunctions.functions?.echo?.entrypoint).toBe(entrypoint);
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("keeps composed Functions running when the project env files are unchanged", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-env-same-" });
+      const functionsRoot = `${root}/supabase/functions`;
+      yield* fs.makeDirectory(`${functionsRoot}/echo`, { recursive: true });
+      yield* fs.writeFileString(`${functionsRoot}/echo/index.ts`, "");
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-env-same"\n[edge_runtime.secrets]\nSHARED = "secret"\n',
+      );
+      yield* fs.writeFileString(`${functionsRoot}/.env`, "DOTENV=x\n");
+      yield* fs.writeFileString(`${functionsRoot}/echo/.env`, "PER_FN=echo\n");
+      const saved = {
+        functionsRoot,
+        env: { SHARED: "secret", DOTENV: "x" },
+        functions: { echo: { env: { PER_FN: "echo" } } },
+      };
+      const state = yield* fixture({ projectRoot: root, savedFunctions: saved });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild,
+      );
+      yield* Deferred.await(state.started);
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+      expect(state.restartCount).toBe(0);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("replaces stale per-function env a previous serve left on composed Functions", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-env-stale-" });
+      const functionsRoot = `${root}/supabase/functions`;
+      for (const slug of ["echo", "gone"]) {
+        yield* fs.makeDirectory(`${functionsRoot}/${slug}`, { recursive: true });
+        yield* fs.writeFileString(`${functionsRoot}/${slug}/index.ts`, "");
+      }
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-env-stale"\n[edge_runtime.secrets]\nSHARED = "secret"\n',
+      );
+      yield* fs.writeFileString(`${functionsRoot}/echo/.env`, "PER_FN=fresh\n");
+      const saved = {
+        functionsRoot,
+        env: { SHARED: "secret" },
+        functions: { echo: { env: { PER_FN: "stale" } }, gone: { env: { OLD: "deleted" } } },
+      };
+      const state = yield* fixture({ projectRoot: root, savedFunctions: saved });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild,
+      );
+      yield* Deferred.await(state.started);
+      expect(state.currentFunctions.functions).toEqual({ echo: { env: { PER_FN: "fresh" } } });
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+      expect(state.currentFunctions).toEqual({ ...functionsConfig(), ...saved });
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("rejects serving composed Functions once edge_runtime is disabled", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-disabled-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-disabled"\n[edge_runtime]\nenabled = false\n',
+      );
+      const state = yield* fixture({ projectRoot: root });
+      const exit = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.exit,
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failure = Cause.findErrorOption(exit.cause);
+        expect(Option.isSome(failure)).toBe(true);
+        if (Option.isSome(failure))
+          expect(failure.value.message).toBe(
+            "Enable edge_runtime in supabase/config.toml before serving Functions.",
+          );
+      }
+      expect(state.restartCount).toBe(0);
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("replaces the project env files with an explicit env file and restores on SIGINT", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-env-merge-" });
+      const functionsRoot = `${root}/supabase/functions`;
+      yield* fs.makeDirectory(`${functionsRoot}/echo`, { recursive: true });
+      yield* fs.writeFileString(`${functionsRoot}/echo/index.ts`, "");
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "functions-env-merge"\n[edge_runtime.secrets]\nSHARED = "secret"\nSECRET_ONLY = "secret"\n',
+      );
+      yield* fs.writeFileString(`${functionsRoot}/.env`, "DOTENV_ONLY=dotenv\n");
+      yield* fs.writeFileString(`${functionsRoot}/echo/.env`, "PER_FN=echo\n");
       const file = `${root}/override.env`;
       yield* fs.writeFileString(file, "SHARED=override\nADDED=new\n");
-      const state = yield* fixture();
+      const state = yield* fixture({ projectRoot: root, savedFunctions: { functionsRoot } });
       const run = yield* functionsServeStack(flags({ envFile: Option.some(file) })).pipe(
         Effect.provide(state.layer),
         Effect.forkChild,
@@ -656,13 +966,44 @@ describe("experimental Stack Functions serve", () => {
       yield* Deferred.await(state.started);
       expect(state.currentFunctions.env).toEqual({
         SHARED: "override",
-        RETAINED: "retained",
+        SECRET_ONLY: "secret",
         ADDED: "new",
       });
+      expect(state.currentFunctions.functions).toEqual({});
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+      expect(state.currentFunctions).toEqual({ ...functionsConfig(), functionsRoot });
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
+  it.live("runs composed Functions in debug mode for --debug and restores it on SIGINT", () =>
+    Effect.gen(function* () {
+      const state = yield* fixture({ debug: true });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild,
+      );
+      yield* Deferred.await(state.started);
+      expect(state.currentFunctions.debug).toBe(true);
       yield* Deferred.succeed(state.signal, undefined);
       yield* Fiber.join(run);
-      expect(state.currentFunctions.env).toEqual(functionsConfig().env);
-    }).pipe(Effect.provide(BunServices.layer)),
+      expect(state.currentFunctions).toEqual(functionsConfig());
+    }),
+  );
+
+  it.live("serves quietly without --debug on a debug-started stack and restores it on SIGINT", () =>
+    Effect.gen(function* () {
+      const state = yield* fixture({ savedFunctions: { debug: true } });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild,
+      );
+      yield* Deferred.await(state.started);
+      expect(state.currentFunctions.debug).toBeUndefined();
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+      expect(state.currentFunctions).toEqual({ ...functionsConfig(), debug: true });
+    }),
   );
 
   it.live("rejects unsupported flags before reading or mutating the stack", () =>
@@ -720,39 +1061,46 @@ describe("experimental Stack Functions serve", () => {
       ).toBe(true);
     }),
   );
-  it.live("rejects multiline environment values before restarting Functions", () =>
+  it.live("passes multiline values and legacy names from an env file to Functions", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-env-" });
       const file = `${root}/override.env`;
-      yield* fs.writeFileString(file, 'CUSTOM_VALUE="first\nsecond"\n');
+      yield* fs.writeFileString(file, 'CUSTOM_VALUE="first\nsecond"\nLEGACY.NAME=value\n');
       const state = yield* fixture();
-      const error = yield* functionsServeStack(flags({ envFile: Option.some(file) })).pipe(
+      const run = yield* functionsServeStack(flags({ envFile: Option.some(file) })).pipe(
         Effect.provide(state.layer),
-        Effect.flip,
+        Effect.forkChild,
       );
-      expect(error.reason).toBe("invalid-config");
-      expect(error.message).toContain("Multiline");
+      yield* Deferred.await(state.started);
+      expect(state.currentFunctions.env).toEqual({
+        CUSTOM_VALUE: "first\nsecond",
+        "LEGACY.NAME": "value",
+      });
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
       expect(state.currentFunctions).toEqual(functionsConfig());
-      expect(state.restartCount).toBe(0);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
-  it.live("rejects an invalid environment key before restarting Functions", () =>
+  it.live("rejects a malformed env file before restarting Functions", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-env-key-" });
       const file = `${root}/override.env`;
-      yield* fs.writeFileString(file, "INVALID.KEY=value\n");
+      yield* fs.writeFileString(file, "API-KEY=secret-value\n");
       const state = yield* fixture();
       const error = yield* functionsServeStack(flags({ envFile: Option.some(file) })).pipe(
         Effect.provide(state.layer),
         Effect.flip,
       );
-      expect(error.message).toContain("Environment names");
+      expect(error.reason).toBe("invalid-config");
+      expect(error.message).toBe(
+        `failed to parse environment file: ${file} (unexpected character '-' in variable name)`,
+      );
       expect(state.currentFunctions).toEqual(functionsConfig());
       expect(state.restartCount).toBe(0);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("restores config when SIGINT arrives during an in-flight restart", () =>
diff --git a/apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts b/apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts
index 8e3b542664..969946fdd3 100644
--- a/apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts
+++ b/apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts
@@ -1,5 +1,5 @@
 import { generateKeyPairSync } from "node:crypto";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, DateTime, Effect, Exit, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { CliOutput, Command } from "effect/cli";
@@ -1232,6 +1232,7 @@ describe("gen bearer-jwt integration", () => {
     const analytics = mockAnalytics();
     const layer = Layer.mergeAll(
       BunServices.layer,
+      BunCrypto.layer,
       processControlLayer,
       CliOutput.layer(textCliOutputFormatter()),
       out.layer,
diff --git a/apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts b/apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts
index d381fc76fe..e34934cdbf 100644
--- a/apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts
+++ b/apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Cause, Effect, Exit, FileSystem, Layer, Option, Path, Schema, Sink, Stream } from "effect";
 import { CliOutput, Command } from "effect/cli";
 import { ChildProcessSpawner } from "effect/process";
@@ -263,6 +263,7 @@ describe("gen signing-key integration", () => {
       const analytics = mockAnalytics();
       const layer = Layer.mergeAll(
         BunServices.layer,
+        BunCrypto.layer,
         processControlLayer,
         CliOutput.layer(textCliOutputFormatter()),
         out.layer,
diff --git a/apps/cli/src/commands/gen/types/SIDE_EFFECTS.md b/apps/cli/src/commands/gen/types/SIDE_EFFECTS.md
index 8bfbf9b7b0..c82eb7e2da 100644
--- a/apps/cli/src/commands/gen/types/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/gen/types/SIDE_EFFECTS.md
@@ -9,26 +9,28 @@ registry, which lists every `--lang` value and either calls that language's gene
 was run from, with the introspected document on stdin (`--lang dart` runs
 `dart run supabase_typegen --output -`, `--lang swift` runs supabase-swift's
 `supabase-typegen`). A bump of that dependency can add a `--lang` value or a
-language flag; the CLI names no language itself. TypeScript output for a remote project
-still comes from the Management API; every other language and target (including local and a database
-URL) connects to the database and introspects it directly — no pg-meta container is involved. When
+language flag; the CLI names no language itself. Every language and target (including a remote
+project, local and a database URL) connects to the database and introspects it directly — no pg-meta
+container is involved. The one exception is TypeScript for a remote project: it generates directly only
+when that is eligible, and otherwise, or when direct generation fails before introspection starts,
+uses the Management API (see Notes). When
 `[experimental].stack` is on, the local target resolves the project stack through `DbConfigResolver`
 instead of inspecting `supabase_db_*`.
 
 ## Files Read
 
-| Path                                                                    | Format             | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| ----------------------------------------------------------------------- | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `<workdir>/supabase/.temp/project-ref`                                  | plain text         | a remote project: resolves the ref (bare `--remote` with no `SUPABASE_PROJECT_ID`) and tells whether it is the linked project; with no selector, only to word the linked-checkout hint and to decide whether a stopped local stack suggests `--remote`                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `<workdir>/supabase/.temp/linked-project.json`                          | JSON               | to name the project in the `Target:` banner and the linked-checkout hint, and as the parent project for `--remote=<branch>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `~/.supabase/access-token`                                              | plain text         | when `SUPABASE_ACCESS_TOKEN` unset and the target is a remote project (or a branch is looked up)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `<workdir>/supabase/config.toml` or `config.json`                       | TOML/JSON          | when selecting schemas on a remote project (a matched `[remotes.<ref>]` block over the base) or with `--remote=<db-url>` (`--schema` omitted; any `--schema` skips the schema load entirely). The local target reads the config through `readDbToml` and always keeps the embedded-default fallback when the file is absent. On the other paths, a DEFAULTED workdir also keeps the embedded-default fallback (`included_schemas` falls back to `public,graphql_public`); an EXPLICIT `--workdir`/`SUPABASE_WORKDIR` that holds no project instead FAILS (`GenTypesMissingProjectConfigError`) rather than silently generating a `public`-only types file — see the exit-code table |
-| `<workdir>/supabase/config.json` or `config.toml` (`[db]` values only)  | JSON/TOML          | every `--remote=<db-url>` resolution, regardless of `--schema` — `DbConfigResolver` reads it through `readDbToml` (`config.json` preferred when both exist) to fill a passwordless local DSN's `[db].password` and to classify the target host as local vs. remote. A present-but-unparseable config file fails the command (`DbConfigLoadError`) even on this path, independent of the schema-selecting load above.                                                                                                                                                                                                                                                                |
-| `<workdir>{/supabase}/.env*`                                            | dotenv             | the local target; resolves the same nested environment overrides as the CLI. Every `--remote=<db-url>` resolution also reads it (same `.env.<SUPABASE_ENV>.local`/`.env.local`/`.env.<SUPABASE_ENV>`/`.env` search) to populate the `PG*` fallbacks used while parsing the DSN.                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `~/.pg_service.conf` (or a `PGSERVICEFILE`/DSN `servicefile=` override) | libpq service file | `--remote=<db-url>`, only when the DSN or `PGSERVICE` names a `service` — its settings fill in for connection fields the DSN itself omits                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `Package.resolved` (nearest)                                            | JSON               | `--lang swift` without `SUPABASE_TYPEGEN`, on macOS or Linux x86_64: the first one found walking up from the working directory, including the copies inside an `.xcodeproj` or `.xcworkspace`; the supabase-swift version it pins picks the `supabase-typegen` release                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `<workdir>/supabase/.temp/rest-version`                                 | plain text         | the local target only, when `db.major_version > 14` — forces v9 compat if the tag contains `v9`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `$PGSSLROOTCERT`, `$PGSSLCERT` / `$PGSSLKEY`, `pg_service.conf`         | PEM, libpq         | non-TypeScript `--lang` on a remote project, when `PGSSLCERT`/`PGSSLKEY` or `PGSERVICE` are set; `$PGSSLROOTCERT` only on the pooler temp-role probe; the PEM files are skipped under `PGSSLMODE=disable`                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Path                                                                    | Format             | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| ----------------------------------------------------------------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/.temp/project-ref`                                  | plain text         | a remote project: resolves the ref (bare `--remote` with no `SUPABASE_PROJECT_ID`) and tells whether it is the linked project; with no selector, only to word the linked-checkout hint and to decide whether a stopped local stack suggests `--remote`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `<workdir>/supabase/.temp/linked-project.json`                          | JSON               | to name the project in the `Target:` banner and the linked-checkout hint, and as the parent project for `--remote=<branch>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `~/.supabase/access-token`                                              | plain text         | when `SUPABASE_ACCESS_TOKEN` unset and the target is a remote project (or a branch is looked up)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `<workdir>/supabase/config.toml` or `config.json`                       | TOML/JSON          | when selecting schemas on a remote project (a matched `[remotes.<ref>]` block over the base) or with `--remote=<db-url>` (`--schema` omitted; any `--schema` skips the schema load entirely). Every path that introspects the database (the local target, `--remote=<db-url>`, and a remote project) also reads `[api].extra_search_path` from it, even with `--schema`, so a malformed file fails those invocations before any API call or connection, except TypeScript on a remote project, which then uses the Management API instead (see Notes); the default (`public,extensions`) applies when the file is absent. A remote project takes it from this file (with a matched `[remotes.<ref>]` block), like `[api].schemas`, not from the project's hosted `db_extra_search_path`. The local target reads the config through `readDbConfig` and always keeps the embedded-default fallback when the file is absent. On the other paths, a DEFAULTED workdir also keeps the embedded-default fallback (`included_schemas` falls back to `public,graphql_public`); an EXPLICIT `--workdir`/`SUPABASE_WORKDIR` that holds no project instead FAILS (`GenTypesMissingProjectConfigError`) rather than silently generating a `public`-only types file — see the exit-code table |
+| `<workdir>/supabase/config.json` or `config.toml` (`[db]` values only)  | JSON/TOML          | every `--remote=<db-url>` resolution, regardless of `--schema` — `DbConfigResolver` reads it through `readDbConfig` (`config.json` preferred when both exist) to fill a passwordless local DSN's `[db].password` and to classify the target host as local vs. remote. A present-but-unparseable config file fails the command (`DbConfigLoadError`) even on this path, independent of the schema-selecting load above. Resolving a remote project's connection reads the whole config the same strict way (auth hooks, SMTP, email templates, the `signing_keys_path` file, `[db.vault]` secrets), now for `--lang=typescript` too; a failure there fails other languages and falls back to the Management API for TypeScript.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `<workdir>{/supabase}/.env*`                                            | dotenv             | the local target; resolves the same nested environment overrides as the CLI. Every `--remote=<db-url>` resolution also reads it (same `.env.<SUPABASE_ENV>.local`/`.env.local`/`.env.<SUPABASE_ENV>`/`.env` search) to populate the `PG*` fallbacks used while parsing the DSN.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `~/.pg_service.conf` (or a `PGSERVICEFILE`/DSN `servicefile=` override) | libpq service file | `--remote=<db-url>`, only when the DSN or `PGSERVICE` names a `service` — its settings fill in for connection fields the DSN itself omits                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `Package.resolved` (nearest)                                            | JSON               | `--lang swift` without `SUPABASE_TYPEGEN`, on macOS or Linux x86_64: the first one found walking up from the working directory, including the copies inside an `.xcodeproj` or `.xcworkspace`; the supabase-swift version it pins picks the `supabase-typegen` release                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `<workdir>/supabase/.temp/rest-version`                                 | plain text         | the local target, when `db.major_version > 14` — forces v9 compat if the tag contains `v9`; and `--lang=typescript` on the linked project, where it is required for direct generation and, without its leading `v`, becomes `__InternalSupabase.PostgrestVersion`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `$PGSSLROOTCERT`, `$PGSSLCERT` / `$PGSSLKEY`, `pg_service.conf`         | PEM, libpq         | a remote project (any `--lang`), when `PGSSLCERT`/`PGSSLKEY` or `PGSERVICE` are set; `$PGSSLROOTCERT` also replaces the pinned Supabase CA; the PEM files are skipped under `PGSSLMODE=disable`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 
 ## Files Written
 
@@ -43,8 +45,8 @@ Apart from the Swift binary cache, the local target and `--remote=<db-url>` writ
 
 | Method   | Path                                        | Auth         | Request body                              | Response (used fields)                                                                                                                                                  |
 | -------- | ------------------------------------------- | ------------ | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `GET`    | `/v1/projects/{ref}/types/typescript`       | Bearer token | none                                      | TypeScript type definitions text                                                                                                                                        |
-| `GET`    | `/v1/projects/{ref}`                        | Bearer token | none                                      | non-TypeScript lookup (`404` ⇒ branch ref); also the linked-project cache fill on every remote project                                                                  |
+| `GET`    | `/v1/projects/{ref}/types/typescript`       | Bearer token | none                                      | TypeScript type definitions text — only for `--lang=typescript` on a remote project, when direct generation is not eligible or fails before introspection (see Notes)   |
+| `GET`    | `/v1/projects/{ref}`                        | Bearer token | none                                      | project lookup (`404` ⇒ branch ref); also the linked-project cache fill on every remote project                                                                         |
 | `GET`    | `/v1/branches/{branch_id_or_ref}`           | Bearer token | none                                      | `db_host`, `db_port`, `db_user`, `db_pass`                                                                                                                              |
 | `POST`   | `/v1/projects/{ref}/cli/login-role`         | Bearer token | `{ read_only: false }`                    | temporary `role` and `password`                                                                                                                                         |
 | `GET`    | `/v1/projects/{ref}/config/database/pooler` | Bearer token | none                                      | primary pooler `connection_string`                                                                                                                                      |
@@ -54,12 +56,15 @@ Apart from the Swift binary cache, the local target and `--remote=<db-url>` writ
 | `GET`    | `/v1/projects/{parent}/branches`            | Bearer token | none                                      | `[{id, name, project_ref, is_default}]` — only for `--remote=<branch>` (or an alias given a branch name); `{parent}` is `SUPABASE_PROJECT_ID`, else the linked project  |
 | `GET`    | `/v1/branches/{id}`                         | Bearer token | none                                      | `{ref, status, …}` — only for `--remote=<branch UUID>` when no project is linked                                                                                        |
 
-The TypeScript endpoint is called for a remote project (`--remote`, `--remote=<ref>`,
-`--remote=<branch>` or an alias) when `--lang=typescript`. For other languages on a remote project
-(see Notes), the project endpoint is probed first: a `404` means the ref is a preview branch (any
+For a remote project (`--remote`, `--remote=<ref>`, `--remote=<branch>` or an alias), every
+language generates from the database directly. TypeScript does so only when direct generation is
+eligible; otherwise, or when it fails before introspection, it calls the types endpoint instead (see
+Notes), and an ineligible run makes no other call but the cache fill. The project endpoint is probed
+first: a `404` means the ref is a preview branch (any
 404 body), so the branch endpoint supplies the branch database host/port and credentials for the
 direct connection. Otherwise the database connection is resolved for the ref and the login-role
-endpoint supplies temporary credentials. On an IPv4-only network where the direct database host is
+endpoint supplies temporary credentials when no database password resolves (never for
+TypeScript, which requires one). On an IPv4-only network where the direct database host is
 unreachable, remote project generation retries once through the IPv4 pooler only when the current
 target host is the project's direct `db.<ref>` host and the pooler URL matches the expected tenant
 and pooler domain. A ref given by flag (`--remote=<ref>`, `--remote=<branch>` or an alias), or one
@@ -109,7 +114,7 @@ way `--remote=<db-url>` does.
 | `SUPABASE_TYPEGEN`                                                                                                                                                                               | path of the `supabase-typegen` binary `--lang swift` runs, skipping the version lookup and download                                                                                                                                                                                                                                                                                                                                                                      | no                                                                                                                                                                                                     |
 | `XDG_CACHE_HOME`, `HOME`                                                                                                                                                                         | locate the cache directory of the `--lang swift` release binary                                                                                                                                                                                                                                                                                                                                                                                                          | no                                                                                                                                                                                                     |
 | `PATH`, `PATHEXT`, `ComSpec`                                                                                                                                                                     | find the tool of an out-of-process `--lang`; `PATHEXT` and `ComSpec` matter on Windows only                                                                                                                                                                                                                                                                                                                                                                              | no (`PATHEXT` defaults to `.COM;.EXE;.BAT;.CMD`, `ComSpec` to `cmd.exe`; without `PATH` the tool is reported as not installed)                                                                         |
-| `PGSSLMODE`, `PGSSLROOTCERT`, `PGSSLCERT`, `PGSSLKEY`, `PGSSLPASSWORD`, `PGSERVICE`, `PGSERVICEFILE`                                                                                             | non-TypeScript `--lang` on a remote project: client-cert pair outside `sslmode=disable`; invalid values fail; mode and CA stay pinned except on the pooler temp-role probe (see Notes)                                                                                                                                                                                                                                                                                   | no                                                                                                                                                                                                     |
+| `PGSSLMODE`, `PGSSLROOTCERT`, `PGSSLCERT`, `PGSSLKEY`, `PGSSLPASSWORD`, `PGSERVICE`, `PGSERVICEFILE`                                                                                             | a remote project (any `--lang`): client-cert pair outside `sslmode=disable`; invalid values fail (TypeScript falls back to the Management API instead); an explicit `sslmode`/`sslrootcert` replaces the Supabase CA pin (see Notes)                                                                                                                                                                                                                                     | no                                                                                                                                                                                                     |
 | `PGCONNECT_TIMEOUT`                                                                                                                                                                              | same path: the 15s query-timeout default pins it on the project database; the pooler temp-role probe always uses it                                                                                                                                                                                                                                                                                                                                                      | no                                                                                                                                                                                                     |
 
 ## Exit Codes
@@ -126,7 +131,7 @@ way `--remote=<db-url>` does.
 | `1`  | the local target on the legacy Docker Compose stack and `container inspect` exits non-zero for any other reason (`GenTypesLocalDbInspectError`); a linked checkout gets the same suggestion                                                                                   |
 | `1`  | resolved `--workdir`/`SUPABASE_WORKDIR` doesn't exist or isn't a directory (`GenTypesWorkdirError`) — beats every other guard                                                                                                                                                 |
 | `1`  | an explicit `--workdir`/`SUPABASE_WORKDIR` holds no project config on a schema-selecting path (`GenTypesMissingProjectConfigError`) — a DEFAULTED workdir keeps the embedded-default fallback instead                                                                         |
-| `1`  | a resolved preview branch config has no `db_user`/`db_pass` (`GenTypesBranchCredentialsUnavailableError`)                                                                                                                                                                     |
+| `1`  | a resolved preview branch config has no `db_user`/`db_pass` (`GenTypesBranchCredentialsUnavailableError`); `--lang=typescript` falls back to the Management API instead                                                                                                       |
 | `1`  | API error or database connection/introspection/generation failure (`GenTypesGenerationError`)                                                                                                                                                                                 |
 | `1`  | an out-of-process language's toolchain or package is missing from the current directory; the message carries the registry's install hint (`GenTypesToolNotInstalledError`)                                                                                                    |
 | `1`  | an out-of-process language's tool exited unsuccessfully or rejected the metadata document; the message carries its stderr (`GenTypesToolFailedError`)                                                                                                                         |
@@ -139,7 +144,8 @@ Prints generated TypeScript (or other language) type definitions to stdout.
 Diagnostics go to stderr: alias deprecation warnings, one `Target:` banner and `Connecting to …` for database
 introspection. On the legacy Docker Compose stack the banner prints before the running check, so a
 stopped stack still shows the chosen target. In-process TypeScript also prints a stderr note that the
-output is unformatted.
+output is unformatted. TypeScript from the Management API prints no such note; when it is a fallback
+from a failed direct attempt, one stderr warning prints instead (see Notes).
 
 ### `--output-format json`
 
@@ -152,7 +158,32 @@ Not applicable.
 ## Notes
 
 - TypeScript generated in-process is unformatted. stderr suggests `npx oxfmt <generated-file.ts>`.
-  TypeScript for a remote project still comes from the Management API.
+- **TypeScript on a remote project.** `--lang=typescript` on a remote project generates directly
+  with the CLI's generator, like every other language, only when it is eligible: the ref is the
+  linked project (`.temp/project-ref`), `link` recorded its PostgREST version in
+  `.temp/rest-version`, and a database password resolves (`SUPABASE_DB_PASSWORD`, shell env >
+  project `.env*`). The version, without its leading `v`, is passed as typegen's `postgrest-version`,
+  so the output keeps `__InternalSupabase.PostgrestVersion` like the API's; requiring a password
+  means no login role is minted, since minting resets that role's password under any concurrent
+  command. The output applies `[api].extra_search_path` and is unformatted like the other paths.
+  When not eligible (or any of those inputs cannot be read), the command prints the types returned
+  by `GET /v1/projects/{ref}/types/typescript` as-is, without a warning, as before.
+- **TypeScript Management API fallback.** When eligible direct generation fails before introspection
+  starts, the command prints a warning on stderr and then the types endpoint's output as-is (no
+  formatting note), for the schemas the direct path would have used. The warning is yellow and reads
+  `Warning: Could not generate types from the project database (<first line of the error>), so these
+types come from the Management API: they do not apply [api].extra_search_path or the CLI's
+generator.`, then the failing error's own suggestion when it carries one, then `This fallback is
+removed in the next major version.` stdout carries only the types.
+- **Fallback rule.** The fallback covers every failure before introspection starts: resolving
+  `[api].extra_search_path` and the rest of the config (including the strict config read), the
+  project or preview-branch lookup (the project lookup needs `projects:read`, which the types
+  endpoint does not), the libpq `PG*` environment, connection and pooler resolution (including an
+  IPv6-only direct host and a missing privileged role), a preview branch without database
+  credentials, and connecting, TLS or authentication (also on the IPv4 pooler retry). It does not
+  cover a generator failure (`GenTypesGenerationError`: the database answered, so the API would hit
+  the same schema), which fails the command. Other languages never fall back. The fallback is
+  removed in the next major version.
 - **`--remote <word>`.** A word after `--remote` is always read as `--remote=<word>`: the legacy positional
   language is hidden and takes no part in that reading, so a language goes before `--remote`
   (`gen types typescript --remote`). A word that is a language name (`--remote typescript`) is still
@@ -195,21 +226,28 @@ Not applicable.
   PostgreSQL connection, and there is no container to join a Docker network from. Use a
   host-reachable `--remote=<db-url>` instead.
 - **TLS.** There is no SSL probe on any path.
-  - A remote project (including a resolved preview branch) connects with `sslmode=require` and the bundled Supabase CA pinned
-    (promoted to `verify-ca`), matching prior behavior. On a project ref the `PG*` env
-    (see `db push`) is validated and supplies the client-cert pair, and the 15s query timeout
-    sets the connect timeout; the pooler temp-role probe runs before the pin and takes the shell
-    `PG*` TLS and timeout settings; a preview branch's direct host takes no `PG*` setting.
+  - A remote project (including a resolved preview branch) on a `supabase`, `supabase-staging` or
+    `snap` profile host connects with `sslmode=require` and the bundled Supabase CA pinned (promoted to
+    `verify-ca`) unless `sslmode` is set from any source, which is then used as is. A root cert
+    set without `sslmode` replaces the bundled CA and keeps `require`. The connection resolver applies the pin for a project ref, its direct host and pooler
+    alike, including the pooler temp-role probe (see `db push`); this command applies it itself
+    only to a preview branch. On a project ref the `PG*` env (see `db push`) is validated and
+    supplies the client-cert pair, and the 15s query timeout sets the connect timeout. A preview
+    branch's direct host takes no `PG*` setting and is always pinned; its pooler fallback parses
+    the pooler URL with the shell `PG*` env, so `PGSSLMODE`, `PGSSLROOTCERT`, the client-cert pair
+    and `PGCONNECT_TIMEOUT` apply there, and a set `PGSSLMODE` or `PGSSLROOTCERT` replaces the pin.
   - `--remote=<db-url>` honors the DSN's own `sslmode`/`sslrootcert` when either is set, even
     against a target classified local (e.g. a TLS tunnel on the loopback stack);
-    otherwise, a known Supabase host gets the Supabase CA pinned the same way, and any
+    otherwise, a known Supabase host on a `supabase`, `supabase-staging` or `snap` profile gets
+    the Supabase CA pinned the same way, and any
     other host — including a loopback target where the DSN sets neither — uses the
-    connection resolver's default, which is plaintext for a local target.
+    connection resolver's default: plaintext for a local target, otherwise libpq `prefer` (TLS
+    first, then plaintext when the server declines TLS, the handshake fails, or `pg_hba` rejects
+    the TLS connection).
   - The local target uses no TLS.
 - **Remote project language generation.** `--lang` accepts `typescript` (default), `go`, `swift`, or
-  `python`. A remote project uses the Management API for TypeScript, and connects directly to the
-  project database (temporary login-role credentials, preview-branch fallback) for the other
-  languages, so no database URL is required. Do not revert this to a hard error. The flag groups
+  `python`. A remote project connects directly to the project database (temporary login-role
+  credentials, preview-branch fallback) for every language, so no database URL is required. Do not revert this to a hard error. The flag groups
   block `--swift-access-control`, `--query-timeout` and `--postgrest-v9-compat` whenever a remote
   project selector is passed, so a remote project always generates with defaults (`internal` access
   control, one-to-one detection on, 15s timeout). Use `--remote=<db-url>` for control over any of
@@ -225,10 +263,12 @@ Not applicable.
     which expected an unparsed JSON _string_ rather than the already-decoded row value
     typegen produces; `NotRequired` and `TypeAlias` are now imported from
     `typing_extensions` instead of `typing`.
-  - TypeScript for a remote project is still generated server-side by the
-    Management API and is unaffected by this change, so it can differ from local output
-    on these jsonb cases until the hosted service adopts the same generator.
+  - TypeScript for a remote project uses the same generator when direct generation is
+    eligible; Management API output can differ from local output on these jsonb cases.
 - `--schema` / `-s` accepts a comma-separated list of schemas to include.
+- Introspection follows views in the `[api].extra_search_path` schemas to their base tables, as
+  PostgREST does with `db-extra-search-path`, so a generated view built on such a view keeps its
+  relationships. Nothing in those schemas is generated unless `--schema` or `[api].schemas` names it.
 - Language flags are rendered from the registry's user-facing option specs; today that is
   `--swift-access-control`, which accepts `internal` (default) or `public`.
   Every such flag is mutually exclusive with a remote project selector; on the local and
diff --git a/apps/cli/src/commands/gen/types/types.api-fallback.ts b/apps/cli/src/commands/gen/types/types.api-fallback.ts
new file mode 100644
index 0000000000..ff91ceb632
--- /dev/null
+++ b/apps/cli/src/commands/gen/types/types.api-fallback.ts
@@ -0,0 +1,35 @@
+import {
+  GenTypesGenerationError,
+  GenTypesToolFailedError,
+  GenTypesToolNotInstalledError,
+} from "./types.generator.service.ts";
+
+/**
+ * Whether a direct-generation failure came before introspection ran. The generator's own errors
+ * mean the database answered: the Management API would hit the same schema, so they never fall
+ * back. Everything else that reaches the fallback (config and search-path resolution, libpq
+ * environment, login role, connection resolution, pooler, dial, TLS, authentication) never got
+ * that far.
+ */
+export const failedBeforeIntrospection = (error: unknown): boolean =>
+  !(
+    error instanceof GenTypesGenerationError ||
+    error instanceof GenTypesToolFailedError ||
+    error instanceof GenTypesToolNotInstalledError
+  );
+
+const firstLine = (message: string) => message.split("\n", 1)[0]?.trim() ?? "";
+
+export const apiFallbackWarning = (error: {
+  readonly message: string;
+  readonly suggestion?: string;
+}) =>
+  [
+    `Warning: Could not generate types from the project database (${firstLine(error.message)}), ` +
+      "so these types come from the Management API: they do not apply [api].extra_search_path " +
+      "or the CLI's generator.",
+    ...(error.suggestion === undefined || error.suggestion.trim().length === 0
+      ? []
+      : [error.suggestion.trim()]),
+    "This fallback is removed in the next major version.",
+  ].join("\n");
diff --git a/apps/cli/src/commands/gen/types/types.command.ts b/apps/cli/src/commands/gen/types/types.command.ts
index 4acb165ae9..43f2660796 100644
--- a/apps/cli/src/commands/gen/types/types.command.ts
+++ b/apps/cli/src/commands/gen/types/types.command.ts
@@ -101,8 +101,6 @@ const commandConfig = {
 export type GenTypesFlags = CliCommand.Command.Config.Infer<typeof flagsConfig> &
   Readonly<Record<string, unknown>>;
 
-const NON_TYPESCRIPT = GEN_TYPES_LANGUAGES.filter((lang) => lang !== "typescript");
-const nonTypescript = { flag: "lang", oneOf: NON_TYPESCRIPT } as const;
 const notBranch = "the ref names a project, not a preview branch";
 // A run without a linked target uses a local or `--remote=<url>` database, or fails before the API.
 const remoteTarget: ReadonlyArray<EntryCondition> = [
@@ -150,32 +148,36 @@ export const genTypesCommand = Command.make("types", commandConfig).pipe(
               operationId: "v1-generate-typescript-types",
               kind: "required",
               when: [{ flag: "lang", oneOf: ["typescript"] }],
+              context:
+                "direct generation is not eligible (the ref is not the linked project, supabase/.temp/rest-version is missing, or no database password resolves), or it failed before introspection started (project lookup, config, connection, TLS, authentication or pooler failure); a generator failure does not fall back",
+            },
+            {
+              operationId: "v1-get-project",
+              kind: "required",
+              context:
+                "every language but TypeScript; TypeScript only when direct generation is eligible",
             },
-            { operationId: "v1-get-project", kind: "required", when: [nonTypescript] },
             {
               operationId: "v1-get-a-branch-config",
               kind: "required",
-              when: [nonTypescript],
               context: "the project lookup returns 404, so the ref names a preview branch",
             },
             {
               operationId: "v1-get-pooler-config",
               kind: "required",
-              when: [nonTypescript],
               context: `${notBranch}, the direct database host is unreachable (IPv4-only network) and there is no usable saved supabase/.temp/pooler-url (--remote=<ref>, --project-ref and --project-id ignore the saved file)`,
             },
             {
               operationId: "v1-get-pooler-config",
               kind: "required",
-              when: [nonTypescript],
               context:
                 "the ref names a preview branch and generating against its direct host fails with an IPv6 connectivity error",
             },
           ],
           noApiEffectFlags: ["schema", "query-timeout", ...GEN_TYPES_LANGUAGE_FLAG_NAMES],
         },
-        withCondition(withContext(dbConfigLinked, notBranch), nonTypescript),
-        withCondition(withContext(dbConfigPoolerFallbackLinked, notBranch), nonTypescript),
+        withContext(dbConfigLinked, notBranch),
+        withContext(dbConfigPoolerFallbackLinked, notBranch),
         projectRefPicker,
         linkedProjectCache,
         branchResolution,
diff --git a/apps/cli/src/commands/gen/types/types.e2e.test.ts b/apps/cli/src/commands/gen/types/types.e2e.test.ts
index 9c9539a7d4..368fa1b3c5 100644
--- a/apps/cli/src/commands/gen/types/types.e2e.test.ts
+++ b/apps/cli/src/commands/gen/types/types.e2e.test.ts
@@ -286,7 +286,7 @@ function expectNoRemoteAuthPath(result: { stdout: string; stderr: string }) {
   const output = combinedOutput(result);
   expect(output).not.toContain("Access token not provided");
   expect(output).not.toContain("api.supabase.com");
-  expect(output).not.toContain("127.0.0.1:1");
+  expect(output).not.toMatch(/127\.0\.0\.1:1(?!\d)/);
 }
 
 function expectLanguageShape(lang: TypegenLang, stdout: string) {
diff --git a/apps/cli/src/commands/gen/types/types.generator.integration.test.ts b/apps/cli/src/commands/gen/types/types.generator.integration.test.ts
index 4209a07517..3866e553e0 100644
--- a/apps/cli/src/commands/gen/types/types.generator.integration.test.ts
+++ b/apps/cli/src/commands/gen/types/types.generator.integration.test.ts
@@ -15,17 +15,21 @@ import {
 const unused = (what: string) => () => Effect.die(`${what} is not part of this test`);
 
 /** A connection whose every introspection query returns no rows: a valid, empty database. */
-const emptyDatabase = Layer.succeed(DbConnection, {
-  connect: () =>
-    Effect.succeed<DbSession>({
-      exec: unused("exec"),
-      execBatch: unused("execBatch"),
-      query: () => Effect.succeed([]),
-      queryRaw: unused("queryRaw"),
-      extensionExists: unused("extensionExists"),
-      copyToCsv: unused("copyToCsv"),
-    }),
-});
+const databaseRecording = (issued: string[]) =>
+  Layer.succeed(DbConnection, {
+    connect: () =>
+      Effect.succeed<DbSession>({
+        exec: unused("exec"),
+        execBatch: unused("execBatch"),
+        query: (sql) => {
+          issued.push(sql);
+          return Effect.succeed([]);
+        },
+        queryRaw: unused("queryRaw"),
+        extensionExists: unused("extensionExists"),
+        copyToCsv: unused("copyToCsv"),
+      }),
+  });
 
 const runtimeIn = (cwd: string) =>
   Layer.succeed(RuntimeInfo, {
@@ -38,15 +42,15 @@ const runtimeIn = (cwd: string) =>
   });
 
 /** The generator layer as the command wires it, with the environment the layer reads through Config. */
-const layerIn = (cwd: string, env: Record<string, string>) =>
+const layerIn = (cwd: string, env: Record<string, string>, issued: string[] = []) =>
   genTypesGeneratorLayer.pipe(
-    Layer.provide(emptyDatabase),
+    Layer.provide(databaseRecording(issued)),
     Layer.provide(runtimeIn(cwd)),
     Layer.provide(BunServices.layer),
     Layer.provide(Layer.succeed(ConfigProvider.ConfigProvider, ConfigProvider.fromEnvRecord(env))),
   );
 
-const input = (lang: string): GenTypesGenerateInput => ({
+const input = (lang: string, extraSearchPath: readonly string[] = []): GenTypesGenerateInput => ({
   conn: {
     host: "127.0.0.1",
     port: 5432,
@@ -58,13 +62,14 @@ const input = (lang: string): GenTypesGenerateInput => ({
   dnsResolver: "native",
   lang,
   includedSchemas: ["public"],
+  extraSearchPath,
   options: {},
 });
 
-const generate = (lang: string) =>
+const generate = (lang: string, extraSearchPath: readonly string[] = []) =>
   Effect.gen(function* () {
     const generator = yield* GenTypesGenerator;
-    return yield* Effect.scoped(generator.generate(input(lang)));
+    return yield* Effect.scoped(generator.generate(input(lang, extraSearchPath)));
   });
 
 /** A stand-in `dart`: fails like the real tool when `.fail` sits in its cwd, else echoes its stdin. */
@@ -145,6 +150,23 @@ describe.skipIf(process.platform === "win32")(
       ),
     );
 
+    it.effect("introspects views in the extra search path schemas", () =>
+      withFakeDart(({ cwd }) =>
+        Effect.gen(function* () {
+          const withoutExtra: string[] = [];
+          yield* generate("typescript").pipe(
+            Effect.provide(layerIn(cwd, { PATH: "/usr/bin:/bin" }, withoutExtra)),
+          );
+          const withExtra: string[] = [];
+          yield* generate("typescript", ["extensions_extra"]).pipe(
+            Effect.provide(layerIn(cwd, { PATH: "/usr/bin:/bin" }, withExtra)),
+          );
+          expect(withoutExtra.some((sql) => sql.includes("'extensions_extra'"))).toBe(false);
+          expect(withExtra.some((sql) => sql.includes("'extensions_extra'"))).toBe(true);
+        }),
+      ),
+    );
+
     it.effect("still generates in-process languages without spawning anything", () =>
       withFakeDart(({ cwd }) =>
         generate("typescript").pipe(
diff --git a/apps/cli/src/commands/gen/types/types.generator.layer.ts b/apps/cli/src/commands/gen/types/types.generator.layer.ts
index fe8a356fa0..447a9a2f8f 100644
--- a/apps/cli/src/commands/gen/types/types.generator.layer.ts
+++ b/apps/cli/src/commands/gen/types/types.generator.layer.ts
@@ -110,7 +110,10 @@ export const genTypesGeneratorLayer = Layer.effect(
                       rows: [...rows],
                     })),
                 };
-                return introspect(queryable, { includedSchemas: [...input.includedSchemas] });
+                return introspect(queryable, {
+                  includedSchemas: [...input.includedSchemas],
+                  extraSearchPath: [...input.extraSearchPath],
+                });
               },
               catch: toGenerationError,
             });
diff --git a/apps/cli/src/commands/gen/types/types.generator.service.ts b/apps/cli/src/commands/gen/types/types.generator.service.ts
index 8fcb069039..bfa9a76568 100644
--- a/apps/cli/src/commands/gen/types/types.generator.service.ts
+++ b/apps/cli/src/commands/gen/types/types.generator.service.ts
@@ -18,6 +18,8 @@ export interface GenTypesGenerateInput {
   /** A `--lang` value: the name of one of the registry's `languages`. */
   readonly lang: string;
   readonly includedSchemas: ReadonlyArray<string>;
+  /** PostgREST's `db-extra-search-path`, whose views lead from a generated view to its tables. */
+  readonly extraSearchPath: ReadonlyArray<string>;
   /** Registry option values by name; ones the language does not declare are dropped. */
   readonly options: OptionValues;
 }
diff --git a/apps/cli/src/commands/gen/types/types.handler.ts b/apps/cli/src/commands/gen/types/types.handler.ts
index 2573de1426..22a534977a 100644
--- a/apps/cli/src/commands/gen/types/types.handler.ts
+++ b/apps/cli/src/commands/gen/types/types.handler.ts
@@ -1,6 +1,5 @@
 import { ChildProcessSpawner } from "effect/process";
 import { Effect, FileSystem, Match, Option, Path, Predicate, Result, Stdio, Stream } from "effect";
-import { getDomain } from "tldts";
 import { DnsResolverFlag } from "../../../command-internal/global-flags.ts";
 import { announceTarget } from "../../../shared/output/command-target.service.ts";
 import { Output } from "../../../shared/output/output.service.ts";
@@ -19,13 +18,14 @@ import {
   SUGGEST_LINKED_PROJECT,
 } from "../../../command-internal/connect-errors.ts";
 import { isDockerDaemonUnreachable } from "../../../command-internal/docker-suggest.ts";
+import { yellow } from "../../../command-internal/colors.ts";
 import { mapHttpError } from "../../../command-internal/http-errors.ts";
 import {
   type DbConfigError,
   DbConfigResolver,
 } from "../../../command-internal/db-config.service.ts";
 import { poolerConfigFromConnectionString } from "../../../command-internal/db-config.parse.ts";
-import { readDbToml } from "../../../command-internal/db-config.toml-read.ts";
+import { readDbConfig } from "../../../command-internal/db-config.read.ts";
 import { getHostname } from "../../../command-internal/hostname.ts";
 import { hostedMutationPreapproval } from "../../../command-internal/hosted-consent/hosted-consent.ts";
 import {
@@ -50,7 +50,9 @@ import {
   isDirectDbHost,
   runWithPoolerFallback,
 } from "../../../command-internal/pooler-fallback.ts";
+import { pinSupabaseTls } from "../../../command-internal/supabase-tls.ts";
 import type { GenTypesFlags } from "./types.command.ts";
+import { apiFallbackWarning, failedBeforeIntrospection } from "./types.api-fallback.ts";
 import {
   GEN_TYPES_LANGUAGE_FLAG_NAMES,
   GEN_TYPES_LANGUAGE_VALUE_FLAG_NAMES,
@@ -72,12 +74,7 @@ import {
 import { type GenTypesGenerateError, GenTypesGenerator } from "./types.generator.service.ts";
 import { currentStackBackend } from "../../../command-internal/stack-backend.ts";
 import { CommandPlatformApiFactory } from "../../../auth/command-platform-api-factory.service.ts";
-import {
-  defaultSchemas,
-  localDbContainerId,
-  parseQueryTimeoutMillis,
-  rootCaBundle,
-} from "./types.shared.ts";
+import { defaultSchemas, localDbContainerId, parseQueryTimeoutMillis } from "./types.shared.ts";
 
 const mapProjectTypesError = mapHttpError({
   networkError: GenTypesNetworkError,
@@ -107,18 +104,6 @@ function isProjectNotFound(cause: unknown) {
   return cause instanceof GenTypesUnexpectedStatusError && cause.status === 404;
 }
 
-/** Pins the Supabase CA on a known-Supabase target, promoting `require` to `verify-ca`. */
-function pinSupabaseTls(conn: PgConnInput): PgConnInput {
-  return { ...conn, sslmode: "require", sslrootcertInline: rootCaBundle() };
-}
-
-/** Whether `host`'s registrable domain matches the active profile's pooler domain. */
-function isPoolerHost(host: string, poolerHost: string): boolean {
-  if (poolerHost.length === 0) return false;
-  const domain = getDomain(host);
-  return domain !== null && domain.toLowerCase() === poolerHost.toLowerCase();
-}
-
 const GEN_TYPES_COMMAND_PATH = ["gen", "types"] as const;
 
 // A hosted project target excludes these flags; only the first passed, in this order, is reported.
@@ -260,7 +245,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
 
   // `projectRef` is passed only for the linked path, so a matching `[remotes.*]` overlay is
   // merged in the same load; omitted for the local and `--remote=<url>` paths.
-  const loadApiSchemas = (projectRef?: string) =>
+  const loadCliConfigValues = (projectRef?: string) =>
     configValues
       .load({
         workdir: cliSettings.workdir,
@@ -280,21 +265,25 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
             new GenTypesParseConfigError({ message: cause.message }),
           CliConfigLoadError: (cause) => new GenTypesParseConfigError({ message: cause.message }),
         }),
-        Effect.tap((resolvedConfig) =>
-          requireProjectConfigWhenExplicit(resolvedConfig.hasConfigFile),
-        ),
-        Effect.tap((resolvedConfig) =>
-          Effect.annotateCurrentSpan("config.found", resolvedConfig.hasConfigFile),
-        ),
-        Effect.flatMap((resolvedConfig) =>
-          resolvedConfig.get(CliConfigKeys.api.schemas).pipe(
-            // Without a project the embedded default applies, not the schema's default list.
-            Effect.map(({ value, origin }) =>
-              origin.tier === "default" && !resolvedConfig.hasConfigFile ? [] : value,
-            ),
+      );
+
+  const loadApiSchemas = (projectRef?: string) =>
+    loadCliConfigValues(projectRef).pipe(
+      Effect.tap((resolvedConfig) =>
+        requireProjectConfigWhenExplicit(resolvedConfig.hasConfigFile),
+      ),
+      Effect.tap((resolvedConfig) =>
+        Effect.annotateCurrentSpan("config.found", resolvedConfig.hasConfigFile),
+      ),
+      Effect.flatMap((resolvedConfig) =>
+        resolvedConfig.get(CliConfigKeys.api.schemas).pipe(
+          // Without a project the embedded default applies, not the schema's default list.
+          Effect.map(({ value, origin }) =>
+            origin.tier === "default" && !resolvedConfig.hasConfigFile ? [] : value,
           ),
         ),
-      );
+      ),
+    );
 
   // An explicit --workdir that holds no project must not silently resolve to the embedded
   // default schemas (dropping a declared [api].schemas and writing a public-only file at exit
@@ -308,13 +297,21 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
         })
       : Effect.void;
 
-  // `--schema` skips the config load, so a `--remote=<url> --schema ...` invocation must not fail
+  // `--schema` skips the schema load, so a `--remote=<url> --schema ...` invocation must not fail
   // just because the workdir has no project config.
   const resolveIncludedSchemas = (projectRef?: string) =>
     schemas.length > 0
       ? Effect.succeed(schemas)
       : loadApiSchemas(projectRef).pipe(Effect.map(defaultSchemas));
 
+  // Read even with `--schema` and without a project, where the default list applies, since it
+  // describes the target's PostgREST rather than which schemas to generate.
+  const resolveExtraSearchPath = (projectRef?: string) =>
+    loadCliConfigValues(projectRef).pipe(
+      Effect.flatMap((resolvedConfig) => resolvedConfig.get(CliConfigKeys.api.extraSearchPath)),
+      Effect.map(({ value }) => value),
+    );
+
   /**
    * Sets a session-level `statement_timeout` and connect timeout from `--query-timeout` on
    * every generate attempt — the server-side `statement_timeout` is the real guard, unlike the
@@ -352,7 +349,9 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
     readonly conn: PgConnInput;
     readonly isLocal: boolean;
     readonly includedSchemas: ReadonlyArray<string>;
+    readonly extraSearchPath: ReadonlyArray<string>;
     readonly detectOneToOneRelationships: boolean;
+    readonly postgrestVersion?: string;
     readonly poolerFallback?: {
       readonly directHost: string;
       readonly eligible: boolean;
@@ -374,9 +373,13 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
             dnsResolver,
             lang,
             includedSchemas: input.includedSchemas,
+            extraSearchPath: input.extraSearchPath,
             options: {
               ...languageOptions,
               "detect-one-to-one-relationships": input.detectOneToOneRelationships,
+              ...(input.postgrestVersion === undefined
+                ? {}
+                : { "postgrest-version": input.postgrestVersion }),
             },
           });
         }),
@@ -416,62 +419,23 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
     return yield* dbConfig.resolveConnection(yield* connectionInputFor(target));
   });
 
-  const runProjectTypes = (
-    target: Extract<ResolvedTarget, { readonly kind: "linked" }>,
-    includedSchemas: ReadonlyArray<string>,
-  ) => {
-    const projectRef = target.ref;
-    return Effect.gen(function* () {
-      yield* Effect.annotateCurrentSpan("project.ref", projectRef);
-      const api = yield* platformApi.make;
-
-      if (lang !== "typescript") {
-        const projectResult = yield* api.v1.getProject({ ref: projectRef }).pipe(
-          Effect.catch(mapProjectDatabaseHostError),
-          Effect.as("project" as const),
-          Effect.catchIf(isProjectNotFound, () =>
-            runPreviewBranchTypes(projectRef, includedSchemas).pipe(Effect.as("branch" as const)),
-          ),
-        );
-        if (projectResult === "branch") return;
-
-        const connectionInput = yield* connectionInputFor(target);
-        const resolved = yield* dbConfig.resolveConnection(connectionInput);
-        const conn = pinSupabaseTls(resolved.conn);
-        yield* runGenerate({
-          conn,
-          isLocal: resolved.isLocal,
-          includedSchemas,
-          detectOneToOneRelationships: !flags.postgrestV9Compat,
-          poolerFallback: {
-            directHost: conn.host,
-            eligible: !resolved.isLocal && isDirectDbHost(conn.host, cliSettings.projectHost),
-            resolve: dbConfig
-              .resolvePoolerFallback(connectionInput)
-              .pipe(Effect.map(Option.map(pinSupabaseTls))),
-          },
-        });
-        return;
-      }
-
-      const response = yield* api.v1
-        .generateTypescriptTypes({
-          ref: projectRef,
-          included_schemas: includedSchemas.join(","),
-        })
-        .pipe(Effect.catch(mapProjectTypesError));
-
-      yield* output.raw(response.types);
-    }).pipe(Effect.ensuring(linkedProjectCache.cache(projectRef)));
-  };
-
-  const runPreviewBranchTypes = (branchRef: string, includedSchemas: ReadonlyArray<string>) =>
+  const lookupPreviewBranch = (branchRef: string) =>
     Effect.gen(function* () {
       const api = yield* platformApi.make;
       yield* Effect.annotateCurrentSpan("typegen.preview_branch", true);
-      const branch = yield* api.v1
+      return yield* api.v1
         .getABranchConfig({ branch_id_or_ref: branchRef })
         .pipe(Effect.catch(mapBranchDatabaseConfigError));
+    });
+
+  const runPreviewBranchTypes = (
+    branch: Effect.Success<ReturnType<typeof lookupPreviewBranch>>,
+    includedSchemas: ReadonlyArray<string>,
+    extraSearchPath: ReadonlyArray<string>,
+    postgrestVersion: string | undefined,
+  ) =>
+    Effect.gen(function* () {
+      const api = yield* platformApi.make;
 
       if (branch.db_user === undefined || branch.db_pass === undefined) {
         return yield* new GenTypesBranchCredentialsUnavailableError({
@@ -492,7 +456,9 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
               cliSettings.poolerHost,
             );
             return Predicate.isTagged(parsed, "ok")
-              ? Option.some(pinSupabaseTls({ ...parsed.conn, password: branchPassword }))
+              ? Option.some(
+                  pinSupabaseTls({ ...parsed.conn, password: branchPassword }, cliSettings.profile),
+                )
               : Option.none<PgConnInput>();
           }),
         ),
@@ -502,16 +468,21 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
       );
 
       yield* runGenerate({
-        conn: pinSupabaseTls({
-          host: branch.db_host,
-          port: branch.db_port,
-          user: branchUser,
-          password: branchPassword,
-          database: "postgres",
-        }),
+        conn: pinSupabaseTls(
+          {
+            host: branch.db_host,
+            port: branch.db_port,
+            user: branchUser,
+            password: branchPassword,
+            database: "postgres",
+          },
+          cliSettings.profile,
+        ),
         isLocal: false,
         includedSchemas,
+        extraSearchPath,
         detectOneToOneRelationships: !flags.postgrestV9Compat,
+        postgrestVersion,
         poolerFallback: {
           directHost: branch.db_host,
           eligible: isDirectDbHost(branch.db_host, cliSettings.projectHost),
@@ -520,6 +491,107 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
       });
     });
 
+  /**
+   * Remote TypeScript runs in-process only when its output can match the Management API's without
+   * minting a login role, which would reset that role's password under any concurrent command: the
+   * ref is the linked project, `link` recorded its PostgREST version (emitted as
+   * `__InternalSupabase.PostgrestVersion`), and a database password resolves. Any unreadable input
+   * keeps the API path.
+   */
+  const directTypescriptPostgrestVersion = (projectRef: string) =>
+    Effect.gen(function* () {
+      const linkedRef = yield* legacyState.readProjectRef(cliSettings.workdir);
+      if (!Option.contains(linkedRef, projectRef)) return Option.none<string>();
+      const restVersion = (yield* legacyState.read(cliSettings.workdir, "restVersion")).trim();
+      if (restVersion.length === 0) return Option.none<string>();
+      const resolvedConfig = yield* loadCliConfigValues(projectRef);
+      const { value: password } = yield* resolvedConfig.get(CliConfigKeys.linkedDb.password);
+      return Option.exists(password, (value) => value.length > 0)
+        ? Option.some(restVersion.replace(/^v/i, ""))
+        : Option.none<string>();
+    }).pipe(Effect.orElseSucceed(() => Option.none<string>()));
+
+  const runProjectTypes = (
+    target: Extract<ResolvedTarget, { readonly kind: "linked" }>,
+    includedSchemas: ReadonlyArray<string>,
+  ) => {
+    const projectRef = target.ref;
+    return Effect.gen(function* () {
+      yield* Effect.annotateCurrentSpan("project.ref", projectRef);
+      const api = yield* platformApi.make;
+
+      const generateViaApi = Effect.gen(function* () {
+        const response = yield* api.v1
+          .generateTypescriptTypes({
+            ref: projectRef,
+            included_schemas: includedSchemas.join(","),
+          })
+          .pipe(Effect.catch(mapProjectTypesError));
+        yield* output.raw(response.types);
+      });
+
+      const postgrestVersion =
+        lang === "typescript"
+          ? yield* directTypescriptPostgrestVersion(projectRef)
+          : Option.none<string>();
+      yield* Effect.annotateCurrentSpan(
+        "typegen.direct",
+        lang !== "typescript" || Option.isSome(postgrestVersion),
+      );
+      if (lang === "typescript" && Option.isNone(postgrestVersion)) return yield* generateViaApi;
+
+      const generateDirect = Effect.gen(function* () {
+        const extraSearchPath = yield* resolveExtraSearchPath(projectRef);
+        // Inside the TypeScript fallback: the types endpoint needs only `database:read`, while
+        // the project lookup also needs `projects:read`.
+        const branch = yield* api.v1.getProject({ ref: projectRef }).pipe(
+          Effect.catch(mapProjectDatabaseHostError),
+          Effect.as(Option.none<Effect.Success<ReturnType<typeof lookupPreviewBranch>>>()),
+          Effect.catchIf(isProjectNotFound, () =>
+            lookupPreviewBranch(projectRef).pipe(Effect.map(Option.some)),
+          ),
+        );
+        if (Option.isSome(branch)) {
+          return yield* runPreviewBranchTypes(
+            branch.value,
+            includedSchemas,
+            extraSearchPath,
+            Option.getOrUndefined(postgrestVersion),
+          );
+        }
+
+        const connectionInput = yield* connectionInputFor(target);
+        const resolved = yield* dbConfig.resolveConnection(connectionInput);
+        yield* runGenerate({
+          conn: resolved.conn,
+          isLocal: resolved.isLocal,
+          includedSchemas,
+          extraSearchPath,
+          detectOneToOneRelationships: !flags.postgrestV9Compat,
+          postgrestVersion: Option.getOrUndefined(postgrestVersion),
+          poolerFallback: {
+            directHost: resolved.conn.host,
+            eligible:
+              !resolved.isLocal && isDirectDbHost(resolved.conn.host, cliSettings.projectHost),
+            resolve: dbConfig.resolvePoolerFallback(connectionInput),
+          },
+        });
+      });
+
+      if (lang !== "typescript") return yield* generateDirect;
+
+      return yield* generateDirect.pipe(
+        Effect.catchIf(failedBeforeIntrospection, (error) =>
+          Effect.gen(function* () {
+            yield* Effect.annotateCurrentSpan("typegen.api_fallback", true);
+            yield* output.raw(`${yellow(apiFallbackWarning(error))}\n`, "stderr");
+            yield* generateViaApi;
+          }),
+        ),
+      );
+    }).pipe(Effect.ensuring(linkedProjectCache.cache(projectRef)));
+  };
+
   const assertLocalDbRunning = (projectId: string, linkedCheckout: boolean) =>
     Effect.scoped(
       Effect.gen(function* () {
@@ -644,7 +716,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
         "typegen.source": "local",
         "stack.backend": backend.kind,
       });
-      const config = yield* readDbToml(fs, path, cliSettings.workdir);
+      const config = yield* readDbConfig(fs, path, cliSettings.workdir);
       const projectId = config.projectId;
 
       // Only forces v9 compat from the rest-version file's image tag when the database's
@@ -659,20 +731,20 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
       const forcedV9 = restVersion.length > 0 && restVersion.includes("v9");
 
       const includedSchemas = schemas.length > 0 ? schemas : defaultSchemas(config.apiSchemas);
+      const extraSearchPath = yield* resolveExtraSearchPath();
       if (backend.kind === "stack") {
         const resolved = yield* connectTo(target);
         yield* runGenerate({
           conn: resolved.conn,
           isLocal: true,
           includedSchemas,
+          extraSearchPath,
           detectOneToOneRelationships: !(flags.postgrestV9Compat || forcedV9),
         });
         return;
       }
 
-      const host = yield* getHostname(
-        yield* configValues.load({ workdir: cliSettings.workdir, projectRef: Option.none() }),
-      );
+      const host = yield* getHostname(yield* loadCliConfigValues());
       yield* announceTarget(renderLocalTarget(host, config.port));
       const linkedCheckout = yield* isCheckoutLinked(
         fs,
@@ -696,6 +768,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
         },
         isLocal: true,
         includedSchemas,
+        extraSearchPath,
         detectOneToOneRelationships: !(flags.postgrestV9Compat || forcedV9),
       });
       return;
@@ -704,23 +777,18 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
     if (target.kind === "db-url") {
       yield* Effect.annotateCurrentSpan("typegen.source", "db_url");
       const includedSchemas = yield* resolveIncludedSchemas();
+      const extraSearchPath = yield* resolveExtraSearchPath();
       const resolved = yield* connectTo(target);
 
-      // A DSN's own `sslmode`/`sslrootcert` is honored as-is; only a known Supabase host with
-      // neither set gets the CA pinned, matching the project-ref/branch paths.
-      const conn =
-        !resolved.isLocal &&
-        resolved.conn.sslmode === undefined &&
-        resolved.conn.sslrootcert === undefined &&
-        (isDirectDbHost(resolved.conn.host, cliSettings.projectHost) ||
-          isPoolerHost(resolved.conn.host, cliSettings.poolerHost))
-          ? pinSupabaseTls(resolved.conn)
-          : resolved.conn;
+      const conn = resolved.isLocal
+        ? resolved.conn
+        : pinSupabaseTls(resolved.conn, cliSettings.profile);
 
       yield* runGenerate({
         conn,
         isLocal: resolved.isLocal,
         includedSchemas,
+        extraSearchPath,
         detectOneToOneRelationships: !flags.postgrestV9Compat,
       });
       return;
diff --git a/apps/cli/src/commands/gen/types/types.integration.test.ts b/apps/cli/src/commands/gen/types/types.integration.test.ts
index 1a52bfaa32..19759865f0 100644
--- a/apps/cli/src/commands/gen/types/types.integration.test.ts
+++ b/apps/cli/src/commands/gen/types/types.integration.test.ts
@@ -70,14 +70,23 @@ import {
   branchLookupsOf,
   describeDbTargetSelection,
 } from "../../../../tests/helpers/db-target-selection.ts";
-import { cliConfigValuesTestLayer } from "../../../../tests/helpers/config-values-layer.ts";
+import {
+  cliConfigValuesTestLayer,
+  configValuesLayer,
+} from "../../../../tests/helpers/config-values-layer.ts";
 import type { PgConnInput } from "../../../command-internal/db-connection.service.ts";
 import type { DbConnectError } from "../../../command-internal/db-connection.errors.ts";
 import { DbConnection } from "../../../command-internal/db-connection.service.ts";
 import { toConnectError } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import type { DbConfigError } from "../../../command-internal/db-config.service.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
-import { DbConfigLoadError } from "../../../command-internal/db-config.errors.ts";
+import {
+  DbConfigIpv6Error,
+  DbConfigLibpqEnvError,
+  DbConfigLoadError,
+  DbConfigLoginRoleStatusError,
+  LinkedDbNetworkBannedError,
+} from "../../../command-internal/db-config.errors.ts";
 import type {
   DbConnectionInput,
   ResolvedDbConfig,
@@ -86,7 +95,8 @@ import type {
 import type { GenTypesFlags } from "./types.command.ts";
 import { GenTypesLocalDbInspectError, GenTypesLocalDbNotRunningError } from "./types.errors.ts";
 import { genTypes } from "./types.handler.ts";
-import { localDbContainerId, parseQueryTimeoutMillis, rootCaBundle } from "./types.shared.ts";
+import { localDbContainerId, parseQueryTimeoutMillis } from "./types.shared.ts";
+import { rootCaBundle } from "../../../command-internal/supabase-tls.ts";
 import { stackBackendLayer } from "../../../command-internal/stack-backend.ts";
 import { projectStateModeLayer } from "../../../shared/config/project-state-mode.ts";
 import {
@@ -316,6 +326,18 @@ function enotfoundFailure(): DbConnectError {
   );
 }
 
+function refusedFailure(): DbConnectError {
+  return toConnectError(
+    DIAL_FAILURE_CONN,
+    false,
+    Object.assign(new Error("connect ECONNREFUSED 203.0.113.7:5432"), {
+      code: "ECONNREFUSED",
+      address: "203.0.113.7",
+      port: 5432,
+    }),
+  );
+}
+
 function nonIpv6Failure(lang = "go") {
   return new GenTypesGenerationError({
     message: `failed to generate ${lang} types: permission denied for schema public`,
@@ -349,7 +371,9 @@ function mockInspectSpawner(
   const calls: Array<{
     readonly command: string;
     readonly args: ReadonlyArray<string>;
-    readonly env: Readonly<Record<string, string | undefined>> | undefined;
+    readonly env:
+      | Readonly<Record<string, string | Redacted.Redacted<string> | undefined>>
+      | undefined;
     readonly extendEnv: boolean | undefined;
   }> = [];
   const encoder = new TextEncoder();
@@ -360,7 +384,7 @@ function mockInspectSpawner(
       Effect.gen(function* () {
         const isStandard = ChildProcess.isStandardCommand(command);
         const cmd = isStandard ? command.command : "";
-        const args = isStandard ? command.args : [];
+        const args = isStandard ? command.args.map(String) : [];
         const options = isStandard ? command.options : undefined;
         calls.push({ command: cmd, args, env: options?.env, extendEnv: options?.extendEnv });
 
@@ -441,12 +465,24 @@ const setup = Effect.fnUntraced(function* (
     readonly generator?: ReturnType<typeof mockGenTypesGenerator>;
     readonly generatorOutput?: string;
     readonly branches?: ReadonlyArray<Record<string, unknown>>;
+    /** Written to `supabase/.temp/project-ref`. */
+    readonly linkedRef?: string;
+    /** Written to `supabase/.temp/rest-version`. */
+    readonly restVersion?: string;
+    /** Resolved as `SUPABASE_DB_PASSWORD` through the config values. */
+    readonly dbPassword?: string;
   } = {},
 ) {
   const workdir = opts.workdir ?? (yield* makeWorkdir("supabase-gen-types-"));
   if (!opts.skipConfig) {
     yield* ensureDefaultConfig(workdir);
   }
+  if (opts.linkedRef !== undefined) {
+    yield* writeTempFile(workdir, "project-ref", opts.linkedRef);
+  }
+  if (opts.restVersion !== undefined) {
+    yield* writeTempFile(workdir, "rest-version", opts.restVersion);
+  }
   const out = mockOutput({
     format: opts.format ?? "text",
     interactive: (opts.format ?? "text") === "text",
@@ -554,7 +590,9 @@ const setup = Effect.fnUntraced(function* (
   });
 
   const layer = Layer.mergeAll(
-    cliConfigValuesTestLayer,
+    opts.dbPassword === undefined
+      ? cliConfigValuesTestLayer
+      : configValuesLayer({ env: { SUPABASE_DB_PASSWORD: opts.dbPassword } }),
     runtime,
     BunServices.layer,
     recorder.layer,
@@ -995,6 +1033,153 @@ describe("gen types", () => {
     );
   });
 
+  describe("[api].extra_search_path", () => {
+    const dbUrl = "postgresql://postgres:postgres@127.0.0.1:5432/postgres";
+    const dbUrlArgs = ["gen", "types", `--remote=${dbUrl}`];
+    const dbUrlFlags = (overrides: Parameters<typeof defaultFlags>[0] = {}) =>
+      defaultFlags({
+        remote: Option.some({ _tag: "DbUrl", url: dbUrl } as const),
+        ...overrides,
+      });
+
+    it.effect("is passed to the generator for --local", () =>
+      Effect.gen(function* () {
+        const workdir = yield* makeWorkdir("supabase-gen-types-esp-local-");
+        yield* writeConfig(
+          workdir,
+          ['project_id = "demo"', "[api]", 'extra_search_path = ["extra"]'].join("\n"),
+        );
+        const { layer, generator } = yield* setup({ workdir });
+        yield* genTypes(defaultFlags({ local: true })).pipe(Effect.provide(layer));
+        expect(generator.calls[0]?.extraSearchPath).toEqual(["extra"]);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+
+    it.effect("is read for --remote=<db-url> even when --schema selects the schemas", () =>
+      Effect.gen(function* () {
+        const workdir = yield* makeWorkdir("supabase-gen-types-esp-dburl-");
+        yield* writeConfig(
+          workdir,
+          ['project_id = "demo"', "[api]", 'extra_search_path = ["extra"]'].join("\n"),
+        );
+        const { layer, generator } = yield* setup({
+          workdir,
+          args: [...dbUrlArgs, "--schema", "api"],
+        });
+        yield* genTypes(dbUrlFlags({ schema: ["api"] })).pipe(Effect.provide(layer));
+        expect(generator.calls[0]?.includedSchemas).toEqual(["api"]);
+        expect(generator.calls[0]?.extraSearchPath).toEqual(["extra"]);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+
+    it.effect("defaults to public and extensions without a project config", () =>
+      Effect.gen(function* () {
+        const { layer, generator } = yield* setup({ skipConfig: true, args: dbUrlArgs });
+        yield* genTypes(dbUrlFlags()).pipe(Effect.provide(layer));
+        expect(generator.calls[0]?.extraSearchPath).toEqual(["public", "extensions"]);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+
+    it.effect("uses the matching [remotes] block for a project ref", () =>
+      Effect.gen(function* () {
+        const workdir = yield* makeWorkdir("supabase-gen-types-esp-remote-");
+        yield* writeConfig(
+          workdir,
+          [
+            'project_id = "base"',
+            "",
+            "[api]",
+            'extra_search_path = ["public"]',
+            "",
+            "[remotes.staging]",
+            `project_id = "${VALID_REF}"`,
+            "",
+            "[remotes.staging.api]",
+            'extra_search_path = ["extra"]',
+            "",
+          ].join("\n"),
+        );
+        const { layer, generator } = yield* setup({
+          workdir,
+          args: ["gen", "types", "--lang", "go", `--remote=${VALID_REF}`],
+        });
+        yield* genTypes(
+          defaultFlags({
+            remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
+            lang: "go",
+          }),
+        ).pipe(Effect.provide(layer));
+        expect(generator.calls[0]?.extraSearchPath).toEqual(["extra"]);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+
+    it.effect("fails on a malformed config before any API call even with --schema", () =>
+      Effect.gen(function* () {
+        const workdir = yield* makeWorkdir("supabase-gen-types-esp-malformed-");
+        yield* writeConfig(workdir, 'project_id = "unterminated\n');
+        const { layer, api, generator } = yield* setup({
+          workdir,
+          skipConfig: true,
+          args: ["gen", "types", "--lang", "go", `--remote=${VALID_REF}`, "--schema", "api"],
+        });
+        const exit = yield* genTypes(
+          defaultFlags({
+            remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
+            lang: "go",
+            schema: ["api"],
+          }),
+        ).pipe(Effect.provide(layer), Effect.exit);
+
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(String(exit.cause)).toContain("GenTypesParseConfigError");
+        }
+        expect(api.requests).toHaveLength(0);
+        expect(generator.calls).toHaveLength(0);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+
+    it.effect("is passed to the generator for a preview branch", () =>
+      Effect.gen(function* () {
+        const workdir = yield* makeWorkdir("supabase-gen-types-esp-branch-");
+        yield* writeConfig(
+          workdir,
+          ['project_id = "demo"', "[api]", 'extra_search_path = ["extra"]'].join("\n"),
+        );
+        const { layer, api, generator } = yield* setup({
+          workdir,
+          args: ["gen", "types", "--lang", "go", `--remote=${VALID_REF}`],
+          getProject: () =>
+            Effect.fail(statusApiError(404, `{"message":"Preview branch not found"}`)),
+          getABranchConfig: ({ branch_id_or_ref }) =>
+            Effect.succeed({
+              ref: branch_id_or_ref,
+              postgres_version: "15.1",
+              postgres_engine: "15",
+              release_channel: "ga",
+              status: "ACTIVE_HEALTHY",
+              db_host: "127.0.0.1",
+              db_port: 5432,
+              db_user: "branch_user",
+              db_pass: "branch-password",
+              jwt_secret: "secret",
+            }),
+        });
+        yield* genTypes(
+          defaultFlags({
+            remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
+            lang: "go",
+          }),
+        ).pipe(Effect.provide(layer));
+        expect(api.requests).toContainEqual({
+          method: "getABranchConfig",
+          input: { branch_id_or_ref: VALID_REF },
+        });
+        expect(generator.calls[0]?.extraSearchPath).toEqual(["extra"]);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+  });
+
   describe("target selection", () => {
     const tempRoot = useTempWorkdir("supabase-gen-types-target-");
 
@@ -1798,9 +1983,6 @@ describe("gen types", () => {
           expect(call?.lang).toBe(scenario.lang);
           expect(call?.includedSchemas).toEqual(["public"]);
           expect(call?.isLocal).toBe(false);
-          // project-ref generation always pins the Supabase CA, promoting sslmode to verify-ca.
-          expect(call?.conn.sslmode).toBe("require");
-          expect(call?.conn.sslrootcertInline).toBe(rootCaBundle());
           expect(linkedProjectCache.cached).toBe(true);
         }).pipe(Effect.provide(BunServices.layer)),
       );
@@ -1969,56 +2151,65 @@ describe("gen types", () => {
   });
 
   describe("Preview-branch fallback", () => {
-    it.effect("falls back to preview branch config for non-TypeScript project refs", () =>
-      Effect.gen(function* () {
-        const { layer, api, dbConfig, generator } = yield* setup({
-          args: ["gen", "types", "--lang", "python", `--remote=${VALID_REF}`],
-          generatorOutput: "class PublicMovies(BaseModel):",
-          getProject: () =>
-            Effect.fail(statusApiError(404, `{"message":"Preview branch not found"}`)),
-          getABranchConfig: ({ branch_id_or_ref }) =>
-            Effect.succeed({
-              ref: branch_id_or_ref,
-              postgres_version: "15.1",
-              postgres_engine: "15",
-              release_channel: "ga",
-              status: "ACTIVE_HEALTHY",
-              db_host: "127.0.0.1",
-              db_port: 5432,
-              db_user: "branch_user",
-              db_pass: "branch-password",
-              jwt_secret: "secret",
-            }),
-          createLoginRole: ({ ref }) =>
-            Effect.fail(
-              new ApiCallFailure({ message: `unexpected login role creation for ${ref}` }),
-            ),
-        });
-        yield* genTypes(
-          defaultFlags({
-            remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
-            lang: "python",
-          }),
-        ).pipe(Effect.provide(layer));
+    for (const { dbHost, pinned } of [
+      { dbHost: `db.${VALID_REF}.supabase.co`, pinned: true },
+      { dbHost: "127.0.0.1", pinned: false },
+    ]) {
+      it.effect(
+        `falls back to preview branch config for non-TypeScript project refs (${pinned ? "Supabase" : "other"} host)`,
+        () =>
+          Effect.gen(function* () {
+            const { layer, api, dbConfig, generator } = yield* setup({
+              args: ["gen", "types", "--lang", "python", `--remote=${VALID_REF}`],
+              generatorOutput: "class PublicMovies(BaseModel):",
+              getProject: () =>
+                Effect.fail(statusApiError(404, `{"message":"Preview branch not found"}`)),
+              getABranchConfig: ({ branch_id_or_ref }) =>
+                Effect.succeed({
+                  ref: branch_id_or_ref,
+                  postgres_version: "15.1",
+                  postgres_engine: "15",
+                  release_channel: "ga",
+                  status: "ACTIVE_HEALTHY",
+                  db_host: dbHost,
+                  db_port: 5432,
+                  db_user: "branch_user",
+                  db_pass: "branch-password",
+                  jwt_secret: "secret",
+                }),
+              createLoginRole: ({ ref }) =>
+                Effect.fail(
+                  new ApiCallFailure({ message: `unexpected login role creation for ${ref}` }),
+                ),
+            });
+            yield* genTypes(
+              defaultFlags({
+                remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
+                lang: "python",
+              }),
+            ).pipe(Effect.provide(layer));
 
-        expect(api.requests).toContainEqual({ method: "getProject", input: { ref: VALID_REF } });
-        expect(api.requests).toContainEqual({
-          method: "getABranchConfig",
-          input: { branch_id_or_ref: VALID_REF },
-        });
-        expect(api.requests).not.toContainEqual(
-          expect.objectContaining({ method: "createLoginRole" }),
-        );
-        expect(dbConfig.resolves).toHaveLength(0);
-        const call = generator.calls[0];
-        expect(call?.conn.host).toBe("127.0.0.1");
-        expect(call?.conn.user).toBe("branch_user");
-        expect(call?.conn.password).toBe("branch-password");
-        // Preview-branch generation pins the Supabase CA the same as any other remote target.
-        expect(call?.conn.sslmode).toBe("require");
-        expect(call?.conn.sslrootcertInline).toBe(rootCaBundle());
-      }).pipe(Effect.provide(BunServices.layer)),
-    );
+            expect(api.requests).toContainEqual({
+              method: "getProject",
+              input: { ref: VALID_REF },
+            });
+            expect(api.requests).toContainEqual({
+              method: "getABranchConfig",
+              input: { branch_id_or_ref: VALID_REF },
+            });
+            expect(api.requests).not.toContainEqual(
+              expect.objectContaining({ method: "createLoginRole" }),
+            );
+            expect(dbConfig.resolves).toHaveLength(0);
+            const call = generator.calls[0];
+            expect(call?.conn.host).toBe(dbHost);
+            expect(call?.conn.user).toBe("branch_user");
+            expect(call?.conn.password).toBe("branch-password");
+            expect(call?.conn.sslmode).toBe(pinned ? "require" : undefined);
+            expect(call?.conn.sslrootcertInline).toBe(pinned ? rootCaBundle() : undefined);
+          }).pipe(Effect.provide(BunServices.layer)),
+      );
+    }
 
     it.effect("falls back to preview branch config for any project 404 body", () =>
       Effect.gen(function* () {
@@ -2097,6 +2288,525 @@ describe("gen types", () => {
     );
   });
 
+  describe("TypeScript generation for a project", () => {
+    const projectArgs = ["gen", "types", `--remote=${VALID_REF}`];
+    const projectFlags = () =>
+      defaultFlags({ remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const) });
+    const eligible = {
+      linkedRef: VALID_REF,
+      restVersion: "v13.0.4",
+      dbPassword: "db-password",
+    } as const;
+    const directHost = () =>
+      Effect.succeed(
+        remoteResolvedConfig({
+          host: `db.${VALID_REF}.supabase.co`,
+          port: 5432,
+          user: "postgres",
+          password: "direct-password",
+          database: "postgres",
+        }),
+      );
+    const branchConfig = ({ branch_id_or_ref }: { readonly branch_id_or_ref: string }) =>
+      Effect.succeed({
+        ref: branch_id_or_ref,
+        postgres_version: "15.1",
+        postgres_engine: "15",
+        release_channel: "ga",
+        status: "ACTIVE_HEALTHY",
+        db_host: "127.0.0.1",
+        db_port: 5432,
+        db_user: "branch_user",
+        db_pass: "branch-password",
+        jwt_secret: "secret",
+      });
+    const missingProject = () =>
+      Effect.fail(statusApiError(404, `{"message":"Preview branch not found"}`));
+    const apiTypeRequests = (api: {
+      readonly requests: ReadonlyArray<{ readonly method: string }>;
+    }) => api.requests.filter(({ method }) => method === "generateTypescriptTypes");
+    const fallbackWarning = (reason: string, suggestion?: string) =>
+      [
+        `Warning: Could not generate types from the project database (${reason}), so these types come from the Management API: they do not apply [api].extra_search_path or the CLI's generator.`,
+        ...(suggestion === undefined ? [] : [suggestion]),
+        "This fallback is removed in the next major version.",
+      ].join("\n");
+
+    describe("when direct generation is not eligible", () => {
+      const notEligible = [
+        {
+          name: "no database password resolves",
+          setupOptions: { linkedRef: VALID_REF, restVersion: "v13.0.4" },
+        },
+        {
+          name: "link recorded no PostgREST version",
+          setupOptions: { linkedRef: VALID_REF, dbPassword: "db-password" },
+        },
+        {
+          name: "the ref is not the linked project",
+          setupOptions: {
+            linkedRef: "otherrefotherrefother",
+            restVersion: "v13.0.4",
+            dbPassword: "db-password",
+          },
+        },
+      ] as const;
+
+      for (const { name, setupOptions } of notEligible) {
+        it.effect(`uses the types endpoint, without a warning or lookups, when ${name}`, () =>
+          Effect.gen(function* () {
+            const { layer, api, out, generator, dbConfig, linkedProjectCache } = yield* setup({
+              args: projectArgs,
+              projectTypes: "export type FromApi = {};",
+              ...setupOptions,
+            });
+            yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+            expect(out.stdoutText).toBe("export type FromApi = {};");
+            expect(out.stdoutText).not.toContain("Warning");
+            expect(warningsOf(out)).toEqual([]);
+            expect(out.stderrText).not.toContain("unformatted");
+            expect(api.requests).toEqual([
+              {
+                method: "generateTypescriptTypes",
+                input: { ref: VALID_REF, included_schemas: "public" },
+              },
+            ]);
+            expect(dbConfig.resolves).toHaveLength(0);
+            expect(generator.calls).toHaveLength(0);
+            expect(linkedProjectCache.cached).toBe(true);
+          }).pipe(Effect.provide(BunServices.layer)),
+        );
+      }
+
+      it.effect("uses the types endpoint, without a warning, when the config is unparseable", () =>
+        Effect.gen(function* () {
+          const workdir = yield* makeWorkdir("supabase-gen-types-ts-malformed-");
+          yield* writeConfig(workdir, 'project_id = "unterminated\n');
+          const { layer, api, out, generator } = yield* setup({
+            workdir,
+            skipConfig: true,
+            args: [...projectArgs, "--schema", "api"],
+            projectTypes: "export type FromApi = {};",
+            ...eligible,
+          });
+          yield* genTypes(
+            defaultFlags({
+              remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
+              schema: ["api"],
+            }),
+          ).pipe(Effect.provide(layer));
+
+          expect(out.stdoutText).toBe("export type FromApi = {};");
+          expect(generator.calls).toHaveLength(0);
+          expect(warningsOf(out)).toEqual([]);
+          expect(api.requests).toEqual([
+            {
+              method: "generateTypescriptTypes",
+              input: { ref: VALID_REF, included_schemas: "api" },
+            },
+          ]);
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+    });
+
+    describe("when direct generation is eligible", () => {
+      it.effect(
+        "generates directly with [api].extra_search_path and never asks the API for types",
+        () =>
+          Effect.gen(function* () {
+            const workdir = yield* makeWorkdir("supabase-gen-types-ts-direct-");
+            yield* writeConfig(
+              workdir,
+              ['project_id = "demo"', "[api]", 'extra_search_path = ["extra"]'].join("\n"),
+            );
+            const { layer, api, out, generator, linkedProjectCache } = yield* setup({
+              workdir,
+              args: projectArgs,
+              generatorOutput: "export type Database = {};",
+              ...eligible,
+            });
+            yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+            expect(out.stdoutText).toBe("export type Database = {};");
+            expect(out.stderrText).toContain("Generated TypeScript is unformatted");
+            expect(warningsOf(out)).toEqual([]);
+            expect(apiTypeRequests(api)).toEqual([]);
+            expect(generator.calls).toHaveLength(1);
+            expect(generator.calls[0]?.lang).toBe("typescript");
+            expect(generator.calls[0]?.extraSearchPath).toEqual(["extra"]);
+            expect(generator.calls[0]?.options["postgrest-version"]).toBe("13.0.4");
+            expect(linkedProjectCache.cached).toBe(true);
+          }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect("generates directly through the preview branch when the project lookup 404s", () =>
+        Effect.gen(function* () {
+          const { layer, api, out, generator } = yield* setup({
+            args: projectArgs,
+            getProject: missingProject,
+            getABranchConfig: branchConfig,
+            generatorOutput: "export type Database = {};",
+            ...eligible,
+          });
+          yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+          expect(out.stdoutText).toBe("export type Database = {};");
+          expect(api.requests).toContainEqual({
+            method: "getABranchConfig",
+            input: { branch_id_or_ref: VALID_REF },
+          });
+          expect(apiTypeRequests(api)).toEqual([]);
+          expect(generator.calls[0]?.conn.user).toBe("branch_user");
+          expect(generator.calls[0]?.options["postgrest-version"]).toBe("13.0.4");
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect("falls back with one warning when the project lookup is forbidden", () =>
+        Effect.gen(function* () {
+          const { layer, api, out, generator, dbConfig } = yield* setup({
+            args: projectArgs,
+            projectTypes: "export type FromApi = {};",
+            getProject: () => Effect.fail(statusApiError(403, `{"message":"forbidden"}`)),
+            ...eligible,
+          });
+          yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+          expect(out.stdoutText).toBe("export type FromApi = {};");
+          expect(out.stdoutText).not.toContain("Warning");
+          expect(stripAnsi(out.stderrText)).toContain(
+            fallbackWarning(
+              `unexpected project database config status 403: {"message":"forbidden"}`,
+            ),
+          );
+          expect(warningsOf(out)).toHaveLength(1);
+          expect(apiTypeRequests(api)).toHaveLength(1);
+          expect(generator.calls).toHaveLength(0);
+          expect(dbConfig.resolves).toHaveLength(0);
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect("falls back when the preview-branch lookup fails", () =>
+        Effect.gen(function* () {
+          const { layer, api, out, generator } = yield* setup({
+            args: projectArgs,
+            projectTypes: "export type FromApi = {};",
+            getProject: missingProject,
+            getABranchConfig: () => Effect.fail(statusApiError(500, `{"message":"boom"}`)),
+            ...eligible,
+          });
+          yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+          expect(out.stdoutText).toBe("export type FromApi = {};");
+          expect(warningsOf(out)).toHaveLength(1);
+          expect(apiTypeRequests(api)).toHaveLength(1);
+          expect(generator.calls).toHaveLength(0);
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect(
+        "falls back to the Management API with one warning when the database refuses the connection",
+        () =>
+          Effect.gen(function* () {
+            const { layer, api, out, generator, linkedProjectCache } = yield* setup({
+              args: projectArgs,
+              projectTypes: "export type FromApi = {};",
+              dbConfigResolve: directHost,
+              generator: sequentialGenerator([() => Effect.fail(refusedFailure())]),
+              ...eligible,
+            });
+            yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+            expect(out.stdoutText).toBe("export type FromApi = {};");
+            expect(out.stderrText).not.toContain("unformatted");
+            expect(generator.calls).toHaveLength(1);
+            expect(apiTypeRequests(api)).toEqual([
+              {
+                method: "generateTypescriptTypes",
+                input: { ref: VALID_REF, included_schemas: "public" },
+              },
+            ]);
+            expect(stripAnsi(out.stderrText)).toContain(
+              fallbackWarning(
+                "failed to connect to postgres: failed to connect to `host=db.example.supabase.co user=postgres database=postgres`: dial error (connect ECONNREFUSED 203.0.113.7:5432)",
+              ),
+            );
+            expect(warningsOf(out)).toHaveLength(1);
+            expect(out.stdoutText).not.toContain("Warning");
+            expect(linkedProjectCache.cached).toBe(true);
+          }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect(
+        "falls back to the Management API when the preview-branch database is unreachable",
+        () =>
+          Effect.gen(function* () {
+            const { layer, api, out } = yield* setup({
+              args: projectArgs,
+              getProject: missingProject,
+              getABranchConfig: branchConfig,
+              projectTypes: "export type FromApi = {};",
+              generator: sequentialGenerator([() => Effect.fail(refusedFailure())]),
+              ...eligible,
+            });
+            yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+            expect(out.stdoutText).toBe("export type FromApi = {};");
+            expect(warningsOf(out)).toHaveLength(1);
+            expect(apiTypeRequests(api)).toHaveLength(1);
+          }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect("falls back when the pooler cannot be used after an IPv6 failure", () =>
+        Effect.gen(function* () {
+          const { layer, api, out, generator, dbConfig } = yield* setup({
+            args: projectArgs,
+            projectTypes: "export type FromApi = {};",
+            dbConfigResolve: directHost,
+            poolerFallback: Option.none(),
+            generator: sequentialGenerator([() => Effect.fail(ipv6Failure())]),
+            ...eligible,
+          });
+          yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+          expect(out.stdoutText).toBe("export type FromApi = {};");
+          expect(dbConfig.poolerFallbacks).toHaveLength(1);
+          expect(generator.calls).toHaveLength(1);
+          expect(warningsOf(out)).toHaveLength(1);
+          expect(apiTypeRequests(api)).toHaveLength(1);
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      const fallbackCauses = [
+        {
+          name: "a strict config load failure",
+          error: () =>
+            new DbConfigLoadError({
+              message: "failed to read signing keys: open supabase/signing_keys.json: no such file",
+            }),
+          reason: "failed to read signing keys: open supabase/signing_keys.json: no such file",
+          suggestion: undefined,
+        },
+        {
+          name: "an invalid libpq environment",
+          error: () => new DbConfigLibpqEnvError({ message: "invalid PGSSLMODE: nope" }),
+          reason: "invalid PGSSLMODE: nope",
+          suggestion: undefined,
+        },
+        {
+          name: "an IPv6-only direct host without a pooler",
+          error: () =>
+            new DbConfigIpv6Error({
+              message: "IPv6 is not supported on your current network",
+              suggestion: "Run supabase link --project-ref demo to setup IPv4 connection",
+            }),
+          reason: "IPv6 is not supported on your current network",
+          suggestion: "Run supabase link --project-ref demo to setup IPv4 connection",
+        },
+        {
+          name: "a network ban that was not approved for removal",
+          error: () =>
+            new LinkedDbNetworkBannedError({
+              message: "your IP is banned\nthe ban was not removed",
+              suggestion: "Re-run with --yes to remove the ban",
+            }),
+          reason: "your IP is banned",
+          suggestion: "Re-run with --yes to remove the ban",
+        },
+      ] as const;
+
+      for (const cause of fallbackCauses) {
+        it.effect(`falls back, with the error's suggestion, on ${cause.name}`, () =>
+          Effect.gen(function* () {
+            const { layer, api, out, generator, linkedProjectCache } = yield* setup({
+              args: projectArgs,
+              projectTypes: "export type FromApi = {};",
+              dbConfigResolve: () => Effect.fail(cause.error()),
+              ...eligible,
+            });
+            yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+            expect(out.stdoutText).toBe("export type FromApi = {};");
+            expect(generator.calls).toHaveLength(0);
+            expect(stripAnsi(out.stderrText)).toContain(
+              fallbackWarning(cause.reason, cause.suggestion),
+            );
+            expect(apiTypeRequests(api)).toHaveLength(1);
+            expect(linkedProjectCache.cached).toBe(true);
+          }).pipe(Effect.provide(BunServices.layer)),
+        );
+      }
+
+      it.effect("falls back when the preview branch has no database credentials", () =>
+        Effect.gen(function* () {
+          const { layer, api, out, generator } = yield* setup({
+            args: projectArgs,
+            getProject: missingProject,
+            getABranchConfig: ({ branch_id_or_ref }) =>
+              Effect.succeed({
+                ref: branch_id_or_ref,
+                postgres_version: "15.1",
+                postgres_engine: "15",
+                release_channel: "ga",
+                status: "ACTIVE_HEALTHY",
+                db_host: "127.0.0.1",
+                db_port: 5432,
+                jwt_secret: "secret",
+              }),
+            projectTypes: "export type FromApi = {};",
+            ...eligible,
+          });
+          yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+          expect(out.stdoutText).toBe("export type FromApi = {};");
+          expect(generator.calls).toHaveLength(0);
+          expect(stripAnsi(out.stderrText)).toContain(
+            fallbackWarning("Preview branch database credentials are unavailable"),
+          );
+          expect(apiTypeRequests(api)).toHaveLength(1);
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect("retries through the pooler without calling the API", () =>
+        Effect.gen(function* () {
+          const { layer, api, out, generator } = yield* setup({
+            args: projectArgs,
+            dbConfigResolve: directHost,
+            poolerFallback: Option.some({
+              host: "127.0.0.1",
+              port: 5432,
+              user: `postgres.${VALID_REF}`,
+              password: "pooler-password",
+              database: "postgres",
+            }),
+            generator: sequentialGenerator([
+              () => Effect.fail(ipv6Failure()),
+              () => Effect.succeed("export type ViaPooler = {};"),
+            ]),
+            ...eligible,
+          });
+          yield* genTypes(projectFlags()).pipe(Effect.provide(layer));
+
+          expect(out.stdoutText).toBe("export type ViaPooler = {};");
+          expect(generator.calls).toHaveLength(2);
+          expect(out.stderrText).toContain("Retrying via the IPv4 connection pooler.");
+          expect(apiTypeRequests(api)).toEqual([]);
+          expect(stripAnsi(out.stderrText)).not.toContain("Management API");
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect("does not fall back when the pooler retry fails during introspection", () =>
+        Effect.gen(function* () {
+          const { layer, api, out } = yield* setup({
+            args: projectArgs,
+            dbConfigResolve: directHost,
+            poolerFallback: Option.some({
+              host: "127.0.0.1",
+              port: 5432,
+              user: `postgres.${VALID_REF}`,
+              password: "pooler-password",
+              database: "postgres",
+            }),
+            generator: sequentialGenerator([
+              () => Effect.fail(ipv6Failure()),
+              () => Effect.fail(nonIpv6Failure("typescript")),
+            ]),
+            ...eligible,
+          });
+          const exit = yield* genTypes(projectFlags()).pipe(Effect.provide(layer), Effect.exit);
+
+          expect(Exit.isFailure(exit)).toBe(true);
+          expect(apiTypeRequests(api)).toEqual([]);
+          expect(stripAnsi(out.stderrText)).not.toContain("Management API");
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+
+      it.effect("does not fall back on an introspection failure", () =>
+        Effect.gen(function* () {
+          const { layer, api, out } = yield* setup({
+            args: projectArgs,
+            dbConfigResolve: directHost,
+            generator: sequentialGenerator([() => Effect.fail(nonIpv6Failure("typescript"))]),
+            ...eligible,
+          });
+          const exit = yield* genTypes(projectFlags()).pipe(Effect.provide(layer), Effect.exit);
+
+          expect(Exit.isFailure(exit)).toBe(true);
+          expect(apiTypeRequests(api)).toEqual([]);
+          expect(warningsOf(out)).toEqual([]);
+        }).pipe(Effect.provide(BunServices.layer)),
+      );
+    });
+
+    it.effect("fails when another language cannot look the project up", () =>
+      Effect.gen(function* () {
+        const { layer, api, out, generator } = yield* setup({
+          args: ["gen", "types", "--lang", "go", `--remote=${VALID_REF}`],
+          getProject: () => Effect.fail(statusApiError(403, `{"message":"forbidden"}`)),
+          ...eligible,
+        });
+        const exit = yield* genTypes(
+          defaultFlags({
+            remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
+            lang: "go",
+          }),
+        ).pipe(Effect.provide(layer), Effect.exit);
+
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(apiTypeRequests(api)).toEqual([]);
+        expect(generator.calls).toHaveLength(0);
+        expect(warningsOf(out)).toEqual([]);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+
+    it.effect("fails without calling the API when another language hits a login-role 429", () =>
+      Effect.gen(function* () {
+        const { layer, api, out, generator } = yield* setup({
+          args: ["gen", "types", "--lang", "go", `--remote=${VALID_REF}`],
+          dbConfigResolve: () =>
+            Effect.fail(
+              new DbConfigLoginRoleStatusError({
+                status: 429,
+                body: "slow down",
+                message: "unexpected login role status 429: slow down",
+              }),
+            ),
+        });
+        const exit = yield* genTypes(
+          defaultFlags({
+            remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
+            lang: "go",
+          }),
+        ).pipe(Effect.provide(layer), Effect.exit);
+
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(apiTypeRequests(api)).toEqual([]);
+        expect(generator.calls).toHaveLength(0);
+        expect(warningsOf(out)).toEqual([]);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+
+    it.effect("fails without calling the API when another language cannot connect", () =>
+      Effect.gen(function* () {
+        const { layer, api, out } = yield* setup({
+          args: ["gen", "types", "--lang", "go", `--remote=${VALID_REF}`],
+          dbConfigResolve: directHost,
+          generator: sequentialGenerator([() => Effect.fail(refusedFailure())]),
+        });
+        const exit = yield* genTypes(
+          defaultFlags({
+            remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const),
+            lang: "go",
+          }),
+        ).pipe(Effect.provide(layer), Effect.exit);
+
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(apiTypeRequests(api)).toEqual([]);
+        expect(warningsOf(out)).toEqual([]);
+      }).pipe(Effect.provide(BunServices.layer)),
+    );
+  });
+
   describe("Pooler fallback on an IPv6-classified generation failure", () => {
     it.effect("retries through the IPv4 pooler on an IPv6-classified generation failure", () =>
       Effect.gen(function* () {
@@ -2437,6 +3147,10 @@ describe("gen types", () => {
         expect(generator.calls).toHaveLength(2);
         expect(generator.calls[1]?.conn.host).toBe(poolerHost);
         expect(generator.calls[1]?.conn.password).toBe("branch-password");
+        for (const call of generator.calls) {
+          expect(call.conn.sslmode).toBe("require");
+          expect(call.conn.sslrootcertInline).toBe(rootCaBundle());
+        }
       }).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -3563,6 +4277,10 @@ const setupRecorded = Effect.fnUntraced(function* (opts: {
   readonly args: ReadonlyArray<string>;
   /** Written to `supabase/.temp/project-ref`. */
   readonly projectRefFile?: string;
+  /** Written to `supabase/.temp/rest-version`. */
+  readonly restVersionFile?: string;
+  /** Resolved as `SUPABASE_DB_PASSWORD`, by the handler and by the real resolver. */
+  readonly dbPassword?: string;
   /** The ref the cache's project lookup answers for. */
   readonly cacheRef?: string;
   readonly branchOf?: string;
@@ -3575,6 +4293,13 @@ const setupRecorded = Effect.fnUntraced(function* (opts: {
   if (opts.projectRefFile !== undefined) {
     yield* writeTempFile(workdir, "project-ref", opts.projectRefFile);
   }
+  if (opts.restVersionFile !== undefined) {
+    yield* writeTempFile(workdir, "rest-version", opts.restVersionFile);
+  }
+  const env = {
+    SUPABASE_ACCESS_TOKEN: VALID_TOKEN,
+    ...(opts.dbPassword === undefined ? {} : { SUPABASE_DB_PASSWORD: opts.dbPassword }),
+  };
   const out = mockOutput({
     format: "text",
     interactive: opts.pickRef !== undefined,
@@ -3648,7 +4373,9 @@ const setupRecorded = Effect.fnUntraced(function* (opts: {
   });
   const layer = Layer.mergeAll(
     runtime,
-    cliConfigValuesTestLayer,
+    opts.dbPassword === undefined
+      ? cliConfigValuesTestLayer
+      : configValuesLayer({ env: { SUPABASE_DB_PASSWORD: opts.dbPassword } }),
     BunServices.layer,
     mockInspectSpawner().layer,
     Stdio.layerTest({ args: Effect.succeed(opts.args) }),
@@ -3669,7 +4396,7 @@ const setupRecorded = Effect.fnUntraced(function* (opts: {
             queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
           }),
       }),
-      env: { SUPABASE_ACCESS_TOKEN: VALID_TOKEN },
+      env,
     }),
     generator.layer,
   );
@@ -3683,11 +4410,7 @@ const setupRecorded = Effect.fnUntraced(function* (opts: {
     Effect.gen(function* () {
       yield* stubManagementApi(stubbed, serveLinkedDatabase(opts.cacheRef ?? VALID_REF));
       return yield* effect;
-    }).pipe(
-      Effect.scoped,
-      Effect.provide(layer),
-      provideEnv({ SUPABASE_ACCESS_TOKEN: VALID_TOKEN }),
-    );
+    }).pipe(Effect.scoped, Effect.provide(layer), provideEnv(env));
   return { workdir, out, generator, api, http, stubbed, recordedRequests, run };
 });
 
@@ -3731,6 +4454,39 @@ describe("gen types permissions through the real layers", () => {
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
+  it.effect(
+    "generates typescript for the linked ref directly with its PostgREST version and no login role",
+    () =>
+      Effect.gen(function* () {
+        const ctx = yield* setupRecorded({
+          args: ["gen", "types", `--remote=${VALID_REF}`],
+          projectRefFile: VALID_REF,
+          restVersionFile: "v13.0.4\n",
+          dbPassword: "db-password",
+        });
+        yield* ctx.run(
+          genTypes(defaultFlags({ remote: Option.some({ _tag: "Ref", ref: VALID_REF } as const) })),
+        );
+
+        expect(ctx.out.stdoutText).toBe("generated");
+        expect(warningsOf(ctx.out)).toEqual([]);
+        expect(methodPaths(ctx.api.requests)).toEqual([`GET /v1/projects/${VALID_REF}`]);
+        expect(ctx.stubbed.map(({ method, path }) => `${method} ${path}`)).not.toContain(
+          `POST /v1/projects/${VALID_REF}/cli/login-role`,
+        );
+        expect(ctx.generator.calls).toHaveLength(1);
+        expect(ctx.generator.calls[0]?.lang).toBe("typescript");
+        expect(ctx.generator.calls[0]?.conn.password).toBe("db-password");
+        expect(ctx.generator.calls[0]?.options["postgrest-version"]).toBe("13.0.4");
+        assertPermissionDrift({
+          command: "gen types",
+          activeFlags: { ...DEFAULT_SWITCHES, remote: VALID_REF, lang: "typescript" },
+          requests: ctx.recordedRequests(),
+          exact: true,
+        });
+      }).pipe(Effect.provide(BunServices.layer)),
+  );
+
   it.effect("still generates typescript through the deprecated --project-id alias", () =>
     Effect.gen(function* () {
       const ctx = yield* setupRecorded({
diff --git a/apps/cli/src/commands/gen/types/types.layers.unit.test.ts b/apps/cli/src/commands/gen/types/types.layers.unit.test.ts
index 20fdc34ae8..d9b9e90dff 100644
--- a/apps/cli/src/commands/gen/types/types.layers.unit.test.ts
+++ b/apps/cli/src/commands/gen/types/types.layers.unit.test.ts
@@ -4,7 +4,7 @@
  */
 
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer, Option } from "effect";
 
 import {
@@ -75,6 +75,7 @@ function ambientStubs() {
 
   return Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     // Builds the real commandSettingsLayer against the real filesystem — see
     // isolatedHomeLayer's docs.
     isolatedHomeLayer(tempRoot.current),
diff --git a/apps/cli/src/commands/gen/types/types.shared.ts b/apps/cli/src/commands/gen/types/types.shared.ts
index f493bb62d2..14621d07d4 100644
--- a/apps/cli/src/commands/gen/types/types.shared.ts
+++ b/apps/cli/src/commands/gen/types/types.shared.ts
@@ -1,8 +1,5 @@
 import { Effect, Schema } from "effect";
 import { InvalidGenTypesDurationError } from "./types.errors.ts";
-import caProd2021 from "./templates/prod-ca-2021.ts";
-import caProd2025 from "./templates/prod-ca-2025.ts";
-import caStaging2021 from "./templates/staging-ca-2021.ts";
 
 // Local Docker resource ids are hoisted to `command-internal` so the declarative seam
 // can derive the same `supabase_db_<id>` name when checking the local stack.
@@ -79,7 +76,3 @@ export function parseQueryTimeoutMillis(
     return totalMillis;
   });
 }
-
-export function rootCaBundle() {
-  return `${caStaging2021}${caProd2021}${caProd2025}`;
-}
diff --git a/apps/cli/src/commands/gen/types/types.typegen-host.unit.test.ts b/apps/cli/src/commands/gen/types/types.typegen-host.unit.test.ts
index 3dbff497e9..23a577e7d3 100644
--- a/apps/cli/src/commands/gen/types/types.typegen-host.unit.test.ts
+++ b/apps/cli/src/commands/gen/types/types.typegen-host.unit.test.ts
@@ -1,7 +1,17 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import type { SpawnRequest, SpawnResult } from "@supabase/typegen";
-import { Data, Deferred, Effect, FileSystem, Path, PlatformError, Sink, Stream } from "effect";
+import {
+  Data,
+  Deferred,
+  Effect,
+  FileSystem,
+  Path,
+  PlatformError,
+  type Redacted,
+  Sink,
+  Stream,
+} from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { makeTypegenHost } from "./types.typegen-host.ts";
 
@@ -9,7 +19,9 @@ interface SpawnCall {
   readonly command: string;
   readonly args: ReadonlyArray<string>;
   readonly cwd: string | undefined;
-  readonly env: Readonly<Record<string, string | undefined>> | undefined;
+  readonly env:
+    | Readonly<Record<string, string | Redacted.Redacted<string> | undefined>>
+    | undefined;
   readonly extendEnv: boolean | undefined;
   readonly shell: boolean | string | undefined;
   stdin: string;
@@ -36,7 +48,7 @@ function fakeSpawner(
       }
       const call: SpawnCall = {
         command: command.command,
-        args: command.args,
+        args: command.args.map(String),
         cwd: command.options.cwd,
         env: command.options.env,
         extendEnv: command.options.extendEnv,
diff --git a/apps/cli/src/commands/gen/types/types.unit.test.ts b/apps/cli/src/commands/gen/types/types.unit.test.ts
index 4658239bbb..cda6749794 100644
--- a/apps/cli/src/commands/gen/types/types.unit.test.ts
+++ b/apps/cli/src/commands/gen/types/types.unit.test.ts
@@ -3,7 +3,6 @@ import { Effect, Exit } from "effect";
 import { parseSchemaFlags } from "../../../command-internal/schema-flags.ts";
 import {
   defaultSchemas,
-  rootCaBundle,
   localDbContainerId,
   localNetworkId,
   parseQueryTimeoutMillis,
@@ -86,8 +85,4 @@ describe("schema and id helpers", () => {
     const longId = "a".repeat(60);
     expect(localDbContainerId(longId)).toBe(`supabase_db_${"a".repeat(40)}`);
   });
-
-  it("bundles the staging and production CA certificates", () => {
-    expect(rootCaBundle().length).toBeGreaterThan(0);
-  });
 });
diff --git a/apps/cli/src/commands/init/SIDE_EFFECTS.md b/apps/cli/src/commands/init/SIDE_EFFECTS.md
index 9e09b1a070..21c00e9a70 100644
--- a/apps/cli/src/commands/init/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/init/SIDE_EFFECTS.md
@@ -4,7 +4,9 @@
 
 | Path                      | Format     | When                                                                                             |
 | ------------------------- | ---------- | ------------------------------------------------------------------------------------------------ |
-| `supabase/config.toml`    | TOML       | checked first to fail fast unless `--force` is set                                               |
+| `supabase/config.json`    | JSON       | existence check, first, to fail fast unless `--force` is set                                     |
+| `supabase/config.jsonc`   | JSONC      | existence check, second, to fail fast unless `--force` is set                                    |
+| `supabase/config.toml`    | TOML       | existence check, last, to fail fast unless `--force` is set                                      |
 | `.git/`                   | directory  | checked upward from the invocation cwd to decide whether `supabase/.gitignore` should be managed |
 | `supabase/.gitignore`     | text       | only when inside a git repo and the file already exists                                          |
 | `.vscode/settings.json`   | JSONC/JSON | when VS Code settings are generated and the file already exists                                  |
@@ -14,6 +16,8 @@
 
 | Path                      | Format | When                                                                                                                    |
 | ------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------- |
+| `supabase/config.json`    | -      | removed (if present) when `--force` is set, so the fresh `config.toml` is the file that loads                           |
+| `supabase/config.jsonc`   | -      | removed (if present) when `--force` is set, so the fresh `config.toml` is the file that loads                           |
 | `supabase/config.toml`    | TOML   | always on success; created from the default template, or the stack-opt-in template when `SUPABASE_EXPERIMENTAL_STACK=1` |
 | `supabase/.gitignore`     | text   | when inside a git repo and the template is not already present                                                          |
 | `.vscode/settings.json`   | JSON   | when interactive VS Code setup is accepted, or when `--with-vscode-settings` / `--with-vscode-workspace` is set         |
@@ -35,13 +39,13 @@
 
 ## Exit Codes
 
-| Code | Condition                                                                            |
-| ---- | ------------------------------------------------------------------------------------ |
-| `0`  | success - prints "Finished supabase init."                                           |
-| `1`  | `supabase/config.toml` already exists and `--force` was not provided                 |
-| `1`  | `SUPABASE_EXPERIMENTAL_STACK` is a non-empty value that is not a boolean             |
-| `1`  | permission denied writing config file                                                |
-| `1`  | an existing `.vscode/settings.json` / `.vscode/extensions.json` is not valid JSON(C) |
+| Code | Condition                                                                                     |
+| ---- | --------------------------------------------------------------------------------------------- |
+| `0`  | success - prints "Finished supabase init."                                                    |
+| `1`  | `supabase/config.json`, `config.jsonc` or `config.toml` exists and `--force` was not provided |
+| `1`  | `SUPABASE_EXPERIMENTAL_STACK` is a non-empty value that is not a boolean                      |
+| `1`  | permission denied writing config file                                                         |
+| `1`  | an existing `.vscode/settings.json` / `.vscode/extensions.json` is not valid JSON(C)          |
 
 ## Output
 
@@ -57,7 +61,7 @@ In interactive mode (`-i`/`--interactive`), may prompt for IDE settings preferen
 
 Success is emitted as raw text even when the CLI is invoked with non-text output modes.
 
-When `supabase/config.toml` already exists and `--force` is not set (stderr; the platform check selects the exact per-OS path separator and errno text):
+When `supabase/config.json`, `supabase/config.jsonc` or `supabase/config.toml` already exists and `--force` is not set (stderr; the first of those files in that order is named, and the platform check selects the exact per-OS path separator and errno text; `config.toml` is shown):
 
 On Linux/macOS:
 
@@ -83,7 +87,8 @@ Try rerunning the command with --debug to troubleshoot the error.
 ## Notes
 
 - Uses the invocation cwd directly and does not recurse upward looking for an existing project.
-- The `--force` flag overwrites an existing `supabase/config.toml`.
+- The `--force` flag overwrites an existing `supabase/config.toml` and removes any `supabase/config.json` / `supabase/config.jsonc`, since the project loader reads those before `config.toml`.
+- `supabase/config.toml` starts with a `#:schema https://supabase.com/schemas/config/v1.json` directive so Taplo and Tombi validate it against the hosted schema.
 - The `--use-orioledb` flag writes the OrioleDB version to `db.orioledb_version`; it does not require `--experimental`.
 - `SUPABASE_EXPERIMENTAL_STACK=1` opts the new project into the experimental stack backend: the
   written config includes `[experimental] stack = true` and omits the Docker-era default ports
@@ -92,6 +97,7 @@ Try rerunning the command with --debug to troubleshoot the error.
   established template.
 - The `--interactive` / `-i` flag enables IDE settings prompts (only effective in TTY).
 - The `--with-vscode-settings` and `--with-vscode-workspace` flags are hidden backward-compat aliases for the same VS Code helper and both write `.vscode/settings.json` and `.vscode/extensions.json`.
+- `.vscode/settings.json` includes `json.schemaDownload.trustedDomains` trusting `https://supabase.com/schemas/`, so VS Code loads the hosted config schema without an untrusted-location warning.
 - The `--with-intellij-settings` flag is a hidden backward-compat alias for generating `.idea/deno.xml`.
-- An existing `.vscode/settings.json` / `.vscode/extensions.json` is parsed tolerantly through a JSONC boundary that strips line/block comments and trailing commas, then the template is merged on top (template keys win). An empty file is treated as absent and the template is written verbatim. A non-empty file that is not valid JSON(C) aborts the command with `InitParseSettingsError` and is left untouched rather than being overwritten.
+- An existing `.vscode/settings.json` / `.vscode/extensions.json` is parsed tolerantly through a JSONC boundary that strips line/block comments and trailing commas, then the template is merged on top: nested objects are merged key by key with template values winning on conflicts, and arrays and scalars from the template replace the existing value. An empty file is treated as absent and the template is written verbatim. A non-empty file that is not valid JSON(C) aborts the command with `InitParseSettingsError` and is left untouched rather than being overwritten.
 - No authentication required - purely local file creation.
diff --git a/apps/cli/src/commands/init/init.command.ts b/apps/cli/src/commands/init/init.command.ts
index de8655a647..4baa121c9d 100644
--- a/apps/cli/src/commands/init/init.command.ts
+++ b/apps/cli/src/commands/init/init.command.ts
@@ -21,7 +21,9 @@ const config = {
     Flag.withDefault(false),
   ),
   force: Flag.Boolean("force").pipe(
-    Flag.withDescription("Overwrite existing supabase/config.toml."),
+    Flag.withDescription(
+      "Write a fresh supabase/config.toml, replacing an existing config.toml and removing any config.json or config.jsonc.",
+    ),
     Flag.withDefault(false),
   ),
   withVscodeWorkspace: Flag.Boolean("with-vscode-workspace").pipe(
diff --git a/apps/cli/src/commands/init/init.handler.ts b/apps/cli/src/commands/init/init.handler.ts
index 93ebda13c7..b7e7079ebd 100644
--- a/apps/cli/src/commands/init/init.handler.ts
+++ b/apps/cli/src/commands/init/init.handler.ts
@@ -38,13 +38,14 @@ export const init = Effect.fn("init")(function* (flags: InitFlags) {
   });
 
   if (!result.created) {
-    // The path in this message is always the relative `supabase/config.toml`, regardless of
-    // cwd or `--workdir`. Windows uses a backslash and "The file exists."; POSIX uses a
-    // forward slash and "file exists".
+    // The path in this message is always the relative `supabase/<existing config file>`,
+    // regardless of cwd or `--workdir`. Windows uses a backslash and "The file exists.";
+    // POSIX uses a forward slash and "file exists".
+    const configFile = path.basename(result.configPath);
     const message =
       runtimeInfo.platform === "win32"
-        ? "failed to create config file: open supabase\\config.toml: The file exists."
-        : "failed to create config file: open supabase/config.toml: file exists";
+        ? `failed to create config file: open supabase\\${configFile}: The file exists.`
+        : `failed to create config file: open supabase/${configFile}: file exists`;
     return yield* new InitConfigExistsError({
       message,
       suggestion: "Run supabase init --force to overwrite existing config file.",
diff --git a/apps/cli/src/commands/init/init.integration.test.ts b/apps/cli/src/commands/init/init.integration.test.ts
index 3c4ed5ed74..d978abc455 100644
--- a/apps/cli/src/commands/init/init.integration.test.ts
+++ b/apps/cli/src/commands/init/init.integration.test.ts
@@ -33,6 +33,10 @@ const decodeOrioleDbConfig = Schema.decodeUnknownEffect(
   }),
 );
 
+const decodeJsonObject = Schema.decodeUnknownEffect(
+  Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown)),
+);
+
 const readTextFile = (...segments: Array<string>) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
@@ -142,6 +146,7 @@ describe("init", () => {
       }).pipe(Effect.provide(layer));
 
       const content = yield* readTextFile(tempDir, "supabase", "config.toml");
+      expect(content.split("\n")[0]).toBe("#:schema https://supabase.com/schemas/config/v1.json");
       expect(content).toContain("major_version = 17");
       expect(content).toContain("port = 54321");
       expect(content).not.toContain("stack = true");
@@ -207,6 +212,95 @@ describe("init", () => {
     });
   });
 
+  it.effect.each([
+    { existing: ["config.json", "config.jsonc", "config.toml"], named: "config.json" },
+    { existing: ["config.jsonc", "config.toml"], named: "config.jsonc" },
+    { existing: ["config.jsonc"], named: "config.jsonc" },
+  ])("names $named when $existing already exist", ({ existing, named }) => {
+    const tempDir = tempRoot.current;
+
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* fs.makeDirectory(path.join(tempDir, "supabase"), { recursive: true });
+      for (const file of existing) {
+        yield* fs.writeFileString(path.join(tempDir, "supabase", file), "{}\n");
+      }
+      const { layer } = setup(tempDir);
+
+      const exit = yield* init({
+        interactive: false,
+        useOrioledb: false,
+        force: false,
+        withVscodeWorkspace: false,
+        withVscodeSettings: false,
+        withIntellijSettings: false,
+      }).pipe(Effect.provide(layer), Effect.exit);
+
+      expect(findFailure(exit)).toMatchObject({
+        message: `failed to create config file: open supabase/${named}: file exists`,
+      });
+      for (const file of existing) {
+        expect(yield* fs.readFileString(path.join(tempDir, "supabase", file))).toBe("{}\n");
+      }
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
+  it.effect("--force writes config.toml and removes config.json and config.jsonc", () => {
+    const tempDir = tempRoot.current;
+
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* fs.makeDirectory(path.join(tempDir, "supabase"), { recursive: true });
+      yield* fs.writeFileString(path.join(tempDir, "supabase", "config.json"), "{}\n");
+      yield* fs.writeFileString(path.join(tempDir, "supabase", "config.jsonc"), "{}\n");
+      const { layer } = setup(tempDir);
+
+      yield* init({
+        interactive: false,
+        useOrioledb: false,
+        force: true,
+        withVscodeWorkspace: false,
+        withVscodeSettings: false,
+        withIntellijSettings: false,
+      }).pipe(Effect.provide(layer));
+
+      expect(yield* fs.exists(path.join(tempDir, "supabase", "config.json"))).toBe(false);
+      expect(yield* fs.exists(path.join(tempDir, "supabase", "config.jsonc"))).toBe(false);
+      expect(yield* readTextFile(tempDir, "supabase", "config.toml")).toContain("major_version");
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
+  it.effect("--force keeps config.json when config.toml cannot be written", () => {
+    const tempDir = tempRoot.current;
+
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const supabaseDir = path.join(tempDir, "supabase");
+      yield* fs.makeDirectory(supabaseDir, { recursive: true });
+      yield* fs.writeFileString(path.join(supabaseDir, "config.json"), "{}\n");
+      yield* fs.writeFileString(path.join(supabaseDir, "config.toml"), "");
+      yield* fs.chmod(path.join(supabaseDir, "config.toml"), 0o444);
+      const { layer } = setup(tempDir);
+
+      const exit = yield* Effect.exit(
+        init({
+          interactive: false,
+          useOrioledb: false,
+          force: true,
+          withVscodeWorkspace: false,
+          withVscodeSettings: false,
+          withIntellijSettings: false,
+        }).pipe(Effect.provide(layer)),
+      );
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(yield* fs.readFileString(path.join(supabaseDir, "config.json"))).toBe("{}\n");
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
   it.effect("renders the Windows form of the already-exists error on win32", () => {
     const tempDir = tempRoot.current;
 
@@ -348,6 +442,76 @@ describe("init", () => {
     });
   });
 
+  it.effect("merges the VS Code settings into an existing file without losing user entries", () => {
+    const tempDir = tempRoot.current;
+
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const settingsPath = path.join(tempDir, ".vscode", "settings.json");
+      yield* fs.makeDirectory(path.dirname(settingsPath), { recursive: true });
+      yield* fs.writeFileString(
+        settingsPath,
+        `{
+  // user preferences
+  "editor.fontSize": 14,
+  "json.schemaDownload.trustedDomains": { "https://example.com/": true },
+  "[typescript]": { "editor.tabSize": 4 },
+}
+`,
+      );
+      const { layer } = setup(tempDir);
+
+      yield* init({ ...BASE_INIT_FLAGS, interactive: false, withVscodeSettings: true }).pipe(
+        Effect.provide(layer),
+      );
+
+      expect(yield* decodeJsonObject(yield* readTextFile(settingsPath))).toMatchObject({
+        "editor.fontSize": 14,
+        "json.schemaDownload.trustedDomains": {
+          "https://example.com/": true,
+          "https://supabase.com/schemas/": true,
+        },
+        "[typescript]": {
+          "editor.tabSize": 4,
+          "editor.defaultFormatter": "denoland.vscode-deno",
+        },
+      });
+    }).pipe(Effect.provide(BunServices.layer));
+  });
+
+  it.effect.each([
+    ["malformed JSON", `{ "a": }`],
+    ["a non-object document", "[]"],
+  ] as const)(
+    "fails with InitParseSettingsError for %s and leaves settings.json unchanged",
+    ([, contents]) => {
+      const tempDir = tempRoot.current;
+
+      return Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const settingsPath = path.join(tempDir, ".vscode", "settings.json");
+        yield* fs.makeDirectory(path.dirname(settingsPath), { recursive: true });
+        yield* fs.writeFileString(settingsPath, contents);
+        const { layer } = setup(tempDir);
+
+        const exit = yield* init({
+          ...BASE_INIT_FLAGS,
+          interactive: false,
+          withVscodeSettings: true,
+        }).pipe(Effect.provide(layer), Effect.exit);
+
+        const error = findFailure(exit);
+        expect(Predicate.isTagged(error, "InitParseSettingsError")).toBe(true);
+        const detail = (error as { detail: string }).detail;
+        expect(detail.startsWith(`Could not parse JSON in ${settingsPath}: `)).toBe(true);
+        expect(detail.length).toBeGreaterThan(`Could not parse JSON in ${settingsPath}: `.length);
+        expect(yield* readTextFile(settingsPath)).toBe(contents);
+      }).pipe(Effect.provide(BunServices.layer));
+    },
+  );
+
   it.effect("writes the stack-opt-in template when SUPABASE_EXPERIMENTAL_STACK=1", () => {
     const tempDir = tempRoot.current;
 
diff --git a/apps/cli/src/commands/inspect/db/SIDE_EFFECTS.md b/apps/cli/src/commands/inspect/db/SIDE_EFFECTS.md
index 4469c0119c..c266476e41 100644
--- a/apps/cli/src/commands/inspect/db/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/inspect/db/SIDE_EFFECTS.md
@@ -2,10 +2,11 @@
 
 Target: selectable, no consent — see [Command target](../../../../docs/command-target.md)
 
-Single shared side-effect document for all 13 active `inspect db` subcommands and
+Single shared side-effect document for all 16 active `inspect db` subcommands and
 their 12 deprecated aliases. Every subcommand has the same surface — it resolves its target, runs one read-only
 `SELECT`, and renders the result as an ASCII table. They differ only in the SQL run and
-the columns rendered (see the per-subcommand `<name>.query.ts`).
+the columns rendered (see the per-subcommand `<name>.query.ts`). `collation-drift` is the
+exception: it renders a report (see Output).
 
 ## Files Read
 
@@ -57,24 +58,31 @@ Local targets and database URLs make none.
 ## Database Queries
 
 Each subcommand runs one read-only `SELECT` (the embedded `<name>.sql`). The
-5 schema-filtered queries take `$1` = the LIKE-escaped internal-schema list;
+7 schema-filtered queries take `$1` = the LIKE-escaped internal-schema list;
 `db-stats` additionally takes `$2` = the database name.
 
-| Subcommand           | SQL file                 | InternalSchemas param?      |
-| -------------------- | ------------------------ | --------------------------- |
-| db-stats             | db_stats.sql             | yes (`$1`) + db name (`$2`) |
-| index-stats          | index_stats.sql          | yes (`$1`)                  |
-| bloat                | bloat.sql                | yes (`$1`)                  |
-| vacuum-stats         | vacuum_stats.sql         | yes (`$1`)                  |
-| table-stats          | table_stats.sql          | yes (`$1`)                  |
-| replication-slots    | replication_slots.sql    | no                          |
-| locks                | locks.sql                | no                          |
-| blocking             | blocking.sql             | no                          |
-| outliers             | outliers.sql             | no                          |
-| calls                | calls.sql                | no                          |
-| long-running-queries | long_running_queries.sql | no                          |
-| role-stats           | role_stats.sql           | no                          |
-| traffic-profile      | traffic_profile.sql      | no                          |
+| Subcommand           | SQL file                             | InternalSchemas param?      |
+| -------------------- | ------------------------------------ | --------------------------- |
+| db-stats             | db_stats.sql                         | yes (`$1`) + db name (`$2`) |
+| index-stats          | index_stats.sql                      | yes (`$1`)                  |
+| bloat                | bloat.sql                            | yes (`$1`)                  |
+| vacuum-stats         | vacuum_stats.sql                     | yes (`$1`)                  |
+| table-stats          | table_stats.sql                      | yes (`$1`)                  |
+| toast-sizes          | toast_sizes.sql                      | yes (`$1`)                  |
+| xid-age              | xid_age.sql                          | yes (`$1`)                  |
+| replication-slots    | replication_slots.sql                | no                          |
+| locks                | locks.sql                            | no                          |
+| blocking             | blocking.sql                         | no                          |
+| outliers             | outliers.sql                         | no                          |
+| calls                | calls.sql                            | no                          |
+| long-running-queries | long_running_queries.sql             | no                          |
+| role-stats           | role_stats.sql                       | no                          |
+| traffic-profile      | traffic_profile.sql                  | no                          |
+| collation-drift      | inline in `collation-drift.query.ts` | no (no params)              |
+
+`collation-drift` first runs `SELECT current_setting('server_version_num')::int` on the same
+session, then one inline parameterless detection `SELECT` built for that version (PG15+ also
+reads `pg_database.datcollversion` and `pg_database_collation_actual_version()`). Both are read-only.
 
 Deprecated aliases run an active subcommand's query: `cache-hit`→db-stats;
 `index-usage`/`index-sizes`/`unused-indexes`/`seq-scans`/`table-record-counts`→index-stats;
@@ -95,6 +103,9 @@ flags, run no query and open no connection, and exit 1 with
 | `0`  | success                                  |
 | `1`  | resolution, connection, or query failure |
 
+`collation-drift` also exits `1` before connecting when `-o/--output` is passed; it supports
+`--output-format` only.
+
 ## Telemetry Events Fired
 
 | Event                  | When                                       | Notable properties                  |
@@ -114,14 +125,20 @@ whitespace runs collapsed to single spaces (long-running-queries' query is NOT
 collapsed). One `Target: …` banner naming the resolved target is written to
 **stderr** before the query runs.
 
+`collation-drift` instead prints a report: a key/value header, a callout, a table of
+affected indexes, and numbered remediation steps (verify with amcheck, `REINDEX INDEX
+CONCURRENTLY`, then `ALTER ... REFRESH ... VERSION`). With no drift it prints only the
+healthy callout.
+
 ### `--output-format json`
 
 A single object: `{ "rows": [ <raw driver rows, snake_case keys> ], "target": { … } }`,
 where `target` describes the resolved target. The stderr banner is still printed.
+`collation-drift` emits `{ "rows": [...], "report": { … } }`.
 
 ### `--output-format stream-json`
 
-A `result` event carrying the same `{ rows }` payload.
+A `result` event carrying the same `{ rows }` payload (`{ rows, report }` for `collation-drift`).
 
 ### Deprecated aliases
 
diff --git a/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.command.ts b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.command.ts
new file mode 100644
index 0000000000..dbb31eb76e
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.command.ts
@@ -0,0 +1,38 @@
+import { Command } from "effect/cli";
+import { withPermissions } from "../../../../command-internal/command-permissions/command-permissions.annotation.ts";
+import { inspectDbCollationDrift } from "./collation-drift.handler.ts";
+import {
+  INSPECT_DB_FLAGS,
+  INSPECT_DB_PERMISSIONS,
+  inspectDbCommandHandler,
+  withInspectDbTargetPolicy,
+} from "../inspect-db-command.ts";
+import { inspectDbRuntimeLayer } from "../db.layers.ts";
+import { cliConfigValuesLayer } from "../../../../config/cli-config-values.layer.ts";
+import { withCliConfigFlags } from "../../../../config/cli-config-flags.ts";
+
+export const inspectDbCollationDriftCommand = Command.make(
+  "collation-drift",
+  INSPECT_DB_FLAGS,
+).pipe(
+  Command.withDescription(
+    `Show indexes affected by collation version drift, with the fix workflow.
+
+Postgres stores btree indexes on text columns in sorted order, using rules from
+the system collation library (glibc or ICU). When that library is upgraded the
+rules can change, and indexes built under the old rules are no longer correctly
+ordered. Postgres reports no error: queries may quietly return missing rows,
+sort incorrectly, or let duplicates past a unique constraint.
+
+The output lists the affected indexes and the exact statements to verify
+(amcheck), rebuild (REINDEX CONCURRENTLY), and record the new version — in the
+order they must be run. This command itself is read-only.`,
+  ),
+  Command.withShortDescription("Show indexes affected by collation version drift"),
+  withPermissions(INSPECT_DB_PERMISSIONS),
+  Command.withHandler(inspectDbCommandHandler(inspectDbCollationDrift)),
+  Command.provide(inspectDbRuntimeLayer("collation-drift")),
+  Command.provide(cliConfigValuesLayer),
+  withCliConfigFlags(INSPECT_DB_FLAGS),
+  withInspectDbTargetPolicy,
+);
diff --git a/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.handler.ts b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.handler.ts
new file mode 100644
index 0000000000..24136809f2
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.handler.ts
@@ -0,0 +1,7 @@
+import { makeInspectDbReportHandler } from "../inspect-report.ts";
+import { collationDriftSpec } from "./collation-drift.query.ts";
+
+export const inspectDbCollationDrift = makeInspectDbReportHandler(
+  collationDriftSpec,
+  "inspect.db.collation-drift",
+);
diff --git a/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.integration.test.ts b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.integration.test.ts
new file mode 100644
index 0000000000..7d1033a4a2
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.integration.test.ts
@@ -0,0 +1,192 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, ConfigProvider, Effect, Exit, Layer, Option } from "effect";
+import { vi } from "vitest";
+
+vi.mock("node:net", (importOriginal) =>
+  Promise.all([
+    import("../../../../../tests/helpers/refuse-invalid-db-hosts.ts"),
+    importOriginal<typeof import("node:net")>(),
+  ]).then(([helper, net]) => helper.refuseInvalidDbHosts(net)),
+);
+
+import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import {
+  buildTestRuntime,
+  jsonResponse,
+  mockCommandPlatformApi,
+  mockCommandSettings,
+  mockTelemetryStateTracked,
+} from "../../../../../tests/helpers/command-mocks.ts";
+import { configValuesLayer } from "../../../../../tests/helpers/config-values-layer.ts";
+import { DbConfigResolver } from "../../../../command-internal/db-config.service.ts";
+import type {
+  DbConnectionInput,
+  ResolvedDbConnection,
+} from "../../../../command-internal/db-config.types.ts";
+import {
+  DbConnection,
+  type PgConnInput,
+} from "../../../../command-internal/db-connection.service.ts";
+import { DnsResolverFlag, OutputFlag, YesFlag } from "../../../../command-internal/global-flags.ts";
+import { TargetPolicy } from "../../../../command-internal/target/target-policy.ts";
+import type { InspectConnectionFlags } from "../inspect-query.ts";
+import { inspectDbCollationDrift } from "./collation-drift.handler.ts";
+
+const LOCAL_CONN: PgConnInput = {
+  host: "127.0.0.1",
+  port: 54322,
+  user: "postgres",
+  password: "postgres",
+  database: "postgres",
+};
+
+const DRIFT_ROW = {
+  database: "postgres",
+  name: "public.users_email_key",
+  table: "public.users",
+  columns: "email",
+  collation: "default",
+  stored_version: "2.36",
+  current_version: "2.39",
+  key_type: "UNIQUE",
+  size: "16 kB",
+  can_refresh: true,
+};
+
+const flags: InspectConnectionFlags = {
+  dbUrl: Option.none(),
+  remote: Option.none(),
+  linked: false,
+  local: false,
+  projectRef: Option.none(),
+};
+
+function setup(opts: {
+  serverVersionNum: number;
+  rows: ReadonlyArray<Record<string, unknown>>;
+  format?: "text" | "json";
+  connectFails?: boolean;
+}) {
+  const out = mockOutput({ format: opts.format ?? "text" });
+  const queries: string[] = [];
+  const connection = Layer.succeed(DbConnection, {
+    connect: () =>
+      opts.connectFails === true
+        ? Effect.die("connect must not be reached")
+        : Effect.succeed({
+            exec: () => Effect.void,
+            execBatch: () => Effect.void,
+            extensionExists: () => Effect.succeed(false),
+            queryRaw: () => Effect.succeed({ fields: [], rows: [], commandTag: "" }),
+            copyToCsv: () => Effect.succeed(new Uint8Array()),
+            query: (sql: string) => {
+              queries.push(sql);
+              return Effect.succeed(
+                sql.includes("server_version_num")
+                  ? [{ server_version_num: opts.serverVersionNum }]
+                  : opts.rows,
+              );
+            },
+          }),
+  });
+  const resolver = Layer.succeed(DbConfigResolver, {
+    resolveConnection: (input: DbConnectionInput) =>
+      Effect.succeed({
+        conn: LOCAL_CONN,
+        isLocal: true,
+        target: input.target,
+      } satisfies ResolvedDbConnection),
+    resolvePoolerFallback: () => Effect.succeed(Option.none()),
+  });
+  const runtime = buildTestRuntime({
+    out,
+    api: mockCommandPlatformApi({
+      handler: (request) => Effect.succeed(jsonResponse(request, 200, [])),
+    }),
+    cliSettings: mockCommandSettings({
+      workdir: "/tmp/collation-drift-test",
+      projectId: Option.none(),
+    }),
+    telemetry: mockTelemetryStateTracked().layer,
+  });
+  const layer = Layer.mergeAll(
+    runtime,
+    resolver,
+    connection,
+    Layer.succeed(DnsResolverFlag, "native"),
+    Layer.succeed(YesFlag, false),
+    Layer.succeed(TargetPolicy, { group: "selectable", consent: "none" }),
+    ConfigProvider.layer(ConfigProvider.fromEnvRecord({}, { preserveEmptyStrings: true })),
+    configValuesLayer(),
+  );
+  return { layer, out, queries };
+}
+
+describe("inspect db collation-drift", () => {
+  it.effect("PG15+ reads the default collation version and prints remediation steps", () => {
+    const { layer, out, queries } = setup({
+      serverVersionNum: 150000,
+      rows: [DRIFT_ROW],
+    });
+    return Effect.gen(function* () {
+      yield* inspectDbCollationDrift(flags);
+      expect(queries[1]).toContain("pg_database_collation_actual_version");
+      expect(out.stdoutText).toContain("public.users_email_key");
+      expect(out.stdoutText).toContain("bt_index_check");
+      expect(out.stdoutText).toContain("REINDEX INDEX CONCURRENTLY public.users_email_key;");
+      expect(out.stdoutText).toContain('ALTER DATABASE "postgres" REFRESH COLLATION VERSION;');
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("pre-15 skips the default collation check and prints the healthy callout", () => {
+    const { layer, out, queries } = setup({
+      serverVersionNum: 140000,
+      rows: [],
+    });
+    return Effect.gen(function* () {
+      yield* inspectDbCollationDrift(flags);
+      expect(queries[1]).not.toContain("datcollversion");
+      expect(out.stdoutText).toContain("No recorded collation version mismatch");
+      expect(out.stdoutText.replace(/\s+/g, " ")).toContain("not checked before PostgreSQL 15");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("json mode carries raw rows and the report severity", () => {
+    const { layer, out } = setup({
+      serverVersionNum: 160000,
+      rows: [DRIFT_ROW],
+      format: "json",
+    });
+    return Effect.gen(function* () {
+      yield* inspectDbCollationDrift(flags);
+      expect(out.messages).toContainEqual(
+        expect.objectContaining({
+          type: "success",
+          message: "inspect db collation-drift",
+          data: {
+            rows: [DRIFT_ROW],
+            report: expect.objectContaining({
+              command: "collation-drift",
+              severity: "critical",
+            }),
+          },
+        }),
+      );
+      expect(out.stdoutText).toBe("");
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("rejects -o/--output before connecting", () => {
+    const { layer } = setup({ serverVersionNum: 170000, rows: [], connectFails: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(inspectDbCollationDrift(flags));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(Cause.pretty(exit.cause)).toContain(
+          "the -o/--output flag is not supported by inspect db collation-drift; use --output-format json|stream-json instead.",
+        );
+        expect(Cause.pretty(exit.cause)).not.toContain("connect must not be reached");
+      }
+    }).pipe(Effect.provide(Layer.mergeAll(layer, Layer.succeed(OutputFlag, Option.some("json")))));
+  });
+});
diff --git a/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.query.ts b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.query.ts
new file mode 100644
index 0000000000..da618205a7
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.query.ts
@@ -0,0 +1,297 @@
+import type { InspectReportSpec } from "../inspect-report.ts";
+import type { Report, ReportSeverity } from "../../../../output/report.types.ts";
+
+// Detects btree drift for the database default collation (PG15+) and named collations.
+// Other access methods are out of scope; amcheck verifies only btree.
+// pg_database records the default collation's version from PG15; PG15 itself only reports
+// the current version through pg_database_collation_actual_version().
+function collationDriftSql(serverVersionNum: number): string {
+  const [dbStored, dbCurrent] =
+    serverVersionNum >= 150000
+      ? [
+          "(SELECT datcollversion FROM pg_database WHERE datname = current_database())",
+          "(SELECT pg_database_collation_actual_version(oid) FROM pg_database WHERE datname = current_database())",
+        ]
+      : ["NULL::text", "NULL::text"];
+  return `WITH key_collations AS (
+  SELECT DISTINCT
+    ix.indexrelid,
+    ix.indrelid,
+    k.colloid,
+    ix.indisprimary AS is_primary,
+    ix.indisunique AS is_unique,
+    ix.indisexclusion AS is_exclusion
+  FROM pg_index ix
+  -- indkey holds 0 for expression columns, which have no pg_attribute row.
+  JOIN LATERAL unnest(ix.indkey, ix.indcollation) AS k(attnum, colloid) ON k.attnum <> 0
+  WHERE k.colloid <> 0
+),
+drifted AS (
+  SELECT
+    kc.*,
+    CASE WHEN kc.colloid = 'pg_catalog.default'::regcollation
+      THEN ${dbStored}
+      ELSE c.collversion
+    END AS stored_version,
+    CASE WHEN kc.colloid = 'pg_catalog.default'::regcollation
+      THEN ${dbCurrent}
+      ELSE pg_collation_actual_version(kc.colloid)
+    END AS current_version,
+    CASE WHEN kc.colloid = 'pg_catalog.default'::regcollation
+      THEN 'default'
+      -- Schema-qualified: the generated ALTER COLLATION must not depend on search_path.
+      ELSE FORMAT('%I.%I', cn.nspname, c.collname)
+    END AS collation_name,
+    -- Refreshing a version needs ownership of the database or collation.
+    CASE WHEN kc.colloid = 'pg_catalog.default'::regcollation
+      THEN (SELECT pg_has_role(datdba, 'USAGE') FROM pg_database WHERE datname = current_database())
+      ELSE pg_has_role(c.collowner, 'USAGE')
+    END AS can_refresh
+  FROM key_collations kc
+  JOIN pg_collation c ON c.oid = kc.colloid
+  JOIN pg_namespace cn ON cn.oid = c.collnamespace
+)
+SELECT
+  current_database() AS database,
+  FORMAT('%I.%I', n.nspname, i.relname) AS name,
+  FORMAT('%I.%I', n.nspname, t.relname) AS "table",
+  (
+    SELECT STRING_AGG(a.attname, ', ' ORDER BY k.ord)
+    FROM pg_index ix
+    JOIN LATERAL unnest(ix.indkey, ix.indcollation) WITH ORDINALITY AS k(attnum, colloid, ord) ON true
+    JOIN pg_attribute a ON a.attrelid = ix.indrelid AND a.attnum = k.attnum
+    WHERE ix.indexrelid = dr.indexrelid AND k.colloid = dr.colloid
+  ) AS columns,
+  dr.collation_name AS collation,
+  dr.stored_version,
+  dr.current_version,
+  dr.can_refresh,
+  CASE
+    WHEN dr.is_primary THEN 'PRIMARY KEY'
+    WHEN dr.is_unique THEN 'UNIQUE'
+    WHEN dr.is_exclusion THEN 'EXCLUSION'
+    ELSE ''
+  END AS key_type,
+  pg_size_pretty(pg_relation_size(i.oid)) AS size
+FROM drifted dr
+JOIN pg_class i ON i.oid = dr.indexrelid
+JOIN pg_class t ON t.oid = dr.indrelid
+JOIN pg_namespace n ON n.oid = t.relnamespace
+JOIN pg_am am ON am.oid = i.relam
+WHERE am.amname = 'btree'
+  -- Partitioned indexes ('I') hold no data; each partition's index is listed instead.
+  AND i.relkind = 'i'
+  AND t.relkind IN ('r', 'm')
+  -- Other sessions' temporary tables cannot be rebuilt from this session.
+  AND t.relpersistence <> 't'
+  AND n.nspname NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
+  AND dr.stored_version IS NOT NULL
+  AND dr.stored_version IS DISTINCT FROM dr.current_version
+-- Constraint-backing indexes first: a wrong sort order there can let
+-- duplicate rows past a unique check, not merely return wrong results.
+ORDER BY dr.is_primary DESC, dr.is_unique DESC, dr.is_exclusion DESC, pg_relation_size(i.oid) DESC, name`;
+}
+
+interface DriftRow {
+  readonly database: string;
+  readonly name: string;
+  readonly table: string;
+  readonly columns: string;
+  readonly collation: string;
+  readonly stored_version: string;
+  readonly current_version: string;
+  readonly key_type: string;
+  readonly size: string;
+  readonly can_refresh: boolean;
+}
+
+function toDriftRow(row: Record<string, unknown>): DriftRow {
+  const text = (v: unknown) => (v === null || v === undefined ? "" : String(v));
+  return {
+    database: text(row["database"]),
+    name: text(row["name"]),
+    table: text(row["table"]),
+    columns: text(row["columns"]),
+    collation: text(row["collation"]),
+    stored_version: text(row["stored_version"]),
+    current_version: text(row["current_version"]),
+    key_type: text(row["key_type"]),
+    size: text(row["size"]),
+    can_refresh: row["can_refresh"] === true || row["can_refresh"] === "t",
+  };
+}
+
+/** Double-quotes an identifier, escaping embedded quotes. */
+function quoteIdent(value: string): string {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+
+/** Quotes a value as an escape-string literal, so it parses the same under any `standard_conforming_strings`. */
+function quoteLiteral(value: string): string {
+  return `E'${value.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+}
+
+function amcheckStatements(rows: ReadonlyArray<DriftRow>): string[] {
+  return rows.map(
+    (r) =>
+      `SELECT bt_index_check(${quoteLiteral(r.name)}::regclass, heapallindexed => true);` +
+      (r.key_type === "" ? "" : `  -- ${r.key_type.toLowerCase()}`),
+  );
+}
+
+function reindexStatements(rows: ReadonlyArray<DriftRow>): string[] {
+  return rows.map((r) =>
+    r.key_type === "EXCLUSION"
+      ? `REINDEX INDEX ${r.name};  -- exclusion constraint: CONCURRENTLY is unsupported, blocks writes while it runs`
+      : `REINDEX INDEX CONCURRENTLY ${r.name};`,
+  );
+}
+
+function refreshStatements(rows: ReadonlyArray<DriftRow>): string[] {
+  const out: string[] = [];
+  if (rows.some((r) => r.collation === "default" && r.can_refresh)) {
+    const database = rows[0]?.database ?? "postgres";
+    out.push(`ALTER DATABASE ${quoteIdent(database)} REFRESH COLLATION VERSION;`);
+  }
+  // Already quoted by the SQL's FORMAT('%I.%I', ...).
+  const seen = new Set<string>();
+  for (const r of rows) {
+    if (r.collation === "default" || !r.can_refresh || seen.has(r.collation)) continue;
+    seen.add(r.collation);
+    out.push(`ALTER COLLATION ${r.collation} REFRESH VERSION;`);
+  }
+  return out;
+}
+
+export function buildCollationDriftReport(
+  rawRows: ReadonlyArray<Record<string, unknown>>,
+  serverVersionNum: number,
+): Report {
+  const defaultScope =
+    serverVersionNum >= 150000
+      ? ""
+      : " The database default collation is not checked before PostgreSQL 15; only named collations were.";
+  if (rawRows.length === 0) {
+    return {
+      command: "collation-drift",
+      severity: "ok",
+      blocks: [
+        {
+          kind: "callout",
+          severity: "ok",
+          text: `No recorded collation version mismatch on btree index key columns. This compares version labels and does not verify index ordering or expression indexes.${defaultScope} Re-run this check after a PostgreSQL upgrade or instance migration.`,
+        },
+      ],
+    };
+  }
+
+  const rows = rawRows.map(toDriftRow);
+  // An index with key columns on several drifted collations has one row per collation.
+  const indexes = [...new Map(rows.map((r) => [r.name, r])).values()];
+  const keyRows = indexes.filter((r) => r.key_type !== "");
+  const severity: ReportSeverity = keyRows.length > 0 ? "critical" : "warn";
+
+  const defaultDrift = rows.find((r) => r.collation === "default");
+  const ownerOnly = [...new Set(rows.filter((r) => !r.can_refresh).map((r) => r.collation))];
+  const namedCollations = [...new Set(rows.map((r) => r.collation))].filter((c) => c !== "default");
+
+  const environment: Array<{ key: string; value: string }> = [
+    { key: "Database", value: rows[0]?.database ?? "" },
+    { key: "Affected indexes", value: String(indexes.length) },
+  ];
+  if (keyRows.length > 0) {
+    environment.push({
+      key: "Keys / unique",
+      value: `${keyRows.length} (a wrong sort order here can admit duplicate rows)`,
+    });
+  }
+  if (defaultDrift !== undefined) {
+    environment.push({
+      key: "Default collation",
+      value: `${defaultDrift.stored_version} (recorded)  →  ${defaultDrift.current_version} (current)`,
+    });
+  }
+  if (serverVersionNum < 150000) {
+    environment.push({ key: "Default collation", value: "not checked before PostgreSQL 15" });
+  }
+  if (namedCollations.length > 0) {
+    environment.push({ key: "Drifted collations", value: namedCollations.join(", ") });
+  }
+
+  return {
+    command: "collation-drift",
+    severity,
+    blocks: [
+      { kind: "keyValue", entries: environment },
+      {
+        kind: "callout",
+        severity,
+        text: "These indexes were built under different sorting rules than the system now provides. Postgres reports no error for this: queries may quietly return missing rows, sort incorrectly, or let duplicates past a unique constraint. amcheck can detect some ordering problems, but every listed index must still be rebuilt.",
+      },
+      {
+        kind: "table",
+        columns: [
+          { title: "Name" },
+          { title: "Table" },
+          { title: "Columns" },
+          { title: "Collation" },
+          { title: "Stored version" },
+          { title: "Current version" },
+          { title: "Key" },
+          { title: "Size" },
+        ],
+        rows: rows.map((r) => ({
+          cells: [
+            r.name,
+            r.table,
+            r.columns,
+            r.collation,
+            r.stored_version,
+            r.current_version,
+            r.key_type,
+            r.size,
+          ],
+          severity: r.key_type === "" ? ("warn" as const) : ("critical" as const),
+        })),
+      },
+      {
+        kind: "steps",
+        steps: [
+          {
+            title: "Diagnose the listed indexes (optional)",
+            body: "amcheck raises an error when it finds a mis-ordered index. A clean result does not prove the index is safe, so it does not replace step 2.",
+            sql: ["CREATE EXTENSION IF NOT EXISTS amcheck;", ...amcheckStatements(indexes)],
+          },
+          {
+            title: "Rebuild every listed index",
+            body: "Run each statement on its own, outside a transaction block. CONCURRENTLY keeps the application online during the rebuild; exclusion-constraint indexes cannot use it and block writes while they rebuild.",
+            sql: reindexStatements(indexes),
+          },
+          {
+            title: "Record the new collation version — only after every rebuild has finished",
+            body:
+              "Refreshing first hides the problem without fixing it: it updates a label and silences the warning while leaving the indexes mis-ordered. The list above covers btree key columns only; also rebuild expression indexes and any other index or constraint that uses these collations before refreshing." +
+              (ownerOnly.length > 0
+                ? ` The current role does not own ${ownerOnly.join(", ")}; after the rebuilds, ask its owner (on hosted projects, Supabase support) to refresh the version.`
+                : ""),
+            sql: refreshStatements(rows),
+          },
+        ],
+      },
+    ],
+  };
+}
+
+/**
+ * `inspect db collation-drift` — btree indexes on text columns whose collation
+ * version no longer matches the version the operating system provides, with
+ * the verify → rebuild → refresh workflow rendered as part of the output.
+ *
+ * Includes `auth`, `storage` and other Supabase schemas, which the table commands filter,
+ * because their indexes protect user data too.
+ */
+export const collationDriftSpec: InspectReportSpec = {
+  name: "collation-drift",
+  sql: collationDriftSql,
+  report: buildCollationDriftReport,
+};
diff --git a/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.query.unit.test.ts b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.query.unit.test.ts
new file mode 100644
index 0000000000..4b4fc99b84
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/collation-drift/collation-drift.query.unit.test.ts
@@ -0,0 +1,146 @@
+import { describe, expect, it } from "vitest";
+
+import { buildCollationDriftReport } from "./collation-drift.query.ts";
+import type { ReportStepsBlock, ReportTableBlock } from "../../../../output/report.types.ts";
+
+const PG17 = 170000;
+
+const libcRow = {
+  database: "postgres",
+  name: "public.t_key",
+  table: "public.events",
+  columns: "title",
+  collation: "default",
+  stored_version: "2.39",
+  current_version: "2.40",
+  key_type: "UNIQUE",
+  size: "148 MB",
+  can_refresh: true,
+};
+
+const icuRow = {
+  database: "postgres",
+  name: "public.demo_title_idx",
+  table: "public.collation_drift_demo",
+  columns: "title",
+  collation: "public.test_stale_icu",
+  stored_version: "153.14",
+  current_version: "153.121",
+  key_type: "",
+  size: "8192 bytes",
+  can_refresh: true,
+};
+
+function stepsBlock(report: ReturnType<typeof buildCollationDriftReport>): ReportStepsBlock {
+  const block = report.blocks.find((b) => b.kind === "steps");
+  if (block === undefined || block.kind !== "steps") throw new Error("no steps block");
+  return block;
+}
+
+describe("buildCollationDriftReport", () => {
+  it("renders the healthy state as an ok callout with no remediation", () => {
+    const report = buildCollationDriftReport([], PG17);
+
+    expect(report.severity).toBe("ok");
+    expect(report.blocks).toHaveLength(1);
+    expect(report.blocks[0]).toMatchObject({
+      kind: "callout",
+      severity: "ok",
+    });
+  });
+
+  it("is critical when a key or unique index is affected, warn otherwise", () => {
+    expect(buildCollationDriftReport([libcRow], PG17).severity).toBe("critical");
+    expect(buildCollationDriftReport([icuRow], PG17).severity).toBe("warn");
+  });
+
+  it("includes environment, callout, table, and steps blocks when drift exists", () => {
+    const kinds = buildCollationDriftReport([libcRow, icuRow], PG17).blocks.map((b) => b.kind);
+    expect(kinds).toEqual(["keyValue", "callout", "table", "steps"]);
+  });
+
+  it("keeps the row order the SQL produced (keys first)", () => {
+    const report = buildCollationDriftReport([libcRow, icuRow], PG17);
+    const table = report.blocks.find((b) => b.kind === "table") as ReportTableBlock;
+    expect(table.rows[0]?.cells[0]).toBe("public.t_key");
+    expect(table.rows[0]?.severity).toBe("critical");
+    expect(table.rows[1]?.severity).toBe("warn");
+  });
+
+  it("orders the workflow verify → rebuild → refresh", () => {
+    const steps = stepsBlock(buildCollationDriftReport([libcRow], PG17)).steps;
+    expect(steps.map((s) => s.title)).toEqual([
+      "Diagnose the listed indexes (optional)",
+      "Rebuild every listed index",
+      "Record the new collation version — only after every rebuild has finished",
+    ]);
+  });
+
+  it("routes the refresh of a collation the role does not own to its owner", () => {
+    const foreign = { ...icuRow, collation: 'pg_catalog."und-x-icu"', can_refresh: false };
+    const refresh = stepsBlock(buildCollationDriftReport([libcRow, foreign], PG17)).steps[2];
+
+    expect(refresh?.sql).toEqual(['ALTER DATABASE "postgres" REFRESH COLLATION VERSION;']);
+    expect(refresh?.body).toContain('does not own pg_catalog."und-x-icu"');
+  });
+
+  it("lists an index once in the workflow when several of its collations drifted", () => {
+    const multi = [
+      { ...libcRow, name: "public.m_ab", key_type: "", columns: "a" },
+      { ...icuRow, name: "public.m_ab", columns: "b" },
+    ];
+    const report = buildCollationDriftReport(multi, PG17);
+    const [, rebuild, refresh] = stepsBlock(report).steps;
+
+    expect(report.blocks[0]).toMatchObject({
+      kind: "keyValue",
+      entries: expect.arrayContaining([{ key: "Affected indexes", value: "1" }]),
+    });
+    expect(rebuild?.sql).toEqual(["REINDEX INDEX CONCURRENTLY public.m_ab;"]);
+    expect(refresh?.sql).toEqual([
+      'ALTER DATABASE "postgres" REFRESH COLLATION VERSION;',
+      "ALTER COLLATION public.test_stale_icu REFRESH VERSION;",
+    ]);
+  });
+
+  it("degrades null cells instead of throwing", () => {
+    const report = buildCollationDriftReport([{ ...libcRow, current_version: null }], PG17);
+    const table = report.blocks.find((b) => b.kind === "table") as ReportTableBlock;
+    expect(table.rows[0]?.cells[5]).toBe("");
+  });
+});
+
+function stepSql(rows: ReadonlyArray<Record<string, unknown>>, step: number) {
+  return stepsBlock(buildCollationDriftReport(rows, PG17)).steps[step]?.sql ?? [];
+}
+
+describe("generated statements", () => {
+  it("escapes quotes and backslashes in the amcheck literal", () => {
+    const crafted = { ...icuRow, name: `public."x\\'::text::regclass) WHERE false;SELECT 1;--"` };
+    expect(stepSql([crafted], 0)[1]).toBe(
+      `SELECT bt_index_check(E'public."x\\\\\\'::text::regclass) WHERE false;SELECT 1;--"'::regclass, heapallindexed => true);`,
+    );
+  });
+
+  it("marks key-backing indexes in the amcheck list", () => {
+    const [, keyed, plain] = stepSql([libcRow, icuRow], 0);
+    expect(keyed).toContain("-- unique");
+    expect(plain).not.toContain("--");
+  });
+
+  it("rebuilds concurrently, except exclusion-constraint indexes", () => {
+    const exclusion = { ...icuRow, name: "public.demo_excl", key_type: "EXCLUSION" };
+    expect(stepSql([icuRow, exclusion], 1)).toEqual([
+      "REINDEX INDEX CONCURRENTLY public.demo_title_idx;",
+      "REINDEX INDEX public.demo_excl;  -- exclusion constraint: CONCURRENTLY is unsupported, blocks writes while it runs",
+    ]);
+  });
+
+  it("refreshes the database only for default-collation drift, and each collation once", () => {
+    const second = { ...icuRow, name: "public.demo_title_uniq" };
+    expect(stepSql([icuRow, second], 2)).toEqual([
+      "ALTER COLLATION public.test_stale_icu REFRESH VERSION;",
+    ]);
+    expect(stepSql([libcRow], 2)).toEqual(['ALTER DATABASE "postgres" REFRESH COLLATION VERSION;']);
+  });
+});
diff --git a/apps/cli/src/commands/inspect/db/db.command.ts b/apps/cli/src/commands/inspect/db/db.command.ts
index 396e32f831..43e0171558 100644
--- a/apps/cli/src/commands/inspect/db/db.command.ts
+++ b/apps/cli/src/commands/inspect/db/db.command.ts
@@ -1,8 +1,9 @@
 import { Command } from "effect/cli";
 import { inspectDbBloatCommand } from "./bloat/bloat.command.ts";
 import { inspectDbBlockingCommand } from "./blocking/blocking.command.ts";
-import { inspectDbCallsCommand } from "./calls/calls.command.ts";
 import { inspectDbCacheHitCommand } from "./cache-hit/cache-hit.command.ts";
+import { inspectDbCallsCommand } from "./calls/calls.command.ts";
+import { inspectDbCollationDriftCommand } from "./collation-drift/collation-drift.command.ts";
 import { inspectDbDbStatsCommand } from "./db-stats/db-stats.command.ts";
 import { inspectDbIndexSizesCommand } from "./index-sizes/index-sizes.command.ts";
 import { inspectDbIndexStatsCommand } from "./index-stats/index-stats.command.ts";
@@ -19,11 +20,13 @@ import { inspectDbTableIndexSizesCommand } from "./table-index-sizes/table-index
 import { inspectDbTableRecordCountsCommand } from "./table-record-counts/table-record-counts.command.ts";
 import { inspectDbTableSizesCommand } from "./table-sizes/table-sizes.command.ts";
 import { inspectDbTableStatsCommand } from "./table-stats/table-stats.command.ts";
+import { inspectDbToastSizesCommand } from "./toast-sizes/toast-sizes.command.ts";
 import { inspectDbTotalIndexSizeCommand } from "./total-index-size/total-index-size.command.ts";
 import { inspectDbTotalTableSizesCommand } from "./total-table-sizes/total-table-sizes.command.ts";
 import { inspectDbTrafficProfileCommand } from "./traffic-profile/traffic-profile.command.ts";
 import { inspectDbUnusedIndexesCommand } from "./unused-indexes/unused-indexes.command.ts";
 import { inspectDbVacuumStatsCommand } from "./vacuum-stats/vacuum-stats.command.ts";
+import { inspectDbXidAgeCommand } from "./xid-age/xid-age.command.ts";
 
 export const inspectDbCommand = Command.make("db").pipe(
   Command.withDescription(
@@ -38,12 +41,15 @@ export const inspectDbCommand = Command.make("db").pipe(
     inspectDbOutliersCommand,
     inspectDbCallsCommand,
     inspectDbIndexStatsCommand,
+    inspectDbCollationDriftCommand,
     inspectDbLongRunningQueriesCommand,
     inspectDbBloatCommand,
     inspectDbRoleStatsCommand,
     inspectDbVacuumStatsCommand,
     inspectDbTableStatsCommand,
     inspectDbTrafficProfileCommand,
+    inspectDbToastSizesCommand,
+    inspectDbXidAgeCommand,
     inspectDbCacheHitCommand,
     inspectDbIndexUsageCommand,
     inspectDbTotalIndexSizeCommand.pipe(Command.unlisted),
diff --git a/apps/cli/src/commands/inspect/db/db.layers.ts b/apps/cli/src/commands/inspect/db/db.layers.ts
index 16b1f5f760..a5eba5fc8e 100644
--- a/apps/cli/src/commands/inspect/db/db.layers.ts
+++ b/apps/cli/src/commands/inspect/db/db.layers.ts
@@ -5,7 +5,7 @@ import { inspectBaseLayer } from "../inspect.layers.ts";
 
 /**
  * The command-runtime path for a single `inspect db <leaf>` subcommand, appended to
- * `["inspect", "db"]` so each of the 25 leaves — and each deprecated alias — records its own
+ * `["inspect", "db"]` so each of the 26 leaves — and each deprecated alias — records its own
  * name in `cli_command_executed`, not a shared "inspect db" event.
  */
 export const inspectDbCommandPath = (leaf: string): ReadonlyArray<string> => [
diff --git a/apps/cli/src/commands/inspect/db/inspect-query.integration.test.ts b/apps/cli/src/commands/inspect/db/inspect-query.integration.test.ts
index 2585980738..f8a4f5dcc8 100644
--- a/apps/cli/src/commands/inspect/db/inspect-query.integration.test.ts
+++ b/apps/cli/src/commands/inspect/db/inspect-query.integration.test.ts
@@ -544,7 +544,7 @@ describe("inspect db through the real database-config resolver", () => {
         expect(asLines(requests)).toEqual([poolerRequest, loginRoleRequest]);
         expect(connection.connectCalls[0]?.cfg.host).toBe("aws-0-us-east-1.pooler.supabase.com");
         expect(out.stdoutText).toContain("8192 kB");
-        expect(INSPECT_DB_LEAVES).toHaveLength(25);
+        expect(INSPECT_DB_LEAVES).toHaveLength(28);
         expect(INSPECT_DB_LEAVES).toEqual(expect.arrayContaining(REMOVED_INSPECT_DB_LEAVES));
         for (const command of RUNNER_INSPECT_DB_LEAVES) {
           assertPermissionDrift({
diff --git a/apps/cli/src/commands/inspect/db/inspect-query.ts b/apps/cli/src/commands/inspect/db/inspect-query.ts
index 8020243eb0..7954cdbd22 100644
--- a/apps/cli/src/commands/inspect/db/inspect-query.ts
+++ b/apps/cli/src/commands/inspect/db/inspect-query.ts
@@ -44,8 +44,8 @@ export function inspectText(value: unknown): string {
 
 /**
  * The unwrapped text cell (no backtick code span): an empty/null value renders as the empty
- * string. Only the `vacuum_stats` timestamp columns are written bare; every other string
- * column is wrapped (use `inspectText`).
+ * string. Use it for timestamp columns (`vacuum_stats`, `toast_sizes`); wrap other string
+ * columns with `inspectText`.
  */
 export function inspectPlainText(value: unknown): string {
   if (value === null || value === undefined) return "";
@@ -104,6 +104,21 @@ export function inspectBacktickStmt(value: unknown): string {
   return stmt === "" ? "``" : stmt;
 }
 
+/** Resolves the target and connection every `inspect db` subcommand queries. */
+export const resolveInspectConnection = Effect.fnUntraced(function* (
+  flags: InspectConnectionFlags,
+  dnsResolver: "native" | "https",
+) {
+  const resolver = yield* DbConfigResolver;
+  const target = yield* resolveTarget(flags);
+  return yield* resolver.resolveConnection({
+    target,
+    dnsResolver,
+    password: Option.none(),
+    networkBanRemoval: yield* hostedMutationPreapproval,
+  });
+});
+
 /**
  * Runs an `inspect db` subcommand's query and renders the result: resolve the target and its
  * connection, run the query, then render the table — or, in `json`/`stream-json` mode, emit the
@@ -115,16 +130,8 @@ export const runInspectQuery = Effect.fn("Inspect.runQuery")(function* (
   dnsResolver: "native" | "https",
 ) {
   const output = yield* Output;
-  const resolver = yield* DbConfigResolver;
   const dbConn = yield* DbConnection;
-
-  const target = yield* resolveTarget(flags);
-  const cfg = yield* resolver.resolveConnection({
-    target,
-    dnsResolver,
-    password: Option.none(),
-    networkBanRemoval: yield* hostedMutationPreapproval,
-  });
+  const cfg = yield* resolveInspectConnection(flags, dnsResolver);
 
   const rows = yield* Effect.scoped(
     Effect.gen(function* () {
diff --git a/apps/cli/src/commands/inspect/db/inspect-report.errors.ts b/apps/cli/src/commands/inspect/db/inspect-report.errors.ts
new file mode 100644
index 0000000000..1d2cbb0057
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/inspect-report.errors.ts
@@ -0,0 +1,15 @@
+import { Data } from "effect";
+import {
+  actionability,
+  type CliErrorActionabilityDeclaration,
+  ErrorActionabilityId,
+} from "../../../shared/telemetry/error-actionability.ts";
+
+/** The `-o/--output` flag was passed; report commands only support `--output-format`. */
+export class InspectReportOutputFlagUnsupportedError extends Data.TaggedError(
+  "InspectReportOutputFlagUnsupportedError",
+)<{ readonly message: string }> {
+  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
+    return actionability.invalidInput;
+  }
+}
diff --git a/apps/cli/src/commands/inspect/db/inspect-report.ts b/apps/cli/src/commands/inspect/db/inspect-report.ts
new file mode 100644
index 0000000000..7f15624e9d
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/inspect-report.ts
@@ -0,0 +1,71 @@
+import { Effect, Option } from "effect";
+
+import { DnsResolverFlag, OutputFlag } from "../../../command-internal/global-flags.ts";
+import { unsupportedOutputFlagMessage } from "../../../command-internal/output-formats.ts";
+import { Output } from "../../../shared/output/output.service.ts";
+import { renderReportText } from "../../../output/report-render-text.ts";
+import type { Report } from "../../../output/report.types.ts";
+import { DbConnection } from "../../../command-internal/db-connection.service.ts";
+import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
+import { InspectReportOutputFlagUnsupportedError } from "./inspect-report.errors.ts";
+import { resolveInspectConnection, type InspectConnectionFlags } from "./inspect-query.ts";
+
+/** A report-producing `inspect db` subcommand: its version-specific SQL and a pure rows-to-`Report` mapping. */
+export interface InspectReportSpec {
+  readonly name: string;
+  readonly sql: (serverVersionNum: number) => string;
+  readonly report: (
+    rows: ReadonlyArray<Record<string, unknown>>,
+    serverVersionNum: number,
+  ) => Report;
+}
+
+const runInspectReport = Effect.fn("Inspect.runReport")(function* (
+  spec: InspectReportSpec,
+  flags: InspectConnectionFlags,
+  dnsResolver: "native" | "https",
+) {
+  if (Option.isSome(yield* OutputFlag)) {
+    return yield* new InspectReportOutputFlagUnsupportedError({
+      message: unsupportedOutputFlagMessage(`inspect db ${spec.name}`),
+    });
+  }
+  const output = yield* Output;
+  const dbConn = yield* DbConnection;
+  const cfg = yield* resolveInspectConnection(flags, dnsResolver);
+
+  const { serverVersionNum, rows } = yield* Effect.scoped(
+    Effect.gen(function* () {
+      const session = yield* dbConn.connect(cfg.conn, { isLocal: cfg.isLocal, dnsResolver });
+      const [version] = yield* session.query(
+        "SELECT current_setting('server_version_num')::int AS server_version_num",
+        [],
+      );
+      const serverVersionNum = Number(version?.["server_version_num"]);
+      return { serverVersionNum, rows: yield* session.query(spec.sql(serverVersionNum), []) };
+    }),
+  );
+  yield* Effect.annotateCurrentSpan({ "query.row_count": rows.length });
+
+  const report = spec.report(rows, serverVersionNum);
+
+  if (output.format === "text") {
+    yield* output.raw(renderReportText(report));
+    return;
+  }
+
+  // `rows` keeps the payload shape of the table-based inspect commands.
+  yield* output.success(`inspect db ${spec.name}`, { rows, report });
+});
+
+/**
+ * Builds an `inspect db <name>` handler from a report spec. It flushes
+ * telemetry itself, like `makeInspectDbHandler`.
+ */
+export function makeInspectDbReportHandler(spec: InspectReportSpec, traceName: string) {
+  return Effect.fn(traceName)(function* (flags: InspectConnectionFlags) {
+    const dnsResolver = yield* DnsResolverFlag;
+    const telemetryState = yield* TelemetryState;
+    yield* runInspectReport(spec, flags, dnsResolver).pipe(Effect.ensuring(telemetryState.flush));
+  });
+}
diff --git a/apps/cli/src/commands/inspect/db/inspect-specs.integration.test.ts b/apps/cli/src/commands/inspect/db/inspect-specs.integration.test.ts
index e1e7f1d0d1..d53ecb2f22 100644
--- a/apps/cli/src/commands/inspect/db/inspect-specs.integration.test.ts
+++ b/apps/cli/src/commands/inspect/db/inspect-specs.integration.test.ts
@@ -30,8 +30,10 @@ import { outliersSpec } from "./outliers/outliers.query.ts";
 import { replicationSlotsSpec } from "./replication-slots/replication-slots.query.ts";
 import { roleStatsSpec } from "./role-stats/role-stats.query.ts";
 import { tableStatsSpec } from "./table-stats/table-stats.query.ts";
+import { toastSizesSpec } from "./toast-sizes/toast-sizes.query.ts";
 import { trafficProfileSpec } from "./traffic-profile/traffic-profile.query.ts";
 import { vacuumStatsSpec } from "./vacuum-stats/vacuum-stats.query.ts";
+import { xidAgeSpec } from "./xid-age/xid-age.query.ts";
 
 const LOCAL_CONN: PgConnInput = {
   host: "127.0.0.1",
@@ -245,6 +247,16 @@ const cases: ReadonlyArray<Case> = [
     },
     expect: ["public.t", "8 kB", "10 kB", "1000"],
   },
+  {
+    spec: xidAgeSpec,
+    params: "schemas1",
+    row: {
+      name: "public.users",
+      xid_age: 500000000,
+      transactions_remaining: 1500000000,
+    },
+    expect: ["public.users", "500000000", "1500000000"],
+  },
   {
     spec: trafficProfileSpec,
     params: "none",
@@ -258,11 +270,27 @@ const cases: ReadonlyArray<Case> = [
     },
     expect: ["public", "100", "50", "12.0", "1:1 (Balanced)"],
   },
+  {
+    spec: toastSizesSpec,
+    params: "schemas1",
+    row: {
+      name: "public.events",
+      total_size: "120 kB",
+      heap_size: "80 kB",
+      toast_size: "40 kB",
+      toast_live_chunks: 1200,
+      toast_dead_chunks: 80,
+      toast_dead_pct: "6.3",
+      last_autovacuum: "2025-01-15 03:00",
+      last_vacuum: "",
+    },
+    expect: ["public.events", "120 kB", "40 kB", "1200", "80", "6.3", "2025-01-15 03:00"],
+  },
 ];
 
 describe("inspect db specs (per-subcommand correctness)", () => {
-  it("covers all 13 active subcommands", () => {
-    expect(cases).toHaveLength(13);
+  it("covers all 15 active subcommands", () => {
+    expect(cases).toHaveLength(15);
   });
 
   for (const testCase of cases) {
@@ -315,4 +343,33 @@ describe("inspect db specs (per-subcommand correctness)", () => {
     expect(cells[1]).toBe("``");
     expect(cells[4]).toBe("");
   });
+
+  it("projects toast-sizes columns in header order, leaving a never-vacuumed cell empty", () => {
+    const row: Record<string, unknown> = {
+      name: "public.events",
+      total_size: "120 kB",
+      heap_size: "80 kB",
+      toast_size: "40 kB",
+      toast_live_chunks: 1200,
+      toast_dead_chunks: 80,
+      toast_dead_pct: "6.3",
+      last_autovacuum: "2025-01-15 03:00",
+      last_vacuum: null,
+    };
+    const cells = toastSizesSpec.project(row, {
+      conn: LOCAL_CONN,
+      isLocal: true,
+    } satisfies ResolvedDbConfig);
+    expect(cells).toEqual([
+      "public.events",
+      "120 kB",
+      "80 kB",
+      "40 kB",
+      "1200",
+      "80",
+      "6.3",
+      "2025-01-15 03:00",
+      "",
+    ]);
+  });
 });
diff --git a/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.command.ts b/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.command.ts
new file mode 100644
index 0000000000..937ec804a4
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.command.ts
@@ -0,0 +1,23 @@
+import { Command } from "effect/cli";
+import { withPermissions } from "../../../../command-internal/command-permissions/command-permissions.annotation.ts";
+import { inspectDbToastSizes } from "./toast-sizes.handler.ts";
+import {
+  INSPECT_DB_FLAGS,
+  INSPECT_DB_PERMISSIONS,
+  inspectDbCommandHandler,
+  withInspectDbTargetPolicy,
+} from "../inspect-db-command.ts";
+import { inspectDbRuntimeLayer } from "../db.layers.ts";
+import { cliConfigValuesLayer } from "../../../../config/cli-config-values.layer.ts";
+import { withCliConfigFlags } from "../../../../config/cli-config-flags.ts";
+
+export const inspectDbToastSizesCommand = Command.make("toast-sizes", INSPECT_DB_FLAGS).pipe(
+  Command.withDescription("Show TOAST table sizes and dead chunk counts for user tables."),
+  Command.withShortDescription("Show TOAST table sizes and dead chunk counts"),
+  withPermissions(INSPECT_DB_PERMISSIONS),
+  Command.withHandler(inspectDbCommandHandler(inspectDbToastSizes)),
+  Command.provide(inspectDbRuntimeLayer("toast-sizes")),
+  Command.provide(cliConfigValuesLayer),
+  withCliConfigFlags(INSPECT_DB_FLAGS),
+  withInspectDbTargetPolicy,
+);
diff --git a/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.handler.ts b/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.handler.ts
new file mode 100644
index 0000000000..68f14bfa2b
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.handler.ts
@@ -0,0 +1,4 @@
+import { makeInspectDbHandler } from "../inspect-query.ts";
+import { toastSizesSpec } from "./toast-sizes.query.ts";
+
+export const inspectDbToastSizes = makeInspectDbHandler(toastSizesSpec, "inspect.db.toast-sizes");
diff --git a/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.query.ts b/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.query.ts
new file mode 100644
index 0000000000..a4f0bd669e
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/toast-sizes/toast-sizes.query.ts
@@ -0,0 +1,64 @@
+import {
+  inspectFloat1,
+  inspectInt,
+  inspectPlainText,
+  inspectText,
+  type InspectQuerySpec,
+} from "../inspect-query.ts";
+import { INTERNAL_SCHEMAS, likeEscapeSchema } from "../inspect-schemas.ts";
+
+// Ordinary tables only; materialized views and partitioned parents are out of scope.
+const SQL = `
+SELECT
+  FORMAT('%I.%I', n.nspname, main.relname)                            AS name,
+  pg_size_pretty(pg_total_relation_size(main.oid))                    AS total_size,
+  pg_size_pretty(pg_relation_size(main.oid))                          AS heap_size,
+  pg_size_pretty(pg_total_relation_size(main.reltoastrelid))          AS toast_size,
+  COALESCE(ts.n_live_tup, 0)                                          AS toast_live_chunks,
+  COALESCE(ts.n_dead_tup, 0)                                          AS toast_dead_chunks,
+  COALESCE(
+    round(100.0 * ts.n_dead_tup / nullif(ts.n_live_tup + ts.n_dead_tup, 0), 1),
+    0.0
+  )                                                                    AS toast_dead_pct,
+  COALESCE(to_char(ts.last_autovacuum, 'YYYY-MM-DD HH24:MI'), '')     AS last_autovacuum,
+  COALESCE(to_char(ts.last_vacuum, 'YYYY-MM-DD HH24:MI'), '')         AS last_vacuum
+FROM pg_class main
+JOIN pg_namespace n ON n.oid = main.relnamespace
+LEFT JOIN pg_stat_all_tables ts ON ts.relid = main.reltoastrelid
+WHERE main.relkind = 'r'
+  AND main.reltoastrelid <> 0
+  AND pg_total_relation_size(main.reltoastrelid) > 0
+  AND NOT n.nspname LIKE ANY($1)
+ORDER BY pg_total_relation_size(main.reltoastrelid) DESC, name`;
+
+/**
+ * `inspect db toast-sizes` — per-table TOAST footprint (including its index) and TOAST dead-chunk
+ * stats; Total Size also counts the parent's indexes, so it exceeds Heap + TOAST.
+ */
+export const toastSizesSpec: InspectQuerySpec = {
+  name: "toast-sizes",
+  sql: SQL,
+  params: () => [likeEscapeSchema(INTERNAL_SCHEMAS)],
+  headers: [
+    "Table",
+    "Total Size",
+    "Heap Size",
+    "TOAST Size",
+    "TOAST Live Chunks",
+    "TOAST Dead Chunks",
+    "TOAST Dead %",
+    "Last Autovacuum",
+    "Last Vacuum",
+  ],
+  project: (row) => [
+    inspectText(row["name"]),
+    inspectText(row["total_size"]),
+    inspectText(row["heap_size"]),
+    inspectText(row["toast_size"]),
+    inspectInt(row["toast_live_chunks"]),
+    inspectInt(row["toast_dead_chunks"]),
+    inspectFloat1(row["toast_dead_pct"]),
+    inspectPlainText(row["last_autovacuum"]),
+    inspectPlainText(row["last_vacuum"]),
+  ],
+};
diff --git a/apps/cli/src/commands/inspect/db/xid-age/xid-age.command.ts b/apps/cli/src/commands/inspect/db/xid-age/xid-age.command.ts
new file mode 100644
index 0000000000..237d33f611
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/xid-age/xid-age.command.ts
@@ -0,0 +1,28 @@
+import { Command } from "effect/cli";
+import { withPermissions } from "../../../../command-internal/command-permissions/command-permissions.annotation.ts";
+import { inspectDbXidAge } from "./xid-age.handler.ts";
+import {
+  INSPECT_DB_FLAGS,
+  INSPECT_DB_PERMISSIONS,
+  inspectDbCommandHandler,
+  withInspectDbTargetPolicy,
+} from "../inspect-db-command.ts";
+import { inspectDbRuntimeLayer } from "../db.layers.ts";
+import { cliConfigValuesLayer } from "../../../../config/cli-config-values.layer.ts";
+import { withCliConfigFlags } from "../../../../config/cli-config-flags.ts";
+
+export const inspectDbXidAgeCommand = Command.make("xid-age", INSPECT_DB_FLAGS).pipe(
+  Command.withDescription(
+    "Lists user tables with their transaction ID (XID) age, oldest first. " +
+      "Transactions remaining is the headroom to a 2 billion threshold, below PostgreSQL's ~2.1 billion wraparound limit. " +
+      "Autovacuum forces a freeze once a table passes autovacuum_freeze_max_age, and PostgreSQL stops assigning XIDs near the limit. " +
+      "Tables older than 1.5 billion transactions should be treated as urgent.",
+  ),
+  Command.withShortDescription("Show XID age for user tables"),
+  withPermissions(INSPECT_DB_PERMISSIONS),
+  Command.withHandler(inspectDbCommandHandler(inspectDbXidAge)),
+  Command.provide(inspectDbRuntimeLayer("xid-age")),
+  Command.provide(cliConfigValuesLayer),
+  withCliConfigFlags(INSPECT_DB_FLAGS),
+  withInspectDbTargetPolicy,
+);
diff --git a/apps/cli/src/commands/inspect/db/xid-age/xid-age.handler.ts b/apps/cli/src/commands/inspect/db/xid-age/xid-age.handler.ts
new file mode 100644
index 0000000000..9aba4aa51a
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/xid-age/xid-age.handler.ts
@@ -0,0 +1,4 @@
+import { makeInspectDbHandler } from "../inspect-query.ts";
+import { xidAgeSpec } from "./xid-age.query.ts";
+
+export const inspectDbXidAge = makeInspectDbHandler(xidAgeSpec, "inspect.db.xid-age");
diff --git a/apps/cli/src/commands/inspect/db/xid-age/xid-age.query.ts b/apps/cli/src/commands/inspect/db/xid-age/xid-age.query.ts
new file mode 100644
index 0000000000..f34599213f
--- /dev/null
+++ b/apps/cli/src/commands/inspect/db/xid-age/xid-age.query.ts
@@ -0,0 +1,25 @@
+import { inspectInt, inspectText, type InspectQuerySpec } from "../inspect-query.ts";
+import { INTERNAL_SCHEMAS, likeEscapeSchema } from "../inspect-schemas.ts";
+
+const SQL = `
+SELECT
+  FORMAT('%I.%I', n.nspname, c.relname) AS name,
+  age(c.relfrozenxid)                   AS xid_age,
+  2000000000 - age(c.relfrozenxid)      AS transactions_remaining
+FROM pg_class c
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE c.relkind = 'r'
+  AND NOT n.nspname LIKE ANY($1)
+ORDER BY age(c.relfrozenxid) DESC, name`;
+
+export const xidAgeSpec: InspectQuerySpec = {
+  name: "xid-age",
+  sql: SQL,
+  params: () => [likeEscapeSchema(INTERNAL_SCHEMAS)],
+  headers: ["Table", "XID Age", "Transactions Remaining"],
+  project: (row) => [
+    inspectText(row["name"]),
+    inspectInt(row["xid_age"]),
+    inspectInt(row["transactions_remaining"]),
+  ],
+};
diff --git a/apps/cli/src/commands/inspect/inspect.layers.unit.test.ts b/apps/cli/src/commands/inspect/inspect.layers.unit.test.ts
index 2ccc447aca..06971f70da 100644
--- a/apps/cli/src/commands/inspect/inspect.layers.unit.test.ts
+++ b/apps/cli/src/commands/inspect/inspect.layers.unit.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer, Option } from "effect";
 
 import {
@@ -64,6 +64,7 @@ function ambientStubs() {
 
   return Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     // Builds the real commandSettingsLayer against the real filesystem; see isolatedHomeLayer's docs.
     isolatedHomeLayer(tempRoot.current),
     mockTty(),
diff --git a/apps/cli/src/commands/inspect/report/SIDE_EFFECTS.md b/apps/cli/src/commands/inspect/report/SIDE_EFFECTS.md
index 320db759c7..a3cd9f7676 100644
--- a/apps/cli/src/commands/inspect/report/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/inspect/report/SIDE_EFFECTS.md
@@ -16,7 +16,7 @@ validating those CSVs.
 | `<workdir>/supabase/.temp/project-ref`         | plain text | a remote project: resolves the ref (bare `--remote` with no `SUPABASE_PROJECT_ID`) and tells whether it is the linked project; with no selector, only to word the linked-checkout hint |
 | `<workdir>/supabase/.temp/linked-project.json` | JSON       | to name the project in the `Target:` banner and the linked-checkout hint, and as the parent project for `--remote=<branch>`                                                            |
 | `~/.supabase/access-token`                     | plain text | when `SUPABASE_ACCESS_TOKEN` unset and the target is a remote project (or a branch is looked up)                                                                                       |
-| `<output-dir>/<YYYY-MM-DD>/<name>.csv` ×14     | CSV        | read back in-memory for rule evaluation                                                                                                                                                |
+| `<output-dir>/<YYYY-MM-DD>/<name>.csv` ×15     | CSV        | read back in-memory for rule evaluation                                                                                                                                                |
 | `PGSSL*` PEM, `pg_service.conf`                | PEM, libpq | remote project, when set; see `db push`                                                                                                                                                |
 
 A **missing** `config.toml` is fine (defaults apply); a
@@ -30,13 +30,14 @@ or an unknown rule key aborts the command before connecting. Rules and `env(VAR)
 | Path                                       | Mode | When                                                            |
 | ------------------------------------------ | ---- | --------------------------------------------------------------- |
 | `<output-dir>/<YYYY-MM-DD>/` (directory)   | 0755 | always — created recursively                                    |
-| `<output-dir>/<YYYY-MM-DD>/<name>.csv` ×14 | 0644 | always — one CSV per inspect query (server-side `COPY ... CSV`) |
+| `<output-dir>/<YYYY-MM-DD>/<name>.csv` ×15 | 0644 | always — one CSV per inspect query (server-side `COPY ... CSV`) |
 | `~/.supabase/telemetry.json`               | —    | always (telemetry flush)                                        |
 
-The 14 CSV basenames (underscored, matching the SQL filenames — **not** the
+The 15 CSV basenames (underscored, matching the SQL filenames — **not** the
 `inspect db` command names): `bloat`, `blocking`, `calls`, `db_stats`,
 `index_stats`, `locks`, `long_running_queries`, `outliers`, `replication_slots`,
-`role_stats`, `table_stats`, `traffic_profile`, `unused_indexes`, `vacuum_stats`.
+`role_stats`, `table_stats`, `toast_sizes`, `traffic_profile`, `unused_indexes`, `vacuum_stats`,
+`xid_age`.
 
 The date folder is **local-time** `YYYY-MM-DD`. A relative `--output-dir` resolves
 against the process CWD, not `--workdir`; an absolute path is used as-is.
diff --git a/apps/cli/src/commands/inspect/report/report.integration.test.ts b/apps/cli/src/commands/inspect/report/report.integration.test.ts
index 06aaf3feba..ab81023937 100644
--- a/apps/cli/src/commands/inspect/report/report.integration.test.ts
+++ b/apps/cli/src/commands/inspect/report/report.integration.test.ts
@@ -293,11 +293,11 @@ describe("inspect report", () => {
       const base = yield* tempDir("supabase-report-out-");
       yield* inspectReport(flags({ outputDir: base }));
       const { dir, files } = yield* dateFolderContents(base);
-      expect(files.length).toBe(14);
+      expect(files.length).toBe(16);
       expect(files).toContain("db_stats.csv");
       expect(files).toContain("unused_indexes.csv");
       expect(files).not.toContain("db-stats.csv");
-      expect(connection.copiedSql.length).toBe(14);
+      expect(connection.copiedSql.length).toBe(16);
       expect(
         connection.copiedSql.every(
           (s) => s.startsWith("COPY (") && s.endsWith("TO STDOUT WITH CSV HEADER"),
@@ -534,10 +534,10 @@ describe("inspect report", () => {
         expect.objectContaining({ type: "success", message: "inspect report" }),
       );
       const data = out.messages.find((m) => m.type === "success")?.data;
-      expect(data?.files).toHaveLength(14);
+      expect(data?.files).toHaveLength(16);
       expect(typeof data?.outputDir).toBe("string");
       expect(data?.rules).toHaveLength(13);
-      expect((yield* dateFolderContents(base)).files.length).toBe(14);
+      expect((yield* dateFolderContents(base)).files.length).toBe(16);
       expect(out.stderrText).toBe("");
     }).pipe(Effect.provide(layer));
   });
@@ -639,7 +639,7 @@ describe("inspect report", () => {
       const { layer } = setupReport({ csvs: DEFAULT_RULE_CSVS, cwd });
       yield* inspectReport(flags({ outputDir: "reports" })).pipe(Effect.provide(layer));
       const { files } = yield* dateFolderContents(path.join(cwd, "reports"));
-      expect(files.length).toBe(14);
+      expect(files.length).toBe(16);
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
@@ -650,7 +650,7 @@ describe("inspect report", () => {
       const cwd = yield* tempDir("supabase-report-cwd-");
       const { layer } = setupReport({ csvs: DEFAULT_RULE_CSVS, cwd });
       yield* inspectReport(flags({ outputDir: base })).pipe(Effect.provide(layer));
-      expect((yield* dateFolderContents(base)).files.length).toBe(14);
+      expect((yield* dateFolderContents(base)).files.length).toBe(16);
       expect((yield* fs.readDirectory(cwd)).length).toBe(0);
     }).pipe(Effect.provide(BunServices.layer)),
   );
@@ -706,8 +706,8 @@ describe("inspect report through the real database-config resolver", () => {
         `POST /v1/projects/${VALID_REF}/cli/login-role`,
       ]);
       const { files } = yield* dateFolderContents(base);
-      expect(files).toHaveLength(14);
-      expect(connection.copiedSql).toHaveLength(14);
+      expect(files).toHaveLength(16);
+      expect(connection.copiedSql).toHaveLength(16);
       assertPermissionDrift({
         command: "inspect report",
         activeFlags: { remote: VALID_REF, "output-dir": true },
@@ -730,8 +730,8 @@ describe("inspect report through the real database-config resolver", () => {
       yield* stubManagementApi(requests, () => undefined);
       yield* inspectReport(flags({ outputDir: base }));
       const { files } = yield* dateFolderContents(base);
-      expect(files).toHaveLength(14);
-      expect(connection.copiedSql).toHaveLength(14);
+      expect(files).toHaveLength(16);
+      expect(connection.copiedSql).toHaveLength(16);
       expect(requests).toEqual([]);
       assertPermissionDrift({
         command: "inspect report",
diff --git a/apps/cli/src/commands/inspect/report/report.queries.ts b/apps/cli/src/commands/inspect/report/report.queries.ts
index 6e508418c0..12bad15354 100644
--- a/apps/cli/src/commands/inspect/report/report.queries.ts
+++ b/apps/cli/src/commands/inspect/report/report.queries.ts
@@ -10,8 +10,10 @@ import { outliersSpec } from "../db/outliers/outliers.query.ts";
 import { replicationSlotsSpec } from "../db/replication-slots/replication-slots.query.ts";
 import { roleStatsSpec } from "../db/role-stats/role-stats.query.ts";
 import { tableStatsSpec } from "../db/table-stats/table-stats.query.ts";
+import { toastSizesSpec } from "../db/toast-sizes/toast-sizes.query.ts";
 import { trafficProfileSpec } from "../db/traffic-profile/traffic-profile.query.ts";
 import { vacuumStatsSpec } from "../db/vacuum-stats/vacuum-stats.query.ts";
+import { xidAgeSpec } from "../db/xid-age/xid-age.query.ts";
 
 /**
  * The `unused_indexes` query. `inspect db` folds `unused-indexes` into a deprecated alias of
@@ -44,7 +46,7 @@ export interface ReportQuery {
 }
 
 /**
- * The 14 report queries. Reuses the 13 `inspect db` specs' `.sql` verbatim
+ * The 15 report queries. Reuses the 14 `inspect db` specs' `.sql` verbatim
  * (byte-identical COPY input → byte-identical CSVs) plus the standalone
  * `unused_indexes` query.
  */
@@ -60,9 +62,11 @@ export const REPORT_QUERIES: ReadonlyArray<ReportQuery> = [
   { fileName: "replication_slots", sql: replicationSlotsSpec.sql },
   { fileName: "role_stats", sql: roleStatsSpec.sql },
   { fileName: "table_stats", sql: tableStatsSpec.sql },
+  { fileName: "toast_sizes", sql: toastSizesSpec.sql },
   { fileName: "traffic_profile", sql: trafficProfileSpec.sql },
   { fileName: "unused_indexes", sql: UNUSED_INDEXES_REPORT_SQL },
   { fileName: "vacuum_stats", sql: vacuumStatsSpec.sql },
+  { fileName: "xid_age", sql: xidAgeSpec.sql },
 ];
 
 /**
diff --git a/apps/cli/src/commands/inspect/report/report.queries.unit.test.ts b/apps/cli/src/commands/inspect/report/report.queries.unit.test.ts
index d0d7fe6183..975afc2e2d 100644
--- a/apps/cli/src/commands/inspect/report/report.queries.unit.test.ts
+++ b/apps/cli/src/commands/inspect/report/report.queries.unit.test.ts
@@ -38,7 +38,7 @@ describe("reportIgnoreSchemas", () => {
 });
 
 describe("REPORT_QUERIES", () => {
-  it("has the 14 underscore CSV basenames", () => {
+  it("has the 15 underscore CSV basenames", () => {
     expect(REPORT_QUERIES.map((q) => q.fileName)).toEqual([
       "bloat",
       "blocking",
@@ -51,9 +51,11 @@ describe("REPORT_QUERIES", () => {
       "replication_slots",
       "role_stats",
       "table_stats",
+      "toast_sizes",
       "traffic_profile",
       "unused_indexes",
       "vacuum_stats",
+      "xid_age",
     ]);
   });
 
diff --git a/apps/cli/src/commands/link/SIDE_EFFECTS.md b/apps/cli/src/commands/link/SIDE_EFFECTS.md
index da02e3fe01..6090bbc638 100644
--- a/apps/cli/src/commands/link/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/link/SIDE_EFFECTS.md
@@ -16,7 +16,7 @@ currently-linked parent project. `link` takes no `--remote`: the argument is its
 | ------------------------------------ | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `supabase/config.toml`               | TOML (`project_id`) | NOT read for ref resolution itself — read by `CommandSettings` for workdir/project-id discovery generally (`--workdir` resolution, `SUPABASE_PROJECT_ID` passthrough)                                                                                        |
 | `supabase/.temp/linked-project.json` | JSON (`ref` field)  | only when the given `[ref-or-branch]`/`--project-ref` value is not ref-shaped, as the 2nd parent-project candidate for branch-name resolution (CLI-2167)                                                                                                     |
-| `supabase/.temp/project-ref`         | plain text          | only when the given `[ref-or-branch]`/`--project-ref` value is not ref-shaped, as the 3rd (last) parent-project candidate for branch-name resolution (CLI-2167)                                                                                              |
+| `supabase/.temp/project-ref`         | plain text          | outside stack mode, at services link, to tell whether it names the target; also when the given `[ref-or-branch]`/`--project-ref` value is not ref-shaped, as the 3rd (last) parent-project candidate for branch-name resolution (CLI-2167)                   |
 | `~/.supabase/access-token`           | plain text          | when `SUPABASE_ACCESS_TOKEN` is unset and the keyring is unavailable                                                                                                                                                                                         |
 | `$SUPABASE_HOME/stacks/<id>/`        | JSON                | stack mode only, when the lock is written and the lease is released: saved stack state and database data records, to warn about data a new pin would be refused by; nothing is created, locked or probed (see "Hosted versions in `supabase/supabase.lock`") |
 
@@ -47,11 +47,11 @@ All under `<workdir>/supabase/.temp/` (plain text, created with parent dirs as n
 | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `project-ref`         | always, after services link (mandatory — a write failure fails the command)                                                                                                                                                                                                                                                                                            |
 | `postgres-version`    | when the project status is 200 and `database.version` is non-empty                                                                                                                                                                                                                                                                                                     |
-| `storage-migration`   | best-effort — storage config `migrationVersion`                                                                                                                                                                                                                                                                                                                        |
+| `storage-migration`   | best-effort — storage config `migrationVersion`; **removed** first unless `project-ref` names the target                                                                                                                                                                                                                                                               |
 | `pooler-url`          | best-effort — processed PRIMARY pooler connection string; **removed** when `--skip-pooler`                                                                                                                                                                                                                                                                             |
-| `rest-version`        | best-effort — PostgREST swagger `info.version`, prefixed with `v` unless it already starts with `v`                                                                                                                                                                                                                                                                    |
-| `gotrue-version`      | best-effort — GoTrue `/auth/v1/health` version                                                                                                                                                                                                                                                                                                                         |
-| `storage-version`     | best-effort — Storage `/storage/v1/version` body, prefixed with `v` unless it already starts with `v`                                                                                                                                                                                                                                                                  |
+| `rest-version`        | best-effort — PostgREST swagger `info.version`, prefixed with `v` unless it already starts with `v`; **removed** first unless `project-ref` names the target                                                                                                                                                                                                           |
+| `gotrue-version`      | best-effort — GoTrue `/auth/v1/health` version; **removed** first unless `project-ref` names the target                                                                                                                                                                                                                                                                |
+| `storage-version`     | best-effort — Storage `/storage/v1/version` body, prefixed with `v` unless it already starts with `v`; **removed** first unless `project-ref` names the target                                                                                                                                                                                                         |
 | `linked-project.json` | best-effort — `{ref,name,organization_id,organization_slug}` for a resolvable, non-404 project; on the 404 (branch) path, best-effort WRITTEN as a ref-only `{ref}` record when a name/UUID-resolved branch's parent isn't already cached, or best-effort DELETED when a raw ref-shaped branch link's existing cache is verifiably for a different project (see below) |
 
 > **404-path cache maintenance.** Two cases, both best-effort (`Effect.ignore`/caught, never affect
@@ -244,9 +244,9 @@ stays busy fails the link with `LockResolutionError` reason `lease-busy` before
   the failure that start reports: a database build other than a new `-rN` revision of the one that
   initialized the data (on Docker and Podman, also the one an interrupted first start recorded), or a schema-owning service the stack runs against that database that is
   older than one that already migrated it. The failure names the recorded and refused versions and
-  the remedies: pinning the recorded version in `supabase/config.toml`
-  (`[local.services.<service>] version`, with `[db] major_version` set back when the database major
-  differs and any `[db] orioledb_version` removed when an OrioleDB build is requested), or
+  the remedies: pinning the recorded version in your config file
+  (`local.services.<service>.version`, with `db.major_version` set back when the database major
+  differs and any `db.orioledb_version` removed when an OrioleDB build is requested), or
   `supabase stack destroy --stack-id <id>`, which permanently deletes the stack's local database
   data (data with no recorded identity offers only the destroy). The lock stays written, the link
   never fails on this check, and saved state that cannot be read is logged at debug level and
diff --git a/apps/cli/src/commands/link/link.command.ts b/apps/cli/src/commands/link/link.command.ts
index ebee7f5ef0..72c70e6d05 100644
--- a/apps/cli/src/commands/link/link.command.ts
+++ b/apps/cli/src/commands/link/link.command.ts
@@ -96,7 +96,7 @@ export const linkCommand = Command.make("link", config).pipe(
             operationId: "v1-get-a-branch-config",
             kind: "best-effort",
             context:
-              "stack mode, supabase/config.toml exists, and the project lookup returns 404 (the ref is a branch)",
+              "stack mode, a project config file exists, and the project lookup returns 404 (the ref is a branch)",
           },
           {
             operationId: "v1-list-all-branches",
diff --git a/apps/cli/src/commands/link/link.integration.test.ts b/apps/cli/src/commands/link/link.integration.test.ts
index 551d96c872..41e1755410 100644
--- a/apps/cli/src/commands/link/link.integration.test.ts
+++ b/apps/cli/src/commands/link/link.integration.test.ts
@@ -1,6 +1,18 @@
+import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import type { V1ListAllBranchesOutput } from "@supabase/api/effect";
-import { Cause, Effect, Exit, FileSystem, Layer, Option, Path, Predicate, Schema } from "effect";
+import {
+  Cause,
+  Effect,
+  Exit,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  PlatformError,
+  Predicate,
+  Schema,
+} from "effect";
 import * as HttpClient from "effect/http/HttpClient";
 import type * as HttpClientError from "effect/http/HttpClientError";
 import * as HttpClientRequestModule from "effect/http/HttpClientRequest";
@@ -169,6 +181,7 @@ interface SetupOpts {
   storageVersion?: string;
   projectId?: Option.Option<string>;
   analytics?: ReturnType<typeof mockAnalytics>;
+  fileSystem?: Layer.Layer<FileSystem.FileSystem>;
 }
 
 const tempRoot = useTempWorkdir("supabase-link-int-");
@@ -249,6 +262,7 @@ function setup(opts: SetupOpts = {}) {
       analytics,
       telemetry: telemetry.layer,
       linkedProjectCache: linkedCache.layer,
+      fileSystem: opts.fileSystem,
     }),
     cliConfigValuesTestLayer,
   );
@@ -295,6 +309,28 @@ const writeTempContent = Effect.fnUntraced(function* (
   yield* fs.writeFileString(path.join(directory, name), content);
 });
 
+const failRemoveFsLayer = (name: string): Layer.Layer<FileSystem.FileSystem> =>
+  Layer.effect(
+    FileSystem.FileSystem,
+    Effect.map(FileSystem.FileSystem, (real) =>
+      FileSystem.FileSystem.of({
+        ...real,
+        remove: (path, options) =>
+          path.endsWith(name)
+            ? Effect.fail(
+                PlatformError.systemError({
+                  _tag: "PermissionDenied",
+                  module: "FileSystem",
+                  method: "remove",
+                  pathOrDescriptor: path,
+                  description: "simulated remove failure",
+                }),
+              )
+            : real.remove(path, options),
+      }),
+    ),
+  ).pipe(Layer.provide(BunServices.layer));
+
 // Seeds the 3rd-priority parent candidate for a branch-name lookup, and the file
 // `resolver.resolveForLink` falls back to for a plain ref link.
 const writeLinkedParentRef = (workdir: string, ref: string) =>
@@ -583,6 +619,92 @@ describe("link integration", () => {
       }).pipe(Effect.provide(layer));
     });
 
+    const TENANT_VERSION_FILES = ["rest-version", "gotrue-version", "storage-version"];
+    const VERSION_FILES = ["storage-migration", ...TENANT_VERSION_FILES];
+
+    it.effect(
+      "re-linking to another project drops the old version files when the version checks are skipped",
+      () => {
+        const { layer, workdir } = setup({ apiKeys: { fail: statusCodeFailure(403) } });
+        return Effect.gen(function* () {
+          yield* writeLinkedParentRef(workdir, FILE_ONLY_REF);
+          for (const name of VERSION_FILES) yield* writeTempContent(workdir, name, "old-project");
+          yield* link(flags());
+          expect(yield* readTemp(workdir, "storage-migration")).toBe("2026-01-01-000000");
+          for (const name of TENANT_VERSION_FILES)
+            expect(yield* existsTemp(workdir, name)).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.effect(
+      "re-linking to another project drops the old version files when the service calls fail",
+      () => {
+        const { layer, workdir } = setup({
+          storageConfig: { fail: statusCodeFailure(500) },
+          tenant: "fail",
+        });
+        return Effect.gen(function* () {
+          yield* writeLinkedParentRef(workdir, FILE_ONLY_REF);
+          for (const name of VERSION_FILES) yield* writeTempContent(workdir, name, "old-project");
+          yield* link(flags());
+          for (const name of VERSION_FILES) expect(yield* existsTemp(workdir, name)).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.effect(
+      "re-linking to another project still links when a version file cannot be removed",
+      () => {
+        const { layer, workdir } = setup({
+          storageConfig: { fail: statusCodeFailure(500) },
+          tenant: "fail",
+          fileSystem: failRemoveFsLayer("rest-version"),
+        });
+        return Effect.gen(function* () {
+          yield* writeLinkedParentRef(workdir, FILE_ONLY_REF);
+          for (const name of VERSION_FILES) yield* writeTempContent(workdir, name, "old-project");
+          yield* link(flags());
+          expect(yield* readTemp(workdir, "project-ref")).toBe(VALID_REF);
+          expect(yield* readTemp(workdir, "rest-version")).toBe("old-project");
+          for (const name of ["storage-migration", "gotrue-version", "storage-version"])
+            expect(yield* existsTemp(workdir, name)).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.effect(
+      "linking with no saved project-ref drops leftover version files when the service calls fail",
+      () => {
+        const { layer, workdir } = setup({
+          storageConfig: { fail: statusCodeFailure(500) },
+          tenant: "fail",
+        });
+        return Effect.gen(function* () {
+          for (const name of VERSION_FILES) yield* writeTempContent(workdir, name, "leftover");
+          yield* link(flags());
+          for (const name of VERSION_FILES) expect(yield* existsTemp(workdir, name)).toBe(false);
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
+    it.effect(
+      "re-linking the same project keeps its version files when the service calls fail",
+      () => {
+        const { layer, workdir } = setup({
+          storageConfig: { fail: statusCodeFailure(500) },
+          tenant: "fail",
+        });
+        return Effect.gen(function* () {
+          yield* writeLinkedParentRef(workdir, VALID_REF);
+          for (const name of VERSION_FILES) yield* writeTempContent(workdir, name, "same-project");
+          yield* link(flags());
+          for (const name of VERSION_FILES)
+            expect(yield* readTemp(workdir, name)).toBe("same-project");
+        }).pipe(Effect.provide(layer));
+      },
+    );
+
     it.effect("removes pooler-url and skips the pooler fetch when --skip-pooler is set", () => {
       const { layer, workdir, apiMock } = setup();
       return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/link/link.lock.integration.test.ts b/apps/cli/src/commands/link/link.lock.integration.test.ts
index 5e1dfab801..b3079ba06e 100644
--- a/apps/cli/src/commands/link/link.lock.integration.test.ts
+++ b/apps/cli/src/commands/link/link.lock.integration.test.ts
@@ -604,7 +604,7 @@ describe("link warns when a saved stack would refuse the versions it locks", ()
         const out = yield* runLink(world);
 
         expect(stackWarnings(out)).toEqual([
-          `stack ${stackId}: the next supabase start refuses these pins: PostgreSQL data was initialized by stock PostgreSQL build ${BUILT}, but stock PostgreSQL build ${HOSTED_DATABASE} was requested; keep this data by pinning \`[local.services.database] version = "${BUILT}"\` in supabase/config.toml, or ${destroy(stackId)}`,
+          `stack ${stackId}: the next supabase start refuses these pins: PostgreSQL data was initialized by stock PostgreSQL build ${BUILT}, but stock PostgreSQL build ${HOSTED_DATABASE} was requested; keep this data by pinning \`local.services.database.version\` to \`"${BUILT}"\` in your config file, or ${destroy(stackId)}`,
         ]);
         expect((yield* readServices(world.workdir)).database.resolved.upstreamVersion).toBe(
           HOSTED_DATABASE,
diff --git a/apps/cli/src/commands/login/SIDE_EFFECTS.md b/apps/cli/src/commands/login/SIDE_EFFECTS.md
index 4cdbd876ca..e3887419f3 100644
--- a/apps/cli/src/commands/login/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/login/SIDE_EFFECTS.md
@@ -35,6 +35,7 @@ captures `cli_login_completed`.
 | ---------------------------------------------- | ------------------------------------------------------ | --------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN`                        | non-interactive token source                           | no (falls back to `--token` → piped stdin → browser flow) |
 | `SUPABASE_NO_KEYRING`                          | disables the OS keyring, forcing the file fallback     | no                                                        |
+| `SUPABASE_API_MAX_RETRIES`                     | Management API profile lookup retries (`0` = none)     | no (falls back to 5)                                      |
 | `CLAUDECODE` / `CLAUDE_CODE`                   | enables the Claude Code plugin hint (TTY stdout only)  | no                                                        |
 | `DO_NOT_TRACK` / `SUPABASE_TELEMETRY_DISABLED` | suppress analytics delivery (state file still written) | no                                                        |
 
diff --git a/apps/cli/src/commands/logs/SIDE_EFFECTS.md b/apps/cli/src/commands/logs/SIDE_EFFECTS.md
new file mode 100644
index 0000000000..972469e9c9
--- /dev/null
+++ b/apps/cli/src/commands/logs/SIDE_EFFECTS.md
@@ -0,0 +1,75 @@
+# `supabase logs` and `supabase logs sources`
+
+Both commands default to the local stack. `--remote` selects the linked project; `--remote=<ref|branch>` selects another project or a branch. Reads are consent-exempt. SQL requires a hosted target.
+
+## Files read
+
+- Shared settings and target resolvers read the CLI profile, project config, environment files, and `supabase/.temp/project-ref` with normal CLI precedence.
+- Hosted reads resolve credentials from `SUPABASE_ACCESS_TOKEN`, the native keyring, or `<SUPABASE_HOME or ~/.supabase>/access-token`. Local reads do not resolve hosted credentials.
+- `--file <path>` reads one UTF-8 SQL file relative to the resolved workdir. `--file -` reads non-TTY stdin and rejects terminal stdin immediately. These and `--sql` are mutually exclusive SQL inputs. Known SQL/filter/target incompatibilities and hosted time ranges are validated before SQL input or hosted target resolution. Only `--file -` consumes stdin; local and filtered commands leave it untouched. `--file` has no `-f` alias. Empty SQL, missing files, and failed stdin reads produce `LogsInputError` with actionable guidance.
+- Local reads use the stack catalog and retained log files under `<SUPABASE_HOME or ~/.supabase>/stacks/`. Each load captures the selected segment generations and byte lengths before reading. Incomplete lines and later appends wait for another load. Local reads never launch, install, or mutate services.
+
+## Files written
+
+- Shared telemetry flushes `<SUPABASE_HOME or ~/.supabase>/telemetry.json` on success and failure.
+- Hosted target resolution registers linked-project cache finalization on success and failure. It may write `<workdir>/supabase/.temp/linked-project.json` under shared cache rules.
+
+## API routes
+
+| Method | Path                                          | Auth   | Request and response                                                                                                                      |
+| ------ | --------------------------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| GET    | `/v1/projects/{ref}/analytics/endpoints/logs` | Bearer | `sql`, `iso_timestamp_start`, and `iso_timestamp_end`; response `result` and `error`, both nullable. HTTP-200 query errors fail the load. |
+| GET    | `/v1/projects`                                | Bearer | Shared interactive project picker.                                                                                                        |
+| GET    | `/v1/projects/{parent}/branches`              | Bearer | Shared branch-name resolution.                                                                                                            |
+| GET    | `/v1/branches/{id}`                           | Bearer | Shared branch UUID resolution.                                                                                                            |
+| GET    | `/v1/projects/{ref}`                          | Bearer | Best-effort interactive project-name lookup (two-second timeout, no retries) and linked-project cache finalization.                       |
+
+Each hosted load sends explicit UTC bounds. Hosted ranges cannot exceed 24 hours; local ranges have no 24-hour cap. `--to` alone selects the hour ending at that timestamp. SQL uses GET without a POST fallback or local SQL engine. `sources` makes no analytics request, though target resolution may use the picker or branch routes.
+
+Filtered hosted refreshes stop after five successful pages of 1000 rows. This bounds each load against the analytics endpoint's rate limit of 10 requests per 60 seconds. A remaining page cursor, range start, and captured end persist as a pending continuation. `more pending` appears in the browser header; the next `L` continues that same range before advancing to a newer end. Each page retries HTTP 429 once after the greater of 60 seconds and `Retry-After`. Quitting cancels the wait. Exhausted failures preserve committed rows, cursor, and window.
+
+No background polling runs. Interactive `L` starts one finite load through a newly captured time. The lower bound and target remain fixed. Filtered loads append unseen newer records; SQL reruns replace the result set. Failed loads preserve the previous browser rows and window. Local cursor state commits only after a successful read and emission pass. Local records after the captured end remain in their source files. Per-instance resume positions preserve them for a later load without a future-record memory buffer.
+
+## Environment variables
+
+Shared settings use `SUPABASE_HOME`, `SUPABASE_WORKDIR`, `SUPABASE_PROJECT_ID`, `SUPABASE_PROFILE`, `SUPABASE_ACCESS_TOKEN`, and standard telemetry configuration. Capability discovery follows `SUPABASE_EXPERIMENTAL_STACK` and `SUPABASE_EXPERIMENTAL_COMPUTE` with project config fallback. `CI` and `TERM` also control browser eligibility. No new environment variable is introduced.
+
+## Exit codes
+
+| Code | Condition                                                                                                |
+| ---- | -------------------------------------------------------------------------------------------------------- |
+| 0    | Successful finite read or browser quit.                                                                  |
+| 1    | Input, feature gate, credential, transport, query, response decode, retained log, or truncation failure. |
+| 130  | Browser interrupted with Ctrl-C.                                                                         |
+
+A failed interactive load opens a wrapped, scrollable error panel. Up/down scrolls the full error, Escape restores the previous list or details, and L retries. Copy is disabled in the error panel. Failed loads preserve rows, selection, window, and pinned detail scroll.
+
+## Telemetry
+
+`cli_command_executed` uses `logs` and `logs sources`. SQL, paths, resource names, levels, and searches remain redacted. `LogsInputError` and `LogsApiError` retain declared actionability and committed error tags. HTTP errors retain their actual status. HTTP-200 query and response failures keep status 200 with distinct reasons. Transport failures retain their original HTTP client error instead of a synthetic server status.
+
+## Output
+
+`--output-format text|json|stream-json` selects native output. `-o/--output` is rejected before reads or target resolution.
+
+Interactive text requires an omitted `--output-format`, terminal stdin and stdout, and interaction allowed. Explicit `--output-format text` reads once. CI disables the browser unless `CI` is empty, `0`, or `false` (case-insensitive); `TERM=dumb` also disables it. The browser reserves four header rows for count/status, target identity, active filters, and the requested window. Hosted identity shows project name and ref when available; the ref is the fallback. Local identity shows the selected stack. It shows compact UTC timestamps, service names, and messages. Color settings apply; a selection marker remains visible without color. Up/down selects rows, Enter opens scrollable details, Escape returns, C copies, L loads more logs, and q exits. Resize preserves selection. Selection and viewport stay stable after a reload where retention permits. Open details stay pinned to their record.
+
+Filtered reads retain up to 1000 rows and approximately 8 MiB, with visible discarded-row counts. A single oversized record remains complete and is marked oversized. SQL preserves returned row order. Empty results keep the interactive browser open for another load. Raw input, resize listeners, cursor, screen, and background work are scoped to the viewer and restored on exit or failure.
+
+`Window:` shows request metadata, independently of returned timestamps. A time filter shows its frozen start and the captured end. Local `--since start` names each service's latest launch and shows the captured end. A later successful load extends the end monotonically; a pending hosted continuation keeps its captured end until drained. An explicit `--to` applies to the first load.
+
+Noninteractive reads finish after one pass. JSON returns a two-space-indented array. SQL stream JSON returns a `result` event. Filtered stream JSON emits `log-entry` and `log-marker` events with full records in `data`. Hosted records preserve IDs, source, severity, attributes, derived level, and timestamps. Their `service` is the catalog selector name; their raw table identifier remains in `source`. Local records preserve instance IDs, launch IDs, positions, and loss markers. Sources preserve their capability records in JSON output.
+
+Filtered text wraps to terminal width on a TTY. Piped filtered text does not hard-wrap and escapes embedded carriage returns and newlines, preserving one event per line. SQL uses tables or wrapped vertical records. Page loading and rate-limit wait/retry-time notices appear in the browser footer; finite reads emit diagnostics to stderr. Text strips terminal control sequences from log fields.
+
+## Clipboard
+
+Unmodified c/C copies the selected full record, including metadata and its original timestamp. Details copy their pinned record even after retention evicts it. Empty lists do not copy. Clipboard text goes through subprocess stdin and never into arguments, errors, or telemetry.
+
+macOS uses `pbcopy` with a UTF-8 locale. Windows uses a fixed UTF-8 PowerShell `Set-Clipboard` command. Linux tries `wl-copy`, `xclip -selection clipboard -in`, and `xsel --clipboard --input`. Successful background clipboard owners remain alive. Missing tools and clipboard failures show a status notice. Each copy has a three-second timeout; only one runs at once, and quitting cancels pending work. Pipes and machine output do not access the clipboard.
+
+## Feature gates and compatibility
+
+Compute filtered reads and discovery require the Compute feature. SQL does not require Compute. Local reads and discovery require the stack backend. Unsupported local level, search, and kind filters fail before log reads. Hosted levels derive from service fields; Compute app severity stays unknown. With `--level` and no service selector, hosted reads select `postgres`, `edge`, `auth`, `functions`, and `function-edge`. Local backend errors name `SUPABASE_EXPERIMENTAL_STACK=1`, `[experimental] stack = true`, and `--remote` as alternatives.
+
+The deprecated `compute logs` and `stack logs` entrypoints keep their original flags, defaults, output modes, feature gates, and follow lifecycle. Their engines remain in their command directories; only shared time parsing, retained-history collection, gateway detection, and request transport have common owners. They warn once on stderr with `supabase logs` as the replacement and v4 as the removal version. The warning contains no interactive keyboard instructions. The legacy `-f` continues to mean `--follow`. Stack stream-json output adds `data` with the retained record; its JSON array keeps its existing shape. Legacy errors and lifecycle suggestions retain their shipping text.
diff --git a/apps/cli/src/commands/logs/logs.api.ts b/apps/cli/src/commands/logs/logs.api.ts
new file mode 100644
index 0000000000..2b5d31db33
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.api.ts
@@ -0,0 +1,69 @@
+import { requestLogs } from "../../shared/logs/request.ts";
+import { type ApiClient } from "@supabase/api/effect";
+import { Clock, Effect, Schema } from "effect";
+import { LogsApiError } from "./logs.errors.ts";
+
+const envelope = Schema.Struct({
+  result: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.JsonObject))),
+  error: Schema.optionalKey(Schema.NullOr(Schema.Unknown)),
+});
+
+export const queryLogs = Effect.fn("Logs.query")(function* (
+  api: ApiClient,
+  ref: string,
+  sql: string,
+  window: { readonly start: string; readonly end: string },
+) {
+  const response = yield* requestLogs(api, ref, sql, window);
+  const retryAfter = response.headers["retry-after"];
+  const retryAfterMs =
+    retryAfter === undefined
+      ? undefined
+      : /^\d+(?:\.\d+)?$/.test(retryAfter)
+        ? Number(retryAfter) * 1000
+        : Date.parse(retryAfter) - (yield* Clock.currentTimeMillis);
+  if (response.status !== 200)
+    return yield* new LogsApiError({
+      status: response.status,
+      ...(response.status === 429 && retryAfterMs !== undefined && Number.isFinite(retryAfterMs)
+        ? { retryAfterMs: Math.max(0, retryAfterMs) }
+        : {}),
+      message:
+        response.status === 401
+          ? "The logs API rejected your credentials (HTTP 401). Run supabase login and retry."
+          : response.status === 403
+            ? "The logs API denied access (HTTP 403). Check that your account or token has permission to read this project's logs."
+            : response.status === 402
+              ? "The logs API usage limit was reached (HTTP 402). Check your organization's log usage limits and billing settings in the Dashboard."
+              : response.status === 429
+                ? "The logs API rate limit was reached. Wait before retrying."
+                : `The logs API returned HTTP ${response.status}.`,
+    });
+  const body = yield* response.json.pipe(
+    Effect.mapError(
+      () =>
+        new LogsApiError({
+          message: "The logs API returned invalid JSON.",
+          status: response.status,
+          reason: "response",
+        }),
+    ),
+  );
+  const decoded = yield* Schema.decodeUnknownEffect(envelope)(body).pipe(
+    Effect.mapError(
+      () =>
+        new LogsApiError({
+          message: "The logs API returned an unreadable response.",
+          status: response.status,
+          reason: "response",
+        }),
+    ),
+  );
+  if (decoded.error !== undefined && decoded.error !== null)
+    return yield* new LogsApiError({
+      message: `The logs API could not run this query: ${yield* Schema.encodeUnknownEffect(Schema.fromJsonString(Schema.Unknown))(decoded.error)}`,
+      status: response.status,
+      reason: "query",
+    });
+  return decoded.result ?? [];
+});
diff --git a/apps/cli/src/commands/logs/logs.browser.format.ts b/apps/cli/src/commands/logs/logs.browser.format.ts
new file mode 100644
index 0000000000..31fe6e0a34
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.browser.format.ts
@@ -0,0 +1,371 @@
+import { dim, inverse, type ColorStream } from "../../command-internal/colors.ts";
+import { DateTime, type Schema } from "effect";
+import { stripControlSequences } from "../../shared/output/strip-control-sequences.ts";
+import { stringWidth } from "../../command-internal/string-width.ts";
+import { renderLogsRows, wrapLogsText } from "./logs.display.ts";
+
+const browserHeaderRows = (state: BrowserState) =>
+  state.context === undefined && state.filters === undefined ? 2 : 4;
+const browserReservedRows = (state: BrowserState) => browserHeaderRows(state) + 1;
+
+export type LogsBrowserWindow =
+  | {
+      readonly kind: "range";
+      readonly start: string;
+      readonly end: string;
+      readonly pending?: boolean;
+    }
+  | { readonly kind: "launch"; readonly end: string };
+
+export interface BrowserState {
+  readonly context?: string;
+  readonly filters?: string;
+  readonly window: LogsBrowserWindow | undefined;
+  readonly rows: ReadonlyArray<Schema.JsonObject>;
+  readonly sizes: ReadonlyArray<number>;
+  readonly bytes: number;
+  readonly viewport: number;
+  readonly visibleRows: number;
+  readonly selected: number;
+  readonly detail: Schema.JsonObject | undefined;
+  readonly scroll: number;
+  readonly dropped: number;
+  readonly complete: boolean;
+  readonly notice: string;
+  readonly error: { readonly message: string; readonly scroll: number } | undefined;
+}
+
+export const initialBrowserState: BrowserState = {
+  window: undefined,
+  rows: [],
+  sizes: [],
+  bytes: 0,
+  viewport: 0,
+  visibleRows: 21,
+  selected: 0,
+  detail: undefined,
+  scroll: 0,
+  dropped: 0,
+  complete: false,
+  notice: "",
+  error: undefined,
+};
+
+export function resizeBrowser(state: BrowserState, height: number): BrowserState {
+  const visibleRows = Math.max(1, Math.floor(height) - browserReservedRows(state));
+  const lastStart = Math.max(0, state.rows.length - visibleRows);
+  let viewport = Math.min(state.viewport, lastStart);
+  if (state.selected < viewport) viewport = state.selected;
+  else if (state.selected >= viewport + visibleRows) viewport = state.selected - visibleRows + 1;
+  return { ...state, viewport: Math.max(0, viewport), visibleRows };
+}
+
+function insertBrowserRow(
+  state: BrowserState,
+  row: Schema.JsonObject,
+  mode: "query" | "bounded",
+  index: number,
+): BrowserState {
+  const size = JSON.stringify(row).length * 2;
+  const sizes = [...state.sizes.slice(0, index), size, ...state.sizes.slice(index)];
+  const inserted = [...state.rows.slice(0, index), row, ...state.rows.slice(index)];
+  let bytes = state.bytes + size;
+  let dropped = 0;
+  while (
+    mode !== "query" &&
+    sizes.length - dropped > 1 &&
+    (sizes.length - dropped > 1000 || bytes > 8 * 1024 * 1024)
+  ) {
+    bytes -= sizes[dropped] ?? 0;
+    dropped++;
+  }
+  const rows = inserted.slice(dropped);
+  return resizeBrowser(
+    {
+      ...state,
+      rows,
+      viewport: Math.max(0, state.viewport - dropped),
+      sizes: sizes.slice(dropped),
+      bytes,
+      dropped: state.dropped + dropped,
+      selected: Math.max(0, state.selected - dropped),
+    },
+    state.visibleRows + browserReservedRows(state),
+  );
+}
+
+export function appendBrowserRow(state: BrowserState, row: Schema.JsonObject): BrowserState {
+  return insertBrowserRow(state, row, "query", state.rows.length);
+}
+
+export function stageBrowserRow(state: BrowserState, row: Schema.JsonObject): BrowserState {
+  const time = timestampMillis(row) ?? -Infinity;
+  const identity = String(row["id"] ?? row["instanceId"] ?? "");
+  let low = 0;
+  let high = state.rows.length;
+  while (low < high) {
+    const middle = (low + high) >>> 1;
+    const candidate = state.rows[middle];
+    if (candidate === undefined) break;
+    const otherTime = timestampMillis(candidate) ?? -Infinity;
+    const otherIdentity = String(candidate["id"] ?? candidate["instanceId"] ?? "");
+    if (otherTime < time || (otherTime === time && otherIdentity <= identity)) low = middle + 1;
+    else high = middle;
+  }
+  return insertBrowserRow(state, row, "bounded", low);
+}
+
+function timestampMillis(row: Schema.JsonObject): number | undefined {
+  const millis = row["ts_ms"];
+  const timestamp = row["timestamp"];
+  const time =
+    typeof millis === "number"
+      ? millis
+      : typeof timestamp === "string" &&
+          /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?$/u.test(
+            timestamp,
+          )
+        ? Date.parse(
+            /[zZ]|[+-]\d{2}:?\d{2}$/u.test(timestamp)
+              ? timestamp
+              : `${timestamp.replace(" ", "T")}Z`,
+          )
+        : Number.NaN;
+  return Number.isFinite(time) && Math.abs(time) <= 8_640_000_000_000_000 ? time : undefined;
+}
+
+const months = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+const pad = (value: number) => String(value).padStart(2, "0");
+
+function dateLabel(time: number, includeYear = false): string {
+  const parts = DateTime.toPartsUtc(DateTime.makeUnsafe(time));
+  return `${months[parts.month - 1]} ${pad(parts.day)}${includeYear ? ` ${parts.year}` : ""}`;
+}
+
+function timeLabel(time: number): string {
+  const parts = DateTime.toPartsUtc(DateTime.makeUnsafe(time));
+  return `${pad(parts.hour)}:${pad(parts.minute)}:${pad(parts.second)}`;
+}
+
+export function browserTimestamp(row: Schema.JsonObject): string {
+  const time = timestampMillis(row);
+  return time === undefined ? "—" : `${dateLabel(time)} - ${timeLabel(time)} UTC`;
+}
+
+function requestedWindow(window: LogsBrowserWindow | undefined): string {
+  if (window === undefined) return "Window: resolving…";
+  if (window.kind === "range") {
+    const start = Date.parse(window.start);
+    const end = Date.parse(window.end);
+    const first = DateTime.toPartsUtc(DateTime.makeUnsafe(start));
+    const last = DateTime.toPartsUtc(DateTime.makeUnsafe(end));
+    const crossYear = first.year !== last.year;
+    const sameDay = !crossYear && first.month === last.month && first.day === last.day;
+    const from = `${dateLabel(start, crossYear)} ${timeLabel(start)}`;
+    const to = sameDay ? timeLabel(end) : `${dateLabel(end, crossYear)} ${timeLabel(end)}`;
+    return `Window: ${from}–${to} UTC${window.pending ? " | more pending" : ""}`;
+  }
+  const end = Date.parse(window.end);
+  return `Window: since each service's latest launch → ${dateLabel(end, true)} ${timeLabel(end)} UTC`;
+}
+
+export function applyBrowserBatch(
+  state: BrowserState,
+  batch: Pick<BrowserState, "rows" | "dropped">,
+  mode: "append" | "replace",
+): BrowserState {
+  const selected = state.rows[state.selected];
+  const anchor = state.rows[state.viewport];
+  let next =
+    mode === "replace"
+      ? {
+          ...state,
+          rows: [],
+          sizes: [],
+          bytes: 0,
+          dropped: batch.dropped,
+          selected: 0,
+          viewport: 0,
+        }
+      : { ...state, dropped: state.dropped + batch.dropped };
+  for (const row of batch.rows)
+    next = mode === "replace" ? appendBrowserRow(next, row) : stageBrowserRow(next, row);
+  if (mode === "replace") {
+    const identity = selected?.["id"];
+    const found =
+      identity === undefined ? -1 : next.rows.findIndex((row) => row["id"] === identity);
+    next = {
+      ...next,
+      selected: found >= 0 ? found : Math.min(state.selected, Math.max(0, next.rows.length - 1)),
+      viewport: state.viewport,
+    };
+  } else if (state.rows.length === 0)
+    next = { ...next, selected: Math.max(0, next.rows.length - 1) };
+  else {
+    const selectedIndex = selected === undefined ? -1 : next.rows.indexOf(selected);
+    const anchorIndex = anchor === undefined ? -1 : next.rows.indexOf(anchor);
+    next = {
+      ...next,
+      selected:
+        selectedIndex >= 0
+          ? selectedIndex
+          : Math.min(next.selected, Math.max(0, next.rows.length - 1)),
+      viewport: anchorIndex >= 0 ? anchorIndex : next.viewport,
+    };
+  }
+  return resizeBrowser(next, state.visibleRows + browserReservedRows(state));
+}
+
+const clip = (value: string, width: number): string => {
+  const clean = stripControlSequences(value).replaceAll("\t", "    ");
+  let result = "";
+  let used = 0;
+  for (const character of clean) {
+    const size = stringWidth(character);
+    if (used + size > width) break;
+    result += character;
+    used += size;
+  }
+  return result;
+};
+
+function browserDetailLines(row: Schema.JsonObject, width: number): ReadonlyArray<string> {
+  return wrapLogsText(renderLogsRows([row], Math.max(2, width)), Math.max(2, width)).split("\n");
+}
+
+export function browserKey(
+  state: BrowserState,
+  key: string,
+  width: number,
+  height: number,
+): BrowserState {
+  state = resizeBrowser(state, height);
+  if (state.error !== undefined) {
+    if (key === "escape") return { ...state, error: undefined };
+    const delta = key === "up" ? -1 : key === "down" ? 1 : 0;
+    const lines = wrapLogsText(state.error.message, width).split("\n");
+    return {
+      ...state,
+      error: {
+        ...state.error,
+        scroll: Math.max(
+          0,
+          Math.min(Math.max(0, lines.length - state.visibleRows), state.error.scroll + delta),
+        ),
+      },
+    };
+  }
+  if (key === "escape") return { ...state, detail: undefined, scroll: 0 };
+  if ((key === "return" || key === "enter") && state.detail === undefined)
+    return { ...state, detail: state.rows[state.selected], scroll: 0 };
+  const delta = key === "up" ? -1 : key === "down" ? 1 : 0;
+  if (state.detail !== undefined)
+    return {
+      ...state,
+      scroll: Math.max(
+        0,
+        Math.min(
+          Math.max(
+            0,
+            browserDetailLines(state.detail, width).length -
+              Math.max(1, height - browserReservedRows(state)),
+          ),
+          state.scroll + delta,
+        ),
+      ),
+    };
+  return resizeBrowser(
+    {
+      ...state,
+      selected: Math.max(0, Math.min(state.rows.length - 1, state.selected + delta)),
+    },
+    height,
+  );
+}
+
+export function renderBrowser(
+  state: BrowserState,
+  columns: number,
+  rows: number,
+  stream: ColorStream = {},
+  mode: "append" | "replace" = "append",
+): string {
+  state = resizeBrowser(state, rows);
+  const width = Math.max(1, Math.floor(columns) - 1);
+  const height = Math.max(1, Math.floor(rows));
+  const bodyHeight = Math.max(0, height - browserReservedRows(state));
+  let body: ReadonlyArray<string>;
+  if (state.error !== undefined || state.detail !== undefined) {
+    const lines =
+      state.error !== undefined
+        ? wrapLogsText(state.error.message, width).split("\n")
+        : state.detail === undefined
+          ? []
+          : browserDetailLines(state.detail, width);
+    const scroll = Math.min(
+      state.error?.scroll ?? state.scroll,
+      Math.max(0, lines.length - bodyHeight),
+    );
+    body = lines.slice(scroll, scroll + bodyHeight);
+  } else {
+    const start = state.viewport;
+    body = state.rows.slice(start, start + bodyHeight).map((row, index) => {
+      const service = row["service"] ?? row["source"] ?? "—";
+      const message = row["event_message"] ?? row["text"] ?? row["message"] ?? JSON.stringify(row);
+      const summary = stripControlSequences(
+        `${String(service)} ${typeof message === "string" ? message : JSON.stringify(message)}`,
+      ).replaceAll(/\s+/gu, " ");
+      return `${start + index === state.selected ? ">" : " "} ${browserTimestamp(row)} ${summary}`;
+    });
+    if (body.length === 0 && bodyHeight > 0)
+      body = [state.complete ? "No log rows." : "Waiting for logs…"];
+  }
+  const heading =
+    state.error !== undefined
+      ? "Load failed"
+      : state.detail === undefined
+        ? `Logs | ${state.rows.length} retained${state.dropped > 0 ? ` | ${state.dropped} older rows discarded` : ""}${state.sizes.some((size) => size > 8 * 1024 * 1024) ? " | oversized record" : ""}${state.complete ? " | ready" : " | loading"}`
+        : "Log details";
+  const keys =
+    state.error !== undefined
+      ? "↑/↓ scroll · Esc back · L retry · q quit"
+      : state.detail === undefined
+        ? `↑/↓ select · Enter details · ${mode === "replace" ? "L rerun" : "L load more"} · C copy · q quit`
+        : `↑/↓ scroll · Esc back · ${mode === "replace" ? "L rerun" : "L load more"} · C copy · q quit`;
+  const metadata =
+    browserHeaderRows(state) === 2
+      ? []
+      : [state.context ?? "Logs", state.filters ?? "Filters: all"].map((value) =>
+          stripControlSequences(value).replaceAll(/\s+/gu, " "),
+        );
+  const lines = [heading, ...metadata, requestedWindow(state.window), ...body];
+  while (lines.length < height - 1) lines.push("");
+  const compact = !state.complete
+    ? "q quit"
+    : state.error !== undefined
+      ? "Esc back · L retry · q quit"
+      : `${mode === "replace" ? "L rerun" : "L load more"} · C copy · q quit`;
+  const fullNotice = clip(state.notice, width);
+  const help = stringWidth(fullNotice) + 3 + stringWidth(keys) <= width ? keys : compact;
+  const notice = clip(state.notice, Math.max(0, width - stringWidth(help) - 3));
+  if (height > 1) lines.push(notice ? `${notice} | ${help}` : keys);
+  return lines
+    .slice(0, height)
+    .map((line, index) => {
+      const plain = clip(line, width);
+      const rowIndex = state.viewport + index - browserHeaderRows(state);
+      const row =
+        index >= browserHeaderRows(state) &&
+        index < body.length + browserHeaderRows(state) &&
+        state.detail === undefined &&
+        state.error === undefined
+          ? state.rows[rowIndex]
+          : undefined;
+      if (row === undefined) return plain;
+      if (rowIndex === state.selected)
+        return inverse(plain + " ".repeat(Math.max(0, width - stringWidth(plain))), stream);
+      const timeEnd = Math.min(plain.length, 2 + browserTimestamp(row).length);
+      return plain.slice(0, 2) + dim(plain.slice(2, timeEnd), stream) + plain.slice(timeEnd);
+    })
+    .join("\r\n");
+}
diff --git a/apps/cli/src/commands/logs/logs.browser.integration.test.ts b/apps/cli/src/commands/logs/logs.browser.integration.test.ts
new file mode 100644
index 0000000000..f8e0fa8b9d
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.browser.integration.test.ts
@@ -0,0 +1,318 @@
+import process from "node:process";
+import { expect, it } from "@effect/vitest";
+import { Cause, Deferred, Effect, Exit, Fiber, Layer, Option, Queue, Terminal } from "effect";
+import { mockOutput, mockProcessControl } from "../../../tests/helpers/mocks.ts";
+import { LogsClipboard } from "./logs.clipboard.ts";
+import { LogsInputError } from "./logs.errors.ts";
+import { browseLogs } from "./logs.browser.ts";
+import type { LogsSession } from "./logs.session.ts";
+
+const key = (name: string, ctrl = false): Terminal.UserInput => ({
+  input: Option.none(),
+  key: { name, ctrl, meta: false, shift: false },
+});
+const window = {
+  kind: "range",
+  start: "2026-11-04T10:00:00Z",
+  end: "2026-11-04T11:00:00Z",
+} satisfies import("./logs.browser.format.ts").LogsBrowserWindow;
+const setup = Effect.fnUntraced(function* <E>(session: LogsSession<E>) {
+  const input = yield* Queue.unbounded<Terminal.UserInput>();
+  const frames = yield* Queue.unbounded<string>();
+  const control = mockProcessControl();
+  let columns = 80;
+  let rows = 12;
+  const fiber = yield* browseLogs(session, 1762254000000).pipe(
+    Effect.provideService(
+      Terminal.Terminal,
+      Terminal.make({
+        columns: Effect.sync(() => columns),
+        rows: Effect.sync(() => rows),
+        size: Queue.unbounded<Terminal.Size, Cause.Done>(),
+        readInput: Effect.succeed(input),
+        readLine: Effect.die("unused"),
+        display: (text) => Queue.offer(frames, text).pipe(Effect.asVoid),
+      }),
+    ),
+    Effect.provide(
+      Layer.mergeAll(mockOutput().layer, control.layer, Layer.mock(LogsClipboard, {})),
+    ),
+    Effect.forkScoped,
+  );
+  const frame = Effect.fnUntraced(function* (contains: string) {
+    let text = "";
+    while (!text.includes(contains)) text = yield* Queue.take(frames);
+    return text;
+  });
+  return {
+    input,
+    frames,
+    control,
+    fiber,
+    frame,
+    resize: (width: number, height: number) => {
+      columns = width;
+      rows = height;
+      process.stdout.emit("resize");
+    },
+  };
+});
+
+it.effect(
+  "loads newer rows once and commits against navigation and resize performed while loading",
+  () =>
+    Effect.gen(function* () {
+      const release = yield* Deferred.make<void>();
+      const pending = yield* Deferred.make<void>();
+      const stopped = yield* Deferred.make<void>();
+      let calls = 0;
+      const listeners = process.stdout.listenerCount("resize");
+      const ui = yield* setup({
+        mode: "append",
+        load: (_end, emit, progress) =>
+          Effect.gen(function* () {
+            calls++;
+            if (calls === 1 && progress !== undefined)
+              yield* progress({ message: "Loading page 1…", window });
+            if (calls === 3)
+              return yield* Deferred.succeed(pending, undefined).pipe(
+                Effect.andThen(Effect.never),
+                Effect.ensuring(Deferred.succeed(stopped, undefined)),
+              );
+            for (let index = calls === 1 ? 0 : 20; index < (calls === 1 ? 20 : 30); index++)
+              yield* emit({ id: String(index), ts_ms: index, message: `row-${index}` });
+            if (calls === 2) yield* Deferred.await(release);
+            return window;
+          }),
+      });
+      const initialReady = yield* ui.frame(" | ready");
+      expect(initialReady).toContain("row-19");
+      expect(initialReady).toContain("↑/↓ select · Enter details");
+      yield* Queue.offer(ui.input, key("up"));
+      yield* ui.frame("> Jan 01 - 00:00:00 UTC — row-18");
+      yield* Queue.offer(ui.input, key("L"));
+      const loading = yield* ui.frame("Loading more logs");
+      expect(loading).not.toContain("row-29");
+      yield* Queue.offer(ui.input, key("l"));
+      yield* ui.frame("Loading more logs");
+      expect(calls).toBe(2);
+      yield* Queue.offer(ui.input, key("up"));
+      yield* ui.frame("> Jan 01 - 00:00:00 UTC — row-17");
+      yield* Queue.offer(ui.input, key("return"));
+      yield* ui.frame("Log details");
+      ui.resize(100, 8);
+      yield* ui.frame("Log details");
+      yield* Deferred.succeed(release, undefined);
+      expect(yield* ui.frame("10 new logs loaded.")).toContain("row-17");
+      yield* Queue.offer(ui.input, key("escape"));
+      const refreshed = yield* ui.frame("Enter details");
+      expect(refreshed).toContain("> Jan 01 - 00:00:00 UTC — row-17");
+      expect(refreshed).not.toContain("row-29");
+      yield* Queue.offer(ui.input, key("L"));
+      yield* Deferred.await(pending);
+      yield* Queue.offer(ui.input, key("q"));
+      yield* Fiber.join(ui.fiber);
+      yield* Deferred.await(stopped);
+      expect(process.stdout.listenerCount("resize")).toBe(listeners);
+    }),
+);
+
+it.effect(
+  "replaces SQL rows by identity, keeps pinned details, and retries an atomic failed load",
+  () =>
+    Effect.gen(function* () {
+      let calls = 0;
+      const ui = yield* setup({
+        mode: "replace",
+        load: (_end, emit) =>
+          Effect.gen(function* () {
+            calls++;
+            if (calls === 1) {
+              yield* emit({ id: "a", message: "first" });
+              yield* emit({ id: "b", message: "pinned original" });
+            } else if (calls === 2) {
+              yield* emit({ id: "b", message: "replacement" });
+              yield* emit({ id: "a", message: "second" });
+            } else if (calls === 3) {
+              yield* emit({ id: "bad", message: "must not publish" });
+              return yield* new LogsInputError({
+                message: "A long recoverable failure ".repeat(10),
+              });
+            } else yield* emit({ id: "retry", message: "retried" });
+            return window;
+          }),
+      });
+      yield* ui.frame(" | ready");
+      yield* Queue.offer(ui.input, key("down"));
+      yield* ui.frame("pinned original");
+      yield* Queue.offer(ui.input, key("return"));
+      yield* ui.frame("Log details");
+      yield* Queue.offer(ui.input, key("L"));
+      expect(yield* ui.frame("Query reloaded.")).toContain("pinned original");
+      yield* Queue.offer(ui.input, key("escape"));
+      expect(yield* ui.frame("Enter details")).toContain("> — — replacement");
+      yield* Queue.offer(ui.input, key("L"));
+      const failed = yield* ui.frame("recoverable failure");
+      expect(failed).not.toContain("must not publish");
+      expect(failed.split("\r\n").at(-1)).toContain("L retry");
+      expect(failed).toContain("Load failed");
+      yield* Queue.offer(ui.input, key("escape"));
+      expect(yield* Queue.take(ui.frames)).toContain("> — — replacement");
+      yield* Queue.offer(ui.input, key("L"));
+      expect(yield* ui.frame("Query reloaded.")).toContain("retried");
+      yield* Queue.offer(ui.input, key("q"));
+      yield* Fiber.join(ui.fiber);
+    }),
+);
+
+it.effect("keeps an empty result open for L and preserves raw Ctrl-C exit130", () =>
+  Effect.gen(function* () {
+    let calls = 0;
+    const ui = yield* setup({
+      mode: "append",
+      load: (_end, emit) =>
+        Effect.gen(function* () {
+          calls++;
+          if (calls > 2) yield* emit({ message: "arrived" });
+          return window;
+        }),
+    });
+    expect(yield* ui.frame(" | ready")).toContain("No log rows.");
+    yield* Queue.offer(ui.input, key("L"));
+    expect(yield* ui.frame("0 new logs loaded.")).toContain("No log rows.");
+    yield* Queue.offer(ui.input, key("L"));
+    expect(yield* ui.frame("1 new log loaded.")).toContain("arrived");
+    yield* Queue.offer(ui.input, key("c", true));
+    yield* Fiber.join(ui.fiber);
+    expect(ui.control.exitCode).toBe(130);
+  }),
+);
+
+it.effect("restores the terminal even if entering the alternate screen fails", () =>
+  Effect.gen(function* () {
+    const input = yield* Queue.unbounded<Terminal.UserInput>();
+    const writes: string[] = [];
+    const exit = yield* browseLogs({ mode: "append", load: () => Effect.succeed(window) }, 0).pipe(
+      Effect.provideService(
+        Terminal.Terminal,
+        Terminal.make({
+          columns: Effect.succeed(80),
+          rows: Effect.succeed(12),
+          size: Queue.unbounded<Terminal.Size, Cause.Done>(),
+          readInput: Effect.succeed(input),
+          readLine: Effect.die("unused"),
+          display: (text) =>
+            Effect.gen(function* () {
+              writes.push(text);
+              if (writes.length === 1) return yield* Effect.die("partial display failure");
+            }),
+        }),
+      ),
+      Effect.provide(
+        Layer.mergeAll(
+          mockOutput().layer,
+          mockProcessControl().layer,
+          Layer.mock(LogsClipboard, {}),
+        ),
+      ),
+      Effect.exit,
+    );
+    expect(Exit.isFailure(exit) && Cause.pretty(exit.cause)).toContain("partial display failure");
+    expect(writes).toEqual(["\u001b[?1049h\u001b[?25l", "\u001b[?25h\u001b[?1049l"]);
+  }),
+);
+
+for (const columns of [80, 120])
+  it.effect(`shows complete errors at ${columns} columns and restores pinned details`, () =>
+    Effect.gen(function* () {
+      let calls = 0;
+      const message = `query failed: \u001b[31m${"invalid SQL reason ".repeat(180)}\u001b[0m\nunique-error-end`;
+      const ui = yield* setup({
+        mode: "replace",
+        load: (_end, emit) =>
+          Effect.gen(function* () {
+            calls++;
+            if (calls === 2) return yield* new LogsInputError({ message });
+            if (calls === 3) return yield* new LogsInputError({ message: "retry failure changed" });
+            yield* emit({ id: "a", message: "first" });
+            yield* emit({
+              id: "b",
+              message: Array.from({ length: 30 }, (_, index) => `detail-line-${index}`).join("\n"),
+            });
+            return window;
+          }),
+      });
+      yield* ui.frame(" | ready");
+      ui.resize(columns, 12);
+      yield* ui.frame(" | ready");
+      yield* Queue.offer(ui.input, key("down"));
+      const selected = yield* ui.frame("> — — detail-line-0");
+      yield* Queue.offer(ui.input, key("return"));
+      yield* ui.frame("Log details");
+      let details = "";
+      for (let index = 0; index < 4; index++) {
+        yield* Queue.offer(ui.input, key("down"));
+        details = yield* ui.frame("Log details");
+      }
+      yield* Queue.offer(ui.input, key("L"));
+      yield* ui.frame("Rerunning query");
+      const failed = yield* Queue.take(ui.frames);
+      expect(failed).toContain("Load failed");
+      expect(failed).toContain("query failed:");
+      expect(failed).not.toContain("\u001b[31m");
+      expect(failed).not.toContain("unique-error-end");
+      let last = failed;
+      for (let index = 0; index < 80 && !last.includes("unique-error-end"); index++) {
+        yield* Queue.offer(ui.input, key("down"));
+        last = yield* Queue.take(ui.frames);
+      }
+      expect(last).toContain("unique-error-end");
+      yield* Queue.offer(ui.input, key("c"));
+      expect(yield* Queue.take(ui.frames)).toContain("Load failed");
+      yield* Queue.offer(ui.input, key("escape"));
+      const restored = yield* Queue.take(ui.frames);
+      expect(restored.split("\r\n").slice(0, -1)).toEqual(details.split("\r\n").slice(0, -1));
+      yield* Queue.offer(ui.input, key("escape"));
+      const list = yield* Queue.take(ui.frames);
+      expect(list.split("\r\n").slice(0, -1)).toEqual(selected.split("\r\n").slice(0, -1));
+      yield* Queue.offer(ui.input, key("return"));
+      yield* ui.frame("Log details");
+      for (let index = 0; index < 4; index++) {
+        yield* Queue.offer(ui.input, key("down"));
+        yield* ui.frame("Log details");
+      }
+      yield* Queue.offer(ui.input, key("L"));
+      yield* ui.frame("retry failure changed");
+      yield* Queue.offer(ui.input, key("L"));
+      const retried = yield* ui.frame("Query reloaded.");
+      expect(retried).not.toContain("Load failed");
+      expect(retried.split("\r\n").slice(0, -1)).toEqual(details.split("\r\n").slice(0, -1));
+      yield* Queue.offer(ui.input, key("q"));
+      yield* Fiber.join(ui.fiber);
+    }),
+  );
+
+it.effect("opens initial load errors and allows a successful retry", () =>
+  Effect.gen(function* () {
+    let calls = 0;
+    const ui = yield* setup({
+      mode: "replace",
+      load: (_end, emit) =>
+        Effect.gen(function* () {
+          if (++calls === 1) return yield* new LogsInputError({ message: "initial SQL reason" });
+          yield* emit({ message: "recovered row" });
+          return window;
+        }),
+    });
+    yield* ui.frame("Loading logs");
+    const failed = yield* Queue.take(ui.frames);
+    expect(failed).toContain("Load failed");
+    expect(failed).toContain("initial SQL reason");
+    yield* Queue.offer(ui.input, key("L"));
+    const recovered = yield* ui.frame(" | ready");
+    expect(recovered).toContain("recovered row");
+    expect(recovered).not.toContain("Load failed");
+    yield* Queue.offer(ui.input, key("q"));
+    yield* Fiber.join(ui.fiber);
+  }),
+);
diff --git a/apps/cli/src/commands/logs/logs.browser.ts b/apps/cli/src/commands/logs/logs.browser.ts
new file mode 100644
index 0000000000..bc74227789
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.browser.ts
@@ -0,0 +1,256 @@
+import { BunTerminal } from "@effect/platform-bun";
+import type { LogsFlags, LogsProgress, LogsSession } from "./logs.session.ts";
+import { LogsClipboard } from "./logs.clipboard.ts";
+import process from "node:process";
+import { Clock, Effect, Exit, Layer, Option, Queue, Schema, Stream, Terminal } from "effect";
+import { OutputFormatFlag } from "../../command-internal/global-flags.ts";
+import { envValue } from "../../shared/config/env-option.ts";
+import { Output } from "../../shared/output/output.service.ts";
+import { ProcessControl } from "../../shared/runtime/process-control.service.ts";
+import { Tty } from "../../shared/runtime/tty.service.ts";
+import {
+  appendBrowserRow,
+  applyBrowserBatch,
+  stageBrowserRow,
+  type BrowserState,
+  browserKey,
+  initialBrowserState,
+  renderBrowser,
+  resizeBrowser,
+  type LogsBrowserWindow,
+} from "./logs.browser.format.ts";
+
+export const logsTerminalLayer = Layer.effect(
+  Terminal.Terminal,
+  BunTerminal.make(() => false),
+);
+
+export const useLogsBrowser = Effect.fnUntraced(function* () {
+  const output = yield* Output;
+  const tty = yield* Effect.serviceOption(Tty);
+  const format = yield* Effect.serviceOption(OutputFormatFlag).pipe(Effect.map(Option.flatten));
+  const ci = yield* envValue("CI");
+  const term = yield* envValue("TERM");
+  return (
+    Option.isNone(format) &&
+    (ci === undefined || ci === "" || ci === "0" || ci.toLowerCase() === "false") &&
+    term !== "dumb" &&
+    output.format === "text" &&
+    output.interactive &&
+    Option.isSome(tty) &&
+    tty.value.stdinIsTty &&
+    tty.value.stdoutIsTty
+  );
+});
+
+interface LoadedBatch {
+  readonly rows: ReadonlyArray<Schema.JsonObject>;
+  readonly dropped: number;
+  readonly window: LogsBrowserWindow;
+}
+
+type BrowserEvent<E> =
+  | { readonly kind: "progress"; readonly update: LogsProgress }
+  | { readonly kind: "loaded"; readonly result: Exit.Exit<LoadedBatch, E> }
+  | { readonly kind: "key"; readonly input: Terminal.UserInput }
+  | { readonly kind: "copied"; readonly message: string }
+  | { readonly kind: "resize" }
+  | { readonly kind: "closed" };
+
+const isCopyKey = (key: Terminal.Key) => !key.ctrl && !key.meta && key.name.toLowerCase() === "c";
+
+const encodeClipboardRecord = Schema.encodeEffect(
+  Schema.fromJsonString(Schema.JsonObject, { space: 2 }),
+);
+
+export const browseLogs = Effect.fn("Logs.browser")(function* <E>(
+  session: LogsSession<E>,
+  started: number,
+  flags?: LogsFlags,
+) {
+  return yield* Effect.scoped(
+    Effect.gen(function* () {
+      const terminal = yield* Terminal.Terminal;
+      const processControl = yield* ProcessControl;
+      const events = yield* Queue.bounded<BrowserEvent<E>>(64);
+      const input = yield* terminal.readInput;
+      yield* Effect.acquireRelease(Effect.void, () =>
+        terminal.display("\u001b[?25h\u001b[?1049l").pipe(Effect.orDie),
+      );
+      yield* terminal.display("\u001b[?1049h\u001b[?25l");
+      yield* Effect.acquireRelease(
+        Effect.sync(() => {
+          const resize = () => {
+            Queue.offerUnsafe(events, { kind: "resize" });
+          };
+          process.stdout.on("resize", resize);
+          return resize;
+        }),
+        (resize) =>
+          Effect.sync(() => {
+            process.stdout.off("resize", resize);
+          }),
+      );
+      yield* Stream.fromQueue(input).pipe(
+        Stream.runForEach((input) => Queue.offer(events, { kind: "key", input })),
+        Effect.andThen(Queue.offer(events, { kind: "closed" })),
+        Effect.forkScoped,
+      );
+      const filters =
+        flags === undefined
+          ? undefined
+          : [
+              ...(session.mode === "replace" ? ["custom SQL"] : []),
+              ...flags.service.map((value) => `service=${value}`),
+              ...flags.level.map((value) => `level=${value}`),
+              ...Option.toArray(flags.resource).map((value) => `resource=${value}`),
+              ...Option.toArray(flags.kind).map((value) => `kind=${value}`),
+              ...Option.toArray(flags.search).map((value) => `search=${value}`),
+            ];
+      let state: BrowserState = {
+        ...initialBrowserState,
+        context: session.context,
+        filters: flags === undefined ? undefined : `Filters: ${filters?.join(" · ") || "all"}`,
+      };
+      let copying = false;
+      let loading = false;
+      let hasLoaded = false;
+      const load = Effect.fn("Logs.browser.load")(function* (end: number) {
+        if (loading) return;
+        loading = true;
+        state = {
+          ...state,
+          complete: false,
+          notice:
+            state.rows.length === 0
+              ? "Loading logs…"
+              : session.mode === "replace"
+                ? "Rerunning query…"
+                : "Loading more logs…",
+        };
+        let staged: BrowserState = initialBrowserState;
+        yield* session
+          .load(
+            end,
+            (row) =>
+              Effect.sync(() => {
+                staged =
+                  session.mode === "replace"
+                    ? appendBrowserRow(staged, row)
+                    : stageBrowserRow(staged, row);
+              }),
+            (update) => Queue.offer(events, { kind: "progress", update }).pipe(Effect.asVoid),
+          )
+          .pipe(
+            Effect.map((window): LoadedBatch => ({
+              rows: staged.rows,
+              dropped: staged.dropped,
+              window,
+            })),
+            Effect.exit,
+            Effect.flatMap((result) => Queue.offer(events, { kind: "loaded", result })),
+            Effect.forkScoped,
+          );
+      });
+      yield* load(started);
+      while (true) {
+        const columns = yield* terminal.columns;
+        const rows = yield* terminal.rows;
+        state = resizeBrowser(state, rows);
+        yield* terminal.display(
+          `\u001b[H\u001b[2J${renderBrowser(state, columns, rows, process.stdout, session.mode)}`,
+        );
+        const event = yield* Queue.take(events);
+        switch (event.kind) {
+          case "progress":
+            state = {
+              ...state,
+              notice: event.update.message,
+              window: state.window ?? event.update.window,
+            };
+            break;
+          case "loaded": {
+            loading = false;
+            if (Exit.isFailure(event.result)) {
+              const error = Exit.findErrorOption(event.result);
+              if (Option.isNone(error)) return yield* Effect.failCause(event.result.cause);
+              state = {
+                ...state,
+                complete: true,
+                notice: "Load failed. Press L to retry.",
+                error: {
+                  message: error.value instanceof Error ? error.value.message : String(error.value),
+                  scroll: 0,
+                },
+              };
+            } else {
+              const initial = !hasLoaded;
+              hasLoaded = true;
+              const loadedCount = event.result.value.rows.length + event.result.value.dropped;
+              state = applyBrowserBatch(state, event.result.value, session.mode);
+              state = {
+                ...state,
+                window: event.result.value.window,
+                error: undefined,
+                complete: true,
+                notice:
+                  event.result.value.window.kind === "range" && event.result.value.window.pending
+                    ? "More logs pending in this window. Press L to continue."
+                    : initial
+                      ? ""
+                      : session.mode === "replace"
+                        ? "Query reloaded."
+                        : `${loadedCount} new ${loadedCount === 1 ? "log" : "logs"} loaded.`,
+              };
+            }
+            break;
+          }
+          case "copied":
+            copying = false;
+            state = { ...state, notice: event.message };
+            break;
+          case "resize":
+            break;
+          case "closed":
+            return;
+          case "key":
+            if (event.input.key.ctrl && event.input.key.name.toLowerCase() === "c") {
+              yield* processControl.setExitCode(130);
+              return;
+            }
+            if (
+              !event.input.key.ctrl &&
+              !event.input.key.meta &&
+              event.input.key.name.toLowerCase() === "l"
+            ) {
+              yield* load(yield* Clock.currentTimeMillis);
+              break;
+            }
+            if (isCopyKey(event.input.key)) {
+              const row = state.detail ?? state.rows[state.selected];
+              if (state.error !== undefined || row === undefined || copying) break;
+              const clipboard = yield* LogsClipboard;
+              copying = true;
+              state = { ...state, notice: "Copying log…" };
+              const text = yield* encodeClipboardRecord(row).pipe(Effect.orDie);
+              yield* clipboard.copy(text).pipe(
+                Effect.match({
+                  onSuccess: () => "Copied log to clipboard.",
+                  onFailure: (error) => error.message,
+                }),
+                Effect.flatMap((message) => Queue.offer(events, { kind: "copied", message })),
+                Effect.forkScoped,
+              );
+              break;
+            }
+            if (
+              event.input.key.name === "q" ||
+              (event.input.key.ctrl && event.input.key.name === "d")
+            )
+              return;
+            state = browserKey(state, event.input.key.name, Math.max(2, columns - 1), rows);
+        }
+      }
+    }),
+  );
+});
diff --git a/apps/cli/src/commands/logs/logs.browser.unit.test.ts b/apps/cli/src/commands/logs/logs.browser.unit.test.ts
new file mode 100644
index 0000000000..a7ce5fadfd
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.browser.unit.test.ts
@@ -0,0 +1,397 @@
+import { beforeEach, afterEach, vi } from "vitest";
+import { stripControlSequences } from "../../shared/output/strip-control-sequences.ts";
+import { stringWidth } from "../../command-internal/string-width.ts";
+import { describe, expect, it } from "@effect/vitest";
+import {
+  appendBrowserRow,
+  applyBrowserBatch,
+  stageBrowserRow,
+  browserKey,
+  browserTimestamp,
+  initialBrowserState,
+  renderBrowser,
+  resizeBrowser,
+  type LogsBrowserWindow,
+} from "./logs.browser.format.ts";
+
+beforeEach(() => {
+  for (const variable of ["NO_COLOR", "CLICOLOR", "CLICOLOR_FORCE", "CI"]) vi.stubEnv(variable, "");
+});
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+const requestCases: ReadonlyArray<{
+  readonly window: LogsBrowserWindow | undefined;
+  readonly label: string;
+}> = [
+  {
+    window: {
+      kind: "range",
+      start: "2026-11-03T17:13:35Z",
+      end: "2026-11-03T17:14:55Z",
+      pending: true,
+    },
+    label: "Window: Nov 03 17:13:35–17:14:55 UTC | more pending",
+  },
+  {
+    window: { kind: "range", start: "2026-11-03T17:13:35Z", end: "2026-11-03T17:14:55Z" },
+    label: "Window: Nov 03 17:13:35–17:14:55 UTC",
+  },
+  {
+    window: { kind: "range", start: "2026-11-03T23:59:59Z", end: "2026-11-04T00:00:01Z" },
+    label: "Window: Nov 03 23:59:59–Nov 04 00:00:01 UTC",
+  },
+  {
+    window: { kind: "range", start: "2026-12-31T23:59:59Z", end: "2027-01-01T00:00:01Z" },
+    label: "Window: Dec 31 2026 23:59:59–Jan 01 2027 00:00:01 UTC",
+  },
+  {
+    window: { kind: "launch", end: "2026-11-03T12:00:00Z" },
+    label: "Window: since each service's latest launch → Nov 03 2026 12:00:00 UTC",
+  },
+  { window: undefined, label: "Window: resolving…" },
+];
+
+describe("log browser formatting", () => {
+  it.each([80, 120])(
+    "shows bounded target and filters without terminal control injection at %s columns",
+    (columns) => {
+      const ref = "abcdefghijklmnopqrst";
+      const screen = renderBrowser(
+        {
+          ...initialBrowserState,
+          context: `Remote project\u001b[31m name\n (${ref})`,
+          filters: "Filters: service=postgres · search=hello\r\nworld",
+          window: { kind: "range", start: "2026-11-03T10:00:00Z", end: "2026-11-03T12:00:00Z" },
+        },
+        columns,
+        12,
+      );
+      const lines = screen.split("\r\n");
+      expect(lines[1]).toBe(`Remote project name (${ref})`);
+      expect(lines[2]).toBe("Filters: service=postgres · search=hello world");
+      expect(lines[3]).toBe("Window: Nov 03 10:00:00–12:00:00 UTC");
+      expect(lines).toHaveLength(12);
+      expect(lines.every((line) => stringWidth(line) < columns)).toBe(true);
+    },
+  );
+
+  it.each([
+    [{ ts_ms: 0 }, "Jan 01 - 00:00:00 UTC"],
+    [{ timestamp: "2026-11-02 12:34:56.123" }, "Nov 02 - 12:34:56 UTC"],
+    [{ timestamp: "2026-11-02T14:34:56.123+02:00" }, "Nov 02 - 12:34:56 UTC"],
+    [{ timestamp: "2026-11-03T16:51:32Z" }, "Nov 03 - 16:51:32 UTC"],
+    [{ timestamp: "2026-01-01T00:15:30+01:00" }, "Dec 31 - 23:15:30 UTC"],
+    [{ timestamp: "2026-10-31T23:59:59-01:00" }, "Nov 01 - 00:59:59 UTC"],
+    [{ timestamp: "garbage" }, "—"],
+    [{ timestamp: 123 }, "—"],
+    [{ ts_ms: 8640000000000001 }, "—"],
+    [{ count: 3 }, "—"],
+  ])("formats only known timestamp representations: %j", (row, expected) => {
+    expect(browserTimestamp(row)).toBe(expected);
+  });
+
+  it.each(requestCases)(
+    "shows resolved request metadata regardless of row timestamps: $label",
+    ({ window, label }) => {
+      let state = { ...initialBrowserState, window };
+      state = appendBrowserRow(state, { count: 8 });
+      state = appendBrowserRow(state, { timestamp: "invalid" });
+      state = appendBrowserRow(state, { ts_ms: 0 });
+      for (const columns of [80, 120]) {
+        const lines = renderBrowser(state, columns, 8).split("\r\n");
+        expect(lines[0]).toContain("3 retained");
+        expect(lines[1]).toBe(label);
+        expect(lines).toHaveLength(8);
+        expect(lines.every((line) => stringWidth(line) < columns)).toBe(true);
+      }
+    },
+  );
+
+  it("preserves the requested window through scrolling, resize, and details", () => {
+    let state = resizeBrowser(
+      {
+        ...initialBrowserState,
+        window: { kind: "range", start: "2026-11-03T10:00:00Z", end: "2026-11-03T12:00:00Z" },
+      },
+      8,
+    );
+    for (let index = 0; index < 15; index++)
+      state = appendBrowserRow(state, {
+        ts_ms: 1762190100000 - index * 1000,
+        message: `range-${index}`,
+      });
+    const first = renderBrowser(state, 80, 8).split("\r\n");
+    expect(first[1]).toBe("Window: Nov 03 10:00:00–12:00:00 UTC");
+    expect(first.slice(2, 7).map((line) => line.match(/range-\d+/u)?.[0])).toEqual([
+      "range-0",
+      "range-1",
+      "range-2",
+      "range-3",
+      "range-4",
+    ]);
+    for (let index = 0; index < 5; index++) state = browserKey(state, "down", 79, 8);
+    expect(renderBrowser(state, 80, 8).split("\r\n")[2]).toContain("range-1");
+    state = browserKey(state, "up", 79, 8);
+    expect(
+      renderBrowser(state, 80, 8)
+        .split("\r\n")
+        .slice(2, 7)
+        .map((line) => line.match(/range-\d+/u)?.[0]),
+    ).toEqual(["range-1", "range-2", "range-3", "range-4", "range-5"]);
+    state = browserKey(state, "return", 79, 8);
+    const details = renderBrowser(state, 120, 6).split("\r\n");
+    expect(details[0]).toBe("Log details");
+    expect(details[1]).toBe(first[1]);
+    expect(details).toHaveLength(6);
+    expect(details[5]).toContain("Esc back");
+    state = resizeBrowser(state, 6);
+    state = browserKey(state, "escape", 119, 6);
+    expect(renderBrowser(state, 120, 6).split("\r\n")[1]).toBe(first[1]);
+    expect(renderBrowser(state, 120, 6).split("\r\n")[4]).toContain(
+      "> Nov 03 - 17:14:56 UTC — range-4",
+    );
+  });
+
+  it("keeps the window and controls visible when only headers and footer fit", () => {
+    const state: typeof initialBrowserState = {
+      ...appendBrowserRow(initialBrowserState, { ts_ms: 0 }),
+      window: { kind: "range", start: "2026-11-03T10:00:00Z", end: "2026-11-03T12:00:00Z" },
+    };
+    const lines = renderBrowser(state, 80, 3).split("\r\n");
+    expect(lines).toHaveLength(3);
+    expect(lines[1]).toBe("Window: Nov 03 10:00:00–12:00:00 UTC");
+    expect(lines[2]).toContain("C copy · q quit");
+  });
+
+  it("keeps visible rows stationary while selection moves inside a multi-screen list", () => {
+    let state = initialBrowserState;
+    for (let index = 0; index < 20; index++)
+      state = appendBrowserRow(state, { message: `visible-${index}` });
+    const visible = () =>
+      renderBrowser(state, 80, 9)
+        .split("\r\n")
+        .slice(2, 8)
+        .map((line) => line.slice(line.indexOf("visible-")).trimEnd());
+    expect(visible()).toEqual([
+      "visible-0",
+      "visible-1",
+      "visible-2",
+      "visible-3",
+      "visible-4",
+      "visible-5",
+    ]);
+    for (let index = 0; index < 6; index++) state = browserKey(state, "down", 79, 9);
+    expect(visible()).toEqual([
+      "visible-1",
+      "visible-2",
+      "visible-3",
+      "visible-4",
+      "visible-5",
+      "visible-6",
+    ]);
+    state = browserKey(state, "up", 79, 9);
+    expect(visible()).toEqual([
+      "visible-1",
+      "visible-2",
+      "visible-3",
+      "visible-4",
+      "visible-5",
+      "visible-6",
+    ]);
+    for (let index = 0; index < 4; index++) state = browserKey(state, "up", 79, 9);
+    expect(visible()).toEqual([
+      "visible-1",
+      "visible-2",
+      "visible-3",
+      "visible-4",
+      "visible-5",
+      "visible-6",
+    ]);
+    state = browserKey(state, "up", 79, 9);
+    expect(visible()).toEqual([
+      "visible-0",
+      "visible-1",
+      "visible-2",
+      "visible-3",
+      "visible-4",
+      "visible-5",
+    ]);
+  });
+
+  it("preserves the viewport through details and adjusts only enough for resize", () => {
+    let state = resizeBrowser(initialBrowserState, 9);
+    for (let index = 0; index < 20; index++)
+      state = appendBrowserRow(state, { message: `row-${index}` });
+    for (let index = 0; index < 8; index++) state = browserKey(state, "down", 79, 9);
+    expect(state.viewport).toBe(3);
+    state = browserKey(state, "return", 79, 9);
+    state = resizeBrowser(state, 13);
+    state = browserKey(state, "escape", 79, 13);
+    expect(state.viewport).toBe(3);
+    expect(state.selected).toBe(8);
+    expect(renderBrowser(state, 80, 13).split("\r\n")[2]).toContain("row-3");
+    state = resizeBrowser(state, 7);
+    expect(state.viewport).toBe(5);
+    expect(renderBrowser(state, 80, 7).split("\r\n")[5]).toContain("> — — row-8");
+    state = resizeBrowser(state, 13);
+    expect(state.viewport).toBe(5);
+  });
+
+  it("keeps the visible window stable across manual eviction while browsing older rows", () => {
+    let batch = initialBrowserState;
+    for (let index = 0; index < 1000; index++)
+      batch = stageBrowserRow(batch, { ts_ms: index, message: `row-${index}` });
+    let state = applyBrowserBatch(resizeBrowser(initialBrowserState, 9), batch, "append");
+    expect(state.selected).toBe(999);
+    expect(state.viewport).toBe(994);
+    for (let index = 0; index < 3; index++) state = browserKey(state, "up", 79, 9);
+    const before = state.rows.slice(state.viewport, state.viewport + 6);
+    state = applyBrowserBatch(
+      state,
+      { rows: [{ ts_ms: 1000, message: "newest" }], dropped: 0 },
+      "append",
+    );
+    expect(state.rows.slice(state.viewport, state.viewport + 6)).toEqual(before);
+    expect(state.rows[state.selected]).toMatchObject({ message: "row-996" });
+    state = browserKey(state, "return", 79, 9);
+    state = applyBrowserBatch(
+      state,
+      { rows: [{ ts_ms: 1001, message: "later" }], dropped: 0 },
+      "append",
+    );
+    state = browserKey(state, "escape", 79, 9);
+    expect(state.rows.slice(state.viewport, state.viewport + 6)).toEqual(before);
+    expect(state.rows[state.selected]).toMatchObject({ message: "row-996" });
+  });
+
+  it("highlights the full selected row and dims only unselected timestamps after safe clipping", () => {
+    let state = resizeBrowser(initialBrowserState, 9);
+    const first = {
+      timestamp: "2026-11-03T16:51:32Z",
+      service: "postgres",
+      message: "你好\u001b[31m selected",
+    };
+    state = appendBrowserRow(state, first);
+    state = appendBrowserRow(state, { ...first, message: "normal message" });
+    const lines = renderBrowser(state, 61, 9, { hasColors: () => true }).split("\r\n");
+    const selected = lines[2] ?? "";
+    const ordinary = lines[3] ?? "";
+    expect(selected.startsWith("\u001b[7m>")).toBe(true);
+    expect(selected.endsWith("\u001b[27m")).toBe(true);
+    expect(selected).not.toContain("\u001b[2m");
+    expect(selected).not.toContain("\u001b[31m");
+    expect(stringWidth(stripControlSequences(selected))).toBe(60);
+    expect(ordinary).toContain("\u001b[2mNov 03 - 16:51:32 UTC\u001b[22m postgres normal message");
+    expect(lines.every((line) => stringWidth(stripControlSequences(line)) <= 60)).toBe(true);
+    vi.stubEnv("NO_COLOR", "1");
+    const monochrome = renderBrowser(state, 61, 9, { hasColors: () => true });
+    expect(monochrome).not.toContain("\u001b");
+    expect(monochrome.split("\r\n")[2]).toContain("> Nov 03 - 16:51:32 UTC postgres 你好 selected");
+  });
+
+  it("stages globally newest rows across sources rather than retaining the final source", () => {
+    let batch = initialBrowserState;
+    for (let index = 0; index < 1000; index++)
+      batch = stageBrowserRow(batch, {
+        ts_ms: 10000 + index,
+        instanceId: "newer",
+        message: String(index),
+      });
+    for (let index = 0; index < 1000; index++)
+      batch = stageBrowserRow(batch, { ts_ms: index, instanceId: "older", message: String(index) });
+    expect(batch.rows).toHaveLength(1000);
+    expect(batch.rows.every((row) => row["instanceId"] === "newer")).toBe(true);
+    expect(batch.dropped).toBe(1000);
+  });
+
+  it("does not evict newer retained rows for a late older row or move selected anchors", () => {
+    let state = resizeBrowser(initialBrowserState, 24);
+    for (let index = 0; index < 1000; index++)
+      state = appendBrowserRow(state, { id: String(index), ts_ms: 10000 + index });
+    state = resizeBrowser({ ...state, selected: 900, viewport: 880 }, 24);
+    const selected = state.rows[900];
+    const anchor = state.rows[880];
+    const next = applyBrowserBatch(
+      state,
+      { rows: [{ id: "late", ts_ms: 1 }], dropped: 0 },
+      "append",
+    );
+    expect(next.rows).toEqual(state.rows);
+    expect(next.rows[next.selected]).toBe(selected);
+    expect(next.rows[next.viewport]).toBe(anchor);
+    expect(next.dropped).toBe(1);
+  });
+
+  it("preserves all custom SQL rows and pins current identity across replacement", () => {
+    let state = appendBrowserRow(initialBrowserState, { id: "selected" });
+    state = browserKey(state, "return", 79, 24);
+    const rows = Array.from({ length: 1500 }, (_, index) => ({ id: String(index) }));
+    const replaced = applyBrowserBatch(
+      state,
+      { rows: [...rows, { id: "selected" }], dropped: 0 },
+      "replace",
+    );
+    expect(replaced.rows).toHaveLength(1501);
+    expect(replaced.selected).toBe(1500);
+    expect(replaced.detail).toEqual({ id: "selected" });
+  });
+
+  it("preserves query order and starts at the first row", () => {
+    let state = appendBrowserRow(initialBrowserState, { count: 7 });
+    state = appendBrowserRow(state, { count: 8 });
+    expect(state.rows).toEqual([{ count: 7 }, { count: 8 }]);
+    for (let index = 0; index < 1001; index++) state = appendBrowserRow(state, { count: index });
+    expect(state.rows).toHaveLength(1003);
+    expect(state.rows[0]).toEqual({ count: 7 });
+    expect(state.selected).toBe(0);
+  });
+
+  it("keeps open details pinned when a completed refresh evicts the selected row", () => {
+    let batch = initialBrowserState;
+    for (let index = 0; index < 1000; index++)
+      batch = stageBrowserRow(batch, { ts_ms: index, message: `row-${index}` });
+    let state = applyBrowserBatch(initialBrowserState, batch, "append");
+    state = browserKey(state, "up", 80, 24);
+    state = browserKey(state, "return", 80, 24);
+    batch = initialBrowserState;
+    for (let index = 0; index < 1000; index++)
+      batch = stageBrowserRow(batch, { ts_ms: 1000 + index, message: `later-${index}` });
+    state = applyBrowserBatch(state, batch, "append");
+    expect(state.rows).toHaveLength(1000);
+    expect(state.detail).toMatchObject({ message: "row-998" });
+    expect(renderBrowser(state, 80, 24)).toContain("row-998");
+    state = browserKey(state, "escape", 80, 24);
+    expect(renderBrowser(state, 80, 24)).toContain("older rows discarded");
+  });
+
+  it("bounds retained payload bytes while keeping an oversized record complete", () => {
+    const text = "x".repeat(5 * 1024 * 1024);
+    let state = stageBrowserRow(initialBrowserState, { text });
+    state = stageBrowserRow(state, { text: "newer" });
+    expect(state.rows).toEqual([{ text: "newer" }]);
+    expect(state.dropped).toBe(1);
+    state = stageBrowserRow(state, { text });
+    expect(state.rows).toEqual([{ text }]);
+    expect(renderBrowser(state, 80, 9)).toContain("oversized record");
+  });
+
+  it("sanitizes untrusted summaries and wraps full detail data for scrolling", () => {
+    const row = {
+      service: "postgres",
+      event_message: "unsafe\u001b[2J\u001b]0;title\u0007 safe",
+      nested: { text: "last detail line".repeat(40) },
+    };
+    let state = appendBrowserRow(initialBrowserState, row);
+    const summary = renderBrowser(state, 65, 9);
+    expect(summary).toContain("unsafe safe");
+    expect(summary).not.toContain("\u001b");
+    expect(summary.split("\r\n")).toHaveLength(9);
+    expect(summary.split("\r\n").every((line) => line.length <= 64)).toBe(true);
+    state = browserKey(state, "return", 64, 9);
+    for (let index = 0; index < 100; index++) state = browserKey(state, "down", 64, 9);
+    expect(renderBrowser(state, 65, 9)).toContain("last detail line");
+    expect(state.scroll).toBeGreaterThan(0);
+  });
+});
diff --git a/apps/cli/src/commands/logs/logs.catalog.ts b/apps/cli/src/commands/logs/logs.catalog.ts
new file mode 100644
index 0000000000..d3b519ab88
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.catalog.ts
@@ -0,0 +1,37 @@
+export { COMPUTE_LOG_STREAMS } from "../../shared/compute/compute-logs.sql.ts";
+
+export const hostedSources = [
+  { service: "edge", source: "edge_logs" },
+  { service: "postgres", source: "postgres_logs" },
+  { service: "postgrest", source: "postgrest_logs" },
+  { service: "auth", source: "auth_logs" },
+  { service: "auth-audit", source: "auth_audit_logs" },
+  { service: "storage", source: "storage_logs" },
+  { service: "realtime", source: "realtime_logs" },
+  { service: "functions", source: "function_logs" },
+  { service: "function-edge", source: "function_edge_logs" },
+  { service: "supavisor", source: "supavisor_logs" },
+  { service: "pgbouncer", source: "pgbouncer_logs" },
+  { service: "pg-upgrade", source: "pg_upgrade_logs" },
+  { service: "compute", source: "", kinds: ["app", "requests", "builds"] },
+] as const;
+
+export const quoteLogValue = (value: string) =>
+  `'${value.replaceAll("\\", "\\\\").replaceAll("'", "''")}'`;
+
+export const hostedSeveritySql = `multiIf(
+  source = 'postgres_logs', multiIf(upper(log_attributes['parsed.error_severity']) in ('ERROR','FATAL','PANIC'), 'error', upper(log_attributes['parsed.error_severity']) = 'WARNING', 'warn', lower(log_attributes['parsed.error_severity'])),
+  source in ('edge_logs','function_edge_logs'), multiIf(toInt32OrZero(log_attributes['response.status_code']) >= 500, 'error', toInt32OrZero(log_attributes['response.status_code']) >= 400, 'warn', toInt32OrZero(log_attributes['response.status_code']) >= 100, 'info', ''),
+  source = 'auth_logs', multiIf(lower(log_attributes['level']) in ('error','fatal') or toInt32OrZero(log_attributes['status']) >= 500, 'error', lower(log_attributes['level']) in ('warn','warning') or toInt32OrZero(log_attributes['status']) >= 400, 'warn', lower(log_attributes['level'])),
+  source = 'function_logs', multiIf(lower(log_attributes['level']) in ('error','fatal'), 'error', lower(log_attributes['level']) in ('warn','warning'), 'warn', lower(log_attributes['level'])),
+  log_attributes['subservice'] = 'worker_ingress_logs', multiIf(toInt32OrZero(log_attributes['status']) >= 500, 'error', toInt32OrZero(log_attributes['status']) >= 400, 'warn', toInt32OrZero(log_attributes['status']) >= 100, 'info', ''),
+  log_attributes['subservice'] = 'worker_api_logs', if(log_attributes['event'] = 'build_failed', 'error', 'info'),
+  '')`;
+export const severityServices: ReadonlyArray<string> = [
+  "postgres",
+  "edge",
+  "auth",
+  "functions",
+  "function-edge",
+  "compute",
+];
diff --git a/apps/cli/src/commands/logs/logs.clipboard.integration.test.ts b/apps/cli/src/commands/logs/logs.clipboard.integration.test.ts
new file mode 100644
index 0000000000..78e26bd822
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.clipboard.integration.test.ts
@@ -0,0 +1,245 @@
+import process from "node:process";
+import { connect } from "node:net";
+import { BunServices } from "@effect/platform-bun";
+import { expect, it } from "@effect/vitest";
+import {
+  Deferred,
+  Effect,
+  Fiber,
+  FileSystem,
+  Layer,
+  PlatformError,
+  Schema,
+  Sink,
+  Stream,
+} from "effect";
+import { TestClock } from "effect/testing";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { mockRuntimeInfo } from "../../../tests/helpers/mocks.ts";
+import { LogsClipboard, logsClipboardLayer } from "./logs.clipboard.ts";
+
+const encodeScriptString = Schema.encodeSync(Schema.fromJsonString(Schema.String));
+const payload = JSON.stringify(
+  { message: "你好\nquote ' $(not a command)", metadata: { id: "full-record" } },
+  null,
+  2,
+);
+
+const adapter = (
+  platform: NodeJS.Platform,
+  exits: ReadonlyArray<number | "missing" | "pending">,
+) => {
+  const started = Deferred.makeUnsafe<void>();
+  const stopped = Deferred.makeUnsafe<void>();
+  const commands: Array<{
+    name: string;
+    args: ChildProcess.StandardCommand["args"];
+    text: string;
+    options: ChildProcess.CommandOptions;
+  }> = [];
+  const spawner = ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      if (command._tag !== "StandardCommand") return yield* Effect.die("Unexpected pipe");
+      const input = command.options.stdin;
+      if (!Stream.isStream(input)) return yield* Effect.die("Expected stdin stream");
+      const chunks = yield* Stream.runCollect(input);
+      commands.push({
+        name: command.command,
+        args: command.args,
+        text: chunks.map((chunk) => new TextDecoder().decode(chunk)).join(""),
+        options: command.options,
+      });
+      const code = exits[commands.length - 1] ?? 0;
+      if (code === "missing")
+        return yield* PlatformError.systemError({
+          _tag: "NotFound",
+          module: "ChildProcess",
+          method: "spawn",
+        });
+      return yield* Effect.acquireRelease(
+        Effect.succeed(
+          ChildProcessSpawner.makeHandle({
+            pid: ChildProcessSpawner.ProcessId(1),
+            exitCode:
+              code === "pending"
+                ? Deferred.succeed(started, undefined).pipe(Effect.andThen(Effect.never))
+                : Effect.succeed(ChildProcessSpawner.ExitCode(code)),
+            isRunning: Effect.succeed(false),
+            stdin: Sink.drain,
+            stdout: Stream.empty,
+            stderr: Stream.empty,
+            all: Stream.empty,
+            kill: () => Effect.void,
+            unref: Effect.succeed(Effect.void),
+            getInputFd: () => Sink.drain,
+            getOutputFd: () => Stream.empty,
+          }),
+        ),
+        () => Deferred.succeed(stopped, undefined),
+      );
+    }),
+  );
+  const layer = logsClipboardLayer.pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        mockRuntimeInfo({ platform }),
+        Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner),
+      ),
+    ),
+  );
+  return { commands, layer, started, stopped };
+};
+
+const platforms: ReadonlyArray<{ platform: NodeJS.Platform; name: string }> = [
+  { platform: "darwin", name: "pbcopy" },
+  { platform: "win32", name: "powershell.exe" },
+  { platform: "linux", name: "wl-copy" },
+];
+it.effect.each(platforms)(
+  "writes UTF-8 payload only through stdin on $platform",
+  ({ platform, name }) =>
+    Effect.gen(function* () {
+      const test = adapter(platform, [0]);
+      yield* LogsClipboard.use((clipboard) => clipboard.copy(payload)).pipe(
+        Effect.provide(test.layer),
+      );
+      expect(test.commands).toHaveLength(1);
+      expect(test.commands[0]?.name).toBe(name);
+      expect(test.commands[0]?.text).toBe(payload);
+      expect(test.commands[0]?.args.join(" ")).not.toContain("full-record");
+      expect(test.commands[0]?.options.stdout).toBe("ignore");
+      expect(test.commands[0]?.options.stderr).toBe("ignore");
+      expect(test.commands[0]?.options.shell).not.toBe(true);
+      if (platform === "win32") {
+        expect(test.commands[0]?.args).toContain("-STA");
+        expect(test.commands[0]?.args.join(" ")).toContain("$ErrorActionPreference='Stop'");
+        expect(test.commands[0]?.args.join(" ")).toContain("ReadToEnd()");
+      }
+      if (platform === "darwin")
+        expect(test.commands[0]?.options.env).toMatchObject({ LC_ALL: "en_US.UTF-8" });
+    }),
+);
+
+it.effect("falls back from unavailable Wayland to X11 and requires a successful native exit", () =>
+  Effect.gen(function* () {
+    const success = adapter("linux", ["missing", 0]);
+    yield* LogsClipboard.use((clipboard) => clipboard.copy(payload)).pipe(
+      Effect.provide(success.layer),
+    );
+    expect(success.commands.map((command) => command.name)).toEqual(["wl-copy", "xclip"]);
+    expect(success.commands[1]?.args).toEqual(["-selection", "clipboard", "-in"]);
+    expect(success.commands[1]?.text).toBe(payload);
+    const failure = adapter("darwin", [1]);
+    const error = yield* LogsClipboard.use((clipboard) => clipboard.copy(payload)).pipe(
+      Effect.provide(failure.layer),
+      Effect.flip,
+    );
+    expect(error.reason).toBe("failed");
+    expect(error.message).not.toContain("full-record");
+    const missing = adapter("linux", ["missing", "missing", "missing"]);
+    const unavailable = yield* LogsClipboard.use((clipboard) => clipboard.copy(payload)).pipe(
+      Effect.provide(missing.layer),
+      Effect.flip,
+    );
+    expect(unavailable.reason).toBe("unavailable");
+    expect(unavailable.message).toContain("Install wl-clipboard");
+  }),
+);
+
+it.live.skipIf(process.platform === "win32")(
+  "keeps a background clipboard owner alive after its helper exits successfully",
+  () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "clipboard-owner-" });
+      const socket = `${root}/owner.sock`;
+      const pidFile = `${root}/owner.pid`;
+      const real = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const owner = `const net=require('node:net'); const server=net.createServer(socket=>socket.on('data',()=>socket.write('clipboard owner alive'))); server.listen(${encodeScriptString(socket)},()=>process.send({pid:process.pid}));`;
+      const leader = `const {spawn}=require('node:child_process'); const fs=require('node:fs'); process.stdin.resume(); const owner=spawn(process.execPath,['-e',${encodeScriptString(owner)}],{stdio:['ignore','ignore','ignore','ipc']}); owner.once('message',({pid})=>{fs.writeFileSync(${encodeScriptString(pidFile)},String(pid));process.exit(0)}); owner.once('error',()=>process.exit(1));`;
+      let witnessed = false;
+      yield* Effect.addFinalizer(() =>
+        witnessed
+          ? Effect.void
+          : fs.readFileString(pidFile).pipe(
+              Effect.flatMap((text) =>
+                Effect.sync(() => {
+                  try {
+                    process.kill(Number(text), "SIGKILL");
+                  } catch {}
+                }),
+              ),
+              Effect.ignore,
+            ),
+      );
+      const proxy = ChildProcessSpawner.make((command) =>
+        command._tag === "StandardCommand"
+          ? real.spawn(ChildProcess.make(process.execPath, ["-e", leader], command.options))
+          : Effect.die("Unexpected clipboard pipeline"),
+      );
+      const layer = logsClipboardLayer.pipe(
+        Layer.provide(
+          Layer.mergeAll(
+            mockRuntimeInfo({ platform: "linux" }),
+            Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, proxy),
+          ),
+        ),
+      );
+      yield* LogsClipboard.use((clipboard) => clipboard.copy(payload)).pipe(Effect.provide(layer));
+      const ownerPid = Number(yield* fs.readFileString(pidFile));
+      const closed = yield* Deferred.make<void>();
+      const received = yield* Deferred.make<string>();
+      yield* Effect.acquireRelease(
+        Effect.sync(() => {
+          const client = connect(socket);
+          let reply = "";
+          client.once("close", () => {
+            Deferred.doneUnsafe(closed, Effect.void);
+          });
+          client.once("error", (error) => {
+            Deferred.doneUnsafe(received, Effect.die(error));
+          });
+          client.once("connect", () => client.write("ping"));
+          client.on("data", (bytes) => {
+            reply += bytes.toString();
+            if (reply === "clipboard owner alive")
+              Deferred.doneUnsafe(received, Effect.succeed(reply));
+          });
+          witnessed = true;
+          return client;
+        }),
+        (client) =>
+          Effect.sync(() => {
+            try {
+              process.kill(ownerPid, "SIGKILL");
+            } catch {}
+          }).pipe(
+            Effect.andThen(Deferred.await(closed).pipe(Effect.timeout("2 seconds"), Effect.orDie)),
+            Effect.ensuring(
+              Effect.sync(() => {
+                client.destroy();
+              }),
+            ),
+          ),
+      );
+      const response = yield* Deferred.await(received).pipe(Effect.timeout("2 seconds"));
+      expect(response).toBe("clipboard owner alive");
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("bounds a stalled native clipboard helper and releases its scope", () =>
+  Effect.gen(function* () {
+    const test = adapter("darwin", ["pending"]);
+    const fiber = yield* LogsClipboard.use((clipboard) => clipboard.copy(payload)).pipe(
+      Effect.provide(test.layer),
+      Effect.flip,
+      Effect.forkScoped,
+    );
+    yield* Deferred.await(test.started);
+    yield* TestClock.adjust("3 seconds");
+    const error = yield* Fiber.join(fiber);
+    expect(error.reason).toBe("timeout");
+    expect(error.message).toBe("Copy timed out; check clipboard access.");
+    yield* Deferred.await(test.stopped);
+  }),
+);
diff --git a/apps/cli/src/commands/logs/logs.clipboard.ts b/apps/cli/src/commands/logs/logs.clipboard.ts
new file mode 100644
index 0000000000..46aeb248d4
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.clipboard.ts
@@ -0,0 +1,96 @@
+import { Context, Effect, Layer, Stream } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { RuntimeInfo } from "../../shared/runtime/runtime-info.service.ts";
+import { withChildTraceEnv, withProcessSpan } from "../../shared/telemetry/spans.ts";
+import { LogsClipboardError } from "./logs.errors.ts";
+
+export class LogsClipboard extends Context.Service<
+  LogsClipboard,
+  {
+    readonly copy: (text: string) => Effect.Effect<void, LogsClipboardError>;
+  }
+>()("supabase/logs/Clipboard") {}
+
+export const logsClipboardLayer = Layer.effect(
+  LogsClipboard,
+  Effect.gen(function* () {
+    const runtime = yield* RuntimeInfo;
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const windowsScript =
+      "$ErrorActionPreference='Stop'; [Console]::InputEncoding=[System.Text.UTF8Encoding]::new($false); Set-Clipboard -Value ([Console]::In.ReadToEnd())";
+    const commands: ReadonlyArray<readonly [string, ReadonlyArray<string>]> =
+      runtime.platform === "darwin"
+        ? [["pbcopy", []]]
+        : runtime.platform === "win32"
+          ? [
+              [
+                "powershell.exe",
+                ["-NoProfile", "-NonInteractive", "-STA", "-Command", windowsScript],
+              ],
+            ]
+          : runtime.platform === "linux"
+            ? [
+                ["wl-copy", []],
+                ["xclip", ["-selection", "clipboard", "-in"]],
+                ["xsel", ["--clipboard", "--input"]],
+              ]
+            : [];
+    return LogsClipboard.of({
+      copy: Effect.fn("Logs.clipboard.copy")(
+        function* (text) {
+          let failed = false;
+          for (const [executable, args] of commands) {
+            const result = yield* withProcessSpan(
+              "Logs.clipboard.write",
+              { executable, argCount: args.length, hasFallback: true },
+              (traceEnv) =>
+                spawner.exitCode(
+                  ChildProcess.make(
+                    executable,
+                    args,
+                    withChildTraceEnv(
+                      {
+                        stdin: Stream.make(new TextEncoder().encode(text)),
+                        detached: false,
+                        stdout: "ignore",
+                        stderr: "ignore",
+                        forceKillAfter: "250 millis",
+                        env: runtime.platform === "darwin" ? { LC_ALL: "en_US.UTF-8" } : undefined,
+                        extendEnv: true,
+                      },
+                      traceEnv,
+                    ),
+                  ),
+                ),
+            ).pipe(Effect.result);
+            if (result._tag === "Success") {
+              if (result.success === 0) return;
+              failed = true;
+            } else if (result.failure.reason._tag !== "NotFound") failed = true;
+          }
+          return yield* new LogsClipboardError({
+            reason: failed ? "failed" : "unavailable",
+            message: failed
+              ? "Copy failed; check clipboard access."
+              : runtime.platform === "linux"
+                ? "Install wl-clipboard, xclip, or xsel to copy."
+                : "Clipboard tool unavailable; check system tools.",
+          });
+        },
+        (effect) =>
+          effect.pipe(
+            Effect.timeoutOrElse({
+              duration: "3 seconds",
+              orElse: () =>
+                Effect.fail(
+                  new LogsClipboardError({
+                    reason: "timeout",
+                    message: "Copy timed out; check clipboard access.",
+                  }),
+                ),
+            }),
+          ),
+      ),
+    });
+  }),
+);
diff --git a/apps/cli/src/commands/logs/logs.command.ts b/apps/cli/src/commands/logs/logs.command.ts
new file mode 100644
index 0000000000..a8d9f9452a
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.command.ts
@@ -0,0 +1,217 @@
+import { OptionalSubcommand } from "../../shared/output/optional-subcommand-usage.ts";
+import { Layer } from "effect";
+import { Command, Flag } from "effect/cli";
+import type * as CliCommand from "effect/cli/Command";
+import { GLOBAL_OUTPUT_FORMATS } from "../../command-internal/global-flags.ts";
+import { withPermissions } from "../../command-internal/command-permissions/command-permissions.annotation.ts";
+import { compose } from "../../command-internal/command-permissions/model.ts";
+import { identityStitchLayer } from "../../command-internal/identity-stitch.ts";
+import { projectRefPicker } from "../../config/project-ref.layer.ts";
+import { linkedProjectCache } from "../../telemetry/linked-project-cache.layer.ts";
+import { branchResolution } from "../../command-internal/target/branch-resolution.ts";
+import { targetFlags } from "../../command-internal/target/target-flags.ts";
+import { withTargetPolicy } from "../../command-internal/target/target-policy.ts";
+import { withCommandTelemetry } from "../../telemetry/command-telemetry.ts";
+import { withJsonErrorHandling } from "../../shared/output/json-error-handling.ts";
+import { linkedDbResolverRuntimeLayer } from "../../command-internal/management-api-runtime.layer.ts";
+import { stdinLayer } from "../../shared/runtime/stdin.layer.ts";
+import { stackTargetResolverLayer, stackApiLayer } from "../../command-internal/stack-target.ts";
+import { logsTerminalLayer } from "./logs.browser.ts";
+import { logsClipboardLayer } from "./logs.clipboard.ts";
+import { logs, logsSources } from "./logs.handler.ts";
+
+const stackFlags = {
+  stack: Flag.String("stack").pipe(
+    Flag.withDescription("Select a local stack by name."),
+    Flag.optional,
+  ),
+  stackId: Flag.String("stack-id").pipe(
+    Flag.withDescription("Select a local stack by ID."),
+    Flag.optional,
+  ),
+};
+const config = {
+  ...targetFlags({ subject: "log source", dbUrl: false }),
+  ...stackFlags,
+  service: Flag.String("service").pipe(
+    Flag.withDescription("Service selector; repeat for multiple services. See logs sources."),
+    Flag.atLeast(0),
+  ),
+  resource: Flag.String("resource").pipe(
+    Flag.withDescription("Compute name or function ID remotely, or a local instance ID."),
+    Flag.optional,
+  ),
+  kind: Flag.Literals("kind", ["app", "requests", "builds"]).pipe(
+    Flag.withDescription("Compute stream; requires --service compute."),
+    Flag.optional,
+  ),
+  level: Flag.Literals("level", [
+    "error",
+    "warn",
+    "warning",
+    "info",
+    "debug",
+    "log",
+    "notice",
+  ]).pipe(Flag.withDescription("Severity filter; repeat for several levels."), Flag.atLeast(0)),
+  search: Flag.String("search").pipe(
+    Flag.withDescription("Case-insensitive message substring (hosted only)."),
+    Flag.optional,
+  ),
+  since: Flag.String("since").pipe(
+    Flag.withDescription(
+      "Duration or UTC timestamp; defaults to 1h. Local stacks also accept start.",
+    ),
+    Flag.optional,
+  ),
+  from: Flag.String("from").pipe(
+    Flag.withDescription("Start at a UTC timestamp ending in Z."),
+    Flag.optional,
+  ),
+  to: Flag.String("to").pipe(
+    Flag.withDescription("Initial end at a UTC timestamp ending in Z. L advances to now."),
+    Flag.optional,
+  ),
+  limit: Flag.Int("limit").pipe(
+    Flag.withDescription(
+      "Initial filtered history count (default 100, maximum 1000). SQL controls its own LIMIT.",
+    ),
+    Flag.filter(
+      (value) => value >= 1 && value <= 1000,
+      () => "--limit must be between 1 and 1000.",
+    ),
+    Flag.withDefault(100),
+  ),
+  sql: Flag.String("sql").pipe(
+    Flag.withDescription("Custom hosted log SQL; requires --remote. L reruns the query."),
+    Flag.optional,
+  ),
+  file: Flag.String("file").pipe(
+    Flag.withDescription("Read custom hosted log SQL from a file; use - to read stdin."),
+    Flag.optional,
+  ),
+};
+const sourcesConfig = {
+  ...targetFlags({ subject: "log source", dbUrl: false }),
+  ...stackFlags,
+  service: Flag.String("service").pipe(
+    Flag.withDescription("Describe one service."),
+    Flag.optional,
+  ),
+};
+
+export type LogsSourcesFlags = CliCommand.Command.Config.Infer<typeof sourcesConfig>;
+
+const readPermissions = (flags: ReadonlyArray<string>) =>
+  compose(
+    {
+      operations: [
+        {
+          operationId: "v1-get-project-logs",
+          kind: "required",
+          context: "the hosted target is selected",
+        },
+      ],
+      noApiEffectFlags: [...flags],
+    },
+    projectRefPicker,
+    linkedProjectCache,
+    branchResolution,
+  );
+
+const logsReadFlags = [
+  "stack",
+  "stack-id",
+  "service",
+  "resource",
+  "kind",
+  "level",
+  "search",
+  "since",
+  "from",
+  "to",
+  "limit",
+  "sql",
+  "file",
+];
+
+export const logsCommandFor = () =>
+  Command.make("logs", config).pipe(
+    Command.annotate(OptionalSubcommand, true),
+    Command.withDescription(
+      "Browse local or hosted logs. Arrows select, Enter details, C copies, L loads more logs, and q quits. Custom SQL uses L to rerun. Pipes and machine output read once. Explicit --output-format text disables the viewer. Use --output-format json|stream-json for structured output; -o/--output is unsupported.",
+    ),
+    Command.withExamples([
+      {
+        command: "supabase logs --remote --service postgres --level error --since 30m",
+        description: "Browse hosted Postgres errors",
+      },
+      {
+        command:
+          'supabase logs --remote --service auth --search "invalid token" --output-format text',
+        description: "Read plain text once",
+      },
+      {
+        command: "supabase logs --remote --service postgres --output-format json",
+        description: "Export full records as JSON",
+      },
+      {
+        command: "cat errors.sql | supabase logs --remote --file - --output-format json",
+        description: "Query hosted logs with SQL from stdin",
+      },
+    ]),
+    withPermissions(readPermissions(logsReadFlags)),
+    Command.withHandler((flags) =>
+      logs(flags).pipe(
+        withCommandTelemetry({ flags, config, outputFormats: GLOBAL_OUTPUT_FORMATS }),
+        withJsonErrorHandling,
+      ),
+    ),
+    Command.provide(logsTerminalLayer),
+    Command.provide(logsClipboardLayer),
+    Command.provide(stdinLayer),
+    Command.provide(stackTargetResolverLayer.pipe(Layer.provideMerge(stackApiLayer))),
+    Command.provide(
+      linkedDbResolverRuntimeLayer(["logs"]).pipe(Layer.provide(identityStitchLayer)),
+    ),
+    withTargetPolicy({
+      group: "selectable",
+      consent: "none",
+      consentExemptReason: "Reads logs without mutating the selected target.",
+    }),
+    Command.withSubcommands([
+      Command.make("sources", sourcesConfig).pipe(
+        Command.withDescription(
+          "List supported sources and filters. Hosted entries describe capabilities and do not imply that rows exist. Local entries list retained stack instances. Use --output-format json|stream-json for structured output; -o/--output is unsupported.",
+        ),
+        withPermissions(
+          compose(
+            { operations: [], noApiEffectFlags: logsReadFlags },
+            projectRefPicker,
+            branchResolution,
+          ),
+        ),
+        Command.withHandler((flags) =>
+          logsSources(flags).pipe(
+            withCommandTelemetry({
+              flags,
+              config: sourcesConfig,
+              outputFormats: GLOBAL_OUTPUT_FORMATS,
+            }),
+            withJsonErrorHandling,
+          ),
+        ),
+        Command.provide(stackTargetResolverLayer.pipe(Layer.provideMerge(stackApiLayer))),
+        Command.provide(
+          linkedDbResolverRuntimeLayer(["logs", "sources"]).pipe(
+            Layer.provide(identityStitchLayer),
+          ),
+        ),
+        withTargetPolicy({
+          group: "selectable",
+          consent: "none",
+          consentExemptReason: "Lists log capabilities without mutating the selected target.",
+        }),
+      ),
+    ]),
+  );
diff --git a/apps/cli/src/commands/logs/logs.compatibility.integration.test.ts b/apps/cli/src/commands/logs/logs.compatibility.integration.test.ts
new file mode 100644
index 0000000000..6cc7e4285e
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.compatibility.integration.test.ts
@@ -0,0 +1,44 @@
+import { BunServices } from "@effect/platform-bun";
+import { expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Layer, Option, Stdio } from "effect";
+import { Command } from "effect/cli";
+import { computeLogsCommand } from "../experimental/compute/logs/logs.command.ts";
+import { mockOutput } from "../../../tests/helpers/mocks.ts";
+import {
+  mockCommandSettings,
+  mockCommandPlatformApi,
+  buildTestRuntime,
+} from "../../../tests/helpers/command-mocks.ts";
+
+it.live("preserves bounded legacy compute defaults through the parser", () =>
+  Effect.gen(function* () {
+    const workdir = yield* (yield* FileSystem.FileSystem).makeTempDirectoryScoped({
+      prefix: "logs-compat-parser-",
+    });
+    let reached = false;
+    const command = computeLogsCommand.pipe(
+      Command.withHandler((flags) =>
+        Effect.sync(() => {
+          reached = true;
+          expect(flags).toMatchObject({ name: "api", tail: 100, follow: false });
+          expect(Option.isNone(flags.kind)).toBe(true);
+        }),
+      ),
+    );
+    const args = ["logs", "api"];
+    const root = Command.make("supabase").pipe(Command.withSubcommands([command]));
+    yield* Command.runWith(root, { version: "test" })(args).pipe(
+      Effect.provide(
+        Layer.mergeAll(
+          buildTestRuntime({
+            out: mockOutput(),
+            api: mockCommandPlatformApi({ response: { status: 200, body: {} } }),
+            cliSettings: mockCommandSettings({ workdir }),
+          }),
+          Stdio.layerTest({ args: Effect.succeed(args) }),
+        ),
+      ),
+    );
+    expect(reached).toBe(true);
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
diff --git a/apps/cli/src/commands/logs/logs.copy.integration.test.ts b/apps/cli/src/commands/logs/logs.copy.integration.test.ts
new file mode 100644
index 0000000000..ec639e9b22
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.copy.integration.test.ts
@@ -0,0 +1,204 @@
+import { expect, it } from "@effect/vitest";
+import { Cause, Deferred, Effect, Fiber, Layer, Option, Queue, Schema, Terminal } from "effect";
+import { mockOutput, mockProcessControl } from "../../../tests/helpers/mocks.ts";
+import { browseLogs } from "./logs.browser.ts";
+import { LogsClipboard } from "./logs.clipboard.ts";
+import { LogsClipboardError } from "./logs.errors.ts";
+
+const key = (name: string, modifiers: Partial<Terminal.Key> = {}): Terminal.UserInput => ({
+  input: Option.none(),
+  key: { name, ctrl: false, meta: false, shift: false, ...modifiers },
+});
+const decodeRecord = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.JsonObject));
+const first = {
+  id: "first",
+  timestamp: "2026-11-03T16:51:32.123456Z",
+  event_message: "你好\nfull first log",
+  metadata: { nested: [1, true, { trace_id: "correlation" }] },
+};
+const second = {
+  id: "second",
+  timestamp: "2026-11-03T16:51:33Z",
+  event_message: "second log",
+  metadata: { raw: "\u001b[31mraw control", long: "z".repeat(1000) },
+};
+const setup = Effect.fnUntraced(function* (
+  produce: (
+    pass: number,
+    emit: (row: Schema.JsonObject) => Effect.Effect<void>,
+  ) => Effect.Effect<void>,
+  copy: (text: string) => Effect.Effect<void, LogsClipboardError>,
+) {
+  const input = yield* Queue.unbounded<Terminal.UserInput>();
+  const screens = yield* Queue.unbounded<string>();
+  const control = mockProcessControl();
+  let pass = 0;
+  const fiber = yield* browseLogs(
+    {
+      mode: "append",
+      load: (_end, emit) =>
+        produce(++pass, emit).pipe(
+          Effect.as({ kind: "range", start: "2026-11-03T16:00:00Z", end: "2026-11-04T00:00:00Z" }),
+        ),
+    },
+    0,
+  ).pipe(
+    Effect.provideService(
+      Terminal.Terminal,
+      Terminal.make({
+        columns: Effect.succeed(80),
+        rows: Effect.succeed(12),
+        size: Queue.unbounded<Terminal.Size, Cause.Done>(),
+        readInput: Effect.succeed(input),
+        readLine: Effect.die("unused"),
+        display: (text) => Queue.offer(screens, text).pipe(Effect.asVoid),
+      }),
+    ),
+    Effect.provide(
+      Layer.mergeAll(Layer.succeed(LogsClipboard, { copy }), mockOutput().layer, control.layer),
+    ),
+    Effect.forkScoped,
+  );
+  let ready = "";
+  while (!ready.includes(" | ready")) ready = yield* Queue.take(screens);
+  return { input, screens, fiber, control };
+});
+const initial = (_pass: number, emit: (row: Schema.JsonObject) => Effect.Effect<void>) =>
+  Effect.forEach([first, second], emit, { discard: true });
+
+it.effect("copies complete selected records, snapshots pending copies, and preserves Ctrl-C", () =>
+  Effect.gen(function* () {
+    const copied = yield* Queue.unbounded<string>();
+    const release = yield* Deferred.make<void>();
+    let copies = 0;
+    const ui = yield* setup(initial, (text) =>
+      Effect.gen(function* () {
+        copies++;
+        yield* Queue.offer(copied, text);
+        yield* Deferred.await(release);
+      }),
+    );
+    yield* Queue.offer(ui.input, key("c"));
+    expect(yield* Queue.take(ui.screens)).toContain("Copying log…");
+    const captured = yield* Queue.take(copied);
+    expect(decodeRecord(captured)).toEqual(second);
+    expect(captured).toContain('\n  "metadata": {\n');
+    yield* Queue.offer(ui.input, key("up"));
+    expect(yield* Queue.take(ui.screens)).toContain("> Nov 03 - 16:51:32 UTC");
+    yield* Queue.offer(ui.input, key("c"));
+    yield* Queue.take(ui.screens);
+    expect(copies).toBe(1);
+    yield* Deferred.succeed(release, undefined);
+    expect(yield* Queue.take(ui.screens)).toContain("Copied log to clipboard.");
+    yield* Queue.offer(ui.input, key("return"));
+    yield* Queue.take(ui.screens);
+    yield* Queue.offer(ui.input, key("C", { shift: true }));
+    yield* Queue.take(ui.screens);
+    expect(decodeRecord(yield* Queue.take(copied))).toEqual(first);
+    yield* Queue.take(ui.screens);
+    yield* Queue.offer(ui.input, key("c", { meta: true }));
+    yield* Queue.take(ui.screens);
+    expect(copies).toBe(2);
+    yield* Queue.offer(ui.input, key("c", { ctrl: true }));
+    yield* Fiber.join(ui.fiber);
+    expect(ui.control.exitCode).toBe(130);
+    expect(copies).toBe(2);
+  }),
+);
+
+it.effect("copies pinned details after a manual refresh evicts their original row", () =>
+  Effect.gen(function* () {
+    const copied = yield* Queue.unbounded<string>();
+    const ui = yield* setup(
+      (pass, emit) =>
+        pass === 1
+          ? emit(first)
+          : Effect.forEach(
+              Array.from({ length: 1100 }, (_, index) => index),
+              (index) =>
+                emit({
+                  id: `replacement-${index}`,
+                  ts_ms: Date.parse("2026-11-04T00:00:00Z") + index,
+                  message: `replacement-${index}`,
+                }),
+              { discard: true },
+            ),
+      (text) => Queue.offer(copied, text).pipe(Effect.asVoid),
+    );
+    yield* Queue.offer(ui.input, key("return"));
+    expect(yield* Queue.take(ui.screens)).toContain("Log details");
+    yield* Queue.offer(ui.input, key("L"));
+    let loaded = "";
+    while (!loaded.includes("1100 new logs loaded.")) loaded = yield* Queue.take(ui.screens);
+    yield* Queue.offer(ui.input, key("C"));
+    yield* Queue.take(ui.screens);
+    expect(decodeRecord(yield* Queue.take(copied))).toEqual(first);
+    expect(yield* Queue.take(ui.screens)).toContain("Copied log to clipboard.");
+    yield* Queue.offer(ui.input, key("escape"));
+    const retained = yield* Queue.take(ui.screens);
+    expect(retained).toContain("replacement-100");
+    expect(retained).not.toContain("full first log");
+    yield* Queue.offer(ui.input, key("q"));
+    yield* Fiber.join(ui.fiber);
+  }),
+);
+
+it.effect("reports copy failure visibly and permits navigation and retry", () =>
+  Effect.gen(function* () {
+    let attempts = 0;
+    const ui = yield* setup(initial, () =>
+      ++attempts > 1
+        ? Effect.void
+        : Effect.fail(
+            new LogsClipboardError({
+              reason: "unavailable",
+              message: "Install wl-clipboard, xclip, or xsel to copy.",
+            }),
+          ),
+    );
+    yield* Queue.offer(ui.input, key("c"));
+    yield* Queue.take(ui.screens);
+    const footer = (yield* Queue.take(ui.screens)).split("\r\n").at(-1);
+    expect(footer).toContain("Install wl-clipboard");
+    expect(footer).toContain("L load more");
+    expect(footer).toContain("C copy · q quit");
+    yield* Queue.offer(ui.input, key("up"));
+    expect(yield* Queue.take(ui.screens)).toContain("> Nov 03 - 16:51:32 UTC");
+    yield* Queue.offer(ui.input, key("c"));
+    yield* Queue.take(ui.screens);
+    expect(yield* Queue.take(ui.screens)).toContain("Copied log to clipboard.");
+    expect(attempts).toBe(2);
+    yield* Queue.offer(ui.input, key("q"));
+    yield* Fiber.join(ui.fiber);
+  }),
+);
+
+it.effect("ignores empty copy and cancels pending clipboard work on quit", () =>
+  Effect.gen(function* () {
+    const ready = yield* Deferred.make<void>();
+    const stopped = yield* Deferred.make<void>();
+    let copies = 0;
+    const ui = yield* setup(
+      (pass, emit) => (pass === 1 ? Effect.void : emit(first)),
+      () =>
+        Effect.gen(function* () {
+          copies++;
+          yield* Deferred.succeed(ready, undefined);
+          return yield* Effect.never;
+        }).pipe(Effect.ensuring(Deferred.succeed(stopped, undefined))),
+    );
+    yield* Queue.offer(ui.input, key("c"));
+    expect(yield* Queue.take(ui.screens)).toContain("No log rows.");
+    expect(copies).toBe(0);
+    yield* Queue.offer(ui.input, key("L"));
+    let loaded = "";
+    while (!loaded.includes("1 new log loaded.")) loaded = yield* Queue.take(ui.screens);
+    yield* Queue.offer(ui.input, key("c"));
+    yield* Queue.take(ui.screens);
+    yield* Deferred.await(ready);
+    yield* Queue.offer(ui.input, key("q"));
+    yield* Fiber.join(ui.fiber);
+    yield* Deferred.await(stopped);
+    expect(copies).toBe(1);
+  }),
+);
diff --git a/apps/cli/src/commands/logs/logs.display.ts b/apps/cli/src/commands/logs/logs.display.ts
new file mode 100644
index 0000000000..54aa8dec49
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.display.ts
@@ -0,0 +1,113 @@
+import type { Schema } from "effect";
+import { renderTablewriter } from "../../command-internal/tabular-output.ts";
+import { stringWidth } from "../../command-internal/string-width.ts";
+import { stripControlSequences } from "../../shared/output/strip-control-sequences.ts";
+
+const clean = (text: string) => stripControlSequences(text).replaceAll("\t", "    ");
+
+export function wrapLogsText(text: string, width: number): string {
+  const limit = Math.max(2, Math.floor(width));
+  return clean(text)
+    .split("\n")
+    .map((line) => {
+      const lines: string[] = [];
+      let current = "";
+      let used = 0;
+      for (const token of line.match(/\S+\s*|\s+/gu) ?? []) {
+        if (used > 0 && used + stringWidth(token) > limit) {
+          lines.push(current);
+          current = "";
+          used = 0;
+        }
+        for (const character of token) {
+          const size = stringWidth(character);
+          if (used > 0 && used + size > limit) {
+            lines.push(current);
+            current = "";
+            used = 0;
+          }
+          current += character;
+          used += size;
+        }
+      }
+      return [...lines, current].join("\n");
+    })
+    .join("\n");
+}
+
+const queryValue = (value: Schema.Json | undefined): string =>
+  value === undefined ? "" : typeof value === "string" ? clean(value) : JSON.stringify(value);
+
+function renderFields(fields: ReadonlyArray<readonly [string, string]>, width: number): string {
+  return fields
+    .map(([label, value]) => {
+      const heading = wrapLogsText(`${label}:`, width);
+      const content = wrapLogsText(value, width - 2)
+        .split("\n")
+        .map((line) => `  ${line}`)
+        .join("\n");
+      return `${heading}\n${content}`;
+    })
+    .join("\n");
+}
+
+export function renderLogsRows(rows: ReadonlyArray<Schema.JsonObject>, width: number): string {
+  const columns = [...new Set(rows.flatMap((row) => Object.keys(row)))];
+  const nested = rows.some((row) =>
+    Object.values(row).some((value) => value !== null && typeof value === "object"),
+  );
+  if (!nested && columns.every((column) => !clean(column).includes("\n"))) {
+    const values = rows.map((row) => columns.map((column) => queryValue(row[column])));
+    const widths = columns.map((column, index) =>
+      Math.max(
+        stringWidth(clean(column)),
+        ...values.flatMap((row) => (row[index] ?? "").split("\n").map(stringWidth)),
+      ),
+    );
+    if (widths.reduce((sum, size) => sum + size + 3, 1) <= width)
+      return renderTablewriter(columns.map(clean), values, (value) => String(value));
+  }
+  return rows
+    .map((row, index) => {
+      const fields = Object.entries(row).map(([key, value]): readonly [string, string] => [
+        clean(key),
+        typeof value === "string" ? value : JSON.stringify(value, null, 2),
+      ]);
+      return `${wrapLogsText(`Row ${index + 1}`, width)}\n${renderFields(fields, width)}\n`;
+    })
+    .join("\n");
+}
+
+const sourceValue = (value: Schema.Json | undefined): string =>
+  Array.isArray(value)
+    ? value.map(String).join(", ") || "None"
+    : value == null
+      ? "None"
+      : String(value);
+
+export function renderLogsSources(
+  rows: ReadonlyArray<Schema.JsonObject>,
+  detail: boolean,
+  width: number,
+): string {
+  if (detail) {
+    return (
+      rows
+        .map((row) =>
+          renderFields(
+            Object.entries(row).map(([key, value]) => [
+              key === "sql" ? "SQL" : key.charAt(0).toUpperCase() + key.slice(1),
+              sourceValue(value),
+            ]),
+            width,
+          ),
+        )
+        .join("\n\n") + "\n"
+    );
+  }
+  const overview = rows.map((row): Schema.JsonObject => {
+    const fields = { service: row["service"] ?? "", kinds: sourceValue(row["kinds"]) };
+    return row["resource"] === undefined ? fields : { ...fields, resource: row["resource"] };
+  });
+  return `${renderLogsRows(overview, width)}\n${wrapLogsText("Use --service <service> for SQL and supported filters.", width)}\n`;
+}
diff --git a/apps/cli/src/commands/logs/logs.display.unit.test.ts b/apps/cli/src/commands/logs/logs.display.unit.test.ts
new file mode 100644
index 0000000000..ac41c79e37
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.display.unit.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, it } from "vitest";
+import { stringWidth } from "../../command-internal/string-width.ts";
+import { renderLogsRows, renderLogsSources, wrapLogsText } from "./logs.display.ts";
+
+describe("readable logs output", () => {
+  for (const width of [80, 120]) {
+    it(`preserves long Unicode messages and nested values within ${width} columns`, () => {
+      const message = "界🙂e\u0301".repeat(70);
+      const nested = { request: { path: "/" + "x".repeat(160), ok: true }, tags: ["auth", "db"] };
+      const output = renderLogsRows([{ event_message: message, log_attributes: nested }], width);
+      expect(output.split("\n").every((line) => stringWidth(line) <= width)).toBe(true);
+      expect(output).toContain("Row 1\nevent_message:\n");
+      expect(output.replaceAll("\n", "").replaceAll(" ", "")).toContain(message);
+      const attributes = output.split("log_attributes:\n")[1];
+      expect(
+        JSON.parse(
+          attributes
+            ?.trimEnd()
+            .split("\n")
+            .map((line) => line.slice(2))
+            .join("") ?? "",
+        ),
+      ).toEqual(nested);
+    });
+
+    it(`wraps full source details and lists capabilities as words at ${width} columns`, () => {
+      const sql =
+        "logs WHERE log_attributes['subservice'] IN ('worker_guest_logs','worker_ingress_logs','worker_api_logs')";
+      const output = renderLogsSources(
+        [
+          {
+            service: "compute",
+            sql,
+            filters: ["service", "resource", "kind", "level", "search", "since"],
+            kinds: ["app", "requests", "builds"],
+            severity: "Derived for requests/builds; app severity is unknown.",
+          },
+        ],
+        true,
+        width,
+      );
+      expect(output.split("\n").every((line) => stringWidth(line) <= width)).toBe(true);
+      expect(output).toContain("Filters:\n  service, resource, kind, level, search, since");
+      expect(output).toContain("Kinds:\n  app, requests, builds");
+      const actualSql = output.split("SQL:\n")[1]?.split("\nFilters:")[0];
+      expect(
+        actualSql
+          ?.split("\n")
+          .map((line) => line.slice(2))
+          .join(""),
+      ).toBe(sql);
+    });
+  }
+
+  it("keeps small scalar results tabular and removes terminal control codes from aliases and values", () => {
+    const output = renderLogsRows([{ "\u001b[31mcount\u001b[0m": 3, message: "a\tb" }], 80);
+    expect(output).toContain("│ count │ message │");
+    expect(output).toContain("│ 3     │ a    b  │");
+    expect(output).not.toContain("\u001b");
+    const multiline = renderLogsRows([{ "a\nb": 1 }], 80);
+    expect(multiline).toBe("Row 1\na\nb:\n  1\n");
+  });
+
+  it("uses available width to choose a table or full wrapped scalar record", () => {
+    const message = "x".repeat(90);
+    const narrow = renderLogsRows([{ message }], 80);
+    expect(narrow).toContain("Row 1\nmessage:");
+    expect(narrow.split("\n").every((line) => stringWidth(line) <= 80)).toBe(true);
+    expect(narrow.replaceAll("\n", "").replaceAll(" ", "")).toContain(message);
+    const wide = renderLogsRows([{ message }], 120);
+    expect(wide).toContain(`│ ${message} │`);
+    expect(wide).not.toContain("Row 1");
+  });
+
+  it("shows a compact overview with discoverable service details", () => {
+    const output = renderLogsSources(
+      [{ service: "postgres", sql: "not in overview", filters: ["service"], kinds: [] }],
+      false,
+      80,
+    );
+    expect(output).toContain("postgres");
+    expect(output).toContain("Use --service <service>");
+    expect(output).not.toContain("not in overview");
+    expect(output).not.toContain("│ filters");
+  });
+
+  it("wraps human tail lines without losing spaces or multiline content", () => {
+    const line = "2026-11-02T12:00:00Z postgres " + "hello world ".repeat(20) + "\nlast line";
+    const output = wrapLogsText(line, 80);
+    expect(output.split("\n").every((part) => stringWidth(part) <= 80)).toBe(true);
+    expect(output.replaceAll("\n", "")).toBe(line.replaceAll("\n", ""));
+  });
+});
diff --git a/apps/cli/src/commands/logs/logs.eligibility.unit.test.ts b/apps/cli/src/commands/logs/logs.eligibility.unit.test.ts
new file mode 100644
index 0000000000..6139bc5177
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.eligibility.unit.test.ts
@@ -0,0 +1,28 @@
+import { expect, it } from "@effect/vitest";
+import { ConfigProvider, Effect, Layer, Option } from "effect";
+import { OutputFormatFlag } from "../../command-internal/global-flags.ts";
+import { mockOutput, mockTty } from "../../../tests/helpers/mocks.ts";
+import { useLogsBrowser } from "./logs.browser.ts";
+
+it.effect.each([
+  { explicit: false, env: {}, expected: true },
+  { explicit: true, env: {}, expected: false },
+  { explicit: false, env: { CI: "true" }, expected: false },
+  { explicit: false, env: { TERM: "dumb" }, expected: false },
+  { explicit: false, env: { CI: "false", TERM: "xterm" }, expected: true },
+])(
+  "selects browser with explicit text $explicit and environment $env",
+  ({ explicit, env, expected }) =>
+    Effect.gen(function* () {
+      expect(yield* useLogsBrowser()).toBe(expected);
+    }).pipe(
+      Effect.provide(
+        Layer.mergeAll(
+          mockOutput({ format: "text", interactive: true }).layer,
+          mockTty({ stdinIsTty: true, stdoutIsTty: true }),
+          Layer.succeed(OutputFormatFlag, explicit ? Option.some("text") : Option.none()),
+          ConfigProvider.layer(ConfigProvider.fromUnknown(env)),
+        ),
+      ),
+    ),
+);
diff --git a/apps/cli/src/commands/logs/logs.errors.ts b/apps/cli/src/commands/logs/logs.errors.ts
new file mode 100644
index 0000000000..76e07c555a
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.errors.ts
@@ -0,0 +1,43 @@
+import { Schema } from "effect";
+import {
+  actionability,
+  ErrorActionabilityId,
+  statusCodeActionability,
+} from "../../shared/telemetry/error-actionability.ts";
+
+export class LogsInputError extends Schema.TaggedError<LogsInputError>()("LogsInputError", {
+  message: Schema.String,
+}) {
+  get [ErrorActionabilityId]() {
+    return actionability.invalidInput;
+  }
+}
+
+export class LogsApiError extends Schema.TaggedError<LogsApiError>()("LogsApiError", {
+  message: Schema.String,
+  status: Schema.Finite,
+  reason: Schema.optionalKey(Schema.Literals(["response", "query"])),
+  retryAfterMs: Schema.optionalKey(Schema.Finite),
+}) {
+  get [ErrorActionabilityId]() {
+    return this.reason === "query"
+      ? actionability.invalidInput
+      : this.reason === "response"
+        ? { ...actionability.apiStatus, fingerprint_suffix: "api_response" }
+        : statusCodeActionability(this.status);
+  }
+}
+
+export class LogsClipboardError extends Schema.TaggedError<LogsClipboardError>()(
+  "LogsClipboardError",
+  {
+    reason: Schema.Literals(["unavailable", "failed", "timeout"]),
+    message: Schema.String,
+  },
+) {
+  get [ErrorActionabilityId]() {
+    return this.reason === "unavailable"
+      ? actionability.toolNotInstalled
+      : actionability.toolFailed;
+  }
+}
diff --git a/apps/cli/src/commands/logs/logs.format.ts b/apps/cli/src/commands/logs/logs.format.ts
new file mode 100644
index 0000000000..41c8a7e032
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.format.ts
@@ -0,0 +1,47 @@
+import { DateTime, Option } from "effect";
+import { parseSince } from "../../command-internal/logs/since.ts";
+import { LogsInputError } from "./logs.errors.ts";
+import { Effect } from "effect";
+
+export const logsWindow = Effect.fnUntraced(function* (
+  options: {
+    readonly since: Option.Option<string>;
+    readonly from?: Option.Option<string>;
+    readonly to?: Option.Option<string>;
+  },
+  now: number,
+  maximumDuration = 86_400_000,
+) {
+  const from = Option.getOrUndefined(options.from ?? Option.none());
+  const to = Option.getOrUndefined(options.to ?? Option.none());
+  if (Option.isSome(options.since) && (from !== undefined || to !== undefined))
+    return yield* new LogsInputError({ message: "Use --since or --from/--to, not both." });
+  const utc = (value: string) =>
+    /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/.test(value)
+      ? Option.getOrUndefined(DateTime.make(value))
+      : undefined;
+  const end = to === undefined ? DateTime.makeUnsafe(now) : utc(to);
+  const since = parseSince(
+    Option.getOrElse(options.since, () => "1h"),
+    to !== undefined && end !== undefined ? DateTime.toEpochMillis(end) : now,
+  );
+  const start =
+    from === undefined
+      ? since?.kind === "time"
+        ? Option.getOrUndefined(DateTime.make(since.iso))
+        : undefined
+      : utc(from);
+  if (
+    start === undefined ||
+    end === undefined ||
+    DateTime.toEpochMillis(end) < DateTime.toEpochMillis(start) ||
+    DateTime.toEpochMillis(end) - DateTime.toEpochMillis(start) > maximumDuration
+  )
+    return yield* new LogsInputError({
+      message:
+        maximumDuration === Infinity
+          ? "Use a valid UTC time range, or --since with a duration such as 1h."
+          : "Use a valid UTC time range of at most 24 hours, or --since with a duration such as 1h.",
+    });
+  return { start: DateTime.formatIso(start), end: DateTime.formatIso(end) };
+});
diff --git a/apps/cli/src/commands/logs/logs.format.unit.test.ts b/apps/cli/src/commands/logs/logs.format.unit.test.ts
new file mode 100644
index 0000000000..6b90338e33
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.format.unit.test.ts
@@ -0,0 +1,19 @@
+import { expect, it } from "@effect/vitest";
+import { Effect, Option } from "effect";
+import { logsWindow } from "./logs.format.ts";
+
+it.effect("anchors the default hour to an explicit historical end", () =>
+  logsWindow(
+    { since: Option.none(), to: Option.some("2025-01-01T12:00:00Z") },
+    Date.parse("2026-01-01T00:00:00Z"),
+  ).pipe(
+    Effect.tap((window) =>
+      Effect.sync(() =>
+        expect(window).toEqual({
+          start: "2025-01-01T11:00:00.000Z",
+          end: "2025-01-01T12:00:00.000Z",
+        }),
+      ),
+    ),
+  ),
+);
diff --git a/apps/cli/src/commands/logs/logs.handler.ts b/apps/cli/src/commands/logs/logs.handler.ts
new file mode 100644
index 0000000000..fd2a9c9292
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.handler.ts
@@ -0,0 +1,377 @@
+import { hasGatewayLogs } from "../../command-internal/logs/local-sources.ts";
+import { logEvent, markerText } from "../../command-internal/stack-log-events.ts";
+import { Clock, Effect, FileSystem, Option, Path, Result, Schema, Stream } from "effect";
+import { gatewayLog } from "@supabase/stack/effect";
+import { unsupportedOutputFlagMessage } from "../../command-internal/output-formats.ts";
+import { OutputFlag } from "../../command-internal/global-flags.ts";
+import { StackTargetResolver, validateStackTarget } from "../../command-internal/stack-target.ts";
+import { parseTargetSelector } from "../../command-internal/target/target-selector.ts";
+import { stripControlSequences } from "../../shared/output/strip-control-sequences.ts";
+import { resolveTarget } from "../../command-internal/target/resolve-target.ts";
+import { CliArgs } from "../../shared/cli/cli-args.service.ts";
+import {
+  readExperimentalFeatureConfig,
+  resolveExperimentalFeature,
+} from "../../shared/config/experimental-feature.ts";
+import { currentProjectStateMode } from "../../shared/config/project-state-mode.ts";
+import { CommandSettings } from "../../config/command-settings.service.ts";
+import { LinkedProjectCache } from "../../telemetry/linked-project-cache.service.ts";
+import { TelemetryState } from "../../telemetry/telemetry-state.service.ts";
+import { Output } from "../../shared/output/output.service.ts";
+import { Stdin } from "../../shared/runtime/stdin.service.ts";
+import { Tty } from "../../shared/runtime/tty.service.ts";
+import { encodeHtmlSafeJsonIndented } from "../../command-internal/html-safe-json.ts";
+import { renderLogsRows, renderLogsSources, wrapLogsText } from "./logs.display.ts";
+import { hostedSources, severityServices } from "./logs.catalog.ts";
+import { logsWindow } from "./logs.format.ts";
+import { LogsInputError } from "./logs.errors.ts";
+import { browseLogs, useLogsBrowser } from "./logs.browser.ts";
+import { filteredLogsSql, makeRemoteLogsSession } from "./logs.remote-session.ts";
+import { makeLocalLogsSession } from "./logs.local-session.ts";
+import type { LogsFlags, LogsSession } from "./logs.session.ts";
+import type { LogsSourcesFlags } from "./logs.command.ts";
+
+const resolveLogsCompute = Effect.fn("Logs.resolveCompute")(function* () {
+  const settings = yield* CommandSettings;
+  const args = yield* Effect.serviceOption(CliArgs);
+  return yield* resolveExperimentalFeature({
+    feature: "compute",
+    configValue: readExperimentalFeatureConfig({
+      feature: "compute",
+      cwd: settings.workdir,
+      args: Option.isSome(args) ? args.value.args : [],
+    }),
+  });
+});
+
+const logsWidth = Effect.fnUntraced(function* () {
+  const tty = yield* Effect.serviceOption(Tty);
+  const columns = Option.isSome(tty) ? tty.value.stdoutColumns : undefined;
+  return columns !== undefined && Number.isFinite(columns) && columns >= 20
+    ? Math.floor(columns)
+    : 80;
+});
+
+const logsResult = Effect.fnUntraced(function* (rows: ReadonlyArray<Schema.JsonObject>) {
+  const output = yield* Output;
+  return yield* output.format === "json"
+    ? output.raw(encodeHtmlSafeJsonIndented(rows))
+    : output.result(rows);
+});
+
+const rejectLegacyOutput = Effect.fnUntraced(function* (leaf: "sources" | undefined) {
+  if (Option.isSome(yield* OutputFlag))
+    return yield* new LogsInputError({
+      message: unsupportedOutputFlagMessage(leaf === undefined ? "logs" : `logs ${leaf}`),
+    });
+});
+
+const emitRows = Effect.fnUntraced(function* (
+  rows: ReadonlyArray<Schema.JsonObject>,
+  sourceDetail?: boolean,
+) {
+  const output = yield* Output;
+  if (output.format !== "text") return yield* logsResult(rows);
+  const width = yield* logsWidth();
+  yield* output.raw(
+    sourceDetail === undefined
+      ? renderLogsRows(rows, width)
+      : renderLogsSources(rows, sourceDetail, width),
+  );
+});
+
+const sqlInput = Effect.fn("Logs.sqlInput")(function* (flags: LogsFlags) {
+  let sql = Option.getOrUndefined(flags.sql);
+  if (Option.isSome(flags.file)) {
+    if (flags.file.value === "-") {
+      const stdin = yield* Stdin;
+      if (stdin.isTTY)
+        return yield* new LogsInputError({
+          message: "Pipe SQL into stdin when using --file -, or use --sql or --file <path>.",
+        });
+      sql = yield* stdin.pipedBytesStream.pipe(
+        Stream.decodeText(),
+        Stream.runFold(
+          () => "",
+          (text, chunk) => text + chunk,
+        ),
+        Effect.mapError(
+          () =>
+            new LogsInputError({
+              message: "Could not read SQL from stdin. Check the input pipe and try again.",
+            }),
+        ),
+      );
+    } else {
+      const file = flags.file.value;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const settings = yield* CommandSettings;
+      sql = yield* fs.readFileString(path.resolve(settings.workdir, file)).pipe(
+        Effect.mapError(
+          (error) =>
+            new LogsInputError({
+              message: `Could not read SQL file "${file}": ${error.message}`,
+            }),
+        ),
+      );
+    }
+  }
+  if (sql !== undefined && sql.trim() === "")
+    return yield* new LogsInputError({ message: "The SQL input is empty." });
+  return sql;
+});
+
+const localRecord = Schema.Struct({
+  kind: Schema.Literals(["stdout", "stderr", "launch", "lost"]),
+  timestamp: Schema.String,
+  service: Schema.String,
+  instanceId: Schema.String,
+  text: Schema.optionalKey(Schema.String),
+  stream: Schema.optionalKey(Schema.Literals(["stdout", "stderr"])),
+  count: Schema.optionalKey(Schema.Finite),
+  launchId: Schema.optionalKey(Schema.Int),
+});
+
+const filteredText = (row: Schema.JsonObject) =>
+  `${String(row["timestamp"] ?? "—")} ${String(row["service"] ?? row["source"] ?? "logs")} ${String(row["event_message"] ?? row["text"] ?? (Schema.is(localRecord)(row) ? markerText(row) : (row["kind"] ?? "")))}`;
+
+export const logs = Effect.fn("logs")(function* (flags: LogsFlags) {
+  const telemetry = yield* TelemetryState;
+  return yield* Effect.gen(function* () {
+    yield* rejectLegacyOutput(undefined);
+    const hasSql = Option.isSome(flags.sql) || Option.isSome(flags.file);
+    if (Option.isSome(flags.sql) && Option.isSome(flags.file))
+      return yield* new LogsInputError({ message: "Provide SQL with --sql or --file, not both." });
+    if (
+      hasSql &&
+      (flags.service.length > 0 ||
+        flags.level.length > 0 ||
+        Option.isSome(flags.resource) ||
+        Option.isSome(flags.kind) ||
+        Option.isSome(flags.search) ||
+        Option.isSome(flags.stack) ||
+        Option.isSome(flags.stackId))
+    )
+      return yield* new LogsInputError({
+        message:
+          "Custom SQL cannot be combined with service, resource, kind, level, search, or stack filters.",
+      });
+    const args = yield* Effect.serviceOption(CliArgs);
+    const { selection } = yield* Result.match(
+      parseTargetSelector(flags, {
+        remoteConflict: Option.getOrUndefined(args)?.remoteConflict === true,
+      }),
+      { onFailure: Effect.fail, onSuccess: Effect.succeed },
+    );
+    if (selection._tag === "DbUrl")
+      return yield* new LogsInputError({ message: "Logs do not support database URLs." });
+    const hosted = selection._tag !== "Default" && selection._tag !== "Local";
+    if (hasSql && !hosted)
+      return yield* new LogsInputError({ message: "Custom log SQL requires --remote." });
+    const started = yield* Clock.currentTimeMillis;
+    if (hosted) yield* logsWindow(flags, started);
+    const computeEnabled = hosted && !hasSql ? yield* resolveLogsCompute() : false;
+    if (hosted && !hasSql) yield* filteredLogsSql(flags, computeEnabled);
+    const target = yield* resolveTarget(flags);
+    if (target.kind === "db-url")
+      return yield* new LogsInputError({ message: "Logs do not support database URLs." });
+    const sql = yield* sqlInput(flags);
+    if (target.kind === "local" && (yield* currentProjectStateMode) !== "stack")
+      return yield* new LogsInputError({
+        message:
+          "Local logs require the experimental stack backend. Set SUPABASE_EXPERIMENTAL_STACK=1 or [experimental] stack = true in supabase/config.toml, or use --remote for hosted logs.",
+      });
+    const output = yield* Output;
+    const interactive = yield* useLogsBrowser();
+    const run = Effect.fnUntraced(function* <E>(session: LogsSession<E>) {
+      if (interactive) return yield* browseLogs(session, started, flags);
+      const rows: Array<Schema.JsonObject> = [];
+      yield* session.load(
+        started,
+        (row) =>
+          Effect.sync(() => {
+            rows.push(row);
+          }),
+        (update) => output.raw(`${update.message}\n`, "stderr"),
+      );
+      if (sql === undefined && rows.length >= flags.limit)
+        yield* output.raw(
+          "History reached --limit; older rows may exist. Narrow the window or use --sql for a wider result.\n",
+          "stderr",
+        );
+      if (output.format === "json") return yield* logsResult(rows);
+      if (sql !== undefined) return yield* emitRows(rows);
+      const width = yield* logsWidth();
+      const tty = yield* Effect.serviceOption(Tty);
+      const wrap = Option.isSome(tty) && tty.value.stdoutIsTty;
+      for (const row of rows) {
+        if (output.format === "stream-json" && Schema.is(localRecord)(row))
+          yield* output.event({ ...logEvent(row, "history"), data: row });
+        else if (output.format === "stream-json")
+          yield* output.event({
+            type: "log-entry",
+            stream: row["level"] === "error" || row["level"] === "warn" ? "stderr" : "stdout",
+            timestamp: String(row["timestamp"] ?? ""),
+            service: String(row["service"] ?? row["source"] ?? "logs"),
+            source: "history",
+            line: String(row["event_message"] ?? row["text"] ?? ""),
+            data: row,
+          });
+        else {
+          const text = filteredText(row);
+          yield* output.raw(
+            `${wrap ? wrapLogsText(text, width) : stripControlSequences(text.replaceAll("\r", "\\r").replaceAll("\n", "\\n"))}\n`,
+          );
+        }
+      }
+    });
+    if (target.kind === "linked") {
+      const cache = yield* LinkedProjectCache;
+      return yield* Effect.gen(function* () {
+        const session = yield* makeRemoteLogsSession(
+          flags,
+          target.ref,
+          started,
+          computeEnabled,
+          sql,
+          interactive,
+        );
+        yield* run(session);
+      }).pipe(Effect.ensuring(cache.cache(target.ref)));
+    }
+    const session = yield* makeLocalLogsSession(flags, started);
+    return yield* run(session);
+  }).pipe(Effect.ensuring(telemetry.flush));
+});
+
+export const logsSources = Effect.fn("logs.sources")(function* (flags: LogsSourcesFlags) {
+  const telemetry = yield* TelemetryState;
+  return yield* Effect.gen(function* () {
+    yield* rejectLegacyOutput("sources");
+    const target = yield* resolveTarget(flags);
+    if (target.kind === "linked") {
+      const availableCompute = yield* resolveLogsCompute();
+      if (Option.isSome(flags.stack) || Option.isSome(flags.stackId))
+        return yield* new LogsInputError({
+          message: "--stack and --stack-id are local selectors.",
+        });
+      if (
+        Option.isSome(flags.service) &&
+        !hostedSources.some(
+          (entry) =>
+            entry.service === Option.getOrUndefined(flags.service) &&
+            (availableCompute || entry.service !== "compute"),
+        )
+      )
+        return yield* new LogsInputError({
+          message: "Unknown or disabled hosted service. Use logs sources --remote.",
+        });
+      return yield* emitRows(
+        hostedSources
+          .filter(
+            (entry) =>
+              (availableCompute || entry.service !== "compute") &&
+              (Option.isNone(flags.service) || entry.service === flags.service.value),
+          )
+          .map((entry) => ({
+            service: entry.service,
+            sql:
+              entry.service === "compute"
+                ? "logs WHERE log_attributes['subservice'] IN ('worker_guest_logs','worker_ingress_logs','worker_api_logs')"
+                : `logs WHERE source = '${entry.source}'`,
+            filters:
+              entry.service === "compute"
+                ? ["service", "resource", "kind", "level", "search", "since"]
+                : [
+                    "service",
+                    "search",
+                    "since",
+                    ...(severityServices.includes(entry.service) ? ["level"] : []),
+                    ...(["functions", "function-edge"].includes(entry.service) ? ["resource"] : []),
+                  ],
+            levels: severityServices.includes(entry.service)
+              ? entry.service === "compute" ||
+                entry.service === "edge" ||
+                entry.service === "function-edge"
+                ? ["error", "warn", "info"]
+                : ["error", "warn", "info", "debug", "log", "notice"]
+              : [],
+            severity: severityServices.includes(entry.service)
+              ? entry.service === "compute"
+                ? "Derived for requests/builds; app severity is unknown."
+                : "Derived from service fields; unknown stays unknown."
+              : null,
+            kinds: "kinds" in entry ? entry.kinds : [],
+          })),
+        Option.isSome(flags.service),
+      );
+    }
+    if ((yield* currentProjectStateMode) !== "stack")
+      return yield* new LogsInputError({
+        message:
+          "Local log discovery requires the experimental stack backend. Set SUPABASE_EXPERIMENTAL_STACK=1 or [experimental] stack = true in supabase/config.toml, or use --remote for hosted sources.",
+      });
+    return yield* Effect.gen(function* () {
+      yield* validateStackTarget({
+        stack: Option.getOrUndefined(flags.stack),
+        stackId: Option.getOrUndefined(flags.stackId),
+      }).pipe(Effect.mapError((error) => new LogsInputError({ message: error.message })));
+      const resolver = yield* StackTargetResolver;
+      const settings = yield* CommandSettings;
+      const target = yield* resolver.resolve({
+        projectRoot: settings.workdir,
+        runtime: "auto",
+        name: Option.getOrUndefined(flags.stack),
+        id: Option.getOrUndefined(flags.stackId),
+      });
+      const instances = target.definition?.instances ?? [];
+      const requested = Option.getOrUndefined(flags.service);
+      const gateway = target.definition !== undefined && hasGatewayLogs(target.definition);
+      if (
+        requested !== undefined &&
+        !instances.some(
+          ({ creation }) =>
+            creation.service === (requested === "postgres" ? "database" : requested),
+        ) &&
+        !(requested === "gateway" && gateway)
+      )
+        return yield* new LogsInputError({
+          message: "Unknown local service. Use logs sources.",
+        });
+      const rows = instances
+        .filter(
+          ({ creation }) =>
+            Option.isNone(flags.service) ||
+            creation.service ===
+              (flags.service.value === "postgres" ? "database" : flags.service.value),
+        )
+        .map(({ id, creation }) => ({
+          service: creation.service === "database" ? "postgres" : creation.service,
+          resource: id,
+          sql: null,
+          filters: ["service", "resource", "since", "limit"],
+          kinds: ["stdout", "stderr", "launch", "lost"],
+          severity: null,
+        }));
+      yield* emitRows(
+        [
+          ...rows,
+          ...(gateway && (requested === undefined || requested === "gateway")
+            ? [
+                {
+                  service: gatewayLog.service,
+                  resource: gatewayLog.instanceId,
+                  sql: null,
+                  filters: ["service", "since", "limit"],
+                  kinds: ["stdout", "stderr", "launch", "lost"],
+                  severity: null,
+                },
+              ]
+            : []),
+        ],
+        Option.isSome(flags.service),
+      );
+    });
+  }).pipe(Effect.ensuring(telemetry.flush));
+});
diff --git a/apps/cli/src/commands/logs/logs.integration.test.ts b/apps/cli/src/commands/logs/logs.integration.test.ts
new file mode 100644
index 0000000000..20dcc00baa
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.integration.test.ts
@@ -0,0 +1,660 @@
+import { LogsClipboard } from "./logs.clipboard.ts";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import {
+  Cause,
+  ConfigProvider,
+  Effect,
+  Layer,
+  Option,
+  Stream,
+  Schema,
+  Queue,
+  Terminal,
+} from "effect";
+import { DebugFlag, ProfileFlag, WorkdirFlag } from "../../command-internal/global-flags.ts";
+import { mockContextualAnalytics, mockTelemetryRuntime } from "../../../tests/helpers/mocks.ts";
+import { TestClock } from "effect/testing";
+import { CommandPlatformApi } from "../../auth/command-platform-api.service.ts";
+import { CommandPlatformApiFactory } from "../../auth/command-platform-api-factory.service.ts";
+import { TargetPolicy } from "../../command-internal/target/target-policy.ts";
+import { Tty } from "../../shared/runtime/tty.service.ts";
+import { Stdin } from "../../shared/runtime/stdin.service.ts";
+import {
+  makeComputeProject,
+  setupCompute,
+  COMPUTE_PROJECT_REF,
+} from "../../../tests/helpers/compute.ts";
+import { StackApi, StackTargetResolver } from "../../command-internal/stack-target.ts";
+import { logs, logsSources } from "./logs.handler.ts";
+import type { LogsFlags } from "./logs.session.ts";
+import {
+  classifyCliErrorActionability,
+  ErrorActionabilityId,
+} from "../../shared/telemetry/error-actionability.ts";
+import { LogsApiError, LogsInputError } from "./logs.errors.ts";
+
+const decodeRows = Schema.decodeSync(Schema.fromJsonString(Schema.Array(Schema.JsonObject)));
+
+const route = `GET /v1/projects/${COMPUTE_PROJECT_REF}/analytics/endpoints/logs`;
+const now = Date.parse("2026-11-02T12:00:00Z");
+const baseFlags = (overrides: Partial<LogsFlags> = {}): LogsFlags => ({
+  remote: Option.some({ _tag: "Linked" }),
+  projectRef: Option.none(),
+  local: false,
+  linked: false,
+  stack: Option.none(),
+  stackId: Option.none(),
+  service: [],
+  resource: Option.none(),
+  kind: Option.none(),
+  level: [],
+  search: Option.none(),
+  since: Option.none(),
+  from: Option.none(),
+  to: Option.none(),
+  sql: Option.none(),
+  file: Option.none(),
+  limit: 100,
+  ...overrides,
+});
+const queryFlags = (overrides: Partial<LogsFlags> = {}): LogsFlags =>
+  baseFlags({
+    sql: Option.some("select event_message, log_attributes from logs limit 2"),
+    ...overrides,
+  });
+const tailFlags = (overrides: Partial<LogsFlags> = {}): LogsFlags =>
+  baseFlags({ service: ["postgres"], ...overrides });
+const runQuery = (flags: LogsFlags) => logs(flags);
+const stdin = (text?: string) =>
+  Layer.succeed(Stdin, {
+    isTTY: text === undefined,
+    readPipedText: Effect.succeed(Option.fromUndefinedOr(text)),
+    readPipedBytes: Effect.succeed(Option.none()),
+    pipedBytesStream:
+      text === undefined ? Stream.empty : Stream.make(new TextEncoder().encode(text)),
+    readLine: () => Effect.succeed(Option.none()),
+  });
+const row = (id: string, ts = now - 1000) => ({
+  id,
+  ts_ms: ts,
+  source: "postgres_logs",
+  severity_text: "INFO",
+  level: "error",
+  event_message: "db failure",
+  log_attributes: { "parsed.error_severity": "ERROR", trace_id: "correlation" },
+});
+
+const prepare = Effect.fnUntraced(function* (
+  options: Parameters<typeof setupCompute>[0],
+  piped?: string,
+) {
+  const setup = setupCompute({ interactive: false, ...options });
+  const api = yield* CommandPlatformApi.pipe(Effect.provide(setup.layer));
+  const layer = Layer.mergeAll(
+    setup.layer,
+    ConfigProvider.layer(ConfigProvider.fromUnknown({})),
+    Layer.mock(LogsClipboard, {}),
+    Layer.mock(StackApi, {}),
+    Layer.mock(StackTargetResolver, {}),
+    Layer.succeed(DebugFlag, false),
+    Layer.succeed(ProfileFlag, "supabase"),
+    Layer.succeed(WorkdirFlag, Option.none()),
+    mockContextualAnalytics().layer,
+    mockTelemetryRuntime(),
+    Layer.succeed(CommandPlatformApiFactory, { make: Effect.succeed(api) }),
+    stdin(piped),
+    Layer.succeed(TargetPolicy, {
+      group: "selectable",
+      consent: "none",
+      consentExemptReason: "Read logs",
+    }),
+  );
+  return { ...setup, layer };
+});
+
+describe("unified logs", () => {
+  it.effect.each([
+    {
+      from: Option.none<string>(),
+      to: Option.none<string>(),
+      start: "2026-11-02T11:00:00.000Z",
+      end: "2026-11-02T12:00:00.000Z",
+      header: "Window: Nov 02 11:00:00–12:00:00 UTC",
+    },
+    {
+      from: Option.some("2027-01-01T08:00:00Z"),
+      to: Option.some("2027-01-01T09:00:00Z"),
+      start: "2027-01-01T08:00:00.000Z",
+      end: "2027-01-01T09:00:00.000Z",
+      header: "Window: Jan 01 08:00:00–09:00:00 UTC",
+    },
+  ])(
+    "shows the exact query request window after time advances and undated results arrive: $header",
+    (test) =>
+      Effect.gen(function* () {
+        yield* TestClock.setTime(now);
+        const repo = yield* makeComputeProject();
+        const setup = yield* prepare({
+          workdir: repo.dir,
+          interactive: true,
+          routes: {
+            [route]: {
+              status: 200,
+              body: { result: [{ count: 8 }, { timestamp: "2000-01-01T00:00:00Z" }], error: null },
+            },
+          },
+        });
+        const input = yield* Queue.unbounded<Terminal.UserInput>();
+        const screens: string[] = [];
+        let advanced = false;
+        yield* runQuery(queryFlags({ from: test.from, to: test.to })).pipe(
+          Effect.provideService(
+            Terminal.Terminal,
+            Terminal.make({
+              columns: Effect.succeed(80),
+              rows: Effect.succeed(12),
+              size: Queue.unbounded<Terminal.Size, Cause.Done>(),
+              readInput: Effect.succeed(input),
+              readLine: Effect.die("unused"),
+              display: (text) =>
+                Effect.gen(function* () {
+                  screens.push(text);
+                  if (!advanced && text.includes("Window:")) {
+                    advanced = true;
+                    yield* TestClock.adjust("5 minutes");
+                  }
+                  if (text.includes(" | ready"))
+                    yield* Queue.offer(input, {
+                      input: Option.none(),
+                      key: { name: "q", ctrl: false, meta: false, shift: false },
+                    });
+                }),
+            }),
+          ),
+          Effect.provide(setup.layer),
+        );
+        expect(
+          setup.http.requests.find((request) => request.url.endsWith("/analytics/endpoints/logs"))
+            ?.urlParams,
+        ).toMatchObject({
+          iso_timestamp_start: test.start,
+          iso_timestamp_end: test.end,
+        });
+        const headers = screens
+          .filter((screen) => screen.includes("Window:") && !screen.includes("resolving…"))
+          .map((screen) => screen.split("\r\n").find((line) => line.startsWith("Window:")));
+        expect(headers.length).toBeGreaterThan(0);
+        expect(headers.every((header) => header === test.header)).toBe(true);
+      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("routes terminal query rows into details and leaves piped stdin on normal output", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      for (const stdinIsTty of [true, false]) {
+        const setup = yield* prepare({
+          workdir: repo.dir,
+          interactive: true,
+          routes: {
+            [route]: {
+              status: 200,
+              body: {
+                result: [
+                  {
+                    timestamp: "2026-11-02T12:00:00Z",
+                    service: "postgres",
+                    event_message: "first query row",
+                    private_field: "first full detail",
+                  },
+                  {
+                    timestamp: "2026-11-01T12:00:00Z",
+                    service: "auth",
+                    event_message: "second query row",
+                  },
+                ],
+                error: null,
+              },
+            },
+          },
+        });
+        const input = yield* Queue.unbounded<Terminal.UserInput>();
+        const screens: string[] = [];
+        let opened = false;
+        const terminal = Terminal.make({
+          columns: Effect.succeed(100),
+          rows: Effect.succeed(20),
+          size: Queue.unbounded<Terminal.Size, Cause.Done>(),
+          readInput: stdinIsTty
+            ? Effect.succeed(input)
+            : Effect.die("piped stdin must not acquire terminal input"),
+          readLine: Effect.die("unused"),
+          display: (text) =>
+            Effect.gen(function* () {
+              screens.push(text);
+              if (!opened && text.includes("first query row")) {
+                opened = true;
+                yield* Queue.offer(input, {
+                  input: Option.none(),
+                  key: { name: "return", ctrl: false, meta: false, shift: false },
+                });
+              } else if (text.includes("Log details")) {
+                yield* Queue.offer(input, {
+                  input: Option.none(),
+                  key: { name: "q", ctrl: false, meta: false, shift: false },
+                });
+              }
+            }),
+        });
+        const sql =
+          "select timestamp, service, event_message, private_field from logs order by timestamp desc";
+        yield* runQuery(queryFlags({ sql: Option.some(sql) })).pipe(
+          Effect.provideService(Terminal.Terminal, terminal),
+          Effect.provideService(Tty, { stdinIsTty, stdoutIsTty: true, stdoutIsPipe: false }),
+          Effect.provide(setup.layer),
+        );
+        expect(
+          setup.http.requests.find((request) => request.url.endsWith("/analytics/endpoints/logs"))
+            ?.urlParams.sql,
+        ).toBe(sql);
+        if (stdinIsTty) {
+          expect(
+            screens.some((screen) =>
+              screen.includes("> Nov 02 - 12:00:00 UTC postgres first query row"),
+            ),
+          ).toBe(true);
+          expect(screens.find((screen) => screen.includes("Log details"))).toContain(
+            "first full detail",
+          );
+          expect(screens.at(-1)).toContain("?1049l");
+        } else {
+          expect(screens).toEqual([]);
+          expect(setup.out.stdoutText).toContain("first full detail");
+        }
+      }
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("queries arbitrary hosted SQL from a file with exact bounds and raw attributes", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject({
+        "query.sql": "select id, log_attributes from logs limit 2",
+      });
+      const setup = yield* prepare({
+        workdir: repo.dir,
+        format: "json",
+        routes: {
+          [route]: {
+            status: 200,
+            body: {
+              result: [{ id: "a", log_attributes: { "user.id": "123", trace_id: "abc" } }],
+              error: null,
+            },
+          },
+        },
+      });
+      yield* runQuery(
+        queryFlags({
+          sql: Option.none(),
+          file: Option.some("query.sql"),
+          from: Option.some("2026-11-02T11:00:00Z"),
+          to: Option.some("2026-11-02T12:00:00Z"),
+        }),
+      ).pipe(Effect.provide(setup.layer));
+      expect(setup.out.stdoutText).toContain('\n    "log_attributes": {\n');
+      expect(decodeRows(setup.out.stdoutText)).toEqual([
+        { id: "a", log_attributes: { "user.id": "123", trace_id: "abc" } },
+      ]);
+      expect(
+        setup.http.requests.find((request) => request.url.endsWith("/analytics/endpoints/logs"))
+          ?.urlParams,
+      ).toMatchObject({
+        sql: "select id, log_attributes from logs limit 2",
+        iso_timestamp_start: "2026-11-02T11:00:00.000Z",
+        iso_timestamp_end: "2026-11-02T12:00:00.000Z",
+      });
+      expect(setup.telemetry.flushed).toBe(true);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect(
+    "rejects conflicting SQL inputs, oversized ranges, and invalid formats before querying",
+    () =>
+      Effect.gen(function* () {
+        const repo = yield* makeComputeProject();
+        for (const test of [
+          { flags: queryFlags({ file: Option.some("query.sql") }) },
+          { flags: queryFlags({ since: Option.some("25h") }) },
+          { flags: queryFlags(), format: "env" as const },
+        ]) {
+          const setup = yield* prepare({ workdir: repo.dir, routes: {}, outputFlag: test.format });
+          const error = yield* runQuery(test.flags).pipe(Effect.flip, Effect.provide(setup.layer));
+          expect(Schema.is(LogsInputError)(error)).toBe(true);
+          expect(setup.http.requests).toEqual([]);
+        }
+      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect.each([
+    {
+      flags: baseFlags({ sql: Option.none(), file: Option.some("-"), service: ["auth"] }),
+      message: "Custom SQL cannot be combined",
+    },
+    {
+      flags: baseFlags({ remote: Option.none(), file: Option.some("-") }),
+      message: "Custom log SQL requires --remote",
+    },
+    {
+      flags: baseFlags({ file: Option.some("-"), since: Option.some("25h") }),
+      message: "at most 24 hours",
+    },
+    {
+      flags: baseFlags({
+        remote: Option.some({ _tag: "Branch", name: "feature" }),
+        kind: Option.some("requests"),
+      }),
+      message: "--kind requires --service compute",
+    },
+  ])(
+    "rejects invalid combinations before SQL input or authentication: $message",
+    ({ flags, message }) =>
+      Effect.gen(function* () {
+        const repo = yield* makeComputeProject();
+        const setup = yield* prepare({ workdir: repo.dir, routes: {} });
+        const error = yield* logs(flags).pipe(
+          Effect.provideService(Stdin, {
+            isTTY: false,
+            readPipedText: Effect.die("stdin was consumed"),
+            readPipedBytes: Effect.die("stdin was consumed"),
+            pipedBytesStream: Stream.die("stdin was consumed"),
+            readLine: () => Effect.die("stdin was consumed"),
+          }),
+          Effect.provideService(CommandPlatformApiFactory, {
+            make: Effect.die("authentication was invoked"),
+          }),
+          Effect.provide(setup.layer),
+          Effect.flip,
+        );
+        expect(error).toMatchObject({
+          _tag: "LogsInputError",
+          message: expect.stringContaining(message),
+        });
+        expect(setup.http.requests).toEqual([]);
+      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("keeps a long multiline piped event on one unwrapped line", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(now);
+      const repo = yield* makeComputeProject();
+      const message = `${"long-message-".repeat(20)}\r\nsecond line`;
+      const setup = yield* prepare({
+        workdir: repo.dir,
+        format: "text",
+        routes: {
+          [route]: {
+            status: 200,
+            body: { result: [{ ...row("long"), event_message: message }], error: null },
+          },
+        },
+      });
+      yield* logs(tailFlags()).pipe(Effect.provide(setup.layer));
+      expect(setup.out.stdoutText).toBe(
+        `2026-11-02T11:59:59.000Z postgres ${"long-message-".repeat(20)}\\r\\nsecond line\n`,
+      );
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("surfaces HTTP-200 query errors and accepts null empty results", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const bad = yield* prepare({
+        workdir: repo.dir,
+        routes: {
+          [route]: { status: 200, body: { result: null, error: { message: "Unknown field" } } },
+        },
+      });
+      const error = yield* runQuery(queryFlags()).pipe(Effect.flip, Effect.provide(bad.layer));
+      expect(Schema.is(LogsApiError)(error) && error.message).toContain("Unknown field");
+      const empty = yield* prepare({
+        workdir: repo.dir,
+        format: "json",
+        routes: { [route]: { status: 200, body: { result: null, error: null } } },
+      });
+      yield* runQuery(queryFlags()).pipe(Effect.provide(empty.layer));
+      expect(empty.out.stdoutText).toBe("[]\n");
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect(
+    "tails oldest first with raw IDs and attributes and escapes literal filter values",
+    () =>
+      Effect.gen(function* () {
+        yield* TestClock.setTime(now);
+        const repo = yield* makeComputeProject();
+        const setup = yield* prepare({
+          workdir: repo.dir,
+          format: "json",
+          routes: {
+            [route]: {
+              status: 200,
+              body: { result: [row("new"), row("old", now - 2000)], error: null },
+            },
+          },
+        });
+        yield* logs(
+          tailFlags({ limit: 2, level: ["error"], search: Option.some("can't_%\\") }),
+        ).pipe(Effect.provide(setup.layer));
+        const lines = decodeRows(setup.out.stdoutText);
+        expect(setup.out.stderrText).toContain("History reached --limit; older rows may exist.");
+        expect(lines.map((line) => line.id)).toEqual(["old", "new"]);
+        expect(lines[0]?.log_attributes).toMatchObject({ trace_id: "correlation" });
+        const sql = setup.http.requests.find((request) =>
+          request.url.endsWith("/analytics/endpoints/logs"),
+        )?.urlParams.sql;
+        expect(sql).toContain("source = 'postgres_logs'");
+        expect(sql).toContain("positionCaseInsensitiveUTF8(event_message, 'can''t_%\\\\') > 0");
+        expect(sql).toContain("parsed.error_severity");
+      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("discovers truthful hosted capabilities without querying logs", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const setup = yield* prepare({ workdir: repo.dir, format: "json", routes: {} });
+      yield* logsSources({ ...tailFlags(), service: Option.some("storage") }).pipe(
+        Effect.provide(setup.layer),
+      );
+      const sources = decodeRows(setup.out.stdoutText);
+      expect(sources).toHaveLength(1);
+      expect(sources[0]).toMatchObject({ service: "storage", severity: null });
+      expect(sources[0]?.filters).not.toContain("level");
+      expect(setup.http.requests).toEqual([]);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+  it.effect("renders source summaries and full selected-service details in text", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject({
+        "supabase/config.toml": "[experimental]\ncompute = true\n",
+      });
+      const overview = yield* prepare({ workdir: repo.dir, format: "text", routes: {} });
+      yield* logsSources({ ...tailFlags(), service: Option.none() }).pipe(
+        Effect.provide(overview.layer),
+      );
+      expect(overview.out.stdoutText).toContain("Use --service <service>");
+      expect(overview.out.stdoutText).not.toContain("log_attributes");
+      const detail = yield* prepare({ workdir: repo.dir, format: "text", routes: {} });
+      yield* logsSources({ ...tailFlags(), service: Option.some("compute") }).pipe(
+        Effect.provide(detail.layer),
+      );
+      expect(detail.out.stdoutText).toContain("Service:\n  compute");
+      expect(detail.out.stdoutText).toContain("Kinds:\n  app, requests, builds");
+      expect(detail.out.stdoutText).toContain("worker_api_logs");
+      expect(detail.out.stdoutText.split("\n").every((line) => line.length <= 80)).toBe(true);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("reads stdin only for --file - and preserves unrelated piped input", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const setup = yield* prepare(
+        {
+          workdir: repo.dir,
+          format: "json",
+          routes: { [route]: { status: 200, body: { result: [], error: null } } },
+        },
+        "select count() from logs",
+      );
+      yield* runQuery(queryFlags({ sql: Option.none(), file: Option.some("-") })).pipe(
+        Effect.provide(setup.layer),
+      );
+      expect(
+        setup.http.requests.find((request) => request.url.endsWith("/analytics/endpoints/logs"))
+          ?.urlParams.sql,
+      ).toBe("select count() from logs");
+      const failOnRead = Layer.succeed(Stdin, {
+        isTTY: false,
+        readPipedText: Effect.die("explicit SQL must not consume stdin"),
+        readPipedBytes: Effect.succeed(Option.none()),
+        pipedBytesStream: Stream.empty,
+        readLine: () => Effect.succeed(Option.none()),
+      });
+      yield* runQuery(queryFlags()).pipe(Effect.provide(Layer.merge(setup.layer, failOnRead)));
+      expect(setup.http.requests[1]?.urlParams.sql).toContain("select event_message");
+      yield* logs(tailFlags()).pipe(Effect.provide(Layer.merge(setup.layer, failOnRead)));
+      expect(setup.http.requests[2]?.urlParams.sql).toContain("postgres_logs");
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+  it.effect("does not read an open stdin pipe for ordinary logs", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const setup = yield* prepare({
+        workdir: repo.dir,
+        format: "json",
+        routes: { [route]: { status: 200, body: { result: [], error: null } } },
+      });
+      yield* logs(tailFlags()).pipe(
+        Effect.provideService(Stdin, {
+          isTTY: false,
+          readPipedText: Effect.die("ordinary logs consumed stdin"),
+          readPipedBytes: Effect.die("ordinary logs consumed stdin"),
+          pipedBytesStream: Stream.die("ordinary logs consumed stdin"),
+          readLine: () => Effect.die("ordinary logs consumed stdin"),
+        }),
+        Effect.provide(setup.layer),
+      );
+      expect(
+        setup.http.requests.find((request) => request.url.endsWith("/analytics/endpoints/logs"))
+          ?.urlParams.sql,
+      ).toContain("postgres_logs");
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect.each([
+    { file: "-", piped: undefined, message: "Pipe SQL into stdin" },
+    { file: "-", piped: "   ", message: "SQL input is empty" },
+    { file: "missing.sql", piped: undefined, message: 'Could not read SQL file "missing.sql"' },
+  ])("rejects unusable SQL input from $file: $message", ({ file, piped, message }) =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const setup = yield* prepare({ workdir: repo.dir, routes: {} }, piped);
+      const error = yield* runQuery(
+        queryFlags({ sql: Option.none(), file: Option.some(file) }),
+      ).pipe(Effect.flip, Effect.provide(setup.layer));
+      expect(error).toMatchObject({
+        _tag: "LogsInputError",
+        message: expect.stringContaining(message),
+      });
+      expect(setup.http.requests).toEqual([]);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+  it.effect.each([401, 402, 403, 404, 429, 500])(
+    "surfaces hosted query HTTP %s as a typed API failure",
+    (status) =>
+      Effect.gen(function* () {
+        const repo = yield* makeComputeProject();
+        const setup = yield* prepare({ workdir: repo.dir, routes: { [route]: { status } } });
+        const error = yield* runQuery(queryFlags()).pipe(Effect.flip, Effect.provide(setup.layer));
+        expect(error).toMatchObject({ _tag: "LogsApiError", status });
+        if (Schema.is(LogsApiError)(error) && [401, 402, 403].includes(status))
+          expect(error.message).toMatch(/login|usage|permission/i);
+        expect(setup.http.requests).toHaveLength(1);
+        expect(setup.telemetry.flushed).toBe(true);
+      }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("preserves transport failure classification without an invented HTTP status", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const setup = yield* prepare({
+        workdir: repo.dir,
+        routes: { [route]: { transportError: "connection refused" } },
+      });
+      const error = yield* runQuery(queryFlags()).pipe(Effect.flip, Effect.provide(setup.layer));
+      expect(error).toMatchObject({ _tag: "HttpClientError", reason: { _tag: "TransportError" } });
+      expect(error).not.toHaveProperty("status");
+      expect(classifyCliErrorActionability(error)).toMatchObject({
+        error_kind: "external_service",
+        error_category: "network",
+      });
+      expect(setup.http.requests).toHaveLength(1);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("classifies an unreadable successful response without inventing an HTTP failure", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const setup = yield* prepare({
+        workdir: repo.dir,
+        routes: { [route]: { status: 200, body: { result: "not rows" } } },
+      });
+      const error = yield* runQuery(queryFlags()).pipe(Effect.flip, Effect.provide(setup.layer));
+      expect(error).toMatchObject({ _tag: "LogsApiError", status: 200, reason: "response" });
+      if (!Schema.is(LogsApiError)(error)) return yield* Effect.die("Expected logs response error");
+      expect(error[ErrorActionabilityId]).toMatchObject({
+        error_category: "api_status",
+        fingerprint_suffix: "api_response",
+      });
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("fails typed for an out-of-range log timestamp", () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const setup = yield* prepare({
+        workdir: repo.dir,
+        routes: { [route]: { status: 200, body: { result: [row("bad", 8.7e15)], error: null } } },
+      });
+      const error = yield* logs(tailFlags()).pipe(Effect.flip, Effect.provide(setup.layer));
+      expect(error).toMatchObject({
+        _tag: "LogsApiError",
+        status: 200,
+        reason: "response",
+        message: "The logs API returned an unreadable log row.",
+      });
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("finishes a structured read without automatic polling", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(now);
+      const repo = yield* makeComputeProject();
+      const setup = yield* prepare({
+        workdir: repo.dir,
+        format: "stream-json",
+        routes: {
+          [route]: [{ status: 200, body: { result: [row("seed")], error: null } }, { status: 404 }],
+        },
+      });
+      yield* logs(tailFlags()).pipe(Effect.provide(setup.layer));
+      yield* TestClock.adjust("10 seconds");
+      expect(setup.http.requests).toHaveLength(1);
+      expect(setup.out.events).toContainEqual(
+        expect.objectContaining({
+          type: "log-entry",
+          data: expect.objectContaining({ id: "seed" }),
+        }),
+      );
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+});
diff --git a/apps/cli/src/commands/logs/logs.local-session.integration.test.ts b/apps/cli/src/commands/logs/logs.local-session.integration.test.ts
new file mode 100644
index 0000000000..5fb3be7422
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.local-session.integration.test.ts
@@ -0,0 +1,377 @@
+import { BunServices } from "@effect/platform-bun";
+import { expect, it } from "@effect/vitest";
+import { DateTime, Effect, FileSystem, Layer, Option, Path, PlatformError, Schema } from "effect";
+import type { SavedStack } from "@supabase/stack/effect";
+import { mockCommandSettings } from "../../../tests/helpers/command-mocks.ts";
+import { selection } from "../../../tests/helpers/pins.ts";
+import { StackTargetResolver } from "../../command-internal/stack-target.ts";
+import { makeLocalLogsSession } from "./logs.local-session.ts";
+import type { LogsFlags } from "./logs.session.ts";
+
+const flags: LogsFlags = {
+  local: false,
+  linked: false,
+  remote: Option.none(),
+  projectRef: Option.none(),
+  stack: Option.none(),
+  stackId: Option.none(),
+  service: [],
+  resource: Option.none(),
+  kind: Option.none(),
+  level: [],
+  search: Option.none(),
+  since: Option.none(),
+  from: Option.none(),
+  to: Option.none(),
+  sql: Option.none(),
+  file: Option.none(),
+  limit: 1,
+};
+const iso = (millis: number) => DateTime.formatIso(DateTime.makeUnsafe(millis));
+const line = (text: string, millis = 1, launchId = 1) =>
+  `${iso(millis)} stdout ${launchId} | ${text}\n`;
+
+const fixture = Effect.fn("LogsLocalTest.fixture")(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const root = yield* fs.makeTempDirectoryScoped({ prefix: "local-log-session-" });
+  const file = path.join(root, "stacks", "stack-main", "logs", "mail", "one", "0000000001.log");
+  yield* fs.makeDirectory(path.dirname(file), { recursive: true });
+  const definition: SavedStack = {
+    id: "stack-main",
+    identity: { projectRoot: root, branchContext: "main", stackName: "local" },
+    runtime: "native",
+    lifetime: "detached",
+    instances: [
+      { id: "one", creation: { service: "mail", pin: selection.mail, config: {}, endpoints: {} } },
+    ],
+    composition: { members: [{ id: "one", activation: "eager" }], dependencies: [] },
+  };
+  let resolutions = 0;
+  const layer = Layer.merge(
+    mockCommandSettings({ workdir: root, supabaseHome: root }),
+    Layer.succeed(StackTargetResolver, {
+      resolve: () =>
+        Effect.sync(() => {
+          resolutions += 1;
+          return { projectRoot: root, id: definition.id, definition, hostRunning: false };
+        }),
+    }),
+  );
+  return { fs, file, layer, resolutions: () => resolutions };
+});
+
+it.effect("loads every newer line without resurrecting initial history omitted by limit", () =>
+  Effect.gen(function* () {
+    const test = yield* fixture();
+    yield* test.fs.writeFileString(test.file, line("latest", 5) + line("older-late", 1));
+    const session = yield* makeLocalLogsSession(flags, 10).pipe(Effect.provide(test.layer));
+    const rows: Array<Schema.JsonObject> = [];
+    const emit = (row: Schema.JsonObject) =>
+      Effect.sync(() => {
+        rows.push(row);
+      });
+    expect(yield* session.load(10, emit)).toMatchObject({ end: iso(10) });
+    expect(rows.map(({ text }) => text)).toEqual(["latest"]);
+    rows.length = 0;
+    yield* test.fs.writeFileString(test.file, line("new-a", 6) + line("new-b", 7), { flag: "a" });
+    yield* session.load(20, emit);
+    expect(rows.map(({ text }) => text)).toEqual(["new-a", "new-b"]);
+    rows.length = 0;
+    yield* session.load(30, emit);
+    expect(rows).toEqual([]);
+    expect(test.resolutions()).toBe(1);
+  }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect(
+  "defers future timestamps while emitting later positions whose timestamps are eligible",
+  () =>
+    Effect.gen(function* () {
+      const test = yield* fixture();
+      yield* test.fs.writeFileString(test.file, line("future", 30) + line("eligible", 5));
+      const session = yield* makeLocalLogsSession(flags, 10).pipe(Effect.provide(test.layer));
+      const rows: Array<Schema.JsonObject> = [];
+      const emit = (row: Schema.JsonObject) =>
+        Effect.sync(() => {
+          rows.push(row);
+        });
+      yield* session.load(10, emit);
+      expect(rows.map(({ text }) => text)).toEqual(["eligible"]);
+      rows.length = 0;
+      yield* session.load(30, emit);
+      expect(rows.map(({ text }) => text)).toEqual(["future"]);
+      rows.length = 0;
+      yield* session.load(20, emit);
+      expect(rows).toEqual([]);
+    }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect("retries a failed read without committing the cursor or requested window", () =>
+  Effect.gen(function* () {
+    const test = yield* fixture();
+    yield* test.fs.writeFileString(test.file, line("initial"));
+    let fail = false;
+    const failingFs: FileSystem.FileSystem = {
+      ...test.fs,
+      open: (target, options) =>
+        fail && target === test.file
+          ? Effect.fail(
+              new PlatformError.PlatformError(
+                new PlatformError.SystemError({
+                  _tag: "PermissionDenied",
+                  module: "FileSystem",
+                  method: "open",
+                  pathOrDescriptor: target,
+                }),
+              ),
+            )
+          : test.fs.open(target, options),
+    };
+    const session = yield* makeLocalLogsSession(flags, 10).pipe(
+      Effect.provide(test.layer),
+      Effect.provideService(FileSystem.FileSystem, failingFs),
+    );
+    const rows: Array<Schema.JsonObject> = [];
+    const emit = (row: Schema.JsonObject) =>
+      Effect.sync(() => {
+        rows.push(row);
+      });
+    yield* session.load(10, emit);
+    rows.length = 0;
+    yield* test.fs.writeFileString(test.file, line("retry", 15), { flag: "a" });
+    fail = true;
+    expect((yield* session.load(30, emit).pipe(Effect.exit))._tag).toBe("Failure");
+    fail = false;
+    expect(yield* session.load(20, emit)).toMatchObject({ end: iso(20) });
+    expect(rows.map(({ text }) => text)).toEqual(["retry"]);
+  }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect("freezes the requested lower bound and extends an explicit end on later loads", () =>
+  Effect.gen(function* () {
+    const test = yield* fixture();
+    yield* test.fs.writeFileString(
+      test.file,
+      line("before", 1) + line("inside", 5) + line("after", 15),
+    );
+    const session = yield* makeLocalLogsSession(
+      {
+        ...flags,
+        from: Option.some(iso(3)),
+        to: Option.some(iso(10)),
+      },
+      20,
+    ).pipe(Effect.provide(test.layer));
+    const rows: Array<Schema.JsonObject> = [];
+    const emit = (row: Schema.JsonObject) =>
+      Effect.sync(() => {
+        rows.push(row);
+      });
+    expect(yield* session.load(20, emit)).toEqual({
+      kind: "range",
+      start: iso(3),
+      end: iso(10),
+    });
+    expect(rows.map(({ text }) => text)).toEqual(["inside"]);
+    rows.length = 0;
+    expect(yield* session.load(20, emit)).toMatchObject({ end: iso(20) });
+    expect(rows.map(({ text }) => text)).toEqual(["after"]);
+  }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect(
+  "keeps only the latest launch initially and excludes late output from an older launch",
+  () =>
+    Effect.gen(function* () {
+      const test = yield* fixture();
+      yield* test.fs.writeFileString(
+        test.file,
+        line("previous", 1, 1) + `${iso(2)} launch 2 | \n` + line("current", 3, 2),
+      );
+      const session = yield* makeLocalLogsSession(
+        { ...flags, since: Option.some("start") },
+        10,
+      ).pipe(Effect.provide(test.layer));
+      const rows: Array<Schema.JsonObject> = [];
+      const emit = (row: Schema.JsonObject) =>
+        Effect.sync(() => {
+          rows.push(row);
+        });
+      expect(yield* session.load(10, emit)).toMatchObject({
+        kind: "launch",
+        end: iso(10),
+      });
+      expect(rows.filter(({ kind }) => kind === "stdout").map(({ text }) => text)).toEqual([
+        "current",
+      ]);
+      rows.length = 0;
+      yield* test.fs.writeFileString(
+        test.file,
+        line("late previous", 4, 1) + line("new current", 5, 2),
+        { flag: "a" },
+      );
+      yield* session.load(20, emit);
+      expect(rows.map(({ text }) => text)).toEqual(["new current"]);
+    }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect(
+  "rereads large historical windows without retaining post-window rows or replaying eligible rows",
+  () =>
+    Effect.gen(function* () {
+      const test = yield* fixture();
+      const future = Array.from({ length: 1001 }, (_, index) => line(`future-${index}`, 30)).join(
+        "",
+      );
+      yield* test.fs.writeFileString(test.file, line("initial") + future + line("eligible", 5));
+      const session = yield* makeLocalLogsSession(
+        { ...flags, limit: 10, from: Option.some(iso(0)), to: Option.some(iso(10)) },
+        40,
+      ).pipe(Effect.provide(test.layer));
+      const rows: Array<Schema.JsonObject> = [];
+      const emit = (row: Schema.JsonObject) =>
+        Effect.sync(() => {
+          rows.push(row);
+        });
+      yield* session.load(40, emit);
+      expect(rows.map(({ text }) => text)).toEqual(["initial", "eligible"]);
+      rows.length = 0;
+      yield* test.fs.writeFileString(test.file, line("late older", 2), { flag: "a" });
+      yield* session.load(20, emit);
+      expect(rows.map(({ text }) => text)).toEqual(["late older"]);
+      rows.length = 0;
+      yield* session.load(30, emit);
+      expect(rows).toHaveLength(1001);
+      expect(new Set(rows.map(({ text }) => text)).size).toBe(1001);
+      rows.length = 0;
+      yield* session.load(40, emit);
+      expect(rows).toEqual([]);
+    }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect("requires a resource instance ID instead of a service name", () =>
+  Effect.gen(function* () {
+    const test = yield* fixture();
+    const invalid = yield* makeLocalLogsSession(
+      { ...flags, resource: Option.some("mail") },
+      10,
+    ).pipe(Effect.provide(test.layer), Effect.flip);
+    expect(invalid.message).toBe("No service matches mail.");
+  }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect("permits retained local ranges longer than a day", () =>
+  Effect.gen(function* () {
+    const test = yield* fixture();
+    yield* test.fs.writeFileString(test.file, line("retained", 5));
+    const session = yield* makeLocalLogsSession(
+      {
+        ...flags,
+        resource: Option.some("one"),
+        from: Option.some(iso(0)),
+        to: Option.some(iso(172800000)),
+      },
+      172800000,
+    ).pipe(Effect.provide(test.layer));
+    const rows: Schema.JsonObject[] = [];
+    yield* session.load(172800000, (row) =>
+      Effect.sync(() => {
+        rows.push(row);
+      }),
+    );
+    expect(rows.map(({ text }) => text)).toEqual(["retained"]);
+  }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect("advances a failed initial load to the retry time without committing a cursor", () =>
+  Effect.gen(function* () {
+    const test = yield* fixture();
+    yield* test.fs.writeFileString(test.file, line("available on retry", 15));
+    let fail = true;
+    const failingFs: FileSystem.FileSystem = {
+      ...test.fs,
+      open: (target, options) =>
+        fail && target === test.file
+          ? Effect.fail(
+              new PlatformError.PlatformError(
+                new PlatformError.SystemError({
+                  _tag: "PermissionDenied",
+                  module: "FileSystem",
+                  method: "open",
+                  pathOrDescriptor: target,
+                }),
+              ),
+            )
+          : test.fs.open(target, options),
+    };
+    const session = yield* makeLocalLogsSession(flags, 10).pipe(
+      Effect.provide(test.layer),
+      Effect.provideService(FileSystem.FileSystem, failingFs),
+    );
+    expect((yield* session.load(10, () => Effect.void).pipe(Effect.exit))._tag).toBe("Failure");
+    fail = false;
+    const rows: Schema.JsonObject[] = [];
+    expect(
+      yield* session.load(20, (row) =>
+        Effect.sync(() => {
+          rows.push(row);
+        }),
+      ),
+    ).toMatchObject({ end: iso(20) });
+    expect(rows.map(({ text }) => text)).toEqual(["available on retry"]);
+  }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect("reports rotated-away pending history once and resumes the remaining segment", () =>
+  Effect.gen(function* () {
+    const test = yield* fixture();
+    const path = yield* Path.Path;
+    yield* test.fs.writeFileString(test.file, line("initial", 5) + line("unavailable future", 30));
+    const session = yield* makeLocalLogsSession(flags, 10).pipe(Effect.provide(test.layer));
+    yield* session.load(10, () => Effect.void);
+    yield* test.fs.remove(test.file);
+    yield* test.fs.writeFileString(
+      path.join(path.dirname(test.file), "0000000003.log"),
+      line("rotated", 15),
+    );
+    const rows: Schema.JsonObject[] = [];
+    const emit = (row: Schema.JsonObject) =>
+      Effect.sync(() => {
+        rows.push(row);
+      });
+    yield* session.load(20, emit);
+    expect(rows.map(({ kind }) => kind)).toEqual(["lost", "stdout"]);
+    expect(rows[1]?.["text"]).toBe("rotated");
+    rows.length = 0;
+    yield* session.load(30, emit);
+    expect(rows).toEqual([]);
+  }).pipe(Effect.provide(BunServices.layer)),
+);
+
+it.effect("does not treat a gap resume cursor as a scanned row in an empty rotated segment", () =>
+  Effect.gen(function* () {
+    const test = yield* fixture();
+    const path = yield* Path.Path;
+    yield* test.fs.writeFileString(test.file, line("initial", 5));
+    const session = yield* makeLocalLogsSession(flags, 10).pipe(Effect.provide(test.layer));
+    yield* session.load(10, () => Effect.void);
+    yield* test.fs.remove(test.file);
+    const rotated = path.join(path.dirname(test.file), "0000000003.log");
+    yield* test.fs.writeFileString(rotated, "");
+    const rows: Schema.JsonObject[] = [];
+    const emit = (row: Schema.JsonObject) =>
+      Effect.sync(() => {
+        rows.push(row);
+      });
+    yield* session.load(20, emit);
+    expect(rows.map(({ kind }) => kind)).toEqual(["lost"]);
+    rows.length = 0;
+    yield* test.fs.writeFileString(rotated, line("late at gap cursor", 15));
+    yield* session.load(30, emit);
+    expect(rows.map(({ text }) => text)).toEqual(["late at gap cursor"]);
+    rows.length = 0;
+    yield* session.load(40, emit);
+    expect(rows).toEqual([]);
+  }).pipe(Effect.provide(BunServices.layer)),
+);
diff --git a/apps/cli/src/commands/logs/logs.local-session.ts b/apps/cli/src/commands/logs/logs.local-session.ts
new file mode 100644
index 0000000000..e59a0831ba
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.local-session.ts
@@ -0,0 +1,198 @@
+import { DateTime, Effect, FileSystem, Option, Path, Schema, Stream } from "effect";
+import {
+  gatewayLog,
+  streamStackLogs,
+  type LogPosition,
+  type StackLogRecord,
+} from "@supabase/stack/effect";
+import { CommandSettings } from "../../config/command-settings.service.ts";
+import { StackTargetResolver, validateStackTarget } from "../../command-internal/stack-target.ts";
+import { isFromLaunch, makeHistoryCollector } from "../../command-internal/logs/local-history.ts";
+import { parseSince } from "../../command-internal/logs/since.ts";
+import { hasGatewayLogs } from "../../command-internal/logs/local-sources.ts";
+import { LogsInputError } from "./logs.errors.ts";
+import { logsWindow } from "./logs.format.ts";
+import type { LogsFlags, LogsSession } from "./logs.session.ts";
+
+const inputError = (error: { readonly message: string }) =>
+  new LogsInputError({ message: error.message });
+const iso = (millis: number) => DateTime.formatIso(DateTime.makeUnsafe(millis));
+const afterPosition = (left: LogPosition, right: LogPosition) =>
+  left.generation > right.generation ||
+  (left.generation === right.generation && left.byteOffset > right.byteOffset);
+
+export const makeLocalLogsSession = Effect.fn("Logs.local.session")(function* (
+  flags: LogsFlags,
+  started: number,
+) {
+  if (flags.level.length > 0 || Option.isSome(flags.search) || Option.isSome(flags.kind))
+    return yield* new LogsInputError({
+      message:
+        "Local logs support service, resource, and time filters. Level, search, and kind are unavailable.",
+    });
+  if (Option.isSome(flags.resource) && flags.service.length > 0)
+    return yield* new LogsInputError({
+      message: "For local logs, select either --resource (instance ID) or --service.",
+    });
+  yield* validateStackTarget({
+    stack: Option.getOrUndefined(flags.stack),
+    stackId: Option.getOrUndefined(flags.stackId),
+  }).pipe(Effect.mapError(inputError));
+  const settings = yield* CommandSettings;
+  const resolver = yield* StackTargetResolver;
+  const path = yield* Path.Path;
+  const fs = yield* FileSystem.FileSystem;
+  const target = yield* resolver
+    .resolve({
+      projectRoot: settings.workdir,
+      runtime: "auto",
+      ...(Option.isSome(flags.stack) ? { name: flags.stack.value } : {}),
+      ...(Option.isSome(flags.stackId) ? { id: flags.stackId.value } : {}),
+    })
+    .pipe(Effect.mapError(inputError));
+  if (target.id === undefined || target.definition === undefined)
+    return yield* new LogsInputError({
+      message: "No managed stack exists for the selected project. Run supabase stack start first.",
+    });
+  const requested = Option.isSome(flags.resource)
+    ? [flags.resource.value]
+    : flags.service.map((service) => (service === "postgres" ? "database" : service));
+  const definition = target.definition;
+  const members = new Set(definition.composition.members.map(({ id }) => id));
+  const available: Array<{ readonly id: string; readonly service: string }> =
+    definition.instances.map(({ id, creation }) => ({ id, service: creation.service }));
+  if (hasGatewayLogs(definition))
+    available.push({ id: gatewayLog.instanceId, service: gatewayLog.service });
+  const unknown = requested.find(
+    (value) =>
+      !available.some(
+        ({ id, service }) => id === value || (Option.isNone(flags.resource) && service === value),
+      ),
+  );
+  if (unknown !== undefined)
+    return yield* new LogsInputError({ message: `No service matches ${unknown}.` });
+  const selected = available.filter(({ id, service }) =>
+    requested.length === 0
+      ? members.has(id) || id === gatewayLog.instanceId
+      : requested.includes(id) || (Option.isNone(flags.resource) && requested.includes(service)),
+  );
+  if (selected.length === 0)
+    return yield* new LogsInputError({
+      message:
+        "The stack has no composition members to read. Select a standalone service with --service.",
+    });
+  const explicitRange =
+    Option.isSome(flags.from) || Option.isSome(flags.to)
+      ? yield* logsWindow(flags, started, Infinity)
+      : undefined;
+  const since =
+    explicitRange === undefined
+      ? parseSince(
+          Option.getOrElse(flags.since, () => "1h"),
+          started,
+        )
+      : { kind: "time" as const, iso: explicitRange.start };
+  if (since === undefined)
+    return yield* new LogsInputError({
+      message: "Invalid --since value. Use a duration, an ISO-8601 time, or start.",
+    });
+  const stackId = target.id;
+  const stateRoot = path.join(settings.supabaseHome, "stacks");
+  let positions = new Map<string, LogPosition>();
+  let launches: ReadonlyMap<string, number> = new Map();
+  let gaps = new Map<string, LogPosition>();
+  let resumePositions = new Map<string, LogPosition>();
+  let initialized = false;
+  let attempted = false;
+  let lastEnd = explicitRange === undefined ? started : Date.parse(explicitRange.end);
+  const load = Effect.fn("Logs.local.load")(function* (
+    capturedEnd: number,
+    emit: (row: Schema.JsonObject) => Effect.Effect<void>,
+  ) {
+    const end = attempted ? Math.max(lastEnd, capturedEnd) : lastEnd;
+    attempted = true;
+    const nextPositions = new Map(positions);
+    const nextGaps = new Map(gaps);
+    const scannedPositions = new Map(resumePositions);
+    const nextResume = new Map<string, LogPosition>();
+    const collector = makeHistoryCollector(flags.limit, since.kind === "start");
+    const accept = Effect.fnUntraced(function* (record: StackLogRecord) {
+      const position = record.position ?? record.resumeAt;
+      const previous = scannedPositions.get(record.instanceId);
+      if (Date.parse(record.timestamp) > end && !nextResume.has(record.instanceId))
+        nextResume.set(
+          record.instanceId,
+          previous ?? { generation: position?.generation ?? 0, byteOffset: 0 },
+        );
+      if (position !== undefined) {
+        scannedPositions.set(record.instanceId, position);
+        const highWater = nextPositions.get(record.instanceId);
+        if (
+          record.position !== undefined &&
+          (highWater === undefined || afterPosition(position, highWater))
+        )
+          nextPositions.set(record.instanceId, position);
+      }
+      if (Date.parse(record.timestamp) > end) return;
+      if (record.position === undefined && record.resumeAt !== undefined) {
+        const previousGap = gaps.get(record.instanceId);
+        if (previousGap !== undefined && !afterPosition(record.resumeAt, previousGap)) return;
+        nextGaps.set(record.instanceId, record.resumeAt);
+      }
+      const scanned = positions.get(record.instanceId);
+      if (
+        initialized &&
+        record.position !== undefined &&
+        scanned !== undefined &&
+        !afterPosition(record.position, scanned) &&
+        Date.parse(record.timestamp) <= lastEnd
+      )
+        return;
+      if (!initialized) collector.push(record);
+      else if (isFromLaunch(record, launches.get(record.instanceId)))
+        yield* Schema.decodeEffect(Schema.JsonObject)(record).pipe(
+          Effect.orDie,
+          Effect.flatMap(emit),
+        );
+    });
+    yield* streamStackLogs({
+      stateRoot,
+      stackId,
+      instances: selected.map(({ id }) => id),
+      from: resumePositions,
+      ...(since.kind === "time" ? { since: since.iso } : {}),
+    }).pipe(
+      Stream.mapError(inputError),
+      Stream.runForEach(accept),
+      Effect.provideService(FileSystem.FileSystem, fs),
+      Effect.provideService(Path.Path, path),
+    );
+    if (!initialized) {
+      const initial = collector.finish();
+      for (const record of initial.window.records)
+        yield* Schema.decodeEffect(Schema.JsonObject)(record).pipe(
+          Effect.orDie,
+          Effect.flatMap(emit),
+        );
+      launches = initial.launches;
+    }
+    positions = nextPositions;
+    gaps = nextGaps;
+    resumePositions = scannedPositions;
+    for (const [instance, position] of nextResume) resumePositions.set(instance, position);
+    initialized = true;
+    lastEnd = end;
+    yield* Effect.annotateCurrentSpan({
+      "logs.instance_count": selected.length,
+      "logs.deferred_instance_count": nextResume.size,
+    });
+    return since.kind === "time"
+      ? { kind: "range" as const, start: since.iso, end: iso(end) }
+      : { kind: "launch" as const, end: iso(end) };
+  });
+  return {
+    mode: "append",
+    context: `Local stack ${target.name ?? target.id}`,
+    load,
+  } satisfies LogsSession<LogsInputError>;
+});
diff --git a/apps/cli/src/commands/logs/logs.output.integration.test.ts b/apps/cli/src/commands/logs/logs.output.integration.test.ts
new file mode 100644
index 0000000000..6aff4786fe
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.output.integration.test.ts
@@ -0,0 +1,60 @@
+import { BunCrypto, BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit, FileSystem, Layer } from "effect";
+import { CliOutput, Command } from "effect/cli";
+import { rootCommandForFeatures } from "../../cli/root.ts";
+import { CliArgs } from "../../shared/cli/cli-args.service.ts";
+import { legacyProjectStateLayer } from "../../shared/config/legacy-project-state.layer.ts";
+import { textCliOutputFormatter } from "../../shared/output/text-formatter.ts";
+import { LogsInputError } from "./logs.errors.ts";
+import {
+  mockAnalytics,
+  mockOutput,
+  mockProcessControl,
+  mockRuntimeInfo,
+  mockTelemetryRuntime,
+  mockTty,
+  processEnvLayer,
+} from "../../../tests/helpers/mocks.ts";
+
+const root = rootCommandForFeatures();
+const cases = ["", "sources"];
+const formats = ["pretty", "table", "json", "csv", "env", "yaml", "toml"];
+
+describe("logs output format parsing", () => {
+  for (const leaf of cases) {
+    for (const format of formats) {
+      it.effect(`rejects legacy -o ${format} for logs ${leaf}`, () =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const home = yield* fs.makeTempDirectoryScoped({ prefix: "logs-output-" });
+          const args = ["logs", ...(leaf === "" ? [] : [leaf]), "--workdir", home, "-o", format];
+          const exit = yield* Command.runWith(root, { version: "0.0.0-test" })(args).pipe(
+            Effect.provide(
+              Layer.mergeAll(
+                CliOutput.layer(textCliOutputFormatter()),
+                Layer.succeed(CliArgs, { args }),
+                mockOutput({ format: "text" }).layer,
+                BunServices.layer,
+                BunCrypto.layer,
+                legacyProjectStateLayer.pipe(Layer.provide(BunServices.layer)),
+                mockRuntimeInfo({ homeDir: home, cwd: home }),
+                mockAnalytics().layer,
+                mockTelemetryRuntime({ configDir: home }),
+                mockTty(),
+                mockProcessControl().layer,
+                processEnvLayer({ SUPABASE_HOME: home }),
+              ),
+            ),
+            Effect.exit,
+          );
+          const error = Exit.isFailure(exit) ? Cause.squash(exit.cause) : undefined;
+          expect(error).toBeInstanceOf(LogsInputError);
+          expect(error).toMatchObject({
+            message: `the -o/--output flag is not supported by ${leaf === "" ? "logs" : `logs ${leaf}`}; use --output-format json|stream-json instead.`,
+          });
+        }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+      );
+    }
+  }
+});
diff --git a/apps/cli/src/commands/logs/logs.remote-session.integration.test.ts b/apps/cli/src/commands/logs/logs.remote-session.integration.test.ts
new file mode 100644
index 0000000000..e287f839a7
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.remote-session.integration.test.ts
@@ -0,0 +1,471 @@
+import { BunServices } from "@effect/platform-bun";
+import { expect, it } from "@effect/vitest";
+import { Deferred, Effect, Fiber, Option, Schema } from "effect";
+import { TestClock } from "effect/testing";
+import { CommandPlatformApi } from "../../auth/command-platform-api.service.ts";
+import { CommandPlatformApiFactory } from "../../auth/command-platform-api-factory.service.ts";
+import {
+  makeComputeProject,
+  setupCompute,
+  COMPUTE_PROJECT_REF,
+} from "../../../tests/helpers/compute.ts";
+import { makeRemoteLogsSession } from "./logs.remote-session.ts";
+import type { LogsFlags } from "./logs.session.ts";
+
+const now = Date.parse("2026-11-04T12:00:00Z");
+const route = `GET /v1/projects/${COMPUTE_PROJECT_REF}/analytics/endpoints/logs`;
+const flags = (overrides: Partial<LogsFlags> = {}): LogsFlags => ({
+  remote: Option.some({ _tag: "Linked" }),
+  projectRef: Option.none(),
+  local: false,
+  linked: false,
+  stack: Option.none(),
+  stackId: Option.none(),
+  service: ["postgres"],
+  resource: Option.none(),
+  kind: Option.none(),
+  level: [],
+  search: Option.none(),
+  since: Option.none(),
+  from: Option.none(),
+  to: Option.none(),
+  sql: Option.none(),
+  file: Option.none(),
+  limit: 100,
+  ...overrides,
+});
+const row = (id: string, ts_ms = now) => ({
+  id,
+  ts_ms,
+  source: "postgres_logs",
+  severity_text: "INFO",
+  level: "info",
+  event_message: id,
+  log_attributes: {},
+});
+const page = (rows: ReadonlyArray<Schema.JsonObject>) => ({
+  status: 200,
+  body: { result: rows, error: null },
+});
+const prepare = Effect.fnUntraced(function* (
+  options: Parameters<typeof setupCompute>[0],
+  optionsFlags: LogsFlags = flags(),
+  sql?: string,
+) {
+  const setup = setupCompute(options);
+  const api = yield* CommandPlatformApi.pipe(Effect.provide(setup.layer));
+  const session = yield* makeRemoteLogsSession(
+    optionsFlags,
+    COMPUTE_PROJECT_REF,
+    now,
+    false,
+    sql,
+  ).pipe(Effect.provideService(CommandPlatformApiFactory, { make: Effect.succeed(api) }));
+  return { ...setup, session };
+});
+
+it.effect("validates hosted capabilities before acquiring an authenticated API", () =>
+  Effect.gen(function* () {
+    const error = yield* makeRemoteLogsSession(
+      flags({ kind: Option.some("requests") }),
+      COMPUTE_PROJECT_REF,
+      now,
+      false,
+      undefined,
+    ).pipe(
+      Effect.provideService(CommandPlatformApiFactory, {
+        make: Effect.die("authentication was invoked"),
+      }),
+      Effect.flip,
+    );
+    expect(error).toMatchObject({
+      _tag: "LogsInputError",
+      message: "--kind requires --service compute.",
+    });
+  }),
+);
+
+it.effect.each([
+  { interactive: false, status: 403, name: undefined },
+  { interactive: true, status: 403, name: undefined },
+  { interactive: true, status: 200, name: undefined },
+  { interactive: true, status: 200, name: "test-project" },
+])(
+  "resolves viewer identity best effort with interactive=$interactive and project HTTP $status",
+  ({ interactive, status, name }) =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const projectRoute = `GET /v1/projects/${COMPUTE_PROJECT_REF}`;
+      const setup = setupCompute({
+        workdir: repo.dir,
+        routes: {
+          [projectRoute]: {
+            status,
+            body: {
+              ref: COMPUTE_PROJECT_REF,
+              id: COMPUTE_PROJECT_REF,
+              name,
+              organization_id: "org",
+              organization_slug: "test-org",
+              region: "us-east-1",
+              created_at: "2026-01-01T00:00:00Z",
+              status: "ACTIVE_HEALTHY",
+              database: {
+                host: "db.example.com",
+                version: "15",
+                postgres_engine: "15",
+                release_channel: "ga",
+              },
+            },
+          },
+          [route]: page([row("readable")]),
+        },
+      });
+      const api = yield* CommandPlatformApi.pipe(Effect.provide(setup.layer));
+      const session = yield* makeRemoteLogsSession(
+        flags(),
+        COMPUTE_PROJECT_REF,
+        now,
+        false,
+        undefined,
+        interactive,
+      ).pipe(Effect.provideService(CommandPlatformApiFactory, { make: Effect.succeed(api) }));
+      expect(session.context).toBe(
+        name === undefined
+          ? `Remote project ${COMPUTE_PROJECT_REF}`
+          : `Remote ${name} (${COMPUTE_PROJECT_REF})`,
+      );
+      const loaded: Schema.JsonObject[] = [];
+      yield* session.load(now, (entry) =>
+        Effect.sync(() => {
+          loaded.push(entry);
+        }),
+      );
+      expect(loaded[0]?.["id"]).toBe("readable");
+      expect(
+        setup.http.requests.filter((request) =>
+          request.url.endsWith(`/v1/projects/${COMPUTE_PROJECT_REF}`),
+        ),
+      ).toHaveLength(interactive ? 1 : 0);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect(
+  "drains every refresh page with exact millisecond/id ordering and deduplicates overlap independently of displayed rows",
+  () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const old = row("initial", now - 1000);
+      const fresh = Array.from({ length: 1500 }, (_, index) =>
+        row(`id-${String(index).padStart(4, "0")}`),
+      );
+      const setup = yield* prepare({
+        workdir: repo.dir,
+        routes: {
+          [route]: [
+            page([old]),
+            page([old, ...fresh.slice(0, 999)]),
+            page(fresh.slice(999)),
+            page(fresh.slice(0, 1000)),
+            page(fresh.slice(1000)),
+          ],
+        },
+      });
+      yield* setup.session.load(now, () => Effect.void);
+      const loaded: Schema.JsonObject[] = [];
+      const window = yield* setup.session.load(now + 10000, (item) =>
+        Effect.sync(() => {
+          loaded.push(item);
+        }),
+      );
+      expect(loaded.map((item) => item["id"])).toEqual(fresh.map((item) => item.id));
+      expect(window).toEqual({
+        kind: "range",
+        start: "2026-11-04T11:00:00.000Z",
+        end: "2026-11-04T12:00:10.000Z",
+      });
+      expect(setup.http.requests[1]?.urlParams.sql).toContain(
+        "order by ts_ms asc, id asc limit 1000",
+      );
+      expect(setup.http.requests[2]?.urlParams.sql).toContain(
+        "toUnixTimestamp64Milli(timestamp) = 1793793600000 and id > 'id-0998'",
+      );
+      expect(
+        setup.http.requests.slice(1).map((request) => request.urlParams.iso_timestamp_end),
+      ).toEqual(["2026-11-04T12:00:10.000Z", "2026-11-04T12:00:10.000Z"]);
+      const repeated: Schema.JsonObject[] = [];
+      yield* setup.session.load(now + 20000, (item) =>
+        Effect.sync(() => {
+          repeated.push(item);
+        }),
+      );
+      expect(repeated).toEqual([]);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("includes late older overlap rows when the initial history was not truncated", () =>
+  Effect.gen(function* () {
+    const repo = yield* makeComputeProject();
+    const setup = yield* prepare({
+      workdir: repo.dir,
+      routes: {
+        [route]: [
+          page([row("first", now - 1000)]),
+          page([row("late", now - 5000), row("first", now - 1000)]),
+        ],
+      },
+    });
+    yield* setup.session.load(now, () => Effect.void);
+    const loaded: Schema.JsonObject[] = [];
+    yield* setup.session.load(now + 1000, (item) =>
+      Effect.sync(() => {
+        loaded.push(item);
+      }),
+    );
+    expect(loaded.map((item) => item["id"])).toEqual(["late"]);
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("keeps a failed refresh checkpoint unchanged so retry rereads all pages", () =>
+  Effect.gen(function* () {
+    const repo = yield* makeComputeProject();
+    const fresh = Array.from({ length: 1000 }, (_, index) =>
+      row(`id-${String(index).padStart(4, "0")}`),
+    );
+    const setup = yield* prepare({
+      workdir: repo.dir,
+      routes: {
+        [route]: [
+          page([row("old", now - 1000)]),
+          page(fresh),
+          { status: 500 },
+          page(fresh),
+          page([row("last", now + 1000)]),
+        ],
+      },
+    });
+    yield* setup.session.load(now, () => Effect.void);
+    const error = yield* setup.session.load(now + 10000, () => Effect.void).pipe(Effect.flip);
+    expect(error).toMatchObject({ _tag: "LogsApiError", status: 500 });
+    const retried: Schema.JsonObject[] = [];
+    yield* setup.session.load(now + 10000, (item) =>
+      Effect.sync(() => {
+        retried.push(item);
+      }),
+    );
+    expect(retried).toHaveLength(1001);
+    expect(retried.at(-1)?.["id"]).toBe("last");
+    expect(setup.http.requests[3]?.urlParams).toEqual(setup.http.requests[1]?.urlParams);
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect(
+  "reruns custom SQL without rewriting it and extends the requested end monotonically",
+  () =>
+    Effect.gen(function* () {
+      const repo = yield* makeComputeProject();
+      const sql = "select count() as total from logs order by total desc";
+      const setup = yield* prepare(
+        { workdir: repo.dir, routes: { [route]: [page([{ total: 2 }]), page([{ total: 3 }])] } },
+        flags({ service: [], to: Option.some("2026-11-04T11:55:00Z") }),
+        sql,
+      );
+      expect(setup.session.mode).toBe("replace");
+      yield* setup.session.load(now, () => Effect.void);
+      const rows: Schema.JsonObject[] = [];
+      const window = yield* setup.session.load(now + 10000, (item) =>
+        Effect.sync(() => {
+          rows.push(item);
+        }),
+      );
+      expect(rows).toEqual([{ total: 3 }]);
+      expect(window).toEqual({
+        kind: "range",
+        start: "2026-11-04T10:55:00.000Z",
+        end: "2026-11-04T12:00:10.000Z",
+      });
+      expect(setup.http.requests.map((request) => request.urlParams.sql)).toEqual([sql, sql]);
+      expect(setup.http.requests[0]?.urlParams.iso_timestamp_end).toBe("2026-11-04T11:55:00.000Z");
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("caps refresh pages and resumes a fixed window at an exact tied-timestamp cursor", () =>
+  Effect.gen(function* () {
+    const repo = yield* makeComputeProject();
+    const fresh = Array.from({ length: 6001 }, (_, index) =>
+      row(`id-${String(index).padStart(5, "0")}`),
+    );
+    const setup = yield* prepare({
+      workdir: repo.dir,
+      routes: {
+        [route]: [
+          page([row("old", now - 1000)]),
+          ...Array.from({ length: 5 }, (_, index) =>
+            page(fresh.slice(index * 1000, (index + 1) * 1000)),
+          ),
+          { status: 500 },
+          page(fresh.slice(5000, 6000)),
+          page(fresh.slice(6000)),
+          page([row("old", now - 1000), ...fresh.slice(0, 998)]),
+        ],
+      },
+    });
+    yield* setup.session.load(now, () => Effect.void);
+    const rows: Schema.JsonObject[] = [];
+    const emit = (item: Schema.JsonObject) =>
+      Effect.sync(() => {
+        rows.push(item);
+      });
+    const partial = yield* setup.session.load(now + 10000, emit);
+    expect(rows).toHaveLength(5000);
+    expect(partial).toMatchObject({ end: "2026-11-04T12:00:10.000Z", pending: true });
+    expect((yield* setup.session.load(now + 90000, emit).pipe(Effect.exit))._tag).toBe("Failure");
+    expect(rows).toHaveLength(5000);
+    const complete = yield* setup.session.load(now + 95000, emit);
+    expect(setup.http.requests[7]?.urlParams).toEqual(setup.http.requests[6]?.urlParams);
+    expect(complete).toMatchObject({ end: "2026-11-04T12:00:10.000Z" });
+    expect(complete).not.toMatchObject({ pending: true });
+    expect(rows.map(({ id }) => id)).toEqual(fresh.map(({ id }) => id));
+    expect(setup.http.requests[6]?.urlParams.sql).toContain("id > 'id-04999'");
+    expect(setup.http.requests[6]?.urlParams.iso_timestamp_end).toBe("2026-11-04T12:00:10.000Z");
+    rows.length = 0;
+    yield* setup.session.load(now + 100000, emit);
+    expect(rows).toEqual([]);
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("retries only the throttled page after its retry-after delay", () =>
+  Effect.gen(function* () {
+    const repo = yield* makeComputeProject();
+    const full = Array.from({ length: 1000 }, (_, index) =>
+      row(`id-${String(index).padStart(4, "0")}`),
+    );
+    const setup = yield* prepare({
+      workdir: repo.dir,
+      routes: {
+        [route]: [
+          page([row("old", now - 1000)]),
+          page(full),
+          { status: 429, headers: { "retry-after": "90" } },
+          page([row("last", now + 1)]),
+        ],
+      },
+    });
+    yield* setup.session.load(now, () => Effect.void);
+    const rows: Schema.JsonObject[] = [];
+    const updates: string[] = [];
+    const firstPage = yield* Deferred.make<void>();
+    const fiber = yield* setup.session
+      .load(
+        now + 10000,
+        (item) =>
+          Effect.gen(function* () {
+            rows.push(item);
+            if (rows.length === 1000) yield* Deferred.succeed(firstPage, undefined);
+          }),
+        (update) =>
+          Effect.sync(() => {
+            updates.push(update.message);
+          }),
+      )
+      .pipe(Effect.forkScoped);
+    yield* Deferred.await(firstPage);
+    yield* TestClock.adjust("89 seconds");
+    expect(updates).toContain("Loading page 2 (1 page received)…");
+    expect(
+      updates.some((message) => /Rate limited\. Retrying in 90s at .*Z\./u.test(message)),
+    ).toBe(true);
+    expect(setup.http.requests).toHaveLength(3);
+    yield* TestClock.adjust("1 second");
+    yield* Fiber.join(fiber);
+    expect(rows.map(({ id }) => id)).toEqual([...full.map(({ id }) => id), "last"]);
+    expect(setup.http.requests).toHaveLength(4);
+    expect(setup.http.requests[3]?.urlParams).toEqual(setup.http.requests[2]?.urlParams);
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("selects only severity-supported sources when level is the only filter", () =>
+  Effect.gen(function* () {
+    const repo = yield* makeComputeProject();
+    const setup = yield* prepare(
+      { workdir: repo.dir, routes: { [route]: page([row("error")]) } },
+      flags({ service: [], level: ["error"] }),
+    );
+    const rows: Schema.JsonObject[] = [];
+    yield* setup.session.load(now, (item) =>
+      Effect.sync(() => {
+        rows.push(item);
+      }),
+    );
+    const sql = setup.http.requests[0]?.urlParams.sql ?? "";
+    expect(sql).toContain("source = 'postgres_logs'");
+    expect(sql).toContain("source = 'function_edge_logs'");
+    expect(sql).not.toContain("source = 'storage_logs'");
+    expect(rows[0]).toMatchObject({ service: "postgres", source: "postgres_logs" });
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("uses the retry time after an initial request failure", () =>
+  Effect.gen(function* () {
+    const repo = yield* makeComputeProject();
+    const setup = yield* prepare({
+      workdir: repo.dir,
+      routes: { [route]: [{ status: 500 }, page([row("retry", now + 5000)])] },
+    });
+    expect((yield* setup.session.load(now, () => Effect.void).pipe(Effect.exit))._tag).toBe(
+      "Failure",
+    );
+    expect(yield* setup.session.load(now + 10000, () => Effect.void)).toMatchObject({
+      end: "2026-11-04T12:00:10.000Z",
+    });
+    expect(setup.http.requests[1]?.urlParams.iso_timestamp_end).toBe("2026-11-04T12:00:10.000Z");
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("exhausts one retry per throttled page and leaves its checkpoint unchanged", () =>
+  Effect.gen(function* () {
+    const repo = yield* makeComputeProject();
+    const setup = yield* prepare({
+      workdir: repo.dir,
+      routes: {
+        [route]: [
+          page([row("old", now - 1)]),
+          { status: 429 },
+          { status: 429 },
+          page([row("after retry", now + 1)]),
+        ],
+      },
+    });
+    yield* setup.session.load(now, () => Effect.void);
+    const fiber = yield* setup.session
+      .load(now + 1000, () => Effect.void)
+      .pipe(Effect.exit, Effect.forkScoped);
+    yield* TestClock.adjust("60 seconds");
+    expect(yield* Fiber.join(fiber)).toMatchObject({ _tag: "Failure" });
+    expect(setup.http.requests).toHaveLength(3);
+    const rows: Schema.JsonObject[] = [];
+    yield* setup.session.load(now + 1000, (row) =>
+      Effect.sync(() => {
+        rows.push(row);
+      }),
+    );
+    expect(rows.map(({ id }) => id)).toEqual(["after retry"]);
+    expect(setup.http.requests[3]?.urlParams).toEqual(setup.http.requests[1]?.urlParams);
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
+
+it.effect("interrupts a throttled page without waiting for its scheduled retry", () =>
+  Effect.gen(function* () {
+    const repo = yield* makeComputeProject();
+    const setup = yield* prepare({
+      workdir: repo.dir,
+      routes: { [route]: [page([row("old", now - 1)]), { status: 429 }] },
+    });
+    yield* setup.session.load(now, () => Effect.void);
+    const fiber = yield* setup.session.load(now + 1000, () => Effect.void).pipe(Effect.forkScoped);
+    yield* TestClock.adjust("59 seconds");
+    yield* Fiber.interrupt(fiber);
+    yield* TestClock.adjust("120 seconds");
+    expect(setup.http.requests).toHaveLength(2);
+  }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
diff --git a/apps/cli/src/commands/logs/logs.remote-session.ts b/apps/cli/src/commands/logs/logs.remote-session.ts
new file mode 100644
index 0000000000..6b974a2c01
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.remote-session.ts
@@ -0,0 +1,307 @@
+import { Clock, DateTime, Duration, Effect, Option, Schedule, Schema } from "effect";
+import { CommandPlatformApiFactory } from "../../auth/command-platform-api-factory.service.ts";
+import { CommandTarget } from "../../shared/output/command-target.service.ts";
+import { sanitizeInlineName } from "../../command-internal/http-errors.ts";
+import { queryLogs } from "./logs.api.ts";
+import {
+  COMPUTE_LOG_STREAMS,
+  hostedSources,
+  quoteLogValue,
+  hostedSeveritySql,
+  severityServices,
+} from "./logs.catalog.ts";
+import { logsWindow } from "./logs.format.ts";
+import { LogsApiError, LogsInputError } from "./logs.errors.ts";
+import type { LogsFlags, LogsProgress, LogsSession } from "./logs.session.ts";
+
+export const filteredLogsSql = Effect.fnUntraced(function* (
+  flags: LogsFlags,
+  computeEnabled: boolean,
+) {
+  if (Option.isSome(flags.stack) || Option.isSome(flags.stackId))
+    return yield* new LogsInputError({ message: "--stack and --stack-id are local selectors." });
+  const enabledSources = hostedSources.filter(
+    (entry) => computeEnabled || entry.service !== "compute",
+  );
+  const selected =
+    flags.service.length === 0
+      ? flags.level.length > 0
+        ? enabledSources.filter(
+            ({ service }) => service !== "compute" && severityServices.includes(service),
+          )
+        : enabledSources
+      : enabledSources.filter((entry) => flags.service.includes(entry.service));
+  const unknown = flags.service.find(
+    (service) => !enabledSources.some((entry) => entry.service === service),
+  );
+  if (unknown !== undefined)
+    return yield* new LogsInputError({
+      message: `Unknown or disabled hosted service ${unknown}. Use logs sources --remote.`,
+    });
+  if (Option.isSome(flags.kind) && (selected.length !== 1 || selected[0]?.service !== "compute"))
+    return yield* new LogsInputError({ message: "--kind requires --service compute." });
+  if (
+    Option.isSome(flags.resource) &&
+    (selected.length !== 1 ||
+      !["compute", "functions", "function-edge"].includes(selected[0]?.service ?? ""))
+  )
+    return yield* new LogsInputError({
+      message:
+        "--resource requires one of: compute (name), functions or function-edge (function ID).",
+    });
+  if (flags.level.length > 0 && selected.some(({ service }) => !severityServices.includes(service)))
+    return yield* new LogsInputError({
+      message:
+        "--level is supported for postgres, edge, auth, functions, function-edge, and compute request/build logs. Select supported services explicitly.",
+    });
+  if (
+    flags.level.length > 0 &&
+    selected.some(({ service }) => service === "compute") &&
+    (!Option.isSome(flags.kind) || flags.kind.value === "app")
+  )
+    return yield* new LogsInputError({
+      message:
+        "Compute app output has no reliable severity. Use --kind requests or --kind builds with --level.",
+    });
+  const where = selected.map(({ source, service }) =>
+    service === "compute"
+      ? `log_attributes['subservice'] in (${Object.values(COMPUTE_LOG_STREAMS).map(quoteLogValue).join(", ")})`
+      : `source = ${quoteLogValue(source)}`,
+  );
+  const conditions = [`(${where.join(" or ")})`];
+  if (Option.isSome(flags.resource))
+    conditions.push(
+      `log_attributes['${selected[0]?.service === "compute" ? "worker" : "function_id"}'] = ${quoteLogValue(flags.resource.value)}`,
+    );
+  if (Option.isSome(flags.kind))
+    conditions.push(
+      `log_attributes['subservice'] = ${quoteLogValue(COMPUTE_LOG_STREAMS[flags.kind.value])}`,
+    );
+  if (flags.level.length > 0)
+    conditions.push(
+      `(${hostedSeveritySql}) in (${flags.level.map((level) => quoteLogValue(level.toLowerCase() === "warning" ? "warn" : level.toLowerCase())).join(", ")})`,
+    );
+  if (Option.isSome(flags.search))
+    conditions.push(
+      `positionCaseInsensitiveUTF8(event_message, ${quoteLogValue(flags.search.value)}) > 0`,
+    );
+  return `select id, toUnixTimestamp64Milli(timestamp) as ts_ms, source, severity_text, ${hostedSeveritySql} as level, event_message, log_attributes from logs where ${conditions.join(" and ")}`;
+});
+
+const logRow = Schema.Struct({
+  id: Schema.String,
+  ts_ms: Schema.Finite.pipe(
+    Schema.check(
+      Schema.isGreaterThanOrEqualTo(-8_640_000_000_000_000),
+      Schema.isLessThanOrEqualTo(8_640_000_000_000_000),
+    ),
+  ),
+  source: Schema.String,
+  severity_text: Schema.String,
+  level: Schema.String,
+  event_message: Schema.String,
+  log_attributes: Schema.Record(Schema.String, Schema.String),
+});
+
+type Cursor = Pick<typeof logRow.Type, "id" | "ts_ms">;
+const after = (row: Cursor, cursor: Cursor) =>
+  row.ts_ms > cursor.ts_ms || (row.ts_ms === cursor.ts_ms && row.id > cursor.id);
+const iso = (value: number) => DateTime.formatIso(DateTime.makeUnsafe(value));
+
+export const makeRemoteLogsSession = Effect.fn("Logs.remote.session")(function* (
+  flags: LogsFlags,
+  ref: string,
+  started: number,
+  computeEnabled: boolean,
+  customSql: string | undefined,
+  interactive = false,
+) {
+  const window = yield* logsWindow(flags, started);
+  const base = customSql === undefined ? yield* filteredLogsSql(flags, computeEnabled) : customSql;
+  const api = yield* (yield* CommandPlatformApiFactory).make;
+  let name: string | undefined;
+  if (interactive) {
+    const target = yield* Effect.serviceOption(CommandTarget);
+    const identity = Option.isSome(target)
+      ? Option.getOrUndefined(yield* target.value.json)
+      : undefined;
+    if (identity?.kind === "linked" && identity.project_ref === ref) name = identity.project_name;
+    if (name === undefined)
+      name = yield* api.v1.getProject({ ref }, { retry: { maxRetries: 0 } }).pipe(
+        Effect.map((project) => project.name),
+        Effect.timeout("2 seconds"),
+        Effect.orElseSucceed(() => undefined),
+      );
+  }
+  let attempted = false;
+  let committedEnd: number | undefined;
+  let seen = new Map<string, number>();
+  let initialFloor: Cursor | undefined;
+  let pending:
+    | { readonly start: number; readonly end: number; readonly cursor: Cursor }
+    | undefined;
+  const queryPage = Effect.fn("Logs.remote.page")(function* (
+    sql: string,
+    requested: { readonly start: string; readonly end: string },
+    progress: (update: LogsProgress) => Effect.Effect<void>,
+  ) {
+    return yield* queryLogs(api, ref, sql, requested).pipe(
+      Effect.retry({
+        while: (error) => error._tag === "LogsApiError" && error.status === 429,
+        schedule: Schedule.spaced("60 seconds").pipe(
+          Schedule.upTo({ times: 1 }),
+          Schedule.setInputType<Effect.Error<ReturnType<typeof queryLogs>>>(),
+          Schedule.modifyDelay(
+            Effect.fnUntraced(function* ({ input, duration }) {
+              const delay = Duration.max(
+                duration,
+                Duration.millis(input._tag === "LogsApiError" ? (input.retryAfterMs ?? 0) : 0),
+              );
+              const retryAt = iso((yield* Clock.currentTimeMillis) + Duration.toMillis(delay));
+              yield* progress({
+                message: `Rate limited. Retrying in ${Math.ceil(Duration.toMillis(delay) / 1000)}s at ${retryAt}.`,
+              });
+              return delay;
+            }),
+          ),
+        ),
+      }),
+    );
+  });
+  const load = Effect.fn("Logs.remote.load")(function* (
+    capturedEnd: number,
+    emit: (row: Schema.JsonObject) => Effect.Effect<void>,
+    progress: (update: LogsProgress) => Effect.Effect<void> = () => Effect.void,
+  ) {
+    const initial = committedEnd === undefined;
+    const firstAttempt = !attempted;
+    attempted = true;
+    const end =
+      pending?.end ??
+      (firstAttempt ? Date.parse(window.end) : Math.max(committedEnd ?? capturedEnd, capturedEnd));
+    const start =
+      pending?.start ??
+      (initial || customSql !== undefined
+        ? Date.parse(window.start)
+        : Math.max(Date.parse(window.start), (committedEnd ?? end) - 60_000));
+    if (end - start > 86_400_000)
+      return yield* new LogsInputError({
+        message:
+          "The refresh window exceeds 24 hours. Restart logs with a narrower --since or --from.",
+      });
+    const requested = { start: iso(start), end: iso(end) };
+    yield* progress({
+      message: customSql === undefined ? "Loading page 1…" : "Running SQL query…",
+      window: { kind: "range", start: window.start, end: requested.end },
+    });
+    if (customSql !== undefined) {
+      const rows = yield* queryLogs(api, ref, customSql, requested);
+      yield* Effect.forEach(rows, emit, { discard: true });
+      committedEnd = end;
+      return {
+        kind: "range",
+        start: window.start,
+        end: requested.end,
+      } satisfies import("./logs.browser.format.ts").LogsBrowserWindow;
+    }
+    const nextSeen = new Map(seen);
+    const retentionFloor = Math.max(Date.parse(window.start), end - 60_000);
+    let cursor: Cursor | undefined = pending?.cursor;
+    let nextPending: typeof pending;
+    let pages = 0;
+    let overlapCount = [...nextSeen.values()].filter((time) => time >= retentionFloor).length;
+    let floor = initialFloor;
+    while (true) {
+      const condition =
+        cursor === undefined
+          ? ""
+          : ` and (toUnixTimestamp64Milli(timestamp) > ${cursor.ts_ms} or (toUnixTimestamp64Milli(timestamp) = ${cursor.ts_ms} and id > ${quoteLogValue(cursor.id)}))`;
+      const sql = `${base}${condition} order by ts_ms ${initial ? "desc" : "asc"}, id ${initial ? "desc" : "asc"} limit ${initial ? flags.limit : 1000}`;
+      if (pages > 0)
+        yield* progress({
+          message: `Loading page ${pages + 1} (${pages} ${pages === 1 ? "page" : "pages"} received)…`,
+        });
+      const raw = yield* queryPage(sql, requested, progress);
+      pages += 1;
+      const rows = yield* Schema.decodeUnknownEffect(Schema.Array(logRow))(raw).pipe(
+        Effect.mapError(
+          () =>
+            new LogsApiError({
+              message: "The logs API returned an unreadable log row.",
+              status: 200,
+              reason: "response",
+            }),
+        ),
+      );
+      const pageCursor = cursor;
+      if (!initial && pageCursor !== undefined && rows.some((row) => !after(row, pageCursor)))
+        return yield* new LogsApiError({
+          message: "The logs API did not advance its page cursor.",
+          status: 200,
+          reason: "response",
+        });
+      const ordered = [...rows].sort(
+        (a, b) => a.ts_ms - b.ts_ms || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0),
+      );
+      for (const row of ordered) {
+        if (!initial && (seen.has(row.id) || (floor !== undefined && !after(row, floor)))) continue;
+        if (row.ts_ms >= retentionFloor) {
+          if (!nextSeen.has(row.id)) overlapCount += 1;
+          nextSeen.set(row.id, row.ts_ms);
+        }
+        if (overlapCount > 10_000)
+          return yield* new LogsInputError({
+            message:
+              "More than 10000 logs occupy the refresh overlap. Narrow the filters and restart logs.",
+          });
+        const service =
+          hostedSources.find(({ source }) => source === row.source && source !== "")?.service ??
+          (Object.values(COMPUTE_LOG_STREAMS).some(
+            (stream) => stream === row.log_attributes["subservice"],
+          )
+            ? "compute"
+            : row.source);
+        yield* emit({ ...row, service, timestamp: iso(row.ts_ms) });
+      }
+      if (initial) {
+        floor = rows.length === flags.limit ? ordered[0] : undefined;
+        break;
+      }
+      if (rows.length < 1000) break;
+      const last = ordered.at(-1);
+      if (last === undefined) break;
+      cursor = { id: last.id, ts_ms: last.ts_ms };
+      if (pages >= 5) {
+        nextPending = { start, end, cursor };
+        break;
+      }
+    }
+    if (nextPending === undefined)
+      for (const [id, time] of nextSeen) if (time < retentionFloor) nextSeen.delete(id);
+    seen = nextSeen;
+    pending = nextPending;
+    initialFloor = floor;
+    if (pending === undefined) committedEnd = end;
+    yield* Effect.annotateCurrentSpan({
+      "logs.page_count": pages,
+      "logs.pending": pending !== undefined,
+    });
+    return {
+      kind: "range",
+      start: window.start,
+      end: requested.end,
+      ...(pending === undefined ? {} : { pending: true }),
+    } satisfies import("./logs.browser.format.ts").LogsBrowserWindow;
+  });
+  const displayName = name === undefined ? undefined : sanitizeInlineName(name).trim() || undefined;
+  const shortName =
+    displayName !== undefined && displayName.length > 24
+      ? `${displayName.slice(0, 23)}…`
+      : displayName;
+  const session: LogsSession<Effect.Error<ReturnType<typeof load>>> = {
+    mode: customSql === undefined ? "append" : "replace",
+    context: shortName === undefined ? `Remote project ${ref}` : `Remote ${shortName} (${ref})`,
+    load,
+  };
+  return session;
+});
diff --git a/apps/cli/src/commands/logs/logs.routing.integration.test.ts b/apps/cli/src/commands/logs/logs.routing.integration.test.ts
new file mode 100644
index 0000000000..afcbf227ed
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.routing.integration.test.ts
@@ -0,0 +1,75 @@
+import { BunCrypto, BunServices } from "@effect/platform-bun";
+import { expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Layer, Sink, Stdio } from "effect";
+import { CliOutput, Command } from "effect/cli";
+import { rootCommandForFeatures } from "../../cli/root.ts";
+import { CliArgs } from "../../shared/cli/cli-args.service.ts";
+import { legacyProjectStateLayer } from "../../shared/config/legacy-project-state.layer.ts";
+import { textCliOutputFormatter } from "../../shared/output/text-formatter.ts";
+import {
+  mockAnalytics,
+  mockOutput,
+  mockProcessControl,
+  mockRuntimeInfo,
+  mockTelemetryRuntime,
+  mockTty,
+  processEnvLayer,
+} from "../../../tests/helpers/mocks.ts";
+
+it.effect.each([
+  { configured: true, override: undefined, expected: true },
+  { configured: true, override: "0", expected: false },
+  { configured: false, override: "1", expected: true },
+])(
+  "routes configured Compute log sources with config $configured and override $override",
+  ({ configured, override, expected }) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const home = yield* fs.makeTempDirectoryScoped({ prefix: "logs-routing-" });
+      yield* fs.makeDirectory(`${home}/supabase`);
+      yield* fs.writeFileString(
+        `${home}/supabase/config.toml`,
+        `[experimental]\ncompute = ${configured}\n`,
+      );
+      const env: Readonly<Record<string, string>> =
+        override === undefined ? {} : { SUPABASE_EXPERIMENTAL_COMPUTE: override };
+      const args = [
+        "logs",
+        "sources",
+        "--remote=abcdefghijklmnopqrst",
+        "--workdir",
+        home,
+        "--output-format",
+        "json",
+      ];
+      const chunks: string[] = [];
+      yield* Command.runWith(rootCommandForFeatures({}), { version: "test" })(args).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            CliOutput.layer(textCliOutputFormatter()),
+            Layer.succeed(CliArgs, { args }),
+            mockOutput({ format: "text" }).layer,
+            BunServices.layer,
+            BunCrypto.layer,
+            legacyProjectStateLayer.pipe(Layer.provide(BunServices.layer)),
+            mockRuntimeInfo({ homeDir: home, cwd: home }),
+            mockAnalytics().layer,
+            mockTelemetryRuntime({ configDir: home }),
+            mockTty(),
+            mockProcessControl().layer,
+            processEnvLayer({ ...env, SUPABASE_HOME: home }),
+            Stdio.layerTest({
+              args: Effect.succeed(args),
+              stdout: () =>
+                Sink.forEach((part: string | Uint8Array) =>
+                  Effect.sync(() => {
+                    chunks.push(typeof part === "string" ? part : new TextDecoder().decode(part));
+                  }),
+                ),
+            }),
+          ),
+        ),
+      );
+      expect(chunks.join("").includes('"compute"')).toBe(expected);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+);
diff --git a/apps/cli/src/commands/logs/logs.session.ts b/apps/cli/src/commands/logs/logs.session.ts
new file mode 100644
index 0000000000..ab2375e9a9
--- /dev/null
+++ b/apps/cli/src/commands/logs/logs.session.ts
@@ -0,0 +1,34 @@
+import type { Effect, Option, Schema } from "effect";
+import type { TargetFlagValues } from "../../command-internal/target/target-flags.ts";
+import type { LogsBrowserWindow } from "./logs.browser.format.ts";
+
+export interface LogsFlags extends TargetFlagValues {
+  readonly stack: Option.Option<string>;
+  readonly stackId: Option.Option<string>;
+  readonly service: ReadonlyArray<string>;
+  readonly resource: Option.Option<string>;
+  readonly kind: Option.Option<"app" | "requests" | "builds">;
+  readonly level: ReadonlyArray<string>;
+  readonly search: Option.Option<string>;
+  readonly since: Option.Option<string>;
+  readonly from: Option.Option<string>;
+  readonly to: Option.Option<string>;
+  readonly sql: Option.Option<string>;
+  readonly file: Option.Option<string>;
+  readonly limit: number;
+}
+
+export interface LogsProgress {
+  readonly message: string;
+  readonly window?: LogsBrowserWindow;
+}
+
+export interface LogsSession<E = never> {
+  readonly context?: string;
+  readonly mode: "append" | "replace";
+  readonly load: (
+    end: number,
+    emit: (row: Schema.JsonObject) => Effect.Effect<void>,
+    progress?: (update: LogsProgress) => Effect.Effect<void>,
+  ) => Effect.Effect<LogsBrowserWindow, E>;
+}
diff --git a/apps/cli/src/commands/migration/down/down.handler.ts b/apps/cli/src/commands/migration/down/down.handler.ts
index 46a22d98b1..7cf23e9dd6 100644
--- a/apps/cli/src/commands/migration/down/down.handler.ts
+++ b/apps/cli/src/commands/migration/down/down.handler.ts
@@ -4,7 +4,7 @@ import { DnsResolverFlag } from "../../../command-internal/global-flags.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { CommandSettings } from "../../../config/command-settings.service.ts";
 import { aqua, bold, yellow } from "../../../command-internal/colors.ts";
-import { readDbToml } from "../../../command-internal/db-config.toml-read.ts";
+import { readDbConfig } from "../../../command-internal/db-config.read.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
 import { DbConnection } from "../../../command-internal/db-connection.service.ts";
 import { dropUserSchemas } from "../../../command-internal/drop-objects.ts";
@@ -51,7 +51,7 @@ const runDown = Effect.fnUntraced(function* (flags: MigrationDownFlags) {
     }
 
     const ref = Option.getOrUndefined(cfg.ref ?? Option.none());
-    const toml = yield* readDbToml(fs, path, cliSettings.workdir, ref);
+    const toml = yield* readDbConfig(fs, path, cliSettings.workdir, ref);
 
     yield* Effect.scoped(
       Effect.gen(function* () {
diff --git a/apps/cli/src/commands/migration/down/down.integration.test.ts b/apps/cli/src/commands/migration/down/down.integration.test.ts
index 850f173f17..270ca6a92a 100644
--- a/apps/cli/src/commands/migration/down/down.integration.test.ts
+++ b/apps/cli/src/commands/migration/down/down.integration.test.ts
@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
 import { vi } from "vitest";
@@ -201,10 +201,13 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     Layer.succeed(YesFlag, opts.yes ?? false),
     Layer.succeed(OutputFlag, Option.none()),
     Layer.succeed(CliArgs, { args: opts.args ?? [] }),
-    commandRuntimeLayer(["migration", "down"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["migration", "down"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     mockTty({ stdinIsTty: interactive, stdoutIsTty: interactive }),
     branchApi.layer,
     BunServices.layer,
+    BunCrypto.layer,
   );
   return {
     layer,
diff --git a/apps/cli/src/commands/migration/fetch/fetch.integration.test.ts b/apps/cli/src/commands/migration/fetch/fetch.integration.test.ts
index 1b863753c4..b1486c7083 100644
--- a/apps/cli/src/commands/migration/fetch/fetch.integration.test.ts
+++ b/apps/cli/src/commands/migration/fetch/fetch.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
 import { vi } from "vitest";
@@ -174,7 +174,9 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     Layer.succeed(DnsResolverFlag, "native"),
     Layer.succeed(YesFlag, opts.yes ?? false),
     Layer.succeed(CliArgs, { args: opts.args ?? ["migration", "fetch"] }),
-    commandRuntimeLayer(["migration", "fetch"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["migration", "fetch"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     branchApi.layer,
     Layer.succeed(OutputFlag, Option.none()),
     Layer.succeed(TargetPolicy, { group: "selectable", consent: "none" }),
@@ -185,6 +187,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
       opts.pipedInput ?? (opts.confirm === undefined ? undefined : opts.confirm ? "y\n" : "n\n"),
     ),
     BunServices.layer,
+    BunCrypto.layer,
   );
   return {
     layer,
diff --git a/apps/cli/src/commands/migration/list/list.integration.test.ts b/apps/cli/src/commands/migration/list/list.integration.test.ts
index e743e64da0..bfe0e1e612 100644
--- a/apps/cli/src/commands/migration/list/list.integration.test.ts
+++ b/apps/cli/src/commands/migration/list/list.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
 import { vi } from "vitest";
@@ -153,9 +153,12 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     mockCommandSettings({ workdir }),
     Layer.succeed(DnsResolverFlag, "native"),
     Layer.succeed(CliArgs, { args: opts.args ?? [] }),
-    commandRuntimeLayer(["migration", "list"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["migration", "list"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     branchApi.layer,
     BunServices.layer,
+    BunCrypto.layer,
   );
   return {
     layer,
diff --git a/apps/cli/src/commands/migration/repair/repair.integration.test.ts b/apps/cli/src/commands/migration/repair/repair.integration.test.ts
index 2069be9a95..ce2182ac3f 100644
--- a/apps/cli/src/commands/migration/repair/repair.integration.test.ts
+++ b/apps/cli/src/commands/migration/repair/repair.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option } from "effect";
 import { vi } from "vitest";
@@ -190,10 +190,13 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     Layer.succeed(YesFlag, opts.yes ?? false),
     Layer.succeed(OutputFlag, Option.none()),
     Layer.succeed(CliArgs, { args: opts.args ?? [] }),
-    commandRuntimeLayer(["migration", "repair"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["migration", "repair"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     mockTty({ stdinIsTty: interactive, stdoutIsTty: interactive }),
     branchApi.layer,
     BunServices.layer,
+    BunCrypto.layer,
   );
   return {
     layer,
diff --git a/apps/cli/src/commands/migration/squash/SIDE_EFFECTS.md b/apps/cli/src/commands/migration/squash/SIDE_EFFECTS.md
index c03f8ce3ff..9a842b59e2 100644
--- a/apps/cli/src/commands/migration/squash/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/migration/squash/SIDE_EFFECTS.md
@@ -22,20 +22,20 @@ and uses an automatically assigned port; `db.shadow_port` applies only to the le
 
 ## Files Read
 
-| Path                                                                                               | Format                                                                                | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `<workdir>/supabase/config.toml`                                                                   | TOML                                                                                  | always, twice: `@supabase/config` for the shadow's own spec, `readDbToml` for shadow port/password/vault/baseline                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `auth.email.template.*` / `auth.email.notification.*` `content_path` (config-relative or absolute) | text (existence/readability only — bytes discarded, used only to validate the config) | only when `auth.enabled`, for every configured template and every notification with `enabled = true` — via the same `readDbToml` `Config.Validate` pipeline shared by `migration up`/`down` and every `db` subcommand that loads config (`dump`/`pull`/`reset`/`diff`/`push`/`schema declarative generate`/`sync` — documented on `db diff`'s `SIDE_EFFECTS.md` and here, rather than duplicated per file, CLI-2339); the resolved path is CONFINED to the project root (symlinks dereferenced using `fs.realPath`) — a path resolving outside it aborts before the read |
-| `<workdir>/supabase/migrations/`                                                                   | directory                                                                             | always                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `<workdir>/supabase/migrations/<version>_*.sql`                                                    | SQL                                                                                   | each migration up to the target, applied to the shadow; the target file's own final content is read by `--version`/baseline lookups                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `<workdir>/supabase/roles.sql`                                                                     | SQL                                                                                   | shadow `SetupDatabase` (custom-roles seed); missing file tolerated                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| managed snapshot key `<key>`                                                                       | backend                                                                               | warm stack-shadow baseline; managed retention may evict entries and snapshots survive stack destruction                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `<workdir>/supabase/.env`, `.env.local`, `SUPABASE_ENV`-selected dotenv                            | dotenv                                                                                | always (`--yes`/registry/network-id overrides)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `<workdir>/supabase/.temp/{project-ref,postgres-version,pooler-url}`                               | plain text                                                                            | a remote project: `project-ref` resolves the ref (bare `--remote` with no `SUPABASE_PROJECT_ID`) and tells whether it is the linked project; `pooler-url` is used only when the target ref is the linked ref; with no selector, `project-ref` only, to word the linked-checkout hint                                                                                                                                                                                                                                                                                     |
-| `<workdir>/supabase/.temp/linked-project.json`                                                     | JSON                                                                                  | to name the project in the `Target:` banner and the linked-checkout hint, and as the parent project for `--remote=<branch>`                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `~/.supabase/access-token`                                                                         | plain text                                                                            | a remote project without `--password`/`SUPABASE_ACCESS_TOKEN`, or when a branch is looked up                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `~/.docker/config.json` + Docker context store                                                     | JSON                                                                                  | resolving the Docker hostname for shadow/pg_dump containers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `PGSSL*` PEM, `pg_service.conf`                                                                    | PEM, libpq                                                                            | a remote project, when set; see `db push`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Path                                                                                               | Format                                                                                | When                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `<workdir>/supabase/config.toml`                                                                   | TOML                                                                                  | always, twice: `@supabase/config` for the shadow's own spec, `readDbConfig` for shadow port/password/vault/baseline                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `auth.email.template.*` / `auth.email.notification.*` `content_path` (config-relative or absolute) | text (existence/readability only — bytes discarded, used only to validate the config) | only when `auth.enabled`, for every configured template and every notification with `enabled = true` — via the same `readDbConfig` `Config.Validate` pipeline shared by `migration up`/`down` and every `db` subcommand that loads config (`dump`/`pull`/`reset`/`diff`/`push`/`schema declarative generate`/`sync` — documented on `db diff`'s `SIDE_EFFECTS.md` and here, rather than duplicated per file, CLI-2339); the resolved path is CONFINED to the project root (symlinks dereferenced using `fs.realPath`) — a path resolving outside it aborts before the read |
+| `<workdir>/supabase/migrations/`                                                                   | directory                                                                             | always                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `<workdir>/supabase/migrations/<version>_*.sql`                                                    | SQL                                                                                   | each migration up to the target, applied to the shadow; the target file's own final content is read by `--version`/baseline lookups                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `<workdir>/supabase/roles.sql`                                                                     | SQL                                                                                   | shadow `SetupDatabase` (custom-roles seed); missing file tolerated                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| managed snapshot key `<key>`                                                                       | backend                                                                               | warm stack-shadow baseline; managed retention may evict entries and snapshots survive stack destruction                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `<workdir>/supabase/.env`, `.env.local`, `SUPABASE_ENV`-selected dotenv                            | dotenv                                                                                | always (`--yes`/registry/network-id overrides)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `<workdir>/supabase/.temp/{project-ref,postgres-version,pooler-url}`                               | plain text                                                                            | a remote project: `project-ref` resolves the ref (bare `--remote` with no `SUPABASE_PROJECT_ID`) and tells whether it is the linked project; `pooler-url` is used only when the target ref is the linked ref; with no selector, `project-ref` only, to word the linked-checkout hint                                                                                                                                                                                                                                                                                       |
+| `<workdir>/supabase/.temp/linked-project.json`                                                     | JSON                                                                                  | to name the project in the `Target:` banner and the linked-checkout hint, and as the parent project for `--remote=<branch>`                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `~/.supabase/access-token`                                                                         | plain text                                                                            | a remote project without `--password`/`SUPABASE_ACCESS_TOKEN`, or when a branch is looked up                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `~/.docker/config.json` + Docker context store                                                     | JSON                                                                                  | resolving the Docker hostname for shadow/pg_dump containers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `PGSSL*` PEM, `pg_service.conf`                                                                    | PEM, libpq                                                                            | a remote project, when set; see `db push`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 
 ## Files Written
 
diff --git a/apps/cli/src/commands/migration/squash/squash.handler.ts b/apps/cli/src/commands/migration/squash/squash.handler.ts
index f9c5223fc1..4b5a59315e 100644
--- a/apps/cli/src/commands/migration/squash/squash.handler.ts
+++ b/apps/cli/src/commands/migration/squash/squash.handler.ts
@@ -28,7 +28,7 @@ import {
   shadowRunInputFromLocalContainerInputs,
 } from "../../../command-internal/db-bootstrap/shadow-database.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
-import { readDbToml, type DbTomlValues } from "../../../command-internal/db-config.toml-read.ts";
+import { readDbConfig, type DbConfigValues } from "../../../command-internal/db-config.read.ts";
 import type { ResolvedDbConfig } from "../../../command-internal/db-config.types.ts";
 import { DbConnection, type PgConnInput } from "../../../command-internal/db-connection.service.ts";
 import {
@@ -82,7 +82,7 @@ const squashMigrations = Effect.fn("MigrationSquash.squashMigrations")(function*
   migrations: ReadonlyArray<string>,
   targetPath: string,
   localInputs: LocalDbContainerInputs,
-  toml: DbTomlValues,
+  toml: DbConfigValues,
 ) {
   const stackBackend = (yield* currentStackBackend).kind === "stack";
   const resolvedShadowImage = stackBackend
@@ -315,7 +315,7 @@ const squashToVersion = Effect.fn("MigrationSquash.squashToVersion")(function* (
   migrations: ReadonlyArray<string>,
   local: string,
   localInputs: LocalDbContainerInputs,
-  toml: DbTomlValues,
+  toml: DbConfigValues,
 ) {
   const output = yield* Output;
   const rel = path.relative(workdir, local);
@@ -449,7 +449,7 @@ const runSquash = Effect.fnUntraced(function* (flags: MigrationSquashFlags) {
 
     // Reads the remote-merged config before resolving the connection (like `db diff --remote`);
     // read unconditionally since the shadow is provisioned locally either way.
-    const toml = yield* readDbToml(fs, path, cliSettings.workdir, linkedRef);
+    const toml = yield* readDbConfig(fs, path, cliSettings.workdir, linkedRef);
     if (toml.appliedRemote !== undefined) {
       yield* output.raw(`Loading config override: [remotes.${toml.appliedRemote}]\n`, "stderr");
     }
diff --git a/apps/cli/src/commands/migration/squash/squash.integration.test.ts b/apps/cli/src/commands/migration/squash/squash.integration.test.ts
index a5a5707bb6..961f083463 100644
--- a/apps/cli/src/commands/migration/squash/squash.integration.test.ts
+++ b/apps/cli/src/commands/migration/squash/squash.integration.test.ts
@@ -1,7 +1,7 @@
 import { cliConfigValuesTestLayer } from "../../../../tests/helpers/config-values-layer.ts";
 import { describeDbTargetSelection } from "../../../../tests/helpers/db-target-selection.ts";
 import { unusedStackServices } from "../../../../tests/helpers/unused-stack.ts";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Config, ConfigProvider, Effect, FileSystem, Layer, Option, Path } from "effect";
 import { PlatformError, SystemError } from "effect/PlatformError";
@@ -223,7 +223,7 @@ function faultyFsLayer(workdir: string, opts: FsFaultOpts): Layer.Layer<FileSyst
         },
       });
     }),
-  ).pipe(Layer.provide(BunServices.layer));
+  ).pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
 }
 
 const alwaysReadyHttpClientLayer = Layer.succeed(
@@ -350,6 +350,7 @@ function fakeServices(workdir: string, opts: SetupOpts = {}) {
     // Listed first so every fake service layer below overrides it; Layer.mergeAll is
     // last-wins on a shared service.
     BunServices.layer,
+    BunCrypto.layer,
     cliConfigValuesTestLayer,
     opts.realLayers === true
       ? realDbConfigResolver({
@@ -449,7 +450,9 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     Layer.succeed(OutputFlag, Option.none()),
     Layer.succeed(TargetPolicy, { group: "selectable", consent: "no" }),
     Layer.succeed(CliArgs, { args: opts.args ?? [] }),
-    commandRuntimeLayer(["migration", "squash"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["migration", "squash"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     mockTty({ stdinIsTty: interactive, stdoutIsTty: interactive }),
   );
 
diff --git a/apps/cli/src/commands/migration/squash/squash.native.integration.test.ts b/apps/cli/src/commands/migration/squash/squash.native.integration.test.ts
index 539cf73330..5c65d8d056 100644
--- a/apps/cli/src/commands/migration/squash/squash.native.integration.test.ts
+++ b/apps/cli/src/commands/migration/squash/squash.native.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Layer, Option, Path } from "effect";
 import { FetchHttpClient } from "effect/http";
@@ -107,7 +107,7 @@ const testLayer = (root: string) =>
     stackCatalogSetupLayer,
     stackBackendLayer("stack"),
     cliConfigValuesTestLayer,
-  ).pipe(Layer.provideMerge(BunServices.layer));
+  ).pipe(Layer.provideMerge(Layer.merge(BunServices.layer, BunCrypto.layer)));
 
 describe("managed migration squash", { timeout: 180_000 }, () => {
   for (const runtime of runtimes) {
diff --git a/apps/cli/src/commands/migration/up/up.handler.ts b/apps/cli/src/commands/migration/up/up.handler.ts
index 7922c583d8..127b2350e1 100644
--- a/apps/cli/src/commands/migration/up/up.handler.ts
+++ b/apps/cli/src/commands/migration/up/up.handler.ts
@@ -4,7 +4,7 @@ import { DnsResolverFlag } from "../../../command-internal/global-flags.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { CommandSettings } from "../../../config/command-settings.service.ts";
 import { bold } from "../../../command-internal/colors.ts";
-import { readDbToml } from "../../../command-internal/db-config.toml-read.ts";
+import { readDbConfig } from "../../../command-internal/db-config.read.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
 import { DbConnection } from "../../../command-internal/db-connection.service.ts";
 import {
@@ -54,7 +54,7 @@ const runUp = Effect.fnUntraced(function* (flags: MigrationUpFlags) {
       networkBanRemoval: yield* hostedMutationPreapproval,
     });
     const ref = Option.getOrUndefined(cfg.ref ?? Option.none());
-    const toml = yield* readDbToml(fs, path, cliSettings.workdir, ref);
+    const toml = yield* readDbConfig(fs, path, cliSettings.workdir, ref);
     yield* Effect.annotateCurrentSpan({
       "db.conn_type": target.kind,
       "db.is_local": cfg.isLocal,
diff --git a/apps/cli/src/commands/migration/up/up.integration.test.ts b/apps/cli/src/commands/migration/up/up.integration.test.ts
index 27c926b3e9..41d127a6a2 100644
--- a/apps/cli/src/commands/migration/up/up.integration.test.ts
+++ b/apps/cli/src/commands/migration/up/up.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option, Path } from "effect";
 import { vi } from "vitest";
@@ -182,9 +182,12 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     mockCommandSettings({ workdir }),
     Layer.succeed(DnsResolverFlag, "native"),
     Layer.succeed(CliArgs, { args: opts.args ?? [] }),
-    commandRuntimeLayer(["migration", "up"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["migration", "up"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     branchApi.layer,
     BunServices.layer,
+    BunCrypto.layer,
   );
   return {
     layer,
diff --git a/apps/cli/src/commands/pull/pull.command.ts b/apps/cli/src/commands/pull/pull.command.ts
index 7c2b7708ab..aa94a56c86 100644
--- a/apps/cli/src/commands/pull/pull.command.ts
+++ b/apps/cli/src/commands/pull/pull.command.ts
@@ -36,7 +36,7 @@ const config = {
   ),
   force: Flag.Boolean("force").pipe(
     Flag.withDescription(
-      "Write even when supabase/config.toml (or config.json), supabase/migrations, or supabase/functions has uncommitted or untracked changes in git.",
+      "Write even when the project config file, supabase/migrations, or supabase/functions has uncommitted or untracked changes in git.",
     ),
     Flag.withDefault(false),
   ),
@@ -70,7 +70,7 @@ export const pullHandler = (flags: PullFlags) =>
 
 export const pullCommand = Command.make("pull", config).pipe(
   Command.withDescription(
-    "Refreshes local project state from a linked Supabase project or branch in one step: pulls config into supabase/config.toml, optionally fetches the remote migration history table, pulls the database schema into supabase/migrations (also updating that database's migration history), and downloads every Edge Function's source. Asks for confirmation (default No) before writing, because the database step records the migration in the remote migration history table: an interactive terminal is prompted, and --output-format json|stream-json or a non-interactive run needs --yes (or SUPABASE_YES in the shell environment) — use --dry-run to preview first.",
+    "Refreshes local project state from a linked Supabase project or branch in one step: pulls config into the project config file, optionally fetches the remote migration history table, pulls the database schema into supabase/migrations (also updating that database's migration history), and downloads every Edge Function's source. Asks for confirmation (default No) before writing, because the database step records the migration in the remote migration history table: an interactive terminal is prompted, and --output-format json|stream-json or a non-interactive run needs --yes (or SUPABASE_YES in the shell environment) — use --dry-run to preview first.",
   ),
   Command.withShortDescription("Pull remote project state into the local checkout"),
   Command.withExamples([
diff --git a/apps/cli/src/commands/pull/pull.integration.test.ts b/apps/cli/src/commands/pull/pull.integration.test.ts
index 46895bc7c6..8d3a032636 100644
--- a/apps/cli/src/commands/pull/pull.integration.test.ts
+++ b/apps/cli/src/commands/pull/pull.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -273,7 +273,7 @@ function composeSpawner(
           return inner.spawn(command);
         }
         if (command.command === "git") {
-          gitCalls.push(command.args);
+          gitCalls.push(command.args.map(String));
           if (opts.gitSpawnFails === true) {
             return Effect.fail(
               PlatformError.systemError({
@@ -722,7 +722,7 @@ function setupSubstrate(
   const layer = Layer.mergeAll(
     configValuesLayer({ output: outputLayer }),
     machineErrorContextLayer,
-    commandRuntimeLayer(["pull"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["pull"]).pipe(Layer.provide([BunServices.layer, BunCrypto.layer])),
     stdioLayer,
     opts.realLayers === true
       ? Layer.mergeAll(
@@ -1660,7 +1660,7 @@ describe("pull integration", () => {
 
         expect(telemetry.flushed).toBe(true);
         expect(linkedProjectCache.cached).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1776,7 +1776,7 @@ describe("pull integration", () => {
           // step's TOCTOU guard rather than routing the db step onto the unmocked migra path.
           confirmSideEffect: writeConfigFile(
             'project_id = "changed-mid-flight"\n\n[experimental.pgdelta]\nenabled = true\n',
-          ).pipe(Effect.provide(BunServices.layer)),
+          ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           api: { functionSlugs: ["hello"] },
           remoteMigrations: [
             { version: "20260101000000", name: "init", statements: ["select 1;"] },
@@ -1812,7 +1812,7 @@ describe("pull integration", () => {
           confirm: [true],
           confirmSideEffect: writeConfigFile(
             'project_id = "changed-mid-flight"\n\n[experimental.pgdelta]\nenabled = true\n',
-          ).pipe(Effect.provide(BunServices.layer)),
+          ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           api: { functionSlugs: [] },
           remoteMigrations: [
             { version: "20260101000000", name: "init", statements: ["select 1;"] },
@@ -1846,7 +1846,7 @@ describe("pull integration", () => {
           // --remote-label was never passed) is ever written.
           confirmSideEffect: writeConfigFile(
             'project_id = "changed-mid-flight"\n\n[experimental.pgdelta]\nenabled = true\n',
-          ).pipe(Effect.provide(BunServices.layer)),
+          ).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           api: { functionSlugs: [] },
           remoteMigrations: [
             { version: "20260101000000", name: "init", statements: ["select 1;"] },
diff --git a/apps/cli/src/commands/secrets/set/set.handler.ts b/apps/cli/src/commands/secrets/set/set.handler.ts
index 57be31b0c3..f1d4ff312f 100644
--- a/apps/cli/src/commands/secrets/set/set.handler.ts
+++ b/apps/cli/src/commands/secrets/set/set.handler.ts
@@ -18,7 +18,9 @@ import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { RuntimeInfo } from "../../../shared/runtime/runtime-info.service.ts";
 import { requireHostedMutationConsent } from "../../../command-internal/hosted-consent/hosted-consent.ts";
+import { DEFAULT_CONFIG_FILE } from "../../../command-internal/config-advice.ts";
 import { mapHttpError, sanitizeInlineName } from "../../../command-internal/http-errors.ts";
+import { relativeConfigPath } from "../../../command-internal/workdir-project.ts";
 import {
   InvalidSecretPairError,
   SecretsEnvFileOpenError,
@@ -111,12 +113,12 @@ export const secretsSet = Effect.fn("secrets.set")(function* (flags: SecretsSetF
   const ref = yield* resolveProjectTarget(flags);
 
   yield* Effect.gen(function* () {
-    // Source 1: `[edge_runtime.secrets]` from `supabase/config.toml`. Only resolved values are
+    // Source 1: `[edge_runtime.secrets]` from the project config file. Only resolved values are
     // sent: `resolveCliSubtree` wraps every resolved secret leaf in `Redacted<string>`,
     // while unresolved `env(VAR)` references stay plain strings, so `Redacted.isRedacted`
     // distinguishes them.
     const merged = new Map<string, string>();
-    // A malformed config.toml (or sibling .env/.env.local) is swallowed here (logged, not
+    // A malformed config file (or sibling .env/.env.local) is swallowed here (logged, not
     // fatal) and proceeds with empty config-sourced secrets — env-file and positional-arg
     // secrets still work. An invalid value in an unrelated key is left out of the resolved config
     // rather than failing it.
@@ -144,7 +146,11 @@ export const secretsSet = Effect.fn("secrets.set")(function* (flags: SecretsSetF
               loadedResolvedConfig.invalid.length === 0
                 ? Effect.void
                 : debugLogger.debug(
-                    "failed to parse supabase/config.toml: schema validation failed",
+                    `failed to parse ${
+                      loadedResolvedConfig.hasConfigFile
+                        ? relativeConfigPath(cliSettings.workdir, loadedResolvedConfig.loaded.path)
+                        : DEFAULT_CONFIG_FILE.path
+                    }: schema validation failed`,
                   ),
             ),
             Effect.as<ConfigSecretSource>({
@@ -168,7 +174,9 @@ export const secretsSet = Effect.fn("secrets.set")(function* (flags: SecretsSetF
             // that order.
             return reportRemote(cause.appliedRemote).pipe(
               Effect.andThen(
-                debugLogger.debug(`failed to parse supabase/config.toml: ${shortMessage}`),
+                debugLogger.debug(
+                  `failed to parse ${relativeConfigPath(cliSettings.workdir, cause.path)}: ${shortMessage}`,
+                ),
               ),
               Effect.as<ConfigSecretSource>({
                 edgeRuntime: recoverEdgeRuntimeConfig(cause)?.edge_runtime,
diff --git a/apps/cli/src/commands/seed/buckets/buckets.command.ts b/apps/cli/src/commands/seed/buckets/buckets.command.ts
index e352673fe4..686d2f41f9 100644
--- a/apps/cli/src/commands/seed/buckets/buckets.command.ts
+++ b/apps/cli/src/commands/seed/buckets/buckets.command.ts
@@ -19,8 +19,8 @@ import { withTargetPolicy } from "../../../command-internal/target/target-policy
 export type BucketsFlags = TargetFlagValues;
 
 export const bucketsCommand = Command.make("buckets").pipe(
-  Command.withDescription("Seed buckets declared in [storage.buckets]."),
-  Command.withShortDescription("Seed buckets declared in [storage.buckets]"),
+  Command.withDescription("Seed buckets declared in storage.buckets."),
+  Command.withShortDescription("Seed buckets declared in storage.buckets"),
   withPermissions(storagePermissions([])),
   Command.withHandler(() =>
     Effect.gen(function* () {
diff --git a/apps/cli/src/commands/seed/buckets/buckets.integration.test.ts b/apps/cli/src/commands/seed/buckets/buckets.integration.test.ts
index c8c2ed78c1..b67093ec10 100644
--- a/apps/cli/src/commands/seed/buckets/buckets.integration.test.ts
+++ b/apps/cli/src/commands/seed/buckets/buckets.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { loadCliConfig } from "@supabase/config/internal";
 import {
@@ -280,6 +280,7 @@ const setupSeedBuckets = Effect.fnUntraced(function* (
     ConfigProvider.layer(ConfigProvider.fromEnvRecord(process.env, { preserveEmptyStrings: true })),
     mockCommandSettings({ workdir, explicitWorkdir: opts.explicitWorkdir ?? false }),
     BunServices.layer,
+    BunCrypto.layer,
     recorder.layer,
     cliConfigValuesTestLayer,
     runtimeInfoLayer,
@@ -287,7 +288,9 @@ const setupSeedBuckets = Effect.fnUntraced(function* (
     mockTty({ stdinIsTty: true, stdoutIsTty: false }),
     mockStdin(true, opts.pipedAnswers ? `${opts.pipedAnswers.join("\n")}\n` : undefined),
     Layer.succeed(CliArgs, { args: opts.args ?? ["seed", "buckets"] }),
-    commandRuntimeLayer(["seed", "buckets"]).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(["seed", "buckets"]).pipe(
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
+    ),
     Layer.succeed(YesFlag, opts.yes ?? false),
     projectRefLayer,
     recorded === undefined
@@ -352,7 +355,7 @@ describe("seed buckets", () => {
   ): Effect.Effect<A, E> =>
     OVERRIDE_ENV_KEYS.reduce<Effect.Effect<A, E>>(
       (acc, key) => withEnvVar(key, undefined, acc),
-      body.pipe(Effect.provide(BunServices.layer)),
+      body.pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
   it.effect("short-circuits with no output when nothing is configured", () =>
@@ -3004,7 +3007,7 @@ describe("seed buckets", () => {
         const loaded = yield* loadCliConfig(tmp.current, {
           cliCompat: true,
           search: false,
-        }).pipe(Effect.provide(BunServices.layer));
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
         if (loaded === null) {
           throw new Error("test setup: config.toml failed to load");
         }
@@ -3050,7 +3053,7 @@ describe("stack backend", () => {
         requests.some((r) => r.method === "POST" && r.url.endsWith("/storage/v1/bucket")),
       ).toBe(true);
       expect(requests.some((r) => r.url.includes("/storage/v1/object/"))).toBe(true);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("seeds buckets without reading or writing supabase/.temp", () =>
@@ -3073,7 +3076,7 @@ describe("stack backend", () => {
 
       expect(accessed.some((entry) => entry.endsWith("a.txt"))).toBe(true);
       expect(legacyStateAccesses(accessed)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("a malformed SUPABASE_API_PORT fails the config load under either backend", () =>
@@ -3093,7 +3096,7 @@ describe("stack backend", () => {
         }
         expect(requests).toHaveLength(0);
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -3113,7 +3116,7 @@ describe("stack backend", () => {
         expect(capability).toBeInstanceOf(StackStorageCapabilityError);
         expect(capability?.suggestion).toContain("--exclude storage");
         expect(requests).toHaveLength(0);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -3133,7 +3136,7 @@ describe("stack backend", () => {
         expect(unavailable).toBeInstanceOf(StackStorageUnavailableError);
         expect(unavailable?.suggestion).toContain("supabase start");
         expect(requests).toHaveLength(0);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
 
diff --git a/apps/cli/src/commands/seed/seed.command.ts b/apps/cli/src/commands/seed/seed.command.ts
index fdb701288d..04ec7f313a 100644
--- a/apps/cli/src/commands/seed/seed.command.ts
+++ b/apps/cli/src/commands/seed/seed.command.ts
@@ -4,7 +4,7 @@ import { seedTargetGlobalFlags } from "../../command-internal/target/target-flag
 import { bucketsCommand } from "./buckets/buckets.command.ts";
 
 export const seedCommand = Command.make("seed").pipe(
-  Command.withDescription("Seed a Supabase project from supabase/config.toml."),
+  Command.withDescription("Seed a Supabase project from its config file."),
   Command.withShortDescription("Seed a Supabase project"),
   Command.withSubcommands([bucketsCommand]),
   // The selector flags are persistent, accepted before or after the subcommand. Kept after
diff --git a/apps/cli/src/commands/services/SIDE_EFFECTS.md b/apps/cli/src/commands/services/SIDE_EFFECTS.md
index f562766237..9eb8041645 100644
--- a/apps/cli/src/commands/services/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/services/SIDE_EFFECTS.md
@@ -44,6 +44,7 @@ Tenant calls send `apikey: <serviceKey>` and additionally
 | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN`       | auth token for Management API linked-version checks                                                                                                                                                                                                                                           | no (falls back to keyring, then `~/.supabase/access-token`) |
 | `SUPABASE_PROFILE`            | built-in profile name or YAML file path                                                                                                                                                                                                                                                       | no (falls back to `~/.supabase/profile` -> `supabase`)      |
+| `SUPABASE_API_MAX_RETRIES`    | Management API client retries for linked-version checks (`0` = none)                                                                                                                                                                                                                          | no (falls back to 5)                                        |
 | `SUPABASE_USE_SLIM_IMAGES`    | Ambient `process.env` only (`true`/`1` enable). Rewrites legacy current-pin `SERVICE IMAGE`/`name` fields to `ghcr.io/supabase/cli/<service>`; Kong stays on docker.io. Majors 13/15 list the slim `15.14.1.167` pin when enabled; flag-off keeps `15.8.1.085`. Ignored by the stack backend. | no                                                          |
 | `SUPABASE_EXPERIMENTAL_STACK` | Selects the stack backend (`1`/`true`) or legacy backend (`0`/`false`); unset or empty uses `experimental.stack`. Non-boolean values fail routing.                                                                                                                                            | no                                                          |
 | `SUPABASE_DB_MAJOR_VERSION`   | Stack backend PostgreSQL major override; supported values are 15 and 17.                                                                                                                                                                                                                      | no                                                          |
diff --git a/apps/cli/src/commands/services/services.handler.ts b/apps/cli/src/commands/services/services.handler.ts
index d062da032a..0d8f0d8c65 100644
--- a/apps/cli/src/commands/services/services.handler.ts
+++ b/apps/cli/src/commands/services/services.handler.ts
@@ -9,7 +9,7 @@ import {
 import { LinkedProjectCache } from "../../telemetry/linked-project-cache.service.ts";
 import { TelemetryState } from "../../telemetry/telemetry-state.service.ts";
 import { failOnInvalidConfigValue } from "../../command-internal/config-value-passthrough.ts";
-import { readDbToml } from "../../command-internal/db-config.toml-read.ts";
+import { readDbConfig } from "../../command-internal/db-config.read.ts";
 import { resolveDbImage } from "../../command-internal/db-image.ts";
 import { resolveEdgeRuntimeImage } from "../../command-internal/edge-runtime-image.ts";
 import { readServiceVersionOverrides } from "../../command-internal/service-version-overrides.ts";
@@ -141,6 +141,7 @@ export const services = Effect.fn("services")(function* (_flags: ServicesFlags)
               projectRef: validLinkedRef.value,
               accessToken: accessToken.value,
               userAgent: cliSettings.userAgent,
+              maxRetries: Option.getOrUndefined(cliSettings.apiMaxRetries),
             })
           : {};
       const result = yield* stackServiceVersions(cliSettings.workdir, remote);
@@ -153,7 +154,7 @@ export const services = Effect.fn("services")(function* (_flags: ServicesFlags)
       rows = result.rows;
     } else {
       yield* failOnInvalidConfigValue(cliSettings.workdir, linkedProjectRef);
-      const tomlValues = yield* readDbToml(
+      const tomlValues = yield* readDbConfig(
         fs,
         path,
         cliSettings.workdir,
@@ -210,6 +211,7 @@ export const services = Effect.fn("services")(function* (_flags: ServicesFlags)
           projectRef: validLinkedRef.value,
           accessToken: accessToken.value,
           userAgent: cliSettings.userAgent,
+          maxRetries: Option.getOrUndefined(cliSettings.apiMaxRetries),
         });
         rows = mergeRemoteServiceVersions(remote, localImageOptions);
       }
diff --git a/apps/cli/src/commands/services/services.integration.test.ts b/apps/cli/src/commands/services/services.integration.test.ts
index 872be19f58..5072b7f54b 100644
--- a/apps/cli/src/commands/services/services.integration.test.ts
+++ b/apps/cli/src/commands/services/services.integration.test.ts
@@ -1,7 +1,7 @@
 import { legacyProjectStateLayer } from "../../shared/config/legacy-project-state.layer.ts";
 import { describe, expect, it } from "@effect/vitest";
 import { catalogPins, orioledbVersions } from "@supabase/stack/internal/artifacts";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { CliOutput, Command } from "effect/cli";
 import {
   Cause,
@@ -131,6 +131,7 @@ function setup(
           workdir: opts.workdir ?? defaultWorkdir.current,
           explicitWorkdir: false,
           userAgent: "SupabaseCLI/test",
+          apiMaxRetries: Option.none(),
         }),
       ),
       Layer.succeed(
@@ -270,6 +271,7 @@ describe("services", () => {
       const layer = Layer.mergeAll(
         cliConfigValuesTestLayer,
         BunServices.layer,
+        BunCrypto.layer,
         legacyProjectStateLayer.pipe(Layer.provide(BunServices.layer)),
         processControlLayer,
         CliOutput.layer(textCliOutputFormatter()),
diff --git a/apps/cli/src/commands/services/services.layers.unit.test.ts b/apps/cli/src/commands/services/services.layers.unit.test.ts
index 211e01f742..c2e84966ab 100644
--- a/apps/cli/src/commands/services/services.layers.unit.test.ts
+++ b/apps/cli/src/commands/services/services.layers.unit.test.ts
@@ -5,7 +5,7 @@
  */
 
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer, Option } from "effect";
 
 import {
@@ -59,6 +59,7 @@ function ambientStubs() {
 
   return Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     // The runtime layer under test builds the real commandSettingsLayer against
     // the real filesystem — see isolatedHomeLayer's docs.
     isolatedHomeLayer(tempRoot.current),
diff --git a/apps/cli/src/commands/sso/list/SIDE_EFFECTS.md b/apps/cli/src/commands/sso/list/SIDE_EFFECTS.md
index 78e42cd4a8..19a341faac 100644
--- a/apps/cli/src/commands/sso/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/sso/list/SIDE_EFFECTS.md
@@ -26,17 +26,19 @@ Target: hosted, no consent — see [Command target](../../../../docs/command-tar
 | `GET`  | `/v1/projects`                                 | Bearer token | none         | project list for the interactive picker — only when no ref comes from `--remote=<ref>`, `SUPABASE_PROJECT_ID` or `.temp/project-ref` and stdin is a TTY with interactive output                                                                          |
 | `GET`  | `/v1/projects/{parent}/branches`               | Bearer token | none         | `[{id, name, project_ref, is_default}]` — only for `--remote=<branch>` (or the deprecated `--project-ref=<branch>`), and for a bare `--remote` followed by a word that could name a branch; `{parent}` is `SUPABASE_PROJECT_ID`, else the linked project |
 | `GET`  | `/v1/branches/{id}`                            | Bearer token | none         | `{ref, status, …}` — only for `--remote=<branch UUID>` when no project is linked                                                                                                                                                                         |
-| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers` | Bearer token | none         | `{items: [{id, saml?, domains?, created_at?, updated_at?}]}`                                                                                                                                                                                             |
+| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers` | Bearer token | none         | `{items: [{id, saml?, domains?, created_at?, updated_at?}]}` — 10s per attempt, 1 retry unless `SUPABASE_API_MAX_RETRIES` is set                                                                                                                         |
 | `GET`  | `/v1/projects/{ref}`                           | Bearer token | none         | `{organization_slug}` — upgrade-gate side-call on a 4xx with no plan-gate error in the body                                                                                                                                                              |
 | `GET`  | `/v1/organizations/{slug}/entitlements`        | Bearer token | none         | `{entitlements[].feature.key, .hasAccess}` — upgrade-gate side-call on a 4xx with no plan-gate error in the body                                                                                                                                         |
 | `GET`  | `/v1/projects/{ref}`                           | Bearer token | none         | `{ref, name, organization_id, organization_slug}` — `linkedProjectCache` fill, best-effort, skipped when `.temp/linked-project.json` exists, `.temp/project-ref` names another ref, or no token is available                                             |
+| `GET`  | `/v1/projects/{ref}`                           | Bearer token | none         | `{status}` — health lookup after a transport failure or 5xx from the SSO call; warns when not `ACTIVE_HEALTHY`, no retries, 10s timeout                                                                                                                  |
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
+| Variable                   | Purpose                                                          | Required?                                               |
+| -------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN`    | auth token (bypasses credential file/keyring lookup)             | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROFILE`         | profile selector (built-in name or YAML file path)               | no (defaults to `supabase`)                             |
+| `SUPABASE_API_MAX_RETRIES` | Management API retries after the first attempt (`0` = send once) | no (SSO reads fall back to 1)                           |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/commands/sso/list/list.handler.ts b/apps/cli/src/commands/sso/list/list.handler.ts
index 1aa92b957f..ceec27a749 100644
--- a/apps/cli/src/commands/sso/list/list.handler.ts
+++ b/apps/cli/src/commands/sso/list/list.handler.ts
@@ -21,6 +21,7 @@ import {
   SsoListUnexpectedStatusError,
   SsoTomlEncodeError,
 } from "../sso.errors.ts";
+import { ssoReadRequestOptions, warnIfProjectUnhealthy } from "../sso.request-policy.ts";
 import { renderListProviders } from "../sso.format.ts";
 import type { SsoListFlags } from "./list.command.ts";
 
@@ -74,8 +75,9 @@ export const ssoList = Effect.fn("sso.list")(function* (flags: SsoListFlags) {
     yield* Effect.gen(function* () {
       const fetching =
         output.format === "text" ? yield* output.task("Fetching SSO providers...") : undefined;
-      const response = yield* api.v1.listAllSsoProvider({ ref }).pipe(
+      const response = yield* api.v1.listAllSsoProvider({ ref }, yield* ssoReadRequestOptions).pipe(
         Effect.tapError(() => fetching?.fail() ?? Effect.void),
+        Effect.tapError((cause) => warnIfProjectUnhealthy(ref, cause)),
         Effect.catch((cause) => handleListError(ref, cause)),
       );
       yield* fetching?.clear ?? Effect.void;
diff --git a/apps/cli/src/commands/sso/list/list.integration.test.ts b/apps/cli/src/commands/sso/list/list.integration.test.ts
index 0ea2e51daa..d15e9891db 100644
--- a/apps/cli/src/commands/sso/list/list.integration.test.ts
+++ b/apps/cli/src/commands/sso/list/list.integration.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Cause, Effect, Exit, FileSystem, Option, Schema } from "effect";
+import { Cause, Effect, Exit, Fiber, FileSystem, Latch, Option, Schema } from "effect";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
+import { TestClock } from "effect/testing";
 
 import { mockAnalytics, mockOutput, mockTty } from "../../../../tests/helpers/mocks.ts";
 import {
@@ -59,6 +60,9 @@ interface SetupOpts {
   //   "notGated"  → entitlement says auth.saml_2 has_access=true
   //   undefined   → no extra handlers wired; project lookup 404s
   upgradeGate?: "gated" | "notGated";
+  projectStatus?: string;
+  stallProviders?: boolean;
+  apiMaxRetries?: Option.Option<number>;
 }
 
 function jsonResponse(
@@ -84,16 +88,20 @@ function setup(opts: SetupOpts = {}) {
   const status = opts.status ?? 200;
   const body = opts.body ?? { items: [PROVIDER_ITEM] };
   const gate = opts.upgradeGate;
+  const providersStalled = Latch.makeUnsafe(false);
 
   const api = mockCommandPlatformApi({
     network: opts.network,
     handler: (request) => {
       const url = request.url;
       if (url.includes("/config/auth/sso/providers")) {
+        if (opts.stallProviders === true) {
+          return Effect.andThen(providersStalled.open, Effect.never);
+        }
         return Effect.succeed(jsonResponse(request, status, body));
       }
       if (url.endsWith(`/v1/projects/${VALID_REF}`)) {
-        if (gate === undefined) {
+        if (gate === undefined && opts.projectStatus === undefined) {
           return Effect.succeed(jsonResponse(request, 404, {}));
         }
         return Effect.succeed(
@@ -105,7 +113,7 @@ function setup(opts: SetupOpts = {}) {
             name: "Test",
             region: "us-east-1",
             created_at: "2023-01-01T00:00:00Z",
-            status: "ACTIVE_HEALTHY",
+            status: opts.projectStatus ?? "ACTIVE_HEALTHY",
             database: {
               host: "db.example.com",
               version: "15",
@@ -136,6 +144,7 @@ function setup(opts: SetupOpts = {}) {
   const cliSettings = mockCommandSettings({
     workdir: tempRoot.current,
     projectId: opts.projectId,
+    apiMaxRetries: opts.apiMaxRetries ?? Option.some(0),
   });
   const layer = buildTestRuntime({
     out,
@@ -147,7 +156,7 @@ function setup(opts: SetupOpts = {}) {
     outputFlag: opts.outputFlag === undefined ? Option.none() : Option.some(opts.outputFlag),
   });
 
-  return { layer, out, api, analytics, telemetry, cache };
+  return { layer, out, api, analytics, telemetry, cache, providersStalled };
 }
 
 describe("sso list integration", () => {
@@ -372,6 +381,61 @@ describe("sso list integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect("warns about the project status when listing fails on an inactive project", () => {
+    const { layer, out } = setup({ status: 500, body: {}, projectStatus: "INACTIVE" });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        ssoList({ remote: Option.none(), projectRef: Option.none() }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      expect(out.messages).toContainEqual({
+        type: "warn",
+        message: `Project ${VALID_REF} status is INACTIVE instead of ACTIVE_HEALTHY. SSO providers can only be managed on an active, healthy project.`,
+      });
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("fails a stalled list within two attempts and warns about the project status", () => {
+    const { layer, out, api, providersStalled } = setup({
+      stallProviders: true,
+      projectStatus: "INACTIVE",
+      apiMaxRetries: Option.none(),
+    });
+    return Effect.gen(function* () {
+      const fiber = yield* Effect.forkChild(
+        Effect.exit(ssoList({ remote: Option.none(), projectRef: Option.none() })),
+      );
+      // Request timeouts are scheduled only once the handler's real filesystem work is done.
+      yield* providersStalled.await;
+      for (let second = 0; second < 30 && fiber.pollUnsafe() === undefined; second++) {
+        yield* TestClock.adjust("1 second");
+      }
+      const exit = yield* Fiber.join(fiber);
+
+      expect(Exit.isFailure(exit) && Cause.pretty(exit.cause)).toContain("SsoListNetworkError");
+      expect(api.requests.filter((r) => r.url.includes("/sso/providers"))).toHaveLength(2);
+      expect(out.messages.some((m) => m.type === "warn" && m.message.includes("INACTIVE"))).toBe(
+        true,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("does not look up project health on a 4xx", () => {
+    const { layer, out } = setup({ status: 404, body: {}, projectStatus: "INACTIVE" });
+    return Effect.gen(function* () {
+      yield* Effect.exit(ssoList({ remote: Option.none(), projectRef: Option.none() }));
+      expect(out.messages.some((m) => m.type === "warn")).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("does not warn when the failing project is healthy", () => {
+    const { layer, out } = setup({ status: 500, body: {}, projectStatus: "ACTIVE_HEALTHY" });
+    return Effect.gen(function* () {
+      yield* Effect.exit(ssoList({ remote: Option.none(), projectRef: Option.none() }));
+      expect(out.messages.some((m) => m.type === "warn")).toBe(false);
+    }).pipe(Effect.provide(layer));
+  });
+
   it.effect("reports network error on transport failure", () => {
     const { layer } = setup({ network: "fail" });
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/sso/remove/SIDE_EFFECTS.md b/apps/cli/src/commands/sso/remove/SIDE_EFFECTS.md
index 943231f860..c068876fb2 100644
--- a/apps/cli/src/commands/sso/remove/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/sso/remove/SIDE_EFFECTS.md
@@ -30,6 +30,7 @@ Target: hosted, consent default No — see [Command target](../../../../docs/com
 | `GET`    | `/v1/projects/{ref}`                                         | Bearer token | none         | `{organization_slug}` — upgrade-gate side-call on a 4xx with no plan-gate error in the body                                                                                                                                                              |
 | `GET`    | `/v1/organizations/{slug}/entitlements`                      | Bearer token | none         | `{entitlements[].feature.key, .hasAccess}` — upgrade-gate side-call on a 4xx with no plan-gate error in the body                                                                                                                                         |
 | `GET`    | `/v1/projects/{ref}`                                         | Bearer token | none         | `{ref, name, organization_id, organization_slug}` — `linkedProjectCache` fill, best-effort, skipped when `.temp/linked-project.json` exists, `.temp/project-ref` names another ref, or no token is available                                             |
+| `GET`    | `/v1/projects/{ref}`                                         | Bearer token | none         | `{status}` — health lookup after a transport failure or 5xx from the SSO call; warns when not `ACTIVE_HEALTHY`, no retries, 10s timeout                                                                                                                  |
 
 ## Environment Variables
 
diff --git a/apps/cli/src/commands/sso/remove/remove.handler.ts b/apps/cli/src/commands/sso/remove/remove.handler.ts
index 3def95b8d1..b4781cbb4d 100644
--- a/apps/cli/src/commands/sso/remove/remove.handler.ts
+++ b/apps/cli/src/commands/sso/remove/remove.handler.ts
@@ -23,6 +23,7 @@ import {
   SsoTomlEncodeError,
 } from "../sso.errors.ts";
 import { quoteSsoString, renderSingleProvider, validateUuid } from "../sso.format.ts";
+import { warnIfProjectUnhealthy } from "../sso.request-policy.ts";
 import type { SsoRemoveFlags } from "./remove.command.ts";
 
 const mapStatusOrNetwork = mapHttpError({
@@ -78,6 +79,7 @@ export const ssoRemove = Effect.fn("sso.remove")(function* (flags: SsoRemoveFlag
         output.format === "text" ? yield* output.task("Removing SSO provider...") : undefined;
       const response = yield* api.v1.deleteASsoProvider({ ref, provider_id: providerId }).pipe(
         Effect.tapError(() => removing?.fail() ?? Effect.void),
+        Effect.tapError((cause) => warnIfProjectUnhealthy(ref, cause)),
         Effect.catch((cause) => handleRemoveError(ref, providerId, cause)),
       );
       yield* removing?.clear ?? Effect.void;
diff --git a/apps/cli/src/commands/sso/show/SIDE_EFFECTS.md b/apps/cli/src/commands/sso/show/SIDE_EFFECTS.md
index 2a0373e647..9796fed70a 100644
--- a/apps/cli/src/commands/sso/show/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/sso/show/SIDE_EFFECTS.md
@@ -26,18 +26,20 @@ Target: hosted, no consent — see [Command target](../../../../docs/command-tar
 | `GET`  | `/v1/projects`                                               | Bearer token | none         | project list for the interactive picker — only when no ref comes from `--remote=<ref>`, `SUPABASE_PROJECT_ID` or `.temp/project-ref` and stdin is a TTY with interactive output                                                                          |
 | `GET`  | `/v1/projects/{parent}/branches`                             | Bearer token | none         | `[{id, name, project_ref, is_default}]` — only for `--remote=<branch>` (or the deprecated `--project-ref=<branch>`), and for a bare `--remote` followed by a word that could name a branch; `{parent}` is `SUPABASE_PROJECT_ID`, else the linked project |
 | `GET`  | `/v1/branches/{id}`                                          | Bearer token | none         | `{ref, status, …}` — only for `--remote=<branch UUID>` when no project is linked                                                                                                                                                                         |
-| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | none         | `{id, saml?, domains?, created_at?, updated_at?}`                                                                                                                                                                                                        |
+| `GET`  | `/v1/projects/{ref}/config/auth/sso/providers/{provider_id}` | Bearer token | none         | `{id, saml?, domains?, created_at?, updated_at?}` — 10s per attempt, 1 retry unless `SUPABASE_API_MAX_RETRIES` is set                                                                                                                                    |
 | `GET`  | `/v1/projects/{ref}`                                         | Bearer token | none         | `{ref, name, organization_id, organization_slug}` — `linkedProjectCache` fill, best-effort, skipped when `.temp/linked-project.json` exists, `.temp/project-ref` names another ref, or no token is available                                             |
+| `GET`  | `/v1/projects/{ref}`                                         | Bearer token | none         | `{status}` — health lookup after a transport failure or 5xx from the SSO call; warns when not `ACTIVE_HEALTHY`, no retries, 10s timeout                                                                                                                  |
 
 Note: Unlike `list`/`add`/`update`/`remove`, `show` does **not** make upgrade-gate
 side-calls.
 
 ## Environment Variables
 
-| Variable                | Purpose                                              | Required?                                               |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_PROFILE`      | profile selector (built-in name or YAML file path)   | no (defaults to `supabase`)                             |
+| Variable                   | Purpose                                                          | Required?                                               |
+| -------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN`    | auth token (bypasses credential file/keyring lookup)             | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROFILE`         | profile selector (built-in name or YAML file path)               | no (defaults to `supabase`)                             |
+| `SUPABASE_API_MAX_RETRIES` | Management API retries after the first attempt (`0` = send once) | no (SSO reads fall back to 1)                           |
 
 ## Exit Codes
 
diff --git a/apps/cli/src/commands/sso/show/show.handler.ts b/apps/cli/src/commands/sso/show/show.handler.ts
index 08358b08f6..f21fbd39f6 100644
--- a/apps/cli/src/commands/sso/show/show.handler.ts
+++ b/apps/cli/src/commands/sso/show/show.handler.ts
@@ -22,6 +22,7 @@ import {
   SsoTomlEncodeError,
 } from "../sso.errors.ts";
 import { quoteSsoString, renderSingleProvider, validateUuid } from "../sso.format.ts";
+import { ssoReadRequestOptions, warnIfProjectUnhealthy } from "../sso.request-policy.ts";
 import type { SsoShowFlags } from "./show.command.ts";
 
 const mapStatusOrNetwork = mapHttpError({
@@ -61,10 +62,13 @@ export const ssoShow = Effect.fn("sso.show")(function* (flags: SsoShowFlags) {
     yield* Effect.gen(function* () {
       const fetching =
         output.format === "text" ? yield* output.task("Fetching SSO provider...") : undefined;
-      const response = yield* api.v1.getASsoProvider({ ref, provider_id: providerId }).pipe(
-        Effect.tapError(() => fetching?.fail() ?? Effect.void),
-        Effect.catch((cause) => handleShowError(providerId, cause)),
-      );
+      const response = yield* api.v1
+        .getASsoProvider({ ref, provider_id: providerId }, yield* ssoReadRequestOptions)
+        .pipe(
+          Effect.tapError(() => fetching?.fail() ?? Effect.void),
+          Effect.tapError((cause) => warnIfProjectUnhealthy(ref, cause)),
+          Effect.catch((cause) => handleShowError(providerId, cause)),
+        );
       yield* fetching?.clear ?? Effect.void;
 
       // `--metadata` short-circuits regardless of `--output`.
diff --git a/apps/cli/src/commands/sso/show/show.integration.test.ts b/apps/cli/src/commands/sso/show/show.integration.test.ts
index 55ea714579..f9c9d09f21 100644
--- a/apps/cli/src/commands/sso/show/show.integration.test.ts
+++ b/apps/cli/src/commands/sso/show/show.integration.test.ts
@@ -58,7 +58,10 @@ function setup(opts: SetupOpts = {}) {
     response: { status: opts.status ?? 200, body: opts.body ?? PROVIDER },
   });
 
-  const cliSettings = mockCommandSettings({ workdir: tempRoot.current });
+  const cliSettings = mockCommandSettings({
+    workdir: tempRoot.current,
+    apiMaxRetries: Option.some(0),
+  });
   const layer = buildTestRuntime({
     out,
     api,
@@ -378,6 +381,7 @@ UpdatedAt = "2023-03-28T13:50:14.464Z"
     const cliSettings = mockCommandSettings({
       workdir: tempRoot.current,
       projectId: Option.none(),
+      apiMaxRetries: Option.some(0),
     });
     const layer = buildTestRuntime({
       out,
diff --git a/apps/cli/src/commands/sso/sso.request-policy.ts b/apps/cli/src/commands/sso/sso.request-policy.ts
new file mode 100644
index 0000000000..5a21487449
--- /dev/null
+++ b/apps/cli/src/commands/sso/sso.request-policy.ts
@@ -0,0 +1,51 @@
+import type { SupabaseApiError } from "@supabase/api/effect";
+import { Effect, Option } from "effect";
+
+import { CommandPlatformApi } from "../../auth/command-platform-api.service.ts";
+import { CommandSettings } from "../../config/command-settings.service.ts";
+import { Output } from "../../shared/output/output.service.ts";
+
+/**
+ * Request options for SSO reads. A project whose auth service is down stalls the request, so each
+ * attempt is capped at 10s and only one retry is made unless `apiMaxRetries` is configured.
+ */
+export const ssoReadRequestOptions = Effect.gen(function* () {
+  const settings = yield* CommandSettings;
+  return {
+    retry: {
+      maxRetries: Option.getOrElse(settings.apiMaxRetries, () => 1),
+      requestTimeoutMs: 10_000,
+    },
+  };
+});
+
+// 4xx responses are SSO-specific (plan gate, missing provider); only transport failures and
+// 5xx point at the project itself.
+const mayBeProjectHealth = (cause: SupabaseApiError) =>
+  cause._tag === "HttpClientError" &&
+  (cause.response === undefined || cause.response.status >= 500);
+
+/** Warns when an SSO call fails on a project that is not `ACTIVE_HEALTHY`, the usual cause. */
+export const warnIfProjectUnhealthy = Effect.fn("sso.projectHealth")(function* (
+  ref: string,
+  cause: SupabaseApiError,
+) {
+  if (!mayBeProjectHealth(cause)) {
+    return;
+  }
+  const api = yield* CommandPlatformApi;
+  const output = yield* Output;
+  const project = yield* api.v1
+    .getProject({ ref }, { retry: { maxRetries: 0, requestTimeoutMs: 10_000 } })
+    .pipe(Effect.option);
+  if (Option.isNone(project)) {
+    return;
+  }
+  const status = project.value.status;
+  yield* Effect.annotateCurrentSpan("project.status", status);
+  if (status !== "ACTIVE_HEALTHY") {
+    yield* output.warn(
+      `Project ${ref} status is ${status} instead of ACTIVE_HEALTHY. SSO providers can only be managed on an active, healthy project.`,
+    );
+  }
+});
diff --git a/apps/cli/src/commands/start/SIDE_EFFECTS.md b/apps/cli/src/commands/start/SIDE_EFFECTS.md
index 5d2a4d32d3..2c4c72505a 100644
--- a/apps/cli/src/commands/start/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/start/SIDE_EFFECTS.md
@@ -110,6 +110,19 @@ the Postgres container (polling `docker container inspect` every 1s until the st
 `starting`, the container stops running, or Docker cannot launch its health check), so a
 following `supabase status` or `supabase start` does not see `starting`. It never fails the run.
 
+Before creating any container, `start` runs `docker version --format
+'{{.Client.DefaultAPIVersion}} {{.Client.APIVersion}} {{.Server.APIVersion}}'` once. When all three
+are Docker API versions >= 1.44, every container whose spec sets a Docker healthcheck also gets
+`--health-start-interval 1s` and, unless its service sets its own, `--health-start-period 10s`. The
+first check then runs about 1s after the container starts instead of one 10s interval later, and the
+interval returns to 10s after the first pass. Failures inside the period do not count, so a failing
+service with 3 retries reaches `unhealthy` about 30s after it starts, or one interval later if a slow
+probe straddles the end of the period; the wait's budget and error type do not change. Below API
+1.44, when `docker version` fails, or with the Podman CLI or a `docker` shim for it,
+`--health-start-interval` is not passed and only Mailpit and Logflare keep their own start period.
+The real `docker` client on a Podman socket reporting 1.44 gets them: Podman keeps the start period
+and drops the start interval, so there is no speedup there.
+
 When a container is running but Docker could not launch its health check, it is judged from the
 host instead of failing. This applies only when the container's last recorded probe has exit
 code `-1` with an `OCI runtime exec failed ... unable to start container process` output, whatever
diff --git a/apps/cli/src/commands/start/services/edge-runtime.service.integration.test.ts b/apps/cli/src/commands/start/services/edge-runtime.service.integration.test.ts
index 86719e062a..5468141e75 100644
--- a/apps/cli/src/commands/start/services/edge-runtime.service.integration.test.ts
+++ b/apps/cli/src/commands/start/services/edge-runtime.service.integration.test.ts
@@ -34,7 +34,7 @@ function mockDockerSpawner(
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.sync(() => {
       const standard = ChildProcess.isStandardCommand(command);
-      const args = standard ? command.args : [];
+      const args = standard ? command.args.map(String) : [];
       calls.push({
         args,
         stdin: standard ? command.options.stdin : undefined,
diff --git a/apps/cli/src/commands/start/services/edge-runtime.service.ts b/apps/cli/src/commands/start/services/edge-runtime.service.ts
index 1ce2cb047a..c725d139b5 100644
--- a/apps/cli/src/commands/start/services/edge-runtime.service.ts
+++ b/apps/cli/src/commands/start/services/edge-runtime.service.ts
@@ -64,6 +64,7 @@ export interface EdgeRuntimeBringUpInput {
    * `shared/functions/deploy.ts`'s `rawFunctionConfigRecord(document)`.
    */
   readonly rawConfigFunctions: ServeEdgeRuntimeContainerConfig["rawConfigFunctions"];
+  readonly configPath?: ServeEdgeRuntimeContainerConfig["configPath"];
   /** Every already-resolved secret/key this container needs; not independently re-resolved here. */
   readonly authArtifacts: ServeAuthArtifacts;
   /** The global `--debug` flag. */
@@ -107,6 +108,7 @@ export const startStackEdgeRuntimeContainer = Effect.fn("start.edgeRuntime")(fun
       configDeclaredFunctions: input.configDeclaredFunctions,
       configFunctions: input.configFunctions,
       rawConfigFunctions: input.rawConfigFunctions,
+      configPath: input.configPath,
     },
     authArtifacts: input.authArtifacts,
     dbUrl: startInternalDbUrl(
diff --git a/apps/cli/src/commands/start/services/gotrue.service.ts b/apps/cli/src/commands/start/services/gotrue.service.ts
index 4dfad3353c..a356994268 100644
--- a/apps/cli/src/commands/start/services/gotrue.service.ts
+++ b/apps/cli/src/commands/start/services/gotrue.service.ts
@@ -401,6 +401,9 @@ export function buildGotrueEnv(input: BuildGotrueEnvInput): Record<string, strin
     GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION: String(
       input.email.secure_password_change,
     ),
+    GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD: String(
+      input.email.require_current_password,
+    ),
     GOTRUE_MFA_PHONE_ENROLL_ENABLED: String(input.mfa.phone.enroll_enabled),
     GOTRUE_MFA_PHONE_VERIFY_ENABLED: String(input.mfa.phone.verify_enabled),
     GOTRUE_MFA_TOTP_ENROLL_ENABLED: String(input.mfa.totp.enroll_enabled),
diff --git a/apps/cli/src/commands/start/services/gotrue.service.unit.test.ts b/apps/cli/src/commands/start/services/gotrue.service.unit.test.ts
index 92bea62095..d08644abfb 100644
--- a/apps/cli/src/commands/start/services/gotrue.service.unit.test.ts
+++ b/apps/cli/src/commands/start/services/gotrue.service.unit.test.ts
@@ -34,6 +34,7 @@ const baseEnvInput: BuildGotrueEnvInput = {
     double_confirm_changes: true,
     enable_confirmations: false,
     secure_password_change: false,
+    require_current_password: false,
     max_frequency: "1s",
     otp_length: 6,
     otp_expiry: 3600,
@@ -94,6 +95,16 @@ const baseEnvInput: BuildGotrueEnvInput = {
 };
 
 describe("buildGotrueEnv", () => {
+  test("forwards require_current_password to its own Auth env var", () => {
+    const env = buildGotrueEnv({
+      ...baseEnvInput,
+      email: { ...baseEnvInput.email, require_current_password: true },
+    });
+
+    expect(env["GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD"]).toBe("true");
+    expect(env["GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION"]).toBe("false");
+  });
+
   describe("TestBuildGotrueEnv parity", () => {
     test("uses auth scoped external url and absolute mailer verify urls", () => {
       const env = buildGotrueEnv({
diff --git a/apps/cli/src/commands/start/services/kong.service.ts b/apps/cli/src/commands/start/services/kong.service.ts
index 199f36ca75..269059de71 100644
--- a/apps/cli/src/commands/start/services/kong.service.ts
+++ b/apps/cli/src/commands/start/services/kong.service.ts
@@ -267,6 +267,13 @@ export function buildKongContainerSpec(
       { containerPort: "8443" },
       { containerPort: String(KONG_NGINX_TEMPLATE_SERVER_PORT) },
     ],
+    /* The image's own check, spelled out so the health start flags can apply to it. */
+    healthcheck: {
+      test: ["CMD-SHELL", "kong health"],
+      intervalSeconds: 10,
+      timeoutSeconds: 10,
+      retries: 10,
+    },
     restartPolicy: "unless-stopped",
     networkId: input.networkId,
     networkAliases: KONG_NETWORK_ALIASES,
diff --git a/apps/cli/src/commands/start/services/kong.service.unit.test.ts b/apps/cli/src/commands/start/services/kong.service.unit.test.ts
index 8fa7a2d9c7..8483cb0e40 100644
--- a/apps/cli/src/commands/start/services/kong.service.unit.test.ts
+++ b/apps/cli/src/commands/start/services/kong.service.unit.test.ts
@@ -151,7 +151,12 @@ describe("buildKongContainerSpec", () => {
       expect(spec.networkId).toBe("supabase_network_proj");
       expect(spec.networkAliases).toEqual(["kong", "api.supabase.internal"]);
       expect(spec.labels).toEqual({});
-      expect(spec.healthcheck).toBeUndefined();
+      expect(spec.healthcheck).toEqual({
+        test: ["CMD-SHELL", "kong health"],
+        intervalSeconds: 10,
+        timeoutSeconds: 10,
+        retries: 10,
+      });
     }).pipe(Effect.provide(BunPath.layer));
   });
 
diff --git a/apps/cli/src/commands/start/services/logflare.service.ts b/apps/cli/src/commands/start/services/logflare.service.ts
index a4b39aa6a7..c677829813 100644
--- a/apps/cli/src/commands/start/services/logflare.service.ts
+++ b/apps/cli/src/commands/start/services/logflare.service.ts
@@ -9,6 +9,7 @@
  * mount for the GCP service-account JSON.
  */
 
+import { DEFAULT_ERL_MAX_PORTS } from "@supabase/stack/defaults";
 import type { Path } from "effect";
 
 import { serviceContainerName } from "../../../command-internal/docker-ids.ts";
@@ -110,6 +111,7 @@ export function buildLogflareContainerSpec(
     // env, not through a shell, so they are never stripped.
     LOGFLARE_FEATURE_FLAG_OVERRIDE: "'multibackend=true'",
     RELEASE_COOKIE: "cookie",
+    ERL_MAX_PORTS: DEFAULT_ERL_MAX_PORTS,
   };
 
   const binds: Array<string> = [];
diff --git a/apps/cli/src/commands/start/services/logflare.service.unit.test.ts b/apps/cli/src/commands/start/services/logflare.service.unit.test.ts
index 13c15d0476..66d2f1dc79 100644
--- a/apps/cli/src/commands/start/services/logflare.service.unit.test.ts
+++ b/apps/cli/src/commands/start/services/logflare.service.unit.test.ts
@@ -90,6 +90,7 @@ describe("buildLogflareContainerSpec", () => {
         LOGFLARE_NODE_HOST: "127.0.0.1",
         LOGFLARE_FEATURE_FLAG_OVERRIDE: "'multibackend=true'",
         RELEASE_COOKIE: "cookie",
+        ERL_MAX_PORTS: "65536",
       });
     }).pipe(Effect.provide(BunPath.layer));
   });
diff --git a/apps/cli/src/commands/start/services/studio.service.ts b/apps/cli/src/commands/start/services/studio.service.ts
index affbc307b9..85ea0eec57 100644
--- a/apps/cli/src/commands/start/services/studio.service.ts
+++ b/apps/cli/src/commands/start/services/studio.service.ts
@@ -66,7 +66,7 @@ export interface BuildStudioEnvInput {
   readonly apiExtraSearchPath: ReadonlyArray<string>;
   /** `config.api.max_rows` — `PGRST_DB_MAX_ROWS`. */
   readonly apiMaxRows: number;
-  /** The effective `analytics.enabled` — `NEXT_PUBLIC_ENABLE_LOGS`. */
+  /** Whether Logflare starts (`analytics.enabled`, not excluded) — `ENABLED_FEATURES_LOGS_ALL`. */
   readonly analyticsEnabled: boolean;
   /** `config.analytics.backend`, post-`SUPABASE_ANALYTICS_BACKEND`-override — `NEXT_ANALYTICS_BACKEND_PROVIDER`. */
   readonly analyticsBackend: "postgres" | "bigquery";
@@ -99,7 +99,7 @@ export function buildStudioEnv(
     PGRST_DB_EXTRA_SEARCH_PATH: input.apiExtraSearchPath.join(","),
     PGRST_DB_MAX_ROWS: String(input.apiMaxRows),
     LOGFLARE_URL: `http://${input.logflareContainerName}:4000`,
-    NEXT_PUBLIC_ENABLE_LOGS: String(input.analyticsEnabled),
+    ENABLED_FEATURES_LOGS_ALL: String(input.analyticsEnabled),
     NEXT_ANALYTICS_BACKEND_PROVIDER: input.analyticsBackend,
     EDGE_FUNCTIONS_MANAGEMENT_FOLDER: toDockerMountPath(
       path.join(input.workdir, "supabase", "functions"),
diff --git a/apps/cli/src/commands/start/services/studio.service.unit.test.ts b/apps/cli/src/commands/start/services/studio.service.unit.test.ts
index 00a3c20c25..70f41047b6 100644
--- a/apps/cli/src/commands/start/services/studio.service.unit.test.ts
+++ b/apps/cli/src/commands/start/services/studio.service.unit.test.ts
@@ -68,7 +68,7 @@ describe("buildStudioEnv", () => {
         PGRST_DB_EXTRA_SEARCH_PATH: "public,extensions",
         PGRST_DB_MAX_ROWS: "1000",
         LOGFLARE_URL: "http://test-logflare:4000",
-        NEXT_PUBLIC_ENABLE_LOGS: "true",
+        ENABLED_FEATURES_LOGS_ALL: "true",
         NEXT_ANALYTICS_BACKEND_PROVIDER: "postgres",
         EDGE_FUNCTIONS_MANAGEMENT_FOLDER: "/project/supabase/functions",
         SNIPPETS_MANAGEMENT_FOLDER: "/project/supabase/.temp/snippets",
@@ -116,7 +116,7 @@ describe("buildStudioEnv", () => {
         },
         path,
       );
-      expect(env["NEXT_PUBLIC_ENABLE_LOGS"]).toBe("false");
+      expect(env["ENABLED_FEATURES_LOGS_ALL"]).toBe("false");
       expect(env["NEXT_ANALYTICS_BACKEND_PROVIDER"]).toBe("bigquery");
     }).pipe(Effect.provide(BunPath.layer));
   });
diff --git a/apps/cli/src/commands/start/services/supavisor.service.ts b/apps/cli/src/commands/start/services/supavisor.service.ts
index db2c8b317f..c98ad3ed0f 100644
--- a/apps/cli/src/commands/start/services/supavisor.service.ts
+++ b/apps/cli/src/commands/start/services/supavisor.service.ts
@@ -11,6 +11,7 @@
  */
 
 import {
+  DEFAULT_ERL_MAX_PORTS,
   DEFAULT_LOCAL_SERVICE_SECRET_KEY_BASE,
   DEFAULT_POOLER_VAULT_ENCRYPTION_KEY,
 } from "@supabase/stack/defaults";
@@ -120,6 +121,7 @@ export function buildSupavisorContainerSpec(
       REGION: "local",
       RUN_JANITOR: "true",
       ERL_AFLAGS: "-proto_dist inet_tcp",
+      ERL_MAX_PORTS: DEFAULT_ERL_MAX_PORTS,
       RLIMIT_NOFILE: "",
     },
     cmd: buildSupavisorStartCmd(),
diff --git a/apps/cli/src/commands/start/services/supavisor.service.unit.test.ts b/apps/cli/src/commands/start/services/supavisor.service.unit.test.ts
index 9cc69ec8c3..15f5950e15 100644
--- a/apps/cli/src/commands/start/services/supavisor.service.unit.test.ts
+++ b/apps/cli/src/commands/start/services/supavisor.service.unit.test.ts
@@ -101,6 +101,7 @@ describe("buildSupavisorContainerSpec", () => {
       REGION: "local",
       RUN_JANITOR: "true",
       ERL_AFLAGS: "-proto_dist inet_tcp",
+      ERL_MAX_PORTS: "65536",
       RLIMIT_NOFILE: "",
     });
   });
diff --git a/apps/cli/src/commands/start/services/vector.service.unit.test.ts b/apps/cli/src/commands/start/services/vector.service.unit.test.ts
index a0fa9d902b..bbcbd27a46 100644
--- a/apps/cli/src/commands/start/services/vector.service.unit.test.ts
+++ b/apps/cli/src/commands/start/services/vector.service.unit.test.ts
@@ -23,7 +23,7 @@ function mockSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.sync(() => {
-      const args = ChildProcess.isStandardCommand(command) ? command.args : [];
+      const args = ChildProcess.isStandardCommand(command) ? command.args.map(String) : [];
       spawned.push(args);
       const result = handler(args);
 
diff --git a/apps/cli/src/commands/start/start.config-precedence.integration.test.ts b/apps/cli/src/commands/start/start.config-precedence.integration.test.ts
index 87e5dbd3cd..f98c8faf59 100644
--- a/apps/cli/src/commands/start/start.config-precedence.integration.test.ts
+++ b/apps/cli/src/commands/start/start.config-precedence.integration.test.ts
@@ -1,6 +1,16 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, it } from "@effect/vitest";
-import { ConfigProvider, Effect, FileSystem, Layer, Option, Path, Sink, Stream } from "effect";
+import {
+  ConfigProvider,
+  Effect,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  type Redacted,
+  Sink,
+  Stream,
+} from "effect";
 import { ChildProcessSpawner } from "effect/process";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
@@ -150,7 +160,7 @@ interface RouteResult {
 
 interface CreateRecord {
   readonly args: ReadonlyArray<string>;
-  readonly env: Readonly<Record<string, string | undefined>>;
+  readonly env: Readonly<Record<string, string | Redacted.Redacted<string> | undefined>>;
 }
 
 function concatByteChunks(chunks: ReadonlyArray<unknown>): Uint8Array | undefined {
@@ -202,7 +212,7 @@ function mockDockerSpawner() {
     ChildProcessSpawner.ChildProcessSpawner,
     ChildProcessSpawner.make((command) =>
       Effect.gen(function* () {
-        const args = command._tag === "StandardCommand" ? command.args : [];
+        const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
         const env = command._tag === "StandardCommand" ? (command.options?.env ?? {}) : {};
         const stdin = command._tag === "StandardCommand" ? command.options.stdin : undefined;
         if (args[0] === "create") creates.push({ args, env });
@@ -300,6 +310,7 @@ describe("start container env precedence goldens", () => {
           cliConfigValuesTestLayer,
           Layer.succeed(ConfigEnvPins, fixture.shellEnv ?? {}),
           BunServices.layer,
+          BunCrypto.layer,
           out.layer,
           mockCommandSettings({ workdir }),
           mockTelemetryStateTracked().layer,
diff --git a/apps/cli/src/commands/start/start.e2e.test.ts b/apps/cli/src/commands/start/start.e2e.test.ts
index d647871b0e..912849ab13 100644
--- a/apps/cli/src/commands/start/start.e2e.test.ts
+++ b/apps/cli/src/commands/start/start.e2e.test.ts
@@ -1,9 +1,57 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, FileSystem } from "effect";
-import { runSupabaseEffect, stripAnsi } from "../../../tests/helpers/cli.ts";
+import { Data, Effect, FileSystem, Layer, Path, Schema } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+import {
+  createTempHome,
+  requireCliSuccess,
+  runSupabaseEffect,
+  stripAnsi,
+  withTempCliProject,
+} from "../../../tests/helpers/cli.ts";
 
 const E2E_TIMEOUT_MS = 30_000;
+const COMMAND_TIMEOUT_MS = 4 * 60_000;
+const CLEANUP_TIMEOUT_MS = 60_000;
+
+const projectConfig = (siteUrl: string) => `project_id = "start-config-restart-e2e"
+
+[experimental]
+stack = true
+
+[auth]
+site_url = "${siteUrl}"
+
+[db.pooler]
+enabled = false
+
+[edge_runtime]
+enabled = false
+
+[realtime]
+enabled = false
+
+[storage]
+enabled = false
+
+[studio]
+enabled = false
+
+[analytics]
+enabled = false
+
+[local_smtp]
+enabled = false
+`;
+
+class StartConfigRestartE2eError extends Data.TaggedError("StartConfigRestartE2eError")<{
+  readonly message: string;
+}> {}
+
+const StartedEnv = Schema.fromJsonString(
+  Schema.Struct({ env: Schema.Struct({ API_URL: Schema.String, SECRET_KEY: Schema.String }) }),
+);
+const GeneratedLink = Schema.fromJsonString(Schema.Struct({ redirect_to: Schema.String }));
 
 describe("supabase start", () => {
   // An unreachable `DOCKER_HOST` forces a fast, deterministic failure regardless of whether a
@@ -29,4 +77,70 @@ describe("supabase start", () => {
       }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
     E2E_TIMEOUT_MS,
   );
+
+  it.live(
+    "applies an edited auth.site_url after stop and start",
+    () =>
+      withTempCliProject("start-config-restart-", (project) =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const http = yield* HttpClient.HttpClient;
+          /* Left to the e2e cleanup drain, which disposes it with the stack project it serves. */
+          const home = yield* createTempHome;
+          const configPath = path.join(project.dir, "supabase", "config.toml");
+          yield* fs.makeDirectory(path.dirname(configPath), { recursive: true });
+          yield* fs.writeFileString(configPath, projectConfig("http://127.0.0.1:3001"));
+          /* Clears an ambient backend switch so `[experimental] stack` in the project routes `start`. */
+          const cli = (args: Array<string>, exitTimeoutMs = CLEANUP_TIMEOUT_MS) =>
+            runSupabaseEffect(args, {
+              cwd: project.dir,
+              home: home.dir,
+              env: { SUPABASE_EXPERIMENTAL_STACK: undefined },
+              exitTimeoutMs,
+            });
+          yield* Effect.addFinalizer(() =>
+            cli(["stack", "destroy", "--yes"]).pipe(
+              Effect.flatMap((destroyed) =>
+                destroyed.exitCode === 0
+                  ? Effect.void
+                  : new StartConfigRestartE2eError({
+                      message: `stack destroy exited ${destroyed.exitCode}: ${destroyed.stderr}`,
+                    }),
+              ),
+              Effect.orDie,
+            ),
+          );
+
+          /* The default redirect of an admin magic link is the running Auth's site URL. */
+          const startedSiteUrl = (email: string) =>
+            Effect.gen(function* () {
+              const started = yield* cli(
+                ["start", "--runtime", "docker", "--output-format", "json"],
+                COMMAND_TIMEOUT_MS,
+              );
+              requireCliSuccess(started, "start");
+              const { env } = yield* Schema.decodeEffect(StartedEnv)(started.stdout.trim());
+              const link = yield* http.execute(
+                HttpClientRequest.post(`${env.API_URL}/auth/v1/admin/generate_link`).pipe(
+                  HttpClientRequest.setHeaders({
+                    apikey: env.SECRET_KEY,
+                    authorization: `Bearer ${env.SECRET_KEY}`,
+                  }),
+                  HttpClientRequest.bodyJsonUnsafe({ type: "magiclink", email }),
+                ),
+              );
+              const body = yield* link.text;
+              expect(link.status, body).toBe(200);
+              return (yield* Schema.decodeEffect(GeneratedLink)(body)).redirect_to;
+            });
+
+          expect(yield* startedSiteUrl("before@example.com")).toBe("http://127.0.0.1:3001");
+          yield* fs.writeFileString(configPath, projectConfig("http://127.0.0.1:4321"));
+          requireCliSuccess(yield* cli(["stop"]), "stop");
+          expect(yield* startedSiteUrl("after@example.com")).toBe("http://127.0.0.1:4321");
+        }).pipe(Effect.scoped),
+      ).pipe(Effect.provide(Layer.mergeAll(BunServices.layer, FetchHttpClient.layer))),
+    2 * COMMAND_TIMEOUT_MS + 2 * CLEANUP_TIMEOUT_MS,
+  );
 });
diff --git a/apps/cli/src/commands/start/start.handler.ts b/apps/cli/src/commands/start/start.handler.ts
index 94c11f5c73..17feaecd1b 100644
--- a/apps/cli/src/commands/start/start.handler.ts
+++ b/apps/cli/src/commands/start/start.handler.ts
@@ -38,8 +38,11 @@ import {
   resolveApiTlsPath,
   resolveEmailTemplateContentPath,
 } from "../../command-internal/config-validate.ts";
-import { isContainerNotFoundMessage } from "../../command-internal/container-cli.ts";
-import { checkDbToml } from "../../command-internal/db-config.toml-read.ts";
+import {
+  dockerSupportsHealthStartInterval,
+  isContainerNotFoundMessage,
+} from "../../command-internal/container-cli.ts";
+import { checkDbConfig } from "../../command-internal/db-config.read.ts";
 import { resolveEdgeRuntimeImage } from "../../command-internal/edge-runtime-image.ts";
 import {
   resolveStorageCredentials,
@@ -94,6 +97,7 @@ import {
 } from "../../command-internal/resolved-config-context.ts";
 import { resolveConfigSubtree } from "../../config/cli-config-subtree.ts";
 import { CliConfigValueError } from "../../config/cli-config.errors.ts";
+import { configFileRefOf } from "../../command-internal/config-advice.ts";
 import { seedBucketsRun } from "../../command-internal/seed-buckets.ts";
 import { cleanupStartSecrets } from "../../command-internal/start-secrets-cleanup.ts";
 import {
@@ -441,8 +445,10 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
       context.hostname,
       cliSettings.workdir,
       context.document,
+      context.resolvedConfig.hasConfigFile ? context.resolvedConfig.loaded.path : undefined,
     ).pipe(Effect.mapError(startConfigError));
     const { config, projectId, projectEnvValues } = context;
+    const configFile = configFileRefOf(path, cliSettings.workdir, context.resolvedConfig);
     // Resolved here (project `.env` aware) so it can be threaded through to `startDatabase`'s
     // own `setup.experimental` below.
     const experimental = yield* resolveExperimentalWithProjectEnv(projectEnvValues);
@@ -534,7 +540,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
     // `SUPABASE_DB_SEED_ENABLED` or an undecryptable `[db.vault]` secret would go unvalidated
     // whenever `start` reuses an existing volume instead of provisioning a fresh one.
     // `startSetupLocalDatabase` still resolves its own fresh-setup values independently when it runs.
-    const dbTomlValues = yield* checkDbToml(fs, path, cliSettings.workdir).pipe(
+    const dbTomlValues = yield* checkDbConfig(fs, path, cliSettings.workdir).pipe(
       Effect.withSpan("start.validateDbConfig"),
     );
 
@@ -562,6 +568,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
         cliSettings.workdir,
         context.projectEnvValues,
         context.document,
+        context.resolvedConfig.hasConfigFile ? context.resolvedConfig.loaded.path : undefined,
         precomputedLocal,
       ).pipe(Effect.mapError((cause) => new StatusInvalidConfigError({ message: cause.message })));
       const containerIds = statusContainerIds(projectId);
@@ -734,7 +741,14 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
             projectId,
             cliSettings.workdir,
             `${cliSettings.workdir}/supabase`,
-            { configDeclaredFunctions, configFunctions, rawConfigFunctions },
+            {
+              configDeclaredFunctions,
+              configFunctions,
+              rawConfigFunctions,
+              configPath: context.resolvedConfig.hasConfigFile
+                ? context.resolvedConfig.loaded.path
+                : undefined,
+            },
             Option.none(),
             Option.none(),
             cliSettings.workdir,
@@ -796,6 +810,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
     const startOpts: ContainerOpts = {
       projectId,
       isBitbucketPipeline: inBitbucketPipeline,
+      healthStartInterval: yield* dockerSupportsHealthStartInterval(spawner),
       workdir: cliSettings.workdir,
       extraHosts,
     };
@@ -1111,7 +1126,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
                   apiSchemas: apiSchemas,
                   apiExtraSearchPath: apiExtraSearchPath,
                   apiMaxRows: apiMaxRows,
-                  analyticsEnabled: values.analyticsEnabled,
+                  analyticsEnabled: gates.logflare,
                   analyticsBackend: values.analyticsBackend,
                 },
               },
@@ -1308,7 +1323,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
           // Runtime container receives plaintext. `toPlainEdgeRuntimeConfig` only interpolates
           // `env()` and unwraps `Redacted` — it never decrypts a dotenvx `encrypted:` value, so
           // without this step the literal ciphertext would reach the container's env file.
-          // `checkDbToml` already validates every secret is decryptable, but discards the
+          // `checkDbConfig` already validates every secret is decryptable, but discards the
           // decrypted plaintext there.
           const decryptedEdgeRuntimeSecrets = decryptSecretMap(
             toPlainEdgeRuntimeConfig(resolvedEdgeRuntime).secrets,
@@ -1334,6 +1349,9 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
             configDeclaredFunctions,
             configFunctions,
             rawConfigFunctions,
+            configPath: context.resolvedConfig.hasConfigFile
+              ? context.resolvedConfig.loaded.path
+              : undefined,
             authArtifacts: {
               publishableKey: values.publishableKey,
               secretKey: values.secretKey,
@@ -1554,6 +1572,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
                   },
                   credentials: storageCredentials,
                   projectEnvValues,
+                  configFile,
                 }).pipe(Effect.withSpan("start.seedBuckets"), Effect.result);
                 if (Result.isFailure(seedResult)) {
                   // No manual `rollbackStart` here — the outer
@@ -1606,6 +1625,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
             },
             credentials: storageCredentials,
             projectEnvValues,
+            configFile,
           }).pipe(Effect.withSpan("start.seedBuckets"));
         }
 
diff --git a/apps/cli/src/commands/start/start.integration.test.ts b/apps/cli/src/commands/start/start.integration.test.ts
index c7aef1a51f..8b959221a1 100644
--- a/apps/cli/src/commands/start/start.integration.test.ts
+++ b/apps/cli/src/commands/start/start.integration.test.ts
@@ -1,6 +1,6 @@
 import { generateKeyPairSync } from "node:crypto";
 
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -15,6 +15,7 @@ import {
   Path,
   PlatformError,
   Predicate,
+  type Redacted,
   Schema,
   Sink,
   Stream,
@@ -51,6 +52,7 @@ import {
 import { assertPermissionDrift } from "../../../tests/helpers/permission-drift.ts";
 import { unusedStackServices } from "../../../tests/helpers/unused-stack.ts";
 import { CliArgs } from "../../shared/cli/cli-args.service.ts";
+import { normalizeCliError } from "../../shared/output/normalize-error.ts";
 import {
   classifyCliCauseActionability,
   classifyCliErrorActionability,
@@ -120,7 +122,7 @@ interface SpawnRecord {
   readonly command: string;
   readonly args: ReadonlyArray<string>;
   /** Bare `-e KEY` (no inline value) flags deliver their value via the spawned process's own env, not argv — see `edge-runtime.service.ts`'s header. */
-  readonly env: Readonly<Record<string, string | undefined>>;
+  readonly env: Readonly<Record<string, string | Redacted.Redacted<string> | undefined>>;
 }
 
 type RouteResult = {
@@ -173,7 +175,7 @@ function mockStartContainerCliSpawner(
       Effect.gen(function* () {
         const standard = ChildProcess.isStandardCommand(command);
         const cmd = standard ? command.command : "";
-        const args = standard ? command.args : [];
+        const args = standard ? command.args.map(String) : [];
         const env = standard ? (command.options?.env ?? {}) : {};
         const stdin = standard ? command.options.stdin : undefined;
         const onSecretCopy = opts.onSecretCopy;
@@ -778,7 +780,7 @@ describe("start integration", () => {
         expect(out.stderrText).toContain("WARNING:");
         expect(out.stderrText).toContain("not-a-real-service");
         expect(out.stderrText).toContain("not valid to exclude");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -794,7 +796,7 @@ describe("start integration", () => {
           expect(createdContainerNames(child.spawned).some((name) => name.includes("_db_"))).toBe(
             true,
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -817,7 +819,7 @@ describe("start integration", () => {
           expect(out.stderrText).toContain("supabase start");
           expect(out.stderrText).toContain("is already running");
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("reports the stack is already running with a machine payload in json mode", () =>
@@ -837,7 +839,7 @@ describe("start integration", () => {
         const success = out.messages.find((m) => m.type === "success");
         expect(success?.data).toMatchObject({ DB_URL: expect.any(String) });
         expect(out.stderrText).not.toContain("is already running");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -859,7 +861,7 @@ describe("start integration", () => {
           const success = out.messages.find((m) => m.type === "success");
           expect(success?.data).toMatchObject({ DB_URL: expect.any(String) });
           expect(out.stderrText).not.toContain("is already running");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -884,7 +886,7 @@ describe("start integration", () => {
             expect(Cause.pretty(exit.cause)).toContain("StatusDbNotRunningError");
           }
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -908,7 +910,7 @@ describe("start integration", () => {
           if (Exit.isFailure(exit)) {
             expect(Cause.pretty(exit.cause)).toContain("StatusDbNotReadyError");
           }
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -934,7 +936,7 @@ describe("start integration", () => {
             expect(serialized).toContain("StatusDbInspectError");
             expect(serialized).toContain("permission denied");
           }
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails when listing running containers errors while already running", () =>
@@ -954,7 +956,7 @@ describe("start integration", () => {
         if (Exit.isFailure(exit)) {
           expect(Cause.pretty(exit.cause)).toContain("StatusListError");
         }
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("already running, --ignore-health-check skips the health re-check entirely", () =>
@@ -975,7 +977,7 @@ describe("start integration", () => {
         yield* start(flags({ ignoreHealthCheck: true })).pipe(Effect.provide(layer));
         expect(inspectCalls).toBe(1);
         expect(child.spawned.some((s) => s.args[0] === "ps")).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("already running with every service still up omits the 'Stopped services' line", () =>
@@ -992,12 +994,12 @@ describe("start integration", () => {
 
         yield* start(flags()).pipe(Effect.provide(layer));
         expect(out.stderrText).not.toContain("Stopped services");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails on a bucket's invalid file_size_limit even when already running", () =>
       Effect.gen(function* () {
-        // `checkDbToml` runs unconditionally before the already-running short-circuit; later
+        // `checkDbConfig` runs unconditionally before the already-running short-circuit; later
         // checks (e.g. storage.analytics.enabled) sit after that early return and never run here.
         const { layer, child } = yield* setup({
           configContents:
@@ -1021,7 +1023,7 @@ describe("start integration", () => {
           );
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -1091,7 +1093,7 @@ describe("start integration", () => {
         expect(
           child.spawned.some((spawn) => spawn.args[0] === "volume" && spawn.args[1] === "prune"),
         ).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("does not remove containers when the project id sanitizes to empty", () =>
@@ -1117,7 +1119,7 @@ describe("start integration", () => {
               (spawn.args[0] === "ps" && spawn.args.includes("--all")) || spawn.args[1] === "prune",
           ),
         ).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("preserves a stopped Bitbucket database container", () =>
@@ -1151,7 +1153,7 @@ describe("start integration", () => {
                 spawn.args[0] === "create",
             ),
           ).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -1182,7 +1184,7 @@ describe("start integration", () => {
               (spawn.args[0] === "ps" && spawn.args.includes("--all")) || spawn.args[1] === "prune",
           ),
         ).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("recovers a created database container without pruning the database volume", () =>
@@ -1224,7 +1226,7 @@ describe("start integration", () => {
         expect(
           child.spawned.some((spawn) => spawn.args[0] === "volume" && spawn.args[1] === "prune"),
         ).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -1251,7 +1253,7 @@ describe("start integration", () => {
           });
           expect(out.stderrText).not.toContain("is already running");
           expect(createdContainerNames(child.spawned)).toEqual([]);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -1281,7 +1283,7 @@ describe("start integration", () => {
             suggestion: expect.stringContaining("supabase stop"),
           });
           expect(out.stderrText).not.toContain("is already running");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("validates custom TLS files before removing a stopped stack", () =>
@@ -1323,7 +1325,7 @@ describe("start integration", () => {
               spawn.args[0] === "create",
           ),
         ).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("validates function bind mounts before removing a stopped stack", () =>
@@ -1360,7 +1362,7 @@ describe("start integration", () => {
               spawn.args[0] === "create",
           ),
         ).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("removes remaining project containers when the stopped database disappears", () =>
@@ -1416,7 +1418,7 @@ describe("start integration", () => {
         expect(
           child.spawned.some((spawn) => spawn.args[0] === "volume" && spawn.args[1] === "prune"),
         ).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("cleans only current-workdir secrets when recovery fails", () =>
@@ -1473,7 +1475,7 @@ describe("start integration", () => {
         expect(yield* fs.exists(staleSecret)).toBe(false);
         expect(yield* fs.exists(foreignSecret)).toBe(true);
         expect(createdContainerNames(child.spawned)).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("keeps a stopped stack intact when a later config field fails to parse", () =>
@@ -1500,7 +1502,7 @@ describe("start integration", () => {
           ),
         ).toBe(false);
         expect(child.spawned.some((spawn) => spawn.args[0] === "stop")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -1537,7 +1539,7 @@ describe("start integration", () => {
           ).toBe(false);
           expect(child.spawned.some((spawn) => spawn.args[0] === "stop")).toBe(false);
           expect(createdContainerNames(child.spawned)).toEqual([]);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -1558,7 +1560,7 @@ describe("start integration", () => {
           );
         }
         expect(child.spawned).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails when the DB container inspect fails for a reason other than not-found", () =>
@@ -1580,7 +1582,7 @@ describe("start integration", () => {
           expect(serialized).toContain("permission denied");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -1601,7 +1603,7 @@ describe("start integration", () => {
               error_fingerprint: "tag:DockerLifecycleInspectError:docker_not_running",
             });
           }
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails on a malformed config.toml", () =>
@@ -1622,7 +1624,31 @@ describe("start integration", () => {
           expect(Cause.pretty(exit.cause)).toContain("StartConfigLoadError");
         }
         expect(child.spawned).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+    );
+
+    it.effect("reports a config.json and config.jsonc conflict without an error-class prefix", () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const workdir = tempRoot.current;
+        yield* fs.makeDirectory(path.join(workdir, "supabase"), { recursive: true });
+        yield* fs.writeFileString(path.join(workdir, "supabase", "config.json"), "{}");
+        yield* fs.writeFileString(path.join(workdir, "supabase", "config.jsonc"), "{}");
+        const { layer, child } = yield* setup({ skipConfig: true });
+
+        const exit = yield* Effect.exit(start(flags()).pipe(Effect.provide(layer)));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const error = Option.getOrUndefined(Cause.findErrorOption(exit.cause));
+          expect(error).toMatchObject({
+            _tag: "StartConfigLoadError",
+            message:
+              "Found both supabase/config.json and supabase/config.jsonc. Keep one and delete the other.",
+          });
+        }
+        expect(child.spawned).toEqual([]);
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails when auth.jwt_secret is configured but shorter than 16 characters", () =>
@@ -1641,7 +1667,7 @@ describe("start integration", () => {
           );
         }
         expect(child.spawned).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -1668,7 +1694,7 @@ describe("start integration", () => {
             );
           }
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -1700,7 +1726,7 @@ describe("start integration", () => {
           }
           expect(yield* fs.exists(path.join(workdir, "templates", "missing.html"))).toBe(false);
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -1738,9 +1764,68 @@ describe("start integration", () => {
           expect(analytics.captured).toContainEqual(
             expect.objectContaining({ event: "cli_stack_started" }),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
+    describe("Docker's first health check", () => {
+      const withVersionAnswer = (answer: RouteResult) => {
+        const base = defaultRoute();
+        return (args: ReadonlyArray<string>) => (args[0] === "version" ? answer : base(args));
+      };
+      const healthFlagsFor = (spawned: ReadonlyArray<SpawnRecord>, service: string) => {
+        const args =
+          spawned.find(
+            (s) =>
+              s.args[0] === "create" &&
+              containerNameFromCreateArgs(s.args).includes(`_${service}_`),
+          )?.args ?? [];
+        return Object.fromEntries(
+          args.flatMap((arg, index) =>
+            arg.startsWith("--health-") ? [[arg, args[index + 1]]] : [],
+          ),
+        );
+      };
+
+      it.effect("emits the health-start flags on a supported engine, asking Docker once", () =>
+        Effect.gen(function* () {
+          const { layer, child } = yield* setup({
+            route: withVersionAnswer({ stdout: ["1.44 1.44 1.44"] }),
+          });
+
+          yield* start(flags()).pipe(Effect.provide(layer));
+
+          expect(child.spawned.filter((s) => s.args[0] === "version")).toHaveLength(1);
+          for (const service of ["db", "auth", "realtime", "storage", "studio", "kong"]) {
+            expect(healthFlagsFor(child.spawned, service)).toMatchObject({
+              "--health-interval": "10s",
+              "--health-start-period": "10s",
+              "--health-start-interval": "1s",
+            });
+          }
+          expect(healthFlagsFor(child.spawned, "rest")).toEqual({});
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+      );
+
+      it.effect.each([
+        { name: "an engine below API 1.44", answer: { stdout: ["1.43 1.43 1.43"] } },
+        { name: "a docker shim for Podman", answer: { stdout: ["6.1.3 6.1.3 6.1.3"] } },
+        { name: "a failing docker version", answer: { exitCode: 1 } },
+      ])("passes none of the start flags on $name", ({ answer }) =>
+        Effect.gen(function* () {
+          const { layer, child } = yield* setup({ route: withVersionAnswer(answer) });
+
+          yield* start(flags()).pipe(Effect.provide(layer));
+
+          const creates = child.spawned.filter((s) => s.args[0] === "create");
+          expect(creates.length).toBeGreaterThan(0);
+          for (const create of creates) {
+            expect(create.args).not.toContain("--health-start-interval");
+          }
+          expect(healthFlagsFor(child.spawned, "auth")).not.toHaveProperty("--health-start-period");
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+      );
+    });
+
     it.effect(
       "starts Studio in a fresh project on Podman, which rejects missing bind sources",
       () =>
@@ -1773,7 +1858,7 @@ describe("start integration", () => {
             createdContainerNames(child.spawned).some((name) => name.includes("_studio_")),
           ).toBe(true);
           expect(yield* fs.exists(snippetsDir)).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("leaves supabase/snippets uncreated when Studio is excluded", () =>
@@ -1785,7 +1870,7 @@ describe("start integration", () => {
         yield* start(flags({ exclude: ["studio"] })).pipe(Effect.provide(layer));
 
         expect(yield* fs.exists(path.join(tempRoot.current, "supabase", "snippets"))).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails before creating anything when a file blocks supabase/snippets", () =>
@@ -1814,7 +1899,7 @@ describe("start integration", () => {
             (s) => s.args[0] === "create" || (s.args[0] === "network" && s.args[1] === "create"),
           ),
         ).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("emits a machine status payload in json mode instead of the pretty table", () =>
@@ -1825,7 +1910,7 @@ describe("start integration", () => {
         const success = out.messages.find((m) => m.type === "success");
         expect(success?.data).toMatchObject({ DB_URL: expect.any(String) });
         expect(out.stderrText).not.toContain("Started");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -1838,7 +1923,7 @@ describe("start integration", () => {
           const success = out.messages.find((m) => m.type === "success");
           expect(success?.data).toMatchObject({ DB_URL: expect.any(String) });
           expect(out.stderrText).not.toContain("Started");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fires cli_stack_started exactly once on a successful start", () =>
@@ -1850,7 +1935,7 @@ describe("start integration", () => {
           (c) => c.event === "cli_stack_started",
         );
         expect(stackStartedEvents).toEqual([{ event: "cli_stack_started", properties: {} }]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("brings the stack up when podman rejects re-creating preserved volumes (#6020)", () =>
@@ -1871,7 +1956,7 @@ describe("start integration", () => {
 
         yield* start(flags()).pipe(Effect.provide(layer));
         expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -1918,7 +2003,7 @@ describe("start integration", () => {
 
           yield* start(flags()).pipe(Effect.provide(layer));
           expect(resolveLocalConfigValuesCalls.count).toBe(1);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -1944,7 +2029,7 @@ describe("start integration", () => {
           expect(Cause.pretty(exit.cause)).toContain("StartInvalidConfigError");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("reads and mounts a configured API TLS cert/key pair for Kong", () =>
@@ -1969,7 +2054,7 @@ describe("start integration", () => {
         expect(createdContainerNames(child.spawned).some((name) => name.includes("_kong_"))).toBe(
           true,
         );
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails when a configured API TLS cert file cannot be read", () =>
@@ -1994,7 +2079,7 @@ describe("start integration", () => {
           expect(serialized).toContain("failed to read TLS cert");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails when a configured API TLS key file cannot be read", () =>
@@ -2019,7 +2104,7 @@ describe("start integration", () => {
           expect(serialized).toContain("failed to read TLS key");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2102,7 +2187,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(notificationBind).toContain(
             path.join(workdir, "supabase", "templates/custom_notice.html"),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2116,7 +2201,7 @@ content_path = "./supabase/templates/custom_notice.html"
             configContents: 'project_id = "demo"\n[db]\nhealth_timeout = "0s"\n[auth.webauthn]\n',
           });
           return yield* start(flags()).pipe(Effect.provide(layer));
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2137,7 +2222,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(serialized).toContain("failed to parse config");
           }
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails on an invalid storage.file_size_limit even when storage is excluded", () =>
@@ -2156,7 +2241,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(serialized).toContain("invalid config for storage.file_size_limit");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2178,7 +2263,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for storage.s3_protocol.enabled");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2201,7 +2286,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for storage.analytics.enabled");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2224,7 +2309,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for storage.analytics.max_namespaces");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2247,7 +2332,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for storage.analytics.max_tables");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2270,7 +2355,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for storage.analytics.max_catalogs");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2293,7 +2378,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for storage.vector.max_buckets");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2316,7 +2401,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for storage.vector.max_indexes");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2335,7 +2420,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(serialized).toContain("invalid config for auth.sms.max_frequency");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2357,7 +2442,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for auth.rate_limit");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2380,7 +2465,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for auth.web3");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2403,7 +2488,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for auth.oauth_server");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2426,7 +2511,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for auth.third_party");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2448,7 +2533,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(serialized).toContain("invalid config for auth.passkey");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails on an invalid auth.external.<custom>.enabled even when auth is disabled", () =>
@@ -2472,7 +2557,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(serialized).toContain("invalid config for auth.external");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails on a per-function env field", () =>
@@ -2495,7 +2580,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(serialized).toContain("functions[foo]: unknown keys: env");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2517,7 +2602,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for edge_runtime.policy");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2540,7 +2625,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for edge_runtime.inspector_port");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2561,7 +2646,7 @@ content_path = "./supabase/templates/custom_notice.html"
               "Analytics on Windows requires Docker daemon exposed on tcp://localhost:2375.",
             );
             expect(out.stderrText).toContain("Started");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -2583,7 +2668,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(createdNames.some((name) => name.includes("_auth_"))).toBe(true);
           expect(createdNames.some((name) => name.includes("_storage_"))).toBe(true);
           expect(createdNames.some((name) => name.includes("_studio_"))).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2602,7 +2687,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(createdNames.some((name) => name.includes("_storage_"))).toBe(false);
           expect(createdNames.some((name) => name.includes("_imgproxy_"))).toBe(false);
           expect(createdNames.some((name) => name.includes("_kong_"))).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2620,7 +2705,7 @@ content_path = "./supabase/templates/custom_notice.html"
             const createdNames = createdContainerNames(child.spawned);
             expect(createdNames.some((name) => name.includes("_storage_"))).toBe(true);
             expect(createdNames.some((name) => name.includes("_imgproxy_"))).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2641,7 +2726,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(createdNames.some((name) => name.includes("_kong_"))).toBe(true);
           expect(createdNames.some((name) => name.includes("_realtime_"))).toBe(true);
           expect(createdNames.some((name) => name.includes("_rest_"))).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2670,7 +2755,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(actuallyExists, `excludeKey=${excludeKey} suffix=${suffix}`).toBe(shouldExist);
             }
           }
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       15_000,
     );
   });
@@ -2693,7 +2778,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(out.stderrText).toContain("Initialising schema...");
           // Default config: realtime, storage, and auth are all enabled.
           expect(dbSetupJobCalls(child.spawned)).toHaveLength(3);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2720,7 +2805,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(
             authMigrateJob?.args.some((arg) => arg.startsWith("registry.example.com/supabase/")),
           ).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2748,7 +2833,7 @@ content_path = "./supabase/templates/custom_notice.html"
           const createdNames = createdContainerNames(child.spawned);
           expect(createdNames.some((name) => name.includes("_storage_"))).toBe(false);
           expect(createdNames.some((name) => name.includes("_kong_"))).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("skips the SetupLocalDatabase-equivalent pipeline on a non-fresh volume", () =>
@@ -2758,11 +2843,11 @@ content_path = "./supabase/templates/custom_notice.html"
         yield* start(flags({ exclude: ["edge-runtime"] })).pipe(Effect.provide(layer));
         expect(out.stderrText).not.toContain("Initialising schema...");
         expect(dbSetupJobCalls(child.spawned)).toHaveLength(0);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails on an undecryptable [db.vault] secret even on a non-fresh volume", () =>
-      // `checkDbToml`'s internal call inside `startSetupLocalDatabase` only runs on a fresh
+      // `checkDbConfig`'s internal call inside `startSetupLocalDatabase` only runs on a fresh
       // volume, but every `encrypted:` value decrypts unconditionally regardless of volume
       // state, so an undecryptable `[db.vault]` secret must still fail eagerly here.
       withEnvVar(
@@ -2782,7 +2867,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(serialized).toContain("failed to parse config: missing private key");
           }
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -2803,7 +2888,7 @@ content_path = "./supabase/templates/custom_notice.html"
           );
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect('prints "Starting database..." on a fresh volume, before Postgres is created', () =>
@@ -2816,7 +2901,7 @@ content_path = "./supabase/templates/custom_notice.html"
         expect(out.stderrText.indexOf("Starting database...\n")).toBeLessThan(
           out.stderrText.indexOf("Initialising schema..."),
         );
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2828,7 +2913,7 @@ content_path = "./supabase/templates/custom_notice.html"
           yield* start(flags({ exclude: ["edge-runtime"] })).pipe(Effect.provide(layer));
           expect(out.stderrText).toContain("Starting database from backup...\n");
           expect(out.stderrText).not.toContain("Starting database...\n");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2844,7 +2929,7 @@ content_path = "./supabase/templates/custom_notice.html"
             path.join(workdir, "supabase", ".branches", "_current_branch"),
           );
           expect(content).toBe("main");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     describe("a reused volume whose Postgres data directory was never initialised", () => {
@@ -2868,7 +2953,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(
                 child.spawned.some((s) => s.args[0] === "volume" && s.args[1] === "prune"),
               ).toBe(false);
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         );
       }
 
@@ -2884,7 +2969,7 @@ content_path = "./supabase/templates/custom_notice.html"
           yield* start(flags({ exclude: ["edge-runtime"] })).pipe(Effect.provide(layer));
 
           expect(http.createdBucketRequests).toHaveLength(1);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       );
 
       for (const [probe, route, volumePruned] of [
@@ -2911,7 +2996,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(
                 child.spawned.some((s) => s.args[0] === "volume" && s.args[1] === "prune"),
               ).toBe(volumePruned);
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           10_000,
         );
 
@@ -2937,7 +3022,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(
                 child.spawned.some((s) => s.args[0] === "volume" && s.args[1] === "prune"),
               ).toBe(volumePruned);
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         );
       }
     });
@@ -2964,7 +3049,7 @@ content_path = "./supabase/templates/custom_notice.html"
         // docker.io Storage carries its own Docker healthcheck, so readiness
         // never goes through the gateway.
         expect(http.requests.some((entry) => entry.url.includes("/storage/v1/status"))).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -2988,7 +3073,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(http.deletedVectorBuckets).toHaveLength(0);
             }).pipe(Effect.provide(layer), withEmptyConfigEnv),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3012,7 +3097,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(out.stderrText).not.toContain("Do you want to overwrite its properties?");
             }).pipe(Effect.provide(layer), withEmptyConfigEnv),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3039,7 +3124,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(out.stderrText).toContain("Keeping vector bucket");
             }).pipe(Effect.provide(layer), withEmptyConfigEnv),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3061,7 +3146,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(http.deletedVectorBuckets[0]).toContain("stale-vec");
             }).pipe(Effect.provide(layer)),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3076,7 +3161,7 @@ content_path = "./supabase/templates/custom_notice.html"
 
           yield* start(flags({ exclude: ["edge-runtime"] })).pipe(Effect.provide(layer));
           expect(http.createdBucketRequests).toHaveLength(0);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3098,7 +3183,7 @@ content_path = "./supabase/templates/custom_notice.html"
             yield* start(flags({ exclude: ["edge-runtime"] })).pipe(Effect.provide(layer));
             expect(http.createdBucketRequests).toHaveLength(1);
             expect(http.createdBucketRequests[0]).toContain(":65432/");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -3121,7 +3206,7 @@ content_path = "./supabase/templates/custom_notice.html"
             yield* start(flags({ exclude: ["edge-runtime"] })).pipe(Effect.provide(layer));
             expect(http.createdBucketRequests).toHaveLength(1);
             expect(http.createdBucketRequests[0]).toContain("override.example.com:9999");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -3148,7 +3233,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(http.createdBucketBodies[0]).toMatchObject({
               file_size_limit: 10 * 1024 * 1024,
             });
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -3180,7 +3265,7 @@ content_path = "./supabase/templates/custom_notice.html"
           `${containerName}:/`,
         ]);
         expect(child.spawned.map((s) => s.args)).toContainEqual(["start", containerName]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("--exclude edge-runtime skips its container entirely", () =>
@@ -3189,7 +3274,7 @@ content_path = "./supabase/templates/custom_notice.html"
 
         yield* start(flags({ exclude: ["edge-runtime"] })).pipe(Effect.provide(layer));
         expect(edgeRuntimeRunCalls(child.spawned)).toHaveLength(0);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3217,7 +3302,7 @@ content_path = "./supabase/templates/custom_notice.html"
           } finally {
             yield* fs.remove(stagingRoot, { recursive: true, force: true });
           }
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3255,7 +3340,7 @@ content_path = "./supabase/templates/custom_notice.html"
               }).pipe(Effect.orDie),
             ),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3291,7 +3376,7 @@ content_path = "./supabase/templates/custom_notice.html"
               }).pipe(Effect.orDie),
             ),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3340,7 +3425,7 @@ content_path = "./supabase/templates/custom_notice.html"
               }).pipe(Effect.orDie),
             ),
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3372,7 +3457,7 @@ content_path = "./supabase/templates/custom_notice.html"
               (s) => s.args[0] === "pull" || (s.args[0] === "image" && s.args[1] === "inspect"),
             ),
           ).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -3416,7 +3501,7 @@ content_path = "./supabase/templates/custom_notice.html"
           );
           expect(kongPulls.length).toBeGreaterThanOrEqual(2);
           expect(out.stderrText).toContain("Started");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       10_000,
     );
 
@@ -3452,7 +3537,7 @@ content_path = "./supabase/templates/custom_notice.html"
           }
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
           expect(rollbackWasAttempted(child.spawned)).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       45_000,
     );
 
@@ -3496,7 +3581,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(out.stdoutText).toBe("");
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
           expect(rollbackWasAttempted(child.spawned)).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       45_000,
     );
   });
@@ -3548,7 +3633,7 @@ content_path = "./supabase/templates/custom_notice.html"
         // including the `Effect.onError` rollback) has fully completed.
         yield* Fiber.interrupt(fiber);
         expect(rollbackWasAttempted(child.spawned)).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3600,7 +3685,7 @@ content_path = "./supabase/templates/custom_notice.html"
           // including the `Effect.onError` rollback) has fully completed.
           yield* Fiber.interrupt(fiber);
           expect(rollbackWasAttempted(child.spawned)).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails and rolls back on a network create failure", () =>
@@ -3629,7 +3714,7 @@ content_path = "./supabase/templates/custom_notice.html"
         expect(child.spawned.some((s) => s.args[0] === "network" && s.args[1] === "prune")).toBe(
           true,
         );
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails and rolls back on a container create failure", () =>
@@ -3651,7 +3736,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(serialized).toContain("failed to create docker container");
         }
         expect(rollbackWasAttempted(child.spawned)).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3681,7 +3766,7 @@ content_path = "./supabase/templates/custom_notice.html"
             );
           }
           expect(rollbackWasAttempted(child.spawned)).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("fails on a malformed auth.email.max_frequency before any Docker work", () =>
@@ -3700,7 +3785,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(serialized).toContain("invalid config for auth.email.max_frequency");
         }
         expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -3725,7 +3810,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("StartInvalidConfigError");
             }
             expect(child.spawned).toHaveLength(0);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -3750,7 +3835,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("StartInvalidConfigError");
             }
             expect(child.spawned).toHaveLength(0);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -3772,7 +3857,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(rollbackWasAttempted(child.spawned)).toBe(true);
           // Postgres's own health wait fails before any other service is ever created.
           expect(createdContainerNames(child.spawned)).toEqual([expect.stringContaining("_db_")]);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       10_000,
     );
 
@@ -3813,7 +3898,7 @@ content_path = "./supabase/templates/custom_notice.html"
           // `cli_stack_started`'s capture sits after the entire bring-up + bulk health check,
           // neither of which is reached once Postgres's wait is downgraded to a warning.
           expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       10_000,
     );
 
@@ -3850,7 +3935,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(rollbackWasAttempted(child.spawned)).toBe(true);
         }).pipe(
           Effect.provideService(HealthCheckTimeoutSeconds, 0),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       10_000,
     );
@@ -3900,7 +3985,7 @@ content_path = "./supabase/templates/custom_notice.html"
         expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
       }).pipe(
         Effect.provideService(HealthCheckTimeoutSeconds, 0),
-        Effect.provide(BunServices.layer),
+        Effect.provide([BunServices.layer, BunCrypto.layer]),
       ),
     10_000,
   );
@@ -3935,7 +4020,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
         }).pipe(
           Effect.provideService(HealthCheckTimeoutSeconds, 0),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       10_000,
     );
@@ -3982,7 +4067,7 @@ content_path = "./supabase/templates/custom_notice.html"
           );
         }).pipe(
           Effect.provideService(HealthCheckTimeoutSeconds, 0),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       10_000,
     );
@@ -4051,7 +4136,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
         }).pipe(
           Effect.provideService(HealthCheckTimeoutSeconds, 0),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       10_000,
     );
@@ -4087,7 +4172,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(analytics.captured.some((c) => c.event === "cli_stack_started")).toBe(false);
         }).pipe(
           Effect.provideService(HealthCheckTimeoutSeconds, 0),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       10_000,
     );
@@ -4121,7 +4206,7 @@ content_path = "./supabase/templates/custom_notice.html"
 
           expect(Exit.isSuccess(first)).toBe(true);
           expect(out.stderrText).toContain("local development setup is running.");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("start still completes without rolling back when Docker never settles", () =>
@@ -4133,7 +4218,7 @@ content_path = "./supabase/templates/custom_notice.html"
 
         expect(Exit.isSuccess(exit)).toBe(true);
         expect(rollbackWasAttempted(child.spawned)).toBe(false);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -4175,7 +4260,7 @@ content_path = "./supabase/templates/custom_notice.html"
                 DB_URL: expect.any(String),
               });
             }
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       );
     }
 
@@ -4202,7 +4287,7 @@ content_path = "./supabase/templates/custom_notice.html"
           for (const request of gets) {
             expect(request.headers["apikey"]).toEqual(expect.any(String));
           }
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -4230,7 +4315,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(warnings[0]).toContain(serviceContainerName(service, projectId));
           }
           expect(warnings[0]).not.toContain(serviceContainerName("kong", projectId));
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.live(
@@ -4255,7 +4340,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(rollbackWasAttempted(child.spawned)).toBe(true);
         }).pipe(
           Effect.provideService(HealthCheckTimeoutSeconds, 0),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       10_000,
     );
@@ -4286,7 +4371,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(rollbackWasAttempted(child.spawned)).toBe(false);
         }).pipe(
           Effect.provideService(HealthCheckTimeoutSeconds, 0),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       10_000,
     );
@@ -4321,7 +4406,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(error).not.toHaveProperty("suggestion");
         }).pipe(
           Effect.provideService(HealthCheckTimeoutSeconds, 0),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       10_000,
     );
@@ -4345,7 +4430,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(out.stderrText).toContain("WARNING:");
           expect(out.stderrText).toContain("Readiness of supabase_db_demo was not verified.");
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("already running: still rejects a db whose health check ran and failed", () =>
@@ -4374,7 +4459,7 @@ content_path = "./supabase/templates/custom_notice.html"
             "supabase_db_demo container is not ready: unhealthy (last health check exit code 1: pg_isready: no response)",
         });
         expect(out.stderrText).not.toContain("Docker cannot run health checks");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -4393,7 +4478,7 @@ content_path = "./supabase/templates/custom_notice.html"
         );
         const networkFlagIndex = kongCreate?.args.indexOf("--network") ?? -1;
         expect(kongCreate?.args[networkFlagIndex + 1]).toBe("custom-net");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("never spawns a create for a pre-created --network-id network", () =>
@@ -4417,7 +4502,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "network" && s.args[1] === "inspect" && s.args[2] === "custom-net",
           ),
         ).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect("falls back to SUPABASE_NETWORK_ID when the flag itself is omitted", () =>
@@ -4432,7 +4517,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "network" && s.args[1] === "create",
           );
           expect(networkCreate?.args.at(-1)).toBe("env-net");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -4451,7 +4536,7 @@ content_path = "./supabase/templates/custom_notice.html"
           );
           expect(kongCreate?.args).toContain("61234:8000");
           expect(kongCreate?.args).not.toContain("54321:8000");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -4544,7 +4629,7 @@ content_path = "./supabase/templates/custom_notice.html"
               (body, key) => withEnvVar(key, scenario.ambient[key], body),
               effect,
             ),
-          Effect.provide(BunServices.layer),
+          Effect.provide([BunServices.layer, BunCrypto.layer]),
         ),
       );
     }
@@ -4570,7 +4655,7 @@ content_path = "./supabase/templates/custom_notice.html"
               s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_storage_"),
           );
           expect(storageCreate?.env["DB_MIGRATIONS_FREEZE_AT"]).toBe("20240102030405");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect('resolves to "" when no pin file exists', () =>
@@ -4583,10 +4668,22 @@ content_path = "./supabase/templates/custom_notice.html"
             s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_storage_"),
         );
         expect(storageCreate?.env["DB_MIGRATIONS_FREEZE_AT"]).toBe("");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
+  it.effect("hides Studio's Logs pages when Logflare is excluded", () =>
+    Effect.gen(function* () {
+      const { layer, child } = yield* setup();
+
+      yield* start(flags({ exclude: ["logflare"] })).pipe(Effect.provide(layer));
+      const studioCreate = child.spawned.find(
+        (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_studio_"),
+      );
+      expect(studioCreate?.env["ENABLED_FEATURES_LOGS_ALL"]).toBe("false");
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+  );
+
   describe("linked service version pins", () => {
     it.effect(
       "resolves a supabase/.temp/storage-version pin into the pulled/created storage image tag",
@@ -4609,7 +4706,7 @@ content_path = "./supabase/templates/custom_notice.html"
               (s.args[2] ?? "").includes("storage"),
           );
           expect(storageImageInspect?.args[2]).toMatch(/:1\.2\.3$/);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -4637,7 +4734,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(dbCp?.args).toEqual(["cp", "-", `${fakeContainerId(containerName)}:/`]);
           expect(dbCp?.args.some((arg) => arg.includes("custom-root-key-value"))).toBe(false);
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -4676,7 +4773,7 @@ content_path = "./supabase/templates/custom_notice.html"
           yield* start(flags()).pipe(Effect.provide(layer));
           const createdNames = createdContainerNames(child.spawned);
           expect(createdNames.some((name) => name.includes("_db_"))).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -4691,7 +4788,7 @@ content_path = "./supabase/templates/custom_notice.html"
         );
         const addHostIndex = kongCreate?.args.indexOf("--add-host") ?? -1;
         expect(kongCreate?.args[addHostIndex + 1]).toBe("host.docker.internal:host-gateway");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -4711,7 +4808,7 @@ content_path = "./supabase/templates/custom_notice.html"
           );
           expect(gotrueCreate?.env["GOTRUE_SMTP_HOST"]).toBe("smtp.example.com");
           expect(gotrueCreate?.env["GOTRUE_SMTP_PORT"]).toBe("587");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -4729,7 +4826,7 @@ content_path = "./supabase/templates/custom_notice.html"
         );
         expect(gotrueCreate?.env["GOTRUE_EXTERNAL_MY_OIDC_ENABLED"]).toBe("true");
         expect(gotrueCreate?.env["GOTRUE_EXTERNAL_MY_OIDC_CLIENT_ID"]).toBe("custom-client-id");
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -4751,7 +4848,7 @@ content_path = "./supabase/templates/custom_notice.html"
             );
             expect(gotrueCreate?.env["GOTRUE_SMTP_ADMIN_EMAIL"]).toBe("override-admin@example.com");
             expect(gotrueCreate?.env["GOTRUE_SMTP_SENDER_NAME"]).toBe("Override Sender");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ),
       ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -4773,7 +4870,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(Cause.pretty(exit.cause)).toContain("StartInvalidConfigError");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -4818,7 +4915,7 @@ content_path = "./supabase/templates/custom_notice.html"
                   expect(gotrueCreate?.env["GOTRUE_SMS_TWILIO_AUTH_TOKEN"]).toBe(
                     "override-auth-token",
                   );
-                }).pipe(Effect.provide(BunServices.layer)),
+                }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
               ),
             ),
           ),
@@ -4847,7 +4944,7 @@ content_path = "./supabase/templates/custom_notice.html"
               );
               expect(gotrueCreate?.env["GOTRUE_EXTERNAL_PHONE_ENABLED"]).toBe("true");
               expect(gotrueCreate?.env["GOTRUE_SMS_MAX_FREQUENCY"]).toBe("10s");
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           ),
         ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -4873,7 +4970,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(out.stderrText).toContain(
               "WARN: no SMS provider is enabled. Disabling phone login",
             );
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -4898,7 +4995,7 @@ content_path = "./supabase/templates/custom_notice.html"
               );
               expect(gotrueCreate?.env["GOTRUE_EXTERNAL_EMAIL_ENABLED"]).toBe("false");
               expect(gotrueCreate?.env["GOTRUE_MAILER_OTP_LENGTH"]).toBe("8");
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           ),
         ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -4930,7 +5027,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(gotrueCreate?.env["GOTRUE_MAILER_SUBJECTS_CONFIRMATION"]).toBe(
               "Override subject",
             );
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -4958,7 +5055,7 @@ content_path = "./supabase/templates/custom_notice.html"
               );
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -4989,7 +5086,7 @@ content_path = "./supabase/templates/custom_notice.html"
           (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
         );
         expect(gotrueCreate?.env[env]).toBe(expected);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect.each([
@@ -5017,7 +5114,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env[row.gotrueEnv]).toBe("true");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5036,7 +5133,7 @@ content_path = "./supabase/templates/custom_notice.html"
           );
           expect(dbCreate?.args).toContain("54329:5432");
           expect(dbCreate?.args).not.toContain("54322:5432");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5054,7 +5151,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_db_"),
           );
           expect(dbCreate?.args.some((arg) => arg.includes("shared_buffers = '256MB'"))).toBe(true);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5079,7 +5176,7 @@ content_path = "./supabase/templates/custom_notice.html"
                   containerNameFromCreateArgs(s.args).includes("_storage_"),
               );
               expect(storageCreate?.env["S3_PROTOCOL_ENABLED"]).toBe("false");
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           ),
         ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -5116,7 +5213,7 @@ content_path = "./supabase/templates/custom_notice.html"
                     containerNameFromCreateArgs(s.args).includes("_studio_"),
                 );
                 expect(studioCreate?.env["NEXT_ANALYTICS_BACKEND_PROVIDER"]).toBe("bigquery");
-              }).pipe(Effect.provide(BunServices.layer)),
+              }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
             ),
           ),
         ),
@@ -5137,7 +5234,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_DISABLE_SIGNUP"]).toBe("true");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5160,7 +5257,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(edgeRuntimeImageInspect?.args[2]).toBe(
             "public.ecr.aws/supabase/edge-runtime:v1.68.4",
           );
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5197,7 +5294,7 @@ content_path = "./supabase/templates/custom_notice.html"
               );
               expect(realtimeSetupJob?.env["ERL_AFLAGS"]).toBe("-proto_dist inet6_tcp");
               expect(realtimeSetupJob?.env["MAX_HEADER_LENGTH"]).toBe("8192");
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           ),
         ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -5217,7 +5314,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(Cause.pretty(exit.cause)).toContain("StartInvalidConfigError");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5236,7 +5333,7 @@ content_path = "./supabase/templates/custom_notice.html"
           );
           expect(studioCreate?.env["SUPABASE_PUBLIC_URL"]).toBe("http://127.0.0.1:54321");
           expect(studioCreate?.env["SUPABASE_PUBLIC_URL"]).not.toBe("http://127.0.0.1");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -5262,7 +5359,7 @@ content_path = "./supabase/templates/custom_notice.html"
               (s) => s.args[0] === "run" && s.args[1] === "--rm",
             );
             expect(migrateJobs[1]?.env["FILE_SIZE_LIMIT"]).toBe(String(5 * 1024 * 1024));
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5289,7 +5386,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(message).not.toContain("failed to read config");
             }
             expect(child.spawned).toEqual([]);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5315,7 +5412,7 @@ content_path = "./supabase/templates/custom_notice.html"
               (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_db_"),
             );
             expect(dbCreate?.env["S3_ENABLED"]).toBe("true");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5348,7 +5445,7 @@ content_path = "./supabase/templates/custom_notice.html"
                   expect(dbCreate?.env["S3_REGION"]).toBe("env-s3-region");
                   expect(dbCreate?.env["S3_ACCESS_KEY"]).toBe("env-s3-access-key");
                   expect(dbCreate?.env["S3_SECRET_KEY"]).toBe("env-s3-secret-key");
-                }).pipe(Effect.provide(BunServices.layer)),
+                }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
               ),
             ),
           ),
@@ -5373,7 +5470,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(true);
           expect(copied.get("/home/kong/localhost.crt")).toBe(KONG_LOCAL_TLS_CERT);
           expect(copied.get("/home/kong/localhost.key")).toBe(KONG_LOCAL_TLS_KEY);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     // An empty but present `cert_path`/`key_path` is treated the same as absent — it must not
@@ -5395,7 +5492,7 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(child.spawned.some((s) => s.args[0] === "create")).toBe(true);
           expect(copied.get("/home/kong/localhost.crt")).toBe(KONG_LOCAL_TLS_CERT);
           expect(copied.get("/home/kong/localhost.key")).toBe(KONG_LOCAL_TLS_KEY);
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
   });
 
@@ -5439,7 +5536,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(copied.get("/home/kong/localhost.key")).toBe(
                 "-----BEGIN PRIVATE KEY-----env-key",
               );
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           ),
         ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -5481,7 +5578,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(true);
             expect(copied.get("/home/kong/localhost.crt")).toBe(KONG_LOCAL_TLS_CERT);
             expect(copied.get("/home/kong/localhost.key")).toBe(KONG_LOCAL_TLS_KEY);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5500,7 +5597,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(Cause.pretty(exit.cause)).toContain("StartInvalidConfigError");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5522,7 +5619,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_JWT_EXP"]).toBe("7200");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5542,7 +5639,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_EXTERNAL_GITHUB_SECRET"]).toBe("value");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5563,7 +5660,7 @@ content_path = "./supabase/templates/custom_notice.html"
                 s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
             );
             expect(gotrueCreate?.env["GOTRUE_EXTERNAL_MY_OIDC_SECRET"]).toBe("value");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5581,7 +5678,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_SMS_TWILIO_AUTH_TOKEN"]).toBe("value");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5610,7 +5707,73 @@ content_path = "./supabase/templates/custom_notice.html"
           expect(envFileContent).toContain("MY_LOWER_SECRET=keep-me");
           expect(envFileContent).not.toContain("my_lower_secret=");
           expect(envFileContent).not.toContain("EMPTY_SECRET=");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+    );
+
+    it.effect(
+      "lets supabase/functions/.env override secrets and leaves unresolved secrets out",
+      () =>
+        Effect.gen(function* () {
+          const { layer, child, workdir } = yield* setup({
+            configContents:
+              'project_id = "demo"\n[edge_runtime.secrets]\nSHARED = "secret"\nUNSET_SECRET = "env(LEGACY_START_UNSET_SECRET)"\n',
+          });
+
+          const fs = yield* FileSystem.FileSystem;
+          yield* fs.makeDirectory(`${workdir}/supabase/functions/hello`, { recursive: true });
+          yield* fs.writeFileString(`${workdir}/supabase/functions/hello/index.ts`, "");
+          yield* fs.writeFileString(`${workdir}/supabase/functions/.env`, "SHARED=dotenv\n");
+          yield* fs.writeFileString(`${workdir}/supabase/functions/hello/.env`, "PER_FN=hello\n");
+          yield* start(flags()).pipe(Effect.provide(layer));
+          const edgeRuntimeRunCall = child.spawned.find((s) => isEdgeRuntimeCreate(s.args));
+          const args = edgeRuntimeRunCall?.args ?? [];
+          const envFileIndex = args.indexOf("--env-file");
+          const envFilePath = envFileIndex !== -1 ? args[envFileIndex + 1] : undefined;
+          expect(envFilePath).toBeDefined();
+          const envFileContent = yield* fs.readFileString(envFilePath ?? "");
+          expect(envFileContent).toContain("SHARED=dotenv");
+          expect(envFileContent).not.toContain("UNSET_SECRET");
+          expect(envFileContent).not.toContain("PER_FN");
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+    );
+
+    it.effect("fails on a malformed supabase/functions/.env with the legacy error code", () =>
+      Effect.gen(function* () {
+        const { layer, workdir } = yield* setup();
+
+        const fs = yield* FileSystem.FileSystem;
+        yield* fs.makeDirectory(`${workdir}/supabase/functions`, { recursive: true });
+        yield* fs.writeFileString(`${workdir}/supabase/functions/.env`, "API-KEY=secret-value\n");
+        const error = yield* start(flags()).pipe(Effect.provide(layer), Effect.flip);
+
+        expect(error.message).toContain("failed to parse environment file:");
+        expect(error.message).not.toContain("secret-value");
+        expect(normalizeCliError(error).code).toBe("UnknownError");
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
+    );
+
+    it.effect(
+      "skips a disabled function and creates the runtime cache volume before a malformed supabase/functions/.env fails",
+      () =>
+        Effect.gen(function* () {
+          const { layer, out, child, workdir } = yield* setup({
+            configContents: 'project_id = "demo"\n[functions.off]\nenabled = false\n',
+          });
+
+          const fs = yield* FileSystem.FileSystem;
+          yield* fs.makeDirectory(`${workdir}/supabase/functions`, { recursive: true });
+          yield* fs.writeFileString(`${workdir}/supabase/functions/.env`, "API-KEY=secret-value\n");
+          const error = yield* start(flags()).pipe(Effect.provide(layer), Effect.flip);
+
+          expect(error.message).toContain("failed to parse environment file:");
+          expect(out.stderrText).toContain("Skipped serving Function: off\n");
+          expect(
+            child.spawned.some(
+              (spawn) =>
+                spawn.args[0] === "volume" && spawn.args.includes("supabase_edge_runtime_demo"),
+            ),
+          ).toBe(true);
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
     );
 
     it.effect(
@@ -5635,14 +5798,14 @@ content_path = "./supabase/templates/custom_notice.html"
             const envFileContent = yield* fs.readFileString(envFilePath ?? "");
             expect(envFileContent).toContain("MY_SECRET=value");
             expect(envFileContent).not.toContain("encrypted:");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
     it.effect(
       "fails with a typed config error, before any container is created, on an undecryptable [edge_runtime.secrets] entry",
       () =>
-        // Caught eagerly by `checkDbToml`'s `assertDecryptableSecrets` pre-check, before the
+        // Caught eagerly by `checkDbConfig`'s `assertDecryptableSecrets` pre-check, before the
         // bring-up loop's own edge-runtime-specific decrypt.
         withEnvVar(
           "DOTENV_PRIVATE_KEY",
@@ -5660,7 +5823,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("failed to parse config: missing private key");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5695,7 +5858,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(studioCreate?.env["PGRST_DB_SCHEMAS"]).toBe("public,custom");
               expect(studioCreate?.env["PGRST_DB_EXTRA_SEARCH_PATH"]).toBe("extensions,other");
               expect(studioCreate?.env["PGRST_DB_MAX_ROWS"]).toBe("500");
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           ),
         ),
       ).pipe(Effect.provide(BunServices.layer)),
@@ -5716,7 +5879,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(Cause.pretty(exit.cause)).toContain("StartInvalidConfigError");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5740,7 +5903,7 @@ content_path = "./supabase/templates/custom_notice.html"
           // and 6543, so assert on the specific `hostPort:containerPort` mapping instead.
           expect(poolerCreate?.args).toContain("54329:5432");
           expect(poolerCreate?.args).not.toContain("54329:6543");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5761,7 +5924,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(Cause.pretty(exit.cause)).toContain("StartInvalidConfigError");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5780,7 +5943,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(Cause.pretty(exit.cause)).toContain("StartInvalidConfigError");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5802,7 +5965,7 @@ content_path = "./supabase/templates/custom_notice.html"
           // container port 6543 — see the SUPABASE_DB_POOLER_POOL_MODE test above.
           expect(poolerCreate?.args).toContain("60001:6543");
           expect(poolerCreate?.args).not.toContain("54329:6543");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5822,7 +5985,7 @@ content_path = "./supabase/templates/custom_notice.html"
           );
           expect(logflareCreate?.args).toContain("60002:4000");
           expect(logflareCreate?.args).not.toContain("54327:4000");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5846,7 +6009,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(serialized).toContain("invalid config for analytics.vector_port");
             }
             expect(child.spawned.some((s) => s.args[0] === "create")).toBe(false);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -5869,7 +6032,7 @@ content_path = "./supabase/templates/custom_notice.html"
             // Postgres's own health wait fails before any other service is ever created —
             // proving the short env-overridden timeout took effect (the default is much longer).
             expect(createdContainerNames(child.spawned)).toEqual([expect.stringContaining("_db_")]);
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
       10_000,
     );
@@ -5901,7 +6064,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(gotrueCreate?.env["GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI"]).toBe(
               "pg-functions://postgres/auth/custom-access-token-hook",
             );
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ),
       ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -5928,7 +6091,7 @@ content_path = "./supabase/templates/custom_notice.html"
             );
             expect(gotrueCreate?.env["GOTRUE_SECURITY_CAPTCHA_ENABLED"]).toBe("true");
             expect(gotrueCreate?.env["GOTRUE_SECURITY_CAPTCHA_PROVIDER"]).toBe("turnstile");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ),
       ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -5947,7 +6110,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_SESSIONS_TIMEBOX"]).toBe("24h0m0s");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -5970,7 +6133,7 @@ content_path = "./supabase/templates/custom_notice.html"
             );
             expect(gotrueCreate?.env["GOTRUE_MFA_TOTP_ENROLL_ENABLED"]).toBe("true");
             expect(gotrueCreate?.env["GOTRUE_MFA_TOTP_VERIFY_ENABLED"]).toBe("true");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ),
       ).pipe(Effect.provide(BunServices.layer)),
     );
@@ -5987,7 +6150,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_RATE_LIMIT_SMS_SENT"]).toBe("99");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -6003,7 +6166,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_EXTERNAL_WEB3_SOLANA_ENABLED"]).toBe("true");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -6019,7 +6182,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_OAUTH_SERVER_ENABLED"]).toBe("true");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -6040,7 +6203,7 @@ content_path = "./supabase/templates/custom_notice.html"
             (s) => s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
           );
           expect(gotrueCreate?.env["GOTRUE_PASSKEY_ENABLED"]).toBe("true");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
 
@@ -6070,7 +6233,7 @@ content_path = "./supabase/templates/custom_notice.html"
               expect(gotrueCreate?.env["GOTRUE_WEBAUTHN_RP_ORIGINS"]).toBe(
                 "http://a.example,http://b.example",
               );
-            }).pipe(Effect.provide(BunServices.layer)),
+            }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
           ),
         ),
       ).pipe(Effect.provide(BunServices.layer)),
@@ -6098,7 +6261,7 @@ content_path = "./supabase/templates/custom_notice.html"
                 s.args[0] === "create" && containerNameFromCreateArgs(s.args).includes("_auth_"),
             );
             expect(gotrueCreate?.env["GOTRUE_PASSKEY_ENABLED"]).toBe("true");
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer), (body) =>
           withConfigEnv({ PASSKEY_ENABLED: "true" }, body),
         ),
@@ -6124,7 +6287,7 @@ content_path = "./supabase/templates/custom_notice.html"
             expect(gotrueCreate?.env["GOTRUE_WEBAUTHN_RP_ORIGINS"]).toBe(
               "http://a.example,http://b.example",
             );
-          }).pipe(Effect.provide(BunServices.layer)),
+          }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
         ).pipe(Effect.provide(BunServices.layer)),
     );
   });
@@ -6144,7 +6307,7 @@ content_path = "./supabase/templates/custom_notice.html"
           const entrypointCommand = runCalls[0]?.args.at(-1) ?? "";
           expect(entrypointCommand).toContain("--policy=per_worker");
           expect(entrypointCommand).not.toContain("--policy=oneshot");
-        }).pipe(Effect.provide(BunServices.layer)),
+        }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
       ).pipe(Effect.provide(BunServices.layer)),
     );
   });
diff --git a/apps/cli/src/commands/start/start.slim-images.e2e.test.ts b/apps/cli/src/commands/start/start.slim-images.e2e.test.ts
index 590ec1ea07..f63934ea81 100644
--- a/apps/cli/src/commands/start/start.slim-images.e2e.test.ts
+++ b/apps/cli/src/commands/start/start.slim-images.e2e.test.ts
@@ -1,6 +1,7 @@
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
-import { BunServices } from "@effect/platform-bun";
-import { Clock, Crypto, Data, Effect, FileSystem, Layer, Path, Schema } from "effect";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
+import { Clock, Data, Effect, FileSystem, Layer, Path, Schema } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { beforeAll, describe, expect, it } from "@effect/vitest";
 import {
   catalogPins,
@@ -228,8 +229,8 @@ const runWgetInImage = Effect.fn("start.e2e.wgetProbe")(function* (
   image: string,
   args: ReadonlyArray<string>,
 ) {
-  const crypto = yield* Crypto.Crypto;
-  const containerName = `sb-wget-probe-${yield* crypto.randomUUIDv4}`;
+  const crypto = yield* SecureRandom.SecureRandom;
+  const containerName = `sb-wget-probe-${yield* crypto.uuidV4()}`;
   const removeContainer = runDockerEffect(["rm", "--force", containerName], {
     timeout: WGET_PROBE_CLEANUP_TIMEOUT_MS,
   }).pipe(
@@ -330,7 +331,9 @@ describe("supabase start slim images (e2e)", () => {
             yield* runWgetInImage(image, waitArgs);
           }
         }
-      }).pipe(Effect.provide(Layer.merge(BunServices.layer, FetchHttpClient.layer))),
+      }).pipe(
+        Effect.provide(Layer.mergeAll(BunServices.layer, BunCrypto.layer, FetchHttpClient.layer)),
+      ),
     WGET_PROBE_TEST_TIMEOUT_MS,
   );
 
diff --git a/apps/cli/src/commands/start/testdata/config-precedence/start/no-overrides.json b/apps/cli/src/commands/start/testdata/config-precedence/start/no-overrides.json
index f9db4d565d..bfe418270d 100644
--- a/apps/cli/src/commands/start/testdata/config-precedence/start/no-overrides.json
+++ b/apps/cli/src/commands/start/testdata/config-precedence/start/no-overrides.json
@@ -22,6 +22,7 @@
         "DB_PORT": "5432",
         "DB_SCHEMA": "_analytics",
         "DB_USERNAME": "supabase_admin",
+        "ERL_MAX_PORTS": "65536",
         "LOGFLARE_FEATURE_FLAG_OVERRIDE": "'multibackend=true'",
         "LOGFLARE_LOG_LEVEL": "warn",
         "LOGFLARE_MIN_CLUSTER_SIZE": "1",
@@ -99,6 +100,7 @@
         "GOTRUE_SECURITY_MANUAL_LINKING_ENABLED": "false",
         "GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL": "10",
         "GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED": "true",
+        "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD": "false",
         "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION": "false",
         "GOTRUE_SITE_URL": "http://base.example.com",
         "GOTRUE_SMS_AUTOCONFIRM": "true",
@@ -189,6 +191,7 @@
         "DB_USER": "supabase_admin",
         "DNS_NODES": "''",
         "ERL_AFLAGS": "-proto_dist inet_tcp",
+        "ERL_MAX_PORTS": "65536",
         "MAX_HEADER_LENGTH": "4096",
         "METRICS_JWT_SECRET": "super-secret-jwt-token-with-at-least-32-characters-long",
         "PORT": "4000",
@@ -251,11 +254,11 @@
         "AUTH_JWT_SECRET": "super-secret-jwt-token-with-at-least-32-characters-long",
         "CURRENT_CLI_VERSION": "0.0.0-dev",
         "EDGE_FUNCTIONS_MANAGEMENT_FOLDER": "<WORKDIR>/supabase/functions",
+        "ENABLED_FEATURES_LOGS_ALL": "true",
         "HOSTNAME": "0.0.0.0",
         "LOGFLARE_PRIVATE_ACCESS_TOKEN": "api-key",
         "LOGFLARE_URL": "http://supabase_analytics_golden-start:4000",
         "NEXT_ANALYTICS_BACKEND_PROVIDER": "postgres",
-        "NEXT_PUBLIC_ENABLE_LOGS": "true",
         "OPENAI_API_KEY": "",
         "PGRST_DB_EXTRA_SEARCH_PATH": "public,extensions",
         "PGRST_DB_MAX_ROWS": "1000",
diff --git a/apps/cli/src/commands/start/testdata/config-precedence/start/project-dotenv.json b/apps/cli/src/commands/start/testdata/config-precedence/start/project-dotenv.json
index cf0dcec1ff..09f3740169 100644
--- a/apps/cli/src/commands/start/testdata/config-precedence/start/project-dotenv.json
+++ b/apps/cli/src/commands/start/testdata/config-precedence/start/project-dotenv.json
@@ -19,6 +19,7 @@
         "DB_PORT": "5432",
         "DB_SCHEMA": "_analytics",
         "DB_USERNAME": "supabase_admin",
+        "ERL_MAX_PORTS": "65536",
         "LOGFLARE_FEATURE_FLAG_OVERRIDE": "'multibackend=true'",
         "LOGFLARE_LOG_LEVEL": "warn",
         "LOGFLARE_MIN_CLUSTER_SIZE": "1",
@@ -96,6 +97,7 @@
         "GOTRUE_SECURITY_MANUAL_LINKING_ENABLED": "false",
         "GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL": "10",
         "GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED": "true",
+        "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD": "false",
         "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION": "false",
         "GOTRUE_SITE_URL": "http://dotenv.example.com",
         "GOTRUE_SMS_AUTOCONFIRM": "true",
diff --git a/apps/cli/src/commands/start/testdata/config-precedence/start/remote-block-ignored.json b/apps/cli/src/commands/start/testdata/config-precedence/start/remote-block-ignored.json
index f9db4d565d..bfe418270d 100644
--- a/apps/cli/src/commands/start/testdata/config-precedence/start/remote-block-ignored.json
+++ b/apps/cli/src/commands/start/testdata/config-precedence/start/remote-block-ignored.json
@@ -22,6 +22,7 @@
         "DB_PORT": "5432",
         "DB_SCHEMA": "_analytics",
         "DB_USERNAME": "supabase_admin",
+        "ERL_MAX_PORTS": "65536",
         "LOGFLARE_FEATURE_FLAG_OVERRIDE": "'multibackend=true'",
         "LOGFLARE_LOG_LEVEL": "warn",
         "LOGFLARE_MIN_CLUSTER_SIZE": "1",
@@ -99,6 +100,7 @@
         "GOTRUE_SECURITY_MANUAL_LINKING_ENABLED": "false",
         "GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL": "10",
         "GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED": "true",
+        "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD": "false",
         "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION": "false",
         "GOTRUE_SITE_URL": "http://base.example.com",
         "GOTRUE_SMS_AUTOCONFIRM": "true",
@@ -189,6 +191,7 @@
         "DB_USER": "supabase_admin",
         "DNS_NODES": "''",
         "ERL_AFLAGS": "-proto_dist inet_tcp",
+        "ERL_MAX_PORTS": "65536",
         "MAX_HEADER_LENGTH": "4096",
         "METRICS_JWT_SECRET": "super-secret-jwt-token-with-at-least-32-characters-long",
         "PORT": "4000",
@@ -251,11 +254,11 @@
         "AUTH_JWT_SECRET": "super-secret-jwt-token-with-at-least-32-characters-long",
         "CURRENT_CLI_VERSION": "0.0.0-dev",
         "EDGE_FUNCTIONS_MANAGEMENT_FOLDER": "<WORKDIR>/supabase/functions",
+        "ENABLED_FEATURES_LOGS_ALL": "true",
         "HOSTNAME": "0.0.0.0",
         "LOGFLARE_PRIVATE_ACCESS_TOKEN": "api-key",
         "LOGFLARE_URL": "http://supabase_analytics_golden-start:4000",
         "NEXT_ANALYTICS_BACKEND_PROVIDER": "postgres",
-        "NEXT_PUBLIC_ENABLE_LOGS": "true",
         "OPENAI_API_KEY": "",
         "PGRST_DB_EXTRA_SEARCH_PATH": "public,extensions",
         "PGRST_DB_MAX_ROWS": "1000",
diff --git a/apps/cli/src/commands/start/testdata/config-precedence/start/remote-block-with-shell-env.json b/apps/cli/src/commands/start/testdata/config-precedence/start/remote-block-with-shell-env.json
index 8a46c6a9f0..72b996f7e9 100644
--- a/apps/cli/src/commands/start/testdata/config-precedence/start/remote-block-with-shell-env.json
+++ b/apps/cli/src/commands/start/testdata/config-precedence/start/remote-block-with-shell-env.json
@@ -19,6 +19,7 @@
         "DB_PORT": "5432",
         "DB_SCHEMA": "_analytics",
         "DB_USERNAME": "supabase_admin",
+        "ERL_MAX_PORTS": "65536",
         "LOGFLARE_FEATURE_FLAG_OVERRIDE": "'multibackend=true'",
         "LOGFLARE_LOG_LEVEL": "warn",
         "LOGFLARE_MIN_CLUSTER_SIZE": "1",
@@ -96,6 +97,7 @@
         "GOTRUE_SECURITY_MANUAL_LINKING_ENABLED": "false",
         "GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL": "10",
         "GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED": "true",
+        "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD": "false",
         "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION": "false",
         "GOTRUE_SITE_URL": "http://shell.example.com",
         "GOTRUE_SMS_AUTOCONFIRM": "true",
diff --git a/apps/cli/src/commands/start/testdata/config-precedence/start/shell-beats-dotenv.json b/apps/cli/src/commands/start/testdata/config-precedence/start/shell-beats-dotenv.json
index 0ffd236e72..7743c256f5 100644
--- a/apps/cli/src/commands/start/testdata/config-precedence/start/shell-beats-dotenv.json
+++ b/apps/cli/src/commands/start/testdata/config-precedence/start/shell-beats-dotenv.json
@@ -19,6 +19,7 @@
         "DB_PORT": "5432",
         "DB_SCHEMA": "_analytics",
         "DB_USERNAME": "supabase_admin",
+        "ERL_MAX_PORTS": "65536",
         "LOGFLARE_FEATURE_FLAG_OVERRIDE": "'multibackend=true'",
         "LOGFLARE_LOG_LEVEL": "warn",
         "LOGFLARE_MIN_CLUSTER_SIZE": "1",
@@ -96,6 +97,7 @@
         "GOTRUE_SECURITY_MANUAL_LINKING_ENABLED": "false",
         "GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL": "10",
         "GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED": "true",
+        "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD": "false",
         "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION": "false",
         "GOTRUE_SITE_URL": "http://shell.example.com",
         "GOTRUE_SMS_AUTOCONFIRM": "true",
diff --git a/apps/cli/src/commands/start/testdata/config-precedence/start/shell-env.json b/apps/cli/src/commands/start/testdata/config-precedence/start/shell-env.json
index 8a46c6a9f0..72b996f7e9 100644
--- a/apps/cli/src/commands/start/testdata/config-precedence/start/shell-env.json
+++ b/apps/cli/src/commands/start/testdata/config-precedence/start/shell-env.json
@@ -19,6 +19,7 @@
         "DB_PORT": "5432",
         "DB_SCHEMA": "_analytics",
         "DB_USERNAME": "supabase_admin",
+        "ERL_MAX_PORTS": "65536",
         "LOGFLARE_FEATURE_FLAG_OVERRIDE": "'multibackend=true'",
         "LOGFLARE_LOG_LEVEL": "warn",
         "LOGFLARE_MIN_CLUSTER_SIZE": "1",
@@ -96,6 +97,7 @@
         "GOTRUE_SECURITY_MANUAL_LINKING_ENABLED": "false",
         "GOTRUE_SECURITY_REFRESH_TOKEN_REUSE_INTERVAL": "10",
         "GOTRUE_SECURITY_REFRESH_TOKEN_ROTATION_ENABLED": "true",
+        "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD": "false",
         "GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION": "false",
         "GOTRUE_SITE_URL": "http://shell.example.com",
         "GOTRUE_SMS_AUTOCONFIRM": "true",
diff --git a/apps/cli/src/commands/status/status.handler.ts b/apps/cli/src/commands/status/status.handler.ts
index f1f90ab4a6..56b6a402d8 100644
--- a/apps/cli/src/commands/status/status.handler.ts
+++ b/apps/cli/src/commands/status/status.handler.ts
@@ -169,6 +169,7 @@ export const status = Effect.fn("status")(function* (flags: StatusFlags) {
       cliSettings.workdir,
       context.projectEnvValues,
       context.resolvedConfig.loaded.document,
+      context.resolvedConfig.hasConfigFile ? context.resolvedConfig.loaded.path : undefined,
     ).pipe(
       Effect.mapError((cause) =>
         cause instanceof CliConfigValueError
diff --git a/apps/cli/src/commands/status/status.integration.test.ts b/apps/cli/src/commands/status/status.integration.test.ts
index 37f4a2dee4..819e1fdc31 100644
--- a/apps/cli/src/commands/status/status.integration.test.ts
+++ b/apps/cli/src/commands/status/status.integration.test.ts
@@ -1,7 +1,7 @@
 import { generateKeyPairSync } from "node:crypto";
 
 import type { V1ListAllBranchesOutput } from "@supabase/api/effect";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -225,7 +225,7 @@ function mockRoutedContainerCliSpawner(
       Effect.gen(function* () {
         const standard = ChildProcess.isStandardCommand(command);
         const cmd = standard ? command.command : "";
-        const args = standard ? command.args : [];
+        const args = standard ? command.args.map(String) : [];
         spawned.push({ command: cmd, args });
 
         if (opts.dockerMissing === true && cmd === "docker") {
@@ -374,6 +374,7 @@ function setup(opts: SetupOpts = {}) {
   const layer = Layer.mergeAll(
     cliConfigValuesTestLayer,
     BunServices.layer,
+    BunCrypto.layer,
     recorder.layer,
     runtimeInfoLayer,
     out.layer,
@@ -465,6 +466,7 @@ function setupFailureEnvelope(opts: FailureEnvelopeOpts) {
   const layer = Layer.mergeAll(
     cliConfigValuesTestLayer,
     BunServices.layer,
+    BunCrypto.layer,
     runtimeInfoLayer,
     outputLayer.pipe(Layer.provide(stdio.layer)),
     cliSettings,
@@ -671,7 +673,7 @@ project_id = "short"
         );
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when --workdir/SUPABASE_WORKDIR points at a file, not a directory", () =>
@@ -688,7 +690,7 @@ project_id = "short"
         expect(causeText).toContain(`failed to change workdir: chdir ${filePath}: not a directory`);
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when auth.jwt_secret is configured but shorter than 16 characters", () => {
@@ -779,7 +781,7 @@ content_path = "./supabase/templates/password_changed_notification.html"
       expect(out.stderrText).toContain("local development setup is running.");
       expect(out.stdoutText).toContain("Project URL");
       expect(out.stdoutText).toContain("Database");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("resolves SUPABASE_PROJECT_ID from supabase/.env over config.toml", () => {
@@ -867,7 +869,7 @@ content_path = "./supabase/templates/password_changed_notification.html"
         );
         expect(inspectCall?.args).toContain(localDbContainerId(projectId));
         expect(inspectCall?.args).not.toContain(localDbContainerId("ancestor-project"));
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
diff --git a/apps/cli/src/commands/stop/SIDE_EFFECTS.md b/apps/cli/src/commands/stop/SIDE_EFFECTS.md
index 84fa021d7e..333bbea781 100644
--- a/apps/cli/src/commands/stop/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/stop/SIDE_EFFECTS.md
@@ -163,7 +163,7 @@ flags.noBackup`. `--backup=false` alone does **not** delete volumes; only
   `--no-backup` does.
 - Volume prune gates `--all` on the Docker client and daemon API versions (`container-cli.ts`'s
   `dockerSupportsVolumePruneAllFlag`, checked via `docker version --format
-'{{.Client.APIVersion}} {{.Server.APIVersion}}'`) — Docker requires both to be >= 1.42. This
+'{{.Client.DefaultAPIVersion}} {{.Client.APIVersion}} {{.Server.APIVersion}}'`) — the CLI requires all three to be >= 1.42. This
   isn't cosmetic: a pre-23.0 Docker CLI doesn't know `--all` on `volume prune`, and a newer
   CLI annotates it `version: "1.42"` and rejects it when the daemon is below 1.42, before
   pruning runs, so sending it unconditionally hard-fails the whole call instead of just
diff --git a/apps/cli/src/commands/stop/stop.handler.ts b/apps/cli/src/commands/stop/stop.handler.ts
index 77daf71ec1..b9e488e721 100644
--- a/apps/cli/src/commands/stop/stop.handler.ts
+++ b/apps/cli/src/commands/stop/stop.handler.ts
@@ -74,6 +74,7 @@ const resolveSearchProjectIdFilter = Effect.fn("stop.resolveSearchProjectIdFilte
     context.hostname,
     cliSettings.workdir,
     context.resolvedConfig.loaded.document,
+    context.resolvedConfig.hasConfigFile ? context.resolvedConfig.loaded.path : undefined,
   ).pipe(
     Effect.mapError((cause) =>
       cause instanceof CliConfigValueError
diff --git a/apps/cli/src/commands/stop/stop.integration.test.ts b/apps/cli/src/commands/stop/stop.integration.test.ts
index f892cc4423..ebf2c7c267 100644
--- a/apps/cli/src/commands/stop/stop.integration.test.ts
+++ b/apps/cli/src/commands/stop/stop.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -103,7 +103,7 @@ function mockRoutedContainerCliSpawner(
       Effect.gen(function* () {
         const standard = ChildProcess.isStandardCommand(command);
         const cmd = standard ? command.command : "";
-        const args = standard ? command.args : [];
+        const args = standard ? command.args.map(String) : [];
         spawned.push({ command: cmd, args });
         if (opts.onSpawn !== undefined) yield* opts.onSpawn(args);
 
@@ -188,6 +188,7 @@ function defaultRoute(
       return {
         stdout: [
           format
+            .replaceAll("{{.Client.DefaultAPIVersion}}", dockerClientApiVersion)
             .replaceAll("{{.Client.APIVersion}}", dockerClientApiVersion)
             .replaceAll("{{.Server.APIVersion}}", dockerServerApiVersion),
         ],
@@ -275,7 +276,7 @@ describe("stop integration", () => {
         expect(out.stderrText).toContain(
           "docker volume ls --filter label=com.supabase.cli.project=demo",
         );
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -298,7 +299,7 @@ describe("stop integration", () => {
         yield* stop(flags()).pipe(Effect.provide(layer));
         expect(yield* fs.exists(matchedDir)).toBe(false);
         expect(yield* fs.exists(unmatchedDir)).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -342,7 +343,7 @@ describe("stop integration", () => {
         yield* stop(flags({ all: Option.some(true) })).pipe(Effect.provide(layer));
         expect(yield* fs.exists(correctDir)).toBe(false);
         expect(yield* fs.exists(wrongDir)).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -363,7 +364,7 @@ describe("stop integration", () => {
           "--format",
           '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
         ]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("keeps an explicit --project-id raw, unsanitized", () =>
@@ -379,7 +380,7 @@ describe("stop integration", () => {
         "--format",
         '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("stops every project's containers with --all without reading config.toml", () =>
@@ -405,7 +406,7 @@ describe("stop integration", () => {
         "--filter",
         "label=com.supabase.cli.project",
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("suggests the bare-label volume command with --all when volumes remain", () =>
@@ -420,7 +421,7 @@ describe("stop integration", () => {
       );
       expect(out.stderrText).toContain("docker volume ls --filter label=com.supabase.cli.project");
       expect(out.stderrText).not.toContain("com.supabase.cli.project=");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("stops a named project with --project-id without reading config.toml", () =>
@@ -436,7 +437,7 @@ describe("stop integration", () => {
         "--format",
         '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("falls back to config.toml when --project-id is an empty string", () =>
@@ -455,7 +456,7 @@ describe("stop integration", () => {
         "--format",
         '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("resolves SUPABASE_PROJECT_ID from supabase/.env over config.toml", () =>
@@ -475,7 +476,7 @@ describe("stop integration", () => {
         "--format",
         '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("prefers ambient SUPABASE_PROJECT_ID over supabase/.env", () =>
@@ -499,7 +500,7 @@ describe("stop integration", () => {
         "--format",
         '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -527,7 +528,7 @@ describe("stop integration", () => {
           "--format",
           '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
         ]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("resolves SUPABASE_PROJECT_ID from supabase/.env even when config.toml is absent", () =>
@@ -544,7 +545,7 @@ describe("stop integration", () => {
         "--format",
         '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("resolves SUPABASE_PROJECT_ID from a project-root .env file", () =>
@@ -564,7 +565,7 @@ describe("stop integration", () => {
         "--format",
         '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when --workdir/SUPABASE_WORKDIR points at a missing path", () =>
@@ -583,7 +584,7 @@ describe("stop integration", () => {
         );
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when --workdir/SUPABASE_WORKDIR points at a file, not a directory", () =>
@@ -600,7 +601,7 @@ describe("stop integration", () => {
         expect(causeText).toContain(`failed to change workdir: chdir ${filePath}: not a directory`);
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("rejects --project-id together with --all", () =>
@@ -616,7 +617,7 @@ describe("stop integration", () => {
         expect(Cause.pretty(exit.cause)).toContain("StopMutuallyExclusiveError");
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   // Presence-based, not value-based: `--all=false` still counts as "set" alongside
@@ -634,7 +635,7 @@ describe("stop integration", () => {
         expect(Cause.pretty(exit.cause)).toContain("StopMutuallyExclusiveError");
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   const PRUNE_RUNNING = "Error response from daemon: a prune operation is already running";
@@ -670,7 +671,7 @@ describe("stop integration", () => {
       const fiber = yield* stop(flags()).pipe(Effect.provide(layer), Effect.forkChild);
       yield* joinAdvancingClock(fiber);
       expect(networkPrunes(child.spawned)).toHaveLength(3);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails once another stack's prune outlasts the retry budget", () =>
@@ -687,7 +688,7 @@ describe("stop integration", () => {
         expect(Cause.pretty(exit.cause)).toContain("a prune operation is already running");
       }
       expect(networkPrunes(child.spawned)).toHaveLength(41);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails on the first unrelated prune error", () =>
@@ -704,7 +705,7 @@ describe("stop integration", () => {
         );
       }
       expect(networkPrunes(child.spawned)).toHaveLength(1);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("deletes data volumes with --no-backup", () =>
@@ -725,7 +726,7 @@ describe("stop integration", () => {
         "--filter",
         "label=com.supabase.cli.project=demo",
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("omits --all from docker's volume prune on a pre-1.42 API host", () =>
@@ -747,7 +748,7 @@ describe("stop integration", () => {
         "--filter",
         "label=com.supabase.cli.project=demo",
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("omits --all from docker's volume prune when an old client talks to a new daemon", () =>
@@ -767,7 +768,7 @@ describe("stop integration", () => {
         "--filter",
         "label=com.supabase.cli.project=demo",
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("includes --all in docker's volume prune when the API is exactly 1.42", () =>
@@ -788,7 +789,7 @@ describe("stop integration", () => {
         "--filter",
         "label=com.supabase.cli.project=demo",
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("--backup=false alone does not delete data volumes", () =>
@@ -802,7 +803,7 @@ describe("stop integration", () => {
         (s) => s.args[0] === "volume" && s.args[1] === "prune",
       );
       expect(volumePrune).toBeUndefined();
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("--no-backup still deletes data volumes even when --backup stays true", () =>
@@ -823,7 +824,7 @@ describe("stop integration", () => {
         "--filter",
         "label=com.supabase.cli.project=demo",
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("keeps data volumes by default (no volume prune call)", () =>
@@ -837,7 +838,7 @@ describe("stop integration", () => {
         (s) => s.args[0] === "volume" && s.args[1] === "prune",
       );
       expect(volumePrune).toBeUndefined();
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when config.toml is malformed", () =>
@@ -850,7 +851,7 @@ describe("stop integration", () => {
         expect(Cause.pretty(exit.cause)).toContain("StopConfigLoadError");
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails naming the source when a config value is invalid", () =>
@@ -866,7 +867,7 @@ describe("stop integration", () => {
         expect(causeText).not.toContain("StopConfigLoadError");
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when [remotes.*] has a duplicate project_id, even with no projectRef", () =>
@@ -890,7 +891,7 @@ project_id = "aaaaaaaaaaaaaaaaaaaa"
         expect(Cause.pretty(exit.cause)).toContain("StopConfigLoadError");
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when a [remotes.*] project_id is not a valid 20-letter ref", () =>
@@ -911,7 +912,7 @@ project_id = "short"
         expect(Cause.pretty(exit.cause)).toContain("StopConfigLoadError");
       }
       expect(child.spawned).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -938,7 +939,7 @@ additional_redirect_urls = "http://a,http://b"
           "--format",
           '{{.ID}}\t{{.Names}}\t{{.Label "com.supabase.cli.workdir"}}',
         ]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -959,7 +960,7 @@ additional_redirect_urls = "http://a,http://b"
           expect(causeText).toContain("Postgres version 12.x is unsupported");
         }
         expect(child.spawned).toEqual([]);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("does not run config Validate for --all (bypasses config entirely)", () =>
@@ -976,7 +977,7 @@ additional_redirect_urls = "http://a,http://b"
       expect(Exit.isSuccess(exit)).toBe(true);
       const psCall = child.spawned.find((s) => s.args[0] === "ps");
       expect(psCall?.args).toContain("label=com.supabase.cli.project");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("does not run config Validate for --project-id (bypasses config entirely)", () =>
@@ -993,7 +994,7 @@ additional_redirect_urls = "http://a,http://b"
       expect(Exit.isSuccess(exit)).toBe(true);
       const psCall = child.spawned.find((s) => s.args[0] === "ps");
       expect(psCall?.args).toContain("label=com.supabase.cli.project=explicit");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when stopping a container errors", () =>
@@ -1011,7 +1012,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopContainerError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1044,7 +1045,7 @@ additional_redirect_urls = "http://a,http://b"
           expect(Cause.pretty(exit.cause)).toContain("StopContainerError");
         }
         expect(yield* fs.exists(stagedDir)).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when a container cannot be spawned to stop it at all", () =>
@@ -1061,7 +1062,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopContainerError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect(
@@ -1082,7 +1083,7 @@ additional_redirect_urls = "http://a,http://b"
         if (Exit.isFailure(exit)) {
           expect(Cause.pretty(exit.cause)).toContain("StopContainerError");
         }
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when container prune errors", () =>
@@ -1099,7 +1100,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopContainerPruneError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when volume prune errors", () =>
@@ -1116,7 +1117,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopVolumePruneError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when network prune errors", () =>
@@ -1133,7 +1134,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopNetworkPruneError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   // By the time a later prune stage fails, container-prune has already removed the containers;
@@ -1161,7 +1162,7 @@ additional_redirect_urls = "http://a,http://b"
       const exit = yield* Effect.exit(stop(flags()).pipe(Effect.provide(layer)));
       expect(Exit.isFailure(exit)).toBe(true);
       expect(yield* fs.exists(matchedDir)).toBe(false);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when the container list errors", () =>
@@ -1178,7 +1179,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopListError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.live("stops many containers in order, at most CONTAINER_CLI_CONCURRENCY at a time", () =>
@@ -1213,7 +1214,7 @@ additional_redirect_urls = "http://a,http://b"
       expect(stopCalls.map((s) => s.args)).toEqual(containerIds.map((id) => ["stop", id]));
       expect(yield* Ref.get(peak)).toBe(CONTAINER_CLI_CONCURRENCY);
       expect(out.stdoutText).toContain("Stopped");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("falls back to podman when docker is absent", () =>
@@ -1229,7 +1230,7 @@ additional_redirect_urls = "http://a,http://b"
       const psCalls = child.spawned.filter((s) => s.args[0] === "ps");
       expect(psCalls.at(-1)?.command).toBe("podman");
       expect(psCalls.some((s) => s.command === "docker")).toBe(true);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("omits --all from podman's volume prune (not a real Podman flag)", () =>
@@ -1254,7 +1255,7 @@ additional_redirect_urls = "http://a,http://b"
         "--filter",
         "label=com.supabase.cli.project=demo",
       ]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("emits a machine result in json mode without spinner text", () =>
@@ -1270,7 +1271,7 @@ additional_redirect_urls = "http://a,http://b"
       expect(out.stdoutText).not.toContain("\x1b[?25l");
       // json mode has no volume-suggestion equivalent — only text mode emits it.
       expect(out.stderrText).not.toContain("Local data are backed up");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("shows no volume suggestion when no volumes remain", () =>
@@ -1281,7 +1282,7 @@ additional_redirect_urls = "http://a,http://b"
       });
       yield* stop(flags()).pipe(Effect.provide(layer));
       expect(out.stderrText).not.toContain("Local data are backed up");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("flushes telemetry via ensuring even on failure", () =>
@@ -1292,7 +1293,7 @@ additional_redirect_urls = "http://a,http://b"
       });
       yield* Effect.exit(stop(flags()).pipe(Effect.provide(layer)));
       expect(telemetry.flushed).toBe(true);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when container prune cannot spawn any container runtime", () =>
@@ -1307,7 +1308,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopContainerPruneError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when volume prune cannot spawn any container runtime", () =>
@@ -1322,7 +1323,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopVolumePruneError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("fails when network prune cannot spawn any container runtime", () =>
@@ -1337,7 +1338,7 @@ additional_redirect_urls = "http://a,http://b"
       if (Exit.isFailure(exit)) {
         expect(Cause.pretty(exit.cause)).toContain("StopNetworkPruneError");
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("still reports success when the post-run volume listing fails", () =>
@@ -1352,7 +1353,7 @@ additional_redirect_urls = "http://a,http://b"
       yield* stop(flags()).pipe(Effect.provide(layer));
       expect(out.stdoutText).toContain("Stopped");
       expect(out.stderrText).not.toContain("Local data are backed up");
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   // `dockerRemoveAll`'s `--debug` prune reports write straight to `process.stderr`, bypassing
@@ -1403,7 +1404,7 @@ additional_redirect_urls = "http://a,http://b"
             writeSpy.mockRestore();
           }),
       );
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("never writes the Pruned lines to stderr without --debug", () =>
@@ -1427,6 +1428,6 @@ additional_redirect_urls = "http://a,http://b"
             writeSpy.mockRestore();
           }),
       );
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/commands/storage/cp/cp.command.integration.test.ts b/apps/cli/src/commands/storage/cp/cp.command.integration.test.ts
index a7c852b56c..23a0865b73 100644
--- a/apps/cli/src/commands/storage/cp/cp.command.integration.test.ts
+++ b/apps/cli/src/commands/storage/cp/cp.command.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Cause, Effect, Exit, Layer, Option } from "effect";
 import { CliOutput, Command } from "effect/cli";
 
@@ -33,6 +33,7 @@ function setup(args: ReadonlyArray<string>) {
   const out = mockOutput({ format: "text" });
   const layer = Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     CliOutput.layer(textCliOutputFormatter()),
     out.layer,
     commandTargetLayer.pipe(Layer.provide(out.layer)),
diff --git a/apps/cli/src/commands/storage/rm/rm.handler.ts b/apps/cli/src/commands/storage/rm/rm.handler.ts
index 08723634da..5bca608599 100644
--- a/apps/cli/src/commands/storage/rm/rm.handler.ts
+++ b/apps/cli/src/commands/storage/rm/rm.handler.ts
@@ -6,7 +6,7 @@ import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import { resolveYesWithProjectEnv } from "../../../command-internal/global-flags.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { bold } from "../../../command-internal/colors.ts";
-import { loadProjectEnvValues } from "../../../command-internal/db-config.toml-read.ts";
+import { loadProjectEnvValues } from "../../../command-internal/db-config.read.ts";
 import { requireTargetMutationConsent } from "../../../command-internal/hosted-consent/hosted-consent.ts";
 import type { HostedMutationConsent } from "../../../command-internal/hosted-consent/hosted-consent.token.ts";
 import { promptYesNo } from "../../../command-internal/prompt-yes-no.ts";
diff --git a/apps/cli/src/commands/storage/storage.experimental-gate.integration.test.ts b/apps/cli/src/commands/storage/storage.experimental-gate.integration.test.ts
index 13f17f04f4..6e22fea474 100644
--- a/apps/cli/src/commands/storage/storage.experimental-gate.integration.test.ts
+++ b/apps/cli/src/commands/storage/storage.experimental-gate.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Cause, Effect, Exit, Layer, Option } from "effect";
 import { CliOutput, Command } from "effect/cli";
 
@@ -32,6 +32,7 @@ function setup(args: ReadonlyArray<string>) {
   const out = mockOutput({ format: "text" });
   const layer = Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     CliOutput.layer(textCliOutputFormatter()),
     out.layer,
     commandTargetLayer.pipe(Layer.provide(out.layer)),
diff --git a/apps/cli/src/commands/telemetry/telemetry.integration.test.ts b/apps/cli/src/commands/telemetry/telemetry.integration.test.ts
index 4fe3f2d269..71694d1ffc 100644
--- a/apps/cli/src/commands/telemetry/telemetry.integration.test.ts
+++ b/apps/cli/src/commands/telemetry/telemetry.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, FileSystem, Layer, Path, Schema } from "effect";
 import { Command } from "effect/cli";
 import { FetchHttpClient } from "effect/http";
@@ -28,14 +28,14 @@ const writeTelemetryConfig = (dir: string, contents: string) =>
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
     yield* fs.writeFileString(path.join(dir, TELEMETRY_FILE), contents);
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const telemetryConfigExists = (dir: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
     return yield* fs.exists(path.join(dir, TELEMETRY_FILE));
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const readTelemetryConfig = (dir: string) =>
   Effect.gen(function* () {
@@ -45,7 +45,7 @@ const readTelemetryConfig = (dir: string) =>
     return yield* Schema.decodeEffect(
       Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown)),
     )(text);
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 function setup(dir: string) {
   const out = mockOutput();
@@ -54,6 +54,7 @@ function setup(dir: string) {
     out.layer,
     analytics.layer,
     BunServices.layer,
+    BunCrypto.layer,
     processControlLayer,
     processEnvLayer({ SUPABASE_HOME: dir }),
   );
@@ -75,13 +76,13 @@ function setupWithRealAnalytics(dir: string) {
     Layer.provide(runtimeInfoLayer),
     Layer.provide(cliProjectContextLayer),
     Layer.provide(envLayer),
-    Layer.provide(BunServices.layer),
+    Layer.provide([BunServices.layer, BunCrypto.layer]),
   );
   const analytics = analyticsLayer.pipe(
     Layer.provide(configLayer),
     Layer.provide(runtimeInfoLayer),
     Layer.provide(ttyLayer),
-    Layer.provide(BunServices.layer),
+    Layer.provide([BunServices.layer, BunCrypto.layer]),
     Layer.provide(FetchHttpClient.layer),
     Layer.provide(envLayer),
   );
@@ -89,6 +90,7 @@ function setupWithRealAnalytics(dir: string) {
     out.layer,
     analytics,
     BunServices.layer,
+    BunCrypto.layer,
     processControlLayer,
     envLayer,
   );
diff --git a/apps/cli/src/commands/test/db/SIDE_EFFECTS.md b/apps/cli/src/commands/test/db/SIDE_EFFECTS.md
index 55bccf3426..020eb3908b 100644
--- a/apps/cli/src/commands/test/db/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/test/db/SIDE_EFFECTS.md
@@ -125,8 +125,9 @@ command (exit 1).
   (`ConnectLocalPostgres` sets `cc.TLSConfig = nil`); remote (`--remote`)
   connections honor the URL's `sslmode` —
   `disable` → plaintext, `verify-ca` / `verify-full` → TLS **with** certificate
-  verification, and everything else (`prefer` / `require` / unset) → TLS **without**
-  verification (non-TLS fallbacks stripped).
+  verification, `require` → TLS **without** verification, and `prefer` / unset → TLS **without**
+  verification, retried in plaintext when the server declines TLS, the handshake fails, or
+  `pg_hba` rejects the TLS connection.
 - `--remote=<url>` accepts a WHATWG `postgres(ql)://…` URL; the deprecated `--db-url` also accepts the libpq
   keyword/value DSN form (`host=… dbname=… user=…`, incl. unix-socket paths), following libpq parsing. The `sslmode` and libpq `options` (Supavisor
   `?options=reference=<ref>`) parameters are preserved on both forms. A malformed URL or
diff --git a/apps/cli/src/commands/vanity-subdomains/activate/SIDE_EFFECTS.md b/apps/cli/src/commands/vanity-subdomains/activate/SIDE_EFFECTS.md
index d96a538e52..7666b32bfc 100644
--- a/apps/cli/src/commands/vanity-subdomains/activate/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/vanity-subdomains/activate/SIDE_EFFECTS.md
@@ -25,8 +25,6 @@ Target: hosted, consent default No — see [Command target](../../../../docs/com
 | `GET`  | `/v1/projects/{parent}/branches`               | Bearer token | none                           | `[{id, name, project_ref, is_default}]` — only for `--remote=<branch>` (or the deprecated `--project-ref=<branch>`), and for a bare `--remote` followed by a word that could name a branch; `{parent}` is `SUPABASE_PROJECT_ID`, else the linked project |
 | `GET`  | `/v1/branches/{id}`                            | Bearer token | none                           | `{ref, status, …}` — only for `--remote=<branch UUID>` when no project is linked                                                                                                                                                                         |
 | `POST` | `/v1/projects/{ref}/vanity-subdomain/activate` | Bearer token | `{ vanity_subdomain: string }` | `{ custom_domain: string }`                                                                                                                                                                                                                              |
-| `GET`  | `/v1/projects/{ref}`                           | Bearer token | none                           | `{organization_slug}` — upgrade-gate side-call on a 4xx with no plan-gate error in the body                                                                                                                                                              |
-| `GET`  | `/v1/organizations/{slug}/entitlements`        | Bearer token | none                           | `{entitlements[].feature.key, .hasAccess}` (key `vanity_subdomain`) — upgrade-gate side-call on a 4xx with no plan-gate error in the body                                                                                                                |
 | `GET`  | `/v1/projects/{ref}`                           | Bearer token | none                           | `{ref, name, organization_id, organization_slug}` — `linkedProjectCache` fill, best-effort, skipped when `.temp/linked-project.json` exists, `.temp/project-ref` names another ref, or no token is available                                             |
 
 ## Environment Variables
@@ -57,7 +55,7 @@ Target: hosted, consent default No — see [Command target](../../../../docs/com
 | Event                   | When                                                                                           | Notable properties / groups                |
 | ----------------------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------ |
 | `cli_command_executed`  | post-run, success or failure (via wrapper); not fired when the `--experimental` gate is closed | `exit_code`, `duration_ms`, `flags`        |
-| `cli_upgrade_suggested` | gated 4xx responses only                                                                       | `feature_key=vanity_subdomain`, `org_slug` |
+| `cli_upgrade_suggested` | 4xx whose body is the `entitlement_required` envelope                                          | `feature_key=vanity_subdomain`, `org_slug` |
 
 ## Output
 
@@ -88,7 +86,7 @@ One `result` event with the full response object.
   open), even when the API call fails, but only on a cache miss with a token when
   `GET /v1/projects/{ref}` succeeds and `.temp/project-ref` does not name another ref. A closed
   gate writes nothing.
-- On gated 4xx responses this command prints an upgrade suggestion and fires `cli_upgrade_suggested`.
+- On a 4xx whose body is the `entitlement_required` envelope this command prints an upgrade suggestion and fires `cli_upgrade_suggested`.
 - `--desired-subdomain` is required, but only enforced in the handler (after gate → login → ref
   resolution) rather than at parse time, using the fixed wording
   `required flag(s) "desired-subdomain" not set`. The gate/login/ref errors win over the missing
diff --git a/apps/cli/src/commands/vanity-subdomains/activate/activate.command.ts b/apps/cli/src/commands/vanity-subdomains/activate/activate.command.ts
index 905fba538d..dfe369822f 100644
--- a/apps/cli/src/commands/vanity-subdomains/activate/activate.command.ts
+++ b/apps/cli/src/commands/vanity-subdomains/activate/activate.command.ts
@@ -8,7 +8,6 @@ import { branchResolution } from "../../../command-internal/target/branch-resolu
 import { projectTargetFlags } from "../../../command-internal/target/target-flags.ts";
 import { projectRefPicker } from "../../../config/project-ref.layer.ts";
 import { linkedProjectCache } from "../../../telemetry/linked-project-cache.layer.ts";
-import { upgradeSuggestion } from "../../../command-internal/upgrade-suggest.ts";
 import { withJsonErrorHandling } from "../../../shared/output/json-error-handling.ts";
 import { requireExperimental } from "../../../command-internal/experimental-gate.ts";
 import { RESOURCE_OUTPUT_FORMATS } from "../../../command-internal/output-formats.ts";
@@ -54,7 +53,6 @@ export const vanitySubdomainsActivateCommand = Command.make("activate", config).
           },
         ],
       },
-      upgradeSuggestion,
       projectRefPicker,
       linkedProjectCache,
       branchResolution,
diff --git a/apps/cli/src/commands/vanity-subdomains/activate/activate.handler.ts b/apps/cli/src/commands/vanity-subdomains/activate/activate.handler.ts
index 93d9aa98a9..fc3e6dd81a 100644
--- a/apps/cli/src/commands/vanity-subdomains/activate/activate.handler.ts
+++ b/apps/cli/src/commands/vanity-subdomains/activate/activate.handler.ts
@@ -74,7 +74,6 @@ export const vanitySubdomainsActivate = Effect.fn("vanity-subdomains.activate")(
                 Effect.gen(function* () {
                   const upgradeSuggested = yield* suggestUpgrade({
                     projectRef: ref,
-                    featureKey: "vanity_subdomain",
                     statusCode: mapped.status,
                     response: gateResponse(cause),
                   });
diff --git a/apps/cli/src/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md b/apps/cli/src/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md
index dc35e60073..06ced207b0 100644
--- a/apps/cli/src/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/vanity-subdomains/check-availability/SIDE_EFFECTS.md
@@ -25,8 +25,6 @@ Target: hosted, no consent — see [Command target](../../../../docs/command-tar
 | `GET`  | `/v1/projects/{parent}/branches`                         | Bearer token | none                           | `[{id, name, project_ref, is_default}]` — only for `--remote=<branch>` (or the deprecated `--project-ref=<branch>`), and for a bare `--remote` followed by a word that could name a branch; `{parent}` is `SUPABASE_PROJECT_ID`, else the linked project |
 | `GET`  | `/v1/branches/{id}`                                      | Bearer token | none                           | `{ref, status, …}` — only for `--remote=<branch UUID>` when no project is linked                                                                                                                                                                         |
 | `POST` | `/v1/projects/{ref}/vanity-subdomain/check-availability` | Bearer token | `{ vanity_subdomain: string }` | `{ available: boolean }`                                                                                                                                                                                                                                 |
-| `GET`  | `/v1/projects/{ref}`                                     | Bearer token | none                           | `{organization_slug}` — upgrade-gate side-call on a 4xx with no plan-gate error in the body                                                                                                                                                              |
-| `GET`  | `/v1/organizations/{slug}/entitlements`                  | Bearer token | none                           | `{entitlements[].feature.key, .hasAccess}` (key `vanity_subdomain`) — upgrade-gate side-call on a 4xx with no plan-gate error in the body                                                                                                                |
 | `GET`  | `/v1/projects/{ref}`                                     | Bearer token | none                           | `{ref, name, organization_id, organization_slug}` — `linkedProjectCache` fill, best-effort, skipped when `.temp/linked-project.json` exists, `.temp/project-ref` names another ref, or no token is available                                             |
 
 ## Environment Variables
@@ -55,7 +53,7 @@ Target: hosted, no consent — see [Command target](../../../../docs/command-tar
 | ---------------------- | ---------------------------------------------------------------------------------------------- | ----------------------------------- |
 | `cli_command_executed` | post-run, success or failure (via wrapper); not fired when the `--experimental` gate is closed | `exit_code`, `duration_ms`, `flags` |
 
-This command may print an upgrade suggestion for gated 4xx responses, but it does not fire
+This command may print an upgrade suggestion for a 4xx whose body is the `entitlement_required` envelope, but it does not fire
 `cli_upgrade_suggested`.
 
 ## Output
diff --git a/apps/cli/src/commands/vanity-subdomains/check-availability/check-availability.command.ts b/apps/cli/src/commands/vanity-subdomains/check-availability/check-availability.command.ts
index ad5332cc0b..2e21251ac1 100644
--- a/apps/cli/src/commands/vanity-subdomains/check-availability/check-availability.command.ts
+++ b/apps/cli/src/commands/vanity-subdomains/check-availability/check-availability.command.ts
@@ -8,7 +8,6 @@ import { branchResolution } from "../../../command-internal/target/branch-resolu
 import { projectTargetFlags } from "../../../command-internal/target/target-flags.ts";
 import { projectRefPicker } from "../../../config/project-ref.layer.ts";
 import { linkedProjectCache } from "../../../telemetry/linked-project-cache.layer.ts";
-import { upgradeSuggestion } from "../../../command-internal/upgrade-suggest.ts";
 import { withJsonErrorHandling } from "../../../shared/output/json-error-handling.ts";
 import { requireExperimental } from "../../../command-internal/experimental-gate.ts";
 import { RESOURCE_OUTPUT_FORMATS } from "../../../command-internal/output-formats.ts";
@@ -55,7 +54,6 @@ export const vanitySubdomainsCheckAvailabilityCommand = Command.make(
           },
         ],
       },
-      upgradeSuggestion,
       projectRefPicker,
       linkedProjectCache,
       branchResolution,
diff --git a/apps/cli/src/commands/vanity-subdomains/check-availability/check-availability.handler.ts b/apps/cli/src/commands/vanity-subdomains/check-availability/check-availability.handler.ts
index 282be59786..d1a937f196 100644
--- a/apps/cli/src/commands/vanity-subdomains/check-availability/check-availability.handler.ts
+++ b/apps/cli/src/commands/vanity-subdomains/check-availability/check-availability.handler.ts
@@ -72,7 +72,6 @@ export const vanitySubdomainsCheckAvailability = Effect.fn("vanity-subdomains.ch
                     // analytics event.
                     const upgradeSuggested = yield* suggestUpgrade({
                       projectRef: ref,
-                      featureKey: "vanity_subdomain",
                       statusCode: mapped.status,
                       response: gateResponse(cause),
                       trackAnalytics: false,
diff --git a/apps/cli/src/commands/vanity-subdomains/vanity-subdomains.integration.test.ts b/apps/cli/src/commands/vanity-subdomains/vanity-subdomains.integration.test.ts
index 0e13f8e8c2..1c5717df04 100644
--- a/apps/cli/src/commands/vanity-subdomains/vanity-subdomains.integration.test.ts
+++ b/apps/cli/src/commands/vanity-subdomains/vanity-subdomains.integration.test.ts
@@ -1,7 +1,6 @@
 import type {
   V1ActivateVanitySubdomainConfigOutput,
   V1CheckVanitySubdomainAvailabilityOutput,
-  V1GetProjectOutput,
   V1GetVanitySubdomainConfigOutput,
 } from "@supabase/api/effect";
 import { describe, expect, it } from "@effect/vitest";
@@ -30,13 +29,13 @@ import { vanitySubdomainsActivate } from "./activate/activate.handler.ts";
 import { vanitySubdomainsCheckAvailability } from "./check-availability/check-availability.handler.ts";
 import { vanitySubdomainsDelete } from "./delete/delete.handler.ts";
 import { vanitySubdomainsGet } from "./get/get.handler.ts";
+import { classifyCliCauseActionability } from "../../shared/telemetry/error-actionability.ts";
 import { YesFlag } from "../../command-internal/global-flags.ts";
 import { TargetPolicy } from "../../command-internal/target/target-policy.ts";
 
 type VanityConfig = typeof V1GetVanitySubdomainConfigOutput.Type;
 type AvailabilityResponse = typeof V1CheckVanitySubdomainAvailabilityOutput.Type;
 type ActivateResponse = typeof V1ActivateVanitySubdomainConfigOutput.Type;
-type ProjectResponse = typeof V1GetProjectOutput.Type;
 
 const tempRoot = useTempWorkdir("supabase-vanity-int-");
 
@@ -73,21 +72,12 @@ const SAMPLE_ACTIVATE: ActivateResponse = {
   custom_domain: "example.com",
 };
 
-// Schema-valid project body: the upgrade-suggest fallback decodes it with the typed client.
-const SAMPLE_PROJECT: ProjectResponse = {
-  id: VALID_REF,
-  ref: VALID_REF,
-  organization_id: "org-123",
-  organization_slug: "supabase",
-  name: "Test Project",
-  region: "us-east-1",
-  created_at: "2026-01-01T00:00:00Z",
-  status: "ACTIVE_HEALTHY",
-  database: {
-    host: "db.example.com",
-    version: "15",
-    postgres_engine: "15",
-    release_channel: "ga",
+const VANITY_GATE_ENVELOPE = {
+  message: "This feature requires the Pro, Team, or Enterprise organization plan.",
+  error: {
+    code: "entitlement_required",
+    feature: "vanity_subdomain",
+    upgrade_url: "https://supabase.com/dashboard/org/env-org/billing",
   },
 };
 
@@ -112,35 +102,6 @@ function runtimeWith(opts: {
   });
 }
 
-// Mocks a billing-gated (402) write endpoint with entitlements reporting no access to
-// `vanity_subdomain`, for the upgrade-suggestion branch tests.
-function gatedApi(matchWrite: (url: string) => boolean) {
-  return mockCommandPlatformApi({
-    handler: (request) =>
-      Effect.sync(() => {
-        if (request.method === "POST" && matchWrite(request.url)) {
-          return jsonResponse(request, 402, {});
-        }
-        if (request.method === "GET" && request.url.endsWith(`/v1/projects/${VALID_REF}`)) {
-          return jsonResponse(request, 200, SAMPLE_PROJECT);
-        }
-        if (request.method === "GET" && request.url.includes("/entitlements")) {
-          return jsonResponse(request, 200, {
-            entitlements: [
-              {
-                feature: { key: "vanity_subdomain", type: "boolean" },
-                hasAccess: false,
-                type: "boolean",
-                config: { enabled: true },
-              },
-            ],
-          });
-        }
-        return jsonResponse(request, 200, null);
-      }),
-  });
-}
-
 // No project is configured: the picker lists projects, the command makes its own call, and the
 // real linked-project cache then looks the project up.
 function pickerComposition(own: { readonly status: number; readonly body: unknown }) {
@@ -534,7 +495,7 @@ describe("vanity-subdomains check-availability", () => {
 
   it.effect("suggests upgrade for gated checks without firing analytics", () => {
     const out = mockOutput({ format: "text" });
-    const api = gatedApi((url) => url.includes("/check-availability"));
+    const api = mockCommandPlatformApi({ response: { status: 400, body: VANITY_GATE_ENVELOPE } });
     const analytics = mockAnalytics();
     const layer = runtimeWith({ out, api, analytics });
 
@@ -548,11 +509,10 @@ describe("vanity-subdomains check-availability", () => {
       );
       expect(Exit.isFailure(exit)).toBe(true);
       expect(out.stderrText).toContain("Upgrade your plan:");
+      expect(out.stderrText).toContain("/org/env-org/billing");
       expect(analytics.captured).toHaveLength(0);
       expect(requestLines(api)).toEqual([
         `POST ${API_URL}/v1/projects/${VALID_REF}/vanity-subdomain/check-availability`,
-        `GET ${API_URL}/v1/projects/${VALID_REF}`,
-        `GET ${API_URL}/v1/organizations/supabase/entitlements`,
       ]);
       assertPermissionDrift({
         command: "vanity-subdomains check-availability",
@@ -562,6 +522,34 @@ describe("vanity-subdomains check-availability", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect("makes one request and suggests no upgrade on a check 4xx without the envelope", () => {
+    const out = mockOutput({ format: "text" });
+    const api = mockCommandPlatformApi({
+      response: { status: 400, body: { message: "Invalid subdomain" } },
+    });
+    const analytics = mockAnalytics();
+    const layer = runtimeWith({ out, api, analytics });
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        vanitySubdomainsCheckAvailability({
+          remote: Option.none(),
+          projectRef: Option.none(),
+          desiredSubdomain: Option.some("example.com"),
+        }),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        expect(classifyCliCauseActionability(exit.cause).error_category).not.toBe("plan_limit");
+      }
+      expect(requestLines(api)).toEqual([
+        `POST ${API_URL}/v1/projects/${VALID_REF}/vanity-subdomain/check-availability`,
+      ]);
+      expect(out.stderrText).not.toContain("Upgrade your plan:");
+      expect(analytics.captured).toHaveLength(0);
+    }).pipe(Effect.provide(layer));
+  });
+
   // json mode so the spinner is suppressed — exercises the no-task error path.
   it.effect("fails with a network error on transport failure", () => {
     const out = mockOutput({ format: "json" });
@@ -772,7 +760,7 @@ describe("vanity-subdomains activate", () => {
 
   it.effect("suggests upgrade and fires analytics for gated activation", () => {
     const out = mockOutput({ format: "text" });
-    const api = gatedApi((url) => url.endsWith("/vanity-subdomain/activate"));
+    const api = mockCommandPlatformApi({ response: { status: 400, body: VANITY_GATE_ENVELOPE } });
     const analytics = mockAnalytics();
     const layer = runtimeWith({ out, api, analytics });
 
@@ -786,16 +774,15 @@ describe("vanity-subdomains activate", () => {
       );
       expect(Exit.isFailure(exit)).toBe(true);
       expect(out.stderrText).toContain("Upgrade your plan:");
+      expect(out.stderrText).toContain("/org/env-org/billing");
       expect(analytics.captured).toEqual([
         {
           event: "cli_upgrade_suggested",
-          properties: { feature_key: "vanity_subdomain", org_slug: "supabase" },
+          properties: { feature_key: "vanity_subdomain", org_slug: "env-org" },
         },
       ]);
       expect(requestLines(api)).toEqual([
         `POST ${API_URL}/v1/projects/${VALID_REF}/vanity-subdomain/activate`,
-        `GET ${API_URL}/v1/projects/${VALID_REF}`,
-        `GET ${API_URL}/v1/organizations/supabase/entitlements`,
       ]);
       assertPermissionDrift({
         command: "vanity-subdomains activate",
@@ -805,6 +792,37 @@ describe("vanity-subdomains activate", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect(
+    "makes one request and suggests no upgrade on an activate 4xx without the envelope",
+    () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockCommandPlatformApi({
+        response: { status: 400, body: { message: "Invalid subdomain" } },
+      });
+      const analytics = mockAnalytics();
+      const layer = runtimeWith({ out, api, analytics });
+
+      return Effect.gen(function* () {
+        const exit = yield* Effect.exit(
+          vanitySubdomainsActivate({
+            remote: Option.none(),
+            projectRef: Option.none(),
+            desiredSubdomain: Option.some("example.com"),
+          }),
+        );
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(classifyCliCauseActionability(exit.cause).error_category).not.toBe("plan_limit");
+        }
+        expect(requestLines(api)).toEqual([
+          `POST ${API_URL}/v1/projects/${VALID_REF}/vanity-subdomain/activate`,
+        ]);
+        expect(out.stderrText).not.toContain("Upgrade your plan:");
+        expect(analytics.captured).toHaveLength(0);
+      }).pipe(Effect.provide(layer));
+    },
+  );
+
   // json mode so the spinner is suppressed — exercises the no-task error path.
   it.effect("fails with a network error on transport failure", () => {
     const out = mockOutput({ format: "json" });
diff --git a/apps/cli/src/config/cli-config-failure-key.ts b/apps/cli/src/config/cli-config-failure-key.ts
new file mode 100644
index 0000000000..97b169e43f
--- /dev/null
+++ b/apps/cli/src/config/cli-config-failure-key.ts
@@ -0,0 +1,105 @@
+import {
+  CliConfigSchema,
+  type CliConfigParseError,
+  type CliConfigRemovedKeyError,
+} from "@supabase/config";
+import { Predicate, Schema, type SchemaIssue } from "effect";
+
+import { cliConfigDocumentOnlyPaths, cliConfigRegistry } from "./cli-config-keys.ts";
+import type { CliConfigValueError } from "./cli-config.errors.ts";
+
+const REMOVED_KEY_PATHS: ReadonlyArray<string> = [
+  "inbucket",
+  "experimental.orioledb_version",
+  "auth.external.linkedin",
+  "auth.external.slack",
+];
+
+const withAncestors = (path: string): ReadonlyArray<string> => {
+  const segments = path.split(".");
+  return segments.map((_, index) => segments.slice(0, index + 1).join("."));
+};
+
+const KNOWN_PATHS: ReadonlySet<string> = new Set(
+  [
+    ...Object.keys(CliConfigSchema.fields),
+    ...cliConfigRegistry.keys.map((key) => key.path),
+    ...cliConfigRegistry.families.map((family) => family.prefix),
+    ...cliConfigDocumentOnlyPaths,
+  ].flatMap(withAncestors),
+);
+
+const taggedAs =
+  <E extends { readonly _tag: string }>(tag: E["_tag"]) =>
+  (error: unknown): error is E =>
+    Predicate.isTagged(error, tag);
+
+const isRemovedKeyError = taggedAs<CliConfigRemovedKeyError>("CliConfigRemovedKeyError");
+const isParseError = taggedAs<CliConfigParseError>("CliConfigParseError");
+const isValueError = taggedAs<CliConfigValueError>("CliConfigValueError");
+
+const removedKeyPath = (displayKey: string): string | undefined => {
+  const path = displayKey.replaceAll(/[[\]]/g, "");
+  return REMOVED_KEY_PATHS.find(
+    (canonical) =>
+      path === canonical || (path.startsWith("remotes.") && path.endsWith(`.${canonical}`)),
+  );
+};
+
+const knownPrefix = (segments: ReadonlyArray<string>): string | undefined => {
+  for (let length = segments.length; length > 0; length--) {
+    const candidate = segments.slice(0, length).join(".");
+    if (KNOWN_PATHS.has(candidate)) return candidate;
+  }
+  return undefined;
+};
+
+/** Remote blocks decode as one record, so their issue paths start with the remote name instead of `remotes`. */
+const decodedAsRemoteBlocks = (issue: SchemaIssue.Issue): boolean =>
+  issue._tag === "Composite" &&
+  issue.ast._tag === "Objects" &&
+  issue.ast.propertySignatures.length === 0;
+
+const firstIssuePath = (
+  issue: SchemaIssue.Issue,
+  path: ReadonlyArray<string>,
+): ReadonlyArray<string> | undefined => {
+  switch (issue._tag) {
+    case "Pointer":
+      return firstIssuePath(issue.issue, [...path, ...issue.path.map(String)]);
+    case "Filter":
+    case "Encoding":
+      return firstIssuePath(issue.issue, path);
+    case "Composite":
+    case "AnyOf":
+      for (const nested of issue.issues) {
+        const found = firstIssuePath(nested, path);
+        if (found !== undefined) return found;
+      }
+      return undefined;
+    default:
+      return path.length > 0 ? path : undefined;
+  }
+};
+
+/** The source-owned config key path a config load failure names, never a value, file path or user-chosen name. */
+export const cliConfigFailureKey = (error: unknown): string | undefined => {
+  if (isRemovedKeyError(error)) {
+    const matched = new Set<string>();
+    for (const { key } of error.removedKeys) {
+      const canonical = removedKeyPath(key);
+      if (canonical !== undefined) matched.add(canonical);
+    }
+    return matched.size === 0 ? undefined : [...matched].sort().join(",");
+  }
+  if (isValueError(error)) {
+    return knownPrefix(error.path.split("."));
+  }
+  if (isParseError(error) && Schema.isSchemaError(error.cause)) {
+    const { issue } = error.cause;
+    const path = firstIssuePath(issue, []);
+    if (path === undefined) return undefined;
+    return knownPrefix(decodedAsRemoteBlocks(issue) ? path.slice(1) : path);
+  }
+  return undefined;
+};
diff --git a/apps/cli/src/config/cli-config-failure-key.unit.test.ts b/apps/cli/src/config/cli-config-failure-key.unit.test.ts
new file mode 100644
index 0000000000..0c916099e1
--- /dev/null
+++ b/apps/cli/src/config/cli-config-failure-key.unit.test.ts
@@ -0,0 +1,222 @@
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { CliConfigRemovedKeyError } from "@supabase/config";
+import { Effect, Option, Schema } from "effect";
+
+import { withConfigEnv } from "../../tests/helpers/command-mocks.ts";
+import { definedEnv } from "../../tests/helpers/config-env-pins.ts";
+import { configValuesLayer } from "../../tests/helpers/config-values-layer.ts";
+import { createStackConfigProject } from "../../tests/helpers/stack-config.ts";
+import { cliConfigFailureKey } from "./cli-config-failure-key.ts";
+import { CliConfigValueError } from "./cli-config.errors.ts";
+import { CliConfigValues } from "./cli-config-values.service.ts";
+
+const SECRET = "sk_live_4eC39Hq";
+
+const REMOTE_REF = "abcdefghijklmnopqrst";
+
+const loadFailure = (config: string) =>
+  Effect.gen(function* () {
+    const workdir = yield* createStackConfigProject(config, {
+      prefix: "supabase-config-failure-key-",
+    });
+    return yield* CliConfigValues.use((values) =>
+      values.load({ workdir, projectRef: Option.none() }),
+    ).pipe(Effect.provide(configValuesLayer()), Effect.flip);
+  }).pipe(
+    Effect.provide(BunServices.layer),
+    (effect) => withConfigEnv(definedEnv({}), effect),
+    Effect.scoped,
+  );
+
+const remoteDbPort = (remote: string) =>
+  `[remotes."${remote}"]\nproject_id = "${REMOTE_REF}"\n[remotes."${remote}".db]\nport = "x"\n`;
+
+const remoteDbSection = (remote: string) =>
+  `[remotes."${remote}"]\nproject_id = "${REMOTE_REF}"\ndb = "invalid"\n`;
+
+describe("cliConfigFailureKey for a removed key", () => {
+  it.live.each([
+    {
+      name: "the [inbucket] table",
+      config: "[inbucket]\nenabled = true\n",
+      key: "inbucket",
+    },
+    {
+      name: "experimental.orioledb_version",
+      config: '[experimental]\norioledb_version = "15.1.0.150"\n',
+      key: "experimental.orioledb_version",
+    },
+    {
+      name: "the linkedin provider",
+      config: "[auth.external.linkedin]\nenabled = true\n",
+      key: "auth.external.linkedin",
+    },
+    {
+      name: "the slack provider",
+      config: "[auth.external.slack]\nenabled = true\n",
+      key: "auth.external.slack",
+    },
+    {
+      name: "a remote block whose name contains dots and a secret",
+      config: `[remotes."prod.${SECRET}.example.com".inbucket]\nenabled = true\n`,
+      key: "inbucket",
+    },
+    {
+      name: "a removed provider in a remote block",
+      config: "[remotes.staging.auth.external.slack]\nenabled = true\n",
+      key: "auth.external.slack",
+    },
+    {
+      name: "several keys, joined sorted without repeats",
+      config: [
+        "[inbucket]",
+        "enabled = true",
+        "[experimental]",
+        'orioledb_version = "15.1.0.150"',
+        "[auth.external.slack]",
+        "enabled = true",
+        "[remotes.staging.inbucket]",
+        "enabled = true",
+      ].join("\n"),
+      key: "auth.external.slack,experimental.orioledb_version,inbucket",
+    },
+  ])("names $name", ({ config, key }) =>
+    Effect.gen(function* () {
+      const error = yield* loadFailure(config);
+
+      expect(error._tag).toBe("CliConfigRemovedKeyError");
+      expect(cliConfigFailureKey(error)).toBe(key);
+    }),
+  );
+
+  it("drops removed keys outside the source-owned vocabulary", () => {
+    const removedKeys = (...keys: ReadonlyArray<string>) =>
+      new CliConfigRemovedKeyError({
+        path: "supabase/config.toml",
+        format: "toml",
+        removedKeys: keys.map((key) => ({ key, replacement: "[replacement]" })),
+      });
+
+    expect(cliConfigFailureKey(removedKeys(`[${SECRET}]`, "[inbucket]"))).toBe("inbucket");
+    expect(cliConfigFailureKey(removedKeys(`[${SECRET}]`))).toBeUndefined();
+  });
+});
+
+describe("cliConfigFailureKey for an invalid value", () => {
+  it.live.each([
+    {
+      name: "a registry key",
+      config: "[db]\nport = 70000\n",
+      key: "db.port",
+    },
+    {
+      name: "a provider the source names",
+      config: "[auth.external.github]\nclient_id = 5\n",
+      key: "auth.external.github.client_id",
+    },
+    {
+      name: "a user-chosen provider name, collapsed to its family",
+      config: "[auth.external.my_provider]\nclient_id = 5\n",
+      key: "auth.external",
+    },
+    {
+      name: "a user-chosen provider name containing dots and a secret",
+      config: `[auth.external."corp.${SECRET}.sso"]\nclient_id = 5\n`,
+      key: "auth.external",
+    },
+  ])("names $name", ({ config, key }) =>
+    Effect.gen(function* () {
+      const error = yield* loadFailure(config);
+
+      expect(error._tag).toBe("CliConfigValueError");
+      expect(cliConfigFailureKey(error)).toBe(key);
+    }),
+  );
+
+  it("names nothing for a path outside the source-owned vocabulary", () => {
+    const error = new CliConfigValueError({
+      path: `vendor_tables.${SECRET}.password`,
+      tier: "config",
+      message: "invalid",
+    });
+
+    expect(cliConfigFailureKey(error)).toBeUndefined();
+  });
+});
+
+describe("cliConfigFailureKey for a config document that does not decode", () => {
+  it.live.each([
+    {
+      name: "a section table written as an array",
+      config: "[[auth.hook.custom_access_token]]\n",
+      key: "auth.hook.custom_access_token",
+    },
+    {
+      name: "a user-named bucket, collapsed to its section",
+      config: `[storage.buckets."${SECRET}.assets"]\npublic = "yes"\n`,
+      key: "storage",
+    },
+    {
+      name: "a user-named function, collapsed to functions",
+      config: '[functions.my-fn]\nverify_jwt = "x"\n',
+      key: "functions",
+    },
+    {
+      name: "a key inside a remote block",
+      config: remoteDbPort("staging"),
+      key: "db.port",
+    },
+    {
+      name: "a key inside a remote named after a config section",
+      config: remoteDbPort("auth"),
+      key: "db.port",
+    },
+    {
+      name: "a section inside a remote named after a config section",
+      config: remoteDbSection("auth"),
+      key: "db",
+    },
+  ])("names $name", ({ config, key }) =>
+    Effect.gen(function* () {
+      const error = yield* loadFailure(config);
+
+      expect(error._tag).toBe("CliConfigParseError");
+      expect(Schema.isSchemaError("cause" in error ? error.cause : undefined)).toBe(true);
+      expect(cliConfigFailureKey(error)).toBe(key);
+    }),
+  );
+
+  it.live("names the key without the dotted, secret-looking remote name", () =>
+    Effect.gen(function* () {
+      const error = yield* loadFailure(remoteDbPort(`prod.${SECRET}.example.com`));
+
+      expect(error._tag).toBe("CliConfigParseError");
+      expect(Schema.isSchemaError("cause" in error ? error.cause : undefined)).toBe(true);
+      const key = cliConfigFailureKey(error);
+      expect(key).toBe("db.port");
+      expect(key).not.toContain(SECRET);
+    }),
+  );
+
+  it.live("names nothing for a TOML syntax error", () =>
+    Effect.gen(function* () {
+      const error = yield* loadFailure("[db\nport = ");
+
+      expect(error._tag).toBe("CliConfigParseError");
+      expect(Schema.isSchemaError("cause" in error ? error.cause : undefined)).toBe(false);
+      expect(cliConfigFailureKey(error)).toBeUndefined();
+    }),
+  );
+});
+
+describe("cliConfigFailureKey for a failure unrelated to config", () => {
+  it.each([
+    { name: "a plain Error", failure: new Error("db.port is invalid") },
+    { name: "a string", failure: "db.port" },
+    { name: "undefined", failure: undefined },
+    { name: "a lookalike with another tag", failure: { _tag: "SomeOtherError", path: "db.port" } },
+  ])("names nothing for $name", ({ failure }) => {
+    expect(cliConfigFailureKey(failure)).toBeUndefined();
+  });
+});
diff --git a/apps/cli/src/config/cli-config-key-annotations.ts b/apps/cli/src/config/cli-config-key-annotations.ts
index 51e3235361..0562dbc514 100644
--- a/apps/cli/src/config/cli-config-key-annotations.ts
+++ b/apps/cli/src/config/cli-config-key-annotations.ts
@@ -82,7 +82,8 @@ export const CLI_CONFIG_ENV_NAME_PATHS: Readonly<Record<string, ReadonlyArray<st
 
 /** Schema sections whose keys take no `SUPABASE_*` override, with the reason. */
 export const CLI_CONFIG_NO_ENV_SECTIONS: Readonly<Record<string, string>> = {
-  local: "local stack service versions are pinned in config.toml and supabase/supabase.lock only",
+  local:
+    "local stack service versions are pinned in the config file and supabase/supabase.lock only",
 };
 
 /** Removed `SUPABASE_*` config overrides with the key and variable that replace them; a non-empty value fails config resolution. */
@@ -296,6 +297,7 @@ export const CLI_NON_CONFIG_ENV_NAMES: Readonly<Record<string, string>> = {
   SUPABASE_ACCESS_TOKEN: "platform auth",
   SUPABASE_ACTIVE_HELP: "shell completion",
   SUPABASE_ANON_KEY: "functions runtime env",
+  SUPABASE_API_MAX_RETRIES: "platform api retries",
   SUPABASE_API_URL: "platform profile",
   SUPABASE_BASELINE: "pgdata snapshot marker file name",
   SUPABASE_CA_SKIP_VERIFY: "telemetry signal",
diff --git a/apps/cli/src/config/cli-config-values.integration.test.ts b/apps/cli/src/config/cli-config-values.integration.test.ts
index fa591823be..18c152e1d4 100644
--- a/apps/cli/src/config/cli-config-values.integration.test.ts
+++ b/apps/cli/src/config/cli-config-values.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import type { CliConfig } from "@supabase/config";
 import { loadCliConfig } from "@supabase/config/internal";
@@ -13,10 +13,15 @@ import {
 } from "../../tests/helpers/config-values-layer.ts";
 import { mockOutput } from "../../tests/helpers/mocks.ts";
 import { createStackConfigProject } from "../../tests/helpers/stack-config.ts";
+import { describeConfigLoadFailure } from "../command-internal/resolved-config-context.ts";
 import { loadStackConfig } from "../command-internal/stack-config.ts";
 import { CliEnvNameSource } from "../shared/config/cli-config-provider.layer.ts";
 import { DebugLogger } from "../shared/output/debug-logger.service.ts";
 import { runtimeInfoLayer } from "../shared/runtime/runtime-info.layer.ts";
+import {
+  CommandTelemetryAttributes,
+  type CommandTelemetryAttributeValues,
+} from "../telemetry/command-telemetry-attributes.ts";
 import {
   CliConfigFlagInputs,
   makeCliConfigFlagInputs,
@@ -452,6 +457,380 @@ describe("CliConfigValues deprecated keys", () => {
   );
 });
 
+describe("CliConfigValues JSON config files", () => {
+  const load = (root: string) =>
+    CliConfigValues.use((values) => values.load({ workdir: root, projectRef: Option.none() }));
+
+  const writeSupabaseFile = (root: string, name: string, content: string) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* fs.writeFileString(path.join(root, "supabase", name), content);
+    });
+
+  it.live("warns once that config.toml is ignored and reads values from config.jsonc", () =>
+    Effect.gen(function* () {
+      const root = yield* project("[db]\nport = 54111\n");
+      yield* writeSupabaseFile(
+        root,
+        "config.jsonc",
+        '{\n  // wins\n  "db": { "port": 54222, },\n}\n',
+      );
+      const output = mockOutput();
+
+      const first = yield* Effect.gen(function* () {
+        const loaded = yield* load(root);
+        yield* load(root);
+        return loaded;
+      }).pipe(Effect.provide(configValuesLayer({ output: output.layer })));
+
+      expect(first.materialized.config.db.port).toBe(54222);
+      expect(output.messages).toEqual([
+        {
+          type: "warn",
+          message:
+            "Ignoring supabase/config.toml because supabase/config.jsonc takes precedence. Delete the file you don't use.",
+        },
+      ]);
+    }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("warns that config.toml is ignored when a strict config.json shadows it", () =>
+    Effect.gen(function* () {
+      const root = yield* project("[db]\nport = 54111\n");
+      yield* writeSupabaseFile(root, "config.json", '{"db": {"port": 54333}}');
+      const output = mockOutput();
+
+      const loaded = yield* load(root).pipe(
+        Effect.provide(configValuesLayer({ output: output.layer })),
+      );
+
+      expect(loaded.materialized.config.db.port).toBe(54333);
+      expect(output.messages).toEqual([
+        {
+          type: "warn",
+          message:
+            "Ignoring supabase/config.toml because supabase/config.json takes precedence. Delete the file you don't use.",
+        },
+      ]);
+    }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("prints no ignored-file warning when only config.toml exists", () =>
+    Effect.gen(function* () {
+      const root = yield* project("[db]\nport = 54111\n");
+      const output = mockOutput();
+
+      yield* load(root).pipe(Effect.provide(configValuesLayer({ output: output.layer })));
+
+      expect(output.messages).toEqual([]);
+    }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("resolves a value from a commented config.jsonc-only project", () =>
+    Effect.gen(function* () {
+      const root = yield* project("");
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* fs.remove(path.join(root, "supabase", "config.toml"));
+      yield* writeSupabaseFile(
+        root,
+        "config.jsonc",
+        '{\n  /* local port */\n  "db": { "port": 54444, },\n}\n',
+      );
+      const output = mockOutput();
+
+      const loaded = yield* load(root).pipe(
+        Effect.provide(configValuesLayer({ output: output.layer })),
+      );
+
+      expect(loaded.materialized.config.db.port).toBe(54444);
+      expect(output.messages).toEqual([]);
+    }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live(
+    "fails with CliConfigFileConflictError when config.json and config.jsonc both exist",
+    () =>
+      Effect.gen(function* () {
+        const root = yield* project("");
+        yield* writeSupabaseFile(root, "config.json", "{}");
+        yield* writeSupabaseFile(root, "config.jsonc", "{}");
+
+        const failure = yield* load(root).pipe(Effect.flip, Effect.provide(configValuesLayer()));
+
+        expect(failure).toMatchObject({ _tag: "CliConfigFileConflictError" });
+        expect(failure.message).toBe(
+          "Found both supabase/config.json and supabase/config.jsonc. Keep one and delete the other.",
+        );
+      }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+});
+
+describe("CliConfigValues schema declaration", () => {
+  const V2 = "https://supabase.com/schemas/config/v2.json";
+  const V1 = "https://supabase.com/schemas/config/v1.json";
+
+  const load = (root: string) =>
+    CliConfigValues.use((values) => values.load({ workdir: root, projectRef: Option.none() }));
+
+  const loadLinked = (root: string) =>
+    CliConfigValues.use((values) =>
+      values.load({ workdir: root, projectRef: Option.some(LINKED) }),
+    );
+
+  const writeConfig = (root: string, name: string, content: string) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* fs.remove(path.join(root, "supabase", "config.toml"), { force: true });
+      yield* fs.writeFileString(path.join(root, "supabase", name), content);
+    });
+
+  const warningsFor = (file: string, content: string) =>
+    Effect.gen(function* () {
+      const root = yield* project("");
+      yield* writeConfig(root, file, content);
+      const output = mockOutput();
+      yield* load(root).pipe(Effect.provide(configValuesLayer({ output: output.layer })));
+      return { messages: output.messages, stderr: output.stderrText, stdout: output.stdoutText };
+    }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect));
+
+  it.live("warns once that an unrecognized schema URL is read as v1", () =>
+    Effect.gen(function* () {
+      const root = yield* project("");
+      yield* writeConfig(
+        root,
+        "config.json",
+        '{"$schema": "https://example.com/x.json", "db": {"port": 54777}}',
+      );
+      const output = mockOutput();
+
+      const loaded = yield* Effect.gen(function* () {
+        const first = yield* load(root);
+        yield* loadLinked(root);
+        return first;
+      }).pipe(Effect.provide(configValuesLayer({ output: output.layer })));
+
+      expect(loaded.materialized.config.db.port).toBe(54777);
+      expect(output.stderrText).toBe(
+        "WARN: supabase/config.json declares schema https://example.com/x.json, which is not the Supabase CLI config schema, so it is read as v1. Set it to https://supabase.com/schemas/config/v1.json to remove this warning.\n",
+      );
+      expect(output.stdoutText).toBe("");
+      expect(output.messages).toEqual([]);
+    }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  const silent: ReadonlyArray<readonly [string, string, string]> = [
+    ["v1 JSON", "config.json", `{"$schema": "${V1}"}`],
+    ["an undeclared JSON file", "config.json", "{}"],
+    ["a v1 TOML directive", "config.toml", `#:schema ${V1}\n[db]\nport = 54111\n`],
+    ["an undeclared TOML file", "config.toml", "[db]\nport = 54111\n"],
+    [
+      "the legacy docs URL",
+      "config.json",
+      '{"$schema": "https://supabase.com/docs/cli/config.schema.json"}',
+    ],
+    [
+      "the built dist/schema.json path",
+      "config.json",
+      '{"$schema": "../node_modules/@supabase/config/dist/schema.json"}',
+    ],
+    [
+      "the legacy node_modules path",
+      "config.jsonc",
+      '{"$schema": "./node_modules/@supabase/config/schema.json"}',
+    ],
+  ];
+
+  for (const [name, file, content] of silent) {
+    it.live(`prints no warning for ${name}`, () =>
+      Effect.gen(function* () {
+        expect(yield* warningsFor(file, content)).toEqual({ messages: [], stderr: "", stdout: "" });
+      }).pipe(Effect.scoped),
+    );
+  }
+
+  it.live("warns once with the sorted unknown keys of the file", () =>
+    Effect.gen(function* () {
+      const root = yield* project("bogus = 1\n[api]\nfoo = 2\n");
+      const output = mockOutput();
+
+      yield* Effect.gen(function* () {
+        yield* load(root);
+        yield* loadLinked(root);
+      }).pipe(Effect.provide(configValuesLayer({ output: output.layer })));
+
+      expect(output.stderrText).toBe(
+        "WARN: supabase/config.toml has keys this version of the Supabase CLI does not recognize and ignores: api.foo, bogus. Check them for typos, remove keys older CLI versions used, or upgrade the CLI if they come from a newer version.\n",
+      );
+      expect(output.stdoutText).toBe("");
+      expect(output.messages).toEqual([]);
+    }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("lists unknown keys under a remote with the remote name", () =>
+    Effect.gen(function* () {
+      const messages = yield* warningsFor(
+        "config.toml",
+        '[remotes.staging]\nproject_id = "stagingrefstagingref"\n[remotes.staging.api]\nfoo = 1\n',
+      );
+
+      expect(messages.stderr).toBe(
+        "WARN: supabase/config.toml has keys this version of the Supabase CLI does not recognize and ignores: remotes.staging.api.foo. Check them for typos, remove keys older CLI versions used, or upgrade the CLI if they come from a newer version.\n",
+      );
+      expect(messages.messages).toEqual([]);
+    }).pipe(Effect.scoped),
+  );
+
+  it.live(
+    "never lists the document-only db.password and db.root_key, at the root or in a remote",
+    () =>
+      Effect.gen(function* () {
+        const messages = yield* warningsFor(
+          "config.toml",
+          [
+            "[db]",
+            'password = "pw"',
+            'root_key = "rk"',
+            "oops = 1",
+            "[remotes.staging]",
+            'project_id = "stagingrefstagingref"',
+            "[remotes.staging.db]",
+            'password = "pw"',
+            'root_key = "rk"',
+            "",
+          ].join("\n"),
+        );
+
+        expect(messages.stderr).toBe(
+          "WARN: supabase/config.toml has keys this version of the Supabase CLI does not recognize and ignores: db.oops. Check them for typos, remove keys older CLI versions used, or upgrade the CLI if they come from a newer version.\n",
+        );
+        expect(messages.messages).toEqual([]);
+      }).pipe(Effect.scoped),
+  );
+
+  it.live(
+    "never lists the document-only auth.passkey and auth.webauthn tables, at the root or in a remote",
+    () =>
+      Effect.gen(function* () {
+        const warnings = yield* warningsFor(
+          "config.toml",
+          [
+            "[auth.passkey]",
+            "enabled = true",
+            "[auth.webauthn]",
+            'rp_id = "x"',
+            "[remotes.staging]",
+            'project_id = "stagingrefstagingref"',
+            "[remotes.staging.auth.passkey]",
+            "enabled = true",
+            "[remotes.staging.auth.webauthn]",
+            'rp_id = "x"',
+            "",
+          ].join("\n"),
+        );
+
+        expect(warnings).toEqual({ messages: [], stderr: "", stdout: "" });
+      }).pipe(Effect.scoped),
+  );
+
+  it.live("never lists a custom auth.external provider table, at the root or in a remote", () =>
+    Effect.gen(function* () {
+      const warnings = yield* warningsFor(
+        "config.toml",
+        [
+          "[auth.external.my_oidc]",
+          "enabled = true",
+          'client_id = "id"',
+          "[remotes.staging]",
+          'project_id = "stagingrefstagingref"',
+          "[remotes.staging.auth.external.my_oidc]",
+          "enabled = true",
+          "",
+        ].join("\n"),
+      );
+
+      expect(warnings).toEqual({ messages: [], stderr: "", stdout: "" });
+    }).pipe(Effect.scoped),
+  );
+
+  it.live("still lists a non-table value under auth.external", () =>
+    Effect.gen(function* () {
+      const warnings = yield* warningsFor("config.toml", '[auth.external]\nmy_oidc = "x"\n');
+
+      expect(warnings.stderr).toBe(
+        "WARN: supabase/config.toml has keys this version of the Supabase CLI does not recognize and ignores: auth.external.my_oidc. Check them for typos, remove keys older CLI versions used, or upgrade the CLI if they come from a newer version.\n",
+      );
+    }).pipe(Effect.scoped),
+  );
+
+  it.live("still lists an unknown key written beside the document-only auth tables", () =>
+    Effect.gen(function* () {
+      const warnings = yield* warningsFor(
+        "config.toml",
+        "[auth.passkey]\nenabled = true\n[auth.passkeys]\nenabled = true\n",
+      );
+
+      expect(warnings.stderr).toBe(
+        "WARN: supabase/config.toml has keys this version of the Supabase CLI does not recognize and ignores: auth.passkeys. Check them for typos, remove keys older CLI versions used, or upgrade the CLI if they come from a newer version.\n",
+      );
+    }).pipe(Effect.scoped),
+  );
+
+  it.live(
+    "prints an unknown key containing an escape sequence with the control characters escaped",
+    () =>
+      Effect.gen(function* () {
+        const warnings = yield* warningsFor("config.toml", '"bad\\u001b[31m" = 1\n');
+
+        expect(warnings.stderr).toBe(
+          "WARN: supabase/config.toml has keys this version of the Supabase CLI does not recognize and ignores: bad\\u001b[31m. Check them for typos, remove keys older CLI versions used, or upgrade the CLI if they come from a newer version.\n",
+        );
+        expect(warnings.stderr.includes("\u001b")).toBe(false);
+        expect(warnings.stdout).toBe("");
+      }).pipe(Effect.scoped),
+  );
+
+  it.live("prints an unrecognized $schema containing an escape sequence escaped", () =>
+    Effect.gen(function* () {
+      const warnings = yield* warningsFor(
+        "config.json",
+        '{"$schema": "https://example.com/\\u001b[31mx.json"}',
+      );
+
+      expect(warnings.stderr).toBe(
+        "WARN: supabase/config.json declares schema https://example.com/\\u001b[31mx.json, which is not the Supabase CLI config schema, so it is read as v1. Set it to https://supabase.com/schemas/config/v1.json to remove this warning.\n",
+      );
+      expect(warnings.stderr.includes("\u001b")).toBe(false);
+    }).pipe(Effect.scoped),
+  );
+
+  const tooNew: ReadonlyArray<readonly [string, string, string]> = [
+    ["config.json", `{"$schema": "${V2}"}`, "supabase/config.json"],
+    ["config.jsonc", `{\n// c\n"$schema": "${V2}",\n}`, "supabase/config.jsonc"],
+    ["config.toml", `#:schema ${V2}\n[db\nbroken = = 1\n`, "supabase/config.toml"],
+    ["config.toml", `  # note\n\t#:schema ${V2} \t\n[db]\n`, "supabase/config.toml"],
+  ];
+
+  for (const [file, content, shown] of tooNew) {
+    it.live(`fails CliConfigValues.load with the upgrade message for a v2 ${file}`, () =>
+      Effect.gen(function* () {
+        const root = yield* project("");
+        yield* writeConfig(root, file, content);
+
+        const failure = yield* load(root).pipe(Effect.flip, Effect.provide(configValuesLayer()));
+
+        expect(failure).toMatchObject({ _tag: "CliConfigSchemaVersionError" });
+        expect(failure.message).toBe(
+          `${shown} declares config schema v2, but this version of the Supabase CLI only reads up to v1. Upgrade the Supabase CLI to use this config.`,
+        );
+        expect(describeConfigLoadFailure(failure)).toBe(failure.message);
+      }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+    );
+  }
+});
+
 describe("CliConfigValues memoisation", () => {
   it.live("memoises a load per target and drops the memo after a write", () =>
     Effect.gen(function* () {
@@ -1347,7 +1726,11 @@ policy = "per_worker"
       });
       expect(originAt("auth.email.smtp.port")).toMatchObject({ tier: "config" });
       expect(originAt("db.password")).toEqual({ tier: "default" });
-    }).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+    }).pipe(
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
+      (effect) => withShell({}, effect),
+      Effect.scoped,
+    ),
   );
 
   it.live("agrees with the stack config overlay for a matched remote and shell overrides", () =>
@@ -1383,7 +1766,7 @@ major_version = 15
       expect(originAt("auth.site_url")).toMatchObject({ tier: "config", remote: "staging" });
       expect(originAt("api.schemas")).toMatchObject({ tier: "shell" });
     }).pipe(
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       (effect) => withShell({ SUPABASE_API_SCHEMAS: "public,shell_api" }, effect),
       Effect.scoped,
     ),
@@ -2027,3 +2410,130 @@ project_id = "${OTHER}"
     }).pipe(Effect.provide(BunServices.layer), Effect.scoped),
   );
 });
+
+describe("CliConfigValues failure telemetry", () => {
+  const withCommandRun = <A, E, R>(
+    body: (telemetry: {
+      readonly records: ReadonlyArray<CommandTelemetryAttributeValues>;
+      readonly configKey: () => string | undefined;
+    }) => Effect.Effect<A, E, R>,
+  ) => {
+    const records: Array<CommandTelemetryAttributeValues> = [];
+    let attributes: CommandTelemetryAttributeValues = {};
+    const sink = {
+      record: (values: CommandTelemetryAttributeValues) =>
+        Effect.sync(() => {
+          records.push(values);
+          attributes = { ...attributes, ...values };
+        }),
+    };
+    return body({ records, configKey: () => attributes.config_key }).pipe(
+      Effect.provide(configValuesLayer()),
+      Effect.provideService(CommandTelemetryAttributes, sink),
+    );
+  };
+
+  const load = (workdir: string) =>
+    CliConfigValues.use((values) => values.load({ workdir, projectRef: Option.none() }));
+
+  const loadTolerating = (workdir: string) =>
+    CliConfigValues.use((values) =>
+      values.load({ workdir, projectRef: Option.none(), tolerateInvalid: true }),
+    );
+
+  it.live("records nothing for a successful load and lookup with no earlier failure", () =>
+    withCommandRun(({ records }) =>
+      Effect.gen(function* () {
+        const root = yield* project("[db]\nport = 54400\n");
+
+        const resolvedConfig = yield* load(root);
+        const port = yield* resolvedConfig.get(CliConfigKeys.db.port);
+
+        expect(port.value).toBe(54400);
+        expect(records).toEqual([]);
+      }),
+    ).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("records the key of a tolerated invalid value when it is read", () =>
+    withCommandRun(({ records }) =>
+      Effect.gen(function* () {
+        const root = yield* project('[db]\nport = "not-a-port"\n');
+
+        const resolvedConfig = yield* loadTolerating(root);
+        expect(records).toEqual([]);
+
+        const error = yield* resolvedConfig.get(CliConfigKeys.db.port).pipe(Effect.flip);
+
+        expect(error).toMatchObject({ _tag: "CliConfigValueError", path: "db.port" });
+        expect(records).toEqual([{ config_key: "db.port" }]);
+      }),
+    ).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("records no key when the load failure names no config key", () =>
+    withCommandRun(({ records }) =>
+      Effect.gen(function* () {
+        const root = yield* project("[db\nport = ");
+
+        const error = yield* load(root).pipe(Effect.flip);
+
+        expect(error._tag).toBe("CliConfigParseError");
+        expect(records).toEqual([]);
+      }),
+    ).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("records no key for a keyless load failure after a recovered keyed lookup failure", () =>
+    withCommandRun(({ configKey }) =>
+      Effect.gen(function* () {
+        const invalid = yield* project('[db]\nport = "not-a-port"\n');
+        const malformed = yield* project("[db\nport = ");
+
+        const resolvedConfig = yield* loadTolerating(invalid);
+        const lookup = yield* resolvedConfig.get(CliConfigKeys.db.port).pipe(Effect.flip);
+        expect(lookup).toMatchObject({ _tag: "CliConfigValueError", path: "db.port" });
+        expect(configKey()).toBe("db.port");
+
+        const error = yield* load(malformed).pipe(Effect.flip);
+
+        expect(error._tag).toBe("CliConfigParseError");
+        expect(configKey()).toBeUndefined();
+      }),
+    ).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("clears the key of a recovered lookup failure when a later load succeeds", () =>
+    withCommandRun(({ configKey }) =>
+      Effect.gen(function* () {
+        const invalid = yield* project('[db]\nport = "not-a-port"\n');
+        const valid = yield* project("[db]\nport = 54400\n");
+
+        const resolvedConfig = yield* loadTolerating(invalid);
+        const lookup = yield* resolvedConfig.get(CliConfigKeys.db.port).pipe(Effect.flip);
+        expect(lookup).toMatchObject({ _tag: "CliConfigValueError", path: "db.port" });
+        expect(configKey()).toBe("db.port");
+
+        yield* load(valid);
+
+        expect(configKey()).toBeUndefined();
+      }),
+    ).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+
+  it.live("clears the key of a recovered lookup failure when a later lookup succeeds", () =>
+    withCommandRun(({ configKey }) =>
+      Effect.gen(function* () {
+        const root = yield* project('[db]\nport = "not-a-port"\n');
+
+        const resolvedConfig = yield* loadTolerating(root);
+        yield* resolvedConfig.get(CliConfigKeys.db.port).pipe(Effect.flip);
+        expect(configKey()).toBe("db.port");
+
+        yield* resolvedConfig.get(CliConfigKeys.db.majorVersion);
+
+        expect(configKey()).toBeUndefined();
+      }),
+    ).pipe(Effect.provide(BunServices.layer), (effect) => withShell({}, effect), Effect.scoped),
+  );
+});
diff --git a/apps/cli/src/config/cli-config-values.layer.ts b/apps/cli/src/config/cli-config-values.layer.ts
index e9ac913c49..ffd102a868 100644
--- a/apps/cli/src/config/cli-config-values.layer.ts
+++ b/apps/cli/src/config/cli-config-values.layer.ts
@@ -1,7 +1,8 @@
-import type { CliConfigValueOrigin } from "@supabase/config";
+import { CLI_CONFIG_SCHEMA_URL, type CliConfigValueOrigin } from "@supabase/config";
 import {
   decodeMergedCliConfig,
   ENV_CAPTURE_REGEX,
+  findUnknownCliConfigKeys,
   mergeParsedCliConfig,
   parseCliConfigDocumentFile,
   type MergedCliConfigDocument,
@@ -16,6 +17,7 @@ import {
   Layer,
   Option,
   Path,
+  Ref,
   Result,
 } from "effect";
 
@@ -26,6 +28,8 @@ import { CliConfigLoadError } from "../shared/config/cli-config-load.errors.ts";
 import { DebugLogger } from "../shared/output/debug-logger.service.ts";
 import { escapeControlCharacters } from "../shared/output/escape-control-characters.ts";
 import { Output } from "../shared/output/output.service.ts";
+import { PropConfigKey } from "../shared/telemetry/event-catalog.ts";
+import { recordCommandTelemetry } from "../telemetry/command-telemetry-attributes.ts";
 import { CLI_CONFIG_FAMILIES, CLI_CONFIG_REMOVED_ENV_NAMES } from "./cli-config-key-annotations.ts";
 import {
   cloneDocumentRecord,
@@ -37,6 +41,7 @@ import {
   sameDocumentValue,
   setDocumentValue,
 } from "./cli-config-document.ts";
+import { cliConfigFailureKey } from "./cli-config-failure-key.ts";
 import { CliConfigFlagInputs, cliConfigFlagConflictError } from "./cli-config-flags.ts";
 import {
   decodingFailedMessage,
@@ -50,6 +55,7 @@ import {
 } from "./cli-config-key.ts";
 import {
   cliConfigFamilyEnvNames,
+  cliConfigDocumentOnlyPaths,
   cliConfigFamilyKey,
   cliConfigRegistry,
   cliRemoteProjectIdEnvName,
@@ -91,6 +97,31 @@ const deprecatedKeyLine = (deprecatedPath: string): string => {
   return `WARN: ${shown} is deprecated and will be removed in v4, use ${shown.replace(/enable_signup$/, "enabled")} instead.\n`;
 };
 
+/** Unknown-key reports stop at the first unknown table, so a document-only table such as `auth.passkey` arrives whole. */
+const isDocumentOnlyKey = (key: ReadonlyArray<string>): boolean => {
+  const dotted = key.join(".");
+  return [...cliConfigDocumentOnlyPaths].some(
+    (known) => known === dotted || known.startsWith(`${dotted}.`) || dotted.startsWith(`${known}.`),
+  );
+};
+
+/** Custom `[auth.external.<name>]` providers have no schema entry, but `start` reads them from the raw document. */
+const isCustomAuthProvider = (rawDocument: unknown, key: ReadonlyArray<string>): boolean => {
+  const local = key[0] === "remotes" ? key.slice(2) : key;
+  return (
+    local.length === 3 &&
+    local[0] === "auth" &&
+    local[1] === "external" &&
+    isDocumentRecord(getDocumentValue(rawDocument, key))
+  );
+};
+
+const unrecognizedSchemaLine = (file: string, ref: string): string =>
+  `WARN: ${file} declares schema ${escapeControlCharacters(ref)}, which is not the Supabase CLI config schema, so it is read as v1. Set it to ${CLI_CONFIG_SCHEMA_URL} to remove this warning.\n`;
+
+const unknownKeysLine = (file: string, keys: ReadonlyArray<string>): string =>
+  `WARN: ${file} has keys this version of the Supabase CLI does not recognize and ignores: ${keys.map(escapeControlCharacters).join(", ")}. Check them for typos, remove keys older CLI versions used, or upgrade the CLI if they come from a newer version.\n`;
+
 const registryEnvNames = cliConfigRegistry.keys.flatMap((key) => key.env);
 
 /** The env names the document makes relevant: `env()` references, remote ids and family entries. */
@@ -220,6 +251,21 @@ export const cliConfigValuesLayer = Layer.effect(
       return output.raw(line, "stderr");
     };
 
+    // The latest config load or lookup decides `config_key`, so a recovered failure cannot label
+    // a later one; only changes are recorded.
+    const recordedFailureKey = yield* Ref.make<string | undefined>(undefined);
+    const settleFailureKey = (key: string | undefined) =>
+      Ref.getAndSet(recordedFailureKey, key).pipe(
+        Effect.flatMap((previous) =>
+          previous === key ? Effect.void : recordCommandTelemetry({ [PropConfigKey]: key }),
+        ),
+      );
+    const tracksConfigFailureKey = <A, E, R>(self: Effect.Effect<A, E, R>) =>
+      self.pipe(
+        Effect.tapError((error) => settleFailureKey(cliConfigFailureKey(error))),
+        Effect.tap(() => settleFailureKey(undefined)),
+      );
+
     const parsedDocuments = yield* Cache.makeWith(
       (workdir: string) => withPlatform(parseCliConfigDocumentFile(workdir, { search: false })),
       {
@@ -238,6 +284,31 @@ export const cliConfigValuesLayer = Layer.effect(
       for (const deprecatedPath of parsed?.deprecatedPaths ?? []) {
         yield* printOnce(deprecatedKeyLine(deprecatedPath));
       }
+      if (parsed !== null) {
+        const displayPath = (filePath: string) =>
+          path.relative(target.workdir, filePath).replaceAll("\\", "/");
+        const used = displayPath(parsed.path);
+        const declaration = parsed.schemaDeclaration;
+        if (declaration !== undefined && declaration.version === undefined) {
+          yield* printOnce(unrecognizedSchemaLine(used, declaration.ref));
+        }
+        const unknownKeys = findUnknownCliConfigKeys(parsed.rawDocument)
+          .filter(
+            (key) =>
+              !isDocumentOnlyKey(key[0] === "remotes" ? key.slice(2) : key) &&
+              !isCustomAuthProvider(parsed.rawDocument, key),
+          )
+          .map((key) => key.join("."));
+        if (unknownKeys.length > 0) {
+          yield* printOnce(unknownKeysLine(used, unknownKeys));
+        }
+        for (const ignoredPath of parsed.ignoredPaths) {
+          const ignored = displayPath(ignoredPath);
+          yield* warnOnce(
+            `Ignoring ${ignored} because ${used} takes precedence. Delete the file you don't use.`,
+          );
+        }
+      }
       const rawDocument = parsed?.rawDocument ?? {};
 
       const shell = yield* readShellEnvironment({
@@ -534,7 +605,7 @@ export const cliConfigValuesLayer = Layer.effect(
           const picked = pickCliConfigKey(key, sources);
           if (Result.isFailure(picked)) return yield* picked.failure;
           return picked.success;
-        });
+        }).pipe(tracksConfigFailureKey);
 
       for (const message of overrideWarnings) yield* warnOnce(message);
       if (Option.isSome(debugLogger)) {
@@ -600,7 +671,7 @@ export const cliConfigValuesLayer = Layer.effect(
             tolerateUnreadableLinkedRef: target.tolerateUnreadableLinkedRef === true,
             tolerateInvalid: target.tolerateInvalid === true,
           }),
-        ),
+        ).pipe(tracksConfigFailureKey),
       writeThrough: (write) => Effect.ensuring(write, invalidate),
       invalidate,
     });
diff --git a/apps/cli/src/config/command-settings.layer.ts b/apps/cli/src/config/command-settings.layer.ts
index b5ec300e3b..06de31fe16 100644
--- a/apps/cli/src/config/command-settings.layer.ts
+++ b/apps/cli/src/config/command-settings.layer.ts
@@ -1,5 +1,15 @@
 import { findCliProjectRoot } from "@supabase/config/effect";
-import { Config, ConfigProvider, Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
+import {
+  Config,
+  ConfigProvider,
+  Data,
+  Effect,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Redacted,
+} from "effect";
 import { CliArgs } from "../shared/cli/cli-args.service.ts";
 import { lastExplicitLongFlagValue } from "../shared/cli/flag-groups.ts";
 import { CLI_VERSION } from "../shared/cli/version.ts";
@@ -14,6 +24,20 @@ import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
 import { CliEnvNames } from "./cli-config-keys.ts";
 import { CommandSettings } from "./command-settings.service.ts";
 import { resolveSupabaseHomeValue } from "../shared/config/supabase-home.ts";
+import {
+  actionability,
+  type CliErrorActionabilityDeclaration,
+  ErrorActionabilityId,
+} from "../shared/telemetry/error-actionability.ts";
+
+/** A `SUPABASE_API_MAX_RETRIES` that is not a non-negative integer, rejected before any API request. */
+export class ApiMaxRetriesError extends Data.TaggedError("ApiMaxRetriesError")<{
+  readonly message: string;
+}> {
+  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
+    return actionability.invalidConfig;
+  }
+}
 
 function unknownMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
@@ -162,6 +186,26 @@ export const commandSettingsLayer = Layer.unwrap(
           path,
         );
 
+        // Empty means unset, like the other SUPABASE_* settings; anything else must be plain
+        // digits, rejected here before a command reaches the network.
+        const rawApiMaxRetries = yield* read(
+          Config.option(Config.String("SUPABASE_API_MAX_RETRIES")),
+        );
+        const apiMaxRetries = yield* Option.match(
+          Option.filter(rawApiMaxRetries, (value) => value.length > 0),
+          {
+            onNone: () => Effect.succeed(Option.none<number>()),
+            onSome: (value) =>
+              /^\d+$/.test(value) && Number.isSafeInteger(Number(value))
+                ? Effect.succeed(Option.some(Number(value)))
+                : Effect.fail(
+                    new ApiMaxRetriesError({
+                      message: `invalid SUPABASE_API_MAX_RETRIES "${value}": expected a non-negative integer`,
+                    }),
+                  ),
+          },
+        );
+
         const userAgent = `SupabaseCLI/${CLI_VERSION}`;
 
         yield* Effect.annotateCurrentSpan({
@@ -184,6 +228,7 @@ export const commandSettingsLayer = Layer.unwrap(
           explicitWorkdir,
           workdirEnvValue,
           userAgent,
+          apiMaxRetries,
         });
       }).pipe(Effect.withSpan("CommandSettings.load")),
     );
diff --git a/apps/cli/src/config/command-settings.layer.unit.test.ts b/apps/cli/src/config/command-settings.layer.unit.test.ts
index a53247d677..e8bcf7a531 100644
--- a/apps/cli/src/config/command-settings.layer.unit.test.ts
+++ b/apps/cli/src/config/command-settings.layer.unit.test.ts
@@ -19,7 +19,7 @@ import { useTempWorkdir } from "../../tests/helpers/command-mocks.ts";
 import { mockRuntimeInfo } from "../../tests/helpers/mocks.ts";
 import { debugLoggerLayer } from "../command-internal/debug-logger.layer.ts";
 import { ProfileLoadError } from "../command-internal/profile-load.ts";
-import { commandSettingsLayer } from "./command-settings.layer.ts";
+import { ApiMaxRetriesError, commandSettingsLayer } from "./command-settings.layer.ts";
 import { CommandSettings } from "./command-settings.service.ts";
 
 const path = Effect.runSync(Effect.provide(Path.Path, BunPath.layer));
@@ -536,6 +536,40 @@ describe("commandSettingsLayer", () => {
     ),
   );
 
+  it.effect("captures SUPABASE_API_MAX_RETRIES, treating an empty value as unset", () =>
+    Effect.gen(function* () {
+      const read = (value: string | undefined) =>
+        Effect.service(CommandSettings).pipe(
+          Effect.provide(
+            makeLayer({ env: { SUPABASE_API_MAX_RETRIES: value }, cwd: tempRoot.current }),
+          ),
+          Effect.map((config) => config.apiMaxRetries),
+        );
+      expect(yield* read("0")).toEqual(Option.some(0));
+      expect(yield* read("3")).toEqual(Option.some(3));
+      expect(yield* read("")).toEqual(Option.none());
+      expect(yield* read(undefined)).toEqual(Option.none());
+    }),
+  );
+
+  it.effect("rejects a SUPABASE_API_MAX_RETRIES that is not a non-negative integer", () =>
+    Effect.gen(function* () {
+      for (const value of ["-1", "1.5", "1e2", " 3", "abc"]) {
+        const exit = yield* configExit({
+          env: { SUPABASE_API_MAX_RETRIES: value },
+          cwd: tempRoot.current,
+        });
+        const error = Exit.isFailure(exit)
+          ? exit.cause.reasons.find(Cause.isFailReason)?.error
+          : undefined;
+        expect(error).toBeInstanceOf(ApiMaxRetriesError);
+        expect(error).toMatchObject({
+          message: `invalid SUPABASE_API_MAX_RETRIES "${value}": expected a non-negative integer`,
+        });
+      }
+    }),
+  );
+
   it.effect("captures SUPABASE_PROJECT_ID env", () =>
     Effect.gen(function* () {
       const config = yield* CommandSettings;
diff --git a/apps/cli/src/config/command-settings.service.ts b/apps/cli/src/config/command-settings.service.ts
index 58b702e824..b87294cb5b 100644
--- a/apps/cli/src/config/command-settings.service.ts
+++ b/apps/cli/src/config/command-settings.service.ts
@@ -44,6 +44,8 @@ interface CommandSettingsShape {
   /** Raw `SUPABASE_WORKDIR` value; `Some("")` differs from an absent variable and is used verbatim. */
   readonly workdirEnvValue: Option.Option<string>;
   readonly userAgent: string;
+  /** `SUPABASE_API_MAX_RETRIES`: Management API retries after the first attempt; none keeps the client default. */
+  readonly apiMaxRetries: Option.Option<number>;
 }
 
 export class CommandSettings extends Context.Service<CommandSettings, CommandSettingsShape>()(
diff --git a/apps/cli/src/config/project-ref.layer.unit.test.ts b/apps/cli/src/config/project-ref.layer.unit.test.ts
index 433b83d21e..5446b0e3b0 100644
--- a/apps/cli/src/config/project-ref.layer.unit.test.ts
+++ b/apps/cli/src/config/project-ref.layer.unit.test.ts
@@ -33,6 +33,7 @@ function mockCliSettings(opts: { workdir: string; projectId?: string }) {
     workdir: opts.workdir,
     explicitWorkdir: false,
     userAgent: "SupabaseCLI/0.0.0-dev",
+    apiMaxRetries: Option.none(),
   });
 }
 
diff --git a/apps/cli/src/docs/docs-spec.tables.ts b/apps/cli/src/docs/docs-spec.tables.ts
index eb9c89bfd5..905ca8f7d3 100644
--- a/apps/cli/src/docs/docs-spec.tables.ts
+++ b/apps/cli/src/docs/docs-spec.tables.ts
@@ -38,6 +38,7 @@ export const DOCS_TAGS: Readonly<Record<string, ReadonlyArray<string>>> = {
   "supabase-link": ["local-dev"],
   "supabase-login": ["local-dev"],
   "supabase-logout": ["local-dev"],
+  "supabase-logs": ["management-api", "local-dev"],
   "supabase-migration": ["local-dev"],
   "supabase-network-bans": ["management-api"],
   "supabase-network-restrictions": ["management-api"],
@@ -168,12 +169,6 @@ export const DOCS_EXTRA_FLAGS: Readonly<Record<string, ReadonlyArray<DocsFlag>>>
   ],
 };
 
-/**
- * Documented accepted values where the Effect choice union is wider than the
- * globally valid set, keyed `"<doc id> <flag id>"`. The root `-o, --output`
- * union includes `table`/`csv` only because `db query` reuses the global
- * flag; everywhere else the valid formats are the five below.
- */
 export const DOCS_CHOICE_OVERRIDES: Readonly<Record<string, ReadonlyArray<string>>> = {
   "supabase output": ["env", "pretty", "json", "toml", "yaml"],
 };
diff --git a/apps/cli/src/docs/docs-spec.ts b/apps/cli/src/docs/docs-spec.ts
index 6f7043ab5a..d318d91ac0 100644
--- a/apps/cli/src/docs/docs-spec.ts
+++ b/apps/cli/src/docs/docs-spec.ts
@@ -1,3 +1,4 @@
+import { hasOptionalSubcommand } from "../shared/output/optional-subcommand-usage.ts";
 import { Option } from "effect";
 import { stringify } from "yaml";
 import { GlobalFlag } from "effect/cli";
@@ -337,7 +338,8 @@ export function buildDocsSpec(input: DocsSpecInput): DocsSpec {
     const docId = commandPath.join("-");
     const children = docsVisibleChildren(command);
     const internals = commandInternals(command);
-    const isLeaf = children.length === 0;
+    const optionalSubcommand = hasOptionalSubcommand(command);
+    const isExecutable = children.length === 0 || optionalSubcommand;
     emittedIds.add(docId);
 
     const overlayPath = docsOverlayPath(commandPath);
@@ -348,7 +350,7 @@ export function buildDocsSpec(input: DocsSpecInput): DocsSpec {
     );
 
     const flags: Array<DocsFlag> = [];
-    if (isLeaf) {
+    if (isExecutable) {
       const declared = flagDocsFor(commandPath, internals.config.flags);
       const declaredIds = new Set(declared.map((flag) => flag.id));
       const extraFlags = DOCS_EXTRA_FLAGS[docId];
@@ -381,7 +383,7 @@ export function buildDocsSpec(input: DocsSpecInput): DocsSpec {
     }
 
     let usage: string | undefined;
-    if (isLeaf) {
+    if (isExecutable) {
       const argOverride = DOCS_ARG_OVERRIDES[docId];
       if (argOverride !== undefined) consumedArgOverrideIds.add(docId);
       const argUsages =
@@ -390,7 +392,12 @@ export function buildDocsSpec(input: DocsSpecInput): DocsSpec {
           : internals.config.arguments
               .map((param) => docsArgumentUsage(commandPath, param))
               .filter((part) => part !== undefined);
-      usage = [...commandPath, ...argUsages, "[flags]"].join(" ");
+      usage = [
+        ...commandPath,
+        ...argUsages,
+        ...(optionalSubcommand ? ["[subcommand]"] : []),
+        "[flags]",
+      ].join(" ");
     }
 
     const tags = DOCS_TAGS[docId];
diff --git a/apps/cli/src/docs/docs-spec.unit.test.ts b/apps/cli/src/docs/docs-spec.unit.test.ts
index 0f82b19818..fec9900be1 100644
--- a/apps/cli/src/docs/docs-spec.unit.test.ts
+++ b/apps/cli/src/docs/docs-spec.unit.test.ts
@@ -296,6 +296,27 @@ describe("buildDocsSpec", () => {
     expect(output?.accepted_values?.map((value) => value.id)).toEqual(["json", "table", "csv"]);
   });
 
+  it.each(["supabase-logs", "supabase-logs-sources"])(
+    "keeps legacy output off the native logs %s page",
+    (id) => {
+      const command = builtSpec().byId.get(id);
+      expect(command).toBeDefined();
+      expect(command?.flags.some((flag) => flag.id === "output")).toBe(false);
+    },
+  );
+
+  it("documents the executable logs root alongside its source catalog", () => {
+    const { byId } = builtSpec();
+    const logs = byId.get("supabase-logs");
+    expect(logs?.usage).toBe("supabase logs [subcommand] [flags]");
+    expect(logs?.flags.map((flag) => flag.id)).toEqual(
+      expect.arrayContaining(["sql", "file", "limit", "since", "from", "to", "service"]),
+    );
+    expect(byId.has("supabase-logs-sources")).toBe(true);
+    expect(byId.has("supabase-logs-query")).toBe(false);
+    expect(byId.has("supabase-logs-tail")).toBe(false);
+  });
+
   it("quotes YAML 1.1 boolean-like scalars in the serialized spec", () => {
     const { spec } = builtSpec();
     const yaml = stringifyDocsSpec(spec);
diff --git a/apps/cli/src/output/report-render-text.ts b/apps/cli/src/output/report-render-text.ts
new file mode 100644
index 0000000000..2b57f5f79d
--- /dev/null
+++ b/apps/cli/src/output/report-render-text.ts
@@ -0,0 +1,86 @@
+import { renderGlamourTable } from "./glamour-table.ts";
+import type { Report, ReportBlock, ReportSeverity, ReportStepsBlock } from "./report.types.ts";
+
+/** Renders a `Report` as plain terminal text; severity is a symbol prefix, not ANSI color. */
+export function renderReportText(report: Report): string {
+  const parts = report.blocks.map(renderBlock);
+  return "\n" + parts.join("\n") + "\n";
+}
+
+const SEVERITY_SYMBOL: Record<ReportSeverity, string> = {
+  info: "ℹ",
+  ok: "✓",
+  warn: "⚠",
+  critical: "✗",
+};
+
+const WRAP_WIDTH = 72;
+
+function renderBlock(block: ReportBlock): string {
+  switch (block.kind) {
+    case "keyValue": {
+      const width = Math.max(...block.entries.map((e) => e.key.length));
+      return block.entries.map((e) => `  ${e.key.padEnd(width)} : ${e.value}`).join("\n") + "\n";
+    }
+
+    case "table": {
+      const hasSeverity = block.rows.some((r) => r.severity !== undefined);
+      const headers = hasSeverity
+        ? ["", ...block.columns.map((c) => c.title)]
+        : block.columns.map((c) => c.title);
+      const cells = block.rows.map((r) =>
+        hasSeverity
+          ? [r.severity === undefined ? "" : SEVERITY_SYMBOL[r.severity], ...r.cells]
+          : [...r.cells],
+      );
+      return renderGlamourTable(headers, cells);
+    }
+
+    case "callout":
+      return (
+        wrap(block.text, WRAP_WIDTH)
+          .map((line, i) =>
+            i === 0 ? `  ${SEVERITY_SYMBOL[block.severity]}  ${line}` : `     ${line}`,
+          )
+          .join("\n") + "\n"
+      );
+
+    case "steps":
+      return renderSteps(block);
+  }
+}
+
+function renderSteps(block: ReportStepsBlock): string {
+  const lines: string[] = [];
+  block.steps.forEach((step, i) => {
+    lines.push(`  ${i + 1}. ${step.title}`);
+    if (step.body !== undefined) {
+      for (const line of wrap(step.body, WRAP_WIDTH)) lines.push(`     ${line}`);
+    }
+    if (step.sql !== undefined) {
+      lines.push("");
+      for (const statement of step.sql) lines.push(`       ${statement}`);
+    }
+    lines.push("");
+  });
+  return lines.join("\n");
+}
+
+/** Greedy word wrap; preserves words longer than the width intact. */
+function wrap(text: string, width: number): string[] {
+  const out: string[] = [];
+  for (const paragraph of text.split("\n")) {
+    let line = "";
+    for (const word of paragraph.split(/ +/)) {
+      if (word === "") continue;
+      if (line === "") line = word;
+      else if (line.length + 1 + word.length <= width) line += " " + word;
+      else {
+        out.push(line);
+        line = word;
+      }
+    }
+    out.push(line);
+  }
+  return out;
+}
diff --git a/apps/cli/src/output/report-render-text.unit.test.ts b/apps/cli/src/output/report-render-text.unit.test.ts
new file mode 100644
index 0000000000..4ccc991e6a
--- /dev/null
+++ b/apps/cli/src/output/report-render-text.unit.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, it } from "vitest";
+
+import { renderGlamourTable } from "./glamour-table.ts";
+import { renderReportText } from "./report-render-text.ts";
+
+describe("renderReportText", () => {
+  it("renders aligned pairs, a wrapped callout, a severity table and numbered SQL steps", () => {
+    const out = renderReportText({
+      command: "demo",
+      severity: "warn",
+      blocks: [
+        {
+          kind: "keyValue",
+          entries: [
+            { key: "Database", value: "postgres" },
+            { key: "Affected indexes", value: "2" },
+          ],
+        },
+        {
+          kind: "callout",
+          severity: "warn",
+          text: "These indexes were built under different sorting rules than the system now provides today.",
+        },
+        {
+          kind: "table",
+          columns: [{ title: "Name" }],
+          rows: [{ cells: ["a_key"], severity: "critical" }, { cells: ["b_idx"] }],
+        },
+        {
+          kind: "steps",
+          steps: [
+            { title: "Rebuild", body: "One at a time.", sql: ["REINDEX INDEX a_key;"] },
+            { title: "Refresh" },
+          ],
+        },
+      ],
+    });
+
+    expect(out).toBe(
+      [
+        "",
+        "  Database         : postgres",
+        "  Affected indexes : 2",
+        "",
+        "  ⚠  These indexes were built under different sorting rules than the system",
+        "     now provides today.",
+        "",
+        renderGlamourTable(
+          ["", "Name"],
+          [
+            ["✗", "a_key"],
+            ["", "b_idx"],
+          ],
+        ),
+        "  1. Rebuild",
+        "     One at a time.",
+        "",
+        "       REINDEX INDEX a_key;",
+        "",
+        "  2. Refresh",
+        "",
+        "",
+      ].join("\n"),
+    );
+  });
+});
diff --git a/apps/cli/src/output/report.types.ts b/apps/cli/src/output/report.types.ts
new file mode 100644
index 0000000000..f88b5d0b17
--- /dev/null
+++ b/apps/cli/src/output/report.types.ts
@@ -0,0 +1,49 @@
+/** Structured `inspect` output, rendered as text or emitted as JSON. */
+
+export type ReportSeverity = "info" | "ok" | "warn" | "critical";
+
+/** Aligned label/value pairs, e.g. the environment header of a diagnostic. */
+interface ReportKeyValueBlock {
+  readonly kind: "keyValue";
+  readonly entries: ReadonlyArray<{ readonly key: string; readonly value: string }>;
+}
+
+export interface ReportTableBlock {
+  readonly kind: "table";
+  readonly columns: ReadonlyArray<{ readonly title: string }>;
+  readonly rows: ReadonlyArray<{
+    readonly cells: ReadonlyArray<string>;
+    readonly severity?: ReportSeverity;
+  }>;
+}
+
+/** A short highlighted message: the empty state, a warning, a success line. */
+interface ReportCalloutBlock {
+  readonly kind: "callout";
+  readonly severity: ReportSeverity;
+  readonly text: string;
+}
+
+/** An ordered remediation workflow; each step may carry its own SQL. */
+export interface ReportStepsBlock {
+  readonly kind: "steps";
+  readonly steps: ReadonlyArray<{
+    readonly title: string;
+    readonly body?: string;
+    readonly sql?: ReadonlyArray<string>;
+  }>;
+}
+
+export type ReportBlock =
+  | ReportKeyValueBlock
+  | ReportTableBlock
+  | ReportCalloutBlock
+  | ReportStepsBlock;
+
+export interface Report {
+  /** The producing subcommand, e.g. "collation-drift". */
+  readonly command: string;
+  /** Overall status of what the report found. */
+  readonly severity: ReportSeverity;
+  readonly blocks: ReadonlyArray<ReportBlock>;
+}
diff --git a/apps/cli/src/shared/cli/hidden-flag.unit.test.ts b/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
index d8054c8b4d..287fc05887 100644
--- a/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
+++ b/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
@@ -1,6 +1,6 @@
 import { Cause, Effect, Exit, FileSystem, Layer, Option, Schema, Stdio } from "effect";
 import { legacyProjectStateLayer } from "../config/legacy-project-state.layer.ts";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { CliOutput, Command, type HelpDoc } from "effect/cli";
 import { describe, expect, it } from "@effect/vitest";
 import { branchesCommand } from "../../commands/branches/branches.command.ts";
@@ -51,7 +51,8 @@ const testRootLayer = (formatter: CliOutput.Formatter, args: ReadonlyArray<strin
     out.layer,
     commandTargetLayer.pipe(Layer.provide(out.layer)),
     BunServices.layer,
-    legacyProjectStateLayer.pipe(Layer.provide(BunServices.layer)),
+    BunCrypto.layer,
+    legacyProjectStateLayer.pipe(Layer.provide([BunServices.layer, BunCrypto.layer])),
     mockRuntimeInfo(),
     mockAnalytics().layer,
     mockTelemetryRuntime(),
@@ -172,6 +173,7 @@ describe("native hidden flags", () => {
     );
     const parserLayer = Layer.mergeAll(
       BunServices.layer,
+      BunCrypto.layer,
       CliOutput.layer(silentCliOutputFormatter),
     );
     const runParser = (args: ReadonlyArray<string>) =>
@@ -306,7 +308,7 @@ describe("hidden subcommands", () => {
           expect(error.message).toBe(`supabase ${path.join(" ")} was removed.`);
           expect(error.suggestion).toBe(suggestion);
         }
-      }).pipe(Effect.provide(BunServices.layer)),
+      }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it("does not list the removed inspect db aliases in help", () => {
@@ -344,7 +346,7 @@ describe("hidden subcommands", () => {
       expect(Exit.isFailure(unknownExit)).toBe(true);
       if (!Exit.isFailure(unknownExit)) return;
       expect(Cause.hasFails(unknownExit.cause)).toBe(true);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
 
diff --git a/apps/cli/src/shared/cli/run.e2e.test.ts b/apps/cli/src/shared/cli/run.e2e.test.ts
index 2729952aff..9525e9ea51 100644
--- a/apps/cli/src/shared/cli/run.e2e.test.ts
+++ b/apps/cli/src/shared/cli/run.e2e.test.ts
@@ -132,12 +132,12 @@ describe("CLI upgrade notice (#5853)", () => {
 });
 
 /** Only a real pipe whose reader has exited reproduces the broken-pipe write. */
-describe("CLI output to a closed stdout", () => {
+describe("CLI output to a closed pipe", () => {
   it.live.each(["text", "json"])("ends quietly with exit 0 in %s output", (format) =>
     Effect.gen(function* () {
       const { exitCode, stderr, timedOutAfterMs } = yield* runSupabaseEffect(
         ["gen", "signing-key", "--algorithm", "ES256", "--output-format", format],
-        { closeStdout: true },
+        { closeStream: "stdout" },
       );
       expect(timedOutAfterMs).toBeUndefined();
       expect(exitCode).toBe(0);
@@ -155,7 +155,7 @@ describe("CLI output to a closed stdout", () => {
   ])("keeps exit 1 for $name whose JSON error cannot be written", ({ args }) =>
     Effect.gen(function* () {
       const { exitCode, stderr, timedOutAfterMs } = yield* runSupabaseEffect(args, {
-        closeStdout: true,
+        closeStream: "stdout",
         env: { SUPABASE_ACCESS_TOKEN: undefined },
       });
       expect(timedOutAfterMs).toBeUndefined();
@@ -163,4 +163,16 @@ describe("CLI output to a closed stdout", () => {
       expect(stderr).not.toContain("StdoutClosedError");
     }),
   );
+
+  it.live("finishes with exit 0 once a direct `--debug` write met a closed stderr", () =>
+    Effect.gen(function* () {
+      const { exitCode, stdout, timedOutAfterMs } = yield* runSupabaseEffect(
+        ["--debug", "gen", "signing-key", "--algorithm", "ES256"],
+        { closeStream: "stderr" },
+      );
+      expect(timedOutAfterMs).toBeUndefined();
+      expect(exitCode).toBe(0);
+      expect(stdout).toContain('"alg":"ES256"');
+    }),
+  );
 });
diff --git a/apps/cli/src/shared/cli/run.integration.test.ts b/apps/cli/src/shared/cli/run.integration.test.ts
index d85153968c..e934d24cca 100644
--- a/apps/cli/src/shared/cli/run.integration.test.ts
+++ b/apps/cli/src/shared/cli/run.integration.test.ts
@@ -1,8 +1,9 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Console, Effect, Exit, Layer, Stdio } from "effect";
+import { Cause, Console, Effect, Exit, Layer, Schema, Stdio } from "effect";
 import { Argument, CliOutput, Command, Flag } from "effect/cli";
 import { branchesCommand } from "../../commands/branches/branches.command.ts";
 import { GLOBAL_FLAGS, OutputFormatFlag } from "../../command-internal/global-flags.ts";
+import { jsonCliOutputFormatter } from "../output/json-formatter.ts";
 import { textCliOutputFormatter } from "../output/text-formatter.ts";
 import { useTempWorkdir, withEnvVar } from "../../../tests/helpers/command-mocks.ts";
 import { emptyEnv, fakeConsole, mockAnalytics, mockOutput } from "../../../tests/helpers/mocks.ts";
@@ -208,6 +209,24 @@ describe("withoutParseErrorHelpDump (CLI-1901)", () => {
       }),
   );
 
+  it.effect("an invalid global flag value fails without any help dump", () =>
+    Effect.gen(function* () {
+      const { console, calls } = fakeConsole();
+      const exit = yield* runBranches(["--output-format", "xml"], console).pipe(Effect.exit);
+
+      expect(calls).toEqual([]);
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (!Exit.isFailure(exit)) return;
+      expect(exitCodeForFailure(exit.cause)).toBe(1);
+      expect(Cause.hasDies(exit.cause)).toBe(false);
+      expect(Cause.squash(exit.cause)).toMatchObject({
+        _tag: "InvalidValue",
+        option: "output-format",
+        value: "xml",
+      });
+    }),
+  );
+
   it.effect(
     "`--help` on a command with a required flag still prints the full help doc to stdout and exits 0 (untouched)",
     () =>
@@ -241,6 +260,45 @@ describe("withoutParseErrorHelpDump (CLI-1901)", () => {
   );
 });
 
+describe("subcommand help doc", () => {
+  it.effect("lists a parent's shared flags among the subcommand's own flags in JSON help", () =>
+    Effect.gen(function* () {
+      const generate = Command.make("generate", { force: Flag.Boolean("force") });
+      const declarative = Command.make("declarative").pipe(
+        Command.withSharedFlags({ noCache: Flag.Boolean("no-cache") }),
+        Command.withSubcommands([generate]),
+      );
+      const root = Command.make("supabase").pipe(Command.withSubcommands([declarative]));
+      const args = ["declarative", "generate", "--help"];
+      const { console, calls } = fakeConsole();
+
+      yield* Command.runWith(root, { version: "0.0.0-test" })(args).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            CliOutput.layer(jsonCliOutputFormatter()),
+            Layer.succeed(CliArgs, { args }),
+            Layer.succeed(Console.Console, console),
+            textOutputLayer(),
+            emptyEnv(),
+          ),
+        ),
+      );
+
+      expect(calls).toHaveLength(1);
+      const { doc } = yield* Schema.decodeUnknownEffect(
+        Schema.fromJsonString(Schema.Struct({ doc: Schema.Record(Schema.String, Schema.Unknown) })),
+      )(calls[0]?.replace(/^log:/, ""));
+      expect(doc["flags"]).toEqual([
+        expect.objectContaining({ name: "no-cache" }),
+        expect.objectContaining({ name: "force" }),
+      ]);
+      expect(Object.keys(doc)).not.toContain("inheritedFlags");
+      expect(Object.keys(doc)).not.toContain("globalFlagsScope");
+      expect(Object.keys(doc)).not.toContain("commandPath");
+    }),
+  );
+});
+
 describe("nested command parsing", () => {
   it.effect("forwards operands after -- to a nested variadic argument", () =>
     Effect.gen(function* () {
diff --git a/apps/cli/src/shared/cli/run.ts b/apps/cli/src/shared/cli/run.ts
index ec4bbada00..b7f61b0fea 100644
--- a/apps/cli/src/shared/cli/run.ts
+++ b/apps/cli/src/shared/cli/run.ts
@@ -1,10 +1,9 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { CliConfigStore } from "@supabase/config/effect";
 import {
   Cause,
   Config,
   Console,
-  Crypto,
   Effect,
   Exit,
   FileSystem,
@@ -17,6 +16,7 @@ import {
   Scope,
   Stdio,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { CliError, CliOutput, Command } from "effect/cli";
 import { HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
@@ -95,7 +95,8 @@ export type AllowedRunCliServices =
   | CliSettings
   | CommandRuntime
   | FileSystem.FileSystem
-  | Crypto.Crypto
+  | SecureRandom.SecureRandom
+  | Digest.Digest
   | LegacyProjectState
   | Path.Path
   | ProcessControl
@@ -614,7 +615,7 @@ export interface RunCliOptions<BeforeParseError = never> {
   readonly analyticsLayer: Layer.Layer<
     Analytics,
     Config.ConfigError | PlatformError.PlatformError,
-    CliSettings | Crypto.Crypto | FileSystem.FileSystem | Path.Path | RuntimeInfo | Tty
+    CliSettings | SecureRandom.SecureRandom | FileSystem.FileSystem | Path.Path | RuntimeInfo | Tty
   >;
   /**
    * Runs just before the process exits on any invocation that exits 0 — the seam for the CLI's
@@ -676,7 +677,9 @@ export function cliProgramFor<
     Layer.provideMerge(runtimeLayer),
     Layer.provideMerge(fallbackCommandLayer),
     Layer.provideMerge(cliArgsLayer(cliArgs)),
-    Layer.provideMerge(BunServices.layer),
+    Layer.provideMerge(
+      Layer.mergeAll(BunServices.layer, BunCrypto.layerSecureRandom, BunCrypto.layerDigest),
+    ),
   );
   return withoutParseErrorHelpDump(
     commandProgram.pipe(
@@ -777,6 +780,7 @@ export const runCli = Effect.fnUntraced(function* <
   const handledProgramLayer = processControlLayer.pipe(
     Layer.provideMerge(runtimeInfoLayer),
     Layer.provideMerge(BunServices.layer),
+    Layer.provideMerge(BunCrypto.layerSecureRandom),
     Layer.provideMerge(cliConfigProviderLayer),
   );
 
diff --git a/apps/cli/src/shared/cli/value-consuming-flags.ts b/apps/cli/src/shared/cli/value-consuming-flags.ts
index d081c837fc..98524174dc 100644
--- a/apps/cli/src/shared/cli/value-consuming-flags.ts
+++ b/apps/cli/src/shared/cli/value-consuming-flags.ts
@@ -52,6 +52,7 @@ export const VALUE_CONSUMING_LONG_FLAGS = new Set([
   "kind",
   "lang",
   "last",
+  "limit",
   "metadata-file",
   "metadata-url",
   "name",
@@ -69,10 +70,13 @@ export const VALUE_CONSUMING_LONG_FLAGS = new Set([
   "release-channel",
   "remote-label",
   "remove-domains",
+  "resource",
   "role",
   "runtime",
+  "search",
   "size",
   "source",
+  "sql",
   "status",
   "sub",
   ...GEN_TYPES_LANGUAGE_VALUE_FLAG_NAMES,
diff --git a/apps/cli/src/shared/compute/compute-config.ts b/apps/cli/src/shared/compute/compute-config.ts
index da5f16f3a2..6924127004 100644
--- a/apps/cli/src/shared/compute/compute-config.ts
+++ b/apps/cli/src/shared/compute/compute-config.ts
@@ -1,5 +1,9 @@
 import { Data, Effect, FileSystem, Path } from "effect";
-import * as SmolToml from "smol-toml";
+import {
+  applyConfigEdits,
+  cliConfigFormatForPath,
+  parseCliConfigDocument,
+} from "@supabase/config/internal";
 import {
   actionability,
   type CliErrorActionabilityDeclaration,
@@ -13,12 +17,13 @@ import {
 } from "./toml-section.ts";
 
 /**
- * The `[compute]` section of `supabase/config.toml`, read through the decoded
+ * The `[compute]` section of the project config, read through the decoded
  * project config and written back surgically.
  *
  * `[compute]` carries one `[compute.<name>]` table per compute. The schema in
- * `@supabase/config` models exactly that; writing goes through
- * `./toml-section.ts` so a user's comments and formatting survive.
+ * `@supabase/config` models exactly that; TOML writes go through
+ * `./toml-section.ts` and JSON/JSONC writes through `applyConfigEdits`, so a
+ * user's comments and formatting survive.
  */
 
 /** One compute's recorded metadata. Every key is optional. */
@@ -37,7 +42,7 @@ export interface ComputeSection {
 }
 
 /**
- * The compute is already recorded in `config.toml`. `compute new` creates a compute; changing
+ * The compute is already recorded in the project config. `compute new` creates a compute; changing
  * one that exists is a different operation, and the file is the user's to edit. Refusing also
  * keeps writes append-only, avoiding the need to find and rewrite an entry in place.
  */
@@ -53,7 +58,7 @@ export class ComputeAlreadyConfiguredError extends Data.TaggedError(
 }
 
 /**
- * Appending the new table would leave `config.toml` unparseable — e.g. a `[compute]` that's
+ * Appending the new table would leave the config unparseable — e.g. a `[compute]` that's
  * already an inline table (`compute = {}`) can't be extended, so appending `[compute.api]`
  * produces a file nothing can read. Rather than enumerate every representation that breaks,
  * the plan is parsed before it's returned and anything that doesn't round-trip is refused,
@@ -145,14 +150,14 @@ export function readComputeSection(compute: unknown): ComputeSection {
   return { compute: entries };
 }
 
-/** A rendered `config.toml`, not yet written. */
+/** A rendered project config, not yet written. */
 export interface ComputeEntryWrite {
   readonly configPath: string;
   readonly text: string;
 }
 
 /**
- * Renders `config.toml` with `[compute.<name>]` appended, without writing it. Split from the
+ * Renders the project config with the compute entry added, without writing it. Split from the
  * write so callers can find out an entry already exists before they scaffold anything: `new`
  * writes the starter files first, and a failure after that would leave a directory nothing
  * records.
@@ -160,12 +165,14 @@ export interface ComputeEntryWrite {
 export const planComputeEntry = Effect.fn("Compute.planConfigEntry")(function* (options: {
   readonly configPath: string;
   readonly name: string;
-  /** Rendered as written: strings are quoted, numbers are not, lists become TOML arrays. */
+  /** Rendered as written: strings are quoted, numbers are not, lists become arrays. */
   readonly patch: Readonly<Record<string, TomlSectionValue>>;
   /** The already-parsed config — the authority on whether an entry exists. */
   readonly existingCompute: Readonly<Record<string, ComputeEntry>>;
 }) {
   const fs = yield* FileSystem.FileSystem;
+  const format = cliConfigFormatForPath(options.configPath);
+  const entryRef = format === "toml" ? `[compute.${options.name}]` : `compute.${options.name}`;
 
   // Append-only, so an entry that already exists cannot be amended. The decoded config is
   // the authority on whether one exists — regex over the file text can't answer that
@@ -173,7 +180,7 @@ export const planComputeEntry = Effect.fn("Compute.planConfigEntry")(function* (
   if (options.existingCompute[options.name] !== undefined) {
     return yield* new ComputeAlreadyConfiguredError({
       detail: `"${options.name}" is already configured in ${options.configPath}.`,
-      suggestion: `Edit [compute.${options.name}] in ${options.configPath} yourself, or pick a different compute name.`,
+      suggestion: `Edit ${entryRef} in ${options.configPath} yourself, or pick a different compute name.`,
     });
   }
 
@@ -186,37 +193,48 @@ export const planComputeEntry = Effect.fn("Compute.planConfigEntry")(function* (
   if (unrenderable !== undefined) {
     return yield* new ComputeConfigWriteUnsafeError({
       detail: `Recording "${options.name}" would write ${unrenderable[0]} = ${String(unrenderable[1])} to ${options.configPath}, which is not a whole, non-negative count.`,
-      suggestion: `Pass a whole number of zero or more, or add [compute.${options.name}] to ${options.configPath} yourself.`,
+      suggestion: `Pass a whole number of zero or more, or add ${entryRef} to ${options.configPath} yourself.`,
     });
   }
 
   const exists = yield* fs.exists(options.configPath);
   const text = exists ? yield* fs.readFileString(options.configPath) : "";
-  const header = `compute.${tomlKey(options.name)}`;
-  const next = appendTomlSection(text, header, options.patch);
+  let next: string;
+  if (format === "toml") {
+    next = appendTomlSection(text, `compute.${tomlKey(options.name)}`, options.patch);
+  } else {
+    const outcome = applyConfigEdits(text, format, [
+      { path: ["compute", options.name], value: options.patch },
+    ]);
+    if (outcome.kind === "refused") {
+      return yield* new ComputeConfigWriteUnsafeError({
+        detail: `Recording "${options.name}" in ${options.configPath} was refused: ${outcome.refusal.detail}`,
+        suggestion: `Add ${entryRef} to ${options.configPath} yourself.`,
+      });
+    }
+    next = outcome.text;
+  }
 
-  // The rendered file has to parse and the new table has to be readable back out of it —
-  // appending is a syntactic operation on a file this code didn't write, so reading the
+  // The rendered file has to parse and the new entry has to be readable back out of it —
+  // editing is a syntactic operation on a file this code didn't write, so reading the
   // result back is the only honest check.
   const parsed = yield* Effect.try({
-    try: () => SmolToml.parse(next),
+    try: () => parseCliConfigDocument(next, format),
     catch: (cause) =>
       new ComputeConfigWriteUnsafeError({
         detail: `Recording "${options.name}" would make ${options.configPath} unparseable: ${String(cause)}.`,
-        suggestion: `Add [compute.${options.name}] to ${options.configPath} yourself.`,
+        suggestion: `Add ${entryRef} to ${options.configPath} yourself.`,
       }),
   });
 
-  const compute = parsed["compute"];
-  if (
-    typeof compute !== "object" ||
-    compute === null ||
-    Array.isArray(compute) ||
-    !(options.name in compute)
-  ) {
+  const compute = isRecord(parsed) ? parsed["compute"] : undefined;
+  if (!isRecord(compute) || !(options.name in compute)) {
     return yield* new ComputeConfigWriteUnsafeError({
-      detail: `Recording "${options.name}" in ${options.configPath} would not take effect, because its [compute] section cannot be extended by appending a table.`,
-      suggestion: `Add [compute.${options.name}] to ${options.configPath} yourself.`,
+      detail:
+        format === "toml"
+          ? `Recording "${options.name}" in ${options.configPath} would not take effect, because its [compute] section cannot be extended by appending a table.`
+          : `Recording "${options.name}" in ${options.configPath} would not take effect, because its compute section cannot hold the new entry.`,
+      suggestion: `Add ${entryRef} to ${options.configPath} yourself.`,
     });
   }
 
diff --git a/apps/cli/src/shared/compute/compute-logs-api.ts b/apps/cli/src/shared/compute/compute-logs-api.ts
index 12190965c3..58f94bd2a4 100644
--- a/apps/cli/src/shared/compute/compute-logs-api.ts
+++ b/apps/cli/src/shared/compute/compute-logs-api.ts
@@ -1,4 +1,5 @@
-import { operationDefinitions, type ApiClient } from "@supabase/api/effect";
+import { requestLogs } from "../logs/request.ts";
+import { type ApiClient } from "@supabase/api/effect";
 import { Effect, Option, Predicate, Schema } from "effect";
 import {
   bodyText,
@@ -20,54 +21,18 @@ import {
 } from "./compute.errors.ts";
 import { computeLogsQuery } from "./compute-logs.sql.ts";
 
-/**
- * Reading a compute's logs, over the project's unified logs stream:
- * `GET /v1/projects/{ref}/analytics/endpoints/logs`.
- *
- * Not `/v2/projects/{ref}/compute/...` like the rest of the family — there is no
- * compute-scoped log route — so this is the one Compute seam that talks to the
- * analytics API, and the one that has to reckon with its two quirks: the query is
- * SQL this CLI writes, and a failed query can arrive as **HTTP 200 with an
- * `error` field**.
- */
-
-/** One log line, flattened out of the untyped `result` array. */
 export interface ComputeLogEntry {
-  /** Logflare-minted. The dedupe key for an overlapping-window poll. */
   readonly id: string;
-  /** Epoch milliseconds. Order on this — guest lines arrive out of order. */
+
   readonly timestampMs: number;
-  /**
-   * Display text only, never a parse target. On the guest stream it is
-   * tenant-controlled bytes and must be escaped before it reaches a terminal.
-   */
+
   readonly message: string;
-  /** `worker_guest_logs` | `worker_ingress_logs` | `worker_api_logs`, or newer. */
+
   readonly stream: string;
-  /**
-   * `log_attributes`, which is a `Map(String, String)` — so `status` arrives as
-   * `"200"` and `duration_ms` as `"23"`. Coerce before comparing.
-   */
+
   readonly attributes: Readonly<Record<string, string>>;
 }
 
-/**
- * The row shape the projection in `computeLogsQuery` produces.
- *
- * `stream` stays a plain string and `log_attributes` an open record because the
- * log contract is additive-only: a new stream or a new attribute must render,
- * not fail the whole read. A closed `Schema.Literal` union here would break the
- * command the next time a stream is added.
- */
-/**
- * The widest instant a JavaScript `Date` can hold, either side of the epoch.
- *
- * `ts_ms` feeds `DateTime.formatIso(...)` when a payload is built, which is
- * unconditional — text runs format it too. Outside this range that call throws
- * `RangeError`, turning a recoverable bad row into a defect, so the bound belongs
- * on the schema where it fails through `decodeBody` as an unreadable response
- * instead.
- */
 const MAX_DATE_MS = 8_640_000_000_000_000;
 
 const ComputeLogRow = Schema.Struct({
@@ -83,29 +48,15 @@ const ComputeLogRow = Schema.Struct({
   log_attributes: Schema.Record(Schema.String, Schema.String),
 });
 
-/** The endpoint's structured error shape, when it is not a bare string. */
 const StructuredLogError = Schema.Struct({
   message: Schema.String,
 });
 
-/**
- * The response envelope, declared here rather than reusing the generated
- * `V1GetProjectLogsOutput`: that schema forbids `null` on either field, while the endpoint
- * always sends one of them as an explicit `null` (`getAnalyticsResponse` normalizes the
- * unused half), so decoding a real response against it always fails. `error` stays `Unknown`
- * so both the string and structured forms are accepted and narrowed at the point of use.
- */
 const LogsResponse = Schema.Struct({
   result: Schema.optionalKey(Schema.NullOr(Schema.Array(Schema.Unknown))),
   error: Schema.optionalKey(Schema.NullOr(Schema.Unknown)),
 });
 
-/**
- * Renders the endpoint's `error` field, which is `string | {code, errors[], message, status}`.
- *
- * Narrowed through the schema rather than a `typeof` chain so the structured
- * shape is checked rather than assumed.
- */
 const describeLogError = Effect.fnUntraced(function* (error: unknown) {
   if (Predicate.isString(error)) {
     return error;
@@ -126,7 +77,7 @@ export const fetchComputeLogs = Effect.fnUntraced(function* (
     readonly name: string;
     readonly streams: ReadonlyArray<string>;
     readonly tail: number;
-    /** Both bounds, always — see `logWindow`. */
+
     readonly window: { readonly start: string; readonly end: string };
   },
 ) {
@@ -137,32 +88,23 @@ export const fetchComputeLogs = Effect.fnUntraced(function* (
     tail: options.tail,
   });
 
-  const response = yield* api
-    .executeRaw(operationDefinitions.v1GetProjectLogs, {
-      ref: projectRef,
-      sql,
-      iso_timestamp_start: options.window.start,
-      iso_timestamp_end: options.window.end,
-    })
-    .pipe(Effect.mapError(mapRequestError(operation)));
-
+  const response = yield* requestLogs(api, projectRef, sql, options.window).pipe(
+    Effect.mapError(mapRequestError(operation)),
+  );
   if (response.status === 402) {
     return yield* new ComputeLogsUsageExceededError({
       detail: `The log query allowance for project ${projectRef} is exhausted.`,
       suggestion: "Enable additional usage for this project in the dashboard, then retry.",
     });
   }
-  // The analytics endpoints allow 10 requests per 60 seconds, which is well
-  // inside what a tight `--follow` poll would spend.
+
   if (response.status === 429) {
     return yield* new ComputeLogsRateLimitedError({
       detail: "The logs API is rate limiting this project (10 requests per minute).",
       suggestion: "Wait a minute before retrying, and avoid running several tails at once.",
     });
   }
-  // Unlike the compute routes this one is not gated on the alpha's allow-list,
-  // so its 404 is about the project or the route, and only an unrecognized body
-  // is left to read as the family's usual refusal.
+
   if (response.status === 404) {
     const parsed = yield* parse404(yield* bodyText(response));
     const route = unroutedPath(parsed);
@@ -182,15 +124,11 @@ export const fetchComputeLogs = Effect.fnUntraced(function* (
     });
   }
   if (response.status !== 200) {
-    // A rejected query or the server's 30-second timeout lands here rather than
-    // in the 200-with-`error` branch below, so both paths have to exist.
     return yield* unexpectedStatus(operation, response);
   }
 
   const decoded = yield* decodeJsonBody(LogsResponse, operation, response);
 
-  // Checked before `result`: this endpoint reports a failed query with a 200 and
-  // a populated `error`, so reading `result` first reports success on a failure.
   if (decoded.error !== undefined && decoded.error !== null) {
     const described = yield* describeLogError(decoded.error);
     return yield* new ComputeLogsQueryFailedError({
@@ -199,8 +137,6 @@ export const fetchComputeLogs = Effect.fnUntraced(function* (
     });
   }
 
-  // `result` is optional in the contract, so absent, null and [] all mean "no
-  // rows" and must not be told apart.
   const rows = decoded.result ?? [];
   const entries: Array<ComputeLogEntry> = [];
   for (const row of rows) {
@@ -214,8 +150,5 @@ export const fetchComputeLogs = Effect.fnUntraced(function* (
     });
   }
 
-  // The query orders `desc` to make `limit` mean "the most recent N", but sorting here rather
-  // than trusting that order: guest lines are ingested late and out of order, and once
-  // `--follow` merges overlapping windows the server's order stops being meaningful at all.
   return entries.sort((left, right) => left.timestampMs - right.timestampMs);
 });
diff --git a/apps/cli/src/shared/compute/compute-logs.sql.ts b/apps/cli/src/shared/compute/compute-logs.sql.ts
index 507423c216..c4895f06f2 100644
--- a/apps/cli/src/shared/compute/compute-logs.sql.ts
+++ b/apps/cli/src/shared/compute/compute-logs.sql.ts
@@ -1,19 +1,5 @@
 import { DateTime } from "effect";
 
-/**
- * The ClickHouse query `supabase compute logs` sends, and the two
- * literals it turns on.
- *
- * Pure — no Effect, no services — so the query text and the window arithmetic are
- * unit-testable without a stubbed API, and so the literals have exactly one home
- * if the log pipeline ever renames a stream.
- */
-
-/**
- * The three streams that share the Compute Logflare source, keyed by the word the `--kind`
- * flag exposes (`worker_guest_logs` is internal; `app` is what a user means). Lives here
- * rather than in the command so the flag and the query cannot drift apart.
- */
 export const COMPUTE_LOG_STREAMS = {
   app: "worker_guest_logs",
   requests: "worker_ingress_logs",
@@ -22,72 +8,24 @@ export const COMPUTE_LOG_STREAMS = {
 
 export type ComputeLogKindChoice = keyof typeof COMPUTE_LOG_STREAMS;
 
-/**
- * The `--kind` words, in the order help lists them. Checked against {@link COMPUTE_LOG_STREAMS}
- * so the flag can't offer a word the query has no stream for — without that link, an added
- * choice would index the map as `undefined` and reach the SQL as an empty stream name.
- */
 export const COMPUTE_LOG_KINDS = [
   "app",
   "requests",
   "builds",
 ] as const satisfies ReadonlyArray<ComputeLogKindChoice>;
 
-/** Every stream, for an invocation that named none. */
 export const ALL_COMPUTE_LOG_STREAMS: ReadonlyArray<string> = Object.values(COMPUTE_LOG_STREAMS);
 
-/**
- * Which `log_attributes` key carries the worker name.
- *
- * The Logflare writer stamps `metadata.worker`, and the whole metadata map lands
- * in `log_attributes` on the ClickHouse side.
- */
 const COMPUTE_LOG_NAME_ATTRIBUTE = "worker";
 
-/**
- * Which `log_attributes` key carries the stream name.
- *
- * The writer publishes `subservice` at the top level, beside `project`, but that does not
- * make it a column here: the Compute Logflare source is not enrolled as a category in the
- * generic logs path, so nothing it sends is promoted, and every key — top-level ones
- * included — arrives flattened into `log_attributes`. Filtering on a bare `subservice`
- * fails the whole query with `Field "subservice" does not exist`.
- */
 const COMPUTE_LOG_STREAM_ATTRIBUTE = "subservice";
 
-/**
- * The server clamps a span of more than 24 hours, so the default window sits just under the
- * boundary. Being clamped is worse than being rejected: the server rewrites `end` to
- * `start + 24h`, so an over-wide request silently returns an older slice than the one asked for.
- */
 export const COMPUTE_LOG_WINDOW_MINUTES = 23 * 60 + 59;
 
-/**
- * How often `--follow` re-queries — set by the rate limit, not by responsiveness. The v1
- * analytics endpoints allow 10 requests per 60 seconds, so a two-second poll would 429 within
- * the first ten seconds; ten seconds leaves room for the initial history query, the
- * deployed-compute check, and a retry inside the same window.
- */
 export const COMPUTE_LOG_POLL_SECONDS = 10;
 
-/**
- * How far behind the newest line seen the next window starts. Guest lines are relayed
- * CloudWatch -> subscription filter -> Lambda -> Logflare and arrive late and out of order, so
- * a cursor sitting exactly on the newest timestamp would drop every straggler permanently —
- * the window re-asks for ground already covered, and `id` dedupe absorbs the overlap. Wider
- * than one poll interval, so a line delayed a full cycle still lands inside the next window.
- */
 const COMPUTE_LOG_CURSOR_GRACE_SECONDS = 60;
 
-/**
- * A closed window ending at `now`, with UTC ISO timestamps ending in `Z` as
- * required by the logs API.
- *
- * Both bounds, always. Sending only a start yields a **one-minute** window
- * server-side (the lone bound is minute-rounded and the other derived from it),
- * and sending neither is an outright error — so there is no valid single-bound
- * call to make.
- */
 export function logWindow(now: DateTime.Utc): { readonly start: string; readonly end: string } {
   return {
     start: DateTime.formatIso(
@@ -97,13 +35,6 @@ export function logWindow(now: DateTime.Utc): { readonly start: string; readonly
   };
 }
 
-/**
- * The window for one `--follow` poll: from just before the newest line seen, up to now.
- * Clamped to the same sub-24h span as {@link logWindow} — a tail left running past a laptop
- * suspend would otherwise resume with a wider span, and the server answers that by rewriting
- * `end` to `start + 24h`, returning an older slice rather than a truncated one, so a resumed
- * tail would silently start replaying yesterday.
- */
 export function followWindow(
   now: DateTime.Utc,
   newestSeen: DateTime.Utc,
@@ -122,25 +53,10 @@ export function followWindow(
   };
 }
 
-/**
- * Single-quoted SQL string literal.
- *
- * Every value this module interpolates is either an internal constant or a name
- * `validateComputeName` has already reduced to a DNS label, so this is a
- * backstop rather than the guard. It exists so the guarantee does not rest on a
- * caller remembering to validate first.
- */
 function quote(value: string): string {
   return `'${value.replaceAll("'", "''")}'`;
 }
 
-/**
- * The logs query for one compute. Two things about the projection are load-bearing: the
- * `in (...)` list is a tenancy guard, not a convenience — compute rows carry an empty
- * top-level `source`, so the stream list is the only thing keeping a non-compute row with a
- * `worker` attribute out of the result; and `toUnixTimestamp64Milli` rather than a formatter,
- * since ClickHouse's `%M` is the month name and bare `toString(timestamp)` has no zone.
- */
 export function computeLogsQuery(options: {
   readonly name: string;
   readonly streams: ReadonlyArray<string>;
diff --git a/apps/cli/src/shared/compute/compute-logs.sql.unit.test.ts b/apps/cli/src/shared/compute/compute-logs.sql.unit.test.ts
index b8eb2f9a7d..823524263f 100644
--- a/apps/cli/src/shared/compute/compute-logs.sql.unit.test.ts
+++ b/apps/cli/src/shared/compute/compute-logs.sql.unit.test.ts
@@ -19,7 +19,7 @@ describe("computeLogsQuery", () => {
     expect(sql).toContain("log_attributes['subservice'] as stream");
     expect(sql).toContain("and log_attributes['subservice'] in (");
     expect(sql).not.toContain("log_attributes['source']");
-    // A bare `subservice` is not a column on an unenrolled source; it fails the query.
+
     expect(sql).not.toMatch(/(?<!\[')subservice/);
     expect(sql).not.toMatch(/(?:^|\s)where source =/);
     expect(sql).not.toMatch(/(?:^|\s)and source =/);
diff --git a/apps/cli/src/shared/compute/compute-paths.ts b/apps/cli/src/shared/compute/compute-paths.ts
index b07d498c95..081360c9a8 100644
--- a/apps/cli/src/shared/compute/compute-paths.ts
+++ b/apps/cli/src/shared/compute/compute-paths.ts
@@ -24,7 +24,7 @@ const RESERVED_SUPABASE_DIRS = ["functions", "migrations", LEGACY_PROJECT_STATE_
  * directories above, which do not cover them — `supabase/config.toml` sits
  * outside every reserved subdirectory.
  */
-const RESERVED_SUPABASE_FILES = ["config.toml", "config.json"];
+const RESERVED_SUPABASE_FILES = ["config.toml", "config.json", "config.jsonc"];
 
 /** `supabase/compute/` — where compute live, resolved against the project. */
 export function computeRootDir(path: Path.Path, projectRoot: string): string {
diff --git a/apps/cli/src/shared/compute/compute-paths.unit.test.ts b/apps/cli/src/shared/compute/compute-paths.unit.test.ts
index 20c13c1e3b..763549e813 100644
--- a/apps/cli/src/shared/compute/compute-paths.unit.test.ts
+++ b/apps/cli/src/shared/compute/compute-paths.unit.test.ts
@@ -134,6 +134,7 @@ describe("resolveComputeSource", () => {
     // destination, and the project's config file is not that.
     { raw: "supabase/config.toml", reason: "supabase/config.toml" },
     { raw: "supabase/config.json", reason: "supabase/config.json" },
+    { raw: "supabase/config.jsonc", reason: "supabase/config.jsonc" },
   ])("refuses $raw", ({ raw, reason }) =>
     Effect.gen(function* () {
       const error = yield* Effect.flip(
diff --git a/apps/cli/src/shared/compute/compute.errors.ts b/apps/cli/src/shared/compute/compute.errors.ts
index 80d2bf0a9a..c47fa65215 100644
--- a/apps/cli/src/shared/compute/compute.errors.ts
+++ b/apps/cli/src/shared/compute/compute.errors.ts
@@ -132,18 +132,6 @@ export class ComputeDirectoryExistsError extends Data.TaggedError("ComputeDirect
   }
 }
 
-/** A compute scaffold cannot safely edit a JSON-authoritative project config. */
-export class ComputeJsonConfigUnsupportedError extends Data.TaggedError(
-  "ComputeJsonConfigUnsupportedError",
-)<{
-  readonly detail: string;
-  readonly suggestion: string;
-}> {
-  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
-    return actionability.invalidConfig;
-  }
-}
-
 export class ComputeSourceMissingError extends Data.TaggedError("ComputeSourceMissingError")<{
   readonly detail: string;
   readonly suggestion: string;
@@ -279,14 +267,6 @@ export class ComputeApiUnexpectedStatusError extends Data.TaggedError(
   }
 }
 
-/**
- * The logs query itself failed. The analytics endpoint can answer HTTP 200 with a populated
- * `error` field, so this isn't reachable from a status code alone; it also covers the server's
- * 30-second query timeout, which arrives as a non-2xx. Kept apart from {@link
- * ComputeApiUnexpectedStatusError} because the SQL here is the CLI's own, not user input — its
- * own fingerprint keeps a broken projection or filter visible instead of blending into transport
- * noise.
- */
 export class ComputeLogsQueryFailedError extends Data.TaggedError("ComputeLogsQueryFailedError")<{
   readonly detail: string;
   readonly suggestion: string;
@@ -296,7 +276,6 @@ export class ComputeLogsQueryFailedError extends Data.TaggedError("ComputeLogsQu
   }
 }
 
-/** The project has exhausted its log query allowance (402). */
 export class ComputeLogsUsageExceededError extends Data.TaggedError(
   "ComputeLogsUsageExceededError",
 )<{
@@ -308,11 +287,6 @@ export class ComputeLogsUsageExceededError extends Data.TaggedError(
   }
 }
 
-/**
- * The analytics endpoints allow 10 requests per 60 seconds, which `--follow` polls against — so
- * 429 is an ordinary outcome here, not an edge case. Its own error lets the suggestion name the
- * poll interval as the thing to slow down.
- */
 export class ComputeLogsRateLimitedError extends Data.TaggedError("ComputeLogsRateLimitedError")<{
   readonly detail: string;
   readonly suggestion: string;
diff --git a/apps/cli/src/shared/config/experimental-feature.ts b/apps/cli/src/shared/config/experimental-feature.ts
index 33e26c408e..5d0d9c14c4 100644
--- a/apps/cli/src/shared/config/experimental-feature.ts
+++ b/apps/cli/src/shared/config/experimental-feature.ts
@@ -1,6 +1,6 @@
 import { CliConfigSchema, findCliProjectPaths } from "@supabase/config/effect";
+import { cliConfigFormatForPath, parseCliConfigDocument } from "@supabase/config/internal";
 import { Config, Data, Effect, FileSystem, Option, Path, Result, Schema } from "effect";
-import * as SmolToml from "smol-toml";
 import { pickCliConfigKey } from "../../config/cli-config-key.ts";
 import { CliConfigKeys } from "../../config/cli-config-keys.ts";
 import { resolveWorkdir } from "../../config/command-settings.layer.ts";
@@ -36,8 +36,6 @@ const firstExplicitLongFlagValue = (
   return undefined;
 };
 
-const UnknownFromJsonString = Schema.fromJsonString(Schema.Unknown);
-
 const readEnv = (name: string) =>
   Config.option(Config.String(name)).pipe(
     Effect.orElseSucceed(() => Option.none<string>()),
@@ -63,9 +61,9 @@ export const readExperimentalFeatureConfig = (input: {
     const project = yield* findCliProjectPaths(resolvedWorkdir.workdir, { search: false });
     if (project === null) return undefined;
     const content = yield* fs.readFileString(project.configPath);
-    const document = project.configPath.endsWith(".json")
-      ? yield* Schema.decodeEffect(UnknownFromJsonString)(content)
-      : yield* Effect.try(() => SmolToml.parse(content));
+    const document = yield* Effect.try(() =>
+      parseCliConfigDocument(content, cliConfigFormatForPath(project.configPath)),
+    );
     const schema = Schema.Struct({
       experimental: Schema.optionalKey(
         Schema.Struct({ [input.feature]: featureSchemas[input.feature] }),
diff --git a/apps/cli/src/shared/config/project-config-api-drift.unit.test.ts b/apps/cli/src/shared/config/project-config-api-drift.unit.test.ts
index 2b4c6f7e39..daa6fc9075 100644
--- a/apps/cli/src/shared/config/project-config-api-drift.unit.test.ts
+++ b/apps/cli/src/shared/config/project-config-api-drift.unit.test.ts
@@ -172,6 +172,8 @@ describe("project-config API type drift guard", () => {
             max_rows: 500,
             db_pool_acquisition_timeout: 10,
             db_pool: null,
+            db_pool_max_lifetime: null,
+            db_pool_max_idletime: null,
           },
           database: {
             major_version: 17,
diff --git a/apps/cli/src/shared/functions/deploy.errors.ts b/apps/cli/src/shared/functions/deploy.errors.ts
index 09e94dd380..c68756d6e4 100644
--- a/apps/cli/src/shared/functions/deploy.errors.ts
+++ b/apps/cli/src/shared/functions/deploy.errors.ts
@@ -1,7 +1,10 @@
 import { Data } from "effect";
 import {
   actionability,
+  causeDeclaration,
   type CliErrorActionabilityDeclaration,
+  CliErrorKind,
+  ErrorActionabilityFingerprintId,
   ErrorActionabilityId,
 } from "../telemetry/error-actionability.ts";
 
@@ -49,5 +52,39 @@ export class FunctionDeployError extends Data.Error<{
 }> {}
 
 export class FunctionImportMapSyntaxError extends Data.Error<{ readonly message: string }> {
+  static readonly [ErrorActionabilityFingerprintId] = "FunctionImportMapSyntaxError";
   override readonly name = "SyntaxError";
+  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
+    return actionability.invalidConfig;
+  }
+}
+
+const causeKindSeverity = {
+  [CliErrorKind.InternalBug]: 4,
+  [CliErrorKind.Unknown]: 3,
+  [CliErrorKind.ExternalService]: 2,
+  [CliErrorKind.UserActionable]: 1,
+  [CliErrorKind.UserCancelled]: 0,
+} as const satisfies Record<CliErrorKind, number>;
+
+/** Aggregates the per-function failures of a multi-function API deploy. */
+export class FunctionsDeployFailedError extends AggregateError {
+  static readonly [ErrorActionabilityFingerprintId] = "FunctionsDeployFailedError";
+  /** Reports the most severe cause, so a CLI or upstream failure is never masked by a user error. */
+  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
+    const errors: unknown = this.errors;
+    let worst: CliErrorActionabilityDeclaration | undefined;
+    if (Array.isArray(errors)) {
+      for (const cause of errors) {
+        const declaration = causeDeclaration(cause) ?? actionability.unknown;
+        if (
+          worst === undefined ||
+          causeKindSeverity[declaration.error_kind] > causeKindSeverity[worst.error_kind]
+        ) {
+          worst = declaration;
+        }
+      }
+    }
+    return worst ?? actionability.unknown;
+  }
 }
diff --git a/apps/cli/src/shared/functions/deploy.errors.unit.test.ts b/apps/cli/src/shared/functions/deploy.errors.unit.test.ts
index 78289dbad5..6b93fa71ba 100644
--- a/apps/cli/src/shared/functions/deploy.errors.unit.test.ts
+++ b/apps/cli/src/shared/functions/deploy.errors.unit.test.ts
@@ -1,6 +1,17 @@
+import { Data } from "effect";
 import { describe, expect, it } from "vitest";
-import { classifyCliErrorActionability } from "../telemetry/error-actionability.ts";
-import { FunctionDeployError, FunctionImportMapSyntaxError } from "./deploy.errors.ts";
+import {
+  actionability,
+  classifyCliErrorActionability,
+  type CliErrorActionabilityDeclaration,
+  ErrorActionabilityId,
+} from "../telemetry/error-actionability.ts";
+import {
+  FunctionDeployError,
+  FunctionImportMapSyntaxError,
+  FunctionsDeployFailedError,
+} from "./deploy.errors.ts";
+import { FunctionsApiStatusError, FunctionsApiTransportError } from "./functions-api.errors.ts";
 
 describe("deploy error telemetry identity", () => {
   it("classifies a FunctionDeployError like a plain Error", () => {
@@ -11,15 +22,76 @@ describe("deploy error telemetry identity", () => {
     expect(result.error_fingerprint).toBe("error:unknown");
   });
 
-  it("classifies a FunctionImportMapSyntaxError like a native SyntaxError", () => {
+  it("classifies a FunctionImportMapSyntaxError as invalid user config", () => {
     const result = classifyCliErrorActionability(
       new FunctionImportMapSyntaxError({ message: "Expected a valid JSON string" }),
     );
-    expect(result).toEqual(
-      classifyCliErrorActionability(new SyntaxError("JSON Parse error: Expected '}'")),
+    expect(result.error_kind).toBe("user_actionable");
+    expect(result.error_category).toBe("invalid_config");
+    expect(result.error_fingerprint).toBe("error:FunctionImportMapSyntaxError");
+  });
+
+  it("classifies a FunctionsDeployFailedError by its cause when every function fails alike", () => {
+    const result = classifyCliErrorActionability(
+      new FunctionsDeployFailedError(
+        [
+          new FunctionsApiStatusError({ status: 403, message: "forbidden" }),
+          new FunctionsApiStatusError({ status: 403, message: "forbidden" }),
+        ],
+        "forbidden",
+      ),
     );
-    expect(result.error_kind).toBe("internal_bug");
-    expect(result.error_category).toBe("panic");
-    expect(result.error_fingerprint).toBe("error:SyntaxError");
+    expect(result.error_kind).toBe("user_actionable");
+    expect(result.error_category).toBe("permission");
+    expect(result.error_fingerprint).toBe("error:FunctionsDeployFailedError:forbidden");
+  });
+
+  it("classifies a FunctionsDeployFailedError by its most severe cause in any order", () => {
+    const forbidden = new FunctionsApiStatusError({ status: 403, message: "forbidden" });
+    const unavailable = new FunctionsApiStatusError({ status: 503, message: "unavailable" });
+    const expected = classifyCliErrorActionability(unavailable);
+    for (const errors of [
+      [forbidden, unavailable],
+      [unavailable, forbidden],
+    ]) {
+      const result = classifyCliErrorActionability(new FunctionsDeployFailedError(errors, "x"));
+      expect(result.error_kind).toBe("external_service");
+      expect(result.error_category).toBe(expected.error_category);
+      expect(result.error_fingerprint).toMatch(/^error:FunctionsDeployFailedError/u);
+    }
+  });
+
+  it("does not let a user error mask an unclassified or internal cause", () => {
+    class InternalCauseError extends Data.TaggedError("InternalCauseError")<{
+      readonly message: string;
+    }> {
+      get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
+        return actionability.internalPanic;
+      }
+    }
+    const forbidden = new FunctionsApiStatusError({ status: 403, message: "forbidden" });
+    const transport = new FunctionsApiTransportError({ message: "reset" });
+
+    const unclassified = classifyCliErrorActionability(
+      new FunctionsDeployFailedError([forbidden, transport, new Error("undeclared")], "x"),
+    );
+    expect(unclassified.error_kind).toBe("unknown");
+
+    const internal = classifyCliErrorActionability(
+      new FunctionsDeployFailedError(
+        [forbidden, new Error("undeclared"), new InternalCauseError({ message: "bug" }), transport],
+        "x",
+      ),
+    );
+    expect(internal.error_kind).toBe("internal_bug");
+    expect(internal.error_fingerprint).toMatch(/^error:FunctionsDeployFailedError/u);
+  });
+
+  it("classifies a FunctionsDeployFailedError without classified causes as unknown", () => {
+    for (const errors of [[], [new Error("plain")]]) {
+      const result = classifyCliErrorActionability(new FunctionsDeployFailedError(errors, "x"));
+      expect(result.error_kind).toBe("unknown");
+      expect(result.error_fingerprint).toMatch(/^error:FunctionsDeployFailedError/u);
+    }
   });
 });
diff --git a/apps/cli/src/shared/functions/deploy.ts b/apps/cli/src/shared/functions/deploy.ts
index c198a7ce34..d60a9caece 100644
--- a/apps/cli/src/shared/functions/deploy.ts
+++ b/apps/cli/src/shared/functions/deploy.ts
@@ -1,3 +1,4 @@
+import { configDisplayPath } from "../../command-internal/config-advice.ts";
 import { scratchDir } from "../../command-internal/scratch-paths.ts";
 import { brotliCompressSync, constants as zlibConstants } from "node:zlib";
 import { URL } from "node:url";
@@ -11,6 +12,7 @@ import {
   inferFunctionsManifest,
   type ResolvedFunctionConfig as ManifestFunctionConfig,
 } from "@supabase/config/effect";
+import { cliConfigFormatForPath, parseJsonc } from "@supabase/config/internal";
 import {
   Cause,
   Config,
@@ -50,6 +52,7 @@ import {
   FunctionDeployError,
   FunctionImportMapSyntaxError,
   FunctionImportNotDirectoryError,
+  FunctionsDeployFailedError,
   InvalidFunctionDeploySlugError,
   NoFunctionsToDeployError,
 } from "./deploy.errors.ts";
@@ -96,6 +99,8 @@ interface FunctionsDeployFlags {
 
 interface DeployFunctionsDependencies<ResolveError, ResolveRequirements> {
   readonly api: ApiClient;
+  /** `SUPABASE_API_MAX_RETRIES`; none keeps this command's own retries. */
+  readonly apiMaxRetries: Option.Option<number>;
   readonly cwd: string;
   readonly flagCwd: string;
   readonly projectRoot: string;
@@ -474,81 +479,6 @@ function humanSize(bytes: number) {
   return `${value.toFixed(precision)} ${units[index]}`;
 }
 
-function stripJsonComments(contents: string): string {
-  const src = contents.replace(/^\uFEFF/, "");
-  const out: Array<string> = [];
-  let pendingCommaIndex = -1;
-  let index = 0;
-  while (index < src.length) {
-    const char = src.charAt(index);
-
-    if (char === '"') {
-      pendingCommaIndex = -1;
-      out.push(char);
-      index += 1;
-      while (index < src.length) {
-        const stringChar = src.charAt(index);
-        out.push(stringChar);
-        index += 1;
-        if (stringChar === "\\") {
-          if (index < src.length) {
-            out.push(src.charAt(index));
-            index += 1;
-          }
-        } else if (stringChar === '"') {
-          break;
-        }
-      }
-      continue;
-    }
-
-    if (char === "/" && src.charAt(index + 1) === "/") {
-      index += 2;
-      while (index < src.length && src.charAt(index) !== "\n") {
-        index += 1;
-      }
-      continue;
-    }
-
-    if (char === "/" && src.charAt(index + 1) === "*") {
-      index += 2;
-      while (index < src.length && !(src.charAt(index) === "*" && src.charAt(index + 1) === "/")) {
-        index += 1;
-      }
-      index += 2;
-      continue;
-    }
-
-    if (char === ",") {
-      pendingCommaIndex = out.length;
-      out.push(char);
-      index += 1;
-      continue;
-    }
-
-    if (char === "}" || char === "]") {
-      if (pendingCommaIndex >= 0) {
-        out[pendingCommaIndex] = "";
-        pendingCommaIndex = -1;
-      }
-      out.push(char);
-      index += 1;
-      continue;
-    }
-
-    if (char === " " || char === "\t" || char === "\n" || char === "\r") {
-      out.push(char);
-      index += 1;
-      continue;
-    }
-
-    pendingCommaIndex = -1;
-    out.push(char);
-    index += 1;
-  }
-  return out.join("");
-}
-
 function resolveImportTarget(path: Path.Path, jsonPath: string, target: string) {
   if (target.startsWith("/")) {
     return target;
@@ -688,9 +618,13 @@ class ImportMapFile {
 }
 
 const parseImportMapContents = (contents: Uint8Array) =>
-  decodeJson(stripJsonComments(new TextDecoder().decode(contents))).pipe(
-    Effect.mapError((error) => new FunctionImportMapSyntaxError({ message: error.message })),
-  );
+  Effect.try({
+    try: () => parseJsonc(new TextDecoder().decode(contents)),
+    catch: (error) =>
+      new FunctionImportMapSyntaxError({
+        message: error instanceof Error ? error.message : String(error),
+      }),
+  });
 
 const loadImportMapFile = Effect.fnUntraced(function* <E = never, R = never>(
   pathname: string,
@@ -1685,11 +1619,14 @@ const bundleFunctionWithDocker = Effect.fn("functions.deploy.bundleWithDocker")(
 const listRemoteFunctions = Effect.fn("functions.deploy.listRemoteFunctions")(function* (
   api: ApiClient,
   projectRef: string,
+  apiMaxRetries: Option.Option<number>,
 ) {
   return yield* Effect.gen(function* () {
-    const response = yield* api
-      .executeRaw(operationDefinitions.v1ListAllFunctions, { ref: projectRef })
-      .pipe(Effect.mapError((error) => mapTransportError("failed to list functions", error)));
+    const response = yield* cappedRequest("listing functions", apiMaxRetries, (options) =>
+      api
+        .executeRaw(operationDefinitions.v1ListAllFunctions, { ref: projectRef }, options)
+        .pipe(Effect.mapError((error) => mapTransportError("failed to list functions", error))),
+    );
     const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
     if (response.status === 200) {
       // A 200 whose body is not the expected JSON is an API-response problem,
@@ -1713,9 +1650,11 @@ const listRemoteFunctions = Effect.fn("functions.deploy.listRemoteFunctions")(fu
   }).pipe(
     Effect.retry({
       schedule: Schedule.exponential(Duration.seconds(1)),
-      times: 3,
+      times: cappedRetries(apiMaxRetries, 3),
       while: (error) =>
-        !(error instanceof FunctionsApiStatusError) || error.status >= 500 || error.status === 429,
+        !(error instanceof FunctionsApiStatusError) ||
+        error.status >= 500 ||
+        (error.status === 429 && Option.isNone(apiMaxRetries)),
     }),
   );
 });
@@ -1758,24 +1697,29 @@ function rateLimitDelayText(milliseconds: number) {
 // The command's own 429 loop is the only retry layer.
 const NO_CLIENT_RETRY = { retry: { maxRetries: 0 } } as const;
 
-const rateLimitedRequest = Effect.fnUntraced(function* <A>(
+// `SUPABASE_API_MAX_RETRIES` caps a command loop without ever raising it.
+const cappedRetries = (apiMaxRetries: Option.Option<number>, commandRetries: number) =>
+  Math.min(
+    Option.getOrElse(apiMaxRetries, () => commandRetries),
+    commandRetries,
+  );
+
+interface RateLimitedResponse {
+  readonly status: number;
+  readonly headers: Readonly<Record<string, string | undefined>>;
+}
+
+const rateLimitedRequest = Effect.fnUntraced(function* <R extends RateLimitedResponse, E>(
   action: string,
-  request: () => Effect.Effect<
-    {
-      readonly status: number;
-      readonly headers: Readonly<Record<string, string | undefined>>;
-      readonly body: Effect.Effect<A, Error>;
-    },
-    Error
-  >,
+  apiMaxRetries: Option.Option<number>,
+  request: () => Effect.Effect<R, E>,
 ) {
   const output = yield* Output;
+  const maxRetries = cappedRetries(apiMaxRetries, DEPLOY_RATE_LIMIT_MAX_RETRIES);
   return yield* Effect.repeat(Effect.suspend(request), ($) =>
     $(Schedule.forever).pipe(
       Schedule.passthrough,
-      Schedule.while(
-        ({ input, attempt }) => input.status === 429 && attempt <= DEPLOY_RATE_LIMIT_MAX_RETRIES,
-      ),
+      Schedule.while(({ input, attempt }) => input.status === 429 && attempt <= maxRetries),
       Schedule.modifyDelay(({ input, attempt, now }) =>
         Effect.succeed(Duration.millis(rateLimitDelayMillis(input.headers, attempt - 1, now))),
       ),
@@ -1789,6 +1733,17 @@ const rateLimitedRequest = Effect.fnUntraced(function* <A>(
   );
 });
 
+// Once `SUPABASE_API_MAX_RETRIES` is set, 429s go through the capped loop that reads the rate-limit
+// headers, and the client stays out so attempts don't multiply.
+const cappedRequest = <R extends RateLimitedResponse, E>(
+  action: string,
+  apiMaxRetries: Option.Option<number>,
+  request: (options?: typeof NO_CLIENT_RETRY) => Effect.Effect<R, E>,
+) =>
+  Option.isSome(apiMaxRetries)
+    ? rateLimitedRequest(action, apiMaxRetries, () => request(NO_CLIENT_RETRY))
+    : request();
+
 const uploadFunctionSource = Effect.fn("functions.deploy.uploadFunctionSource")(function* (
   api: ApiClient,
   projectRef: string,
@@ -1797,6 +1752,7 @@ const uploadFunctionSource = Effect.fn("functions.deploy.uploadFunctionSource")(
   config: ResolvedDeployFunctionConfig,
   metadata: SourceDeployMetadata,
   bundleOnly: boolean,
+  apiMaxRetries: Option.Option<number>,
 ) {
   const output = yield* Output;
   const files = yield* joinDetached(
@@ -1810,33 +1766,36 @@ const uploadFunctionSource = Effect.fn("functions.deploy.uploadFunctionSource")(
       ),
     ),
   );
-  const response = yield* rateLimitedRequest(`deploying function ${config.slug}`, () =>
-    api
-      .executeRaw(
-        operationDefinitions.v1DeployAFunction,
-        {
-          ref: projectRef,
-          slug: config.slug,
-          ...(bundleOnly ? { bundleOnly: true } : {}),
-          body: {
-            metadata,
-            file: files,
+  const response = yield* rateLimitedRequest(
+    `deploying function ${config.slug}`,
+    apiMaxRetries,
+    () =>
+      api
+        .executeRaw(
+          operationDefinitions.v1DeployAFunction,
+          {
+            ref: projectRef,
+            slug: config.slug,
+            ...(bundleOnly ? { bundleOnly: true } : {}),
+            body: {
+              metadata,
+              file: files,
+            },
           },
-        },
-        NO_CLIENT_RETRY,
-      )
-      .pipe(
-        // Read the body as text (never failing) so the status check below wins:
-        // a non-201 with a non-JSON body, or a 201 with malformed JSON, must
-        // classify as a status/response problem — not fall through
-        // `mapTransportError` as a network failure.
-        Effect.map((raw) => ({
-          status: raw.status,
-          headers: raw.headers,
-          body: raw.text.pipe(Effect.orElseSucceed(() => "")),
-        })),
-        Effect.mapError((error) => mapTransportError("failed to deploy function", error)),
-      ),
+          NO_CLIENT_RETRY,
+        )
+        .pipe(
+          // Read the body as text (never failing) so the status check below wins:
+          // a non-201 with a non-JSON body, or a 201 with malformed JSON, must
+          // classify as a status/response problem — not fall through
+          // `mapTransportError` as a network failure.
+          Effect.map((raw) => ({
+            status: raw.status,
+            headers: raw.headers,
+            body: raw.text.pipe(Effect.orElseSucceed(() => "")),
+          })),
+          Effect.mapError((error) => mapTransportError("failed to deploy function", error)),
+        ),
   );
   const body = yield* response.body;
   if (response.status !== 201) {
@@ -1903,9 +1862,10 @@ const bulkUpdateRemoteFunctions = Effect.fn("functions.deploy.bulkUpdateFunction
   api: ApiClient,
   projectRef: string,
   functions: ReadonlyArray<BulkUpdateFunction>,
+  apiMaxRetries: Option.Option<number>,
 ) {
   return yield* Effect.gen(function* () {
-    const response = yield* rateLimitedRequest("bulk updating functions", () =>
+    const response = yield* rateLimitedRequest("bulk updating functions", apiMaxRetries, () =>
       api
         .executeRaw(
           operationDefinitions.v1BulkUpdateFunctions,
@@ -1937,7 +1897,7 @@ const bulkUpdateRemoteFunctions = Effect.fn("functions.deploy.bulkUpdateFunction
   }).pipe(
     Effect.retry({
       schedule: Schedule.exponential(Duration.seconds(1)),
-      times: 3,
+      times: cappedRetries(apiMaxRetries, 3),
       while: (error) => !(error instanceof FunctionsApiStatusError) || error.status >= 500,
     }),
   );
@@ -1948,7 +1908,9 @@ const upsertBundledFunction = Effect.fn("functions.deploy.upsertFunction")(funct
   projectRef: string,
   bundled: BundledFunction,
   exists: boolean,
+  apiMaxRetries: Option.Option<number>,
 ) {
+  const retries = cappedRetries(apiMaxRetries, 3);
   const shouldUpdateRef = yield* Ref.make(exists);
 
   const upsert = Effect.gen(function* () {
@@ -1971,14 +1933,20 @@ const upsertBundledFunction = Effect.fn("functions.deploy.upsertFunction")(funct
       slug: bundled.slug,
       name: bundled.slug,
     };
-    const request = shouldUpdate
-      ? api.executeRaw(operationDefinitions.v1UpdateAFunction, {
-          ...updateInput,
-          function_slug: bundled.slug,
-        })
-      : api.executeRaw(operationDefinitions.v1CreateAFunction, createInput);
-    const response = yield* request.pipe(
-      Effect.mapError((error) => mapTransportError(`failed to ${action} function`, error)),
+    const response = yield* cappedRequest(
+      `${shouldUpdate ? "updating" : "creating"} function ${bundled.slug}`,
+      apiMaxRetries,
+      (options) =>
+        (shouldUpdate
+          ? api.executeRaw(
+              operationDefinitions.v1UpdateAFunction,
+              { ...updateInput, function_slug: bundled.slug },
+              options,
+            )
+          : api.executeRaw(operationDefinitions.v1CreateAFunction, createInput, options)
+        ).pipe(
+          Effect.mapError((error) => mapTransportError(`failed to ${action} function`, error)),
+        ),
     );
 
     const expectedStatus = shouldUpdate ? 200 : 201;
@@ -2013,8 +1981,19 @@ const upsertBundledFunction = Effect.fn("functions.deploy.upsertFunction")(funct
   return yield* upsert.pipe(
     Effect.retry({
       schedule: Schedule.exponential(Duration.millis(500)),
-      times: 3,
-      while: (error) => !(error instanceof FunctionsApiStatusError && error.decode === true),
+      // A duplicated create still becomes an update when no retries are allowed.
+      times: Math.max(retries, 1),
+      while: (error) =>
+        Ref.get(shouldUpdateRef).pipe(
+          Effect.map(
+            (shouldUpdate) =>
+              !(
+                error instanceof FunctionsApiStatusError &&
+                (error.decode === true || (Option.isSome(apiMaxRetries) && error.status === 429))
+              ) &&
+              (retries > 0 || shouldUpdate !== exists),
+          ),
+        ),
     }),
   );
 });
@@ -2105,6 +2084,8 @@ export const resolveFunctionConfigs = Effect.fn("functions.deploy.resolveConfigs
     readonly noVerifyJwtOverride: Option.Option<boolean>;
     /** Skips the fallback-import-map warning, for a resolve whose result is discarded. */
     readonly quiet?: boolean;
+    /** The loaded config file; absent reads as `config.toml`. */
+    readonly configPath?: string | undefined;
   }) {
     const output = yield* Output;
     const path = yield* Path.Path;
@@ -2213,7 +2194,10 @@ export const resolveFunctionConfigs = Effect.fn("functions.deploy.resolveConfigs
       const configPath = relativePath.startsWith("../") ? relativePath : `./${relativePath}`;
       return yield* new FunctionDeployError({
         message: `import_map.json in a function directory is no longer supported: ${[...unsupportedImportMaps.keys()].join(", ")}`,
-        suggestion: `Rename it to deno.json, or set functions.${slug}.import_map = "${configPath}" in config.toml to keep the file.`,
+        suggestion:
+          input.configPath !== undefined && cliConfigFormatForPath(input.configPath) === "json"
+            ? `Rename it to deno.json, or set \`functions.${slug}.import_map\` to \`"${configPath}"\` in ${configDisplayPath(path, input.projectRoot, input.configPath)} to keep the file.`
+            : `Rename it to deno.json, or set functions.${slug}.import_map = "${configPath}" in config.toml to keep the file.`,
       });
     }
 
@@ -2238,6 +2222,7 @@ const deployViaApi = Effect.fn("functions.deploy.viaApi")(function* (
   configs: ReadonlyArray<ResolvedDeployFunctionConfig>,
   api: ApiClient,
   jobs: number,
+  apiMaxRetries: Option.Option<number>,
 ) {
   const output = yield* Output;
   const path = yield* Path.Path;
@@ -2258,7 +2243,9 @@ const deployViaApi = Effect.fn("functions.deploy.viaApi")(function* (
   }
 
   const remoteBySlug = enabled.some((config) => config.verifyJwt === undefined)
-    ? new Map((yield* listRemoteFunctions(api, projectRef)).map((fn) => [fn.slug, fn]))
+    ? new Map(
+        (yield* listRemoteFunctions(api, projectRef, apiMaxRetries)).map((fn) => [fn.slug, fn]),
+      )
     : new Map<string, RemoteFunction>();
 
   const [singleConfig] = enabled;
@@ -2271,6 +2258,7 @@ const deployViaApi = Effect.fn("functions.deploy.viaApi")(function* (
       singleConfig,
       createSourceMetadata(path, projectRoot, singleConfig, remoteBySlug.get(singleConfig.slug)),
       false,
+      apiMaxRetries,
     );
     return;
   }
@@ -2293,6 +2281,7 @@ const deployViaApi = Effect.fn("functions.deploy.viaApi")(function* (
             config,
             createSourceMetadata(path, projectRoot, config, remoteBySlug.get(config.slug)),
             true,
+            apiMaxRetries,
           ),
         );
       }).pipe(
@@ -2315,10 +2304,10 @@ const deployViaApi = Effect.fn("functions.deploy.viaApi")(function* (
   }
 
   if (deployed.length === 0) {
-    return yield* Effect.fail(new AggregateError(causes, messages.join("\n")));
+    return yield* Effect.fail(new FunctionsDeployFailedError(causes, messages.join("\n")));
   }
 
-  const updated = yield* bulkUpdateRemoteFunctions(api, projectRef, deployed).pipe(
+  const updated = yield* bulkUpdateRemoteFunctions(api, projectRef, deployed, apiMaxRetries).pipe(
     Effect.map(() => ({ success: true as const })),
     Effect.catch((error) => Effect.succeed({ success: false as const, error })),
   );
@@ -2327,7 +2316,7 @@ const deployViaApi = Effect.fn("functions.deploy.viaApi")(function* (
     causes.push(updated.error);
   }
   if (messages.length > 0) {
-    return yield* Effect.fail(new AggregateError(causes, messages.join("\n")));
+    return yield* Effect.fail(new FunctionsDeployFailedError(causes, messages.join("\n")));
   }
 });
 
@@ -2338,6 +2327,7 @@ interface DeployViaDockerOptions {
   readonly functionsDir: string;
   readonly configs: ReadonlyArray<ResolvedDeployFunctionConfig>;
   readonly api: ApiClient;
+  readonly apiMaxRetries: Option.Option<number>;
   /** Already resolved (explicit flag > `SUPABASE_NETWORK_ID` > generated) — see the caller. */
   readonly networkMode: string;
   readonly verbose?: boolean;
@@ -2355,6 +2345,7 @@ const deployViaDocker = Effect.fn("functions.deploy.viaDocker")(function* (
     functionsDir,
     configs,
     api,
+    apiMaxRetries,
     networkMode,
     verbose = false,
     styleEmphasis = (text: string) => text,
@@ -2362,7 +2353,7 @@ const deployViaDocker = Effect.fn("functions.deploy.viaDocker")(function* (
   } = options;
   const output = yield* Output;
   yield* Effect.annotateCurrentSpan({ "function.count": configs.length });
-  const remoteFunctions = yield* listRemoteFunctions(api, projectRef);
+  const remoteFunctions = yield* listRemoteFunctions(api, projectRef, apiMaxRetries);
 
   const remoteBySlug = new Map(remoteFunctions.map((fn) => [fn.slug, fn]));
   const changed: BulkUpdateFunction[] = [];
@@ -2399,13 +2390,19 @@ const deployViaDocker = Effect.fn("functions.deploy.viaDocker")(function* (
     );
     changed.push(
       yield* toBulkUpdateItem(
-        yield* upsertBundledFunction(api, projectRef, bundled, current !== undefined),
+        yield* upsertBundledFunction(
+          api,
+          projectRef,
+          bundled,
+          current !== undefined,
+          apiMaxRetries,
+        ),
       ),
     );
   }
 
   if (changed.length > 1) {
-    yield* bulkUpdateRemoteFunctions(api, projectRef, changed);
+    yield* bulkUpdateRemoteFunctions(api, projectRef, changed, apiMaxRetries);
   }
 });
 
@@ -2413,8 +2410,9 @@ const findPruneCandidates = Effect.fn("functions.deploy.pruneCandidates")(functi
   projectRef: string,
   configs: ReadonlyArray<ResolvedDeployFunctionConfig>,
   api: ApiClient,
+  apiMaxRetries: Option.Option<number>,
 ) {
-  const remoteFunctions = yield* listRemoteFunctions(api, projectRef);
+  const remoteFunctions = yield* listRemoteFunctions(api, projectRef, apiMaxRetries);
   const localSlugs = new Set(configs.map((config) => config.slug));
   return remoteFunctions
     .filter((remote) => remote.status !== "REMOVED" && !localSlugs.has(remote.slug))
@@ -2575,12 +2573,13 @@ export const deployFunctions = Effect.fn("functions.deploy")(function* <
     rawConfigFunctions,
     importMapOverride: flags.importMap,
     noVerifyJwtOverride,
+    configPath: context.configPath,
   });
   const dashboardUrl = `${dependencies.dashboardUrl}/project/${projectRef}/functions`;
 
   const toDeploy = configs.filter((config) => config.enabled).map((config) => config.slug);
   const toPrune = flags.prune
-    ? yield* findPruneCandidates(projectRef, configs, dependencies.api)
+    ? yield* findPruneCandidates(projectRef, configs, dependencies.api, dependencies.apiMaxRetries)
     : [];
   if (toDeploy.length > 0 || toPrune.length > 0) {
     yield* requireDeployConsent(toDeploy, toPrune);
@@ -2592,6 +2591,7 @@ export const deployFunctions = Effect.fn("functions.deploy")(function* <
     configs,
     dependencies.api,
     jobs,
+    dependencies.apiMaxRetries,
   ).pipe(
     Effect.as(Option.none<string>()),
     Effect.catchIf(
@@ -2628,6 +2628,7 @@ export const deployFunctions = Effect.fn("functions.deploy")(function* <
           functionsDir: path.join(dependencies.projectRoot, SUPABASE_FUNCTIONS_DIR),
           configs,
           api: dependencies.api,
+          apiMaxRetries: dependencies.apiMaxRetries,
           networkMode,
           verbose: debugEnabled,
           styleEmphasis,
diff --git a/apps/cli/src/shared/functions/download.ts b/apps/cli/src/shared/functions/download.ts
index 5e1357ad7b..84c283b12d 100644
--- a/apps/cli/src/shared/functions/download.ts
+++ b/apps/cli/src/shared/functions/download.ts
@@ -1,4 +1,5 @@
 import { scratchDir } from "../../command-internal/scratch-paths.ts";
+import { type ConfigFileRef, configFileRefFromPath } from "../../command-internal/config-advice.ts";
 import { usesStackState } from "../../command-internal/stack-backend.ts";
 import { BunPath } from "@effect/platform-bun";
 import { operationDefinitions, SupabaseApiInputError, type ApiClient } from "@supabase/api/effect";
@@ -827,10 +828,17 @@ function suggestUseApiRetry(
   return `\nRetry with ${styleAqua(`supabase functions download --use-api ${slug}`)} to unbundle server-side. If that also fails and the Function was deployed with a CLI older than 1.120.0, redeploy it with the current CLI.`;
 }
 
-function suggestDenoV2(styleEmphasis: (text: string) => string = (text) => text): string {
+function suggestDenoV2(
+  configFile: ConfigFileRef,
+  styleEmphasis: (text: string) => string = (text) => text,
+): string {
   // Preserves the established trailing newline; `styleEmphasis` covers the
   // config path the same way it covers the slug above.
-  return `Please use deno v2 in ${styleEmphasis("supabase/config.toml")} to download this Function:\n\n[edge_runtime]\ndeno_version = 2\n`;
+  const block =
+    configFile.format === "json"
+      ? '{\n  "edge_runtime": {\n    "deno_version": 2\n  }\n}'
+      : "[edge_runtime]\ndeno_version = 2";
+  return `Please use deno v2 in ${styleEmphasis(configFile.path)} to download this Function:\n\n${block}\n`;
 }
 
 /**
@@ -884,6 +892,11 @@ const resolveEdgeRuntimeImage = Effect.fn("functions.download.resolveEdgeRuntime
     // per-container, right before `ensureDockerNetwork` (see the caller).
     rawImage: edgeRuntimeImage(edgeRuntimeVersion, yield* slimImagesEnabled),
     projectEnvValues: context.projectEnvValues,
+    configFile: configFileRefFromPath(
+      yield* Path.Path,
+      dependencies.projectRoot,
+      context.configPath,
+    ),
   };
 });
 
@@ -893,6 +906,7 @@ interface EdgeRuntimeImage {
   /** Not yet registry-mapped/pull-resolved — see {@link resolveFunctionsDockerImage}. */
   readonly rawImage: string;
   readonly projectEnvValues: Readonly<Record<string, string>>;
+  readonly configFile: ConfigFileRef;
 }
 
 /**
@@ -1054,7 +1068,8 @@ const downloadWithDockerUnbundle = Effect.fn("functions.download.dockerUnbundle"
           .split(/\r?\n/)
           .some((line) => line.trim().toLowerCase() === "invalid eszip v2");
       const suggestion =
-        (invalidEszipV2 ? suggestDenoV2(styleEmphasis) : "") + suggestUseApiRetry(slug, styleAqua);
+        (invalidEszipV2 ? suggestDenoV2(edgeRuntimeImage.configFile, styleEmphasis) : "") +
+        suggestUseApiRetry(slug, styleAqua);
       return yield* Effect.fail(
         Object.assign(new Error(`error running container: exit ${result.exitCode}`), {
           suggestion,
diff --git a/apps/cli/src/shared/functions/functions-config.ts b/apps/cli/src/shared/functions/functions-config.ts
index 374f67d9ef..0569e3c33c 100644
--- a/apps/cli/src/shared/functions/functions-config.ts
+++ b/apps/cli/src/shared/functions/functions-config.ts
@@ -1,7 +1,16 @@
-import { Crypto, Effect, type FileSystem, Option, type Path } from "effect";
+import { Data, Effect, FileSystem, Option, Path, Predicate, Redacted } from "effect";
+import { Digest } from "effect/crypto";
 import type { RuntimeInfo } from "../runtime/runtime-info.service.ts";
 import type { LoadedCliConfig } from "@supabase/config/effect";
 import { CliConfigValues, type ResolvedCliConfig } from "../../config/cli-config-values.service.ts";
+import { parseDotEnv } from "../config/dotenv.ts";
+import { Output } from "../output/output.service.ts";
+import {
+  actionability,
+  type CliErrorActionabilityDeclaration,
+  ErrorActionabilityId,
+} from "../telemetry/error-actionability.ts";
+import { nativePlatformFailure } from "./functions-docker.ts";
 
 type FunctionsLoadedConfig = Pick<LoadedCliConfig, "config" | "document">;
 
@@ -40,7 +49,7 @@ export interface FunctionsLocalConfigLoader {
       readonly denoVersion: number;
     },
     Error,
-    FileSystem.FileSystem | Path.Path | RuntimeInfo | Crypto.Crypto | CliConfigValues
+    FileSystem.FileSystem | Path.Path | RuntimeInfo | Digest.Digest | CliConfigValues
   >;
 }
 
@@ -74,3 +83,148 @@ export const loadFunctionsCliConfig = Effect.fn("FunctionsConfig.load")(function
     denoVersion: context.denoVersion,
   } satisfies FunctionsCliConfigContext;
 });
+
+/**
+ * `[edge_runtime.secrets]` as the Functions container env: names uppercased, only resolved
+ * non-empty values kept. An unresolved `env(VAR)` literal stays a plain string, not
+ * `Redacted`, so it is dropped, the same guard `secrets set` uses.
+ */
+export function toEdgeRuntimeSecretsEnv(
+  secrets: Readonly<Record<string, string | Redacted.Redacted<string> | undefined>> | undefined,
+): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(secrets ?? {}).flatMap(([name, value]): Array<[string, string]> =>
+      Redacted.isRedacted(value) && Redacted.value(value).length > 0
+        ? [[name.toUpperCase(), Redacted.value(value)]]
+        : [],
+    ),
+  );
+}
+
+/** A Functions env file that cannot be read or parsed. */
+export class FunctionsEnvError extends Data.TaggedError("FunctionsEnvError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {
+  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
+    return actionability.invalidConfig;
+  }
+}
+
+/** The parse failure without the offending line, which may hold a secret. */
+function dotEnvParseErrorMessage(path: string, cause: unknown) {
+  if (!(cause instanceof Error)) {
+    return `failed to parse environment file: ${path}`;
+  }
+  const message = cause.message;
+  if (message.startsWith('unexpected character "')) {
+    const prefix = 'unexpected character "';
+    const start = message.indexOf(prefix);
+    if (start !== -1) {
+      const charStart = start + prefix.length;
+      const charEnd = message.indexOf('"', charStart);
+      if (charEnd !== -1) {
+        const char = message.slice(charStart, charEnd);
+        return `failed to parse environment file: ${path} (unexpected character '${char}' in variable name)`;
+      }
+    }
+    return `failed to parse environment file: ${path} (unexpected character in variable name)`;
+  }
+  if (message.startsWith("unterminated quoted value")) {
+    return `failed to parse environment file: ${path} (unterminated quoted value)`;
+  }
+  if (message.includes("\n")) {
+    return `failed to parse environment file: ${path} (syntax error)`;
+  }
+  return `failed to load ${path}: ${message}`;
+}
+
+/* Native UTF-8 reads retain a leading BOM, which JSON and dotenv parsers reject. */
+export const readFileUtf8 = (fs: FileSystem.FileSystem, pathname: string) =>
+  fs.readFile(pathname).pipe(Effect.map((bytes) => Buffer.from(bytes).toString("utf8")));
+
+const readFunctionsEnvFile = Effect.fnUntraced(function* (pathname: string, optional: boolean) {
+  const fs = yield* FileSystem.FileSystem;
+  const contents = yield* readFileUtf8(fs, pathname).pipe(
+    Effect.catch((error) => {
+      if (optional && Predicate.isTagged(error.reason, "NotFound")) return Effect.succeed("");
+      const failure = nativePlatformFailure(error, pathname);
+      return Effect.fail(
+        new FunctionsEnvError({
+          message: `failed to load environment file: ${pathname} (${failure.message})`,
+          cause: failure.cause,
+        }),
+      );
+    }),
+  );
+  return yield* Effect.try({
+    try: () => parseDotEnv(contents),
+    catch: (cause) => new FunctionsEnvError({ message: dotEnvParseErrorMessage(pathname, cause) }),
+  });
+});
+
+const dropReservedNames = Effect.fnUntraced(function* (
+  env: Readonly<Record<string, string>>,
+  warn: boolean,
+) {
+  const output = yield* Output;
+  const kept: Array<[string, string]> = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (!name.startsWith("SUPABASE_")) kept.push([name, value]);
+    else if (warn)
+      yield* output.raw(`Env name cannot start with SUPABASE_, skipping: ${name}\n`, "stderr");
+  }
+  return Object.fromEntries(kept);
+});
+
+/** A function's own `<functionsDir>/<slug>/.env`, without `SUPABASE_` names. */
+export const resolveFunctionEnv = Effect.fn("FunctionsEnv.resolveFunction")(function* (input: {
+  readonly functionsDir: string;
+  readonly slug: string;
+  readonly warn: boolean;
+}) {
+  const path = yield* Path.Path;
+  const env = yield* readFunctionsEnvFile(path.join(input.functionsDir, input.slug, ".env"), true);
+  return yield* dropReservedNames(env, input.warn);
+});
+
+/** The explicit env file, else `functionsDir/.env`, over the secrets, without `SUPABASE_` names. */
+export const resolveSharedFunctionsEnv = Effect.fn("FunctionsEnv.resolveShared")(function* (input: {
+  readonly secrets: Readonly<Record<string, string>>;
+  readonly functionsDir: string;
+  /** An absolute path. */
+  readonly envFile: Option.Option<string>;
+  readonly warn: boolean;
+}) {
+  const path = yield* Path.Path;
+  const parsed = yield* readFunctionsEnvFile(
+    Option.getOrElse(input.envFile, () => path.join(input.functionsDir, ".env")),
+    Option.isNone(input.envFile),
+  );
+  return yield* dropReservedNames({ ...input.secrets, ...parsed }, input.warn);
+});
+
+/**
+ * The Functions runtime env for `start` and `functions serve`: the shared env, and without an
+ * explicit env file each listed function's own `.env`, read before the shared env.
+ */
+export const resolveFunctionsEnv = Effect.fn("FunctionsEnv.resolve")(function* (input: {
+  readonly secrets: Readonly<Record<string, string>>;
+  readonly functionsDir: string;
+  /** An absolute path. */
+  readonly envFile: Option.Option<string>;
+  readonly functionSlugs: ReadonlyArray<string>;
+  readonly warn: boolean;
+}) {
+  const functions: Record<string, Record<string, string>> = {};
+  for (const slug of Option.isNone(input.envFile) ? input.functionSlugs : []) {
+    const env = yield* resolveFunctionEnv({
+      functionsDir: input.functionsDir,
+      slug,
+      warn: input.warn,
+    });
+    if (Object.keys(env).length > 0) functions[slug] = env;
+  }
+  const shared = yield* resolveSharedFunctionsEnv(input);
+  return { shared, functions };
+});
diff --git a/apps/cli/src/shared/functions/functions.shared.unit.test.ts b/apps/cli/src/shared/functions/functions.shared.unit.test.ts
index 67d85bdf02..26f01da59f 100644
--- a/apps/cli/src/shared/functions/functions.shared.unit.test.ts
+++ b/apps/cli/src/shared/functions/functions.shared.unit.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { afterEach, describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { vi } from "vitest";
@@ -104,7 +104,9 @@ describe("resolveEdgeRuntimeVersionPin", () => {
       expect(edgeRuntimeImage(slimPin, true)).toBe(lockedImage);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(BunServices.layer, projectStateModeLayer("stack"))),
+      Effect.provide(
+        Layer.mergeAll(BunServices.layer, BunCrypto.layer, projectStateModeLayer("stack")),
+      ),
     ),
   );
 
diff --git a/apps/cli/src/shared/functions/serve.errors.ts b/apps/cli/src/shared/functions/serve.errors.ts
index 730c99e211..432f13c748 100644
--- a/apps/cli/src/shared/functions/serve.errors.ts
+++ b/apps/cli/src/shared/functions/serve.errors.ts
@@ -10,6 +10,19 @@ import {
   ErrorActionabilityId,
 } from "../telemetry/error-actionability.ts";
 
+/**
+ * Exit codes a supervisor uses to tear a container down (`supabase stop`, CI cancellation), not a
+ * self-raised crash signal; 137 is excluded because it needs `OOMKilled` to tell a memory-limit
+ * kill from a kill the CLI cannot attribute.
+ */
+export const externalTerminationExitCodes: ReadonlySet<number> = new Set([
+  15, // SIGTERM as edge-runtime reports it: the raw signal number, not 128 + 15
+  129, // SIGHUP
+  130, // SIGINT
+  131, // SIGQUIT
+  143, // SIGTERM
+]);
+
 /**
  * The edge runtime container exited with a real crash signal or other non-zero code while
  * streaming logs. Supervisor-initiated shutdowns (SIGHUP/SIGINT/SIGQUIT/SIGTERM) end the
@@ -60,6 +73,8 @@ export class DockerLogsStreamError extends Data.TaggedError("DockerLogsStreamErr
    * False when that inspect failed and there is no container state to read.
    */
   readonly oomKilled: boolean;
+  /** The stopped container's exit code from the follow-up inspect, absent when that inspect failed. */
+  readonly containerExitCode?: number;
 }> {
   get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
     if (this.oomKilled) {
@@ -68,7 +83,16 @@ export class DockerLogsStreamError extends Data.TaggedError("DockerLogsStreamErr
     if (this.daemonDown) {
       return { ...actionability.dockerNotRunning, fingerprint_suffix: "docker_not_running" };
     }
-    return actionability.unknown;
+    if (this.containerExitCode === undefined) {
+      return { ...actionability.unknown, fingerprint_suffix: "engine_command_inspect" };
+    }
+    if (this.containerExitCode === 137) {
+      return { ...actionability.unknown, fingerprint_suffix: "container_killed" };
+    }
+    if (this.containerExitCode === 0 || externalTerminationExitCodes.has(this.containerExitCode)) {
+      return { ...actionability.unknown, fingerprint_suffix: "runtime_stopped" };
+    }
+    return actionability.runtimeCrash;
   }
 
   /** Keeps the user-visible remediation in sync with the actionability above. */
diff --git a/apps/cli/src/shared/functions/serve.errors.unit.test.ts b/apps/cli/src/shared/functions/serve.errors.unit.test.ts
index d91b9a43a1..a3acd14d47 100644
--- a/apps/cli/src/shared/functions/serve.errors.unit.test.ts
+++ b/apps/cli/src/shared/functions/serve.errors.unit.test.ts
@@ -159,6 +159,31 @@ describe("DockerLogsStreamError suggestion", () => {
     expect(result.error_category).toBe(actionability.resourceLimit.error_category);
     expect(result.error_fingerprint).toBe("tag:DockerLogsStreamError:out_of_memory");
   });
+
+  it.each([
+    { containerExitCode: undefined, category: "unknown", fingerprint: ":engine_command_inspect" },
+    { containerExitCode: 137, category: "unknown", fingerprint: ":container_killed" },
+    { containerExitCode: 0, category: "unknown", fingerprint: ":runtime_stopped" },
+    { containerExitCode: 143, category: "unknown", fingerprint: ":runtime_stopped" },
+    { containerExitCode: 1, category: "runtime_crash", fingerprint: "" },
+  ])(
+    "fingerprints a reachable-daemon stream failure with container exit $containerExitCode",
+    ({ containerExitCode, category, fingerprint }) => {
+      const error = new DockerLogsStreamError({
+        message: "docker logs -f exited",
+        containerId: "abc123",
+        exitCode: 1,
+        stderr: "unexpected error",
+        daemonDown: false,
+        oomKilled: false,
+        containerExitCode,
+      });
+
+      const result = classifyCliErrorActionability(error);
+      expect(result.error_category).toBe(category);
+      expect(result.error_fingerprint).toBe(`tag:DockerLogsStreamError${fingerprint}`);
+    },
+  );
 });
 
 describe("EdgeRuntimeLogStreamLostError actionability", () => {
diff --git a/apps/cli/src/shared/functions/serve.ts b/apps/cli/src/shared/functions/serve.ts
index 727f0b920c..83b2a0a19f 100644
--- a/apps/cli/src/shared/functions/serve.ts
+++ b/apps/cli/src/shared/functions/serve.ts
@@ -30,7 +30,6 @@ import {
   Exit,
   Fiber,
   Option,
-  Predicate,
   Redacted,
   Result,
   Schema,
@@ -44,7 +43,6 @@ import {
 } from "../../command-internal/container-cli.ts";
 import { inspectContainerState } from "../../command-internal/docker-lifecycle.ts";
 import { isDockerDaemonUnreachable } from "../../command-internal/docker-suggest.ts";
-import { parseDotEnv } from "../config/dotenv.ts";
 import { supabaseEnvStringWithProjectFallback } from "../../command-internal/supabase-env.ts";
 import {
   resolveRemoteJwks,
@@ -81,7 +79,15 @@ import {
   runChildProcess,
   toDockerPath,
 } from "./functions-docker.ts";
-import { loadFunctionsCliConfig, type FunctionsLocalConfigLoader } from "./functions-config.ts";
+import {
+  loadFunctionsCliConfig,
+  type FunctionsEnvError,
+  readFileUtf8,
+  resolveFunctionEnv,
+  resolveSharedFunctionsEnv,
+  toEdgeRuntimeSecretsEnv,
+  type FunctionsLocalConfigLoader,
+} from "./functions-config.ts";
 import { edgeRuntimeImage, resolveEdgeRuntimeVersionPin } from "./functions.shared.ts";
 import { slimImagesEnabled } from "../services/slim-images.ts";
 import {
@@ -90,10 +96,13 @@ import {
   EdgeRuntimeLogStreamLostError,
   ServeLocalDbInspectError,
   ServeLocalDbNotRunningError,
+  externalTerminationExitCodes,
 } from "./serve.errors.ts";
 import { CliConfigKeys } from "../../config/cli-config-keys.ts";
 import { resolveConfigSubtree } from "../../config/cli-config-subtree.ts";
 import { CliConfigValues } from "../../config/cli-config-values.service.ts";
+import { recordCommandTelemetry } from "../../telemetry/command-telemetry-attributes.ts";
+import { PropEdgeRuntimeExitCode, PropServeEndReason } from "../telemetry/event-catalog.ts";
 
 const dockerRuntimeServerPort = 8081;
 const dockerRuntimeInspectorPort = 8083;
@@ -124,15 +133,6 @@ const dockerLogDiagnosticTailLength = 4_096;
 // On Windows, `CTRL_C_EVENT` reaches every console-attached process, so the CLI's own shutdown
 // signal and a child spawn/stream failure can land microseconds apart — this is their tie-break.
 const shutdownSignalGracePeriod = Duration.millis(50);
-// Exit codes a supervisor uses to tear a container down (`supabase stop`, CI cancellation),
-// not a self-raised crash signal; 137 is excluded because it needs `OOMKilled` to tell a
-// memory-limit kill from a kill the CLI cannot attribute.
-const externalTerminationExitCodes = new Set([
-  129, // SIGHUP
-  130, // SIGINT
-  131, // SIGQUIT
-  143, // SIGTERM
-]);
 // Consecutive re-attaches to `docker logs -f` without forwarding a new line before giving up on
 // the stream and failing loudly instead of flooding replayed history forever.
 const containerLogReattachCap = 5;
@@ -285,6 +285,7 @@ export interface ServeEdgeRuntimeContainerConfig {
   readonly configDeclaredFunctions: Readonly<Record<string, ManifestFunctionConfig>>;
   readonly configFunctions: Readonly<Record<string, ManifestFunctionConfig>>;
   readonly rawConfigFunctions: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+  readonly configPath?: string | undefined;
 }
 
 /**
@@ -435,18 +436,7 @@ export function toPlainEdgeRuntimeConfig(
     policy: reveal(edgeRuntime.policy) ?? "",
     inspector_port: edgeRuntime.inspector_port,
     deno_version: edgeRuntime.deno_version,
-    // Secret names always reach the container env uppercased regardless of
-    // authored casing. Only resolved (non-empty) values are kept — an
-    // unresolved `env(VAR)` literal stays a plain string, not `Redacted`, so
-    // `Redacted.isRedacted` + non-empty filters it out, the same guard
-    // `secrets set` uses.
-    secrets: Object.fromEntries(
-      Object.entries(edgeRuntime.secrets ?? {}).flatMap(([name, value]) =>
-        Redacted.isRedacted(value) && Redacted.value(value).length > 0
-          ? [[name.toUpperCase(), Redacted.value(value)] as const]
-          : [],
-      ),
-    ),
+    secrets: toEdgeRuntimeSecretsEnv(edgeRuntime.secrets),
   };
 }
 
@@ -471,6 +461,18 @@ export function toPlainFunctionRecord(
   );
 }
 
+/* Env file failures keep the plain error `start` and `serve` have always reported. */
+const legacyEnvFailure = <A, R>(effect: Effect.Effect<A, FunctionsEnvError, R>) =>
+  effect.pipe(
+    Effect.mapError((error) =>
+      nativeFailure(
+        error.cause === undefined
+          ? new Error(error.message)
+          : new Error(error.message, { cause: error.cause }),
+      ),
+    ),
+  );
+
 function normalizeEnvPath(flagCwd: string, pathname: string, path: Path.Path) {
   return path.isAbsolute(pathname) ? pathname : path.resolve(flagCwd, pathname);
 }
@@ -528,10 +530,6 @@ function generateAsymmetricJwt(signingKey: SigningKeyJwk, role: string, now: num
   return `${data}.${signature}`;
 }
 
-// Native UTF-8 reads retain a leading BOM, which JSON and dotenv parsers reject.
-const readFileUtf8 = (fs: FileSystem.FileSystem, pathname: string) =>
-  fs.readFile(pathname).pipe(Effect.map((bytes) => Buffer.from(bytes).toString("utf8")));
-
 function parseSigningKeys(content: string): ReadonlyArray<SigningKeyJwk> {
   const decoded = JSON.parse(content);
   if (!Array.isArray(decoded)) {
@@ -781,66 +779,6 @@ export function buildFunctionsServeInspectArgs(
   ];
 }
 
-const readDotEnvFile = Effect.fnUntraced(function* (pathname: string, optional: boolean) {
-  const fs = yield* FileSystem.FileSystem;
-  const contents = yield* readFileUtf8(fs, pathname).pipe(
-    Effect.catch((error) =>
-      optional && Predicate.isTagged(error.reason, "NotFound")
-        ? Effect.void
-        : nativePlatformFailure(error, pathname),
-    ),
-    Effect.mapError((failure) =>
-      nativeFailure(
-        new Error(`failed to load environment file: ${pathname} (${failure.message})`, {
-          cause: failure.cause,
-        }),
-      ),
-    ),
-  );
-  if (contents === undefined) {
-    return {};
-  }
-  return yield* Effect.try({
-    try: () => parseDotEnv(contents),
-    catch: (cause) => nativeFailure(sanitizeDotEnvParseError(pathname, cause)),
-  });
-});
-
-const filterCustomEnv = Effect.fnUntraced(function* (env: Readonly<Record<string, string>>) {
-  const output = yield* Output;
-  const filtered: Array<[string, string]> = [];
-  for (const [name, value] of Object.entries(env)) {
-    if (name.startsWith("SUPABASE_")) {
-      yield* output.raw(`Env name cannot start with SUPABASE_, skipping: ${name}\n`, "stderr");
-      continue;
-    }
-    filtered.push([name, value]);
-  }
-  return Object.fromEntries(filtered);
-});
-
-const parseCustomEnvFile = Effect.fn("functions.serve.parseCustomEnv")(function* (
-  envFileFlag: Option.Option<string>,
-  projectRoot: string,
-  flagCwd: string,
-  configSecrets: Readonly<Record<string, string>>,
-) {
-  const path = yield* Path.Path;
-  const envFilePath = Option.match(envFileFlag, {
-    onNone: () => path.join(projectRoot, "supabase", "functions", ".env"),
-    onSome: (pathname) => normalizeEnvPath(flagCwd, pathname, path),
-  });
-  const parsed = yield* readDotEnvFile(envFilePath, Option.isNone(envFileFlag));
-  const filtered = yield* filterCustomEnv({ ...configSecrets, ...parsed });
-  return Object.entries(filtered).map(([name, value]) => `${name}=${value}`);
-});
-
-const parseFunctionEnvFile = Effect.fn("functions.serve.parseFunctionEnv")(function* (
-  pathname: string,
-) {
-  return yield* readDotEnvFile(pathname, true).pipe(Effect.flatMap(filterCustomEnv));
-});
-
 function toFunctionContainerConfig(
   workdir: string,
   config: ResolvedDeployFunctionConfig,
@@ -997,37 +935,6 @@ function validateDockerMultilineEnvNames(env: ReadonlyArray<readonly [string, st
   }
 }
 
-function sanitizeDotEnvParseError(path: string, cause: unknown) {
-  if (!(cause instanceof Error)) {
-    return new Error(`failed to parse environment file: ${path}`);
-  }
-  const message = cause.message;
-  if (message.startsWith('unexpected character "')) {
-    const prefix = 'unexpected character "';
-    const start = message.indexOf(prefix);
-    if (start !== -1) {
-      const charStart = start + prefix.length;
-      const charEnd = message.indexOf('"', charStart);
-      if (charEnd !== -1) {
-        const char = message.slice(charStart, charEnd);
-        return new Error(
-          `failed to parse environment file: ${path} (unexpected character '${char}' in variable name)`,
-        );
-      }
-    }
-    return new Error(
-      `failed to parse environment file: ${path} (unexpected character in variable name)`,
-    );
-  }
-  if (message.startsWith("unterminated quoted value")) {
-    return new Error(`failed to parse environment file: ${path} (unterminated quoted value)`);
-  }
-  if (message.includes("\n")) {
-    return new Error(`failed to parse environment file: ${path} (syntax error)`);
-  }
-  return new Error(`failed to load ${path}: ${message}`);
-}
-
 /**
  * Whether any bind mounts something at `containerPath` or below it, i.e. whether
  * that path exists inside the container. Docker creates a missing `--workdir`,
@@ -1205,6 +1112,42 @@ type ServeStartOutcome = Data.TaggedEnum<{
 }>;
 const ServeStartOutcome = Data.taggedEnum<ServeStartOutcome>();
 
+/** How a `functions serve` session ended, as recorded on the command's telemetry event. */
+export type ServeEndReason =
+  | "signal"
+  | "container_stopped"
+  | "container_exited"
+  | "container_removed"
+  | "container_crashed";
+
+const recordServeEnd = (reason: ServeEndReason, exitCode?: number) =>
+  Effect.andThen(
+    Effect.annotateCurrentSpan({
+      "functions.serve.end_reason": reason,
+      ...(exitCode === undefined ? {} : { "container.exit_code": exitCode }),
+    }),
+    recordCommandTelemetry({
+      [PropServeEndReason]: reason,
+      ...(exitCode === undefined ? {} : { [PropEdgeRuntimeExitCode]: exitCode }),
+    }),
+  );
+
+const recordContainerLogsEnd = (reason: ContainerLogsEndReason) =>
+  ContainerLogsEndReason.$match(reason, {
+    ContainerExited: () => recordServeEnd("container_exited", 0),
+    SupervisorTerminated: ({ exitCode }) => recordServeEnd("container_stopped", exitCode),
+    ContainerGone: () => recordServeEnd("container_removed"),
+  });
+
+// A log-stream failure over a clean or supervisor stop is the stream's failure, not a crash.
+const crashedContainerExitCode = (error: unknown): number | undefined => {
+  if (error instanceof EdgeRuntimeContainerCrashedError) return error.exitCode;
+  const exitCode = error instanceof DockerLogsStreamError ? error.containerExitCode : undefined;
+  return exitCode !== undefined && exitCode !== 0 && !externalTerminationExitCodes.has(exitCode)
+    ? exitCode
+    : undefined;
+};
+
 type Spawner = ChildProcessSpawner.ChildProcessSpawner["Service"];
 
 /**
@@ -1368,6 +1311,7 @@ const streamContainerLogs = Effect.fn("functions.serve.streamContainerLogs")(fun
       stderr: trimmedStderr,
       daemonDown: false,
       oomKilled: inspected.success.oomKilled,
+      containerExitCode: inspected.success.exitCode,
     });
   }
 });
@@ -1498,7 +1442,7 @@ const resolveServeFunctionConfigs = Effect.fn("functions.serve.resolveFunctionCo
   supabaseDir: string,
   config: Pick<
     ServeEdgeRuntimeContainerConfig,
-    "configDeclaredFunctions" | "configFunctions" | "rawConfigFunctions"
+    "configDeclaredFunctions" | "configFunctions" | "rawConfigFunctions" | "configPath"
   >,
   importMapOverride: Option.Option<string>,
   noVerifyJwtOverride: Option.Option<boolean>,
@@ -1517,6 +1461,7 @@ const resolveServeFunctionConfigs = Effect.fn("functions.serve.resolveFunctionCo
     importMapOverride,
     noVerifyJwtOverride,
     quiet,
+    configPath: config.configPath,
   });
 });
 
@@ -1543,7 +1488,7 @@ export const resolveFunctionBindMounts = Effect.fn("functions.resolveFunctionBin
     supabaseDir: string,
     config: Pick<
       ServeEdgeRuntimeContainerConfig,
-      "configDeclaredFunctions" | "configFunctions" | "rawConfigFunctions"
+      "configDeclaredFunctions" | "configFunctions" | "rawConfigFunctions" | "configPath"
     >,
     importMapOverride: Option.Option<string>,
     noVerifyJwtOverride: Option.Option<boolean>,
@@ -1700,7 +1645,9 @@ export const startEdgeRuntimeContainer = Effect.fn("functions.startEdgeRuntimeCo
       }
       const functionEnv =
         input.discoverFunctionEnvFiles && Option.isNone(input.envFile)
-          ? yield* parseFunctionEnvFile(path.join(functionsDir, config.slug, ".env"))
+          ? yield* resolveFunctionEnv({ functionsDir, slug: config.slug, warn: true }).pipe(
+              legacyEnvFailure,
+            )
           : {};
       functionsConfig[config.slug] = toFunctionContainerConfig(
         input.projectRoot,
@@ -1725,12 +1672,16 @@ export const startEdgeRuntimeContainer = Effect.fn("functions.startEdgeRuntimeCo
     yield* ensureDockerNetwork(networkMode, projectId);
 
     const env = [
-      ...(yield* parseCustomEnvFile(
-        input.envFile,
-        input.projectRoot,
-        input.flagCwd,
-        input.config.edgeRuntimeSecrets,
-      )),
+      ...Object.entries(
+        yield* resolveSharedFunctionsEnv({
+          secrets: input.config.edgeRuntimeSecrets,
+          functionsDir,
+          envFile: Option.map(input.envFile, (pathname) =>
+            normalizeEnvPath(input.flagCwd, pathname, path),
+          ),
+          warn: true,
+        }).pipe(legacyEnvFailure),
+      ).map(([name, value]) => `${name}=${value}`),
       "SUPABASE_URL=http://kong:8000",
       `SUPABASE_ANON_KEY=${input.authArtifacts.anonKey}`,
       `SUPABASE_SERVICE_ROLE_KEY=${input.authArtifacts.serviceRoleKey}`,
@@ -1944,6 +1895,7 @@ const startEdgeRuntime = Effect.fn("functions.serve.startEdgeRuntime")(function*
         configDeclaredFunctions: resolved.configDeclaredFunctions,
         configFunctions: resolved.configFunctions,
         rawConfigFunctions: resolved.rawConfigFunctions,
+        configPath: resolved.configPath,
       },
       authArtifacts,
       dbUrl: defaultServeDbUrl,
@@ -2047,7 +1999,11 @@ export const serveFunctions = Effect.fn("functions.serve")(function* (
       );
 
       const keepServing = yield* ServeStartOutcome.$match(startOutcome, {
-        Shutdown: () => writeStoppedServingMessage().pipe(Effect.as(false)),
+        Shutdown: () =>
+          recordServeEnd("signal").pipe(
+            Effect.andThen(writeStoppedServingMessage()),
+            Effect.as(false),
+          ),
         Started: ({ started }) =>
           Effect.gen(function* () {
             const outcome = yield* withShutdownGrace(
@@ -2068,6 +2024,12 @@ export const serveFunctions = Effect.fn("functions.serve")(function* (
               gracePeriod,
               () => ServeSessionOutcome.Shutdown(),
             ).pipe(
+              Effect.tapError((error) => {
+                const exitCode = crashedContainerExitCode(error);
+                return exitCode === undefined
+                  ? Effect.void
+                  : recordServeEnd("container_crashed", exitCode);
+              }),
               Effect.ensuring(
                 bestEffortRemoveContainer(started.containerId).pipe(
                   Effect.ensuring(started.cleanup),
@@ -2077,8 +2039,16 @@ export const serveFunctions = Effect.fn("functions.serve")(function* (
 
             return yield* ServeSessionOutcome.$match(outcome, {
               Restart: () => Effect.succeed(true),
-              Shutdown: () => writeStoppedServingMessage().pipe(Effect.as(false)),
-              Exited: ({ reason }) => writeContainerEndedMessage(reason).pipe(Effect.as(false)),
+              Shutdown: () =>
+                recordServeEnd("signal").pipe(
+                  Effect.andThen(writeStoppedServingMessage()),
+                  Effect.as(false),
+                ),
+              Exited: ({ reason }) =>
+                recordContainerLogsEnd(reason).pipe(
+                  Effect.andThen(writeContainerEndedMessage(reason)),
+                  Effect.as(false),
+                ),
             });
           }),
       });
diff --git a/apps/cli/src/shared/init/project-init.templates.ts b/apps/cli/src/shared/init/project-init.templates.ts
index 9a3a5e8f43..a11639e381 100644
--- a/apps/cli/src/shared/init/project-init.templates.ts
+++ b/apps/cli/src/shared/init/project-init.templates.ts
@@ -1,7 +1,9 @@
+import { CLI_CONFIG_SCHEMA_URL } from "@supabase/config";
 import { orioledbVersions, postgresMajor } from "@supabase/stack/internal/artifacts";
 import { postgresVersionCompare } from "../../command-internal/db-bootstrap/postgres.service.ts";
 
-const CONFIG_TEMPLATE_RAW = `# For detailed configuration reference documentation, visit:
+const CONFIG_TEMPLATE_RAW = `#:schema ${CLI_CONFIG_SCHEMA_URL}
+# For detailed configuration reference documentation, visit:
 # https://supabase.com/docs/guides/local-development/cli/config
 # A string used to distinguish different Supabase projects on the same host. Defaults to the
 # working directory name when running \`supabase init\`.
@@ -231,6 +233,9 @@ double_confirm_changes = true
 enable_confirmations = false
 # If enabled, users will need to reauthenticate or have logged in recently to change their password.
 secure_password_change = false
+# If enabled, users will need to provide their current password to change their password, unless
+# they signed in with a one-time password, magic link, or recovery link.
+# require_current_password = true
 # Controls the minimum amount of time that must pass before sending another signup confirmation or password reset email.
 max_frequency = "1s"
 # Number of characters used in the email OTP.
@@ -462,6 +467,9 @@ export const VSCODE_SETTINGS_TEMPLATE = `{
   ],
   "[typescript]": {
     "editor.defaultFormatter": "denoland.vscode-deno"
+  },
+  "json.schemaDownload.trustedDomains": {
+    "https://supabase.com/schemas/": true
   }
 }
 `;
diff --git a/apps/cli/src/shared/init/project-init.templates.unit.test.ts b/apps/cli/src/shared/init/project-init.templates.unit.test.ts
index e4e199fc26..d846e5eb6f 100644
--- a/apps/cli/src/shared/init/project-init.templates.unit.test.ts
+++ b/apps/cli/src/shared/init/project-init.templates.unit.test.ts
@@ -1,8 +1,16 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, FileSystem, Path } from "effect";
-import { applyConfigEdits, loadCliConfig, type ConfigEdit } from "@supabase/config/internal";
+import { Effect, FileSystem, Path, Predicate } from "effect";
+import { CLI_CONFIG_SCHEMA_URL, PROJECT_CONFIG_SCHEMA_URL } from "@supabase/config";
+import {
+  applyConfigEdits,
+  findUnknownCliConfigKeys,
+  loadCliConfig,
+  type ConfigEdit,
+} from "@supabase/config/internal";
+import * as SmolToml from "smol-toml";
 import { orioledbVersions, postgresMajor } from "@supabase/stack/internal/artifacts";
+import { cliConfigDocumentOnlyPaths } from "../../config/cli-config-keys.ts";
 import { postgresVersionCompare } from "../../command-internal/db-bootstrap/postgres.service.ts";
 import {
   INIT_GITIGNORE_TEMPLATE,
@@ -96,6 +104,12 @@ const NATIVE_SMS_SIGNUP_COMMENT = `# Allow/disallow the phone provider. When fal
 # To block new signups only, set enable_signup = false under [auth] instead.
 enabled = false`;
 
+/* Only the native template documents `require_current_password`. */
+const NATIVE_REQUIRE_CURRENT_PASSWORD = `secure_password_change = false
+# If enabled, users will need to provide their current password to change their password, unless
+# they signed in with a one-time password, magic link, or recovery link.
+# require_current_password = true`;
+
 const renderExpectedNativeEject = renderExpectedInitOutput.pipe(
   Effect.map((eject) =>
     eject
@@ -107,6 +121,7 @@ const renderExpectedNativeEject = renderExpectedInitOutput.pipe(
       .replace(SCAFFOLD_SIGNUP_COMMENT, NATIVE_SIGNUP_COMMENT)
       .replace(SCAFFOLD_EMAIL_SIGNUP_COMMENT, NATIVE_EMAIL_SIGNUP_COMMENT)
       .replace(SCAFFOLD_SMS_SIGNUP_COMMENT, NATIVE_SMS_SIGNUP_COMMENT)
+      .replace("secure_password_change = false", NATIVE_REQUIRE_CURRENT_PASSWORD)
       .replace("rows returns from", "rows returned from")
       .replace("(SIWS, EIP-4361)", "(SIWS)")
       .replace(
@@ -175,6 +190,39 @@ describe("project init templates", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
+  it("renders a config with no keys the schema does not recognize", () => {
+    for (const experimentalStack of [false, true]) {
+      for (const useOrioledb of [false, true]) {
+        const rendered = renderCliConfigTemplate("demo-project", useOrioledb, experimentalStack);
+        expect(findUnknownCliConfigKeys(SmolToml.parse(rendered))).toEqual([]);
+      }
+    }
+  });
+
+  it("renders optional commented-out sections that are all recognized once uncommented", () => {
+    const uncommentable = /^# (\[[\w.-]+\]|[\w.-]+ = .+)$/;
+    const isDocumentOnly = (key: ReadonlyArray<string>) => {
+      const dotted = key.join(".");
+      return [...cliConfigDocumentOnlyPaths].some(
+        (known) =>
+          known === dotted || known.startsWith(`${dotted}.`) || dotted.startsWith(`${known}.`),
+      );
+    };
+    for (const experimentalStack of [false, true]) {
+      const rendered = renderCliConfigTemplate("demo-project", false, experimentalStack);
+      const uncommented = rendered
+        .split("\n")
+        .map((line) => uncommentable.exec(line)?.[1] ?? line)
+        .join("\n");
+
+      expect(uncommented).toContain("[auth.passkey]");
+      expect(uncommented).toContain("[auth.webauthn]");
+      expect(
+        findUnknownCliConfigKeys(SmolToml.parse(uncommented)).filter((key) => !isDocumentOnly(key)),
+      ).toEqual([]);
+    }
+  });
+
   it("enables pg-delta by default in the generated config", () => {
     const rendered = renderCliConfigTemplate("demo-project", false);
     expect(rendered).toContain("[experimental.pgdelta]\nenabled = true");
@@ -219,6 +267,22 @@ describe("project init templates", () => {
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
+  it("trusts the hosted schema URLs in the VS Code settings", () => {
+    const settings: unknown = JSON.parse(VSCODE_SETTINGS_TEMPLATE);
+    const trustedDomains = Predicate.isObject(settings)
+      ? settings["json.schemaDownload.trustedDomains"]
+      : undefined;
+    const trusted = Predicate.isObject(trustedDomains)
+      ? Object.entries(trustedDomains)
+          .filter(([, enabled]) => enabled === true)
+          .map(([prefix]) => prefix)
+      : [];
+
+    for (const url of [CLI_CONFIG_SCHEMA_URL, PROJECT_CONFIG_SCHEMA_URL]) {
+      expect(trusted.some((prefix) => url.startsWith(prefix))).toBe(true);
+    }
+  });
+
   it.effect("matches the IntelliJ scaffold", () =>
     Effect.gen(function* () {
       expect(INTELLIJ_DENO_TEMPLATE).toBe(yield* readVendoredTemplate("idea-deno.xml"));
diff --git a/apps/cli/src/shared/init/project-init.ts b/apps/cli/src/shared/init/project-init.ts
index c707def433..72a440c99d 100644
--- a/apps/cli/src/shared/init/project-init.ts
+++ b/apps/cli/src/shared/init/project-init.ts
@@ -1,4 +1,5 @@
-import { Effect, FileSystem, Path, Schema } from "effect";
+import { Effect, FileSystem, Path, Predicate, Schema } from "effect";
+import { parseJsonc } from "@supabase/config/internal";
 import { promptYesNo } from "../../command-internal/prompt-yes-no.ts";
 import { sanitizeProjectId } from "../config/project-id.ts";
 import { Output } from "../output/output.service.ts";
@@ -12,88 +13,7 @@ import {
 } from "./project-init.templates.ts";
 import { InitParseSettingsError } from "./project-init.errors.ts";
 
-// Strips line and block comments and trailing commas while preserving
-// string contents, so an existing JSONC settings file parses correctly.
-function stripJsonComments(contents: string): string {
-  const src = contents.replace(/^\uFEFF/, "");
-  const out: Array<string> = [];
-  let pendingCommaIndex = -1;
-  let i = 0;
-  while (i < src.length) {
-    const char = src.charAt(i);
-
-    if (char === '"') {
-      pendingCommaIndex = -1;
-      out.push(char);
-      i++;
-      while (i < src.length) {
-        const stringChar = src.charAt(i);
-        out.push(stringChar);
-        i++;
-        if (stringChar === "\\") {
-          if (i < src.length) {
-            out.push(src.charAt(i));
-            i++;
-          }
-        } else if (stringChar === '"') {
-          break;
-        }
-      }
-      continue;
-    }
-
-    if (char === "/" && src.charAt(i + 1) === "/") {
-      i += 2;
-      while (i < src.length && src.charAt(i) !== "\n") {
-        i++;
-      }
-      continue;
-    }
-
-    if (char === "/" && src.charAt(i + 1) === "*") {
-      i += 2;
-      while (i < src.length && !(src.charAt(i) === "*" && src.charAt(i + 1) === "/")) {
-        i++;
-      }
-      i += 2;
-      continue;
-    }
-
-    // A comma is "trailing" if the next significant token is a closing brace or
-    // bracket; drop it in that case to match jsonc's trailing-comma handling.
-    if (char === ",") {
-      pendingCommaIndex = out.length;
-      out.push(char);
-      i++;
-      continue;
-    }
-
-    if (char === "}" || char === "]") {
-      if (pendingCommaIndex >= 0) {
-        out[pendingCommaIndex] = "";
-        pendingCommaIndex = -1;
-      }
-      out.push(char);
-      i++;
-      continue;
-    }
-
-    if (char === " " || char === "\t" || char === "\n" || char === "\r") {
-      out.push(char);
-      i++;
-      continue;
-    }
-
-    pendingCommaIndex = -1;
-    out.push(char);
-    i++;
-  }
-  return out.join("");
-}
-
-const decodeJsonObject = Schema.decodeUnknownEffect(
-  Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown)),
-);
+const decodeJsonObject = Schema.decodeUnknownEffect(Schema.Record(Schema.String, Schema.Unknown));
 
 const encodePrettyJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown, { space: 2 }));
 
@@ -101,13 +21,17 @@ const encodePrettyJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknow
 // as a typed `InitParseSettingsError` (never a fiber defect) and a
 // non-object document is rejected.
 function parseJsonObject(pathname: string, contents: string) {
-  return decodeJsonObject(stripJsonComments(contents)).pipe(
-    Effect.mapError(
-      (error) =>
-        new InitParseSettingsError({
-          detail: `Could not parse JSON in ${pathname}: ${error.message}`,
-          suggestion: `Fix or remove ${pathname}, then rerun \`supabase init\`.`,
-        }),
+  const parseFailure = (reason: string) =>
+    new InitParseSettingsError({
+      detail: `Could not parse JSON in ${pathname}: ${reason}`,
+      suggestion: `Fix or remove ${pathname}, then rerun \`supabase init\`.`,
+    });
+  return Effect.try({
+    try: () => parseJsonc(contents),
+    catch: (error) => parseFailure(error instanceof Error ? error.message : String(error)),
+  }).pipe(
+    Effect.flatMap((value) =>
+      decodeJsonObject(value).pipe(Effect.mapError((error) => parseFailure(error.message))),
     ),
   );
 }
@@ -144,6 +68,21 @@ function writeJsonFile(pathname: string, contents: Record<string, unknown>) {
   });
 }
 
+function mergeJsonObjects(
+  existing: Readonly<Record<string, unknown>>,
+  template: Readonly<Record<string, unknown>>,
+): Record<string, unknown> {
+  const merged: Record<string, unknown> = { ...existing };
+  for (const [key, value] of Object.entries(template)) {
+    const current = merged[key];
+    merged[key] =
+      Predicate.isObject(current) && Predicate.isObject(value)
+        ? mergeJsonObjects(current, value)
+        : value;
+  }
+  return merged;
+}
+
 function updateJsonFile(pathname: string, template: string) {
   return Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
@@ -159,10 +98,10 @@ function updateJsonFile(pathname: string, template: string) {
       return;
     }
 
-    const merged = {
-      ...(yield* parseJsonObject(pathname, existing)),
-      ...(yield* parseJsonObject(pathname, template)),
-    };
+    const merged = mergeJsonObjects(
+      yield* parseJsonObject(pathname, existing),
+      yield* parseJsonObject(pathname, template),
+    );
     yield* writeJsonFile(pathname, merged);
   });
 }
@@ -271,10 +210,12 @@ const ensureSupabaseGitignore = Effect.fnUntraced(function* (cwd: string) {
 /**
  * Scaffolds the local project files (config.toml, .gitignore, optional IDE
  * settings). This owns the mechanical filesystem work only — it does not
- * decide how an already-initialized project is reported. When
- * `config.toml` already exists and `force` is not set it short-circuits
- * with `created: false` and writes nothing, leaving the caller free to
- * treat that as a hard error or a graceful no-op.
+ * decide how an already-initialized project is reported. When a
+ * `config.json`, `config.jsonc` or `config.toml` already exists and `force` is
+ * not set it short-circuits with `created: false` and the existing file's path,
+ * leaving the caller free to treat that as a hard error or a graceful no-op.
+ * With `force`, the JSON files are removed once the fresh `config.toml` is
+ * written, so it is the one the loader reads.
  */
 export const initProject = Effect.fnUntraced(function* (options: ProjectInitOptions) {
   const fs = yield* FileSystem.FileSystem;
@@ -284,10 +225,16 @@ export const initProject = Effect.fnUntraced(function* (options: ProjectInitOpti
 
   const supabaseDir = path.join(options.cwd, "supabase");
   const configTomlPath = path.join(supabaseDir, "config.toml");
-  const existingToml = yield* fs.exists(configTomlPath);
+  const jsonConfigPaths = ["config.json", "config.jsonc"].map((name) =>
+    path.join(supabaseDir, name),
+  );
 
-  if (existingToml && !options.force) {
-    return { created: false, configPath: configTomlPath };
+  if (!options.force) {
+    for (const candidate of [...jsonConfigPaths, configTomlPath]) {
+      if (yield* fs.exists(candidate)) {
+        return { created: false, configPath: candidate };
+      }
+    }
   }
 
   const projectId = sanitizeProjectId(path.basename(options.cwd)) || "supabase";
@@ -298,6 +245,9 @@ export const initProject = Effect.fnUntraced(function* (options: ProjectInitOpti
     renderCliConfigTemplate(projectId, options.useOrioledb, options.experimentalStack === true),
     { mode: INIT_FILE_MODE },
   );
+  for (const jsonConfigPath of jsonConfigPaths) {
+    yield* fs.remove(jsonConfigPath, { force: true });
+  }
   yield* ensureSupabaseGitignore(options.cwd);
 
   // Requires text mode (json/stream-json stay payload-only and never scaffold
diff --git a/apps/cli/src/shared/init/testdata/templates/config.toml b/apps/cli/src/shared/init/testdata/templates/config.toml
index 9862194971..560346d2bd 100644
--- a/apps/cli/src/shared/init/testdata/templates/config.toml
+++ b/apps/cli/src/shared/init/testdata/templates/config.toml
@@ -1,3 +1,4 @@
+#:schema https://supabase.com/schemas/config/v1.json
 # For detailed configuration reference documentation, visit:
 # https://supabase.com/docs/guides/local-development/cli/config
 # A string used to distinguish different Supabase projects on the same host. Defaults to the
diff --git a/apps/cli/src/shared/init/testdata/templates/vscode-settings.json.golden b/apps/cli/src/shared/init/testdata/templates/vscode-settings.json.golden
index af62c23f88..d527025809 100644
--- a/apps/cli/src/shared/init/testdata/templates/vscode-settings.json.golden
+++ b/apps/cli/src/shared/init/testdata/templates/vscode-settings.json.golden
@@ -20,5 +20,8 @@
   ],
   "[typescript]": {
     "editor.defaultFormatter": "denoland.vscode-deno"
+  },
+  "json.schemaDownload.trustedDomains": {
+    "https://supabase.com/schemas/": true
   }
 }
diff --git a/apps/cli/src/shared/logs/request.ts b/apps/cli/src/shared/logs/request.ts
new file mode 100644
index 0000000000..1ff17b8b35
--- /dev/null
+++ b/apps/cli/src/shared/logs/request.ts
@@ -0,0 +1,16 @@
+import { operationDefinitions, type ApiClient } from "@supabase/api/effect";
+import { Effect } from "effect";
+
+export const requestLogs = Effect.fn("Logs.request")(function* (
+  api: ApiClient,
+  ref: string,
+  sql: string,
+  window: { readonly start: string; readonly end: string },
+) {
+  return yield* api.executeRaw(operationDefinitions.v1GetProjectLogs, {
+    ref,
+    sql,
+    iso_timestamp_start: window.start,
+    iso_timestamp_end: window.end,
+  });
+});
diff --git a/apps/cli/src/shared/output/json-formatter.ts b/apps/cli/src/shared/output/json-formatter.ts
index 78f671c717..d28ea05044 100644
--- a/apps/cli/src/shared/output/json-formatter.ts
+++ b/apps/cli/src/shared/output/json-formatter.ts
@@ -1,4 +1,5 @@
 import type { CliOutput, HelpDoc } from "effect/cli";
+import { withOptionalSubcommandUsage } from "./optional-subcommand-usage.ts";
 import { permissionSectionForHelp } from "../../command-internal/command-permissions/help-section.ts";
 import type { CliErrorSuggestionContext } from "../cli/subcommand-flag-suggestions.ts";
 import { cliErrorCode, formatCliErrorsForDisplay } from "../cli/subcommand-flag-suggestions.ts";
@@ -10,7 +11,9 @@ export function jsonCliOutputFormatter(context?: CliErrorSuggestionContext): Cli
       const scopes = subcommandScopes(doc, context?.rootCommand);
       const target = targetHelpFor(doc);
       const permissions = permissionSectionForHelp(doc);
-      const { annotations: _annotations, ...serializable } = withRemoteFlagValue(doc);
+      const { annotations: _annotations, ...serializable } = withOptionalSubcommandUsage(
+        withRemoteFlagValue(doc),
+      );
       return JSON.stringify({
         _tag: "Help",
         doc: {
diff --git a/apps/cli/src/shared/output/normalize-error.unit.test.ts b/apps/cli/src/shared/output/normalize-error.unit.test.ts
index 4699fbb685..72d35193f2 100644
--- a/apps/cli/src/shared/output/normalize-error.unit.test.ts
+++ b/apps/cli/src/shared/output/normalize-error.unit.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, test } from "vitest";
 import { Cause } from "effect";
 import { CliError, Command } from "effect/cli";
 import { CliConfigParseError, CliProjectEnvParseError } from "@supabase/config";
+import { JsoncSyntaxError } from "@supabase/config/internal";
 import { branchesCommand } from "../../commands/branches/branches.command.ts";
 import { networkRestrictionsCommand } from "../../commands/network-restrictions/network-restrictions.command.ts";
 import { ssoCommand } from "../../commands/sso/sso.command.ts";
@@ -54,6 +55,19 @@ describe("normalizeCliError", () => {
     });
   });
 
+  test("CliConfigParseError with a JSONC syntax cause names the reason, line and column", () => {
+    const error = new CliConfigParseError({
+      path: "supabase/config.jsonc",
+      format: "json",
+      cause: new JsoncSyntaxError("Value expected", 3, 17),
+    });
+
+    expect(normalizeCliError(error)).toEqual({
+      code: "CliConfigParseError",
+      message: "failed to parse supabase/config.jsonc: Value expected (line 3, column 17)",
+    });
+  });
+
   test("CliProjectEnvParseError falls back to its bare tag as both code and message", () => {
     const error = new CliProjectEnvParseError({
       path: "supabase/.env.local",
diff --git a/apps/cli/src/shared/output/optional-subcommand-usage.ts b/apps/cli/src/shared/output/optional-subcommand-usage.ts
new file mode 100644
index 0000000000..351c32132d
--- /dev/null
+++ b/apps/cli/src/shared/output/optional-subcommand-usage.ts
@@ -0,0 +1,16 @@
+import { Context, Option } from "effect";
+import type { HelpDoc } from "effect/cli";
+
+export class OptionalSubcommand extends Context.Service<OptionalSubcommand, boolean>()(
+  "supabase/OptionalSubcommand",
+) {}
+
+export const hasOptionalSubcommand = (command: {
+  readonly annotations: Context.Context<never>;
+}): boolean =>
+  Option.getOrElse(Context.getOption(command.annotations, OptionalSubcommand), () => false);
+
+export const withOptionalSubcommandUsage = (doc: HelpDoc.HelpDoc): HelpDoc.HelpDoc =>
+  hasOptionalSubcommand(doc)
+    ? { ...doc, usage: doc.usage.replace(" <subcommand>", " [subcommand]") }
+    : doc;
diff --git a/apps/cli/src/shared/output/output.layer.ts b/apps/cli/src/shared/output/output.layer.ts
index a848a05a76..6703f93178 100644
--- a/apps/cli/src/shared/output/output.layer.ts
+++ b/apps/cli/src/shared/output/output.layer.ts
@@ -22,6 +22,7 @@ import {
   Layer,
   Option,
   PlatformError,
+  References,
   Schema,
   Stdio,
   Stream,
@@ -89,8 +90,33 @@ const isBrokenPipe = (error: PlatformError.PlatformError): boolean => {
   );
 };
 
-// Keyed by the Stdio service so every output layer built on the same process streams sees a
-// stream close, including the layer that renders the run's final error.
+/* A direct write (clack's progress lines, `--debug`) can meet the closed pipe first and leave the
+   process stream errored, and the sink would then wait forever for `drain`. Bun sets `errored` a
+   tick after that write, so nothing may yield between this check and the sink's `error` listener. */
+export const writeStdio = (
+  stdio: typeof Stdio.Stdio.Service,
+  stream: "stdout" | "stderr",
+  chunk: string | Uint8Array,
+) =>
+  Effect.suspend(() => {
+    const errored = process[stream].errored;
+    if (errored !== null) {
+      return Effect.fail(
+        PlatformError.systemError({
+          module: "Stdio",
+          method: stream,
+          _tag: "Unknown",
+          cause: errored,
+        }),
+      );
+    }
+    return Stream.make(chunk).pipe(
+      Stream.run(stream === "stderr" ? stdio.stderr() : stdio.stdout()),
+    );
+  }).pipe(Effect.provideService(References.PreventSchedulerYield, true));
+
+/* Keyed by the Stdio service so output layers sharing one skip a stream any of them saw close.
+   Layers on another Stdio (run.ts builds the final-error layer on its own) see it via `errored`. */
 const closedStreams = new WeakMap<typeof Stdio.Stdio.Service, Set<"stdout" | "stderr">>();
 
 /**
@@ -108,8 +134,7 @@ const stdioWriter = (stdio: typeof Stdio.Stdio.Service) => {
     Effect.suspend(() =>
       closed.has(stream)
         ? Effect.void
-        : Stream.make(chunk).pipe(
-            Stream.run(stream === "stderr" ? stdio.stderr() : stdio.stdout()),
+        : writeStdio(stdio, stream, chunk).pipe(
             Effect.catchIf(isBrokenPipe, () =>
               Effect.sync(() => closed.add(stream)).pipe(
                 Effect.andThen(
diff --git a/apps/cli/src/shared/output/output.layer.unit.test.ts b/apps/cli/src/shared/output/output.layer.unit.test.ts
index a2dd3c9ec9..d648802385 100644
--- a/apps/cli/src/shared/output/output.layer.unit.test.ts
+++ b/apps/cli/src/shared/output/output.layer.unit.test.ts
@@ -10,6 +10,7 @@ import {
   Layer,
   Option,
   PlatformError,
+  Scheduler,
   Schema,
   Sink,
   Stdio,
@@ -17,7 +18,7 @@ import {
 } from "effect";
 import { TestClock } from "effect/testing";
 import { CONTEXT_CANCELED_MESSAGE, NonInteractiveError, StdoutClosedError } from "./errors.ts";
-import { mockTty } from "../../../tests/helpers/mocks.ts";
+import { epipe, mockTty, overrideStreamErrored } from "../../../tests/helpers/mocks.ts";
 import {
   announceTarget,
   CommandTarget,
@@ -846,6 +847,85 @@ describe("Output", () => {
       },
     );
 
+    it.effect("drops diagnostics once a direct write broke stderr", () => {
+      const stdio = mockStdio();
+      return Effect.gen(function* () {
+        yield* overrideStreamErrored(process.stderr, epipe);
+        const out = yield* Output;
+        yield* out.raw("diagnostic\n", "stderr");
+        yield* out.raw("payload\n");
+
+        expect(stdio.stderr).toEqual([]);
+        expect(stdio.stdout).toEqual(["payload\n"]);
+      }).pipe(provideLayer(stdio.layer));
+    });
+
+    it.effect("ends the command once a direct write broke stdout", () => {
+      const stdio = mockStdio();
+      return Effect.gen(function* () {
+        yield* overrideStreamErrored(process.stdout, epipe);
+        const out = yield* Output;
+        yield* out.raw("diagnostic\n", "stderr");
+        const exit = yield* Effect.exit(out.raw("payload\n"));
+
+        expect(Exit.isFailure(exit) && Cause.squash(exit.cause)).toBeInstanceOf(StdoutClosedError);
+        expect(stdio.stderr).toEqual(["diagnostic\n"]);
+        expect(stdio.stdout).toEqual([]);
+      }).pipe(provideLayer(stdio.layer));
+    });
+
+    it.effect("never yields between the stream check and the write", () => {
+      let inWindow = false;
+      let windows = 0;
+      let yieldChecks = 0;
+      let suspensions = 0;
+      const stdio = Layer.succeed(
+        Stdio.Stdio,
+        Stdio.make({
+          args: Effect.succeed([]),
+          stdin: Stream.empty,
+          stdout: () =>
+            Sink.forEach((_item: string | Uint8Array) =>
+              Effect.sync(() => {
+                inWindow = false;
+              }),
+            ),
+          stderr: () => Sink.drain,
+        }),
+      );
+      return Effect.gen(function* () {
+        yield* overrideStreamErrored(process.stdout, () => {
+          inWindow = true;
+          windows++;
+          /* Bun delivers the pending error in a microtask; it runs inside the window only if the
+             write suspends there. */
+          queueMicrotask(() => {
+            if (inWindow) suspensions++;
+          });
+          return null;
+        });
+        const scheduler = yield* Scheduler.Scheduler;
+        const out = yield* Output;
+        yield* out.raw("payload\n").pipe(
+          Effect.provideService(Scheduler.Scheduler, {
+            executionMode: scheduler.executionMode,
+            shouldYield: (fiber) => {
+              if (inWindow) yieldChecks++;
+              return scheduler.shouldYield(fiber);
+            },
+            makeDispatcher: () => scheduler.makeDispatcher(),
+          }),
+        );
+
+        expect({ windows, inWindow, yieldChecks, suspensions }).toEqual({
+          windows: 1,
+          inWindow: false,
+          yieldChecks: 0,
+          suspensions: 0,
+        });
+      }).pipe(provideLayer(stdio));
+    });
+
     it.effect("keeps writing stdout once the stderr reader has closed", () => {
       const stdio = brokenStdio("stderr", "EPIPE");
       return Effect.gen(function* () {
diff --git a/apps/cli/src/shared/output/text-formatter.ts b/apps/cli/src/shared/output/text-formatter.ts
index 514e2f51f1..e3527a0da6 100644
--- a/apps/cli/src/shared/output/text-formatter.ts
+++ b/apps/cli/src/shared/output/text-formatter.ts
@@ -1,4 +1,5 @@
 import { CliOutput } from "effect/cli";
+import { withOptionalSubcommandUsage } from "./optional-subcommand-usage.ts";
 import {
   permissionSectionForHelp,
   renderPermissionsSection,
@@ -29,7 +30,9 @@ export function textCliOutputFormatter(context?: CliErrorSuggestionContext): Cli
     ...base,
     formatHelpDoc: (doc) => {
       const text = base.formatHelpDoc(
-        withRemoteFlagUsage(labelSubcommands(doc, context?.rootCommand)),
+        withOptionalSubcommandUsage(
+          withRemoteFlagUsage(labelSubcommands(doc, context?.rootCommand)),
+        ),
       );
       const target = targetHelpFor(doc);
       const withTarget =
diff --git a/apps/cli/src/shared/output/text-formatter.unit.test.ts b/apps/cli/src/shared/output/text-formatter.unit.test.ts
index fce9fd5e27..75f2aaaa02 100644
--- a/apps/cli/src/shared/output/text-formatter.unit.test.ts
+++ b/apps/cli/src/shared/output/text-formatter.unit.test.ts
@@ -1,11 +1,27 @@
 import { CliError, Command } from "effect/cli";
 import { describe, expect, it } from "vitest";
+import { helpDocFor } from "../cli/subcommand-flag-suggestions.ts";
+import { logsCommandFor } from "../../commands/logs/logs.command.ts";
+import { jsonCliOutputFormatter } from "./json-formatter.ts";
 import { ssoCommand } from "../../commands/sso/sso.command.ts";
 import { textCliOutputFormatter } from "./text-formatter.ts";
 
 const testRoot = Command.make("supabase").pipe(Command.withSubcommands([ssoCommand]));
 
 describe("textCliOutputFormatter", () => {
+  it.each([textCliOutputFormatter, jsonCliOutputFormatter])(
+    "shows the logs subcommand as optional while preserving required command groups",
+    (makeFormatter) => {
+      const formatter = makeFormatter();
+      const logsDoc = helpDocFor(logsCommandFor(), ["supabase", "logs"]);
+      const groupDoc = helpDocFor(ssoCommand, ["supabase", "sso"]);
+      if (logsDoc === undefined || groupDoc === undefined) throw new Error("Missing command help");
+      expect(formatter.formatHelpDoc(logsDoc)).toContain("supabase logs [subcommand] [flags]");
+      expect(formatter.formatHelpDoc(logsDoc)).toContain("sources");
+      expect(formatter.formatHelpDoc(groupDoc)).toContain("supabase sso <subcommand> [flags]");
+    },
+  );
+
   it("preserves default parser suggestions for unchanged errors", () => {
     const formatter = textCliOutputFormatter();
 
diff --git a/apps/cli/src/shared/output/types.ts b/apps/cli/src/shared/output/types.ts
index c9ccfdaf2c..2eaf712c48 100644
--- a/apps/cli/src/shared/output/types.ts
+++ b/apps/cli/src/shared/output/types.ts
@@ -1,3 +1,5 @@
+import type { Schema } from "effect";
+
 export type OutputFormat = "text" | "json" | "stream-json";
 
 export type StreamEvent =
@@ -15,6 +17,7 @@ export type StreamEvent =
       readonly stream: "stdout" | "stderr" | "internal";
       readonly line: string;
       readonly source: "history" | "live";
+      readonly data?: Schema.JsonObject;
     }
   | {
       readonly type: "log-marker";
@@ -25,6 +28,7 @@ export type StreamEvent =
       readonly stream?: "stdout" | "stderr";
       readonly count?: number;
       readonly source: "history" | "live";
+      readonly data?: Schema.JsonObject;
     }
   | {
       readonly type: "result";
diff --git a/apps/cli/src/shared/runtime/command-runtime.layer.ts b/apps/cli/src/shared/runtime/command-runtime.layer.ts
index 5969006dde..be39f7fca6 100644
--- a/apps/cli/src/shared/runtime/command-runtime.layer.ts
+++ b/apps/cli/src/shared/runtime/command-runtime.layer.ts
@@ -1,14 +1,15 @@
-import { Crypto, Effect, Layer } from "effect";
+import { Effect, Layer } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { CommandRuntime } from "./command-runtime.service.ts";
 
 export const commandRuntimeLayer = (commandPath: ReadonlyArray<string>) =>
   Layer.effect(
     CommandRuntime,
     Effect.gen(function* () {
-      const crypto = yield* Crypto.Crypto;
+      const crypto = yield* SecureRandom.SecureRandom;
       return CommandRuntime.of({
         commandPath: [...commandPath],
-        commandRunId: yield* crypto.randomUUIDv4,
+        commandRunId: yield* crypto.uuidV4(),
       });
     }),
   );
diff --git a/apps/cli/src/shared/runtime/tty.layer.ts b/apps/cli/src/shared/runtime/tty.layer.ts
index febaca7061..0b8246346f 100644
--- a/apps/cli/src/shared/runtime/tty.layer.ts
+++ b/apps/cli/src/shared/runtime/tty.layer.ts
@@ -12,6 +12,7 @@ export const ttyLayer = Layer.effect(
       Tty.of({
         stdinIsTty: !!process.stdin.isTTY,
         stdoutIsTty: !!process.stdout.isTTY,
+        stdoutColumns: process.stdout.columns,
         stdoutIsPipe,
       }),
     ),
diff --git a/apps/cli/src/shared/runtime/tty.service.ts b/apps/cli/src/shared/runtime/tty.service.ts
index aa1e3373fc..f9cecf6e05 100644
--- a/apps/cli/src/shared/runtime/tty.service.ts
+++ b/apps/cli/src/shared/runtime/tty.service.ts
@@ -3,6 +3,7 @@ import { Context } from "effect";
 interface TtyShape {
   readonly stdinIsTty: boolean;
   readonly stdoutIsTty: boolean;
+  readonly stdoutColumns?: number;
   /**
    * fd 1 is a FIFO per fstat — the signal for the Windows piped-dump warning
    * (PowerShell `>`/`|` interpose one). False on fstat errors and for non-FIFO
diff --git a/apps/cli/src/shared/services/Dockerfile b/apps/cli/src/shared/services/Dockerfile
index 0134b90fc6..2fc80e16fd 100644
--- a/apps/cli/src/shared/services/Dockerfile
+++ b/apps/cli/src/shared/services/Dockerfile
@@ -5,9 +5,9 @@
 # a catalog update. Everything else in this file (this comment, kong, pg14, the one-shot job
 # images) is hand- or Dependabot-managed. Keep a line between image lines: git conflicts on edits to
 # adjacent lines, and catalog PRs for neighbouring aliases are often open at the same time.
-FROM supabase/postgres:17.11.0.011 AS pg
+FROM supabase/postgres:17.11.0.018 AS pg
 
-FROM supabase/postgres:15.19.0.016 AS pg15
+FROM supabase/postgres:15.19.0.018 AS pg15
 # Postgres 14 has no slim build; bumped by hand (Dependabot ignores supabase/postgres).
 FROM supabase/postgres:14.1.0.89 AS pg14
 # New always-on service alias: extend SERVICE_IMAGE_ALIASES in
@@ -21,21 +21,21 @@ FROM postgrest/postgrest:v16.5 AS postgrest
 
 FROM supabase/postgres-meta:v0.100.0 AS pgmeta
 
-FROM supabase/studio:2026.11.02-sha-a05e7ec AS studio
+FROM supabase/studio:2026.11.09-sha-1567384 AS studio
 
 FROM darthsim/imgproxy:v3.26.0 AS imgproxy
 
-FROM supabase/edge-runtime:v1.77.9 AS edgeruntime
+FROM supabase/edge-runtime:v1.78.1 AS edgeruntime
 
 FROM timberio/vector:0.58.0-alpine AS vector
 
-FROM supabase/supavisor:2.9.13 AS supavisor
+FROM supabase/supavisor:2.10.0 AS supavisor
 
 FROM supabase/gotrue:v2.197.0 AS gotrue
 
-FROM supabase/realtime:v2.151.3 AS realtime
+FROM supabase/realtime:v2.154.0 AS realtime
 
-FROM supabase/storage-api:v1.88.0 AS storage
+FROM supabase/storage-api:v1.90.1 AS storage
 
 FROM supabase/logflare:1.50.15 AS logflare
 # One-shot job images (not started as long-running containers); differ's alias
diff --git a/apps/cli/src/shared/services/services.shared.ts b/apps/cli/src/shared/services/services.shared.ts
index 297c675921..810f331e2b 100644
--- a/apps/cli/src/shared/services/services.shared.ts
+++ b/apps/cli/src/shared/services/services.shared.ts
@@ -267,6 +267,7 @@ export interface ServiceFetchConfig {
   readonly headers?: Readonly<Record<string, string | undefined>>;
   readonly api?: ApiClient;
   readonly tenantBaseUrlOverride?: string;
+  readonly maxRetries?: number;
 }
 
 /** @public */
@@ -445,12 +446,15 @@ const makeConfiguredApiClient = Effect.fn("Services.buildApiClient")(function* (
 ) {
   return (
     input.api ??
-    (yield* makeApiClient({
-      baseUrl: input.apiUrl,
-      accessToken: input.accessToken,
-      userAgent: input.userAgent,
-      headers: input.headers,
-    }))
+    (yield* makeApiClient(
+      {
+        baseUrl: input.apiUrl,
+        accessToken: input.accessToken,
+        userAgent: input.userAgent,
+        headers: input.headers,
+      },
+      { retry: { maxRetries: input.maxRetries } },
+    ))
   );
 });
 
diff --git a/apps/cli/src/shared/stack-constants.ts b/apps/cli/src/shared/stack-constants.ts
index 2ce4b81353..45bffd4745 100644
--- a/apps/cli/src/shared/stack-constants.ts
+++ b/apps/cli/src/shared/stack-constants.ts
@@ -1,3 +1,4 @@
+import { DOCKER_DAEMON_CONNECTION_FAILURE_PATTERN } from "../command-internal/docker-suggest.ts";
 import {
   DEFAULT_LOCAL_JWT_SECRET,
   DEFAULT_LOCAL_PUBLISHABLE_KEY,
@@ -48,5 +49,6 @@ export const edgeRuntimeNofileUlimit = (
 };
 
 export const isDockerDaemonDownMessage = (message: string): boolean =>
-  /docker|container engine|daemon/i.test(message) &&
-  /not running|unavailable|cannot connect|down/i.test(message);
+  (/docker|container engine|daemon/i.test(message) &&
+    /not running|unavailable|cannot connect|down/i.test(message)) ||
+  DOCKER_DAEMON_CONNECTION_FAILURE_PATTERN.test(message);
diff --git a/apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt b/apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt
index a6c3fdeac1..6e1d61ac18 100644
--- a/apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt
+++ b/apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt
@@ -1,4 +1,5 @@
 AccessTokenRequiredError
+ApiMaxRetriesError
 BackupListNetworkError
 BackupListUnexpectedStatusError
 BackupRestoreNetworkError
@@ -37,11 +38,13 @@ BranchesUnpauseNetworkError
 BranchesUnpauseUnexpectedStatusError
 BranchesUpdateNetworkError
 BranchesUpdateUnexpectedStatusError
+CliConfigFileConflictError
 CliConfigFlagConflictError
 CliConfigLoadError
 CliConfigParseError
 CliConfigRemovedEnvError
 CliConfigRemovedKeyError
+CliConfigSchemaVersionError
 CliConfigValueError
 CliConfigWriteError
 CliProjectEnvParseError
@@ -56,7 +59,6 @@ ComputeConfigWriteUnsafeError
 ComputeDirectoryExistsError
 ComputeEnvNotSupportedError
 ComputeFollowNotSupportedError
-ComputeJsonConfigUnsupportedError
 ComputeLogsQueryFailedError
 ComputeLogsRateLimitedError
 ComputeLogsUsageExceededError
@@ -132,6 +134,7 @@ DbConfigLibpqEnvError
 DbConfigListBansNetworkError
 DbConfigListBansStatusError
 DbConfigLoadError
+DbConfigLoginRoleMissingPrivilegedRoleError
 DbConfigLoginRoleNetworkError
 DbConfigLoginRoleStatusError
 DbConfigParseUrlError
@@ -237,6 +240,7 @@ FunctionImportNotDirectoryError
 FunctionNotFoundError
 FunctionsApiStatusError
 FunctionsApiTransportError
+FunctionsEnvError
 FunctionsEnvNotSupportedError
 FunctionsListNetworkError
 FunctionsListUnexpectedStatusError
@@ -283,6 +287,7 @@ InitConfigExistsError
 InitParseSettingsError
 InspectCsvqError
 InspectReportMkdirError
+InspectReportOutputFlagUnsupportedError
 InspectReportWriteError
 InvalidAccessTokenError
 InvalidComputeExcludeError
@@ -321,6 +326,9 @@ LoginMissingTokenError
 LoginSaveTokenError
 LoginVerificationError
 LogoutCancelledError
+LogsApiError
+LogsClipboardError
+LogsInputError
 MigraDiffError
 MigraSchemaLoadError
 MigrationApplyError
@@ -496,7 +504,6 @@ StackArtifactSelectionError
 StackBootstrapError
 StackCatalogSetupError
 StackConfigError
-StackFunctionsEnvError
 StackNativeEngineError
 StackRoutingError
 StackRuntimeSelectionError
diff --git a/apps/cli/src/shared/telemetry/consent.integration.test.ts b/apps/cli/src/shared/telemetry/consent.integration.test.ts
index 436c04aacc..4350a84d0e 100644
--- a/apps/cli/src/shared/telemetry/consent.integration.test.ts
+++ b/apps/cli/src/shared/telemetry/consent.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -99,7 +99,7 @@ describe("writeTelemetryConfig", () => {
         ),
       ).toEqual(config);
       expect(yield* temporaryFiles(dir)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("cleans the temporary file when cancelled during replacement backoff", () =>
@@ -121,7 +121,7 @@ describe("writeTelemetryConfig", () => {
       yield* Fiber.interrupt(publishing);
       expect(yield* fs.readFileString(configPath)).toBe("previous config");
       expect(yield* temporaryFiles(dir)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("preserves the normalized platform error when retries exhaust", () =>
@@ -172,7 +172,7 @@ describe("writeTelemetryConfig", () => {
       expect(yield* Ref.get(calls)).toBe(13);
       expect(yield* fs.readFileString(configPath)).toBe("previous config");
       expect(yield* temporaryFiles(dir)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("does not retry unrelated errors or failures on another platform", () =>
@@ -199,7 +199,7 @@ describe("writeTelemetryConfig", () => {
         expect(yield* fs.readFileString(configPath)).toBe("previous config");
         expect(yield* temporaryFiles(dir)).toEqual([]);
       }
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("removes a partially written temporary file when writing fails", () =>
@@ -221,6 +221,6 @@ describe("writeTelemetryConfig", () => {
       expect(Exit.isFailure(result)).toBe(true);
       expect(yield* fs.readFileString(configPath)).toBe("previous config");
       expect(yield* temporaryFiles(dir)).toEqual([]);
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 });
diff --git a/apps/cli/src/shared/telemetry/consent.ts b/apps/cli/src/shared/telemetry/consent.ts
index b5f98360f7..798372c651 100644
--- a/apps/cli/src/shared/telemetry/consent.ts
+++ b/apps/cli/src/shared/telemetry/consent.ts
@@ -1,5 +1,4 @@
 import {
-  Crypto,
   Duration,
   Effect,
   FileSystem,
@@ -10,6 +9,7 @@ import {
   Schedule,
   Schema,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { CliSettings } from "../config/cli-settings.service.ts";
 import {
   type ConsentState,
@@ -89,7 +89,7 @@ export const writeTelemetryConfig = Effect.fnUntraced(function* (
   configDir: string,
   platform: NodeJS.Platform = process.platform,
 ) {
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   yield* fs.makeDirectory(configDir, { recursive: true, mode: 0o700 });
@@ -97,7 +97,7 @@ export const writeTelemetryConfig = Effect.fnUntraced(function* (
   // Random suffix, not a timestamp: concurrent writers (parallel test files,
   // two CLI processes) in the same millisecond would otherwise share a tmp
   // path and race the rename into ENOENT.
-  const tmpPath = `${configPath}.tmp.${yield* crypto.randomUUIDv4}`;
+  const tmpPath = `${configPath}.tmp.${yield* crypto.uuidV4()}`;
   const retrySchedule = Schedule.exponential("10 millis", 2).pipe(
     Schedule.modifyDelay(({ duration }) =>
       Effect.succeed(Duration.min(duration, Duration.millis(100))),
diff --git a/apps/cli/src/shared/telemetry/error-actionability.ts b/apps/cli/src/shared/telemetry/error-actionability.ts
index 592ba9800a..d5a8c3cd02 100644
--- a/apps/cli/src/shared/telemetry/error-actionability.ts
+++ b/apps/cli/src/shared/telemetry/error-actionability.ts
@@ -953,6 +953,7 @@ const effectCliActionabilityByTag = {
   InvalidValue: () => actionability.invalidInput,
   UnknownSubcommand: () => actionability.invalidInput,
   UnrecognizedOption: () => actionability.invalidInput,
+  ValidationError: () => actionability.invalidInput,
 } satisfies Record<EffectCliAdapterTag, ErrorActionabilityAdapter>;
 
 const externalActionabilityByTag: Record<string, ErrorActionabilityAdapter> = {
@@ -985,7 +986,9 @@ const externalActionabilityByTag: Record<string, ErrorActionabilityAdapter> = {
 
   // @supabase/config
   CliConfigParseError: () => actionability.invalidConfig,
+  CliConfigFileConflictError: () => actionability.invalidConfig,
   CliConfigRemovedKeyError: () => actionability.invalidConfig,
+  CliConfigSchemaVersionError: () => actionability.invalidConfig,
   CliProjectEnvParseError: () => actionability.invalidConfig,
   DuplicateRemoteProjectIdError: () => actionability.invalidConfig,
   InvalidRemoteProjectIdError: () => actionability.invalidConfig,
diff --git a/apps/cli/src/shared/telemetry/event-catalog.ts b/apps/cli/src/shared/telemetry/event-catalog.ts
index 3ffd96ba15..cfd281e979 100644
--- a/apps/cli/src/shared/telemetry/event-catalog.ts
+++ b/apps/cli/src/shared/telemetry/event-catalog.ts
@@ -45,6 +45,12 @@ export const PropStackBackend = "stack_backend";
 export const PropOrioleDb = "orioledb";
 // Set only once a stack-backend command resolves its stack's runtime.
 export const PropStackRuntime = "stack_runtime";
+// Set only on failures classified `invalid_config` whose config key is known.
+export const PropConfigKey = "config_key";
+// Set only once `functions serve` on the Docker runtime reaches its final outcome.
+export const PropServeEndReason = "serve_end_reason";
+// Set only when the Edge Runtime container's exit code is known at that outcome.
+export const PropEdgeRuntimeExitCode = "edge_runtime_exit_code";
 // Reserved for a closed workflow label; nothing emits it until a closed
 // vocabulary is agreed (tests assert its absence on failure events).
 export const PropWorkflow = "workflow";
@@ -103,6 +109,7 @@ export const EnvSignalPresenceKeys: ReadonlyArray<string> = [
 export const EnvSignalValueKeys: ReadonlyArray<string> = [
   "AI_AGENT",
   "CURSOR_EXTENSION_HOST_ROLE",
+  "SUPABASE_API_MAX_RETRIES",
   "TERM",
   "TERM_PROGRAM",
   "TERM_PROGRAM_VERSION",
diff --git a/apps/cli/src/shared/telemetry/exporters/debug-console.unit.test.ts b/apps/cli/src/shared/telemetry/exporters/debug-console.unit.test.ts
index f9cd025c8a..b99a142788 100644
--- a/apps/cli/src/shared/telemetry/exporters/debug-console.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/exporters/debug-console.unit.test.ts
@@ -1,10 +1,10 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Clock, Context, Effect, Exit, Option, Schema, Tracer } from "effect";
 import { makeTraceSanitizer } from "../trace-sanitize.ts";
 import { formatSpanForDebugConsole, makeDebugConsoleExporter } from "./debug-console.ts";
 
-const sanitizer = makeTraceSanitizer.pipe(Effect.provide(BunServices.layer));
+const sanitizer = makeTraceSanitizer.pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 
 const makeEndedSpan = (name: string, attrs: Record<string, unknown> = {}) =>
   Effect.map(Clock.currentTimeMillis, (now): Tracer.Span => {
diff --git a/apps/cli/src/shared/telemetry/identity.ts b/apps/cli/src/shared/telemetry/identity.ts
index 592ce0944d..5720f58edd 100644
--- a/apps/cli/src/shared/telemetry/identity.ts
+++ b/apps/cli/src/shared/telemetry/identity.ts
@@ -1,19 +1,20 @@
-import { Clock, Crypto, Effect, Option } from "effect";
+import { Clock, Effect, Option } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { readTelemetryConfig, writeTelemetryConfig } from "./consent.ts";
 import type { TelemetryConfig } from "./types.ts";
 
 const SESSION_TIMEOUT_MS = 30 * 60 * 1000;
 
 export const resolveIdentity = Effect.fnUntraced(function* (configDir: string) {
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const config = yield* readTelemetryConfig(configDir);
   const now = yield* Clock.currentTimeMillis;
 
   if (Option.isNone(config)) {
     const newConfig: TelemetryConfig = {
       consent: "granted",
-      device_id: yield* crypto.randomUUIDv4,
-      session_id: yield* crypto.randomUUIDv4,
+      device_id: yield* crypto.uuidV4(),
+      session_id: yield* crypto.uuidV4(),
       session_last_active: now,
     };
     yield* writeTelemetryConfig(newConfig, configDir);
@@ -27,7 +28,7 @@ export const resolveIdentity = Effect.fnUntraced(function* (configDir: string) {
 
   const currentConfig = config.value;
   const isSessionExpired = now - currentConfig.session_last_active > SESSION_TIMEOUT_MS;
-  const sessionId = isSessionExpired ? yield* crypto.randomUUIDv4 : currentConfig.session_id;
+  const sessionId = isSessionExpired ? yield* crypto.uuidV4() : currentConfig.session_id;
 
   yield* writeTelemetryConfig(
     { ...currentConfig, session_id: sessionId, session_last_active: now },
@@ -87,7 +88,7 @@ export function makeTelemetryIdentity(persisted: string | undefined): TelemetryI
  * aliases a fresh device.
  */
 export const resetIdentity = Effect.fnUntraced(function* (configDir: string) {
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const identity = yield* resolveIdentity(configDir);
   const config = yield* readTelemetryConfig(configDir);
   const nextConfig: TelemetryConfig = {
@@ -95,7 +96,7 @@ export const resetIdentity = Effect.fnUntraced(function* (configDir: string) {
       onNone: () => "granted",
       onSome: (value) => value.consent,
     }),
-    device_id: yield* crypto.randomUUIDv4,
+    device_id: yield* crypto.uuidV4(),
     session_id: identity.sessionId,
     session_last_active: yield* Clock.currentTimeMillis,
   };
diff --git a/apps/cli/src/shared/telemetry/identity.unit.test.ts b/apps/cli/src/shared/telemetry/identity.unit.test.ts
index 0a4889301e..9a48766ae2 100644
--- a/apps/cli/src/shared/telemetry/identity.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/identity.unit.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
-import { Clock, Effect, FileSystem, Path, Schema } from "effect";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
+import { Clock, Effect, FileSystem, Layer, Path, Schema } from "effect";
 import { useTempWorkdir } from "../../../tests/helpers/command-mocks.ts";
 import { makeTelemetryIdentity, resetIdentity, resolveIdentity } from "./identity.ts";
 import { TelemetryConfigSchema, type TelemetryConfig } from "./types.ts";
@@ -28,7 +28,7 @@ const readConfig = (dir: string) =>
     return yield* Schema.decodeEffect(TelemetryConfigJson)(content);
   });
 
-const fsLayer = BunServices.layer;
+const fsLayer = Layer.merge(BunServices.layer, BunCrypto.layer);
 
 const tempRoot = useTempWorkdir("supabase-identity-test-");
 
diff --git a/apps/cli/src/shared/telemetry/otlp-trace-sink.ts b/apps/cli/src/shared/telemetry/otlp-trace-sink.ts
index 28faf6163e..df16285f89 100644
--- a/apps/cli/src/shared/telemetry/otlp-trace-sink.ts
+++ b/apps/cli/src/shared/telemetry/otlp-trace-sink.ts
@@ -9,7 +9,8 @@ import {
   Redacted,
   Semaphore,
 } from "effect";
-import type { Crypto, Scope, Tracer } from "effect";
+import type { Scope, Tracer } from "effect";
+import type { SecureRandom } from "effect/crypto";
 import { FetchHttpClient, HttpBody, HttpClient, HttpClientResponse } from "effect/http";
 import * as OtlpExporter from "effect/observability/OtlpExporter";
 import * as OtlpSerialization from "effect/observability/OtlpSerialization";
@@ -42,7 +43,11 @@ export const makeOtlpTracer = (options: {
   readonly url: string;
   readonly headers: Redacted.Redacted<Readonly<Record<string, string>>>;
   readonly resource: OtlpTraceResource;
-}): Effect.Effect<Tracer.Tracer, never, HttpClient.HttpClient | Crypto.Crypto | Scope.Scope> =>
+}): Effect.Effect<
+  Tracer.Tracer,
+  never,
+  HttpClient.HttpClient | SecureRandom.SecureRandom | Scope.Scope
+> =>
   OtlpTracer.make({
     url: options.url,
     headers: Redacted.value(options.headers),
diff --git a/apps/cli/src/shared/telemetry/runtime.layer.ts b/apps/cli/src/shared/telemetry/runtime.layer.ts
index 6c07ca5b41..b7fbfde04f 100644
--- a/apps/cli/src/shared/telemetry/runtime.layer.ts
+++ b/apps/cli/src/shared/telemetry/runtime.layer.ts
@@ -1,5 +1,6 @@
 import { note } from "@clack/prompts";
-import { Config, Crypto, Effect, Layer, Option } from "effect";
+import { Config, Effect, Layer, Option } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { CLI_VERSION } from "../cli/version.ts";
 import { RuntimeInfo } from "../runtime/runtime-info.service.ts";
 import { Tty } from "../runtime/tty.service.ts";
@@ -20,7 +21,7 @@ export const detectCi = Effect.gen(function* () {
 export const telemetryRuntimeLayer = Layer.effect(
   TelemetryRuntime,
   Effect.gen(function* () {
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
     const configDir = yield* getConfigDir;
     const tty = yield* Tty;
     const runtimeInfo = yield* RuntimeInfo;
@@ -55,8 +56,8 @@ export const telemetryRuntimeLayer = Layer.effect(
         };
       } else {
         identity = {
-          deviceId: yield* crypto.randomUUIDv4,
-          sessionId: yield* crypto.randomUUIDv4,
+          deviceId: yield* crypto.uuidV4(),
+          sessionId: yield* crypto.uuidV4(),
           distinctId: undefined,
           isFirstRun: false,
         };
diff --git a/apps/cli/src/shared/telemetry/runtime.layer.unit.test.ts b/apps/cli/src/shared/telemetry/runtime.layer.unit.test.ts
index 1715c83bf1..1b7cfe6b26 100644
--- a/apps/cli/src/shared/telemetry/runtime.layer.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/runtime.layer.unit.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import {
   Config,
   ConfigProvider,
@@ -59,7 +59,7 @@ function buildLayer(opts: {
     Layer.provide(configLayer),
     Layer.provide(runtimeInfoLayer),
     Layer.provide(ttyLayer),
-    Layer.provide(BunServices.layer),
+    Layer.provide([BunServices.layer, BunCrypto.layer]),
     Layer.provide(providerLayer),
   );
 
diff --git a/apps/cli/src/shared/telemetry/trace-export.integration.test.ts b/apps/cli/src/shared/telemetry/trace-export.integration.test.ts
index 1bea2ae639..e9c0d16ac5 100644
--- a/apps/cli/src/shared/telemetry/trace-export.integration.test.ts
+++ b/apps/cli/src/shared/telemetry/trace-export.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import {
   ConfigProvider,
@@ -74,7 +74,7 @@ const spansOf = (
 
 const traceFilePath = Effect.map(Path.Path, (path) => path.join(tempRoot.current, "trace.jsonl"));
 
-const runtime = Layer.mergeAll(mockRuntimeInfo(), BunServices.layer);
+const runtime = Layer.mergeAll(mockRuntimeInfo(), BunServices.layer, BunCrypto.layer);
 
 describe("withTraceExport with a trace file", () => {
   it.live("creates the file with owner-only permissions and writes one line per batch", () =>
diff --git a/apps/cli/src/shared/telemetry/trace-export.layer.ts b/apps/cli/src/shared/telemetry/trace-export.layer.ts
index 3144736c7d..715e5b7839 100644
--- a/apps/cli/src/shared/telemetry/trace-export.layer.ts
+++ b/apps/cli/src/shared/telemetry/trace-export.layer.ts
@@ -1,7 +1,6 @@
 import {
   Cause,
   Config,
-  Crypto,
   Duration,
   Effect,
   Exit,
@@ -15,12 +14,13 @@ import {
   Redacted,
   Scope,
   Stdio,
-  Stream,
   Tracer,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { Headers, HttpTraceContext } from "effect/http";
 import { CLI_VERSION } from "../cli/version.ts";
 import { CliSettings } from "../config/cli-settings.service.ts";
+import { writeStdio } from "../output/output.layer.ts";
 import { RuntimeInfo } from "../runtime/runtime-info.service.ts";
 import { makeDebugConsoleExporter } from "./exporters/debug-console.ts";
 import { detectCi } from "./runtime.layer.ts";
@@ -33,10 +33,7 @@ const OTLP_TRACES_PATH = "/v1/traces";
 /** Tracing never stops a command: a setup problem prints one warning and the run continues untraced. */
 const warnTracingDisabled = (reason: string) =>
   Effect.flatMap(Stdio.Stdio, (stdio) =>
-    Stream.make(`Warning: tracing disabled: ${reason}\n`).pipe(
-      Stream.run(stdio.stderr()),
-      Effect.ignore,
-    ),
+    writeStdio(stdio, "stderr", `Warning: tracing disabled: ${reason}\n`).pipe(Effect.ignore),
   );
 
 type TraceSink =
@@ -226,7 +223,7 @@ const debugConsoleTracer = Effect.fnUntraced(function* (
 ) {
   const stdio = yield* Stdio.Stdio;
   const exportSpan = makeDebugConsoleExporter(
-    (line) => Stream.make(line).pipe(Stream.run(stdio.stderr()), Effect.asVoid),
+    (line) => writeStdio(stdio, "stderr", line),
     yield* makeTraceSanitizer,
     root,
   );
@@ -250,7 +247,7 @@ const debugConsoleTracer = Effect.fnUntraced(function* (
 
 const sinkTracer = Effect.fnUntraced(function* (sink: TraceSink) {
   const runtimeInfo = yield* RuntimeInfo;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const sinkModule = yield* Effect.promise(() => import("./otlp-trace-sink.ts"));
   const resource = {
     serviceVersion: CLI_VERSION,
@@ -258,7 +255,7 @@ const sinkTracer = Effect.fnUntraced(function* (sink: TraceSink) {
       os: runtimeInfo.platform,
       arch: runtimeInfo.arch,
       is_ci: yield* detectCi,
-      "service.instance.id": yield* Effect.orDie(crypto.randomUUIDv4),
+      "service.instance.id": yield* crypto.uuidV4(),
     },
   };
   const make = (url: string, headers: Redacted.Redacted<Readonly<Record<string, string>>>) =>
@@ -280,7 +277,7 @@ const sinkTracer = Effect.fnUntraced(function* (sink: TraceSink) {
  */
 export const withDebugConsole = <A, E, R>(
   effect: Effect.Effect<A, E, R>,
-): Effect.Effect<A, E, R | CliSettings | Crypto.Crypto | Stdio.Stdio> =>
+): Effect.Effect<A, E, R | CliSettings | SecureRandom.SecureRandom | Stdio.Stdio> =>
   Effect.gen(function* () {
     const settings = yield* CliSettings;
     const enabled =
@@ -310,7 +307,11 @@ export const withTraceExport =
   (settings: TraceSettings, attributes: Readonly<Record<string, unknown>>) =>
   <A, E, R>(
     effect: Effect.Effect<A, E, R>,
-  ): Effect.Effect<A, E, R | Crypto.Crypto | FileSystem.FileSystem | RuntimeInfo | Stdio.Stdio> => {
+  ): Effect.Effect<
+    A,
+    E,
+    R | SecureRandom.SecureRandom | FileSystem.FileSystem | RuntimeInfo | Stdio.Stdio
+  > => {
     const untraced = effect.pipe(Effect.withTracerEnabled(false));
     if (Option.isNone(settings.sink)) return untraced;
     const sink = settings.sink.value;
diff --git a/apps/cli/src/shared/telemetry/trace-export.off-path.unit.test.ts b/apps/cli/src/shared/telemetry/trace-export.off-path.unit.test.ts
index 43d26a6dec..6f885bd3fa 100644
--- a/apps/cli/src/shared/telemetry/trace-export.off-path.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/trace-export.off-path.unit.test.ts
@@ -1,11 +1,11 @@
 import { describe, expect, it } from "@effect/vitest";
 import { vi } from "vitest";
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, Layer, Option, References, Sink, Stdio } from "effect";
 import { mockRuntimeInfo } from "../../../tests/helpers/mocks.ts";
 import { withTraceExport } from "./trace-export.layer.ts";
 
-const runtime = Layer.mergeAll(mockRuntimeInfo(), BunServices.layer);
+const runtime = Layer.mergeAll(mockRuntimeInfo(), BunServices.layer, BunCrypto.layer);
 
 const sinkModule = vi.hoisted(() => ({ evaluated: false }));
 
diff --git a/apps/cli/src/shared/telemetry/trace-export.unit.test.ts b/apps/cli/src/shared/telemetry/trace-export.unit.test.ts
index a9e3971517..e1d5425887 100644
--- a/apps/cli/src/shared/telemetry/trace-export.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/trace-export.unit.test.ts
@@ -10,8 +10,8 @@ import {
   Sink,
   Stdio,
 } from "effect";
-import { BunServices } from "@effect/platform-bun";
-import { mockRuntimeInfo } from "../../../tests/helpers/mocks.ts";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
+import { epipe, mockRuntimeInfo, overrideStreamErrored } from "../../../tests/helpers/mocks.ts";
 import { CliSettings } from "../config/cli-settings.service.ts";
 import { resolveTraceSettings, withDebugConsole, withTraceExport } from "./trace-export.layer.ts";
 
@@ -35,6 +35,7 @@ const resolveWithEnv = (env: Readonly<Record<string, string | undefined>>) => {
       Layer.mergeAll(
         ConfigProvider.layer(ConfigProvider.fromUnknown(env)),
         BunServices.layer,
+        BunCrypto.layer,
         stderr.layer,
       ),
     ),
@@ -67,7 +68,7 @@ describe("resolveTraceSettings", () => {
         _tag: "File",
         path: path.join(process.cwd(), "traces", "run.jsonl"),
       });
-    }).pipe(Effect.provide(BunServices.layer)),
+    }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer])),
   );
 
   it.effect("appends the OTLP traces path to a collector base URL", () =>
@@ -177,7 +178,13 @@ const runWithDebugConsole = Effect.fnUntraced(function* (
       : consoled.pipe(withTraceExport({ sink: Option.none() }, {}))
   ).pipe(
     Effect.provide(
-      Layer.mergeAll(BunServices.layer, stderr.layer, mockRuntimeInfo(), debugSettings(debug)),
+      Layer.mergeAll(
+        BunServices.layer,
+        BunCrypto.layer,
+        stderr.layer,
+        mockRuntimeInfo(),
+        debugSettings(debug),
+      ),
     ),
   );
   return stderr.text();
@@ -246,6 +253,18 @@ describe("withDebugConsole", () => {
     }),
   );
 
+  it.effect("skips span lines once a direct write broke stderr", () =>
+    Effect.gen(function* () {
+      yield* overrideStreamErrored(process.stderr, epipe);
+      const output = yield* runWithDebugConsole(
+        { debug: "1" },
+        Effect.void.pipe(Effect.withSpan("Probe.span")),
+      );
+
+      expect(output).toBe("");
+    }),
+  );
+
   it.effect("prints nothing unless a debug setting is exactly 1", () =>
     Effect.gen(function* () {
       const output = yield* runWithDebugConsole(
diff --git a/apps/cli/src/shared/telemetry/trace-sanitize.ts b/apps/cli/src/shared/telemetry/trace-sanitize.ts
index 399d995d8c..55614fb22f 100644
--- a/apps/cli/src/shared/telemetry/trace-sanitize.ts
+++ b/apps/cli/src/shared/telemetry/trace-sanitize.ts
@@ -1,5 +1,6 @@
 import { createHmac } from "node:crypto";
-import { Cause, Crypto, Effect, Exit } from "effect";
+import { Cause, Effect, Exit } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { absurd } from "effect/Function";
 import type { KeyValue, AnyValue } from "effect/observability/OtlpResource";
 import type { ScopeSpan, TraceData } from "effect/observability/OtlpTracer";
@@ -331,18 +332,17 @@ export interface TraceSanitizer {
  * Creates a sanitizer whose `db.query.hash` is keyed by a fresh random salt, so repeated
  * statements share a hash within one sanitizer but hashes cannot be compared across runs.
  */
-export const makeTraceSanitizer: Effect.Effect<TraceSanitizer, never, Crypto.Crypto> = Effect.gen(
-  function* () {
-    const crypto = yield* Crypto.Crypto;
-    const salt = yield* Effect.orDie(crypto.randomBytes(QUERY_HASH_SALT_BYTES));
+export const makeTraceSanitizer: Effect.Effect<TraceSanitizer, never, SecureRandom.SecureRandom> =
+  Effect.gen(function* () {
+    const crypto = yield* SecureRandom.SecureRandom;
+    const salt = yield* crypto.randomBytes(QUERY_HASH_SALT_BYTES);
     const hashQuery: QueryHasher = (text) =>
       createHmac("sha256", salt).update(text).digest("hex").slice(0, QUERY_HASH_HEX_LENGTH);
     return {
       attributeEntries: (entries) => sanitizeAttributeEntries(entries, hashQuery),
       traceData: (data) => sanitizeTraceData(data, hashQuery),
     };
-  },
-);
+  });
 
 function failureOf(reason: Cause.Reason<unknown>): unknown {
   if (Cause.isFailReason(reason)) return reason.error;
diff --git a/apps/cli/src/shared/telemetry/trace-sanitize.unit.test.ts b/apps/cli/src/shared/telemetry/trace-sanitize.unit.test.ts
index 5f2171db7f..1082da0710 100644
--- a/apps/cli/src/shared/telemetry/trace-sanitize.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/trace-sanitize.unit.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "vitest";
 import { Effect, Exit } from "effect";
 import type { TraceData } from "effect/observability/OtlpTracer";
@@ -10,7 +10,7 @@ const JWT =
   "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIn0.c2lnbmF0dXJlLXZhbHVl";
 
 const newSanitizer = () =>
-  Effect.runSync(makeTraceSanitizer.pipe(Effect.provide(BunServices.layer)));
+  Effect.runSync(makeTraceSanitizer.pipe(Effect.provide([BunServices.layer, BunCrypto.layer])));
 const sanitizer = newSanitizer();
 const sanitizeAttributeEntries = sanitizer.attributeEntries;
 const sanitizeTraceData = sanitizer.traceData;
diff --git a/apps/cli/src/telemetry/analytics.layer.integration.test.ts b/apps/cli/src/telemetry/analytics.layer.integration.test.ts
index 3582501129..919920796d 100644
--- a/apps/cli/src/telemetry/analytics.layer.integration.test.ts
+++ b/apps/cli/src/telemetry/analytics.layer.integration.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { gunzipSync } from "node:zlib";
 import { describe, expect, it } from "@effect/vitest";
 import { ConfigProvider, Effect, Layer, Option, Schema } from "effect";
@@ -60,7 +60,7 @@ const captureWithProcessEnv = (env: Record<string, string>) =>
       ),
       Layer.provide(mockRuntimeInfo({ homeDir: tempRoot.current, cwd: tempRoot.current })),
       Layer.provide(mockTty({ stdoutIsTty: false })),
-      Layer.provide(BunServices.layer),
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
       Layer.provide(Layer.succeed(HttpClient.HttpClient, recordingPosthogClient(events))),
       Layer.provide(
         processEnvLayer({
@@ -103,7 +103,7 @@ describe("analytics destination", () => {
       Layer.provide(settings),
       Layer.provide(mockRuntimeInfo({ homeDir: tempRoot.current })),
       Layer.provide(mockTty({ stdoutIsTty: false })),
-      Layer.provide(BunServices.layer),
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
       Layer.provide(Layer.succeed(HttpClient.HttpClient, recordingClient)),
     );
     return Effect.gen(function* () {
@@ -146,7 +146,7 @@ describe("analytics destination", () => {
       Layer.provide(settings),
       Layer.provide(mockRuntimeInfo({ homeDir: tempRoot.current, cwd: tempRoot.current })),
       Layer.provide(mockTty({ stdoutIsTty: false })),
-      Layer.provide(BunServices.layer),
+      Layer.provide([BunServices.layer, BunCrypto.layer]),
       Layer.provide(Layer.succeed(HttpClient.HttpClient, recordingClient)),
     );
     return Effect.gen(function* () {
@@ -171,7 +171,7 @@ describe("analytics destination", () => {
         }),
       ]);
     }).pipe(
-      Effect.provide(BunServices.layer),
+      Effect.provide([BunServices.layer, BunCrypto.layer]),
       Effect.provideService(
         ConfigProvider.ConfigProvider,
         ConfigProvider.fromEnvRecord({
diff --git a/apps/cli/src/telemetry/analytics.layer.ts b/apps/cli/src/telemetry/analytics.layer.ts
index 6899c6a8a5..3f26f51916 100644
--- a/apps/cli/src/telemetry/analytics.layer.ts
+++ b/apps/cli/src/telemetry/analytics.layer.ts
@@ -71,9 +71,18 @@ export function resolveGroups(
   context: AnalyticsContext,
   linkedProject: Option.Option<LinkedProjectCacheValue>,
 ): Record<string, string> | undefined {
+  const contextProject = context.groups?.project;
   const resolved =
-    context.groups?.organization !== undefined && context.groups.project !== undefined
-      ? { organization: context.groups.organization, project: context.groups.project }
+    contextProject !== undefined
+      ? {
+          organization:
+            context.groups?.organization ??
+            Option.match(linkedProject, {
+              onNone: () => "",
+              onSome: (linked) => (linked.ref === contextProject ? linked.organization_id : ""),
+            }),
+          project: contextProject,
+        }
       : Option.match(linkedProject, {
           onNone: () => undefined,
           onSome: (linked) => ({ organization: linked.organization_id, project: linked.ref }),
diff --git a/apps/cli/src/telemetry/analytics.layer.unit.test.ts b/apps/cli/src/telemetry/analytics.layer.unit.test.ts
index 73270dc049..c2375471dd 100644
--- a/apps/cli/src/telemetry/analytics.layer.unit.test.ts
+++ b/apps/cli/src/telemetry/analytics.layer.unit.test.ts
@@ -122,4 +122,13 @@ describe("resolveGroups", () => {
       [GroupProject]: "ctx-ref",
     });
   });
+
+  it("keys a project-only context group, taking the org from a matching linked project", () => {
+    expect(
+      resolveGroups({ groups: { project: "proj-ref" } }, Option.some(linkedCacheValue())),
+    ).toEqual({ [GroupOrganization]: "org-id-123", [GroupProject]: "proj-ref" });
+    expect(
+      resolveGroups({ groups: { project: "other-ref" } }, Option.some(linkedCacheValue())),
+    ).toEqual({ [GroupProject]: "other-ref" });
+  });
 });
diff --git a/apps/cli/src/telemetry/command-telemetry-attributes.ts b/apps/cli/src/telemetry/command-telemetry-attributes.ts
index 9b4f2f71ec..58a1ef7ecc 100644
--- a/apps/cli/src/telemetry/command-telemetry-attributes.ts
+++ b/apps/cli/src/telemetry/command-telemetry-attributes.ts
@@ -1,11 +1,21 @@
 import { Context, Effect } from "effect";
 import type { StackRuntime } from "../command-internal/stack-runtime.ts";
-import { PropOrioleDb, PropStackRuntime } from "../shared/telemetry/event-catalog.ts";
+import type { ServeEndReason } from "../shared/functions/serve.ts";
+import {
+  PropConfigKey,
+  PropEdgeRuntimeExitCode,
+  PropOrioleDb,
+  PropServeEndReason,
+  PropStackRuntime,
+} from "../shared/telemetry/event-catalog.ts";
 
 /** Properties that code below a command handler adds to its `cli_command_executed` event. */
 export interface CommandTelemetryAttributeValues {
+  readonly [PropConfigKey]?: string;
   readonly [PropOrioleDb]?: boolean;
   readonly [PropStackRuntime]?: StackRuntime;
+  readonly [PropServeEndReason]?: ServeEndReason;
+  readonly [PropEdgeRuntimeExitCode]?: number;
 }
 
 /** Command-scoped attribute sink; `withCommandTelemetry` provides one, otherwise records are dropped. */
diff --git a/apps/cli/src/telemetry/command-telemetry.ts b/apps/cli/src/telemetry/command-telemetry.ts
index 0fe7749a37..dd4c16b7c7 100644
--- a/apps/cli/src/telemetry/command-telemetry.ts
+++ b/apps/cli/src/telemetry/command-telemetry.ts
@@ -15,10 +15,14 @@ import {
 } from "../command-internal/global-flags.ts";
 import { removedFlag, type RemovedSurfaceError } from "../command-internal/removed-command.ts";
 import { ProcessControl } from "../shared/runtime/process-control.service.ts";
-import { withAnalyticsContext } from "../shared/telemetry/analytics-context.ts";
+import {
+  type AnalyticsContext,
+  withAnalyticsContext,
+} from "../shared/telemetry/analytics-context.ts";
 import { Analytics } from "../shared/telemetry/analytics.service.ts";
 import { TelemetryRuntime } from "../shared/telemetry/runtime.service.ts";
 import {
+  CliErrorCategory,
   type CliErrorActionability,
   classifyCliErrorActionability,
   unknownProcessControlledFailureActionability,
@@ -27,7 +31,9 @@ import { DbAdvisorsFailOnError } from "../commands/db/advisors/advisors.errors.t
 import { DbLintFailOnError } from "../commands/db/lint/lint.errors.ts";
 import {
   EventCommandExecuted,
+  PropConfigKey,
   PropDurationMs,
+  PropErrorCategory,
   PropExitCode,
   PropOutputFormat,
   PropStackBackend,
@@ -510,7 +516,8 @@ function withCommandAnalyticsImplementation<Flags extends Record<string, unknown
           Effect.exit,
         );
         const finishedAt = yield* Clock.currentTimeMillis;
-        const recordedAttributes = yield* Ref.get(attributes);
+        // A config failure the command swallowed must not label a success or an unrelated failure.
+        const { [PropConfigKey]: configKey, ...recordedAttributes } = yield* Ref.get(attributes);
 
         // A command that resolves its own `--output` (e.g. `db query`, defaulting `table`/`json`
         // by agent mode) records it here; read optionally so commands that don't provide the
@@ -550,9 +557,15 @@ function withCommandAnalyticsImplementation<Flags extends Record<string, unknown
           const id = svc.stitchedDistinctId();
           return id === undefined ? Option.none() : Option.some(id);
         });
+        const failedProjectRef =
+          failureCause === undefined ? undefined : failureProjectRef(failureCause);
+        const contextWithProject: AnalyticsContext =
+          failedProjectRef === undefined
+            ? analyticsContext
+            : { ...analyticsContext, groups: { project: failedProjectRef } };
         const captureContext = Option.match(stitchedDistinctId, {
-          onNone: () => analyticsContext,
-          onSome: (distinct_id) => ({ ...analyticsContext, distinct_id }),
+          onNone: () => contextWithProject,
+          onSome: (distinct_id) => ({ ...contextWithProject, distinct_id }),
         });
         const failureMetadata =
           failureCause !== undefined
@@ -571,6 +584,10 @@ function withCommandAnalyticsImplementation<Flags extends Record<string, unknown
             ...(Option.isSome(stackBackend) ? { [PropStackBackend]: stackBackend.value.kind } : {}),
             ...recordedAttributes,
             ...failureMetadata,
+            ...(configKey !== undefined &&
+            failureMetadata[PropErrorCategory] === CliErrorCategory.InvalidConfig
+              ? { [PropConfigKey]: configKey }
+              : {}),
           })
           .pipe(
             withAnalyticsContext(captureContext),
@@ -590,6 +607,16 @@ function withCommandAnalyticsImplementation<Flags extends Record<string, unknown
     });
 }
 
+/** The project a typed failure names in its `projectRef` field, for the event's project group. */
+function failureProjectRef(cause: Cause.Cause<unknown>): string | undefined {
+  const error = Cause.findErrorOption(cause);
+  if (Option.isNone(error) || typeof error.value !== "object" || error.value === null) {
+    return undefined;
+  }
+  const ref: unknown = Reflect.get(error.value, "projectRef");
+  return typeof ref === "string" && PROJECT_REF_PATTERN.test(ref) ? ref : undefined;
+}
+
 export function withCommandTelemetry(): <A, E, R>(
   self: Effect.Effect<A, E, R>,
 ) => Effect.Effect<
diff --git a/apps/cli/src/telemetry/command-telemetry.unit.test.ts b/apps/cli/src/telemetry/command-telemetry.unit.test.ts
index 833f907061..35e9c205ba 100644
--- a/apps/cli/src/telemetry/command-telemetry.unit.test.ts
+++ b/apps/cli/src/telemetry/command-telemetry.unit.test.ts
@@ -13,6 +13,7 @@ import {
 } from "../command-internal/global-flags.ts";
 import { Analytics } from "../shared/telemetry/analytics.service.ts";
 import {
+  PropConfigKey,
   PropErrorCategory,
   PropErrorFingerprint,
   PropErrorKind,
@@ -25,7 +26,9 @@ import {
 } from "../shared/telemetry/event-catalog.ts";
 import { ProcessControl } from "../shared/runtime/process-control.service.ts";
 import { ConfigDiffLoadConfigError } from "../commands/config/diff/diff.errors.ts";
+import { CliConfigValueError } from "../config/cli-config.errors.ts";
 import { DbDumpRunError } from "../commands/db/dump/dump.errors.ts";
+import { DbConfigLoginRoleMissingPrivilegedRoleError } from "../command-internal/db-config.errors.ts";
 import { StdoutClosedError } from "../shared/output/errors.ts";
 import { IdentityStitch } from "../command-internal/identity-stitch.ts";
 import { RemovedSurfaceError } from "../command-internal/removed-command.ts";
@@ -203,6 +206,95 @@ describe("withCommandTelemetry", () => {
     );
   });
 
+  describe("config_key", () => {
+    const capturedEvent = (body: Effect.Effect<unknown, CliConfigValueError | DbDumpRunError>) => {
+      const analytics = mockContextualAnalytics();
+
+      return body.pipe(
+        withCommandTelemetry(),
+        Effect.provide(
+          Layer.mergeAll(
+            analytics.layer,
+            mockProcessControl().layer,
+            mockOutput({ format: "text" }).layer,
+            Stdio.layerTest({ args: Effect.succeed(["db", "dump", "--local"]) }),
+            commandRuntimeLayer(["db", "dump"]).pipe(Layer.provide(BunCrypto.layer)),
+          ),
+        ),
+        Effect.exit,
+        Effect.map((exit) => ({ exit, properties: analytics.captured[0]?.properties })),
+      );
+    };
+
+    it.live("emits the recorded config key on an invalid_config failure", () =>
+      Effect.gen(function* () {
+        const { exit, properties } = yield* capturedEvent(
+          recordCommandTelemetry({ [PropConfigKey]: "db.port" }).pipe(
+            Effect.andThen(
+              Effect.fail(
+                new CliConfigValueError({ path: "db.port", tier: "config", message: "invalid" }),
+              ),
+            ),
+          ),
+        );
+
+        expect(Exit.isFailure(exit)).toBe(true);
+        expect(properties).toMatchObject({
+          exit_code: 1,
+          error_category: "invalid_config",
+          [PropConfigKey]: "db.port",
+        });
+      }),
+    );
+
+    it.live("omits a config key that a later config outcome cleared", () =>
+      Effect.gen(function* () {
+        const { properties } = yield* capturedEvent(
+          recordCommandTelemetry({ [PropConfigKey]: "db.port" }).pipe(
+            Effect.andThen(recordCommandTelemetry({ [PropConfigKey]: undefined })),
+            Effect.andThen(
+              Effect.fail(
+                new CliConfigValueError({ path: "db.port", tier: "config", message: "invalid" }),
+              ),
+            ),
+          ),
+        );
+
+        expect(properties).toMatchObject({ exit_code: 1, error_category: "invalid_config" });
+        expect(properties).not.toHaveProperty(PropConfigKey);
+      }),
+    );
+
+    it.live("omits the recorded config key from a failure in another category", () =>
+      Effect.gen(function* () {
+        const { properties } = yield* capturedEvent(
+          recordCommandTelemetry({ [PropConfigKey]: "db.port", [PropOrioleDb]: true }).pipe(
+            Effect.andThen(Effect.fail(new DbDumpRunError({ message: "dump failed" }))),
+          ),
+        );
+
+        expect(properties).toMatchObject({
+          exit_code: 1,
+          error_category: "db_connection",
+          [PropOrioleDb]: true,
+        });
+        expect(properties).not.toHaveProperty(PropConfigKey);
+      }),
+    );
+
+    it.live("omits the recorded config key from a successful run", () =>
+      Effect.gen(function* () {
+        const { exit, properties } = yield* capturedEvent(
+          recordCommandTelemetry({ [PropConfigKey]: "db.port", [PropOrioleDb]: true }),
+        );
+
+        expect(Exit.isSuccess(exit)).toBe(true);
+        expect(properties).toMatchObject({ exit_code: 0, [PropOrioleDb]: true });
+        expect(properties).not.toHaveProperty(PropConfigKey);
+      }),
+    );
+  });
+
   it.live("reports machine output formats emitted through the text layer", () => {
     const analytics = mockContextualAnalytics();
 
@@ -388,9 +480,9 @@ describe("withCommandTelemetry", () => {
             mockProcessControl().layer,
             mockOutput({ format: "text" }).layer,
             Stdio.layerTest({
-              args: Effect.succeed(["stack", "logs", "-f", "--service", "database"]),
+              args: Effect.succeed(["fixture", "watch", "-f", "--service", "database"]),
             }),
-            commandRuntimeLayer(["stack", "logs"]).pipe(Layer.provide(BunCrypto.layer)),
+            commandRuntimeLayer(["fixture", "watch"]).pipe(Layer.provide(BunCrypto.layer)),
           ),
         ),
         Effect.tap(() =>
@@ -995,6 +1087,38 @@ describe("withCommandTelemetry", () => {
     );
   });
 
+  it.live("attributes a failure that names its project to that project group", () => {
+    const analytics = mockContextualAnalytics();
+    const failure = new DbConfigLoginRoleMissingPrivilegedRoleError({
+      message: "missing role",
+      suggestion: "use a password",
+      projectRef: "abcdefghijklmnopqrst",
+    });
+
+    return Effect.fail(failure).pipe(
+      withCommandTelemetry(),
+      Effect.provide(
+        Layer.mergeAll(
+          analytics.layer,
+          mockProcessControl().layer,
+          mockOutput({ format: "text" }).layer,
+          Stdio.layerTest({ args: Effect.succeed(["migration", "list"]) }),
+          commandRuntimeLayer(["migration", "list"]).pipe(Layer.provide(BunCrypto.layer)),
+        ),
+      ),
+      Effect.exit,
+      Effect.tap(() =>
+        Effect.sync(() => {
+          expect(analytics.captured[0]?.properties).toMatchObject({
+            groups: { project: "abcdefghijklmnopqrst" },
+            [PropErrorFingerprint]: "tag:DbConfigLoginRoleMissingPrivilegedRoleError",
+          });
+        }),
+      ),
+      Effect.asVoid,
+    );
+  });
+
   it.live("preserves the command failure when telemetry capture defects", () => {
     const failure = new DbDumpRunError({ message: "command failure" });
 
diff --git a/apps/cli/src/telemetry/telemetry-state.layer.ts b/apps/cli/src/telemetry/telemetry-state.layer.ts
index 033f746a19..eebd67be6f 100644
--- a/apps/cli/src/telemetry/telemetry-state.layer.ts
+++ b/apps/cli/src/telemetry/telemetry-state.layer.ts
@@ -1,4 +1,5 @@
-import { Crypto, DateTime, Effect, FileSystem, Layer, Path } from "effect";
+import { DateTime, Effect, FileSystem, Layer, Path } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { homedir } from "node:os";
 
 import { Analytics } from "../shared/telemetry/analytics.service.ts";
@@ -390,7 +391,7 @@ export const loadOrCreateTelemetryState = Effect.fn("telemetry.loadOrCreateState
 ) {
   const fs = yield* FileSystem.FileSystem;
   const pathSvc = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const filePath = yield* telemetryPath(pathSvc);
   const exists = yield* fs.exists(filePath);
   const existing = exists ? yield* fs.readFileString(filePath) : undefined;
@@ -409,9 +410,9 @@ export const loadOrCreateTelemetryState = Effect.fn("telemetry.loadOrCreateState
 
   const state: State = {
     enabled: prior?.enabled ?? true,
-    device_id: prior?.device_id ?? (yield* crypto.randomUUIDv4),
+    device_id: prior?.device_id ?? (yield* crypto.uuidV4()),
     session_id:
-      !expired && prior?.session_id !== undefined ? prior.session_id : yield* crypto.randomUUIDv4,
+      !expired && prior?.session_id !== undefined ? prior.session_id : yield* crypto.uuidV4(),
     session_last_active: nowIso,
     ...(prior?.distinct_id !== undefined ? { distinct_id: prior.distinct_id } : {}),
     // A decoded file's non-zero schema_version is kept. The numeric field is for in-memory
@@ -467,9 +468,9 @@ const persistIdentityReset = Effect.fn("telemetry.persistIdentityReset")(functio
   const base = yield* loadOrCreateTelemetryState();
   const fs = yield* FileSystem.FileSystem;
   const pathSvc = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const { distinct_id: _drop, ...rest } = base;
-  const nextState: State = { ...rest, device_id: yield* crypto.randomUUIDv4 };
+  const nextState: State = { ...rest, device_id: yield* crypto.uuidV4() };
   const filePath = yield* telemetryPath(pathSvc);
   yield* fs.makeDirectory(pathSvc.dirname(filePath), { recursive: true });
   yield* fs.writeFileString(filePath, serializeTelemetryState(nextState));
@@ -493,17 +494,17 @@ export const telemetryStateLayer = Layer.effect(
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const pathSvc = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
     const analytics = yield* Analytics;
     const runtime = yield* TelemetryRuntime;
 
     const provide = <A, E>(
-      effect: Effect.Effect<A, E, FileSystem.FileSystem | Path.Path | Crypto.Crypto>,
+      effect: Effect.Effect<A, E, FileSystem.FileSystem | Path.Path | SecureRandom.SecureRandom>,
     ) =>
       effect.pipe(
         Effect.provideService(FileSystem.FileSystem, fs),
         Effect.provideService(Path.Path, pathSvc),
-        Effect.provideService(Crypto.Crypto, crypto),
+        Effect.provideService(SecureRandom.SecureRandom, crypto),
       );
 
     return TelemetryState.of({
diff --git a/apps/cli/src/telemetry/telemetry-state.layer.unit.test.ts b/apps/cli/src/telemetry/telemetry-state.layer.unit.test.ts
index 87386ef81a..c5b765b706 100644
--- a/apps/cli/src/telemetry/telemetry-state.layer.unit.test.ts
+++ b/apps/cli/src/telemetry/telemetry-state.layer.unit.test.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { DateTime, Effect, FileSystem, Layer, Path, Schema } from "effect";
 
@@ -14,7 +14,7 @@ import {
 } from "./telemetry-state.layer.ts";
 import { TelemetryState } from "./telemetry-state.service.ts";
 
-const platformLayer = Layer.merge(BunServices.layer, cliConfigProviderLayer);
+const platformLayer = Layer.mergeAll(BunServices.layer, BunCrypto.layer, cliConfigProviderLayer);
 
 const tempHome = useTempWorkdir("supabase-telemetry-");
 
@@ -45,7 +45,7 @@ function makeLayer(
   runtime: ReturnType<typeof makeRuntime> = makeRuntime(),
 ) {
   return telemetryStateLayer.pipe(
-    Layer.provide(BunServices.layer),
+    Layer.provide([BunServices.layer, BunCrypto.layer]),
     Layer.provide(analytics.layer),
     Layer.provide(runtime.layer),
     Layer.provideMerge(cliConfigProviderLayer),
@@ -59,16 +59,16 @@ const telemetryPath = Effect.gen(function* () {
 const readTelemetryFile = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   return yield* fs.readFileString(yield* telemetryPath);
-}).pipe(Effect.provide(BunServices.layer));
+}).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 const telemetryFileExists = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   return yield* fs.exists(yield* telemetryPath);
-}).pipe(Effect.provide(BunServices.layer));
+}).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 const writeTelemetryFile = (contents: string) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     yield* fs.writeFileString(yield* telemetryPath, contents);
-  }).pipe(Effect.provide(BunServices.layer));
+  }).pipe(Effect.provide([BunServices.layer, BunCrypto.layer]));
 const seedJson = (value: unknown) =>
   Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown))(value).pipe(
     Effect.flatMap(writeTelemetryFile),
diff --git a/apps/cli/tests/contract/cases.ts b/apps/cli/tests/contract/cases.ts
new file mode 100644
index 0000000000..d1774884ac
--- /dev/null
+++ b/apps/cli/tests/contract/cases.ts
@@ -0,0 +1,428 @@
+import { expect, layer } from "@effect/vitest";
+import { createClient, type RealtimeChannel } from "@supabase/supabase-js";
+import { Data, Deferred, Effect, Layer, Option, Random, Schema, type Scope, Stream } from "effect";
+import { FetchHttpClient, HttpClient, type HttpClientError } from "effect/http";
+import * as Socket from "effect/socket/Socket";
+import {
+  ContractReset,
+  ContractTarget,
+  type ContractTargetError,
+  inviteTemplateMarker,
+} from "./target.ts";
+
+/** One consumer behavior, run unchanged against every setup's {@link ContractTarget}. */
+interface ContractCase {
+  readonly name: string;
+  readonly run: Effect.Effect<
+    void,
+    ContractCallError | ContractTargetError | HttpClientError.HttpClientError | Schema.SchemaError,
+    | ContractTarget
+    | ContractReset
+    | HttpClient.HttpClient
+    | Socket.WebSocketConstructor
+    | Scope.Scope
+  >;
+  readonly timeout?: number;
+}
+
+/** A supabase-js call rejected or returned an error. */
+class ContractCallError extends Data.TaggedError("ContractCallError")<{
+  readonly message: string;
+  readonly cause: unknown;
+}> {}
+
+/** Runs one Promise-returning consumer call, passing the fiber's abort signal through. */
+const call = <A>(operation: string, run: (signal: AbortSignal) => PromiseLike<A>) =>
+  Effect.tryPromise({
+    try: run,
+    catch: (cause) => new ContractCallError({ message: `${operation} rejected`, cause }),
+  });
+
+const succeeded = <R extends { readonly error: unknown }>(
+  result: R,
+): result is Extract<R, { readonly error: null }> => result.error === null;
+
+/** Runs one supabase-js call and fails with the `error` it returned. */
+const sdk = <R extends { readonly data: unknown; readonly error: unknown }>(
+  operation: string,
+  run: (signal: AbortSignal) => PromiseLike<R>,
+): Effect.Effect<Extract<R, { readonly error: null }>["data"], ContractCallError> =>
+  Effect.flatMap(call(operation, run), (result) =>
+    succeeded(result)
+      ? Effect.succeed(result.data)
+      : Effect.fail(new ContractCallError({ message: `${operation} failed`, cause: result.error })),
+  );
+
+const contractClient = (key: "PUBLISHABLE_KEY" | "ANON_KEY" | "SECRET_KEY") =>
+  ContractTarget.useSync((target) =>
+    createClient(target.API_URL, target[key], {
+      auth: { persistSession: false, autoRefreshToken: false },
+    }),
+  );
+
+const unique = (prefix: string) =>
+  Effect.map(Random.nextIntBetween(0, 1_000_000_000), (suffix) => `${prefix}-${suffix}`);
+
+const selectsSeededRow = (key: "PUBLISHABLE_KEY" | "ANON_KEY") =>
+  Effect.gen(function* () {
+    const client = yield* contractClient(key);
+    const rows = yield* sdk("select contract_items", (signal) =>
+      client.from("contract_items").select("id,label").eq("id", 1).abortSignal(signal),
+    );
+    expect(rows).toEqual([{ id: 1, label: "contract" }]);
+  });
+
+const insertsAndReadsBack = (key: "PUBLISHABLE_KEY" | "ANON_KEY") =>
+  Effect.gen(function* () {
+    const client = yield* contractClient(key);
+    const id = yield* Random.nextIntBetween(2, 1_000_000_000);
+    yield* sdk("insert contract_items", (signal) =>
+      client.from("contract_items").insert({ id, label: "inserted" }).abortSignal(signal),
+    );
+    const rows = yield* sdk("select inserted row", (signal) =>
+      client.from("contract_items").select("id,label").eq("id", id).abortSignal(signal),
+    );
+    expect(rows).toEqual([{ id, label: "inserted" }]);
+  });
+
+const postgrestCases: ReadonlyArray<ContractCase> = [
+  { name: "PostgREST selects with the publishable key", run: selectsSeededRow("PUBLISHABLE_KEY") },
+  { name: "PostgREST selects with the legacy anon key", run: selectsSeededRow("ANON_KEY") },
+  {
+    name: "PostgREST inserts with the publishable key and reads the row back",
+    run: insertsAndReadsBack("PUBLISHABLE_KEY"),
+  },
+  {
+    name: "PostgREST inserts with the legacy anon key and reads the row back",
+    run: insertsAndReadsBack("ANON_KEY"),
+  },
+];
+
+const password = "contract-password-123456";
+
+const signUp = (email: string) =>
+  Effect.flatMap(contractClient("ANON_KEY"), (client) =>
+    sdk("sign up", () => client.auth.signUp({ email, password })),
+  );
+
+const signIn = (email: string) =>
+  Effect.flatMap(contractClient("ANON_KEY"), (client) =>
+    call("sign in", () => client.auth.signInWithPassword({ email, password })),
+  );
+
+const NewMail = Schema.Struct({
+  Type: Schema.Literal("new"),
+  Data: Schema.Struct({
+    ID: Schema.String,
+    To: Schema.Array(Schema.Struct({ Address: Schema.String })),
+  }),
+});
+const MailBody = Schema.Struct({ Text: Schema.String, HTML: Schema.String });
+
+const decodeEvent = Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown));
+
+const mailError = (message: string, cause?: unknown) =>
+  new ContractCallError({ message: `Mailpit ${message}`, cause });
+
+/** Runs `send` while subscribed to Mailpit's events, then returns the mail it sent `email`. */
+const mailedTo = Effect.fn("Contract.mailedTo")(function* <E, R>(
+  email: string,
+  send: Effect.Effect<unknown, E, R>,
+) {
+  const { MAILPIT_URL } = yield* ContractTarget;
+  const events = new URL("/api/events", MAILPIT_URL);
+  events.protocol = "ws:";
+  const pull = yield* Socket.makeWebSocket(events.toString()).pipe(
+    Effect.flatMap(Socket.readerString),
+    Effect.mapError((cause) => mailError("events socket", cause)),
+  );
+  yield* send;
+  const mail = yield* Stream.fromEffectRepeat(
+    Effect.mapError(pull, (cause) => mailError("events socket", cause)),
+  ).pipe(
+    Stream.flattenIterable,
+    Stream.mapEffect((frame) => decodeEvent(frame)),
+    Stream.filter(Schema.is(NewMail)),
+    Stream.filter(({ Data }) => Data.To.some(({ Address }) => Address === email)),
+    Stream.runHead,
+  );
+  if (Option.isNone(mail)) return yield* mailError("event stream ended");
+  const response = yield* HttpClient.get(`${MAILPIT_URL}/api/v1/message/${mail.value.Data.ID}`);
+  return yield* Schema.decodeUnknownEffect(MailBody)(yield* response.json);
+});
+
+/** Signs `email` up, then returns the link mailed to it. */
+const signUpConfirmationLink = Effect.fn("Contract.signUpConfirmationLink")(function* (
+  email: string,
+) {
+  const { Text, HTML } = yield* mailedTo(email, signUp(email));
+  const link = `${Text}\n${HTML}`
+    .replaceAll("&amp;", "&")
+    .match(/https?:\/\/[^\s"'<>]+\/verify\?[^\s"'<>]+/);
+  if (link === null) return yield* mailError("no verify link");
+  return link[0];
+});
+
+const authCases: ReadonlyArray<ContractCase> = [
+  {
+    name: "Auth rejects password sign-in before the email is confirmed",
+    run: Effect.gen(function* () {
+      const email = `${yield* unique("unconfirmed")}@example.com`;
+      expect((yield* signUp(email)).session).toBeNull();
+      const { error } = yield* signIn(email);
+      expect(error).toMatchObject({ code: "email_not_confirmed" });
+    }),
+  },
+  {
+    name: "Auth confirms a sign-up through the mailed link, then signs in",
+    run: Effect.gen(function* () {
+      const email = `${yield* unique("confirmed")}@example.com`;
+      const verified = yield* HttpClient.get(yield* signUpConfirmationLink(email)).pipe(
+        Effect.provideService(FetchHttpClient.RequestInit, { redirect: "manual" }),
+      );
+      expect(verified.status).toBe(303);
+      expect(verified.headers.location).toContain("access_token=");
+      const { data, error } = yield* signIn(email);
+      expect(error).toBeNull();
+      expect(data.user?.email).toBe(email);
+    }),
+  },
+  {
+    name: "Auth mails an invite through the configured content_path template",
+    run: Effect.gen(function* () {
+      const email = `${yield* unique("invited")}@example.com`;
+      const admin = (yield* contractClient("SECRET_KEY")).auth.admin;
+      const { HTML } = yield* mailedTo(
+        email,
+        sdk("invite", () => admin.inviteUserByEmail(email)),
+      );
+      expect(HTML).toContain(inviteTemplateMarker);
+      expect(HTML).toMatch(/\/verify\?token=/u);
+    }),
+  },
+];
+
+const bytes = new Uint8Array([1, 2, 3, 250, 251, 252]);
+
+const uploadedObject = Effect.gen(function* () {
+  const client = yield* contractClient("SECRET_KEY");
+  const name = yield* unique("contract");
+  yield* sdk("create bucket", () => client.storage.createBucket(name, { public: false }));
+  const bucket = client.storage.from(name);
+  yield* sdk("upload", () =>
+    bucket.upload("dir/a.bin", bytes, { contentType: "application/octet-stream" }),
+  );
+  return { bucket, name };
+});
+
+const downloadedBytes = ({ bucket }: Effect.Success<typeof uploadedObject>, objectPath: string) =>
+  sdk(`download ${objectPath}`, (signal) => bucket.download(objectPath, {}, { signal })).pipe(
+    Effect.flatMap((blob) => call("read download", () => blob.arrayBuffer())),
+    Effect.map((buffer) => new Uint8Array(buffer)),
+  );
+
+const storageCases: ReadonlyArray<ContractCase> = [
+  {
+    name: "Storage downloads the bytes it uploaded",
+    run: Effect.gen(function* () {
+      const object = yield* uploadedObject;
+      expect(yield* downloadedBytes(object, "dir/a.bin")).toEqual(bytes);
+    }),
+  },
+  {
+    name: "Storage lists an uploaded object",
+    run: Effect.gen(function* () {
+      const { bucket } = yield* uploadedObject;
+      const objects = yield* sdk("list", (signal) => bucket.list("dir", undefined, { signal }));
+      expect(objects.map(({ name }) => name)).toEqual(["a.bin"]);
+    }),
+  },
+  {
+    name: "Storage serves an object through a signed URL",
+    run: Effect.gen(function* () {
+      const { bucket } = yield* uploadedObject;
+      const { signedUrl } = yield* sdk("create signed URL", () =>
+        bucket.createSignedUrl("dir/a.bin", 60),
+      );
+      const response = yield* HttpClient.get(signedUrl);
+      expect(response.status, signedUrl).toBe(200);
+      expect(new Uint8Array(yield* response.arrayBuffer)).toEqual(bytes);
+    }),
+  },
+  {
+    name: "Storage accepts an anon upload through a signed upload URL",
+    run: Effect.gen(function* () {
+      const object = yield* uploadedObject;
+      const { token } = yield* sdk("create signed upload URL", () =>
+        object.bucket.createSignedUploadUrl("dir/b.bin"),
+      );
+      const anon = (yield* contractClient("ANON_KEY")).storage.from(object.name);
+      yield* sdk("upload to signed URL", () => anon.uploadToSignedUrl("dir/b.bin", token, bytes));
+      expect(yield* downloadedBytes(object, "dir/b.bin")).toEqual(bytes);
+    }),
+  },
+];
+
+/** A client whose channels and socket close with the scope. */
+const realtimeClient = (key: "PUBLISHABLE_KEY" | "ANON_KEY") =>
+  Effect.acquireRelease(contractClient(key), (client) =>
+    call("remove channels", () => client.removeAllChannels()).pipe(Effect.orDie),
+  );
+
+const subscribed = (channel: RealtimeChannel) =>
+  Effect.callback<void, ContractCallError>((resume) => {
+    channel.subscribe((status, cause) =>
+      resume(
+        status === "SUBSCRIBED"
+          ? Effect.void
+          : Effect.fail(new ContractCallError({ message: `subscribe ${status}`, cause })),
+      ),
+    );
+    return Effect.ignore(call("unsubscribe", () => channel.unsubscribe()));
+  });
+
+const deliversBroadcast = (key: "PUBLISHABLE_KEY" | "ANON_KEY") =>
+  Effect.gen(function* () {
+    const topic = yield* unique("room");
+    const received = yield* Deferred.make<unknown>();
+    const receiver = (yield* realtimeClient(key))
+      .channel(topic)
+      .on("broadcast", { event: "ping" }, ({ payload }) =>
+        Deferred.doneUnsafe(received, Effect.succeed(payload)),
+      );
+    const sender = (yield* realtimeClient(key)).channel(topic);
+    yield* Effect.all([subscribed(receiver), subscribed(sender)], { concurrency: "unbounded" });
+    const sent = yield* call("send broadcast", () =>
+      sender.send({ type: "broadcast", event: "ping", payload: { n: 42 } }),
+    );
+    expect(sent).toBe("ok");
+    expect(yield* Deferred.await(received)).toEqual({ n: 42 });
+  });
+
+const realtimeCases: ReadonlyArray<ContractCase> = [
+  {
+    name: "Realtime delivers a broadcast between publishable-key clients",
+    run: deliversBroadcast("PUBLISHABLE_KEY"),
+  },
+  {
+    name: "Realtime delivers a broadcast between legacy anon-key clients",
+    run: deliversBroadcast("ANON_KEY"),
+  },
+];
+
+/* Guards a cold first launch: native stacks start the edge runtime on first use. */
+const COLD_LAUNCH_TIMEOUT_MS = 120_000;
+
+const invokesEcho = (key: "PUBLISHABLE_KEY" | "ANON_KEY") =>
+  Effect.gen(function* () {
+    const client = yield* contractClient(key);
+    const data = yield* sdk("invoke echo", (signal) => client.functions.invoke("echo", { signal }));
+    expect(data).toEqual({ ok: true });
+  });
+
+const functionsCases: ReadonlyArray<ContractCase> = [
+  {
+    name: "Functions invokes a function with the publishable key",
+    run: invokesEcho("PUBLISHABLE_KEY"),
+    timeout: COLD_LAUNCH_TIMEOUT_MS,
+  },
+  {
+    name: "Functions invokes a function with the legacy anon key",
+    run: invokesEcho("ANON_KEY"),
+    timeout: COLD_LAUNCH_TIMEOUT_MS,
+  },
+  {
+    name: "Functions rejects a request without Authorization when verify_jwt is on",
+    run: Effect.gen(function* () {
+      const { FUNCTIONS_URL } = yield* ContractTarget;
+      const response = yield* HttpClient.post(`${FUNCTIONS_URL}/echo`);
+      const body = yield* response.text;
+      expect(response.status, body).toBe(401);
+      expect(body).toContain("UNAUTHORIZED_NO_AUTH_HEADER");
+    }),
+    timeout: COLD_LAUNCH_TIMEOUT_MS,
+  },
+];
+
+const appliesInOrder = Effect.gen(function* () {
+  const client = yield* contractClient("SECRET_KEY");
+  const log = yield* sdk("select contract_log", (signal) =>
+    client.from("contract_log").select("source").order("seq").abortSignal(signal),
+  );
+  expect(log.map(({ source }) => source)).toEqual([
+    "migration 0 sees auth=true storage=true realtime=true",
+    "migration 10",
+    "migration 20260101000000",
+    "migration 9",
+    "seed zz",
+    "seed aa",
+    "seed mm sees public=false",
+  ]);
+  const buckets = yield* sdk("list buckets", () => client.storage.listBuckets());
+  expect(Object.fromEntries(buckets.map(({ id, public: open }) => [id, open]))).toMatchObject({
+    "config-public": true,
+    "config-private": false,
+  });
+  for (const [key, text] of Object.entries({
+    "a.txt": "seeded object\n",
+    "nested/b.txt": "nested object\n",
+  })) {
+    const object = yield* sdk(`download seeded ${key}`, (signal) =>
+      client.storage.from("config-public").download(key, {}, { signal }),
+    );
+    expect(yield* call(`read seeded ${key}`, () => object.text())).toBe(text);
+  }
+});
+
+const seedingCases: ReadonlyArray<ContractCase> = [
+  {
+    name: "start applies migrations in byte order, then seeds in sql_paths order, then config buckets",
+    run: appliesInOrder,
+  },
+];
+
+const resetCases: ReadonlyArray<ContractCase> = [
+  {
+    name: "db reset drops data and reapplies migrations, seeds and config buckets in order",
+    run: Effect.gen(function* () {
+      const client = yield* contractClient("PUBLISHABLE_KEY");
+      const id = yield* Random.nextIntBetween(2, 1_000_000_000);
+      yield* sdk("insert marker", (signal) =>
+        client.from("contract_items").insert({ id, label: "before reset" }).abortSignal(signal),
+      );
+      yield* Effect.flatten(ContractReset);
+      const rows = yield* sdk("select marker", (signal) =>
+        client.from("contract_items").select("id").eq("id", id).abortSignal(signal),
+      );
+      expect(rows).toEqual([]);
+      yield* appliesInOrder;
+    }),
+    /* Guards a legacy reset, which recreates the database container and restarts its services. */
+    timeout: 180_000,
+  },
+];
+
+const contractCases: ReadonlyArray<ContractCase> = [
+  ...postgrestCases,
+  ...authCases,
+  ...storageCases,
+  ...realtimeCases,
+  ...functionsCases,
+  ...seedingCases,
+  /* Last: a legacy reset restarts its services without start's Realtime readiness wait. */
+  ...resetCases,
+];
+
+/** Runs every contract case against one setup's running stack. */
+export const describeContract = <E>(
+  setup: string,
+  target: Layer.Layer<ContractTarget | ContractReset, E>,
+) =>
+  layer(Layer.mergeAll(target, FetchHttpClient.layer, Socket.layerWebSocketConstructorGlobal), {
+    /* Guards the stack start, including first image pulls or native artifact downloads. */
+    timeout: "5 minutes",
+    excludeTestServices: true,
+  })(`consumer contract (${setup})`, (it) => {
+    for (const { name, run, timeout } of contractCases)
+      it.effect(name, () => run, timeout ?? 60_000);
+  });
diff --git a/apps/cli/tests/contract/contract.docker.integration.test.ts b/apps/cli/tests/contract/contract.docker.integration.test.ts
new file mode 100644
index 0000000000..5882789a45
--- /dev/null
+++ b/apps/cli/tests/contract/contract.docker.integration.test.ts
@@ -0,0 +1,4 @@
+import { describeContract } from "./cases.ts";
+import { stackTarget } from "./target.ts";
+
+describeContract("stack/container", stackTarget("docker"));
diff --git a/apps/cli/tests/contract/contract.legacy.integration.test.ts b/apps/cli/tests/contract/contract.legacy.integration.test.ts
new file mode 100644
index 0000000000..f86f3af3ba
--- /dev/null
+++ b/apps/cli/tests/contract/contract.legacy.integration.test.ts
@@ -0,0 +1,4 @@
+import { describeContract } from "./cases.ts";
+import { legacyTarget } from "./target.ts";
+
+describeContract("legacy", legacyTarget);
diff --git a/apps/cli/tests/contract/contract.native.integration.test.ts b/apps/cli/tests/contract/contract.native.integration.test.ts
new file mode 100644
index 0000000000..7ec0b26dc7
--- /dev/null
+++ b/apps/cli/tests/contract/contract.native.integration.test.ts
@@ -0,0 +1,4 @@
+import { describeContract } from "./cases.ts";
+import { stackTarget } from "./target.ts";
+
+describeContract("stack/native", stackTarget("native"));
diff --git a/apps/cli/tests/contract/target.ts b/apps/cli/tests/contract/target.ts
new file mode 100644
index 0000000000..f20f7f7653
--- /dev/null
+++ b/apps/cli/tests/contract/target.ts
@@ -0,0 +1,402 @@
+import { BunCrypto, BunServices } from "@effect/platform-bun";
+import { Context, Data, Effect, FileSystem, Layer, Option, Path, Schema, Stream } from "effect";
+import { FetchHttpClient } from "effect/http";
+import { ChildProcessSpawner } from "effect/process";
+import { CommandPlatformApiFactory } from "../../src/auth/command-platform-api-factory.service.ts";
+import { spawnContainerCli } from "../../src/command-internal/container-cli.ts";
+import { dbConnectionLayer } from "../../src/command-internal/db-connection.sql-pg.layer.ts";
+import {
+  cliProjectFilterValue,
+  serviceContainerName,
+} from "../../src/command-internal/docker-ids.ts";
+import { dockerRemoveAll } from "../../src/command-internal/docker-remove-all.ts";
+import { dockerRunLayer } from "../../src/command-internal/docker-run.layer.ts";
+import {
+  DebugFlag,
+  ExperimentalFlag,
+  NetworkIdFlag,
+  YesFlag,
+} from "../../src/command-internal/global-flags.ts";
+import { localDockerEngineLayer } from "../../src/command-internal/db-bootstrap/local-db-running.ts";
+import { resetLocalDatabase } from "../../src/command-internal/db-bootstrap/reset-local-database.ts";
+import { type StackBackend, stackBackendLayer } from "../../src/command-internal/stack-backend.ts";
+import { stackCatalogSetupLayer } from "../../src/command-internal/stack-catalog-setup.ts";
+import {
+  StackApi,
+  stackApiLayer,
+  stackTargetResolverLayer,
+} from "../../src/command-internal/stack-target.ts";
+import { stackStart } from "../../src/commands/experimental/stack/start/start.handler.ts";
+import { start } from "../../src/commands/start/start.handler.ts";
+import { CliArgs } from "../../src/shared/cli/cli-args.service.ts";
+import { sanitizeProjectId } from "../../src/shared/config/project-id.ts";
+import { processControlLayer } from "../../src/shared/runtime/process-control.layer.ts";
+import { runtimeInfoLayer } from "../../src/shared/runtime/runtime-info.layer.ts";
+import { RuntimeInfo } from "../../src/shared/runtime/runtime-info.service.ts";
+import { stdinLayer } from "../../src/shared/runtime/stdin.layer.ts";
+import { pickFreePort } from "../helpers/cli.ts";
+import { mockCommandSettings, mockTelemetryStateTracked } from "../helpers/command-mocks.ts";
+import { cliConfigValuesTestLayer } from "../helpers/config-values-layer.ts";
+import { mockAnalytics, mockOutput, mockTty } from "../helpers/mocks.ts";
+import { stackArtifactCacheRoot } from "../helpers/stack-artifacts.ts";
+import { destroyTestStacks } from "../helpers/stack-cleanup.ts";
+
+/** Only the configured invite template carries this, so a mail holding it proves the fetch. */
+export const inviteTemplateMarker = "contract invite template marker";
+
+/** Host ports a legacy project binds; stack projects leave them out and get automatic ports. */
+interface LegacyPorts {
+  readonly api: number;
+  readonly db: number;
+  readonly mailpit: number;
+}
+
+const port = (value: number | undefined) => (value === undefined ? "" : `port = ${value}\n`);
+
+const config = (projectId: string, ports: LegacyPorts | undefined) => `project_id = "${projectId}"
+
+[api]
+${port(ports?.api)}
+[db]
+${port(ports?.db)}
+[db.pooler]
+enabled = false
+
+[db.seed]
+sql_paths = ["./seeds/zz.sql", "./seeds/*.sql"]
+
+[auth.email]
+enable_confirmations = true
+
+[auth.email.template.invite]
+subject = "Contract invite"
+content_path = "./supabase/templates/invite.html"
+
+[local_smtp]
+enabled = true
+${port(ports?.mailpit)}
+[realtime]
+enabled = true
+
+[storage]
+enabled = true
+
+[storage.buckets.config-public]
+public = true
+objects_path = "./buckets/public"
+
+[storage.buckets.config-private]
+public = false
+
+[edge_runtime]
+enabled = true
+
+[functions.echo]
+verify_jwt = true
+
+[studio]
+enabled = false
+
+[analytics]
+enabled = false
+`;
+
+/* Migrations and seeds log to contract_log in run order: 0, 10, 2026, 9, skipping notes.sql and nested/,
+   then zz once, then aa and mm. 10 creates config-public private, so the last seed mm seeing
+   public=false and a public bucket at the end prove config buckets seed after every seed. */
+const projectFiles = (projectId: string, ports: LegacyPorts | undefined) => ({
+  "config.toml": config(projectId, ports),
+  "migrations/9_after_10.sql": `insert into public.contract_log (source) values ('migration 9');
+`,
+  "migrations/20260101000000_contract.sql": `create table public.contract_items (id int primary key, label text not null);
+insert into public.contract_items values (1, 'contract');
+grant select, insert on public.contract_items to anon;
+insert into public.contract_log (source) values ('migration 20260101000000');
+`,
+  "migrations/10_buckets.sql": `insert into storage.buckets (id, name, public) values ('config-public', 'config-public', false);
+insert into public.contract_log (source) values ('migration 10');
+`,
+  "migrations/0_log.sql": `create table public.contract_log (seq int generated always as identity primary key, source text not null);
+alter table public.contract_log enable row level security;
+grant select on public.contract_log to service_role;
+insert into public.contract_log (source) select format('migration 0 sees auth=%s storage=%s realtime=%s', (to_regclass('auth.flow_state') is not null)::text, (to_regclass('storage.s3_multipart_uploads') is not null)::text, (to_regclass('realtime.messages') is not null)::text);
+`,
+  "migrations/notes.sql": `insert into public.contract_log (source) values ('notes.sql');
+`,
+  "migrations/nested/1_nested.sql": `insert into public.contract_log (source) values ('nested/1_nested.sql');
+`,
+  "seeds/mm.sql": `insert into public.contract_log (source) select 'seed mm sees public=' || public from storage.buckets where id = 'config-public';
+`,
+  "seeds/aa.sql": `insert into public.contract_log (source) values ('seed aa');
+`,
+  "seeds/zz.sql": `insert into public.contract_log (source) values ('seed zz');
+`,
+  "buckets/public/a.txt": "seeded object\n",
+  "buckets/public/nested/b.txt": "nested object\n",
+  "functions/echo/index.ts": `Deno.serve(() => Response.json({ ok: true }));
+`,
+  "templates/shared/invite.html": `<p>${inviteTemplateMarker}</p><a href="{{ .ConfirmationURL }}">Accept</a>
+`,
+});
+
+/** Writes the one project every contract setup starts. */
+const writeContractProject = Effect.fn("Contract.writeProject")(function* (
+  root: string,
+  projectId: string,
+  ports?: LegacyPorts,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  for (const [name, content] of Object.entries(projectFiles(projectId, ports))) {
+    const file = path.join(root, "supabase", name);
+    yield* fs.makeDirectory(path.dirname(file), { recursive: true });
+    yield* fs.writeFileString(file, content);
+  }
+  /* The invite template is an in-root symlink, which every setup serves like legacy. */
+  yield* fs.symlink("shared/invite.html", path.join(root, "supabase", "templates/invite.html"));
+});
+
+const ContractEnv = Schema.StructWithRest(
+  Schema.Struct({
+    API_URL: Schema.String,
+    FUNCTIONS_URL: Schema.String,
+    MAILPIT_URL: Schema.String,
+    PUBLISHABLE_KEY: Schema.String,
+    SECRET_KEY: Schema.String,
+    ANON_KEY: Schema.String,
+  }),
+  [Schema.Record(Schema.String, Schema.String)],
+);
+
+/** The env `start` reports for one running local setup, every reported name kept. */
+export class ContractTarget extends Context.Service<ContractTarget, typeof ContractEnv.Type>()(
+  "supabase/tests/ContractTarget",
+) {}
+
+export class ContractTargetError extends Data.TaggedError("ContractTargetError")<{
+  readonly message: string;
+  readonly cause: unknown;
+}> {}
+
+/** Resets the running setup's local database through the path `db reset` takes on its backend. */
+export class ContractReset extends Context.Service<
+  ContractReset,
+  Effect.Effect<void, ContractTargetError>
+>()("supabase/tests/ContractReset") {}
+
+const resetOn = (backend: StackBackend) =>
+  resetLocalDatabase().pipe(
+    Effect.scoped,
+    Effect.provide(Layer.mergeAll(stackBackendLayer(backend), localDockerEngineLayer)),
+    Effect.mapError((cause) => new ContractTargetError({ message: "db reset failed", cause })),
+  );
+
+const startedEnv = <A>(
+  output: ReturnType<typeof mockOutput>,
+  schema: Schema.Decoder<A>,
+): Effect.Effect<A, ContractTargetError> =>
+  Schema.decodeEffect(schema)(
+    output.messages.findLast(({ type, data }) => type === "success" && data !== undefined)?.data,
+  ).pipe(
+    Effect.mapError(
+      (cause) => new ContractTargetError({ message: "start reported no consumer env", cause }),
+    ),
+  );
+
+/* Interrupts a stuck start so its own rollback runs before the layer guard tears the fixture down. */
+const guardStart = <A, E, R>(start: Effect.Effect<A, E, R>) =>
+  Effect.timeoutOrElse(start, {
+    duration: "4 minutes",
+    orElse: () =>
+      Effect.fail(
+        new ContractTargetError({ message: "start ran past 4 minutes", cause: undefined }),
+      ),
+  });
+
+const hostServices = Layer.mergeAll(BunServices.layer, BunCrypto.layer, runtimeInfoLayer);
+
+const sharedLayers = (output: ReturnType<typeof mockOutput>, args: string[]) => {
+  const tty = mockTty({ stdinIsTty: false, stdoutIsTty: false });
+  return Layer.mergeAll(
+    cliConfigValuesTestLayer,
+    FetchHttpClient.layer,
+    runtimeInfoLayer,
+    output.layer,
+    mockTelemetryStateTracked().layer,
+    dbConnectionLayer,
+    Layer.succeed(DebugFlag, false),
+    Layer.succeed(ExperimentalFlag, false),
+    Layer.succeed(YesFlag, false),
+    Layer.succeed(CliArgs, { args }),
+    Layer.succeed(CommandPlatformApiFactory, { make: Effect.die("unused by local start") }),
+    Layer.succeed(NetworkIdFlag, Option.none()),
+    dockerRunLayer.pipe(Layer.provideMerge(processControlLayer)),
+    stdinLayer.pipe(Layer.provide(tty)),
+    tty,
+  );
+};
+
+/** Starts one stack in-process with automatic ports and destroys it when the scope closes. */
+export const stackTarget = (runtime: "native" | "docker") =>
+  Layer.effectContext(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const host = yield* RuntimeInfo;
+      const root = yield* fs.makeTempDirectoryScoped({
+        prefix: `contract-${runtime}-`,
+        /* Linux Edge Runtime overlays /tmp with a private worker filesystem, so native functions need a visible host path. */
+        ...(runtime === "native" && host.platform === "linux" ? { directory: host.homeDir } : {}),
+      });
+      yield* writeContractProject(root, sanitizeProjectId(path.basename(root)));
+      const cacheRoot = path.join(root, "cache", "stack");
+      yield* fs.makeDirectory(stackArtifactCacheRoot, { recursive: true });
+      yield* fs.makeDirectory(path.dirname(cacheRoot), { recursive: true });
+      yield* fs.symlink(stackArtifactCacheRoot, cacheRoot);
+      const output = mockOutput({ format: "json" });
+      const layers = Layer.mergeAll(
+        sharedLayers(output, ["stack", "start"]),
+        stackTargetResolverLayer.pipe(
+          Layer.provideMerge(
+            Layer.mergeAll(
+              mockCommandSettings({ workdir: root, supabaseHome: root }),
+              stackApiLayer,
+            ),
+          ),
+        ),
+        stackCatalogSetupLayer,
+      );
+      const context = yield* Layer.build(layers.pipe(Layer.provideMerge(hostServices)));
+      yield* Effect.addFinalizer(() =>
+        StackApi.use((stackApi) =>
+          destroyTestStacks(stackApi, path.join(root, "stacks"), cacheRoot),
+        ).pipe(Effect.provide(context)),
+      );
+      yield* stackStart({
+        exclude: [],
+        stack: Option.none(),
+        stackId: Option.none(),
+        runtime,
+        preparation: "background",
+        frozen: false,
+        eager: false,
+      }).pipe(Effect.provide(context), guardStart);
+      const { env } = yield* startedEnv(output, Schema.Struct({ env: ContractEnv }));
+      const reset = resetOn("stack").pipe(Effect.provide(context));
+      return Context.make(ContractTarget, env).pipe(Context.add(ContractReset, reset));
+    }),
+  ).pipe(Layer.provide(hostServices));
+
+/* Works around a legacy start readiness gap: Realtime seeds through a throwaway node on :4000 before
+   it execs the server, so its healthcheck can pass early. Wait for the line the stack treats as ready. */
+const realtimeServerListening = Effect.fn("Contract.realtimeServerListening")(function* (
+  projectId: string,
+) {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const listening = yield* spawnContainerCli(
+    spawner,
+    ["logs", "--follow", serviceContainerName("realtime", projectId)],
+    { stdin: "ignore", stdout: "pipe", stderr: "ignore" },
+  ).pipe(
+    Effect.flatMap((logs) =>
+      logs.stdout.pipe(
+        Stream.decodeText,
+        Stream.splitLines,
+        Stream.dropWhile((line) => !line.includes("Starting Realtime")),
+        Stream.filter((line) => line.includes("Running RealtimeWeb.Endpoint")),
+        Stream.runHead,
+      ),
+    ),
+    Effect.scoped,
+    Effect.mapError(
+      (cause) => new ContractTargetError({ message: "reading Realtime logs failed", cause }),
+    ),
+  );
+  if (Option.isNone(listening))
+    return yield* new ContractTargetError({
+      message: "Realtime logs ended before its server listened",
+      cause: undefined,
+    });
+});
+
+/* Works around a legacy start gap: Auth fetches its templates before Kong's template server listens,
+   keeps its built-in invite, and refetches every few seconds. Wait for a refetch that succeeded. */
+const authInviteTemplateLoaded = Effect.fn("Contract.authInviteTemplateLoaded")(function* (
+  projectId: string,
+) {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const loaded = yield* spawnContainerCli(
+    spawner,
+    ["logs", "--follow", serviceContainerName("auth", projectId)],
+    { stdin: "ignore", stdout: "pipe", stderr: "pipe" },
+  ).pipe(
+    Effect.flatMap((logs) =>
+      Stream.merge(logs.stdout, logs.stderr).pipe(
+        Stream.decodeText,
+        Stream.splitLines,
+        Stream.filter((line) => line.includes('"mail_type":"invite"')),
+        Stream.mapAccum(
+          () => false,
+          (failed, line) => {
+            const reloaded = line.includes("templatemailer_reloader_template_update");
+            return [reloaded ? false : line.includes("_error"), [reloaded && !failed]];
+          },
+        ),
+        Stream.filter((ok) => ok),
+        Stream.runHead,
+      ),
+    ),
+    Effect.scoped,
+    Effect.mapError(
+      (cause) => new ContractTargetError({ message: "reading Auth logs failed", cause }),
+    ),
+  );
+  if (Option.isNone(loaded))
+    return yield* new ContractTargetError({
+      message: "Auth logs ended before its invite template loaded",
+      cause: undefined,
+    });
+});
+
+/** Starts the legacy Docker stack in-process and removes everything labelled with its project id. */
+export const legacyTarget = Layer.effectContext(
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const root = yield* fs.makeTempDirectoryScoped({ prefix: "contract-legacy-" });
+    const projectId = sanitizeProjectId(path.basename(root));
+    /* Legacy Docker binds the fixed host ports in config.toml, so probing them first is intrinsic.
+       It skips 8915, the fixed API port start.native.integration.test.ts binds. */
+    const legacyPort = pickFreePort.pipe(
+      Effect.repeat({ until: (port) => port !== 8_915, times: 3 }),
+    );
+    yield* writeContractProject(root, projectId, {
+      api: yield* legacyPort,
+      db: yield* legacyPort,
+      mailpit: yield* legacyPort,
+    });
+    const output = mockOutput({ format: "json" });
+    const context = yield* Layer.build(
+      Layer.mergeAll(
+        sharedLayers(output, ["start"]),
+        mockCommandSettings({ workdir: root, supabaseHome: root }),
+        stackApiLayer,
+        mockAnalytics().layer,
+      ).pipe(Layer.provideMerge(hostServices)),
+    );
+    yield* Effect.addFinalizer(() =>
+      ChildProcessSpawner.ChildProcessSpawner.use((spawner) =>
+        dockerRemoveAll(spawner, cliProjectFilterValue(projectId), true),
+      ).pipe(Effect.orDie),
+    );
+    yield* start({ exclude: [], ignoreHealthCheck: false, preview: false }).pipe(
+      Effect.provide(context),
+      Effect.andThen(realtimeServerListening(projectId)),
+      Effect.andThen(authInviteTemplateLoaded(projectId)),
+      guardStart,
+    );
+    const env = yield* startedEnv(output, ContractEnv);
+    const reset = resetOn("legacy").pipe(Effect.provide(context));
+    return Context.make(ContractTarget, env).pipe(Context.add(ContractReset, reset));
+  }),
+).pipe(Layer.provide(hostServices));
diff --git a/apps/cli/tests/helpers/branches-live.integration.test.ts b/apps/cli/tests/helpers/branches-live.integration.test.ts
index 3a1f84e957..51b1632609 100644
--- a/apps/cli/tests/helpers/branches-live.integration.test.ts
+++ b/apps/cli/tests/helpers/branches-live.integration.test.ts
@@ -275,6 +275,35 @@ describe("live branch lifecycle helpers", () => {
       }),
   );
 
+  it.effect("re-issues create once after the platform drops TLS while setting the password", () =>
+    Effect.gen(function* () {
+      let creates = 0;
+      const cli: BranchCli = (args) =>
+        Effect.gen(function* () {
+          if (args[1] === "create") {
+            creates += 1;
+            return creates === 1
+              ? result(
+                  yield* json({
+                    _tag: "Error",
+                    error: {
+                      message:
+                        'unexpected create branch status 400: {"message":"Failed to update password: Client network socket disconnected before secure TLS connection was established"}',
+                    },
+                  }),
+                  "",
+                  1,
+                )
+              : result(yield* json(branch));
+          }
+          return result(yield* json([defaultBranch]));
+        });
+      const ref = yield* createLiveBranchEffect(cli, project, branch.name);
+      expect(ref).toBe(branchRef);
+      expect(creates).toBe(2);
+    }),
+  );
+
   it.effect("fails a create rejected by a second platform database restart", () =>
     Effect.gen(function* () {
       let creates = 0;
diff --git a/apps/cli/tests/helpers/branches-live.ts b/apps/cli/tests/helpers/branches-live.ts
index 13e84fea23..0836a11bb6 100644
--- a/apps/cli/tests/helpers/branches-live.ts
+++ b/apps/cli/tests/helpers/branches-live.ts
@@ -139,17 +139,19 @@ function branchRefFromCreate(
   );
 }
 
-// The platform rejects `branches create` with a 400 when the database it configures restarts mid-create.
-const PLATFORM_DATABASE_RESTART = /\b57P01\b|the database system is shutting down/u;
+// The platform rejects `branches create` with a 400 when the database it configures restarts, or its
+// TLS connection drops while setting the database password, mid-create.
+const PLATFORM_TRANSIENT_CREATE_REJECTION =
+  /\b57P01\b|the database system is shutting down|Failed to update password: Client network socket disconnected before secure TLS connection was established/u;
 
-function isPlatformDatabaseRestart(error: unknown): boolean {
+function isPlatformTransientCreateRejection(error: unknown): boolean {
   return (
     error instanceof BranchCommandFailed &&
-    PLATFORM_DATABASE_RESTART.test(`${error.stdout ?? ""}\n${error.stderr}`)
+    PLATFORM_TRANSIENT_CREATE_REJECTION.test(`${error.stdout ?? ""}\n${error.stderr}`)
   );
 }
 
-/** Runs `branches create`, re-issuing it once when the platform restarted the database mid-create. */
+/** Runs `branches create`, re-issuing it once when the platform rejected it with a transient mid-create failure. */
 export function runLiveBranchCreateEffect<E>(
   cli: BranchCli<E>,
   project: LiveProject,
@@ -170,7 +172,7 @@ export function runLiveBranchCreateEffect<E>(
   );
   return create.pipe(
     Effect.catch((rejected) =>
-      isPlatformDatabaseRestart(rejected)
+      isPlatformTransientCreateRejection(rejected)
         ? clearRejected.pipe(
             Effect.mapError(
               (cleanup) =>
diff --git a/apps/cli/tests/helpers/child-process-spawner.ts b/apps/cli/tests/helpers/child-process-spawner.ts
index a1e6d5214c..ac5eeef578 100644
--- a/apps/cli/tests/helpers/child-process-spawner.ts
+++ b/apps/cli/tests/helpers/child-process-spawner.ts
@@ -45,7 +45,9 @@ export function mockChildProcessSpawner(
       ChildProcessSpawner.make((command) =>
         Effect.gen(function* () {
           const cmd = Predicate.isTagged(command, "StandardCommand") ? command.command : "";
-          const args = Predicate.isTagged(command, "StandardCommand") ? command.args : [];
+          const args = Predicate.isTagged(command, "StandardCommand")
+            ? command.args.map(String)
+            : [];
           const record: SpawnRecord = { command: cmd, args };
           yield* opts.beforeSpawn?.(record) ?? Effect.void;
           spawned.push(record);
@@ -132,7 +134,7 @@ export function containerEngineSpawner(engines: {
   const spawner = (delegate?: ChildProcessSpawner.ChildProcessSpawner["Service"]) =>
     ChildProcessSpawner.make((command) => {
       const cmd = Predicate.isTagged(command, "StandardCommand") ? command.command : "";
-      const args = Predicate.isTagged(command, "StandardCommand") ? command.args : [];
+      const args = Predicate.isTagged(command, "StandardCommand") ? command.args.map(String) : [];
       if (cmd !== "docker" && cmd !== "podman")
         return delegate === undefined ? Effect.fail(notFound(cmd)) : delegate.spawn(command);
       spawned.push({ command: cmd, args });
diff --git a/apps/cli/tests/helpers/cli.ts b/apps/cli/tests/helpers/cli.ts
index e373e336c9..8e9e638951 100644
--- a/apps/cli/tests/helpers/cli.ts
+++ b/apps/cli/tests/helpers/cli.ts
@@ -16,6 +16,7 @@ import {
   Path,
   Predicate,
   PubSub,
+  Random,
   Schema,
   Scope,
   Stream,
@@ -290,47 +291,62 @@ export const withTempCliProject = <A, E, R>(
 
 const portError = (error: Error) => new E2ePortError({ message: error.message, cause: error });
 
-const pickReleasedPort = Effect.callback<number, E2ePortError>((resume) => {
-  const server = createServer();
-  let settled = false;
-  const settle = (result: Effect.Effect<number, E2ePortError>) => {
-    if (settled) return;
-    settled = true;
-    resume(result);
-  };
-  /* Stays attached after cancellation so a late listen error is never an unhandled event. */
-  server.on("error", (error) => settle(Effect.fail(portError(error))));
-  server.listen(0, "127.0.0.1", () => {
-    const address = server.address();
-    if (address == null || typeof address === "string") {
-      server.close(() =>
-        settle(Effect.fail(new E2ePortError({ message: "Failed to allocate a free port" }))),
-      );
-      return;
-    }
-    server.close((error) => {
-      settle(error ? Effect.fail(portError(error)) : Effect.succeed(address.port));
+const isPortTaken = (error: NodeJS.ErrnoException) =>
+  error.code === "EADDRINUSE" || error.code === "EACCES";
+
+/** Succeeds with whether `port` could be bound on `host`. */
+const probePort = (port: number, host: string) =>
+  Effect.callback<boolean, E2ePortError>((resume) => {
+    const server = createServer();
+    let settled = false;
+    const settle = (result: Effect.Effect<boolean, E2ePortError>) => {
+      if (settled) return;
+      settled = true;
+      resume(result);
+    };
+    /* Stays attached after cancellation so a late listen error is never an unhandled event. */
+    server.on("error", (error: NodeJS.ErrnoException) =>
+      settle(isPortTaken(error) ? Effect.succeed(false) : Effect.fail(portError(error))),
+    );
+    server.listen(port, host, () => {
+      server.close((error) => {
+        settle(error ? Effect.fail(portError(error)) : Effect.succeed(true));
+      });
+    });
+    return Effect.sync(() => {
+      settled = true;
+      server.close();
     });
   });
-  return Effect.sync(() => {
-    settled = true;
-    server.close();
-  });
-});
 
-/**
- * Concurrent e2e workers each keep only ports in their own slot, so a port one worker picked and
- * released before Docker binds it is never handed to another worker. Slots skip the low bit
- * because Linux hands out mostly odd ports for `listen(0)`.
+/*
+ * Ports come from below the stack's own allocation ranges (10000+, see `packages/stack/src/Ports.ts`)
+ * and the OS ephemeral ranges, so neither a concurrent stack nor an outbound connection can take a
+ * probed port before Docker binds it. Concurrent e2e workers each keep only ports in their own
+ * slot, so one worker never hands out a port another worker picked.
  */
+const FIXED_PORT_RANGE_START = 1_024;
+const FIXED_PORT_RANGE_END = 10_000;
+
 const envOrEmpty = (name: string) => Config.String(name).pipe(Config.withDefault(""));
 
-const pickFreePort = Effect.gen(function* () {
+const FIXED_PORT_SPAN = FIXED_PORT_RANGE_END - FIXED_PORT_RANGE_START;
+/* Walks the range from a random start, so one worker never hands out the same port twice. */
+let nextPortOffset: number | undefined;
+
+/** A free host port below the stack and ephemeral ranges, split by worker under SUPABASE_E2E_WORKERS. */
+export const pickFreePort = Effect.gen(function* () {
   const e2eWorkers = Number((yield* envOrEmpty("SUPABASE_E2E_WORKERS")) || "1");
   const e2eWorkerSlot = Number((yield* envOrEmpty("VITEST_POOL_ID")) || "1") % e2eWorkers;
-  for (let attempt = 0; attempt < 1000; attempt++) {
-    const port = yield* pickReleasedPort;
-    if (Math.floor(port / 2) % e2eWorkers === e2eWorkerSlot) return port;
+  const start =
+    nextPortOffset ?? (yield* Random.nextIntBetween(0, FIXED_PORT_SPAN, { halfOpen: true }));
+  for (let step = 0; step < FIXED_PORT_SPAN; step++) {
+    const offset = (start + step) % FIXED_PORT_SPAN;
+    const port = FIXED_PORT_RANGE_START + offset;
+    if (port % e2eWorkers !== e2eWorkerSlot) continue;
+    nextPortOffset = offset + 1;
+    // Docker publishes on every interface; macOS lets that bind succeed over a loopback listener.
+    if ((yield* probePort(port, "0.0.0.0")) && (yield* probePort(port, "127.0.0.1"))) return port;
   }
   return yield* new E2ePortError({
     message: `No free port for e2e worker slot ${e2eWorkerSlot} of ${e2eWorkers}`,
@@ -568,8 +584,8 @@ export interface SpawnSupabaseOptions {
   readonly cleanupProcessGroupOnClose?: boolean;
   /** Maximum time to wait for the process to exit before force-killing it. */
   readonly exitTimeoutMs?: number;
-  /** Close the read end of stdout at spawn, like a `| head` reader that has already exited. */
-  readonly closeStdout?: boolean;
+  /** Close the read end of this stream at spawn, like a `| head` reader that has already exited. */
+  readonly closeStream?: "stdout" | "stderr";
 }
 
 export interface SpawnedSupabase {
@@ -598,15 +614,17 @@ const isBrokenPipe = (error: { readonly cause?: unknown }) =>
   Predicate.hasProperty(error.cause, "code") && error.cause.code === "EPIPE";
 
 /*
- * The Effect spawner only hands out stdout as a stream it reads itself, so a pipe whose reader
- * has exited needs a relay: it runs the CLI on a real pipe, closes the read end at once, and
+ * The Effect spawner only hands out stdout and stderr as streams it reads itself, so a pipe whose
+ * reader has exited needs a relay: it runs the CLI on a real pipe, closes the read end at once, and
  * mirrors the CLI's exit code. It ignores group signals so the CLI's own exit wins.
  */
-const closedStdoutRelay = (argvJson: string) =>
+const closedStreamRelay = (argvJson: string, stream: "stdout" | "stderr") =>
   [
     `const { spawn } = require("node:child_process");`,
-    `const child = spawn(process.execPath, ${argvJson}, { stdio: ["inherit", "pipe", "inherit"] });`,
-    `child.stdout.destroy();`,
+    `const stdio = ["inherit", "inherit", "inherit"];`,
+    `stdio[${stream === "stdout" ? 1 : 2}] = "pipe";`,
+    `const child = spawn(process.execPath, ${argvJson}, { stdio });`,
+    `child.${stream}.destroy();`,
     `for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(signal, () => {});`,
     `child.on("exit", (code) => process.exit(code ?? 1));`,
   ].join("\n");
@@ -672,8 +690,8 @@ const spawnSupabaseProgram = Effect.fnUntraced(function* (
   // build artifact without needing platform wrapper packages.
   env["SUPABASE_CLI_BINARY_OVERRIDE"] = BINARY_PATH;
   const shimArgs = [SHIM_PATH, ...args];
-  const commandArgs = options?.closeStdout
-    ? ["-e", closedStdoutRelay(yield* encodeArgv(shimArgs))]
+  const commandArgs = options?.closeStream
+    ? ["-e", closedStreamRelay(yield* encodeArgv(shimArgs), options.closeStream)]
     : shimArgs;
   const command = ChildProcess.make("node", commandArgs, {
     cwd: options?.cwd,
diff --git a/apps/cli/tests/helpers/command-flags.ts b/apps/cli/tests/helpers/command-flags.ts
index 4758cf7417..f8b54c45b5 100644
--- a/apps/cli/tests/helpers/command-flags.ts
+++ b/apps/cli/tests/helpers/command-flags.ts
@@ -1,3 +1,4 @@
+import { hasOptionalSubcommand } from "../../src/shared/output/optional-subcommand-usage.ts";
 import type { Command } from "effect/cli";
 
 import { rootCommandForFeatures } from "../../src/cli/root.ts";
@@ -66,6 +67,7 @@ export interface TreeNode {
   /** What each of {@link flags} accepts; a node's own definition wins over an inherited one of the same name. */
   readonly flagInfo: ReadonlyMap<string, FlagInfo>;
   readonly isLeaf: boolean;
+  readonly isExecutable: boolean;
 }
 
 function walk(
@@ -82,6 +84,7 @@ function walk(
     flags: new Set(flagInfo.keys()),
     flagInfo,
     isLeaf: children.length === 0,
+    isExecutable: children.length === 0 || hasOptionalSubcommand(command),
   });
   for (const child of children) walk(child, [...path, child.name], flags, out);
 }
diff --git a/apps/cli/tests/helpers/command-mocks.ts b/apps/cli/tests/helpers/command-mocks.ts
index 1367aa9394..c9ad1c5c5c 100644
--- a/apps/cli/tests/helpers/command-mocks.ts
+++ b/apps/cli/tests/helpers/command-mocks.ts
@@ -1,6 +1,6 @@
 import { legacyProjectStateLayer } from "../../src/shared/config/legacy-project-state.layer.ts";
 
-import { BunFileSystem, BunPath, BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunFileSystem, BunPath, BunServices } from "@effect/platform-bun";
 import {
   type ApiClient,
   makeApiClient,
@@ -427,6 +427,7 @@ export function mockCommandSettings(opts: {
   readonly userAgent?: string;
   readonly supabaseHome?: string;
   readonly githubToken?: Option.Option<Redacted.Redacted<string>>;
+  readonly apiMaxRetries?: Option.Option<number>;
 }): Layer.Layer<CommandSettings> {
   return Layer.succeed(CommandSettings, {
     githubToken: opts.githubToken ?? Option.none(),
@@ -444,6 +445,7 @@ export function mockCommandSettings(opts: {
     workdirEnvValue:
       opts.workdirEnvValue === undefined ? Option.none() : Option.some(opts.workdirEnvValue),
     userAgent: opts.userAgent ?? DEFAULT_USER_AGENT,
+    apiMaxRetries: opts.apiMaxRetries ?? Option.none(),
   });
 }
 
@@ -538,6 +540,7 @@ export interface MockCommandPlatformApiOpts {
   readonly apiUrl?: string;
   readonly userAgent?: string;
   readonly accessToken?: string;
+  readonly clientMaxRetries?: number;
 }
 
 export interface MockCommandPlatformApiResult {
@@ -609,7 +612,7 @@ export function mockCommandPlatformApi(
         accessToken: opts.accessToken ?? VALID_TOKEN,
         userAgent: opts.userAgent ?? DEFAULT_USER_AGENT,
       },
-      { retry: { maxRetries: 0 } },
+      { retry: { maxRetries: opts.clientMaxRetries ?? 0 } },
     ),
   ).pipe(Layer.provide(httpClientLayer));
 
@@ -1014,7 +1017,7 @@ export function mockShadowContainerCliSpawner(
     ChildProcessSpawner.ChildProcessSpawner,
     ChildProcessSpawner.make((command) =>
       Effect.gen(function* () {
-        const args = command._tag === "StandardCommand" ? command.args : [];
+        const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
         spawned.push({ args });
         if (command._tag !== "StandardCommand") {
           return yield* new PlatformError(
@@ -1274,7 +1277,7 @@ export function mockDockerDaemonCliSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push(args);
 
       let exitCode = 0;
@@ -1478,8 +1481,8 @@ export function buildTestRuntime(opts: BuildTestRuntimeOpts) {
   const httpClient = opts.api.httpClientLayer;
   const platform =
     opts.fileSystem === undefined
-      ? BunServices.layer
-      : Layer.merge(BunServices.layer, opts.fileSystem);
+      ? Layer.merge(BunServices.layer, BunCrypto.layer)
+      : Layer.mergeAll(BunServices.layer, BunCrypto.layer, opts.fileSystem);
 
   // When the caller doesn't expose an HttpClient layer, use a stub that fails
   // loudly if any code path tries to consume it. Always wiring HttpClient at
@@ -1525,7 +1528,9 @@ export function buildTestRuntime(opts: BuildTestRuntimeOpts) {
     Layer.succeed(CliArgs, { args: opts.cliArgs ?? [] }),
     opts.commandPath === undefined
       ? Layer.empty
-      : commandRuntimeLayer(opts.commandPath).pipe(Layer.provide(BunServices.layer)),
+      : commandRuntimeLayer(opts.commandPath).pipe(
+          Layer.provide([BunServices.layer, BunCrypto.layer]),
+        ),
     linkedProjectCache,
     telemetry,
     analytics,
diff --git a/apps/cli/tests/helpers/compute-target-selection.ts b/apps/cli/tests/helpers/compute-target-selection.ts
index 96e7d59e30..0a8da5b61d 100644
--- a/apps/cli/tests/helpers/compute-target-selection.ts
+++ b/apps/cli/tests/helpers/compute-target-selection.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { Effect, FileSystem, Layer, Path } from "effect";
 
 import { commandRuntimeLayer } from "../../src/shared/runtime/command-runtime.layer.ts";
@@ -67,7 +67,9 @@ export function describeComputeTargetSelection(
       return {
         layer: Layer.mergeAll(
           layer,
-          commandRuntimeLayer(path.split(" ")).pipe(Layer.provide(BunServices.layer)),
+          commandRuntimeLayer(path.split(" ")).pipe(
+            Layer.provide([BunServices.layer, BunCrypto.layer]),
+          ),
         ),
         requests: () => http.driftRequests,
         warnings: () => warningsOf(out),
diff --git a/apps/cli/tests/helpers/compute.ts b/apps/cli/tests/helpers/compute.ts
index 03c9cc7aae..4ccd09f730 100644
--- a/apps/cli/tests/helpers/compute.ts
+++ b/apps/cli/tests/helpers/compute.ts
@@ -48,6 +48,7 @@ interface RecordedRequest {
 }
 
 interface StubResponse {
+  readonly headers?: Readonly<Record<string, string>>;
   readonly status: number;
   readonly body?: unknown;
 }
@@ -88,7 +89,7 @@ function respond(
     request,
     new Response(hasBody ? encodedBody : "", {
       status: stub.status,
-      headers: hasBody ? { "content-type": "application/json" } : { "content-type": "text/plain" },
+      headers: { "content-type": hasBody ? "application/json" : "text/plain", ...stub.headers },
     }),
   );
 }
@@ -127,7 +128,12 @@ function mockComputeHttp(routes: ComputeHttpRoutes) {
         method: request.method,
         url: request.url,
         // UrlParams is iterable over [key, value] pairs, not an array.
-        urlParams: Object.fromEntries(request.urlParams),
+        urlParams: Object.fromEntries(
+          Array.from(request.urlParams, ([key, value]) => [
+            key,
+            Redacted.isRedacted(value) ? Redacted.value(value) : value,
+          ]),
+        ),
         body: new TextDecoder().decode(bytes),
         byteLength: bytes.length,
       });
@@ -260,20 +266,9 @@ export function computeResource(options: {
 
 export const computeRoute = (suffix = "") => `/v2/projects/${COMPUTE_PROJECT_REF}/compute${suffix}`;
 
-/**
- * The unified logs endpoint `compute logs` queries. Not under `/v2/.../compute` —
- * there is no compute-scoped log route.
- */
 export const computeLogsRoute = () =>
   `/v1/projects/${COMPUTE_PROJECT_REF}/analytics/endpoints/logs`;
 
-/**
- * One row as the logs endpoint returns it, matching the projection in
- * `computeLogsQuery`.
- *
- * `log_attributes` values are all strings — the column is a
- * `Map(String, String)`, so `status` arrives as `"200"`.
- */
 export function computeLogRow(options: {
   readonly id?: string;
   readonly tsMs?: number;
@@ -297,7 +292,6 @@ export function computeLogRow(options: {
   };
 }
 
-/** An HTTP access log row, whose fields live in `log_attributes`, not the message. */
 export function computeIngressLogRow(options: {
   readonly id?: string;
   readonly tsMs?: number;
@@ -314,7 +308,7 @@ export function computeIngressLogRow(options: {
     ...(options.tsMs === undefined ? {} : { tsMs: options.tsMs }),
     ...(options.compute === undefined ? {} : { compute: options.compute }),
     stream: "worker_ingress_logs",
-    // Only method and path go in the message, matching the wire format.
+
     message: `${method} ${path}`,
     attributes: {
       method,
@@ -326,7 +320,6 @@ export function computeIngressLogRow(options: {
   });
 }
 
-/** A build/deploy lifecycle row. */
 export function computeApiLogRow(options: {
   readonly id?: string;
   readonly tsMs?: number;
@@ -406,6 +399,7 @@ const testCliConfigLayer = (workdir: string, explicitWorkdir: boolean) =>
         explicitWorkdir,
         workdirEnvValue: Option.none(),
         userAgent: "supabase",
+        apiMaxRetries: Option.none(),
       });
     }),
   ).pipe(Layer.provide(BunServices.layer));
diff --git a/apps/cli/tests/helpers/config-fixtures.ts b/apps/cli/tests/helpers/config-fixtures.ts
index b8605c097d..d619e7916e 100644
--- a/apps/cli/tests/helpers/config-fixtures.ts
+++ b/apps/cli/tests/helpers/config-fixtures.ts
@@ -64,6 +64,7 @@ export function v2ProjectConfigResponse(
       mailer_secure_email_change_enabled: true,
       mailer_autoconfirm: true,
       security_update_password_require_reauthentication: false,
+      security_update_password_require_current_password: false,
       mailer_otp_length: 6,
       mailer_otp_exp: 3600,
       smtp_max_frequency: 1,
diff --git a/apps/cli/tests/helpers/db-target-selection.ts b/apps/cli/tests/helpers/db-target-selection.ts
index 4f2313d56c..e7544df031 100644
--- a/apps/cli/tests/helpers/db-target-selection.ts
+++ b/apps/cli/tests/helpers/db-target-selection.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, FileSystem, Layer, Option, Path, Predicate, type Scope } from "effect";
 import { CliOutput, Command } from "effect/cli";
@@ -339,6 +339,7 @@ export function describeDbTargetSelection<R>(
             Effect.provide(
               Layer.mergeAll(
                 BunServices.layer,
+                BunCrypto.layer,
                 legacyProjectStateLayer.pipe(Layer.provide(BunServices.layer)),
                 CliOutput.layer(textCliOutputFormatter()),
                 Layer.succeed(CliArgs, { args }),
diff --git a/apps/cli/tests/helpers/docker-image.unit.test.ts b/apps/cli/tests/helpers/docker-image.unit.test.ts
index 89a885552e..0a3f4aa67a 100644
--- a/apps/cli/tests/helpers/docker-image.unit.test.ts
+++ b/apps/cli/tests/helpers/docker-image.unit.test.ts
@@ -20,7 +20,7 @@ function mockSpawner(
 
   const spawner = ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
-      const args = command._tag === "StandardCommand" ? command.args : [];
+      const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
       spawned.push(args);
       const result = handler(args);
 
diff --git a/apps/cli/tests/helpers/docker-model.ts b/apps/cli/tests/helpers/docker-model.ts
index 9c17b88394..7f4ef07b97 100644
--- a/apps/cli/tests/helpers/docker-model.ts
+++ b/apps/cli/tests/helpers/docker-model.ts
@@ -191,6 +191,7 @@ export function dockerModel(hooks: DockerModelHooks = {}) {
         exitCode: 0,
         stdout: [
           format
+            .replaceAll("{{.Client.DefaultAPIVersion}}", "1.45")
             .replaceAll("{{.Client.APIVersion}}", "1.45")
             .replaceAll("{{.Server.APIVersion}}", "1.45"),
         ],
@@ -204,7 +205,7 @@ export function dockerModel(hooks: DockerModelHooks = {}) {
     ChildProcessSpawner.ChildProcessSpawner,
     ChildProcessSpawner.make((command) =>
       Effect.gen(function* () {
-        const args = ChildProcess.isStandardCommand(command) ? command.args : [];
+        const args = ChildProcess.isStandardCommand(command) ? command.args.map(String) : [];
         commands.push(args);
         const override = hooks.before === undefined ? undefined : yield* hooks.before(args);
         const result = override ?? handle(args);
diff --git a/apps/cli/tests/helpers/hosted-target-selection.ts b/apps/cli/tests/helpers/hosted-target-selection.ts
index b1cede7880..c0871252fd 100644
--- a/apps/cli/tests/helpers/hosted-target-selection.ts
+++ b/apps/cli/tests/helpers/hosted-target-selection.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Option, Path, Stdio } from "effect";
 
@@ -221,7 +221,7 @@ const hostedLayer = (
 ) =>
   Layer.mergeAll(
     buildTestRuntime(runtime),
-    commandRuntimeLayer(words).pipe(Layer.provide(BunServices.layer)),
+    commandRuntimeLayer(words).pipe(Layer.provide([BunServices.layer, BunCrypto.layer])),
     Layer.succeed(YesFlag, true),
     Layer.succeed(TargetPolicy, { group: "hosted", consent: "yes" }),
     Stdio.layerTest({ args: Effect.succeed(argv) }),
diff --git a/apps/cli/tests/helpers/live-project.integration.test.ts b/apps/cli/tests/helpers/live-project.integration.test.ts
index 3d99a9c9fe..ebe30d76a9 100644
--- a/apps/cli/tests/helpers/live-project.integration.test.ts
+++ b/apps/cli/tests/helpers/live-project.integration.test.ts
@@ -7,7 +7,7 @@ import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { cliConfigProviderLayer } from "../../src/shared/config/cli-config-provider.layer.ts";
-import { provisionLiveEnvironment } from "./live-project.ts";
+import { cleanupLiveEnvironment, provisionLiveEnvironment } from "./live-project.ts";
 
 const ref = "abcdefghijklmnopqrst";
 function jsonResponse(
@@ -137,4 +137,111 @@ describe("live project provisioning", () => {
       ),
     );
   });
+
+  it("provisions with the new API keys when the project's legacy keys are disabled", () => {
+    vi.stubEnv("SUPABASE_LIVE_API_URL", "https://api.supabase.green");
+    vi.stubEnv("SUPABASE_ACCESS_TOKEN", "test-token");
+    vi.stubEnv("SUPABASE_LIVE_ORG_ID", "org-slug");
+    vi.stubEnv("SUPABASE_LIVE_REGION", "us-east-1");
+    vi.stubEnv("SUPABASE_LIVE_KEEP_PROJECT", "0");
+
+    const bucketApiKeys: Array<string | undefined> = [];
+    const ownedProjects = new Set<string>();
+    const platformApi = Layer.succeed(
+      HttpClient.HttpClient,
+      HttpClient.make((request) => {
+        const url = new URL(request.url);
+        if (request.method === "GET" && url.pathname === "/v1/organizations") {
+          return Effect.succeed(
+            jsonResponse(request, 200, [{ id: "org-id", slug: "org-slug", name: "Test" }]),
+          );
+        }
+        if (request.method === "POST" && url.pathname === "/v1/projects") {
+          ownedProjects.add(ref);
+          return Effect.succeed(jsonResponse(request, 201, { ...project, database: undefined }));
+        }
+        if (request.method === "GET" && url.pathname === `/v1/projects/${ref}`) {
+          return Effect.succeed(jsonResponse(request, 200, project));
+        }
+        if (request.method === "GET" && url.pathname === `/v1/projects/${ref}/api-keys`) {
+          return Effect.succeed(
+            jsonResponse(request, 200, [
+              { name: "anon", type: "legacy", api_key: "legacy-anon-jwt" },
+              { name: "service_role", type: "legacy", api_key: "legacy-service-role-jwt" },
+              { name: "default", type: "publishable", api_key: "sb_publishable_live" },
+              {
+                name: "default",
+                type: "secret",
+                api_key: "sb_secret_live",
+                secret_jwt_template: { role: "service_role" },
+              },
+            ]),
+          );
+        }
+        if (
+          request.method === "GET" &&
+          url.pathname === `/v1/projects/${ref}/config/database/pooler`
+        ) {
+          return Effect.succeed(
+            jsonResponse(request, 200, [
+              {
+                identifier: "primary",
+                database_type: "PRIMARY",
+                is_using_scram_auth: false,
+                db_user: `postgres.${ref}`,
+                db_host: "aws-0-us-east-1.pooler.supabase.green",
+                db_port: 6543,
+                db_name: "postgres",
+                connection_string: `postgresql://postgres.${ref}:[YOUR-PASSWORD]@aws-0-us-east-1.pooler.supabase.green:6543/postgres`,
+                connectionString: "",
+                default_pool_size: null,
+                max_client_conn: null,
+                pool_mode: "transaction",
+              },
+            ]),
+          );
+        }
+        if (
+          request.method === "POST" &&
+          url.href === `https://${ref}.supabase.green/storage/v1/bucket`
+        ) {
+          const apiKey = request.headers["apikey"];
+          bucketApiKeys.push(apiKey);
+          return Effect.succeed(
+            apiKey === "sb_secret_live"
+              ? jsonResponse(request, 200, { name: "supabase-cli-live-bucket" })
+              : jsonResponse(request, 401, { message: "Legacy API keys are disabled" }),
+          );
+        }
+        if (request.method === "DELETE" && url.pathname === `/v1/projects/${ref}`) {
+          ownedProjects.delete(ref);
+          return Effect.succeed(jsonResponse(request, 200, { id: 1, ref, name: "live-test" }));
+        }
+        return Effect.die(`unexpected request ${request.method} ${url.href}`);
+      }),
+    );
+
+    return Effect.runPromise(
+      Effect.gen(function* () {
+        const client = yield* makeApiClient({
+          baseUrl: "https://api.supabase.green",
+          accessToken: "test-token",
+        });
+
+        const environment = yield* provisionLiveEnvironment(client);
+        yield* cleanupLiveEnvironment(client, environment);
+
+        expect(environment.project).toMatchObject({
+          anonKey: "sb_publishable_live",
+          serviceRoleKey: "sb_secret_live",
+        });
+        expect(bucketApiKeys).toEqual(["sb_secret_live"]);
+        expect(ownedProjects).toEqual(new Set());
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(platformApi, BunFileSystem.layer, BunPath.layer, cliConfigProviderLayer),
+        ),
+      ),
+    );
+  });
 });
diff --git a/apps/cli/tests/helpers/live-project.ts b/apps/cli/tests/helpers/live-project.ts
index f63727ec70..bd9b54af6c 100644
--- a/apps/cli/tests/helpers/live-project.ts
+++ b/apps/cli/tests/helpers/live-project.ts
@@ -19,6 +19,8 @@ import * as HttpClientError from "effect/http/HttpClientError";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import { getDomain } from "tldts";
 
+import { kongAuthHeaders } from "../../src/command-internal/kong-auth.ts";
+import { extractServiceKeys } from "../../src/command-internal/tenant-keys.ts";
 import {
   deriveLiveProjectHost,
   keepLiveProject,
@@ -37,7 +39,6 @@ const POLL_TIMEOUT = "5 minutes";
 
 type Project = OperationOutput<"v1GetProject">;
 type Organization = OperationOutput<"v1ListAllOrganizations">[number];
-type ApiKey = OperationOutput<"v1GetProjectApiKeys">[number];
 export type PoolerConfig = OperationOutput<"v1GetPoolerConfig">[number];
 type LiveApi = Effect.Success<ReturnType<typeof makeApiClient>>;
 type Region =
@@ -386,18 +387,12 @@ function keysReadiness(
   return api.v1.getProjectApiKeys({ ref, reveal: true }).pipe(
     Effect.mapError((cause) => classifyPollError("project API keys", cause)),
     Effect.flatMap((keys) => {
-      const keyValue = (key: ApiKey): string | undefined => key.api_key ?? undefined;
-      const anonKey = keys.find((key) => key.name === "anon");
-      const serviceRoleKey =
-        keys.find((key) => key.name === "service_role") ??
-        keys.find((key) => key.api_key?.startsWith("sb_secret_"));
-      const anon = anonKey === undefined ? undefined : keyValue(anonKey);
-      const service = serviceRoleKey === undefined ? undefined : keyValue(serviceRoleKey);
-      return anon === undefined || service === undefined
+      const { anon, serviceRole } = extractServiceKeys(keys);
+      return anon === "" || serviceRole === ""
         ? Effect.fail(
             new LiveTransientPoll({ phase: "project API keys", cause: "keys incomplete" }),
           )
-        : Effect.succeed({ anonKey: anon, serviceRoleKey: service });
+        : Effect.succeed({ anonKey: anon, serviceRoleKey: serviceRole });
     }),
   );
 }
@@ -495,7 +490,7 @@ function createStorageBucket(
         `https://${ref}.${host}/storage/v1/bucket`,
       ).pipe(
         HttpClientRequest.setHeaders({
-          Authorization: `Bearer ${serviceRoleKey}`,
+          ...kongAuthHeaders(serviceRoleKey),
           "Content-Type": "application/json",
         }),
         HttpClientRequest.bodyJson({ id: bucket, name: bucket, public: false }),
diff --git a/apps/cli/tests/helpers/live.ts b/apps/cli/tests/helpers/live.ts
index 3bfcd04e58..0d9c0e9ce1 100644
--- a/apps/cli/tests/helpers/live.ts
+++ b/apps/cli/tests/helpers/live.ts
@@ -4,7 +4,7 @@ import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
 import pg from "pg";
 import { expect, inject, test as vitestTest } from "vitest";
 
-import { rootCaBundle } from "../../src/commands/gen/types/types.shared.ts";
+import { rootCaBundle } from "../../src/command-internal/supabase-tls.ts";
 import {
   type CliRunError,
   requireCliSuccess,
@@ -326,6 +326,32 @@ export function removeLiveMigration(
   );
 }
 
+const PLATFORM_DATABASE_RESTART = /\b57P01\b|the database system is shutting down/u;
+
+function isPlatformDatabaseRestart(output: string): boolean {
+  return PLATFORM_DATABASE_RESTART.test(output);
+}
+
+/**
+ * Cleanup `db reset` of the shared project, re-issued once when the platform restarted the
+ * database, so a leftover migration can't fail the next migration live file.
+ */
+export const resetLiveDatabase = Effect.fn("Live.resetDatabase")(function* (
+  cliEffect: LiveFixtures["cliEffect"],
+  project: LiveProject,
+  label: string,
+) {
+  const reset = Effect.suspend(() =>
+    cliEffect(["db", "reset", "--yes", `--remote=${project.dbUrl}`]),
+  );
+  const first = yield* reset;
+  const restarted = first.exitCode !== 0 && isPlatformDatabaseRestart(first.stderr);
+  yield* Effect.annotateCurrentSpan({ attempts: restarted ? 2 : 1 });
+  if (!restarted) return requireCliSuccess(first, label);
+  yield* Effect.logWarning(`${label} hit a platform database restart, re-issuing\n${first.stderr}`);
+  return requireCliSuccess(yield* reset, `${label} re-issued after a platform database restart`);
+});
+
 /**
  * Proves a postgres-config write through `get`. The platform can serve a stale
  * read right after the PUT, so after one fail-fast read the value is polled
diff --git a/apps/cli/tests/helpers/live.unit.test.ts b/apps/cli/tests/helpers/live.unit.test.ts
index 51f8a01d70..6528d851fc 100644
--- a/apps/cli/tests/helpers/live.unit.test.ts
+++ b/apps/cli/tests/helpers/live.unit.test.ts
@@ -1,7 +1,41 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it } from "@effect/vitest";
+import { Cause, Effect, Exit } from "effect";
 
 import { requireCliSuccess } from "./cli.ts";
-import { throwWithCleanup } from "./live.ts";
+import {
+  type LiveFixtures,
+  type LiveProject,
+  resetLiveDatabase,
+  throwWithCleanup,
+} from "./live.ts";
+
+const project: LiveProject = {
+  ref: "abcdefghijklmnopqrst",
+  dbUrl: "postgresql://postgres:password@example.com:5432/postgres",
+  dbPassword: "password",
+  anonKey: "anon",
+  serviceRoleKey: "service-role",
+  functionsUrl: "https://example.com/functions",
+  storageBucket: "bucket",
+};
+const restarted = {
+  exitCode: 1,
+  stdout: "",
+  stderr:
+    "failed to connect to postgres: server error (FATAL: terminating connection due to administrator command (SQLSTATE 57P01))",
+};
+const refused = { exitCode: 1, stdout: "", stderr: "permission denied for schema public" };
+const reset = { exitCode: 0, stdout: "", stderr: "Resetting remote database..." };
+
+function scriptedCli(results: ReadonlyArray<typeof reset>) {
+  const calls: string[] = [];
+  const cliEffect: LiveFixtures["cliEffect"] = (args) =>
+    Effect.sync(() => {
+      calls.push(args.join(" "));
+      return results[calls.length - 1] ?? reset;
+    });
+  return { calls, cliEffect };
+}
 
 describe("requireCliSuccess", () => {
   it("passes a zero exit through", () => {
@@ -50,3 +84,44 @@ describe("throwWithCleanup", () => {
     expect(thrown.errors).toEqual([primary, ...cleanup]);
   });
 });
+
+describe("resetLiveDatabase", () => {
+  const failureOf = (cliEffect: LiveFixtures["cliEffect"]) =>
+    Effect.exit(resetLiveDatabase(cliEffect, project, "db reset cleanup")).pipe(
+      Effect.map((exit) => (Exit.isFailure(exit) ? String(Cause.squash(exit.cause)) : undefined)),
+    );
+
+  it.effect("re-issues the reset once when the platform restarted the database", () =>
+    Effect.gen(function* () {
+      const { calls, cliEffect } = scriptedCli([restarted, reset]);
+
+      expect(yield* failureOf(cliEffect)).toBeUndefined();
+      expect(calls).toEqual([
+        `db reset --yes --remote=${project.dbUrl}`,
+        `db reset --yes --remote=${project.dbUrl}`,
+      ]);
+    }),
+  );
+
+  it.effect("fails without re-issuing a reset that failed for another reason", () =>
+    Effect.gen(function* () {
+      const { calls, cliEffect } = scriptedCli([refused, reset]);
+
+      expect(yield* failureOf(cliEffect)).toMatch(
+        /db reset cleanup failed \(exit 1\)[\s\S]*permission denied/u,
+      );
+      expect(calls).toHaveLength(1);
+    }),
+  );
+
+  it.effect("names the re-issue when the platform restarts the database twice", () =>
+    Effect.gen(function* () {
+      const { calls, cliEffect } = scriptedCli([restarted, restarted]);
+
+      expect(yield* failureOf(cliEffect)).toMatch(
+        /db reset cleanup re-issued after a platform database restart failed/u,
+      );
+      expect(calls).toHaveLength(2);
+    }),
+  );
+});
diff --git a/apps/cli/tests/helpers/local-reset.ts b/apps/cli/tests/helpers/local-reset.ts
index 429c96b195..1703a5fa97 100644
--- a/apps/cli/tests/helpers/local-reset.ts
+++ b/apps/cli/tests/helpers/local-reset.ts
@@ -28,7 +28,7 @@ export function mockContainerCliSpawner(route: (args: ReadonlyArray<string>) =>
     ChildProcessSpawner.ChildProcessSpawner,
     ChildProcessSpawner.make((command) =>
       Effect.gen(function* () {
-        const args = command._tag === "StandardCommand" ? command.args : [];
+        const args = command._tag === "StandardCommand" ? command.args.map(String) : [];
         spawned.push({ args });
 
         if (command._tag !== "StandardCommand") {
diff --git a/apps/cli/tests/helpers/mocks.ts b/apps/cli/tests/helpers/mocks.ts
index eec45e65cc..911c045fe8 100644
--- a/apps/cli/tests/helpers/mocks.ts
+++ b/apps/cli/tests/helpers/mocks.ts
@@ -1,6 +1,6 @@
 import { tmpdir } from "node:os";
 import process from "node:process";
-import { BunPath, BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunPath, BunServices } from "@effect/platform-bun";
 import { ConfigEnvPins, definedEnv } from "./config-env-pins.ts";
 import {
   Console,
@@ -142,6 +142,26 @@ export function mockTty(
   });
 }
 
+/**
+ * Stands in for a direct write that left a real process stream `errored`, until the scope closes.
+ * A configurable own getter, unlike a spy on Bun's non-configurable inherited one, is removed again.
+ */
+export const overrideStreamErrored = (stream: NodeJS.WriteStream, errored: () => Error | null) =>
+  Effect.acquireRelease(
+    Effect.sync(() => {
+      const own = Object.getOwnPropertyDescriptor(stream, "errored");
+      Object.defineProperty(stream, "errored", { configurable: true, get: errored });
+      return own;
+    }),
+    (own) =>
+      Effect.sync(() => {
+        if (own === undefined) Reflect.deleteProperty(stream, "errored");
+        else Object.defineProperty(stream, "errored", own);
+      }),
+  );
+
+export const epipe = () => Object.assign(new Error("EPIPE"), { code: "EPIPE" });
+
 export function mockRuntimeInfo(
   opts: {
     cwd?: string;
@@ -712,6 +732,7 @@ export function emptyEnv(env: Readonly<Record<string, string | undefined>> = {})
   const analytics = mockAnalytics();
   return Layer.mergeAll(
     BunServices.layer,
+    BunCrypto.layer,
     runtimeInfoLayer,
     cliProjectContextLayer,
     cliProjectHomeLayer,
diff --git a/apps/cli/tests/helpers/notebooks.ts b/apps/cli/tests/helpers/notebooks.ts
index 60bc890331..de0b5a09c7 100644
--- a/apps/cli/tests/helpers/notebooks.ts
+++ b/apps/cli/tests/helpers/notebooks.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { makeApiClient } from "@supabase/api/effect";
 import { Effect, FileSystem, Layer, Option, Path, Predicate, Stdio } from "effect";
 import * as HttpClient from "effect/http/HttpClient";
@@ -342,7 +342,9 @@ export function setupNotebooks(options: NotebooksSetupOptions) {
       linkedProjectCache,
       analytics.layer,
       process.layer,
-      commandRuntimeLayer(["notebooks", command]).pipe(Layer.provide(BunServices.layer)),
+      commandRuntimeLayer(["notebooks", command]).pipe(
+        Layer.provide([BunServices.layer, BunCrypto.layer]),
+      ),
       Layer.succeed(
         OutputFlag,
         options.outputFlag === undefined ? Option.none() : Option.some(options.outputFlag),
diff --git a/apps/cli/tests/helpers/permission-real-layers.ts b/apps/cli/tests/helpers/permission-real-layers.ts
index 242cc13cbb..a2e17b63dc 100644
--- a/apps/cli/tests/helpers/permission-real-layers.ts
+++ b/apps/cli/tests/helpers/permission-real-layers.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { ConfigProvider, Effect, Layer, Option } from "effect";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
@@ -94,6 +94,7 @@ export function realDbConfigResolver(opts: {
       Layer.provide(services),
     ),
     services,
+    BunCrypto.layer,
     ConfigProvider.layer(ConfigProvider.fromEnvRecord(opts.env, { preserveEmptyStrings: true })),
     configValuesLayer({ env: definedEnv(opts.env) }),
   );
diff --git a/apps/cli/tests/helpers/refuse-invalid-db-hosts.ts b/apps/cli/tests/helpers/refuse-invalid-db-hosts.ts
index a989c82d89..ee8e1465e0 100644
--- a/apps/cli/tests/helpers/refuse-invalid-db-hosts.ts
+++ b/apps/cli/tests/helpers/refuse-invalid-db-hosts.ts
@@ -6,11 +6,14 @@ export interface DirectHostToggle {
   directHostReachable: boolean;
 }
 
+const FIXTURE_DB_HOST_SUFFIXES = [".invalid", ".supabase.co", ".supabase.red", ".snapcloud.dev"];
+
 /**
- * Wraps `node:net` so a connection to a `db.<ref>.invalid` fixture host fails at once instead of
- * waiting on ambient DNS or TCP timing. Use it from a test file's `vi.mock("node:net", ...)`
- * factory; other hosts connect normally. While the toggle passed in is on, the same hosts report a
- * successful connect instead, which fakes the TCP reachability probe only (nothing is dialed).
+ * Wraps `node:net` so a connection to a `db.<ref>` fixture host on one of
+ * `FIXTURE_DB_HOST_SUFFIXES` fails at once instead of waiting on ambient DNS or TCP timing. Use it
+ * from a test file's `vi.mock("node:net", ...)` factory; other hosts connect normally. While the
+ * toggle passed in is on, the same hosts report a successful connect instead, which fakes the TCP
+ * reachability probe only (nothing is dialed).
  */
 export function refuseInvalidDbHosts(
   net: typeof NodeNet,
@@ -20,7 +23,11 @@ export function refuseInvalidDbHosts(
     ...net,
     connect: (connectOptions: NodeNet.NetConnectOpts) => {
       const host = "host" in connectOptions ? connectOptions.host : undefined;
-      if (typeof host !== "string" || !host.startsWith("db.") || !host.endsWith(".invalid")) {
+      if (
+        typeof host !== "string" ||
+        !host.startsWith("db.") ||
+        !FIXTURE_DB_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix))
+      ) {
         return net.connect(connectOptions);
       }
       const socket = new net.Socket();
diff --git a/apps/cli/tests/helpers/stack-cleanup.integration.test.ts b/apps/cli/tests/helpers/stack-cleanup.integration.test.ts
index 99740cfddd..60ac99e6dc 100644
--- a/apps/cli/tests/helpers/stack-cleanup.integration.test.ts
+++ b/apps/cli/tests/helpers/stack-cleanup.integration.test.ts
@@ -1,11 +1,11 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Layer, Path } from "effect";
 import { StackApi, stackApiLayer } from "../../src/command-internal/stack-api.ts";
 import { destroyTestStacks } from "./stack-cleanup.ts";
 import { selection } from "./pins.ts";
 
-const liveStackApi = stackApiLayer.pipe(Layer.provide(BunServices.layer));
+const liveStackApi = stackApiLayer.pipe(Layer.provide([BunServices.layer, BunCrypto.layer]));
 
 describe("test stack cleanup", () => {
   it.live(
diff --git a/apps/cli/tests/helpers/storage.ts b/apps/cli/tests/helpers/storage.ts
index c6b2812380..b0dfc9f729 100644
--- a/apps/cli/tests/helpers/storage.ts
+++ b/apps/cli/tests/helpers/storage.ts
@@ -1,4 +1,4 @@
-import { BunServices } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { ConfigProvider, Effect, FileSystem, Layer, Option, Path, Redacted, Stream } from "effect";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
@@ -520,6 +520,7 @@ export function setupStorage(workdir: string, opts: SetupStorageOptions) {
       : realLinkedProjectCache({ httpClient: recorded.httpClientLayer, cliSettings }),
     cliSettings,
     BunServices.layer,
+    BunCrypto.layer,
     cliConfigValuesTestLayer,
     projectRefLayer,
     recorded === undefined
@@ -542,7 +543,9 @@ export function setupStorage(workdir: string, opts: SetupStorageOptions) {
     Layer.succeed(CliArgs, { args: opts.cliArgs ?? [] }),
     opts.commandPath === undefined
       ? Layer.empty
-      : commandRuntimeLayer(opts.commandPath).pipe(Layer.provide(BunServices.layer)),
+      : commandRuntimeLayer(opts.commandPath).pipe(
+          Layer.provide([BunServices.layer, BunCrypto.layer]),
+        ),
     unusedStackServices,
     stackApi.layer,
     ...(opts.stackBackend === true ? [stackBackendLayer("stack")] : []),
diff --git a/apps/docs/content/docs/logs.mdx b/apps/docs/content/docs/logs.mdx
new file mode 100644
index 0000000000..9e6e36f249
--- /dev/null
+++ b/apps/docs/content/docs/logs.mdx
@@ -0,0 +1,95 @@
+---
+title: Logs
+description: Read hosted or retained local logs and load newer results on demand
+---
+
+Use `supabase logs` to read local or hosted logs. The command defaults to your local stack.
+
+```sh
+supabase logs
+supabase logs --remote --service postgres --level error
+supabase logs sources --remote
+```
+
+Use `--remote` for the linked project, `--remote=<ref>` for another project, or `--remote=<branch>` for a branch of the linked project. Local logs require `SUPABASE_EXPERIMENTAL_STACK=1` or `stack = true` under `[experimental]` in your CLI config. Use `--remote` to read hosted logs.
+
+## Browse logs
+
+An interactive terminal opens a log browser when you omit `--output-format`. Use `--output-format text` for one plain-text read. The browser also stays closed in CI, with `TERM=dumb`, or when stdin or stdout is not a terminal. The first load reads the latest 100 lines from the last hour. Use `--limit` to change the initial line count, up to 1000.
+
+Use the up and down arrows to select a row. Enter opens its full details, and Escape returns to the list. `C` copies the full selected record as indented JSON, including metadata and the original timestamp. `q` exits.
+
+Press `L` to load newer logs through the current time. The browser keeps your selection and viewport. It does not poll in the background. A failed load opens the full error in a scrollable panel. Use the arrows to scroll, Escape to return to the previous list or details, or `L` to retry. The browser preserves your rows, selection, window, and detail scroll. `C` is inactive while the error panel is open.
+
+Hosted filtered refreshes read up to five pages of 1000 rows per load. If more rows remain, the header shows `more pending`. Press `L` to continue toward the same captured end. The next load advances the end once that range is complete. The footer reports the page being loaded. A rate-limited page shows its wait duration and UTC retry time, then retries once after at least 60 seconds, or longer when `Retry-After` requires it. You can quit during the wait.
+
+The header shows the hosted project name and ref, or the selected local stack, plus active filters. If the project name cannot be resolved, it shows the ref. The `Window:` header shows the requested time range, including its captured end. A successful load can extend that end; pending hosted pages keep the same end until the range is complete. For filtered logs, the browser retains up to 1000 rows and approximately 8 MiB, with a visible notice when older rows are discarded. Open details stay pinned to their record. `NO_COLOR` preserves the selection marker without styling.
+
+Copying uses your system clipboard and reports success or failure in the footer. On Linux, install `wl-clipboard`, `xclip`, or `xsel` if no clipboard tool is available.
+
+## Filter logs
+
+```sh
+supabase logs --remote --service auth --search "invalid token"
+supabase logs --remote --service functions --resource <function-id>
+supabase logs --stack feature-a --since start
+supabase logs --remote --since 30m --limit 500
+```
+
+Repeat `--service` or `--level` to select several values. Hosted `--search` matches a case-insensitive literal substring. Percent and underscore characters have no wildcard meaning.
+
+Use `--since` with a duration or ISO-8601 timestamp. Use `--from` and `--to` for explicit UTC bounds. Do not combine `--since` with `--from` or `--to`. With only `--to`, the range covers the hour ending at that timestamp. Hosted ranges must be at most 24 hours. Local ranges have no 24-hour limit. The lower bound stays fixed when you load newer logs.
+
+Severity comes from service fields, such as Postgres error severity or HTTP status. Unknown severity stays unknown. `--level` requires services with a supported severity mapping. Without `--service`, it searches `postgres`, `edge`, `auth`, `functions`, and `function-edge`. `logs sources --remote --service <service>` lists the supported filters.
+
+## Query hosted logs
+
+Pass SQL with `--sql`, `--file <path>`, or `--file -` for piped stdin. Select a hosted target explicitly:
+
+```sh
+supabase logs --remote --sql "select timestamp, id, event_message, log_attributes from logs limit 20"
+supabase logs --remote --file errors.sql --since 30m --output-format json
+cat errors.sql | supabase logs --remote --file - --output-format stream-json
+```
+
+The command reads stdin only with `--file -`. Other invocations leave stdin untouched. `--file -` requires piped input; an empty input or unreadable file fails with a suggestion. `--file` has no `-f` alias.
+
+The query uses ClickHouse SQL over the hosted `logs` table. It does not query Postgres. Select `log_attributes` to keep correlation IDs and user attributes. For example, `where source = 'postgres_logs'` limits rows to Postgres.
+
+The browser keeps all returned SQL rows in their result order. Press `L` to rerun the query over the original lower bound through the current time. A successful query replaces the previous results. The header remains visible even when rows omit timestamps.
+
+Queries use the Management API GET endpoint. Server query limits, retention, and project access apply. A long SQL file may exceed the server URL limit. The CLI reports the HTTP error and does not split or rewrite the query. Local SQL queries are unsupported.
+
+## Read logs in scripts
+
+Without an interactive terminal, `supabase logs` performs one finite read and exits.
+
+```sh
+supabase logs --remote --service postgres --level error --output-format text
+supabase logs --remote --service postgres --output-format json
+supabase logs --remote --service postgres --output-format stream-json
+```
+
+Piped filtered text keeps one event per line without hard wrapping and escapes embedded carriage returns and newlines. Progress and retry diagnostics use stderr.
+
+JSON output returns an indented array of full records. Stream JSON emits one compact event per line. Filtered reads emit `log-entry` or `log-marker` events with the full record in `data`. SQL reads emit a `result` event with the array. Local records retain instance IDs, launch IDs, positions, and loss markers. Hosted records retain IDs, severity, attributes, and timestamps. Their `service` uses the selector name, such as `postgres`, while `source` keeps the original value, such as `postgres_logs`.
+
+Use `--output-format text`, `json`, or `stream-json`. The command rejects the legacy `-o/--output` flag.
+
+## Retained local logs
+
+Local reads work while the stack is stopped. They never start a stack or service. `--service postgres` selects the local `database` service. Other selectors include service names, instance IDs, and `gateway` when the stack exposes the shared API listener.
+
+Use `--stack <name>` or `--stack-id <id-or-prefix>` to select an existing stack. `--resource` selects an instance ID and cannot be combined with `--service`. `--since start` reads from each selected service's latest launch.
+
+Local `--level`, `--search`, and `--kind` filters are unsupported. Source discovery lists existing instances and gateway support; it does not promise retained rows exist.
+
+## Compute logs
+
+Compute sources require the experimental Compute feature. Use `--service compute --resource <name>`. `--kind app`, `requests`, and `builds` select the stream. App output has no reliable severity; `--level` requires the request or build kind.
+
+```sh
+supabase logs --remote --service compute --resource api --kind requests
+```
+
+The deprecated `supabase compute logs` and `supabase stack logs` commands keep their existing flags and follow behavior until removal in v4. They warn on stderr. Their `-f` still means `--follow`; use `--file` for SQL files with `supabase logs`.
diff --git a/apps/docs/content/docs/meta.json b/apps/docs/content/docs/meta.json
index 9da3fcb7fe..55ddf081ef 100644
--- a/apps/docs/content/docs/meta.json
+++ b/apps/docs/content/docs/meta.json
@@ -1,4 +1,4 @@
 {
   "title": "Supabase CLI",
-  "pages": ["index", "getting-started", "commands"]
+  "pages": ["index", "getting-started", "logs", "commands"]
 }
diff --git a/apps/docs/public/schemas/config/v1.json b/apps/docs/public/schemas/config/v1.json
index 49d9416cf2..daade99aaa 100644
--- a/apps/docs/public/schemas/config/v1.json
+++ b/apps/docs/public/schemas/config/v1.json
@@ -909,6 +909,19 @@
                 }
               ]
             },
+            "require_current_password": {
+              "description": "If enabled, users will need to provide their current password to change their password, unless they signed in with a one-time password, magic link, or recovery link.",
+              "default": false,
+              "anyOf": [
+                {
+                  "type": "boolean"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^env\\((.*)\\)$"
+                }
+              ]
+            },
             "max_frequency": {
               "type": "string",
               "description": "Controls the minimum amount of time that must pass before sending another signup confirmation or password reset email.",
@@ -3303,7 +3316,7 @@
                 }
               },
               "additionalProperties": false,
-              "description": "Security checks run on each migration. Each rule takes \"error\", \"warn\" or \"off\"; a rule left unset uses \"warn\". When migrations run against --db-url, this section is read only from the local config.toml."
+              "description": "Security checks run on each migration. Each rule takes \"error\", \"warn\" or \"off\"; a rule left unset uses \"warn\". When migrations run against --db-url, this section is read only from the local config file."
             }
           },
           "additionalProperties": false
@@ -5488,6 +5501,19 @@
                               }
                             ]
                           },
+                          "require_current_password": {
+                            "description": "If enabled, users will need to provide their current password to change their password, unless they signed in with a one-time password, magic link, or recovery link.",
+                            "default": false,
+                            "anyOf": [
+                              {
+                                "type": "boolean"
+                              },
+                              {
+                                "type": "string",
+                                "pattern": "^env\\((.*)\\)$"
+                              }
+                            ]
+                          },
                           "max_frequency": {
                             "type": "string",
                             "description": "Controls the minimum amount of time that must pass before sending another signup confirmation or password reset email.",
@@ -7882,7 +7908,7 @@
                               }
                             },
                             "additionalProperties": false,
-                            "description": "Security checks run on each migration. Each rule takes \"error\", \"warn\" or \"off\"; a rule left unset uses \"warn\". When migrations run against --db-url, this section is read only from the local config.toml."
+                            "description": "Security checks run on each migration. Each rule takes \"error\", \"warn\" or \"off\"; a rule left unset uses \"warn\". When migrations run against --db-url, this section is read only from the local config file."
                           }
                         },
                         "additionalProperties": false
diff --git a/apps/docs/public/schemas/project-config/v1.json b/apps/docs/public/schemas/project-config/v1.json
index ed0875f833..258c28fb1e 100644
--- a/apps/docs/public/schemas/project-config/v1.json
+++ b/apps/docs/public/schemas/project-config/v1.json
@@ -382,6 +382,11 @@
               "description": "If enabled, users will need to reauthenticate or have logged in recently to change their password.",
               "default": false
             },
+            "require_current_password": {
+              "type": "boolean",
+              "description": "If enabled, users will need to provide their current password to change their password, unless they signed in with a one-time password, magic link, or recovery link.",
+              "default": false
+            },
             "max_frequency": {
               "type": "string",
               "description": "Controls the minimum amount of time that must pass before sending another signup confirmation or password reset email.",
diff --git a/docs/adr/0023-config-pull-write-strategy-and-scope-resolution.md b/docs/adr/0023-config-pull-write-strategy-and-scope-resolution.md
index 044a4cdde1..03f1fa7199 100644
--- a/docs/adr/0023-config-pull-write-strategy-and-scope-resolution.md
+++ b/docs/adr/0023-config-pull-write-strategy-and-scope-resolution.md
@@ -22,6 +22,8 @@ The editor's refusal surface is an explicit, closed union rather than a best-eff
 
 JSON configs are handled differently: they are re-serialized rather than span-edited — parsed, mutated with the same `deepSet`, and `JSON.stringify`d back out with the file's detected indent and original key order (new keys appended) preserved, with the same re-parse verification gate. JSON has no comments and no meaningful quoting-style variance, so "preserve the file's own terms" holds in substance without needing span-level surgery. In both formats, a multi-line array's value is rewritten single-line when it is replaced — only the value span changes, never the surrounding key or comment text.
 
+**Addendum (2026-11-04): JSON and JSONC edits are span-edited too.** Targeted edits to `config.json` and `config.jsonc` now go through `jsonc-parser`'s `modify`/`applyEdits` using the file's own detected indent and newline, so comments, trailing commas, and untouched values keep their bytes. The formatter lays out the value it writes (an array gets one element per line) and may re-indent the line a new key is inserted next to. The re-parse verification gate is unchanged and parses with the same JSONC parser. This supersedes the re-serialization paragraph above. Full saves (`saveCliConfig`) of an existing JSON/JSONC file apply the same minimal edits towards the regenerated document, falling back to regeneration only when the edited text fails verification; TOML full saves still regenerate, keeping a leading `#:schema` directive.
+
 ### (b) Scope resolution: narrowest scope, block reuse as the primary signal
 
 `config pull` writes at the narrowest scope that affects only the resolved target, in this rule order:
diff --git a/docs/adr/0028-release-branches-and-maintenance-lines.md b/docs/adr/0028-release-branches-and-maintenance-lines.md
index 8a56bd3c3d..fb59b90e2e 100644
--- a/docs/adr/0028-release-branches-and-maintenance-lines.md
+++ b/docs/adr/0028-release-branches-and-maintenance-lines.md
@@ -18,7 +18,7 @@ Add two release channels and the branches behind them. `develop` and `main` are
 | `next`    | Breaking-change integration, tracks `develop` | `X.Y.Z-next.N` | `next`        | none                                    | prerelease              |
 | `v<N>.x`  | Maintenance for a past major                  | `N.Y.Z`        | `v<N>.stable` | `supabase@<N>` / `supabase-v<N>-stable` | published, never latest |
 
-- **`next`** is one long-lived branch reused for every major. Breaking PRs target it with a `type(scope)!:` title, enforced by the PR title lint. Every push runs the full test suite before publishing. The prerelease identifier is `next`, not `beta`, so versions do not collide on npm after a cut. Publishing stays OIDC-only, so the stable release does not move the `next` dist-tag; `supabase@next` catches up on the next push to `next`.
+- **`next`** is one long-lived branch reused for every major. Breaking PRs target it with a `type(scope)!:` title, enforced by the PR title lint. Every push that carries commits beyond `develop` runs the full test suite before publishing; a push without any releases nothing, because semantic-release reads channel notes per commit ([semantic-release#4073](https://github.com/semantic-release/semantic-release/issues/4073)) and cannot tell a `next` tag from a `beta` tag on the same commit. The prerelease identifier is `next`, not `beta`, so versions do not collide on npm after a cut. Publishing stays OIDC-only, so the stable release does not move the `next` dist-tag; `supabase@next` catches up on the next release from `next`.
 - **`develop` → `next`** is kept in sync on every push, and `main` → `develop` after every stable release. A clean merge is pushed directly. A conflict opens a PR from `sync/<source>-into-<target>` (at the source tip) into the target, and approving it fast-forwards the target to the PR head.
 - **Fast-forward on approval** applies to the deploy PR (`develop` → `main`), the major cut (`next` → `develop`), and sync PRs. The approver must have write access; the approved commit must be the PR head with the required checks green; the target must fast-forward (for a sync PR that is stale because the target or the source moved, a clean merge lands directly, as for a clean sync; only a new conflict or a target that keeps moving sends it back for re-approval); and a major version bump on the deploy PR needs the `release-major` label. The merge button is blocked on these PRs because the repository is squash-only and squashing destroys the ancestry.
 - **`v<N>.x`** is created by hand from the last stable `N.*` tag at the cut of the next major. It is released by dispatching `release.yml` on that ref with `channel=maintenance`; the workflow, scripts, and live e2e tests come from the frozen commit. A wildcard maintenance entry in the semantic-release config covers every such branch. Maintenance releases publish `v<N>.stable` on npm and are never marked latest.
@@ -48,8 +48,8 @@ The operational runbook, including the major-cut steps, is [`apps/cli/docs/relea
 ### Negative
 
 - Release-infrastructure fixes must be cherry-picked to each active `v<N>.x` by hand; Dependabot targets `develop` only.
-- The `next` dist-tag can lag behind `latest` until the next push to `next`.
-- Every `develop` push triggers a sync and, once `next` exists, a `next` test run and release.
+- The `next` dist-tag can lag behind `latest` until the next release from `next`.
+- Every `develop` push triggers a sync into `next`; `next` runs its tests and releases only when it carries commits beyond `develop`.
 - Rulesets for `next` and `v*.x` and the `release-major` label are manual setup.
 - `supabase@<N>` and `supabase` both install `bin/supabase`, so Homebrew can link only one.
 - Homebrew and Scoop for `next` are not published.
diff --git a/package.json b/package.json
index e0b88a787c..71200204c3 100644
--- a/package.json
+++ b/package.json
@@ -15,12 +15,10 @@
     "test:integration": "pnpm exec turbo run test:integration:run --continue=always --",
     "test:e2e": "pnpm exec turbo run supabase#build && pnpm exec turbo run test:e2e:run --only --concurrency=1 --continue=always --",
     "test:vitest": "bun --bun vitest run --project '!*e2e*' --project '!*live*'",
-    "check:all": "pnpm exec turbo run types:check lint:check fmt:check knip:check lint:effect:check lint:actions:check",
-    "fix:all": "pnpm exec turbo run lint:fix fmt:fix knip:fix && pnpm run lint:effect:fix",
+    "check:all": "pnpm exec turbo run types:check lint:check fmt:check knip:check lint:actions:check",
+    "fix:all": "pnpm exec turbo run knip:fix && pnpm exec turbo run lint:fix && pnpm exec turbo run fmt:fix",
     "lint:check": "oxlint --config .oxlintrc.json",
-    "lint:fix": "oxlint --config .oxlintrc.json --fix",
-    "lint:effect:check": "oxlint --config .oxlintrc.effect.json",
-    "lint:effect:fix": "oxlint --config .oxlintrc.effect.json --fix --fix-suggestions",
+    "lint:fix": "oxlint --config .oxlintrc.json --fix --fix-suggestions",
     "lint:actions:check": "jactionlint",
     "fmt:check": "oxfmt --config .oxfmtrc.json --check",
     "fmt:fix": "oxfmt --config .oxfmtrc.json",
diff --git a/packages/api/scripts/generate.ts b/packages/api/scripts/generate.ts
index 5bfd891fe6..db22bc75ba 100644
--- a/packages/api/scripts/generate.ts
+++ b/packages/api/scripts/generate.ts
@@ -307,6 +307,16 @@ export function sanitizeOpenApiSchema(
     sanitized[key] = rawValue;
   }
 
+  // Binary bodies are rewritten to `BinaryInput` by matching the bare format annotation, so
+  // extra annotations such as `description` would leave them typed as plain strings.
+  if (sanitized.type === "string" && sanitized.format === "binary") {
+    return {
+      type: "string",
+      format: "binary",
+      ...(sanitized.nullable === true ? { nullable: true } : {}),
+    };
+  }
+
   if (
     sanitized.type === "string" &&
     sanitized.format === "uuid" &&
@@ -499,6 +509,32 @@ function replaceBinarySchemaCode(code: string): string {
   return code.replace(/Schema\.String\.annotate\(\{\s*"format":\s*"binary"\s*\}\)/g, "BinaryInput");
 }
 
+// Renders the shorthands newer Effect codegen emits in their expanded form, so the committed
+// contracts stay byte-stable across Effect releases; both spellings build the same checks.
+// String literals and comments pass through untouched.
+export function expandSchemaShorthands(code: string): string {
+  const expandCode = (segment: string) =>
+    segment
+      .replace(
+        /Schema\.Int(?![\w$])/g,
+        'Schema.Number.check(Schema.isInt().annotate({ "expected": "an integer" }))',
+      )
+      .replace(
+        /Schema\.Finite(?![\w$])/g,
+        'Schema.Number.check(Schema.isFinite().annotate({ "expected": "a finite number" }))',
+      )
+      .replace(/new globalThis\.RegExp\(/g, "new RegExp(");
+  const opaque =
+    /"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|`(?:[^`\\]|\\.)*`|\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+  let result = "";
+  let last = 0;
+  for (const match of code.matchAll(opaque)) {
+    result += expandCode(code.slice(last, match.index)) + match[0];
+    last = match.index + match[0].length;
+  }
+  return result + expandCode(code.slice(last));
+}
+
 function replaceOpenStringCode(code: string): string {
   return code.replace(
     new RegExp(
@@ -989,7 +1025,7 @@ function renderSchemaSource(
   );
 
   const finalizeCode = (code: string): string => {
-    const withOpenStrings = replaceOpenStringCode(code);
+    const withOpenStrings = replaceOpenStringCode(expandSchemaShorthands(code));
     return hasBinaryInputs ? replaceBinarySchemaCode(withOpenStrings) : withOpenStrings;
   };
 
diff --git a/packages/api/scripts/generate.unit.test.ts b/packages/api/scripts/generate.unit.test.ts
index a9fed3bd9b..278fd316a5 100644
--- a/packages/api/scripts/generate.unit.test.ts
+++ b/packages/api/scripts/generate.unit.test.ts
@@ -5,6 +5,7 @@ import { describe, expect, test } from "vitest";
 
 import type { OpenApiDocument, OpenApiOperation } from "./generate.ts";
 import {
+  expandSchemaShorthands,
   extractOperations,
   normalizeNullableJsonSchema,
   normalizeQueryParameterSchema,
@@ -145,18 +146,19 @@ describe("generate", () => {
     });
   });
 
-  test("drops content annotations from binary strings without touching a property named contentEncoding", () => {
+  test("reduces binary strings to their format, keeping nullability, without touching a property named contentEncoding", () => {
     expect(
       renderOpenApiSchema({
         type: "object",
         additionalProperties: false,
         properties: {
           eszip: { type: "string", format: "binary", contentEncoding: "binary" },
+          described: { type: "string", format: "binary", description: "Raw ESZIP", nullable: true },
           contentEncoding: { type: "string", contentMediaType: "text/plain" },
         },
       }),
     ).toBe(
-      'Schema.Struct({ "eszip": Schema.optionalKey(Schema.String.annotate({ "format": "binary" })), "contentEncoding": Schema.optionalKey(Schema.String) })',
+      'Schema.Struct({ "eszip": Schema.optionalKey(Schema.String.annotate({ "format": "binary" })), "described": Schema.optionalKey(Schema.Union([Schema.String.annotate({ "format": "binary" }), Schema.Null])), "contentEncoding": Schema.optionalKey(Schema.String) })',
     );
   });
 
@@ -270,9 +272,7 @@ describe("generate", () => {
         anyOf: [{ type: "string" }, { type: "number" }, { type: "boolean" }],
         nullable: true,
       }),
-    ).toBe(
-      'Schema.Union([Schema.String, Schema.Number.check(Schema.isFinite().annotate({ "expected": "a finite number" })), Schema.Boolean, Schema.Null])',
-    );
+    ).toBe("Schema.Union([Schema.String, Schema.Finite, Schema.Boolean, Schema.Null])");
   });
 
   test("accepts booleans for string-encoded boolean query parameters", () => {
@@ -439,3 +439,21 @@ describe("generate", () => {
     expect(source).toContain('  "v2-list-organization-members": "v2ListOrganizationMembers",');
   });
 });
+
+describe("expandSchemaShorthands", () => {
+  test("expands shorthands in code but leaves string literals and comments intact", () => {
+    const code = [
+      "const a = Schema.Int;",
+      "const b = Schema.Literal(\"Schema.Int\", 'Schema.Finite', `Schema.Int`);",
+      "// Schema.Finite stays",
+      "const c = Schema.Finite;",
+    ].join("\n");
+
+    const out = expandSchemaShorthands(code);
+
+    expect(out).toContain("Schema.Literal(\"Schema.Int\", 'Schema.Finite', `Schema.Int`)");
+    expect(out).toContain("// Schema.Finite stays");
+    expect(out).toContain("const a = Schema.Number.check(Schema.isInt()");
+    expect(out).toContain("const c = Schema.Number.check(Schema.isFinite()");
+  });
+});
diff --git a/packages/api/src/generated/contracts.ts b/packages/api/src/generated/contracts.ts
index 6a546ee8b9..510fd4908e 100644
--- a/packages/api/src/generated/contracts.ts
+++ b/packages/api/src/generated/contracts.ts
@@ -199,6 +199,7 @@ export const BranchResponse_Output = Schema.Struct({
         "RESTARTING",
         "PAUSE_FAILED",
         "RESIZING",
+        "PROMOTING",
       ]),
       OpenString,
     ]),
@@ -309,6 +310,7 @@ export const V1ProjectWithDatabaseResponse_Output = Schema.Struct({
       "RESTARTING",
       "PAUSE_FAILED",
       "RESIZING",
+      "PROMOTING",
     ]),
     OpenString,
   ]),
@@ -1094,6 +1096,7 @@ export const V1CreateABranchOutput = Schema.Struct({
         "RESTARTING",
         "PAUSE_FAILED",
         "RESIZING",
+        "PROMOTING",
       ]),
       OpenString,
     ]),
@@ -1352,6 +1355,7 @@ export const V1CreateAProjectOutput = Schema.Struct({
       "RESTARTING",
       "PAUSE_FAILED",
       "RESIZING",
+      "PROMOTING",
     ]),
     OpenString,
   ]),
@@ -2426,6 +2430,18 @@ export const V1ExchangeOauthTokenOutput = Schema.Struct({
       }),
     ),
   token_type: Schema.Literal("Bearer"),
+  scope: Schema.optionalKey(
+    Schema.String.annotate({
+      description:
+        "Space-delimited scopes granted to the token. Omitted when no scopes were granted.",
+    }),
+  ),
+  project_refs: Schema.Union([
+    Schema.Array(Schema.String).annotate({
+      description: "Project refs the token is limited to. `null` means all projects.",
+    }),
+    Schema.Null,
+  ]),
 });
 export const V1GenerateTypescriptTypesInput = Schema.Struct({
   included_schemas: Schema.optionalKey(Schema.String),
@@ -2530,6 +2546,7 @@ export const V1GetABranchOutput = Schema.Struct({
         "RESTARTING",
         "PAUSE_FAILED",
         "RESIZING",
+        "PROMOTING",
       ]),
       OpenString,
     ]),
@@ -2584,6 +2601,7 @@ export const V1GetABranchConfigOutput = Schema.Struct({
       "RESTARTING",
       "PAUSE_FAILED",
       "RESIZING",
+      "PROMOTING",
     ]),
     OpenString,
   ]),
@@ -2956,6 +2974,7 @@ export const V1GetAllProjectsForOrganizationOutput = Schema.Struct({
           "RESTARTING",
           "PAUSE_FAILED",
           "RESIZING",
+          "PROMOTING",
         ]),
         OpenString,
       ]),
@@ -4152,6 +4171,22 @@ export const V1GetNetworkRestrictionsOutput = Schema.Struct({
         "Populated when a new config has been received, but not registered as successfully applied to a project.",
     }),
   ),
+  pending_config: Schema.optionalKey(
+    Schema.Struct({
+      dbAllowedCidrs: Schema.optionalKey(Schema.Array(Schema.String)),
+      dbAllowedCidrsV6: Schema.optionalKey(Schema.Array(Schema.String)),
+    }).annotate({
+      description:
+        "Present when a change that was never applied is waiting for review. `config` is the list the project enforces. Apply or reject the change with `POST /v1/projects/{ref}/network-restrictions/review`; submitting a new config also replaces it.",
+    }),
+  ),
+  pending_requested_at: Schema.optionalKey(
+    Schema.String.annotate({
+      description:
+        "When the change in `pending_config` was requested. Send it as `requested_at` to the review endpoint.",
+      format: "date-time",
+    }),
+  ),
   status: Schema.Union([Schema.Literals(["stored", "applied"]), OpenString]),
   updated_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
   applied_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
@@ -4358,6 +4393,9 @@ export const V1GetPerformanceAdvisorsOutput = Schema.Struct({
           "log_auth_error_rate_high",
           "log_storage_error_rate_high",
           "log_edge_function_error_rate_high",
+          "realtime_authorization_timeouts",
+          "realtime_postgres_changes_spike",
+          "realtime_concurrent_users_near_limit",
           "project_not_active",
           "advisor_check_unavailable",
         ]),
@@ -4770,6 +4808,13 @@ export const V1GetPostgresUpgradeEligibilityOutput = Schema.Struct({
         obj_name: Schema.String,
       }),
       Schema.Struct({ type: Schema.Literal("active_replication_slot"), slot_name: Schema.String }),
+      Schema.Struct({
+        type: Schema.Literal("table_using_reg_type"),
+        schema_name: Schema.String,
+        table_name: Schema.String,
+        column_name: Schema.String,
+        type_name: Schema.String,
+      }),
       Schema.Struct({ type: Schema.Literal("x86_architecture") }),
       Schema.Struct({ type: Schema.Literal("project_hibernating") }),
     ]),
@@ -4781,6 +4826,7 @@ export const V1GetPostgresUpgradeEligibilityOutput = Schema.Struct({
         Schema.Struct({ type: Schema.Literal("ltree_reindex_required") }),
         Schema.Struct({ type: Schema.Literal("operator_estimator_gate") }),
         Schema.Struct({ type: Schema.Literal("btree_gist_nan_reindex") }),
+        Schema.Struct({ type: Schema.Literal("collation_reindex_required") }),
       ],
       { mode: "oneOf" },
     ),
@@ -4906,6 +4952,38 @@ export const V1GetPostgrestServiceConfigOutput = Schema.Struct({
       ),
     Schema.Null,
   ]),
+  db_pool_max_lifetime: Schema.Union([
+    Schema.Number.annotate({
+      description: "If `null`, the value is automatically configured to 1800.",
+    })
+      .check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(3600).annotate({
+          expected: "a value less than or equal to 3600",
+        }),
+      ),
+    Schema.Null,
+  ]),
+  db_pool_max_idletime: Schema.Union([
+    Schema.Number.annotate({
+      description: "If `null`, the value is automatically configured to 30.",
+    })
+      .check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(60).annotate({ expected: "a value less than or equal to 60" }),
+      ),
+    Schema.Null,
+  ]),
   jwt_secret: Schema.optionalKey(Schema.String),
 });
 export const V1GetProfileInput = Schema.Record(Schema.String, Schema.Never);
@@ -4969,6 +5047,7 @@ export const V1GetProjectOutput = Schema.Struct({
       "RESTARTING",
       "PAUSE_FAILED",
       "RESIZING",
+      "PROMOTING",
     ]),
     OpenString,
   ]),
@@ -5823,6 +5902,9 @@ export const V1GetSecurityAdvisorsOutput = Schema.Struct({
           "log_auth_error_rate_high",
           "log_storage_error_rate_high",
           "log_edge_function_error_rate_high",
+          "realtime_authorization_timeouts",
+          "realtime_postgres_changes_spike",
+          "realtime_concurrent_users_near_limit",
           "project_not_active",
           "advisor_check_unavailable",
         ]),
@@ -7095,7 +7177,7 @@ export const V1PatchNetworkRestrictionsOutput = Schema.Struct({
   applied_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
   status: Schema.Union([Schema.Literals(["stored", "applied"]), OpenString]),
 });
-export const V1PauseAProjectInput = Schema.Struct({
+export const V1PatchPostgresConfigInput = Schema.Struct({
   ref: Schema.String.check(
     Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
   )
@@ -7107,171 +7189,645 @@ export const V1PauseAProjectInput = Schema.Struct({
         expected: "a string matching the RegExp ^[a-z]+$",
       }),
     ),
-});
-export const V1PushABranchInput = Schema.Struct({
-  branch_id_or_ref: Schema.Union([
-    Schema.String.annotate({ description: "Project ref" })
+  effective_cache_size: Schema.optionalKey(Schema.String),
+  logical_decoding_work_mem: Schema.optionalKey(Schema.String),
+  "pg_stat_statements.max": Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
       .check(
-        Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+        Schema.isGreaterThanOrEqualTo(100).annotate({
+          expected: "a value greater than or equal to 100",
+        }),
       )
       .check(
-        Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+        Schema.isLessThanOrEqualTo(45000).annotate({
+          expected: "a value less than or equal to 45000",
+        }),
+      ),
+  ),
+  "pg_net.batch_size": Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
       )
       .check(
-        Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
-          expected: "a string matching the RegExp ^[a-z]+$",
+        Schema.isLessThanOrEqualTo(32767).annotate({
+          expected: "a value less than or equal to 32767",
         }),
       ),
-    Schema.String.annotate({ format: "uuid" }).check(
-      Schema.isPattern(
-        new RegExp(
-          "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
-          "u",
-        ),
-      ).annotate({
-        expected:
-          "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
-      }),
-    ),
-  ]),
-  migration_version: Schema.optionalKey(Schema.String),
-});
-export const V1PushABranchOutput = Schema.Struct({
-  workflow_run_id: Schema.String,
-  message: Schema.Literal("ok"),
-});
-export const V1ReadOnlyQueryInput = Schema.Struct({
-  ref: Schema.String.check(
-    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
-  )
-    .check(
-      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
-    )
-    .check(
-      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
-        expected: "a string matching the RegExp ^[a-z]+$",
-      }),
-    ),
-  query: Schema.String.check(
-    Schema.isMinLength(1).annotate({ expected: "a value with a length of at least 1" }),
   ),
-  parameters: Schema.optionalKey(Schema.Array(Schema.Json.annotate({ expected: "JSON value" }))),
-});
-export const V1RemoveAReadReplicaInput = Schema.Struct({
-  ref: Schema.String.check(
-    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
-  )
-    .check(
-      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
-    )
-    .check(
-      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
-        expected: "a string matching the RegExp ^[a-z]+$",
-      }),
-    ),
-  database_identifier: Schema.String,
-});
-export const V1RemoveProjectAddonInput = Schema.Struct({
-  ref: Schema.String.check(
-    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
-  )
-    .check(
-      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
-    )
-    .check(
-      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
-        expected: "a string matching the RegExp ^[a-z]+$",
+  autovacuum_max_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(1).annotate({
+          expected: "a value greater than or equal to 1",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  autovacuum_work_mem: Schema.optionalKey(Schema.String),
+  "cron.log_statement": Schema.optionalKey(Schema.Boolean),
+  log_autovacuum_min_duration: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: ms" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
       }),
     ),
-  addon_variant: Schema.Union([
-    Schema.Literals([
-      "ci_micro",
-      "ci_small",
-      "ci_medium",
-      "ci_large",
-      "ci_xlarge",
-      "ci_2xlarge",
-      "ci_4xlarge",
-      "ci_8xlarge",
-      "ci_12xlarge",
-      "ci_16xlarge",
-      "ci_24xlarge",
-      "ci_24xlarge_optimized_cpu",
-      "ci_24xlarge_optimized_memory",
-      "ci_24xlarge_high_memory",
-      "ci_48xlarge",
-      "ci_48xlarge_optimized_cpu",
-      "ci_48xlarge_optimized_memory",
-      "ci_48xlarge_high_memory",
-    ]),
-    Schema.Literal("cd_default"),
-    Schema.Literals(["pitr_7", "pitr_14", "pitr_28"]),
-    Schema.Literal("ipv4_default"),
-  ]),
-});
-export const V1RemoveProjectSigningKeyInput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }).check(
-    Schema.isPattern(
-      new RegExp(
-        "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
-        "u",
-      ),
-    ).annotate({
-      expected:
-        "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
-    }),
   ),
-  ref: Schema.String.check(
-    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
-  )
-    .check(
-      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
-    )
-    .check(
-      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
-        expected: "a string matching the RegExp ^[a-z]+$",
+  log_checkpoints: Schema.optionalKey(Schema.Boolean),
+  log_connections: Schema.optionalKey(Schema.Boolean),
+  log_disconnections: Schema.optionalKey(Schema.Boolean),
+  log_duration: Schema.optionalKey(Schema.Boolean),
+  log_lock_waits: Schema.optionalKey(Schema.Boolean),
+  log_recovery_conflict_waits: Schema.optionalKey(Schema.Boolean),
+  log_replication_commands: Schema.optionalKey(Schema.Boolean),
+  log_startup_progress_interval: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: ms" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
       }),
     ),
-});
-export const V1RemoveProjectSigningKeyOutput = Schema.Struct({
-  id: Schema.String.annotate({ format: "uuid" }).check(
-    Schema.isPattern(
-      new RegExp(
-        "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
-        "u",
-      ),
-    ).annotate({
-      expected:
-        "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
-    }),
   ),
-  algorithm: Schema.Union([Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]), OpenString]),
-  status: Schema.Union([
-    Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
-    OpenString,
-  ]),
-  public_jwk: Schema.Json.annotate({ expected: "JSON value" }),
-  created_at: Schema.String.annotate({ format: "date-time" }),
-  updated_at: Schema.String.annotate({ format: "date-time" }),
-});
-export const V1ResetABranchInput = Schema.Struct({
-  branch_id_or_ref: Schema.Union([
-    Schema.String.annotate({ description: "Project ref" })
-      .check(
-        Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
-      )
+  log_temp_files: Schema.optionalKey(Schema.String),
+  maintenance_work_mem: Schema.optionalKey(Schema.String),
+  track_activity_query_size: Schema.optionalKey(Schema.String),
+  max_connections: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
       .check(
-        Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+        Schema.isGreaterThanOrEqualTo(1).annotate({
+          expected: "a value greater than or equal to 1",
+        }),
       )
       .check(
-        Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
-          expected: "a string matching the RegExp ^[a-z]+$",
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
         }),
       ),
-    Schema.String.annotate({ format: "uuid" }).check(
-      Schema.isPattern(
-        new RegExp(
-          "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+  ),
+  max_locks_per_transaction: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(10).annotate({
+          expected: "a value greater than or equal to 10",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(2147483640).annotate({
+          expected: "a value less than or equal to 2147483640",
+        }),
+      ),
+  ),
+  max_logical_replication_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  max_parallel_maintenance_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(1024).annotate({
+          expected: "a value less than or equal to 1024",
+        }),
+      ),
+  ),
+  max_parallel_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(1024).annotate({
+          expected: "a value less than or equal to 1024",
+        }),
+      ),
+  ),
+  max_parallel_workers_per_gather: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(1024).annotate({
+          expected: "a value less than or equal to 1024",
+        }),
+      ),
+  ),
+  max_replication_slots: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(-9007199254740991).annotate({
+          expected: "a value greater than or equal to -9007199254740991",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(9007199254740991).annotate({
+          expected: "a value less than or equal to 9007199254740991",
+        }),
+      ),
+  ),
+  max_slot_wal_keep_size: Schema.optionalKey(Schema.String),
+  max_standby_archive_delay: Schema.optionalKey(Schema.String),
+  max_standby_streaming_delay: Schema.optionalKey(Schema.String),
+  max_sync_workers_per_subscription: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  max_wal_size: Schema.optionalKey(Schema.String),
+  max_wal_senders: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(-9007199254740991).annotate({
+          expected: "a value greater than or equal to -9007199254740991",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(9007199254740991).annotate({
+          expected: "a value less than or equal to 9007199254740991",
+        }),
+      ),
+  ),
+  max_worker_processes: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  session_replication_role: Schema.optionalKey(Schema.Literals(["origin", "replica", "local"])),
+  shared_buffers: Schema.optionalKey(Schema.String),
+  statement_timeout: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: ms" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
+      }),
+    ),
+  ),
+  track_commit_timestamp: Schema.optionalKey(Schema.Boolean),
+  wal_keep_size: Schema.optionalKey(Schema.String),
+  wal_sender_timeout: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: ms" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
+      }),
+    ),
+  ),
+  work_mem: Schema.optionalKey(Schema.String),
+  checkpoint_timeout: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: s" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
+      }),
+    ),
+  ),
+  hot_standby_feedback: Schema.optionalKey(Schema.Boolean),
+  restart_database: Schema.optionalKey(Schema.Boolean),
+});
+export const V1PatchPostgresConfigOutput = Schema.Struct({
+  effective_cache_size: Schema.optionalKey(Schema.String),
+  logical_decoding_work_mem: Schema.optionalKey(Schema.String),
+  "pg_stat_statements.max": Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(100).annotate({
+          expected: "a value greater than or equal to 100",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(45000).annotate({
+          expected: "a value less than or equal to 45000",
+        }),
+      ),
+  ),
+  "pg_net.batch_size": Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(32767).annotate({
+          expected: "a value less than or equal to 32767",
+        }),
+      ),
+  ),
+  autovacuum_max_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(1).annotate({
+          expected: "a value greater than or equal to 1",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  autovacuum_work_mem: Schema.optionalKey(Schema.String),
+  "cron.log_statement": Schema.optionalKey(Schema.Boolean),
+  log_autovacuum_min_duration: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: ms" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
+      }),
+    ),
+  ),
+  log_checkpoints: Schema.optionalKey(Schema.Boolean),
+  log_connections: Schema.optionalKey(Schema.Boolean),
+  log_disconnections: Schema.optionalKey(Schema.Boolean),
+  log_duration: Schema.optionalKey(Schema.Boolean),
+  log_lock_waits: Schema.optionalKey(Schema.Boolean),
+  log_recovery_conflict_waits: Schema.optionalKey(Schema.Boolean),
+  log_replication_commands: Schema.optionalKey(Schema.Boolean),
+  log_startup_progress_interval: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: ms" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
+      }),
+    ),
+  ),
+  log_temp_files: Schema.optionalKey(Schema.String),
+  maintenance_work_mem: Schema.optionalKey(Schema.String),
+  track_activity_query_size: Schema.optionalKey(Schema.String),
+  max_connections: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(1).annotate({
+          expected: "a value greater than or equal to 1",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  max_locks_per_transaction: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(10).annotate({
+          expected: "a value greater than or equal to 10",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(2147483640).annotate({
+          expected: "a value less than or equal to 2147483640",
+        }),
+      ),
+  ),
+  max_logical_replication_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  max_parallel_maintenance_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(1024).annotate({
+          expected: "a value less than or equal to 1024",
+        }),
+      ),
+  ),
+  max_parallel_workers: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(1024).annotate({
+          expected: "a value less than or equal to 1024",
+        }),
+      ),
+  ),
+  max_parallel_workers_per_gather: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(1024).annotate({
+          expected: "a value less than or equal to 1024",
+        }),
+      ),
+  ),
+  max_replication_slots: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(-9007199254740991).annotate({
+          expected: "a value greater than or equal to -9007199254740991",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(9007199254740991).annotate({
+          expected: "a value less than or equal to 9007199254740991",
+        }),
+      ),
+  ),
+  max_slot_wal_keep_size: Schema.optionalKey(Schema.String),
+  max_standby_archive_delay: Schema.optionalKey(Schema.String),
+  max_standby_streaming_delay: Schema.optionalKey(Schema.String),
+  max_sync_workers_per_subscription: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  max_wal_size: Schema.optionalKey(Schema.String),
+  max_wal_senders: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(-9007199254740991).annotate({
+          expected: "a value greater than or equal to -9007199254740991",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(9007199254740991).annotate({
+          expected: "a value less than or equal to 9007199254740991",
+        }),
+      ),
+  ),
+  max_worker_processes: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(262143).annotate({
+          expected: "a value less than or equal to 262143",
+        }),
+      ),
+  ),
+  session_replication_role: Schema.optionalKey(
+    Schema.Union([Schema.Literals(["origin", "replica", "local"]), OpenString]),
+  ),
+  shared_buffers: Schema.optionalKey(Schema.String),
+  statement_timeout: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: ms" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
+      }),
+    ),
+  ),
+  track_commit_timestamp: Schema.optionalKey(Schema.Boolean),
+  wal_keep_size: Schema.optionalKey(Schema.String),
+  wal_sender_timeout: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: ms" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
+      }),
+    ),
+  ),
+  work_mem: Schema.optionalKey(Schema.String),
+  checkpoint_timeout: Schema.optionalKey(
+    Schema.String.annotate({ description: "Default unit: s" }).check(
+      Schema.isPattern(new RegExp("^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$", "u")).annotate({
+        expected: "a string matching the RegExp ^(-?[0-9]+(?:\\.[0-9]+)?)(us|ms|s|min|h|d)?$",
+      }),
+    ),
+  ),
+  hot_standby_feedback: Schema.optionalKey(Schema.Boolean),
+});
+export const V1PauseAProjectInput = Schema.Struct({
+  ref: Schema.String.check(
+    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+  )
+    .check(
+      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+    )
+    .check(
+      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+        expected: "a string matching the RegExp ^[a-z]+$",
+      }),
+    ),
+});
+export const V1PushABranchInput = Schema.Struct({
+  branch_id_or_ref: Schema.Union([
+    Schema.String.annotate({ description: "Project ref" })
+      .check(
+        Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+      )
+      .check(
+        Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+      )
+      .check(
+        Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+          expected: "a string matching the RegExp ^[a-z]+$",
+        }),
+      ),
+    Schema.String.annotate({ format: "uuid" }).check(
+      Schema.isPattern(
+        new RegExp(
+          "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+          "u",
+        ),
+      ).annotate({
+        expected:
+          "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+      }),
+    ),
+  ]),
+  migration_version: Schema.optionalKey(Schema.String),
+});
+export const V1PushABranchOutput = Schema.Struct({
+  workflow_run_id: Schema.String,
+  message: Schema.Literal("ok"),
+});
+export const V1ReadOnlyQueryInput = Schema.Struct({
+  ref: Schema.String.check(
+    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+  )
+    .check(
+      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+    )
+    .check(
+      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+        expected: "a string matching the RegExp ^[a-z]+$",
+      }),
+    ),
+  query: Schema.String.check(
+    Schema.isMinLength(1).annotate({ expected: "a value with a length of at least 1" }),
+  ),
+  parameters: Schema.optionalKey(Schema.Array(Schema.Json.annotate({ expected: "JSON value" }))),
+});
+export const V1RemoveAReadReplicaInput = Schema.Struct({
+  ref: Schema.String.check(
+    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+  )
+    .check(
+      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+    )
+    .check(
+      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+        expected: "a string matching the RegExp ^[a-z]+$",
+      }),
+    ),
+  database_identifier: Schema.String,
+});
+export const V1RemoveProjectAddonInput = Schema.Struct({
+  ref: Schema.String.check(
+    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+  )
+    .check(
+      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+    )
+    .check(
+      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+        expected: "a string matching the RegExp ^[a-z]+$",
+      }),
+    ),
+  addon_variant: Schema.Union([
+    Schema.Literals([
+      "ci_micro",
+      "ci_small",
+      "ci_medium",
+      "ci_large",
+      "ci_xlarge",
+      "ci_2xlarge",
+      "ci_4xlarge",
+      "ci_8xlarge",
+      "ci_12xlarge",
+      "ci_16xlarge",
+      "ci_24xlarge",
+      "ci_24xlarge_optimized_cpu",
+      "ci_24xlarge_optimized_memory",
+      "ci_24xlarge_high_memory",
+      "ci_48xlarge",
+      "ci_48xlarge_optimized_cpu",
+      "ci_48xlarge_optimized_memory",
+      "ci_48xlarge_high_memory",
+    ]),
+    Schema.Literal("cd_default"),
+    Schema.Literals(["pitr_7", "pitr_14", "pitr_28"]),
+    Schema.Literal("ipv4_default"),
+  ]),
+});
+export const V1RemoveProjectSigningKeyInput = Schema.Struct({
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp(
+        "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+        "u",
+      ),
+    ).annotate({
+      expected:
+        "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+    }),
+  ),
+  ref: Schema.String.check(
+    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+  )
+    .check(
+      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+    )
+    .check(
+      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+        expected: "a string matching the RegExp ^[a-z]+$",
+      }),
+    ),
+});
+export const V1RemoveProjectSigningKeyOutput = Schema.Struct({
+  id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp(
+        "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+        "u",
+      ),
+    ).annotate({
+      expected:
+        "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+    }),
+  ),
+  algorithm: Schema.Union([Schema.Literals(["EdDSA", "ES256", "RS256", "HS256"]), OpenString]),
+  status: Schema.Union([
+    Schema.Literals(["in_use", "previously_used", "revoked", "standby"]),
+    OpenString,
+  ]),
+  public_jwk: Schema.Json.annotate({ expected: "JSON value" }),
+  created_at: Schema.String.annotate({ format: "date-time" }),
+  updated_at: Schema.String.annotate({ format: "date-time" }),
+});
+export const V1ResetABranchInput = Schema.Struct({
+  branch_id_or_ref: Schema.Union([
+    Schema.String.annotate({ description: "Project ref" })
+      .check(
+        Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+      )
+      .check(
+        Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+      )
+      .check(
+        Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+          expected: "a string matching the RegExp ^[a-z]+$",
+        }),
+      ),
+    Schema.String.annotate({ format: "uuid" }).check(
+      Schema.isPattern(
+        new RegExp(
+          "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
           "u",
         ),
       ).annotate({
@@ -7389,6 +7945,66 @@ export const V1RestorePitrBackupInput = Schema.Struct({
       }),
     ),
 });
+export const V1ReviewNetworkRestrictionsInput = Schema.Struct({
+  ref: Schema.String.check(
+    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+  )
+    .check(
+      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+    )
+    .check(
+      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+        expected: "a string matching the RegExp ^[a-z]+$",
+      }),
+    ),
+  action: Schema.Literals(["apply", "reject"]).annotate({
+    description:
+      "`apply` replaces the enforced list with the pending one and applies it. `reject` discards the pending one and keeps the enforced list.",
+  }),
+  requested_at: Schema.String.annotate({
+    description:
+      "The `pending_requested_at` of the change being reviewed. Only that change is resolved: if another one has replaced it, the request gets a 409.",
+    format: "date-time",
+  }),
+});
+export const V1ReviewNetworkRestrictionsOutput = Schema.Struct({
+  entitlement: Schema.Union([Schema.Literals(["disallowed", "allowed"]), OpenString]),
+  config: Schema.Struct({
+    dbAllowedCidrs: Schema.optionalKey(Schema.Array(Schema.String)),
+    dbAllowedCidrsV6: Schema.optionalKey(Schema.Array(Schema.String)),
+  }).annotate({
+    description:
+      "At any given point in time, this is the config that the user has requested be applied to their project. The `status` field indicates if it has been applied to the project, or is pending. When an updated config is received, the applied config is moved to `old_config`.",
+  }),
+  old_config: Schema.optionalKey(
+    Schema.Struct({
+      dbAllowedCidrs: Schema.optionalKey(Schema.Array(Schema.String)),
+      dbAllowedCidrsV6: Schema.optionalKey(Schema.Array(Schema.String)),
+    }).annotate({
+      description:
+        "Populated when a new config has been received, but not registered as successfully applied to a project.",
+    }),
+  ),
+  pending_config: Schema.optionalKey(
+    Schema.Struct({
+      dbAllowedCidrs: Schema.optionalKey(Schema.Array(Schema.String)),
+      dbAllowedCidrsV6: Schema.optionalKey(Schema.Array(Schema.String)),
+    }).annotate({
+      description:
+        "Present when a change that was never applied is waiting for review. `config` is the list the project enforces. Apply or reject the change with `POST /v1/projects/{ref}/network-restrictions/review`; submitting a new config also replaces it.",
+    }),
+  ),
+  pending_requested_at: Schema.optionalKey(
+    Schema.String.annotate({
+      description:
+        "When the change in `pending_config` was requested. Send it as `requested_at` to the review endpoint.",
+      format: "date-time",
+    }),
+  ),
+  status: Schema.Union([Schema.Literals(["stored", "applied"]), OpenString]),
+  updated_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
+  applied_at: Schema.optionalKey(Schema.String.annotate({ format: "date-time" })),
+});
 export const V1RevokeTokenInput = Schema.Struct({
   client_id: Schema.String.annotate({ format: "uuid" }).check(
     Schema.isPattern(
@@ -7643,6 +8259,7 @@ export const V1UpdateABranchConfigOutput = Schema.Struct({
         "RESTARTING",
         "PAUSE_FAILED",
         "RESIZING",
+        "PROMOTING",
       ]),
       OpenString,
     ]),
@@ -9543,7 +10160,23 @@ export const V1UpdateNetworkRestrictionsOutput = Schema.Struct({
       dbAllowedCidrsV6: Schema.optionalKey(Schema.Array(Schema.String)),
     }).annotate({
       description:
-        "Populated when a new config has been received, but not registered as successfully applied to a project.",
+        "Populated when a new config has been received, but not registered as successfully applied to a project.",
+    }),
+  ),
+  pending_config: Schema.optionalKey(
+    Schema.Struct({
+      dbAllowedCidrs: Schema.optionalKey(Schema.Array(Schema.String)),
+      dbAllowedCidrsV6: Schema.optionalKey(Schema.Array(Schema.String)),
+    }).annotate({
+      description:
+        "Present when a change that was never applied is waiting for review. `config` is the list the project enforces. Apply or reject the change with `POST /v1/projects/{ref}/network-restrictions/review`; submitting a new config also replaces it.",
+    }),
+  ),
+  pending_requested_at: Schema.optionalKey(
+    Schema.String.annotate({
+      description:
+        "When the change in `pending_config` was requested. Send it as `requested_at` to the review endpoint.",
+      format: "date-time",
     }),
   ),
   status: Schema.Union([Schema.Literals(["stored", "applied"]), OpenString]),
@@ -10147,6 +10780,30 @@ export const V1UpdatePostgrestServiceConfigInput = Schema.Struct({
         Schema.isLessThanOrEqualTo(60).annotate({ expected: "a value less than or equal to 60" }),
       ),
   ),
+  db_pool_max_lifetime: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(3600).annotate({
+          expected: "a value less than or equal to 3600",
+        }),
+      ),
+  ),
+  db_pool_max_idletime: Schema.optionalKey(
+    Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(60).annotate({ expected: "a value less than or equal to 60" }),
+      ),
+  ),
 });
 export const V1UpdatePostgrestServiceConfigOutput = Schema.Struct({
   db_schema: Schema.String,
@@ -10196,6 +10853,38 @@ export const V1UpdatePostgrestServiceConfigOutput = Schema.Struct({
       ),
     Schema.Null,
   ]),
+  db_pool_max_lifetime: Schema.Union([
+    Schema.Number.annotate({
+      description: "If `null`, the value is automatically configured to 1800.",
+    })
+      .check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(3600).annotate({
+          expected: "a value less than or equal to 3600",
+        }),
+      ),
+    Schema.Null,
+  ]),
+  db_pool_max_idletime: Schema.Union([
+    Schema.Number.annotate({
+      description: "If `null`, the value is automatically configured to 30.",
+    })
+      .check(Schema.isInt().annotate({ expected: "an integer" }))
+      .check(
+        Schema.isGreaterThanOrEqualTo(0).annotate({
+          expected: "a value greater than or equal to 0",
+        }),
+      )
+      .check(
+        Schema.isLessThanOrEqualTo(60).annotate({ expected: "a value less than or equal to 60" }),
+      ),
+    Schema.Null,
+  ]),
 });
 export const V1UpdateProjectApiKeyInput = Schema.Struct({
   ref: Schema.String.check(
@@ -10713,12 +11402,12 @@ export const V2AssignOrganizationMemberRoleInput = Schema.Struct({
   user_id: Schema.String.annotate({ format: "uuid" }).check(
     Schema.isPattern(
       new RegExp(
-        "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+        "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$",
         "u",
       ),
     ).annotate({
       expected:
-        "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+        "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$",
     }),
   ),
   data: Schema.Struct({
@@ -11596,6 +12285,7 @@ export const V2CreateOrganizationInvitationsOutput = Schema.Struct({
           "unauthorized",
           "validation_failed",
           "agentic_credential_not_found",
+          "backup_unsupported",
           "branch_admin_required",
           "compute_build_context_too_large",
           "compute_build_in_progress",
@@ -12027,6 +12717,13 @@ export const V2DeployAComputeInstanceInput = Schema.Struct({
               expected: "a value less than or equal to 9007199254740991",
             }),
           ),
+        secrets_scope: Schema.optionalKey(
+          Schema.Union([
+            Schema.Literals(["all", "supabase", "none"]),
+            Schema.Array(Schema.Struct({ secret_name: Schema.String })),
+            Schema.Null,
+          ]),
+        ),
       }),
       context_upload_id: Schema.optionalKey(
         Schema.String.annotate({
@@ -12057,6 +12754,13 @@ export const V2DeployAComputeInstanceOutput = Schema.Struct({
               expected: "a value less than or equal to 9007199254740991",
             }),
           ),
+        secrets_scope: Schema.optionalKey(
+          Schema.Union([
+            Schema.Union([Schema.Literals(["all", "supabase", "none"]), OpenString]),
+            Schema.Array(Schema.Struct({ secret_name: Schema.String })),
+            Schema.Null,
+          ]),
+        ),
       }),
       build_state: Schema.Union([Schema.Literals(["building", "active", "failed"]), OpenString]),
       secret_generation: Schema.String,
@@ -12115,6 +12819,30 @@ export const V2DeployAComputeInstanceOutput = Schema.Struct({
     }),
   }),
 });
+export const V2DownloadProjectBackupInput = Schema.Struct({
+  ref: Schema.String.check(
+    Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
+  )
+    .check(
+      Schema.isMaxCodePoints(20).annotate({ expected: "a string with at most 20 code points" }),
+    )
+    .check(
+      Schema.isPattern(new RegExp("^[a-z]+$", "u")).annotate({
+        expected: "a string matching the RegExp ^[a-z]+$",
+      }),
+    ),
+  data: Schema.Struct({
+    type: Schema.Literal("project_backup_file_url").annotate({ description: "Resource type." }),
+    id: Schema.Number.check(Schema.isFinite().annotate({ expected: "a finite number" })),
+  }),
+});
+export const V2DownloadProjectBackupOutput = Schema.Struct({
+  data: Schema.Struct({
+    type: Schema.Literal("project_backup_file_url").annotate({ description: "Resource type." }),
+    id: Schema.Number.check(Schema.isFinite().annotate({ expected: "a finite number" })),
+    attributes: Schema.Struct({ file_url: Schema.String }),
+  }),
+});
 export const V2GetAComputeInstanceInput = Schema.Struct({
   ref: Schema.String.check(
     Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
@@ -12153,6 +12881,13 @@ export const V2GetAComputeInstanceOutput = Schema.Struct({
               expected: "a value less than or equal to 9007199254740991",
             }),
           ),
+        secrets_scope: Schema.optionalKey(
+          Schema.Union([
+            Schema.Union([Schema.Literals(["all", "supabase", "none"]), OpenString]),
+            Schema.Array(Schema.Struct({ secret_name: Schema.String })),
+            Schema.Null,
+          ]),
+        ),
       }),
       build_state: Schema.Union([Schema.Literals(["building", "active", "failed"]), OpenString]),
       secret_generation: Schema.String,
@@ -12432,6 +13167,22 @@ export const V2GetProjectConfigOutput = Schema.Struct({
               type: Schema.Union([Schema.Literals(["v4", "v6"]), OpenString]),
             }),
           ),
+          pending_allowed_cidrs: Schema.optionalKey(
+            Schema.Array(
+              Schema.Struct({
+                address: Schema.String,
+                type: Schema.Union([Schema.Literals(["v4", "v6"]), OpenString]),
+              }),
+            ).annotate({
+              description:
+                "Present when a change that was never applied is waiting for review. `allowed_cidrs` is the list the project enforces. Apply or reject the change with `POST /v1/projects/{ref}/network-restrictions/review`; submitting a new config also replaces it.",
+            }),
+          ),
+          pending_requested_at: Schema.optionalKey(
+            Schema.String.annotate({
+              description: "When the change in `pending_allowed_cidrs` was requested.",
+            }),
+          ),
           updated_at: Schema.optionalKey(Schema.String),
           applied_at: Schema.optionalKey(Schema.String),
         }),
@@ -12802,6 +13553,32 @@ export const V2GetProjectConfigOutput = Schema.Struct({
               expected: "a value less than or equal to 9007199254740991",
             }),
           ),
+        db_pool_max_lifetime: Schema.Number.check(
+          Schema.isInt().annotate({ expected: "an integer" }),
+        )
+          .check(
+            Schema.isGreaterThanOrEqualTo(0).annotate({
+              expected: "a value greater than or equal to 0",
+            }),
+          )
+          .check(
+            Schema.isLessThanOrEqualTo(3600).annotate({
+              expected: "a value less than or equal to 3600",
+            }),
+          ),
+        db_pool_max_idletime: Schema.Number.check(
+          Schema.isInt().annotate({ expected: "an integer" }),
+        )
+          .check(
+            Schema.isGreaterThanOrEqualTo(0).annotate({
+              expected: "a value greater than or equal to 0",
+            }),
+          )
+          .check(
+            Schema.isLessThanOrEqualTo(60).annotate({
+              expected: "a value less than or equal to 60",
+            }),
+          ),
         db_pool: Schema.Union([
           Schema.Number.annotate({
             description:
@@ -13076,6 +13853,13 @@ export const V2ListAllComputeInstancesOutput = Schema.Struct({
                 expected: "a value less than or equal to 9007199254740991",
               }),
             ),
+          secrets_scope: Schema.optionalKey(
+            Schema.Union([
+              Schema.Union([Schema.Literals(["all", "supabase", "none"]), OpenString]),
+              Schema.Array(Schema.Struct({ secret_name: Schema.String })),
+              Schema.Null,
+            ]),
+          ),
         }),
         build_state: Schema.Union([Schema.Literals(["building", "active", "failed"]), OpenString]),
         secret_generation: Schema.String,
@@ -13519,6 +14303,68 @@ export const V2ListOrganizationGithubConnectionsOutput = Schema.Struct({
     ),
   }),
 });
+export const V2ListOrganizationMaintenanceWindowsInput = Schema.Struct({
+  slug: Schema.String.check(
+    Schema.isPattern(new RegExp("^[\\w-]+$", "u")).annotate({
+      expected: "a string matching the RegExp ^[\\w-]+$",
+    }),
+  ),
+});
+export const V2ListOrganizationMaintenanceWindowsOutput = Schema.Struct({
+  data: Schema.Array(
+    Schema.Struct({
+      type: Schema.Literal("maintenance_window").annotate({ description: "Resource type." }),
+      id: Schema.String.annotate({ description: "AWS region." }),
+      attributes: Schema.Struct({
+        window: Schema.Struct({
+          day: Schema.Union([
+            Schema.Literals(["mon", "tue", "wed", "thu", "fri", "sat", "sun"]).annotate({
+              description: "UTC day the window starts.",
+            }),
+            OpenString,
+          ]),
+          start_utc: Schema.String.annotate({ description: "UTC start time." }),
+          duration_minutes: Schema.Number.check(Schema.isInt().annotate({ expected: "an integer" }))
+            .check(
+              Schema.isGreaterThanOrEqualTo(-9007199254740991).annotate({
+                expected: "a value greater than or equal to -9007199254740991",
+              }),
+            )
+            .check(
+              Schema.isLessThanOrEqualTo(9007199254740991).annotate({
+                expected: "a value less than or equal to 9007199254740991",
+              }),
+            ),
+        }),
+        current_window: Schema.Union([
+          Schema.Struct({
+            start_at: Schema.String.annotate({
+              description: "Start of the occurrence, inclusive.",
+              format: "date-time",
+            }),
+            end_at: Schema.String.annotate({
+              description: "End of the occurrence, exclusive.",
+              format: "date-time",
+            }),
+          }).annotate({ description: "The open occurrence, or null when the window is closed." }),
+          Schema.Null,
+        ]),
+        next_windows: Schema.Array(
+          Schema.Struct({
+            start_at: Schema.String.annotate({
+              description: "Start of the occurrence, inclusive.",
+              format: "date-time",
+            }),
+            end_at: Schema.String.annotate({
+              description: "End of the occurrence, exclusive.",
+              format: "date-time",
+            }),
+          }),
+        ).annotate({ description: "The next five occurrences that start after now, in order." }),
+      }),
+    }),
+  ),
+});
 export const V2ListOrganizationMembersInput = Schema.Struct({
   slug: Schema.String.check(
     Schema.isPattern(new RegExp("^[\\w-]+$", "u")).annotate({
@@ -13746,6 +14592,7 @@ export const V2ListOrganizationProjectsOutput = Schema.Struct({
             "RESTARTING",
             "PAUSE_FAILED",
             "RESIZING",
+            "PROMOTING",
           ]).annotate({ description: "Project status" }),
           OpenString,
         ]),
@@ -14077,6 +14924,7 @@ export const V2OrganizationsSlugWebhooksDeliveriesIdGetOutput = Schema.Struct({
             "v1.project.branch.created",
             "v1.project.branch.updated",
             "v1.project.branch.removed",
+            "v1.project.secrets.leaked",
             "v1.organization.member.invitation.created",
             "v1.organization.member.invitation.canceled",
             "v1.organization.member.added",
@@ -14086,6 +14934,7 @@ export const V2OrganizationsSlugWebhooksDeliveriesIdGetOutput = Schema.Struct({
             "v1.organization.member.role.updated",
             "v1.organization.billing.plan.upgraded",
             "v1.organization.billing.plan.downgraded",
+            "v1.organization.secrets.leaked",
           ]).annotate({ description: "Webhook event type." }),
           OpenString,
         ]),
@@ -14219,6 +15068,7 @@ export const V2OrganizationsSlugWebhooksEndpointsDeleteOutput = Schema.Struct({
                 "v1.project.branch.created",
                 "v1.project.branch.updated",
                 "v1.project.branch.removed",
+                "v1.project.secrets.leaked",
                 "v1.organization.member.invitation.created",
                 "v1.organization.member.invitation.canceled",
                 "v1.organization.member.added",
@@ -14228,6 +15078,7 @@ export const V2OrganizationsSlugWebhooksEndpointsDeleteOutput = Schema.Struct({
                 "v1.organization.member.role.updated",
                 "v1.organization.billing.plan.upgraded",
                 "v1.organization.billing.plan.downgraded",
+                "v1.organization.secrets.leaked",
                 "*",
               ]).annotate({ description: "Webhook event type." }),
               OpenString,
@@ -14354,6 +15205,7 @@ export const V2OrganizationsSlugWebhooksEndpointsGetOutput = Schema.Struct({
                 "v1.project.branch.created",
                 "v1.project.branch.updated",
                 "v1.project.branch.removed",
+                "v1.project.secrets.leaked",
                 "v1.organization.member.invitation.created",
                 "v1.organization.member.invitation.canceled",
                 "v1.organization.member.added",
@@ -14363,6 +15215,7 @@ export const V2OrganizationsSlugWebhooksEndpointsGetOutput = Schema.Struct({
                 "v1.organization.member.role.updated",
                 "v1.organization.billing.plan.upgraded",
                 "v1.organization.billing.plan.downgraded",
+                "v1.organization.secrets.leaked",
                 "*",
               ]).annotate({ description: "Webhook event type." }),
               OpenString,
@@ -14503,6 +15356,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdDeleteOutput = Schema.Struct(
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -14512,6 +15366,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdDeleteOutput = Schema.Struct(
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
@@ -14702,6 +15557,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdDeliveriesGetOutput = Schema.
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -14711,6 +15567,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdDeliveriesGetOutput = Schema.
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
           ]),
@@ -14849,6 +15706,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdGetOutput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -14858,6 +15716,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdGetOutput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
@@ -14953,6 +15812,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdPatchInput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -14962,6 +15822,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdPatchInput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
           }),
@@ -15062,6 +15923,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdPatchOutput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -15071,6 +15933,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdPatchOutput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
@@ -15141,6 +16004,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdTestPostInput = Schema.Struct
           "v1.project.branch.created",
           "v1.project.branch.updated",
           "v1.project.branch.removed",
+          "v1.project.secrets.leaked",
           "v1.organization.member.invitation.created",
           "v1.organization.member.invitation.canceled",
           "v1.organization.member.added",
@@ -15150,6 +16014,7 @@ export const V2OrganizationsSlugWebhooksEndpointsIdTestPostInput = Schema.Struct
           "v1.organization.member.role.updated",
           "v1.organization.billing.plan.upgraded",
           "v1.organization.billing.plan.downgraded",
+          "v1.organization.secrets.leaked",
         ]).annotate({ description: "Webhook event type." }),
       }),
     }),
@@ -15205,6 +16070,7 @@ export const V2OrganizationsSlugWebhooksEndpointsPostInput = Schema.Struct({
             "v1.project.branch.created",
             "v1.project.branch.updated",
             "v1.project.branch.removed",
+            "v1.project.secrets.leaked",
             "v1.organization.member.invitation.created",
             "v1.organization.member.invitation.canceled",
             "v1.organization.member.added",
@@ -15214,6 +16080,7 @@ export const V2OrganizationsSlugWebhooksEndpointsPostInput = Schema.Struct({
             "v1.organization.member.role.updated",
             "v1.organization.billing.plan.upgraded",
             "v1.organization.billing.plan.downgraded",
+            "v1.organization.secrets.leaked",
             "*",
           ]).annotate({ description: "Webhook event type." }),
         }),
@@ -15305,6 +16172,7 @@ export const V2OrganizationsSlugWebhooksEndpointsPostOutput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -15314,6 +16182,7 @@ export const V2OrganizationsSlugWebhooksEndpointsPostOutput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
@@ -15504,6 +16373,7 @@ export const V2ProjectsRefWebhooksDeliveriesIdGetOutput = Schema.Struct({
             "v1.project.branch.created",
             "v1.project.branch.updated",
             "v1.project.branch.removed",
+            "v1.project.secrets.leaked",
             "v1.organization.member.invitation.created",
             "v1.organization.member.invitation.canceled",
             "v1.organization.member.added",
@@ -15513,6 +16383,7 @@ export const V2ProjectsRefWebhooksDeliveriesIdGetOutput = Schema.Struct({
             "v1.organization.member.role.updated",
             "v1.organization.billing.plan.upgraded",
             "v1.organization.billing.plan.downgraded",
+            "v1.organization.secrets.leaked",
           ]).annotate({ description: "Webhook event type." }),
           OpenString,
         ]),
@@ -15658,6 +16529,7 @@ export const V2ProjectsRefWebhooksEndpointsDeleteOutput = Schema.Struct({
                 "v1.project.branch.created",
                 "v1.project.branch.updated",
                 "v1.project.branch.removed",
+                "v1.project.secrets.leaked",
                 "v1.organization.member.invitation.created",
                 "v1.organization.member.invitation.canceled",
                 "v1.organization.member.added",
@@ -15667,6 +16539,7 @@ export const V2ProjectsRefWebhooksEndpointsDeleteOutput = Schema.Struct({
                 "v1.organization.member.role.updated",
                 "v1.organization.billing.plan.upgraded",
                 "v1.organization.billing.plan.downgraded",
+                "v1.organization.secrets.leaked",
                 "*",
               ]).annotate({ description: "Webhook event type." }),
               OpenString,
@@ -15799,6 +16672,7 @@ export const V2ProjectsRefWebhooksEndpointsGetOutput = Schema.Struct({
                 "v1.project.branch.created",
                 "v1.project.branch.updated",
                 "v1.project.branch.removed",
+                "v1.project.secrets.leaked",
                 "v1.organization.member.invitation.created",
                 "v1.organization.member.invitation.canceled",
                 "v1.organization.member.added",
@@ -15808,6 +16682,7 @@ export const V2ProjectsRefWebhooksEndpointsGetOutput = Schema.Struct({
                 "v1.organization.member.role.updated",
                 "v1.organization.billing.plan.upgraded",
                 "v1.organization.billing.plan.downgraded",
+                "v1.organization.secrets.leaked",
                 "*",
               ]).annotate({ description: "Webhook event type." }),
               OpenString,
@@ -15954,6 +16829,7 @@ export const V2ProjectsRefWebhooksEndpointsIdDeleteOutput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -15963,6 +16839,7 @@ export const V2ProjectsRefWebhooksEndpointsIdDeleteOutput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
@@ -16159,6 +17036,7 @@ export const V2ProjectsRefWebhooksEndpointsIdDeliveriesGetOutput = Schema.Struct
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -16168,6 +17046,7 @@ export const V2ProjectsRefWebhooksEndpointsIdDeliveriesGetOutput = Schema.Struct
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
           ]),
@@ -16312,6 +17191,7 @@ export const V2ProjectsRefWebhooksEndpointsIdGetOutput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -16321,6 +17201,7 @@ export const V2ProjectsRefWebhooksEndpointsIdGetOutput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
@@ -16422,6 +17303,7 @@ export const V2ProjectsRefWebhooksEndpointsIdPatchInput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -16431,6 +17313,7 @@ export const V2ProjectsRefWebhooksEndpointsIdPatchInput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
           }),
@@ -16531,6 +17414,7 @@ export const V2ProjectsRefWebhooksEndpointsIdPatchOutput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -16540,6 +17424,7 @@ export const V2ProjectsRefWebhooksEndpointsIdPatchOutput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
@@ -16616,6 +17501,7 @@ export const V2ProjectsRefWebhooksEndpointsIdTestPostInput = Schema.Struct({
           "v1.project.branch.created",
           "v1.project.branch.updated",
           "v1.project.branch.removed",
+          "v1.project.secrets.leaked",
           "v1.organization.member.invitation.created",
           "v1.organization.member.invitation.canceled",
           "v1.organization.member.added",
@@ -16625,6 +17511,7 @@ export const V2ProjectsRefWebhooksEndpointsIdTestPostInput = Schema.Struct({
           "v1.organization.member.role.updated",
           "v1.organization.billing.plan.upgraded",
           "v1.organization.billing.plan.downgraded",
+          "v1.organization.secrets.leaked",
         ]).annotate({ description: "Webhook event type." }),
       }),
     }),
@@ -16686,6 +17573,7 @@ export const V2ProjectsRefWebhooksEndpointsPostInput = Schema.Struct({
             "v1.project.branch.created",
             "v1.project.branch.updated",
             "v1.project.branch.removed",
+            "v1.project.secrets.leaked",
             "v1.organization.member.invitation.created",
             "v1.organization.member.invitation.canceled",
             "v1.organization.member.added",
@@ -16695,6 +17583,7 @@ export const V2ProjectsRefWebhooksEndpointsPostInput = Schema.Struct({
             "v1.organization.member.role.updated",
             "v1.organization.billing.plan.upgraded",
             "v1.organization.billing.plan.downgraded",
+            "v1.organization.secrets.leaked",
             "*",
           ]).annotate({ description: "Webhook event type." }),
         }),
@@ -16786,6 +17675,7 @@ export const V2ProjectsRefWebhooksEndpointsPostOutput = Schema.Struct({
               "v1.project.branch.created",
               "v1.project.branch.updated",
               "v1.project.branch.removed",
+              "v1.project.secrets.leaked",
               "v1.organization.member.invitation.created",
               "v1.organization.member.invitation.canceled",
               "v1.organization.member.added",
@@ -16795,6 +17685,7 @@ export const V2ProjectsRefWebhooksEndpointsPostOutput = Schema.Struct({
               "v1.organization.member.role.updated",
               "v1.organization.billing.plan.upgraded",
               "v1.organization.billing.plan.downgraded",
+              "v1.organization.secrets.leaked",
               "*",
             ]).annotate({ description: "Webhook event type." }),
             OpenString,
@@ -16832,6 +17723,24 @@ export const V2ProjectsRefWebhooksEndpointsPostOutput = Schema.Struct({
     }),
   }),
 });
+export const V2RemoveOrganizationMembersInput = Schema.Struct({
+  slug: Schema.String.check(
+    Schema.isPattern(new RegExp("^[\\w-]+$", "u")).annotate({
+      expected: "a string matching the RegExp ^[\\w-]+$",
+    }),
+  ),
+  user_id: Schema.String.annotate({ format: "uuid" }).check(
+    Schema.isPattern(
+      new RegExp(
+        "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$",
+        "u",
+      ),
+    ).annotate({
+      expected:
+        "a string matching the RegExp ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$",
+    }),
+  ),
+});
 export const V2RunProjectAdvisorsInput = Schema.Struct({
   ref: Schema.String.check(
     Schema.isMinCodePoints(20).annotate({ expected: "a string with at least 20 code points" }),
@@ -16891,6 +17800,9 @@ export const V2RunProjectAdvisorsInput = Schema.Struct({
               "log_auth_error_rate_high",
               "log_storage_error_rate_high",
               "log_edge_function_error_rate_high",
+              "realtime_authorization_timeouts",
+              "realtime_postgres_changes_spike",
+              "realtime_concurrent_users_near_limit",
             ]),
           }),
         )
@@ -16898,7 +17810,7 @@ export const V2RunProjectAdvisorsInput = Schema.Struct({
             Schema.isMinLength(1).annotate({ expected: "a value with a length of at least 1" }),
           )
           .check(
-            Schema.isMaxLength(10).annotate({ expected: "a value with a length of at most 10" }),
+            Schema.isMaxLength(15).annotate({ expected: "a value with a length of at most 15" }),
           ),
       }),
     }),
@@ -16953,6 +17865,9 @@ export const V2RunProjectAdvisorsOutput = Schema.Struct({
               "log_auth_error_rate_high",
               "log_storage_error_rate_high",
               "log_edge_function_error_rate_high",
+              "realtime_authorization_timeouts",
+              "realtime_postgres_changes_spike",
+              "realtime_concurrent_users_near_limit",
               "project_not_active",
               "advisor_check_unavailable",
             ]),
@@ -17682,6 +18597,7 @@ export const V2DeleteLogDrainOutput = Schema.Void;
 export const V2DeleteNotebookOutput = Schema.Void;
 export const V2DeletePrivateLinkAssociationOutput = Schema.Void;
 export const V2DeletePrivateLinkAssociationForDatabaseOutput = Schema.Void;
+export const V2RemoveOrganizationMembersOutput = Schema.Void;
 export const V2TransferAProjectOutput = Schema.Void;
 
 export const openApiOperationIdMap = {
@@ -17811,6 +18727,7 @@ export const openApiOperationIdMap = {
   "v1-oauth-authorize-project-claim": "v1OauthAuthorizeProjectClaim",
   "v1-patch-a-migration": "v1PatchAMigration",
   "v1-patch-network-restrictions": "v1PatchNetworkRestrictions",
+  "v1-patch-postgres-config": "v1PatchPostgresConfig",
   "v1-pause-a-project": "v1PauseAProject",
   "v1-push-a-branch": "v1PushABranch",
   "v1-read-only-query": "v1ReadOnlyQuery",
@@ -17823,6 +18740,7 @@ export const openApiOperationIdMap = {
   "v1-restore-a-project": "v1RestoreAProject",
   "v1-restore-physical-backup": "v1RestorePhysicalBackup",
   "v1-restore-pitr-backup": "v1RestorePitrBackup",
+  "v1-review-network-restrictions": "v1ReviewNetworkRestrictions",
   "v1-revoke-token": "v1RevokeToken",
   "v1-rollback-migrations": "v1RollbackMigrations",
   "v1-run-a-query": "v1RunAQuery",
@@ -17869,6 +18787,7 @@ export const openApiOperationIdMap = {
   "v2-delete-private-link-association": "v2DeletePrivateLinkAssociation",
   "v2-delete-private-link-association-for-database": "v2DeletePrivateLinkAssociationForDatabase",
   "v2-deploy-a-compute-instance": "v2DeployAComputeInstance",
+  "v2-download-project-backup": "v2DownloadProjectBackup",
   "v2-get-a-compute-instance": "v2GetAComputeInstance",
   "v2-get-notebook": "v2GetNotebook",
   "v2-get-project-config": "v2GetProjectConfig",
@@ -17876,6 +18795,7 @@ export const openApiOperationIdMap = {
   "v2-list-log-drains": "v2ListLogDrains",
   "v2-list-notebooks": "v2ListNotebooks",
   "v2-list-organization-github-connections": "v2ListOrganizationGithubConnections",
+  "v2-list-organization-maintenance-windows": "v2ListOrganizationMaintenanceWindows",
   "v2-list-organization-members": "v2ListOrganizationMembers",
   "v2-list-organization-projects": "v2ListOrganizationProjects",
   "v2-list-organization-roles": "v2ListOrganizationRoles",
@@ -17907,6 +18827,7 @@ export const openApiOperationIdMap = {
   "v2-projects-ref-webhooks-endpoints-id-patch": "v2ProjectsRefWebhooksEndpointsIdPatch",
   "v2-projects-ref-webhooks-endpoints-id-test-post": "v2ProjectsRefWebhooksEndpointsIdTestPost",
   "v2-projects-ref-webhooks-endpoints-post": "v2ProjectsRefWebhooksEndpointsPost",
+  "v2-remove-organization-members": "v2RemoveOrganizationMembers",
   "v2-run-project-advisors": "v2RunProjectAdvisors",
   "v2-transfer-a-project": "v2TransferAProject",
   "v2-update-log-drain": "v2UpdateLogDrain",
@@ -19692,6 +20613,67 @@ export const operationDefinitions = {
     inputSchema: V1PatchNetworkRestrictionsInput,
     outputSchema: V1PatchNetworkRestrictionsOutput,
   },
+  v1PatchPostgresConfig: {
+    id: "v1PatchPostgresConfig",
+    description: "Partially updates project's Postgres config",
+    method: "PATCH",
+    path: "/v1/projects/{ref}/config/database/postgres",
+    pathParams: ["ref"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: {
+      kind: "json",
+      contentType: "application/json",
+      fields: [
+        "effective_cache_size",
+        "logical_decoding_work_mem",
+        "pg_stat_statements.max",
+        "pg_net.batch_size",
+        "autovacuum_max_workers",
+        "autovacuum_work_mem",
+        "cron.log_statement",
+        "log_autovacuum_min_duration",
+        "log_checkpoints",
+        "log_connections",
+        "log_disconnections",
+        "log_duration",
+        "log_lock_waits",
+        "log_recovery_conflict_waits",
+        "log_replication_commands",
+        "log_startup_progress_interval",
+        "log_temp_files",
+        "maintenance_work_mem",
+        "track_activity_query_size",
+        "max_connections",
+        "max_locks_per_transaction",
+        "max_logical_replication_workers",
+        "max_parallel_maintenance_workers",
+        "max_parallel_workers",
+        "max_parallel_workers_per_gather",
+        "max_replication_slots",
+        "max_slot_wal_keep_size",
+        "max_standby_archive_delay",
+        "max_standby_streaming_delay",
+        "max_sync_workers_per_subscription",
+        "max_wal_size",
+        "max_wal_senders",
+        "max_worker_processes",
+        "session_replication_role",
+        "shared_buffers",
+        "statement_timeout",
+        "track_commit_timestamp",
+        "wal_keep_size",
+        "wal_sender_timeout",
+        "work_mem",
+        "checkpoint_timeout",
+        "hot_standby_feedback",
+        "restart_database",
+      ],
+    },
+    response: { kind: "json" },
+    inputSchema: V1PatchPostgresConfigInput,
+    outputSchema: V1PatchPostgresConfigOutput,
+  },
   v1PauseAProject: {
     id: "v1PauseAProject",
     description: "Pauses the given project",
@@ -19856,6 +20838,24 @@ export const operationDefinitions = {
     inputSchema: V1RestorePitrBackupInput,
     outputSchema: V1RestorePitrBackupOutput,
   },
+  v1ReviewNetworkRestrictions: {
+    id: "v1ReviewNetworkRestrictions",
+    description:
+      "This is an **experimental** endpoint. It is subject to change or removal in future versions. Use it with caution, as it may not remain supported or stable.\n\nThis endpoint is currently in its **Alpha** stage.",
+    method: "POST",
+    path: "/v1/projects/{ref}/network-restrictions/review",
+    pathParams: ["ref"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: {
+      kind: "json",
+      contentType: "application/json",
+      fields: ["action", "requested_at"],
+    },
+    response: { kind: "json" },
+    inputSchema: V1ReviewNetworkRestrictionsInput,
+    outputSchema: V1ReviewNetworkRestrictionsOutput,
+  },
   v1RevokeToken: {
     id: "v1RevokeToken",
     description:
@@ -20500,6 +21500,8 @@ export const operationDefinitions = {
         "max_rows",
         "db_pool",
         "db_pool_acquisition_timeout",
+        "db_pool_max_lifetime",
+        "db_pool_max_idletime",
       ],
     },
     response: { kind: "json" },
@@ -20852,6 +21854,19 @@ export const operationDefinitions = {
     inputSchema: V2DeployAComputeInstanceInput,
     outputSchema: V2DeployAComputeInstanceOutput,
   },
+  v2DownloadProjectBackup: {
+    id: "v2DownloadProjectBackup",
+    description: "Download project backup",
+    method: "POST",
+    path: "/v2/projects/{ref}/backups/download",
+    pathParams: ["ref"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: { kind: "json", contentType: "application/json", fields: ["data"] },
+    response: { kind: "json" },
+    inputSchema: V2DownloadProjectBackupInput,
+    outputSchema: V2DownloadProjectBackupOutput,
+  },
   v2GetAComputeInstance: {
     id: "v2GetAComputeInstance",
     description:
@@ -20948,6 +21963,20 @@ export const operationDefinitions = {
     inputSchema: V2ListOrganizationGithubConnectionsInput,
     outputSchema: V2ListOrganizationGithubConnectionsOutput,
   },
+  v2ListOrganizationMaintenanceWindows: {
+    id: "v2ListOrganizationMaintenanceWindows",
+    description:
+      "Returns the weekly maintenance window for each region, with the open occurrence and the next five.",
+    method: "GET",
+    path: "/v2/organizations/{slug}/maintenance/windows",
+    pathParams: ["slug"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: { kind: "none" },
+    response: { kind: "json" },
+    inputSchema: V2ListOrganizationMaintenanceWindowsInput,
+    outputSchema: V2ListOrganizationMaintenanceWindowsOutput,
+  },
   v2ListOrganizationMembers: {
     id: "v2ListOrganizationMembers",
     description:
@@ -21286,6 +22315,20 @@ export const operationDefinitions = {
     inputSchema: V2ProjectsRefWebhooksEndpointsPostInput,
     outputSchema: V2ProjectsRefWebhooksEndpointsPostOutput,
   },
+  v2RemoveOrganizationMembers: {
+    id: "v2RemoveOrganizationMembers",
+    description:
+      "Removes one or more organization members including their roles and project-scoped permissions.",
+    method: "DELETE",
+    path: "/v2/organizations/{slug}/members/{user_id}",
+    pathParams: ["slug", "user_id"],
+    queryParams: [],
+    headerParams: [],
+    requestBody: { kind: "none" },
+    response: { kind: "void" },
+    inputSchema: V2RemoveOrganizationMembersInput,
+    outputSchema: V2RemoveOrganizationMembersOutput,
+  },
   v2RunProjectAdvisors: {
     id: "v2RunProjectAdvisors",
     description: "Runs the project advisors with the given names",
diff --git a/packages/api/src/generated/effect-client.ts b/packages/api/src/generated/effect-client.ts
index d1f8bd2150..c35875f901 100644
--- a/packages/api/src/generated/effect-client.ts
+++ b/packages/api/src/generated/effect-client.ts
@@ -2022,6 +2022,22 @@ export const versionedEffectOperations = {
           options,
         );
       }),
+    patchPostgresConfig: (
+      input: typeof operationDefinitions.v1PatchPostgresConfig.inputSchema.Type,
+      options?: SupabaseApiRequestOptions,
+    ): Effect.Effect<
+      typeof operationDefinitions.v1PatchPostgresConfig.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v1PatchPostgresConfig">(
+          operationDefinitions.v1PatchPostgresConfig,
+          input,
+          options,
+        );
+      }),
     pauseAProject: (
       input: typeof operationDefinitions.v1PauseAProject.inputSchema.Type,
       options?: SupabaseApiRequestOptions,
@@ -2214,6 +2230,22 @@ export const versionedEffectOperations = {
           options,
         );
       }),
+    reviewNetworkRestrictions: (
+      input: typeof operationDefinitions.v1ReviewNetworkRestrictions.inputSchema.Type,
+      options?: SupabaseApiRequestOptions,
+    ): Effect.Effect<
+      typeof operationDefinitions.v1ReviewNetworkRestrictions.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v1ReviewNetworkRestrictions">(
+          operationDefinitions.v1ReviewNetworkRestrictions,
+          input,
+          options,
+        );
+      }),
     revokeToken: (
       input: typeof operationDefinitions.v1RevokeToken.inputSchema.Type,
       options?: SupabaseApiRequestOptions,
@@ -2948,6 +2980,22 @@ export const versionedEffectOperations = {
           options,
         );
       }),
+    downloadProjectBackup: (
+      input: typeof operationDefinitions.v2DownloadProjectBackup.inputSchema.Type,
+      options?: SupabaseApiRequestOptions,
+    ): Effect.Effect<
+      typeof operationDefinitions.v2DownloadProjectBackup.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v2DownloadProjectBackup">(
+          operationDefinitions.v2DownloadProjectBackup,
+          input,
+          options,
+        );
+      }),
     getAComputeInstance: (
       input: typeof operationDefinitions.v2GetAComputeInstance.inputSchema.Type,
       options?: SupabaseApiRequestOptions,
@@ -3060,6 +3108,22 @@ export const versionedEffectOperations = {
           options,
         );
       }),
+    listOrganizationMaintenanceWindows: (
+      input: typeof operationDefinitions.v2ListOrganizationMaintenanceWindows.inputSchema.Type,
+      options?: SupabaseApiRequestOptions,
+    ): Effect.Effect<
+      typeof operationDefinitions.v2ListOrganizationMaintenanceWindows.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v2ListOrganizationMaintenanceWindows">(
+          operationDefinitions.v2ListOrganizationMaintenanceWindows,
+          input,
+          options,
+        );
+      }),
     listOrganizationMembers: (
       input: typeof operationDefinitions.v2ListOrganizationMembers.inputSchema.Type,
       options?: SupabaseApiRequestOptions,
@@ -3460,6 +3524,22 @@ export const versionedEffectOperations = {
           options,
         );
       }),
+    removeOrganizationMembers: (
+      input: typeof operationDefinitions.v2RemoveOrganizationMembers.inputSchema.Type,
+      options?: SupabaseApiRequestOptions,
+    ): Effect.Effect<
+      typeof operationDefinitions.v2RemoveOrganizationMembers.outputSchema.Type,
+      SupabaseApiError,
+      SupabaseApiClient
+    > =>
+      Effect.gen(function* () {
+        const client = yield* SupabaseApiClient;
+        return yield* client.execute<"v2RemoveOrganizationMembers">(
+          operationDefinitions.v2RemoveOrganizationMembers,
+          input,
+          options,
+        );
+      }),
     runProjectAdvisors: (
       input: typeof operationDefinitions.v2RunProjectAdvisors.inputSchema.Type,
       options?: SupabaseApiRequestOptions,
diff --git a/packages/api/src/generated/openapi.json b/packages/api/src/generated/openapi.json
index 9f80f6f044..bf7ec1b0d8 100644
--- a/packages/api/src/generated/openapi.json
+++ b/packages/api/src/generated/openapi.json
@@ -927,6 +927,9 @@
           "403": {
             "description": "Forbidden action"
           },
+          "404": {
+            "description": "User not found"
+          },
           "429": {
             "description": "Rate limit exceeded"
           },
@@ -2164,6 +2167,9 @@
           "403": {
             "description": "Forbidden action"
           },
+          "404": {
+            "description": "API key not found for project"
+          },
           "429": {
             "description": "Rate limit exceeded"
           }
@@ -2240,6 +2246,9 @@
           "403": {
             "description": "Forbidden action"
           },
+          "404": {
+            "description": "API key not found for project"
+          },
           "429": {
             "description": "Rate limit exceeded"
           }
@@ -2338,6 +2347,9 @@
           "403": {
             "description": "Forbidden action"
           },
+          "404": {
+            "description": "API key not found for project"
+          },
           "429": {
             "description": "Rate limit exceeded"
           }
@@ -3580,6 +3592,82 @@
         "x-scalar-stability": "experimental"
       }
     },
+    "/v1/projects/{ref}/network-restrictions/review": {
+      "post": {
+        "description": "This is an **experimental** endpoint. It is subject to change or removal in future versions. Use it with caution, as it may not remain supported or stable.\n\nThis endpoint is currently in its **Alpha** stage.",
+        "operationId": "v1-review-network-restrictions",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NetworkRestrictionsReviewRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkRestrictionsResponse_Output"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to resolve the network restrictions review"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          }
+        ],
+        "summary": "Applies or rejects the change in review in a project's network restrictions",
+        "tags": ["Projects"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: projects:write",
+            "position": "after"
+          },
+          {
+            "name": "Alpha",
+            "position": "before"
+          }
+        ],
+        "x-endpoint-owners": ["control-plane"],
+        "x-fga-permissions": [["database_network_restrictions_write"]],
+        "x-oauth-scope": "projects:write",
+        "x-scalar-stability": "experimental"
+      }
+    },
     "/v1/projects/{ref}/pgsodium": {
       "get": {
         "description": "This is an **experimental** endpoint. It is subject to change or removal in future versions. Use it with caution, as it may not remain supported or stable.\n\nThis endpoint is currently in its **Beta** stage.",
@@ -9248,13 +9336,12 @@
           "content": {
             "application/vnd.denoland.eszip": {
               "schema": {
-                "type": "string",
-                "format": "binary"
+                "$ref": "#/components/schemas/V1UpdateFunctionBodyEszip"
               }
             },
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/V1UpdateFunctionBody"
+                "$ref": "#/components/schemas/V1UpdateFunctionBodyJson"
               }
             }
           }
@@ -10131,6 +10218,74 @@
         "x-endpoint-owners": ["infra", "control-plane"],
         "x-fga-permissions": [["database_config_write"]],
         "x-oauth-scope": "database:write"
+      },
+      "patch": {
+        "operationId": "v1-patch-postgres-config",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UpdatePostgresConfigBody"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostgresConfigResponse_Output"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to update project's Postgres config"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          }
+        ],
+        "summary": "Partially updates project's Postgres config",
+        "tags": ["Database"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: database:write",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["infra", "control-plane"],
+        "x-fga-permissions": [["database_config_write"]],
+        "x-oauth-scope": "database:write"
       }
     },
     "/v1/projects/{ref}/config/realtime": {
@@ -12045,6 +12200,114 @@
         "x-fga-permissions": [["advisors_read"]]
       }
     },
+    "/v2/projects/{ref}/backups/download": {
+      "post": {
+        "operationId": "v2-download-project-backup",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DownloadBackupBody"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DownloadBackupResponse_Output"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Forbidden action",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Project not found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Failed to download project backup",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          }
+        ],
+        "summary": "Download project backup",
+        "tags": ["Projects"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: database:write",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["infra", "control-plane"],
+        "x-fga-permissions": [["backups_write"]],
+        "x-oauth-scope": "database:write"
+      }
+    },
     "/v2/projects/{ref}/branches": {
       "post": {
         "description": "Creates a database branch from the specified project. Compute and disk size can be set here so the branch is provisioned at the requested size, instead of being resized after creation.",
@@ -13816,10 +14079,10 @@
         "x-scalar-stability": "experimental"
       }
     },
-    "/v2/organizations/{slug}/members": {
+    "/v2/organizations/{slug}/roles": {
       "get": {
-        "description": "Returns a cursor-paginated list of organization members including their roles and project-scoped permissions.",
-        "operationId": "v2-list-organization-members",
+        "description": "Returns a list of org-level roles for the organization.",
+        "operationId": "v2-list-organization-roles",
         "parameters": [
           {
             "name": "slug",
@@ -13831,51 +14094,6 @@
               "example": "tsrqponmlkjihgfedcba",
               "type": "string"
             }
-          },
-          {
-            "name": "page",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "properties": {
-                "size": {
-                  "type": "integer",
-                  "minimum": 1,
-                  "maximum": 100
-                },
-                "after": {
-                  "type": "string",
-                  "format": "uuid",
-                  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
-                },
-                "before": {
-                  "type": "string",
-                  "format": "uuid",
-                  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
-                }
-              },
-              "type": "object"
-            },
-            "style": "deepObject"
-          },
-          {
-            "name": "filter",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "properties": {
-                "username": {
-                  "type": "string"
-                },
-                "primary_email": {
-                  "type": "string",
-                  "format": "email",
-                  "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
-                }
-              },
-              "type": "object"
-            },
-            "style": "deepObject"
           }
         ],
         "responses": {
@@ -13884,7 +14102,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/V2ListMembersResponse_Output"
+                  "$ref": "#/components/schemas/V2ListRolesResponse_Output"
                 }
               }
             }
@@ -13925,7 +14143,7 @@
             "bearer": []
           }
         ],
-        "summary": "List members of an organization",
+        "summary": "List roles of an organization",
         "tags": ["Organizations"],
         "x-badges": [
           {
@@ -13938,10 +14156,10 @@
         "x-oauth-scope": "organizations:read"
       }
     },
-    "/v2/organizations/{slug}/members/{user_id}/roles": {
-      "patch": {
-        "description": "Assigns an org-wide role when projects is omitted, or creates a project-scoped assignment when projects is provided. Uses an org-level role template id from GET /v2/organizations/{slug}/roles. Stale role assignments are automatically cleaned up: if a role no longer has any projects, it is deleted; overlapping project assignments in other roles are automatically removed to avoid duplication.",
-        "operationId": "v2-assign-organization-member-role",
+    "/v2/organizations/{slug}/members/invitations": {
+      "post": {
+        "description": "Creates member invitations for an organization. Each invitation can have different role and project scope settings.",
+        "operationId": "v2-create-organization-invitations",
         "parameters": [
           {
             "name": "slug",
@@ -13953,16 +14171,6 @@
               "example": "tsrqponmlkjihgfedcba",
               "type": "string"
             }
-          },
-          {
-            "name": "user_id",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "format": "uuid",
-              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
-              "type": "string"
-            }
           }
         ],
         "requestBody": {
@@ -13970,18 +14178,18 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/V2AssignOrganizationMemberRoleRequest"
+                "$ref": "#/components/schemas/V2CreateInvitationsRequest"
               }
             }
           }
         },
         "responses": {
-          "200": {
+          "201": {
             "description": "",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/OrganizationMemberRoleResponse_Output"
+                  "$ref": "#/components/schemas/V2CreateInvitationsResponse_Output"
                 }
               }
             }
@@ -14025,9 +14233,99 @@
                 }
               }
             }
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          }
+        ],
+        "summary": "Creates organization invitations",
+        "tags": ["Organizations Members Invitations"],
+        "x-allowed-plans": ["Team", "Enterprise"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: organizations:write",
+            "position": "after"
           },
-          "500": {
-            "description": "Failed to assign organization member role",
+          {
+            "name": "Only available on Team, Enterprise",
+            "position": "before"
+          }
+        ],
+        "x-endpoint-owners": ["control-plane"],
+        "x-fga-permissions": [["members_write"]],
+        "x-oauth-scope": "organizations:write"
+      },
+      "delete": {
+        "description": "Bulk delete member invitations for an organization by email address.",
+        "operationId": "v2-delete-organization-invitations",
+        "parameters": [
+          {
+            "name": "slug",
+            "required": true,
+            "in": "path",
+            "description": "Organization slug",
+            "schema": {
+              "pattern": "^[\\w-]+$",
+              "example": "tsrqponmlkjihgfedcba",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/V2DeleteInvitationsRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/V2DeleteInvitationsResponse_Output"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "402": {
+            "description": "This feature requires the Team, or Enterprise organization plan.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Forbidden action",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded",
             "content": {
               "application/json": {
                 "schema": {
@@ -14042,23 +14340,28 @@
             "bearer": []
           }
         ],
-        "summary": "Assign or change an organization member role",
-        "tags": ["Organizations"],
+        "summary": "Deletes organization invitations by email",
+        "tags": ["Organizations Members Invitations"],
         "x-allowed-plans": ["Team", "Enterprise"],
         "x-badges": [
+          {
+            "name": "OAuth scope: organizations:write",
+            "position": "after"
+          },
           {
             "name": "Only available on Team, Enterprise",
             "position": "before"
           }
         ],
         "x-endpoint-owners": ["control-plane"],
-        "x-fga-permissions": [["organization_admin_write"]]
+        "x-fga-permissions": [["members_write"]],
+        "x-oauth-scope": "organizations:write"
       }
     },
-    "/v2/organizations/{slug}/roles": {
+    "/v2/organizations/{slug}/members": {
       "get": {
-        "description": "Returns a list of org-level roles for the organization.",
-        "operationId": "v2-list-organization-roles",
+        "description": "Returns a cursor-paginated list of organization members including their roles and project-scoped permissions.",
+        "operationId": "v2-list-organization-members",
         "parameters": [
           {
             "name": "slug",
@@ -14070,6 +14373,51 @@
               "example": "tsrqponmlkjihgfedcba",
               "type": "string"
             }
+          },
+          {
+            "name": "page",
+            "required": false,
+            "in": "query",
+            "schema": {
+              "properties": {
+                "size": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 100
+                },
+                "after": {
+                  "type": "string",
+                  "format": "uuid",
+                  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                },
+                "before": {
+                  "type": "string",
+                  "format": "uuid",
+                  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                }
+              },
+              "type": "object"
+            },
+            "style": "deepObject"
+          },
+          {
+            "name": "filter",
+            "required": false,
+            "in": "query",
+            "schema": {
+              "properties": {
+                "username": {
+                  "type": "string"
+                },
+                "primary_email": {
+                  "type": "string",
+                  "format": "email",
+                  "pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+                }
+              },
+              "type": "object"
+            },
+            "style": "deepObject"
           }
         ],
         "responses": {
@@ -14078,7 +14426,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/V2ListRolesResponse_Output"
+                  "$ref": "#/components/schemas/V2ListMembersResponse_Output"
                 }
               }
             }
@@ -14119,7 +14467,7 @@
             "bearer": []
           }
         ],
-        "summary": "List roles of an organization",
+        "summary": "List members of an organization",
         "tags": ["Organizations"],
         "x-badges": [
           {
@@ -14132,10 +14480,10 @@
         "x-oauth-scope": "organizations:read"
       }
     },
-    "/v2/organizations/{slug}/members/invitations": {
-      "post": {
-        "description": "Creates member invitations for an organization. Each invitation can have different role and project scope settings.",
-        "operationId": "v2-create-organization-invitations",
+    "/v2/organizations/{slug}/members/{user_id}/roles": {
+      "patch": {
+        "description": "Assigns an org-wide role when projects is omitted, or creates a project-scoped assignment when projects is provided. Uses an org-level role template id from GET /v2/organizations/{slug}/roles. Stale role assignments are automatically cleaned up: if a role no longer has any projects, it is deleted; overlapping project assignments in other roles are automatically removed to avoid duplication.",
+        "operationId": "v2-assign-organization-member-role",
         "parameters": [
           {
             "name": "slug",
@@ -14147,6 +14495,16 @@
               "example": "tsrqponmlkjihgfedcba",
               "type": "string"
             }
+          },
+          {
+            "name": "user_id",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$",
+              "type": "string"
+            }
           }
         ],
         "requestBody": {
@@ -14154,18 +14512,18 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/V2CreateInvitationsRequest"
+                "$ref": "#/components/schemas/V2AssignOrganizationMemberRoleRequest"
               }
             }
           }
         },
         "responses": {
-          "201": {
+          "200": {
             "description": "",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/V2CreateInvitationsResponse_Output"
+                  "$ref": "#/components/schemas/OrganizationMemberRoleResponse_Output"
                 }
               }
             }
@@ -14209,6 +14567,16 @@
                 }
               }
             }
+          },
+          "500": {
+            "description": "Failed to assign organization member role",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
           }
         },
         "security": [
@@ -14216,8 +14584,8 @@
             "bearer": []
           }
         ],
-        "summary": "Creates organization invitations",
-        "tags": ["Organizations Members Invitations"],
+        "summary": "Assign or change an organization member role",
+        "tags": ["Organizations"],
         "x-allowed-plans": ["Team", "Enterprise"],
         "x-badges": [
           {
@@ -14230,12 +14598,14 @@
           }
         ],
         "x-endpoint-owners": ["control-plane"],
-        "x-fga-permissions": [["members_write"]],
+        "x-fga-permissions": [["organization_admin_write"]],
         "x-oauth-scope": "organizations:write"
-      },
+      }
+    },
+    "/v2/organizations/{slug}/members/{user_id}": {
       "delete": {
-        "description": "Bulk delete member invitations for an organization by email address.",
-        "operationId": "v2-delete-organization-invitations",
+        "description": "Removes one or more organization members including their roles and project-scoped permissions.",
+        "operationId": "v2-remove-organization-members",
         "parameters": [
           {
             "name": "slug",
@@ -14247,31 +14617,34 @@
               "example": "tsrqponmlkjihgfedcba",
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/V2DeleteInvitationsRequest"
-              }
+          },
+          {
+            "name": "user_id",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$",
+              "type": "string"
             }
           }
-        },
+        ],
         "responses": {
-          "200": {
-            "description": "",
+          "204": {
+            "description": ""
+          },
+          "401": {
+            "description": "Unauthorized",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/V2DeleteInvitationsResponse_Output"
+                  "$ref": "#/components/schemas/ErrorResponseBody"
                 }
               }
             }
           },
-          "401": {
-            "description": "Unauthorized",
+          "403": {
+            "description": "Forbidden action",
             "content": {
               "application/json": {
                 "schema": {
@@ -14280,8 +14653,8 @@
               }
             }
           },
-          "402": {
-            "description": "This feature requires the Team, or Enterprise organization plan.",
+          "404": {
+            "description": "Organization member not found",
             "content": {
               "application/json": {
                 "schema": {
@@ -14290,8 +14663,8 @@
               }
             }
           },
-          "403": {
-            "description": "Forbidden action",
+          "429": {
+            "description": "Rate limit exceeded",
             "content": {
               "application/json": {
                 "schema": {
@@ -14300,8 +14673,8 @@
               }
             }
           },
-          "429": {
-            "description": "Rate limit exceeded",
+          "500": {
+            "description": "Failed to remove organization member",
             "content": {
               "application/json": {
                 "schema": {
@@ -14316,21 +14689,16 @@
             "bearer": []
           }
         ],
-        "summary": "Deletes organization invitations by email",
-        "tags": ["Organizations Members Invitations"],
-        "x-allowed-plans": ["Team", "Enterprise"],
+        "summary": "Removes organization members",
+        "tags": ["Organizations"],
         "x-badges": [
           {
             "name": "OAuth scope: organizations:write",
             "position": "after"
-          },
-          {
-            "name": "Only available on Team, Enterprise",
-            "position": "before"
           }
         ],
         "x-endpoint-owners": ["control-plane"],
-        "x-fga-permissions": [["members_write"]],
+        "x-fga-permissions": [["organization_admin_write"]],
         "x-oauth-scope": "organizations:write"
       }
     },
@@ -14363,11 +14731,141 @@
                 },
                 "after": {
                   "type": "string",
-                  "minLength": 1
+                  "minLength": 1
+                },
+                "before": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "type": "object"
+            },
+            "style": "deepObject"
+          },
+          {
+            "name": "sort",
+            "required": false,
+            "in": "query",
+            "description": "Sort order by creation time: `inserted_at` (oldest first) or `-inserted_at` (newest first). Defaults to `inserted_at`.",
+            "schema": {
+              "example": "-inserted_at",
+              "type": "string",
+              "enum": ["inserted_at", "-inserted_at"]
+            }
+          },
+          {
+            "name": "search",
+            "required": false,
+            "in": "query",
+            "description": "Case-insensitive substring match on the project name.",
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/V2ListProjectsResponse_Output"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Forbidden action",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Rate limit exceeded",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          }
+        ],
+        "summary": "List projects of an organization",
+        "tags": ["Organizations"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: projects:read",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["control-plane"],
+        "x-fga-permissions": [["organization_projects_read"]],
+        "x-oauth-scope": "projects:read"
+      }
+    },
+    "/v2/organizations/{slug}/integrations/github/connections": {
+      "get": {
+        "description": "Returns a cursor-paginated list of the GitHub connections of the organization's projects.\n\nUse `page[after]` and `page[before]` to navigate pages and `page[size]` to control the page size.\nPaging walks the organization projects, so a page holds at most `page[size]` connections and can hold fewer (or none) when some of its projects are not connected.\nFollow `links.next` until it is `null` rather than stopping on a short page.\n\nUse `filter[project_ref]` to narrow the list down to a single project.",
+        "operationId": "v2-list-organization-github-connections",
+        "parameters": [
+          {
+            "name": "slug",
+            "required": true,
+            "in": "path",
+            "description": "Organization slug",
+            "schema": {
+              "pattern": "^[\\w-]+$",
+              "example": "tsrqponmlkjihgfedcba",
+              "type": "string"
+            }
+          },
+          {
+            "name": "page",
+            "required": false,
+            "in": "query",
+            "schema": {
+              "properties": {
+                "size": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 100
+                },
+                "after": {
+                  "type": "string",
+                  "minLength": 20,
+                  "maxLength": 20,
+                  "pattern": "^[a-z]+$",
+                  "description": "Project ref",
+                  "example": "abcdefghijklmnopqrst"
                 },
                 "before": {
                   "type": "string",
-                  "minLength": 1
+                  "minLength": 20,
+                  "maxLength": 20,
+                  "pattern": "^[a-z]+$",
+                  "description": "Project ref",
+                  "example": "abcdefghijklmnopqrst"
                 }
               },
               "type": "object"
@@ -14375,25 +14873,23 @@
             "style": "deepObject"
           },
           {
-            "name": "sort",
-            "required": false,
-            "in": "query",
-            "description": "Sort order by creation time: `inserted_at` (oldest first) or `-inserted_at` (newest first). Defaults to `inserted_at`.",
-            "schema": {
-              "example": "-inserted_at",
-              "type": "string",
-              "enum": ["inserted_at", "-inserted_at"]
-            }
-          },
-          {
-            "name": "search",
+            "name": "filter",
             "required": false,
             "in": "query",
-            "description": "Case-insensitive substring match on the project name.",
             "schema": {
-              "minLength": 1,
-              "type": "string"
-            }
+              "properties": {
+                "project_ref": {
+                  "type": "string",
+                  "minLength": 20,
+                  "maxLength": 20,
+                  "pattern": "^[a-z]+$",
+                  "description": "Project ref",
+                  "example": "abcdefghijklmnopqrst"
+                }
+              },
+              "type": "object"
+            },
+            "style": "deepObject"
           }
         ],
         "responses": {
@@ -14402,7 +14898,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/V2ListProjectsResponse_Output"
+                  "$ref": "#/components/schemas/V2ListGitHubConnectionsResponse_Output"
                 }
               }
             }
@@ -14443,7 +14939,7 @@
             "bearer": []
           }
         ],
-        "summary": "List projects of an organization",
+        "summary": "List GitHub connections of an organization",
         "tags": ["Organizations"],
         "x-badges": [
           {
@@ -14451,15 +14947,15 @@
             "position": "after"
           }
         ],
-        "x-endpoint-owners": ["control-plane"],
+        "x-endpoint-owners": ["control-plane", "dev-workflows"],
         "x-fga-permissions": [["organization_projects_read"]],
         "x-oauth-scope": "projects:read"
       }
     },
-    "/v2/organizations/{slug}/integrations/github/connections": {
+    "/v2/organizations/{slug}/maintenance/windows": {
       "get": {
-        "description": "Returns a cursor-paginated list of the GitHub connections of the organization's projects.\n\nUse `page[after]` and `page[before]` to navigate pages and `page[size]` to control the page size.\nPaging walks the organization projects, so a page holds at most `page[size]` connections and can hold fewer (or none) when some of its projects are not connected.\nFollow `links.next` until it is `null` rather than stopping on a short page.\n\nUse `filter[project_ref]` to narrow the list down to a single project.",
-        "operationId": "v2-list-organization-github-connections",
+        "description": "Returns the weekly maintenance window for each region, with the open occurrence and the next five.",
+        "operationId": "v2-list-organization-maintenance-windows",
         "parameters": [
           {
             "name": "slug",
@@ -14471,57 +14967,6 @@
               "example": "tsrqponmlkjihgfedcba",
               "type": "string"
             }
-          },
-          {
-            "name": "page",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "properties": {
-                "size": {
-                  "type": "integer",
-                  "minimum": 1,
-                  "maximum": 100
-                },
-                "after": {
-                  "type": "string",
-                  "minLength": 20,
-                  "maxLength": 20,
-                  "pattern": "^[a-z]+$",
-                  "description": "Project ref",
-                  "example": "abcdefghijklmnopqrst"
-                },
-                "before": {
-                  "type": "string",
-                  "minLength": 20,
-                  "maxLength": 20,
-                  "pattern": "^[a-z]+$",
-                  "description": "Project ref",
-                  "example": "abcdefghijklmnopqrst"
-                }
-              },
-              "type": "object"
-            },
-            "style": "deepObject"
-          },
-          {
-            "name": "filter",
-            "required": false,
-            "in": "query",
-            "schema": {
-              "properties": {
-                "project_ref": {
-                  "type": "string",
-                  "minLength": 20,
-                  "maxLength": 20,
-                  "pattern": "^[a-z]+$",
-                  "description": "Project ref",
-                  "example": "abcdefghijklmnopqrst"
-                }
-              },
-              "type": "object"
-            },
-            "style": "deepObject"
           }
         ],
         "responses": {
@@ -14530,7 +14975,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/V2ListGitHubConnectionsResponse_Output"
+                  "$ref": "#/components/schemas/V2ListMaintenanceWindowsResponse_Output"
                 }
               }
             }
@@ -14555,6 +15000,16 @@
               }
             }
           },
+          "404": {
+            "description": "Organization not found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponseBody"
+                }
+              }
+            }
+          },
           "429": {
             "description": "Rate limit exceeded",
             "content": {
@@ -14571,17 +15026,18 @@
             "bearer": []
           }
         ],
-        "summary": "List GitHub connections of an organization",
+        "summary": "List maintenance windows of an organization",
         "tags": ["Organizations"],
         "x-badges": [
           {
-            "name": "OAuth scope: projects:read",
+            "name": "OAuth scope: organizations:read",
             "position": "after"
           }
         ],
-        "x-endpoint-owners": ["control-plane", "dev-workflows"],
-        "x-fga-permissions": [["organization_projects_read"]],
-        "x-oauth-scope": "projects:read"
+        "x-endpoint-owners": ["infra"],
+        "x-fga-permissions": [["organization_admin_read"]],
+        "x-internal": true,
+        "x-oauth-scope": "organizations:read"
       }
     },
     "/v2/projects/{ref}/webhooks/endpoints": {
@@ -14698,6 +15154,7 @@
                                         "v1.project.branch.created",
                                         "v1.project.branch.updated",
                                         "v1.project.branch.removed",
+                                        "v1.project.secrets.leaked",
                                         "v1.organization.member.invitation.created",
                                         "v1.organization.member.invitation.canceled",
                                         "v1.organization.member.added",
@@ -14707,6 +15164,7 @@
                                         "v1.organization.member.role.updated",
                                         "v1.organization.billing.plan.upgraded",
                                         "v1.organization.billing.plan.downgraded",
+                                        "v1.organization.secrets.leaked",
                                         "*"
                                       ],
                                       "description": "Webhook event type."
@@ -15473,6 +15931,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -15482,6 +15941,7 @@
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
                                       "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked",
                                       "*"
                                     ],
                                     "description": "Webhook event type."
@@ -16162,6 +16622,7 @@
                                     "v1.project.branch.created",
                                     "v1.project.branch.updated",
                                     "v1.project.branch.removed",
+                                    "v1.project.secrets.leaked",
                                     "v1.organization.member.invitation.created",
                                     "v1.organization.member.invitation.canceled",
                                     "v1.organization.member.added",
@@ -16171,6 +16632,7 @@
                                     "v1.organization.member.role.updated",
                                     "v1.organization.billing.plan.upgraded",
                                     "v1.organization.billing.plan.downgraded",
+                                    "v1.organization.secrets.leaked",
                                     "*"
                                   ],
                                   "description": "Webhook event type."
@@ -16311,6 +16773,7 @@
                                         "v1.project.branch.created",
                                         "v1.project.branch.updated",
                                         "v1.project.branch.removed",
+                                        "v1.project.secrets.leaked",
                                         "v1.organization.member.invitation.created",
                                         "v1.organization.member.invitation.canceled",
                                         "v1.organization.member.added",
@@ -16320,6 +16783,7 @@
                                         "v1.organization.member.role.updated",
                                         "v1.organization.billing.plan.upgraded",
                                         "v1.organization.billing.plan.downgraded",
+                                        "v1.organization.secrets.leaked",
                                         "*"
                                       ],
                                       "description": "Webhook event type."
@@ -17045,6 +17509,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -17054,6 +17519,7 @@
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
                                       "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked",
                                       "*"
                                     ],
                                     "description": "Webhook event type."
@@ -17871,6 +18337,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -17880,6 +18347,7 @@
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
                                       "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked",
                                       "*"
                                     ],
                                     "description": "Webhook event type."
@@ -18654,6 +19122,7 @@
                                     "v1.project.branch.created",
                                     "v1.project.branch.updated",
                                     "v1.project.branch.removed",
+                                    "v1.project.secrets.leaked",
                                     "v1.organization.member.invitation.created",
                                     "v1.organization.member.invitation.canceled",
                                     "v1.organization.member.added",
@@ -18663,6 +19132,7 @@
                                     "v1.organization.member.role.updated",
                                     "v1.organization.billing.plan.upgraded",
                                     "v1.organization.billing.plan.downgraded",
+                                    "v1.organization.secrets.leaked",
                                     "*"
                                   ],
                                   "description": "Webhook event type."
@@ -18811,6 +19281,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -18820,6 +19291,7 @@
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
                                       "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked",
                                       "*"
                                     ],
                                     "description": "Webhook event type."
@@ -19724,6 +20196,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -19732,7 +20205,8 @@
                                       "v1.organization.member.role.removed",
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
-                                      "v1.organization.billing.plan.downgraded"
+                                      "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked"
                                     ],
                                     "description": "Webhook event type."
                                   },
@@ -21429,6 +21903,7 @@
                               "v1.project.branch.created",
                               "v1.project.branch.updated",
                               "v1.project.branch.removed",
+                              "v1.project.secrets.leaked",
                               "v1.organization.member.invitation.created",
                               "v1.organization.member.invitation.canceled",
                               "v1.organization.member.added",
@@ -21437,7 +21912,8 @@
                               "v1.organization.member.role.removed",
                               "v1.organization.member.role.updated",
                               "v1.organization.billing.plan.upgraded",
-                              "v1.organization.billing.plan.downgraded"
+                              "v1.organization.billing.plan.downgraded",
+                              "v1.organization.secrets.leaked"
                             ],
                             "description": "Webhook event type."
                           }
@@ -21610,6 +22086,7 @@
                                     "v1.project.branch.created",
                                     "v1.project.branch.updated",
                                     "v1.project.branch.removed",
+                                    "v1.project.secrets.leaked",
                                     "v1.organization.member.invitation.created",
                                     "v1.organization.member.invitation.canceled",
                                     "v1.organization.member.added",
@@ -21618,7 +22095,8 @@
                                     "v1.organization.member.role.removed",
                                     "v1.organization.member.role.updated",
                                     "v1.organization.billing.plan.upgraded",
-                                    "v1.organization.billing.plan.downgraded"
+                                    "v1.organization.billing.plan.downgraded",
+                                    "v1.organization.secrets.leaked"
                                   ],
                                   "description": "Webhook event type."
                                 },
@@ -23164,6 +23642,7 @@
                                         "v1.project.branch.created",
                                         "v1.project.branch.updated",
                                         "v1.project.branch.removed",
+                                        "v1.project.secrets.leaked",
                                         "v1.organization.member.invitation.created",
                                         "v1.organization.member.invitation.canceled",
                                         "v1.organization.member.added",
@@ -23173,6 +23652,7 @@
                                         "v1.organization.member.role.updated",
                                         "v1.organization.billing.plan.upgraded",
                                         "v1.organization.billing.plan.downgraded",
+                                        "v1.organization.secrets.leaked",
                                         "*"
                                       ],
                                       "description": "Webhook event type."
@@ -23937,6 +24417,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -23946,6 +24427,7 @@
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
                                       "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked",
                                       "*"
                                     ],
                                     "description": "Webhook event type."
@@ -24626,6 +25108,7 @@
                                     "v1.project.branch.created",
                                     "v1.project.branch.updated",
                                     "v1.project.branch.removed",
+                                    "v1.project.secrets.leaked",
                                     "v1.organization.member.invitation.created",
                                     "v1.organization.member.invitation.canceled",
                                     "v1.organization.member.added",
@@ -24635,6 +25118,7 @@
                                     "v1.organization.member.role.updated",
                                     "v1.organization.billing.plan.upgraded",
                                     "v1.organization.billing.plan.downgraded",
+                                    "v1.organization.secrets.leaked",
                                     "*"
                                   ],
                                   "description": "Webhook event type."
@@ -24773,6 +25257,7 @@
                                         "v1.project.branch.created",
                                         "v1.project.branch.updated",
                                         "v1.project.branch.removed",
+                                        "v1.project.secrets.leaked",
                                         "v1.organization.member.invitation.created",
                                         "v1.organization.member.invitation.canceled",
                                         "v1.organization.member.added",
@@ -24782,6 +25267,7 @@
                                         "v1.organization.member.role.updated",
                                         "v1.organization.billing.plan.upgraded",
                                         "v1.organization.billing.plan.downgraded",
+                                        "v1.organization.secrets.leaked",
                                         "*"
                                       ],
                                       "description": "Webhook event type."
@@ -25505,6 +25991,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -25514,6 +26001,7 @@
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
                                       "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked",
                                       "*"
                                     ],
                                     "description": "Webhook event type."
@@ -26329,6 +26817,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -26338,6 +26827,7 @@
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
                                       "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked",
                                       "*"
                                     ],
                                     "description": "Webhook event type."
@@ -27112,6 +27602,7 @@
                                     "v1.project.branch.created",
                                     "v1.project.branch.updated",
                                     "v1.project.branch.removed",
+                                    "v1.project.secrets.leaked",
                                     "v1.organization.member.invitation.created",
                                     "v1.organization.member.invitation.canceled",
                                     "v1.organization.member.added",
@@ -27121,6 +27612,7 @@
                                     "v1.organization.member.role.updated",
                                     "v1.organization.billing.plan.upgraded",
                                     "v1.organization.billing.plan.downgraded",
+                                    "v1.organization.secrets.leaked",
                                     "*"
                                   ],
                                   "description": "Webhook event type."
@@ -27267,6 +27759,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -27276,6 +27769,7 @@
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
                                       "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked",
                                       "*"
                                     ],
                                     "description": "Webhook event type."
@@ -28178,6 +28672,7 @@
                                       "v1.project.branch.created",
                                       "v1.project.branch.updated",
                                       "v1.project.branch.removed",
+                                      "v1.project.secrets.leaked",
                                       "v1.organization.member.invitation.created",
                                       "v1.organization.member.invitation.canceled",
                                       "v1.organization.member.added",
@@ -28186,7 +28681,8 @@
                                       "v1.organization.member.role.removed",
                                       "v1.organization.member.role.updated",
                                       "v1.organization.billing.plan.upgraded",
-                                      "v1.organization.billing.plan.downgraded"
+                                      "v1.organization.billing.plan.downgraded",
+                                      "v1.organization.secrets.leaked"
                                     ],
                                     "description": "Webhook event type."
                                   },
@@ -29881,6 +30377,7 @@
                               "v1.project.branch.created",
                               "v1.project.branch.updated",
                               "v1.project.branch.removed",
+                              "v1.project.secrets.leaked",
                               "v1.organization.member.invitation.created",
                               "v1.organization.member.invitation.canceled",
                               "v1.organization.member.added",
@@ -29889,7 +30386,8 @@
                               "v1.organization.member.role.removed",
                               "v1.organization.member.role.updated",
                               "v1.organization.billing.plan.upgraded",
-                              "v1.organization.billing.plan.downgraded"
+                              "v1.organization.billing.plan.downgraded",
+                              "v1.organization.secrets.leaked"
                             ],
                             "description": "Webhook event type."
                           }
@@ -30060,6 +30558,7 @@
                                     "v1.project.branch.created",
                                     "v1.project.branch.updated",
                                     "v1.project.branch.removed",
+                                    "v1.project.secrets.leaked",
                                     "v1.organization.member.invitation.created",
                                     "v1.organization.member.invitation.canceled",
                                     "v1.organization.member.added",
@@ -30068,7 +30567,8 @@
                                     "v1.organization.member.role.removed",
                                     "v1.organization.member.role.updated",
                                     "v1.organization.billing.plan.upgraded",
-                                    "v1.organization.billing.plan.downgraded"
+                                    "v1.organization.billing.plan.downgraded",
+                                    "v1.organization.secrets.leaked"
                                   ],
                                   "description": "Webhook event type."
                                 },
@@ -31535,7 +32035,8 @@
               "RESTORE_FAILED",
               "RESTARTING",
               "PAUSE_FAILED",
-              "RESIZING"
+              "RESIZING",
+              "PROMOTING"
             ]
           },
           "db_host": {
@@ -31706,7 +32207,8 @@
               "RESTORE_FAILED",
               "RESTARTING",
               "PAUSE_FAILED",
-              "RESIZING"
+              "RESIZING",
+              "PROMOTING"
             ]
           }
         },
@@ -31823,7 +32325,8 @@
               "RESTORE_FAILED",
               "RESTARTING",
               "PAUSE_FAILED",
-              "RESIZING"
+              "RESIZING",
+              "PROMOTING"
             ]
           },
           "database": {
@@ -32084,7 +32587,8 @@
               "RESTORE_FAILED",
               "RESTARTING",
               "PAUSE_FAILED",
-              "RESIZING"
+              "RESIZING",
+              "PROMOTING"
             ]
           }
         },
@@ -32355,9 +32859,22 @@
           "token_type": {
             "type": "string",
             "enum": ["Bearer"]
+          },
+          "scope": {
+            "description": "Space-delimited scopes granted to the token. Omitted when no scopes were granted.",
+            "example": "projects:read projects:write",
+            "type": "string"
+          },
+          "project_refs": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Project refs the token is limited to. `null` means all projects.",
+            "nullable": true
           }
         },
-        "required": ["access_token", "expires_in", "token_type"]
+        "required": ["access_token", "expires_in", "token_type", "project_refs"]
       },
       "OAuthRevokeTokenBody": {
         "type": "object",
@@ -33265,6 +33782,34 @@
               "dbAllowedCidrsV6": ["2001:db8::/32"]
             }
           },
+          "pending_config": {
+            "description": "Present when a change that was never applied is waiting for review. `config` is the list the project enforces. Apply or reject the change with `POST /v1/projects/{ref}/network-restrictions/review`; submitting a new config also replaces it.",
+            "type": "object",
+            "properties": {
+              "dbAllowedCidrs": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "dbAllowedCidrsV6": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            },
+            "example": {
+              "dbAllowedCidrs": ["203.0.113.0/24"],
+              "dbAllowedCidrsV6": ["2001:db8::/32"]
+            }
+          },
+          "pending_requested_at": {
+            "description": "When the change in `pending_config` was requested. Send it as `requested_at` to the review endpoint.",
+            "type": "string",
+            "format": "date-time",
+            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+          },
           "status": {
             "type": "string",
             "enum": ["stored", "applied"]
@@ -33418,6 +33963,27 @@
         },
         "required": ["entitlement", "config", "status"]
       },
+      "NetworkRestrictionsReviewRequest": {
+        "type": "object",
+        "properties": {
+          "action": {
+            "type": "string",
+            "enum": ["apply", "reject"],
+            "description": "`apply` replaces the enforced list with the pending one and applies it. `reject` discards the pending one and keeps the enforced list."
+          },
+          "requested_at": {
+            "type": "string",
+            "format": "date-time",
+            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+            "description": "The `pending_requested_at` of the change being reviewed. Only that change is resolved: if another one has replaced it, the request gets a 409."
+          }
+        },
+        "required": ["action", "requested_at"],
+        "example": {
+          "action": "apply",
+          "requested_at": "2026-10-21T20:31:51.116+00:00"
+        }
+      },
       "PgsodiumConfigResponse_Output": {
         "type": "object",
         "properties": {
@@ -33472,6 +34038,20 @@
             "description": "If `null`, the value is automatically configured to 10.",
             "nullable": true
           },
+          "db_pool_max_lifetime": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 3600,
+            "description": "If `null`, the value is automatically configured to 1800.",
+            "nullable": true
+          },
+          "db_pool_max_idletime": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 60,
+            "description": "If `null`, the value is automatically configured to 30.",
+            "nullable": true
+          },
           "jwt_secret": {
             "type": "string"
           }
@@ -33481,7 +34061,9 @@
           "max_rows",
           "db_extra_search_path",
           "db_pool",
-          "db_pool_acquisition_timeout"
+          "db_pool_acquisition_timeout",
+          "db_pool_max_lifetime",
+          "db_pool_max_idletime"
         ]
       },
       "V1UpdatePostgrestConfigBody": {
@@ -33507,6 +34089,16 @@
             "type": "integer",
             "minimum": 0,
             "maximum": 60
+          },
+          "db_pool_max_lifetime": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 3600
+          },
+          "db_pool_max_idletime": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 60
           }
         },
         "example": {
@@ -33542,6 +34134,20 @@
             "maximum": 9007199254740991,
             "description": "If `null`, the value is automatically configured to 10.",
             "nullable": true
+          },
+          "db_pool_max_lifetime": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 3600,
+            "description": "If `null`, the value is automatically configured to 1800.",
+            "nullable": true
+          },
+          "db_pool_max_idletime": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 60,
+            "description": "If `null`, the value is automatically configured to 30.",
+            "nullable": true
           }
         },
         "required": [
@@ -33549,7 +34155,9 @@
           "max_rows",
           "db_extra_search_path",
           "db_pool",
-          "db_pool_acquisition_timeout"
+          "db_pool_acquisition_timeout",
+          "db_pool_max_lifetime",
+          "db_pool_max_idletime"
         ]
       },
       "V1ProjectRefResponse_Output": {
@@ -33999,6 +34607,28 @@
                   },
                   "required": ["type", "slot_name"]
                 },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "enum": ["table_using_reg_type"]
+                    },
+                    "schema_name": {
+                      "type": "string"
+                    },
+                    "table_name": {
+                      "type": "string"
+                    },
+                    "column_name": {
+                      "type": "string"
+                    },
+                    "type_name": {
+                      "type": "string"
+                    }
+                  },
+                  "required": ["type", "schema_name", "table_name", "column_name", "type_name"]
+                },
                 {
                   "type": "object",
                   "properties": {
@@ -34065,6 +34695,16 @@
                     }
                   },
                   "required": ["type"]
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "enum": ["collation_reindex_required"]
+                    }
+                  },
+                  "required": ["type"]
                 }
               ]
             }
@@ -37322,6 +37962,9 @@
                     "log_auth_error_rate_high",
                     "log_storage_error_rate_high",
                     "log_edge_function_error_rate_high",
+                    "realtime_authorization_timeouts",
+                    "realtime_postgres_changes_spike",
+                    "realtime_concurrent_users_near_limit",
                     "project_not_active",
                     "advisor_check_unavailable"
                   ]
@@ -38756,7 +39399,7 @@
         "type": "object",
         "properties": {}
       },
-      "V1UpdateFunctionBody": {
+      "V1UpdateFunctionBodyJson": {
         "type": "object",
         "properties": {
           "name": {
@@ -38775,6 +39418,13 @@
           "verify_jwt": true
         }
       },
+      "V1UpdateFunctionBodyEszip": {
+        "type": "string",
+        "format": "binary",
+        "contentEncoding": "binary",
+        "description": "Raw Brotli-compressed ESZIP binary file.\n\n**Validation requirements** - The file must start with the four magic bytes `EZBR` (hex: `45 5A 42 52`).\n- The `ezbr_sha256` query parameter must contain the SHA-256 hash of the uploaded ESZIP payload.\n\n**Example**\n```javascript\nimport { readFile } from 'node:fs/promises';\nimport { brotliCompress } from 'node:zlib';\nimport { promisify } from 'node:util';\nimport { createHash } from 'node:crypto';\n\nconst compress = promisify(brotliCompress);\nconst marker = Buffer.from('EZBR', 'ascii');\n\nconst file = await readFile('./function.eszip');\nconst compressed = await compress(file);\n\nconst payload = Buffer.concat([marker, compressed]);\n\nconst ezbr_sha256 = createHash('sha256')\n  .update(payload)\n  .digest('hex');\n\nconsole.log(ezbr_sha256);\n```\n\n",
+        "examples": ["Binary Brotli-compressed ESZIP file"]
+      },
       "V1StorageBucketResponse_Output": {
         "type": "object",
         "properties": {
@@ -41074,7 +41724,8 @@
                     "RESTORE_FAILED",
                     "RESTARTING",
                     "PAUSE_FAILED",
-                    "RESIZING"
+                    "RESIZING",
+                    "PROMOTING"
                   ]
                 },
                 "inserted_at": {
@@ -41443,6 +42094,7 @@
               "unauthorized",
               "validation_failed",
               "agentic_credential_not_found",
+              "backup_unsupported",
               "branch_admin_required",
               "compute_build_context_too_large",
               "compute_build_in_progress",
@@ -42295,7 +42947,7 @@
                 "properties": {
                   "lints": {
                     "minItems": 1,
-                    "maxItems": 10,
+                    "maxItems": 15,
                     "type": "array",
                     "items": {
                       "type": "object",
@@ -42342,7 +42994,10 @@
                             "log_data_api_error_rate_high",
                             "log_auth_error_rate_high",
                             "log_storage_error_rate_high",
-                            "log_edge_function_error_rate_high"
+                            "log_edge_function_error_rate_high",
+                            "realtime_authorization_timeouts",
+                            "realtime_postgres_changes_spike",
+                            "realtime_concurrent_users_near_limit"
                           ]
                         }
                       },
@@ -42423,6 +43078,9 @@
                             "log_auth_error_rate_high",
                             "log_storage_error_rate_high",
                             "log_edge_function_error_rate_high",
+                            "realtime_authorization_timeouts",
+                            "realtime_postgres_changes_spike",
+                            "realtime_concurrent_users_near_limit",
                             "project_not_active",
                             "advisor_check_unavailable"
                           ]
@@ -42524,6 +43182,55 @@
         },
         "required": ["data"]
       },
+      "DownloadBackupBody": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "description": "Resource type.",
+                "enum": ["project_backup_file_url"]
+              },
+              "id": {
+                "type": "number"
+              }
+            },
+            "required": ["type", "id"]
+          }
+        },
+        "required": ["data"]
+      },
+      "DownloadBackupResponse_Output": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "description": "Resource type.",
+                "enum": ["project_backup_file_url"]
+              },
+              "id": {
+                "type": "number"
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "file_url": {
+                    "type": "string"
+                  }
+                },
+                "required": ["file_url"]
+              }
+            },
+            "required": ["type", "id", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
       "V2CreateBranchRequest": {
         "type": "object",
         "properties": {
@@ -42748,6 +43455,27 @@
                               "required": ["address", "type"]
                             }
                           },
+                          "pending_allowed_cidrs": {
+                            "description": "Present when a change that was never applied is waiting for review. `allowed_cidrs` is the list the project enforces. Apply or reject the change with `POST /v1/projects/{ref}/network-restrictions/review`; submitting a new config also replaces it.",
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "address": {
+                                  "type": "string"
+                                },
+                                "type": {
+                                  "type": "string",
+                                  "enum": ["v4", "v6"]
+                                }
+                              },
+                              "required": ["address", "type"]
+                            }
+                          },
+                          "pending_requested_at": {
+                            "description": "When the change in `pending_allowed_cidrs` was requested.",
+                            "type": "string"
+                          },
                           "updated_at": {
                             "type": "string"
                           },
@@ -43013,6 +43741,16 @@
                         "minimum": -9007199254740991,
                         "maximum": 9007199254740991
                       },
+                      "db_pool_max_lifetime": {
+                        "type": "integer",
+                        "minimum": 0,
+                        "maximum": 3600
+                      },
+                      "db_pool_max_idletime": {
+                        "type": "integer",
+                        "minimum": 0,
+                        "maximum": 60
+                      },
                       "db_pool": {
                         "type": "integer",
                         "minimum": -9007199254740991,
@@ -43026,6 +43764,8 @@
                       "db_extra_search_path",
                       "max_rows",
                       "db_pool_acquisition_timeout",
+                      "db_pool_max_lifetime",
+                      "db_pool_max_idletime",
                       "db_pool"
                     ]
                   },
@@ -44523,22 +45263,39 @@
                       "type": "object",
                       "properties": {
                         "runtime": {
-                          "example": "node",
                           "type": "string"
                         },
                         "size": {
-                          "type": "string",
-                          "example": "2gb-1vcpu"
+                          "type": "string"
                         },
                         "exposure": {
-                          "type": "string",
-                          "example": "public"
+                          "type": "string"
                         },
                         "instances": {
                           "type": "integer",
                           "minimum": -9007199254740991,
-                          "maximum": 9007199254740991,
-                          "example": 1
+                          "maximum": 9007199254740991
+                        },
+                        "secrets_scope": {
+                          "anyOf": [
+                            {
+                              "type": "string",
+                              "enum": ["all", "supabase", "none"]
+                            },
+                            {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "secret_name": {
+                                    "type": "string"
+                                  }
+                                },
+                                "required": ["secret_name"]
+                              }
+                            }
+                          ],
+                          "nullable": true
                         }
                       },
                       "required": ["size", "exposure", "instances"]
@@ -44621,22 +45378,39 @@
                     "type": "object",
                     "properties": {
                       "runtime": {
-                        "example": "node",
                         "type": "string"
                       },
                       "size": {
-                        "type": "string",
-                        "example": "2gb-1vcpu"
+                        "type": "string"
                       },
                       "exposure": {
-                        "type": "string",
-                        "example": "public"
+                        "type": "string"
                       },
                       "instances": {
                         "type": "integer",
                         "minimum": -9007199254740991,
-                        "maximum": 9007199254740991,
-                        "example": 1
+                        "maximum": 9007199254740991
+                      },
+                      "secrets_scope": {
+                        "anyOf": [
+                          {
+                            "type": "string",
+                            "enum": ["all", "supabase", "none"]
+                          },
+                          {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "secret_name": {
+                                  "type": "string"
+                                }
+                              },
+                              "required": ["secret_name"]
+                            }
+                          }
+                        ],
+                        "nullable": true
                       }
                     },
                     "required": ["size", "exposure", "instances"]
@@ -44769,237 +45543,45 @@
                         "minimum": -9007199254740991,
                         "maximum": 9007199254740991,
                         "example": 1
-                      }
-                    },
-                    "required": ["size", "exposure", "instances"]
-                  },
-                  "context_upload_id": {
-                    "description": "Id of a build context staged through the uploads endpoint. Required unless `runtime` is set.",
-                    "type": "string"
-                  }
-                },
-                "required": ["spec"]
-              }
-            },
-            "required": ["type", "attributes"]
-          }
-        },
-        "required": ["data"]
-      },
-      "V2ListMembersResponse_Output": {
-        "type": "object",
-        "properties": {
-          "data": {
-            "type": "array",
-            "items": {
-              "type": "object",
-              "properties": {
-                "type": {
-                  "type": "string",
-                  "description": "Resource type.",
-                  "enum": ["organization_member"]
-                },
-                "id": {
-                  "type": "string",
-                  "format": "uuid",
-                  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$"
-                },
-                "attributes": {
-                  "type": "object",
-                  "properties": {
-                    "username": {
-                      "type": "string",
-                      "description": "Member's username",
-                      "nullable": true
-                    },
-                    "primary_email": {
-                      "type": "string",
-                      "description": "Member's primary email",
-                      "nullable": true
-                    },
-                    "mfa_enabled": {
-                      "type": "boolean",
-                      "description": "Whether Multi-Factor Authentication is enabled for this member"
-                    },
-                    "is_sso_user": {
-                      "type": "boolean",
-                      "description": "Whether this member is a Single Sign-On user"
-                    },
-                    "avatar_url": {
-                      "type": "string",
-                      "description": "Member's avatar URL",
-                      "nullable": true
-                    },
-                    "roles": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "properties": {
-                          "name": {
+                      },
+                      "secrets_scope": {
+                        "anyOf": [
+                          {
                             "type": "string",
-                            "description": "Role name. For project-scoped roles this is the base role name.",
-                            "example": "developer"
+                            "enum": ["all", "supabase", "none"]
                           },
-                          "scope": {
-                            "type": "string",
-                            "enum": ["organization", "project"],
-                            "description": "Whether this role applies org-wide or is scoped to specific projects for the user."
-                          },
-                          "projects": {
+                          {
                             "type": "array",
                             "items": {
                               "type": "object",
                               "properties": {
-                                "ref": {
-                                  "type": "string"
-                                },
-                                "name": {
+                                "secret_name": {
                                   "type": "string"
                                 }
                               },
-                              "required": ["ref", "name"]
+                              "required": ["secret_name"]
                             },
-                            "description": "Project refs this role is scoped to. Empty array for org-level roles."
+                            "examples": [
+                              {
+                                "secret_name": "STRIPE_KEY"
+                              },
+                              {
+                                "secret_name": "AGENT_SECRET"
+                              }
+                            ]
                           }
-                        },
-                        "required": ["name", "scope", "projects"]
-                      },
-                      "description": "Roles assigned to this member. Includes both org-level and project-scoped roles."
-                    }
-                  },
-                  "required": [
-                    "username",
-                    "primary_email",
-                    "mfa_enabled",
-                    "is_sso_user",
-                    "avatar_url",
-                    "roles"
-                  ]
-                }
-              },
-              "required": ["type", "id", "attributes"]
-            }
-          },
-          "links": {
-            "type": "object",
-            "properties": {
-              "first": {
-                "type": "string",
-                "description": "URL path to the first page if available.",
-                "example": "/v2/organizations/my-org/members?page[size]=10",
-                "nullable": true
-              },
-              "prev": {
-                "type": "string",
-                "description": "URL path to the previous page.",
-                "example": "/v2/organizations/my-org/members?page[size]=10&page[before]=019adf7d-4513-74c5-bb9a-f1bc0f7a95d7",
-                "nullable": true
-              },
-              "next": {
-                "type": "string",
-                "description": "URL path to the next page.",
-                "example": "/v2/organizations/my-org/members?page[size]=10&page[after]=019adf7d-4513-7062-b292-78b86cc470a4",
-                "nullable": true
-              },
-              "last": {
-                "type": "string",
-                "description": "URL path to the last page if available.",
-                "example": "/v2/organizations/my-org/members?page[size]=10&page[after]=019adf7d-4513-71ba-b264-21900edb4295",
-                "nullable": true
-              }
-            },
-            "required": ["prev", "next"]
-          }
-        },
-        "required": ["data", "links"]
-      },
-      "V2AssignOrganizationMemberRoleRequest": {
-        "type": "object",
-        "properties": {
-          "data": {
-            "type": "object",
-            "properties": {
-              "type": {
-                "type": "string",
-                "description": "Resource type.",
-                "enum": ["organization_member_role"]
-              },
-              "attributes": {
-                "type": "object",
-                "properties": {
-                  "role": {
-                    "type": "string",
-                    "enum": ["owner", "administrator", "developer", "read-only", "no-access"],
-                    "description": "Role name to assign. Must be one of: owner, administrator, developer, read-only. Must be on a Team or Enterprise plan to use the read-only role.",
-                    "example": "developer"
-                  },
-                  "projects": {
-                    "description": "The projects to assign a project-scoped role for. If omitted, assigns an org-wide role.",
-                    "minItems": 1,
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "ref": {
-                          "type": "string",
-                          "description": "Project ref",
-                          "example": "abcjuqabhgwjjutfvtpa"
-                        }
-                      },
-                      "required": ["ref"]
-                    }
-                  }
-                },
-                "required": ["role"]
-              }
-            },
-            "required": ["type", "attributes"]
-          }
-        },
-        "required": ["data"]
-      },
-      "OrganizationMemberRoleResponse_Output": {
-        "type": "object",
-        "properties": {
-          "data": {
-            "type": "object",
-            "properties": {
-              "type": {
-                "type": "string",
-                "description": "Resource type.",
-                "enum": ["organization_member_role"]
-              },
-              "attributes": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string",
-                    "description": "Role name. For project-scoped assignments this is the base role name.",
-                    "example": "developer"
-                  },
-                  "scope": {
-                    "type": "string",
-                    "enum": ["organization", "project"],
-                    "description": "Whether this role applies org-wide or is scoped to specific projects for the user."
-                  },
-                  "projects": {
-                    "type": "array",
-                    "items": {
-                      "type": "object",
-                      "properties": {
-                        "ref": {
-                          "type": "string"
-                        },
-                        "name": {
-                          "type": "string"
-                        }
-                      },
-                      "required": ["ref", "name"]
+                        ],
+                        "nullable": true
+                      }
                     },
-                    "description": "Project refs this role is scoped to. Empty array for org-level roles."
+                    "required": ["size", "exposure", "instances"]
+                  },
+                  "context_upload_id": {
+                    "description": "Id of a build context staged through the uploads endpoint. Required unless `runtime` is set.",
+                    "type": "string"
                   }
                 },
-                "required": ["name", "scope", "projects"]
+                "required": ["spec"]
               }
             },
             "required": ["type", "attributes"]
@@ -45126,6 +45708,7 @@
                   "unauthorized",
                   "validation_failed",
                   "agentic_credential_not_found",
+                  "backup_unsupported",
                   "branch_admin_required",
                   "compute_build_context_too_large",
                   "compute_build_in_progress",
@@ -45358,6 +45941,227 @@
         },
         "required": ["data"]
       },
+      "V2ListMembersResponse_Output": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "description": "Resource type.",
+                  "enum": ["organization_member"]
+                },
+                "id": {
+                  "type": "string",
+                  "format": "uuid",
+                  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$"
+                },
+                "attributes": {
+                  "type": "object",
+                  "properties": {
+                    "username": {
+                      "type": "string",
+                      "description": "Member's username",
+                      "nullable": true
+                    },
+                    "primary_email": {
+                      "type": "string",
+                      "description": "Member's primary email",
+                      "nullable": true
+                    },
+                    "mfa_enabled": {
+                      "type": "boolean",
+                      "description": "Whether Multi-Factor Authentication is enabled for this member"
+                    },
+                    "is_sso_user": {
+                      "type": "boolean",
+                      "description": "Whether this member is a Single Sign-On user"
+                    },
+                    "avatar_url": {
+                      "type": "string",
+                      "description": "Member's avatar URL",
+                      "nullable": true
+                    },
+                    "roles": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "description": "Role name. For project-scoped roles this is the base role name.",
+                            "example": "developer"
+                          },
+                          "scope": {
+                            "type": "string",
+                            "enum": ["organization", "project"],
+                            "description": "Whether this role applies org-wide or is scoped to specific projects for the user."
+                          },
+                          "projects": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "ref": {
+                                  "type": "string"
+                                },
+                                "name": {
+                                  "type": "string"
+                                }
+                              },
+                              "required": ["ref", "name"]
+                            },
+                            "description": "Project refs this role is scoped to. Empty array for org-level roles."
+                          }
+                        },
+                        "required": ["name", "scope", "projects"]
+                      },
+                      "description": "Roles assigned to this member. Includes both org-level and project-scoped roles."
+                    }
+                  },
+                  "required": [
+                    "username",
+                    "primary_email",
+                    "mfa_enabled",
+                    "is_sso_user",
+                    "avatar_url",
+                    "roles"
+                  ]
+                }
+              },
+              "required": ["type", "id", "attributes"]
+            }
+          },
+          "links": {
+            "type": "object",
+            "properties": {
+              "first": {
+                "type": "string",
+                "description": "URL path to the first page if available.",
+                "example": "/v2/organizations/my-org/members?page[size]=10",
+                "nullable": true
+              },
+              "prev": {
+                "type": "string",
+                "description": "URL path to the previous page.",
+                "example": "/v2/organizations/my-org/members?page[size]=10&page[before]=019adf7d-4513-74c5-bb9a-f1bc0f7a95d7",
+                "nullable": true
+              },
+              "next": {
+                "type": "string",
+                "description": "URL path to the next page.",
+                "example": "/v2/organizations/my-org/members?page[size]=10&page[after]=019adf7d-4513-7062-b292-78b86cc470a4",
+                "nullable": true
+              },
+              "last": {
+                "type": "string",
+                "description": "URL path to the last page if available.",
+                "example": "/v2/organizations/my-org/members?page[size]=10&page[after]=019adf7d-4513-71ba-b264-21900edb4295",
+                "nullable": true
+              }
+            },
+            "required": ["prev", "next"]
+          }
+        },
+        "required": ["data", "links"]
+      },
+      "V2AssignOrganizationMemberRoleRequest": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "description": "Resource type.",
+                "enum": ["organization_member_role"]
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "role": {
+                    "type": "string",
+                    "enum": ["owner", "administrator", "developer", "read-only", "no-access"],
+                    "description": "Role name to assign. Must be one of: owner, administrator, developer, read-only. Must be on a Team or Enterprise plan to use the read-only role.",
+                    "example": "developer"
+                  },
+                  "projects": {
+                    "description": "The projects to assign a project-scoped role for. If omitted, assigns an org-wide role.",
+                    "minItems": 1,
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ref": {
+                          "type": "string",
+                          "description": "Project ref",
+                          "example": "abcjuqabhgwjjutfvtpa"
+                        }
+                      },
+                      "required": ["ref"]
+                    }
+                  }
+                },
+                "required": ["role"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "OrganizationMemberRoleResponse_Output": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "description": "Resource type.",
+                "enum": ["organization_member_role"]
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "description": "Role name. For project-scoped assignments this is the base role name.",
+                    "example": "developer"
+                  },
+                  "scope": {
+                    "type": "string",
+                    "enum": ["organization", "project"],
+                    "description": "Whether this role applies org-wide or is scoped to specific projects for the user."
+                  },
+                  "projects": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "ref": {
+                          "type": "string"
+                        },
+                        "name": {
+                          "type": "string"
+                        }
+                      },
+                      "required": ["ref", "name"]
+                    },
+                    "description": "Project refs this role is scoped to. Empty array for org-level roles."
+                  }
+                },
+                "required": ["name", "scope", "projects"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
       "V2ListProjectsResponse_Output": {
         "type": "object",
         "properties": {
@@ -45403,7 +46207,8 @@
                         "RESTORE_FAILED",
                         "RESTARTING",
                         "PAUSE_FAILED",
-                        "RESIZING"
+                        "RESIZING",
+                        "PROMOTING"
                       ],
                       "description": "Project status"
                     },
@@ -45697,6 +46502,101 @@
         },
         "required": ["data", "links"]
       },
+      "V2ListMaintenanceWindowsResponse_Output": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "description": "Resource type.",
+                  "enum": ["maintenance_window"]
+                },
+                "id": {
+                  "type": "string",
+                  "description": "AWS region.",
+                  "example": "us-east-1"
+                },
+                "attributes": {
+                  "type": "object",
+                  "properties": {
+                    "window": {
+                      "type": "object",
+                      "properties": {
+                        "day": {
+                          "type": "string",
+                          "enum": ["mon", "tue", "wed", "thu", "fri", "sat", "sun"],
+                          "description": "UTC day the window starts."
+                        },
+                        "start_utc": {
+                          "type": "string",
+                          "description": "UTC start time.",
+                          "example": "06:00"
+                        },
+                        "duration_minutes": {
+                          "type": "integer",
+                          "minimum": -9007199254740991,
+                          "maximum": 9007199254740991,
+                          "example": 120
+                        }
+                      },
+                      "required": ["day", "start_utc", "duration_minutes"]
+                    },
+                    "current_window": {
+                      "type": "object",
+                      "properties": {
+                        "start_at": {
+                          "type": "string",
+                          "format": "date-time",
+                          "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+                          "description": "Start of the occurrence, inclusive."
+                        },
+                        "end_at": {
+                          "type": "string",
+                          "format": "date-time",
+                          "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+                          "description": "End of the occurrence, exclusive."
+                        }
+                      },
+                      "required": ["start_at", "end_at"],
+                      "description": "The open occurrence, or null when the window is closed.",
+                      "nullable": true
+                    },
+                    "next_windows": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "start_at": {
+                            "type": "string",
+                            "format": "date-time",
+                            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+                            "description": "Start of the occurrence, inclusive."
+                          },
+                          "end_at": {
+                            "type": "string",
+                            "format": "date-time",
+                            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+                            "description": "End of the occurrence, exclusive."
+                          }
+                        },
+                        "required": ["start_at", "end_at"]
+                      },
+                      "description": "The next five occurrences that start after now, in order."
+                    }
+                  },
+                  "required": ["window", "current_window", "next_windows"]
+                }
+              },
+              "required": ["type", "id", "attributes"]
+            }
+          }
+        },
+        "required": ["data"]
+      },
       "APIErrorObject": {
         "type": "object",
         "properties": {
@@ -45717,6 +46617,7 @@
               "unauthorized",
               "validation_failed",
               "agentic_credential_not_found",
+              "backup_unsupported",
               "branch_admin_required",
               "compute_build_context_too_large",
               "compute_build_in_progress",
diff --git a/packages/api/src/generated/permissions.ts b/packages/api/src/generated/permissions.ts
index 42196b9d25..042a61fd1e 100644
--- a/packages/api/src/generated/permissions.ts
+++ b/packages/api/src/generated/permissions.ts
@@ -125,6 +125,10 @@ export const operationPermissions: Readonly<Record<string, OperationPermissions>
     fga: [["database_network_restrictions_write"]],
     oauthScope: "projects:write",
   },
+  "v1-review-network-restrictions": {
+    fga: [["database_network_restrictions_write"]],
+    oauthScope: "projects:write",
+  },
   "v1-get-pgsodium-config": { fga: [["project_admin_write"]], oauthScope: "secrets:read" },
   "v1-update-pgsodium-config": { fga: [["project_admin_write"]], oauthScope: "secrets:write" },
   "v1-get-postgrest-service-config": {
@@ -299,6 +303,7 @@ export const operationPermissions: Readonly<Record<string, OperationPermissions>
   },
   "v1-get-postgres-config": { fga: [["database_config_read"]], oauthScope: "database:read" },
   "v1-update-postgres-config": { fga: [["database_config_write"]], oauthScope: "database:write" },
+  "v1-patch-postgres-config": { fga: [["database_config_write"]], oauthScope: "database:write" },
   "v1-get-realtime-config": { fga: [["realtime_config_read"]] },
   "v1-update-realtime-config": { fga: [["realtime_config_write"]] },
   "v1-shutdown-realtime": { fga: [["realtime_config_write"]] },
@@ -344,6 +349,7 @@ export const operationPermissions: Readonly<Record<string, OperationPermissions>
     oauthScope: "analytics_config:write",
   },
   "v2-run-project-advisors": { fga: [["advisors_read"]] },
+  "v2-download-project-backup": { fga: [["backups_write"]], oauthScope: "database:write" },
   "v2-create-a-branch": {
     fga: [["branching_development_create"], ["branching_production_create"]],
     oauthScope: "environment:write",
@@ -381,8 +387,6 @@ export const operationPermissions: Readonly<Record<string, OperationPermissions>
     oauthScope: "edge_functions:write",
   },
   "v2-deploy-a-compute-instance": { fga: [["workers_write"]], oauthScope: "edge_functions:write" },
-  "v2-list-organization-members": { fga: [["members_read"]], oauthScope: "organizations:read" },
-  "v2-assign-organization-member-role": { fga: [["organization_admin_write"]] },
   "v2-list-organization-roles": { fga: [["members_read"]], oauthScope: "organizations:read" },
   "v2-create-organization-invitations": {
     fga: [["members_write"]],
@@ -392,6 +396,15 @@ export const operationPermissions: Readonly<Record<string, OperationPermissions>
     fga: [["members_write"]],
     oauthScope: "organizations:write",
   },
+  "v2-list-organization-members": { fga: [["members_read"]], oauthScope: "organizations:read" },
+  "v2-assign-organization-member-role": {
+    fga: [["organization_admin_write"]],
+    oauthScope: "organizations:write",
+  },
+  "v2-remove-organization-members": {
+    fga: [["organization_admin_write"]],
+    oauthScope: "organizations:write",
+  },
   "v2-list-organization-projects": {
     fga: [["organization_projects_read"]],
     oauthScope: "projects:read",
@@ -400,6 +413,10 @@ export const operationPermissions: Readonly<Record<string, OperationPermissions>
     fga: [["organization_projects_read"]],
     oauthScope: "projects:read",
   },
+  "v2-list-organization-maintenance-windows": {
+    fga: [["organization_admin_read"]],
+    oauthScope: "organizations:read",
+  },
   "v2-projects-ref-webhooks-endpoints-get": { fga: [] },
   "v2-projects-ref-webhooks-endpoints-post": { fga: [] },
   "v2-projects-ref-webhooks-endpoints-delete": { fga: [] },
diff --git a/packages/api/src/internal/client.unit.test.ts b/packages/api/src/internal/client.unit.test.ts
index 5ce9c56fe1..5846f62040 100644
--- a/packages/api/src/internal/client.unit.test.ts
+++ b/packages/api/src/internal/client.unit.test.ts
@@ -69,6 +69,7 @@ function oauthTokenResponse(
     refresh_token: "refresh-token",
     expires_in: 3600,
     token_type: "Bearer",
+    project_refs: null,
   });
 }
 
@@ -1349,6 +1350,8 @@ describe("makeSupabaseApiClient", () => {
                         db_extra_search_path: "",
                         max_rows: 1000,
                         db_pool_acquisition_timeout: 0,
+                        db_pool_max_lifetime: 0,
+                        db_pool_max_idletime: 0,
                         db_pool: null,
                       },
                       realtime: {
diff --git a/packages/config/AGENTS.md b/packages/config/AGENTS.md
index 79d3f3187f..ae9425aab5 100644
--- a/packages/config/AGENTS.md
+++ b/packages/config/AGENTS.md
@@ -38,7 +38,9 @@ artifacts (`./schema.json`, `./project-schema.json`).
   `InternalResolveCliConfigOptions`, is package-internal and not itself re-exported) — plus the
   otherwise-internal registry data (`AUTH_HOOK_NAMES`, `unmappedSecretApiPaths`,
   `projectConfigMappingRows`, `ProjectConfigMappingRow`, `ProjectConfigApiAttributes`,
-  `ENV_CAPTURE_REGEX`). It also carries `supabase config pull`/`diff`'s own support surface
+  `ENV_CAPTURE_REGEX`, and `withoutSafeIntegerBounds` for the CLI's published lock schema), the
+  JSONC parser (`parseJsonc`, `JsoncSyntaxError`) and `cliConfigFormatForPath`, and `findUnknownCliConfigKeys` (schema-derived unknown-key paths of a raw document). It also carries
+  `supabase config pull`/`diff`'s own support surface
   (CLI-2064): the format-preserving surgical editor (`applyConfigEdits` and its
   `ConfigEdit`/`ConfigEditOutcome`/`ConfigEditRefusal`/`ConfigEditRefusalReason`/`ConfigEditValue`/
   `AppliedConfigEdit` types — the config diff engine itself, `diffProjectConfig` and its
diff --git a/packages/config/docs/cli-config-loading.md b/packages/config/docs/cli-config-loading.md
index f1108fd2f6..01a9f72482 100644
--- a/packages/config/docs/cli-config-loading.md
+++ b/packages/config/docs/cli-config-loading.md
@@ -5,7 +5,7 @@ This document explains how the CLI's on-disk config document loading works, acro
 
 ## Vocabulary
 
-- `CliConfig`: the persisted config-file document (`supabase/config.toml` / `supabase/config.json`)
+- `CliConfig`: the persisted config-file document (`supabase/config.toml`, `supabase/config.json`, or `supabase/config.jsonc`)
   — the full local superset, including local-only sections (`studio`, ports, `edge_runtime`,
   `analytics`, …) plus `[remotes.*]` overrides. Owned by `@supabase/config`.
 - `ProjectConfig`: the hosted-project subset — the sections a hosted project manages (`api`,
@@ -89,13 +89,15 @@ upward until it finds the nearest ancestor containing one of:
 
 - `supabase/config.toml`
 - `supabase/config.json`
+- `supabase/config.jsonc`
 
 The first match wins. A caller that already holds an authoritative, pre-resolved root — for
 example one derived from an explicit `--workdir`/`SUPABASE_WORKDIR` — can pass `{ search: false }`
 to check only that exact directory, with no ancestor climb.
 
-Within one discovered `supabase/` directory, `config.json` takes precedence over `config.toml`
-when both files exist.
+Within one discovered `supabase/` directory, `config.json` or `config.jsonc` takes precedence over
+`config.toml` when both exist. Discovery never fails on a `config.json` + `config.jsonc` pair; loading
+and saving do.
 
 This produces a `CliProjectPaths` (the type is exported from `@supabase/config`):
 
@@ -116,13 +118,13 @@ and env files under `supabase/`.
 
 The project-scoped files are:
 
-- `supabase/config.toml` or `supabase/config.json`
+- `supabase/config.toml`, `supabase/config.json`, or `supabase/config.jsonc`
 - `supabase/.env`
 - `supabase/.env.local`
 
 Their intended roles are:
 
-- `config.toml` or `config.json`: the shared, committed `CliConfig` document
+- `config.toml`, `config.json`, or `config.jsonc`: the shared, committed `CliConfig` document
 - `.env`: managed or shared project env values
 - `.env.local`: user-editable local overrides
 
@@ -138,8 +140,13 @@ defines the full config/env scope for that invocation.
 these rules:
 
 - `loadCliConfig(cwd)` discovers the project, then:
-  - if both `supabase/config.json` and `supabase/config.toml` exist, JSON wins
-  - the returned `LoadedCliConfig.ignoredPaths` reports the shadowed config file path
+  - `config.json` and `config.jsonc` are both parsed as JSONC (comments and trailing commas
+    allowed); parse errors report the line and column
+  - if both `supabase/config.json` and `supabase/config.jsonc` exist, loading fails with
+    `CliConfigFileConflictError` naming both files
+  - if a JSON file and `supabase/config.toml` both exist, JSON wins, and the returned
+    `LoadedCliConfig.ignoredPaths` reports the shadowed `config.toml`; the CLI warns that it is
+    ignored
   - if only one config file exists, that file is loaded
   - if no config file exists in the discovered project, loading returns `null`
 - `loadCliConfigFile(path)` loads one explicit file path directly instead of discovering or
@@ -147,16 +154,24 @@ these rules:
 
 `saveCliConfig()` uses these rules:
 
-- if the discovered project already has `config.json`, save back to JSON
+- if the discovered project already has `config.jsonc`, save back to it; otherwise, if it has
+  `config.json`, save back to that
 - otherwise if it already has `config.toml`, save back to TOML
 - otherwise default new writes to `supabase/config.json`
+- if both `config.json` and `config.jsonc` exist, saving fails with `CliConfigFileConflictError`
 - callers can still force a format explicitly via `SaveCliConfigOptions.format`
-- after writing, it removes the sibling config file in the other format, if one exists, so a
-  project never ends up with both after a save
+- when the target is an existing JSON/JSONC file, the save applies minimal `jsonc-parser` edits towards
+  the regenerated document so comments and key order survive, and falls back to the regenerated text
+  if the edited text does not re-parse to exactly that document; new files and format switches
+  always write the regenerated text
+- a TOML save keeps the existing file's first-line `#:schema <url>` directive
+- after writing, it removes every other config file among `config.json`, `config.jsonc` and
+  `config.toml`, so a project never ends up with more than one after a save
 
 The saved file may also preserve a top-level `"$schema"` key as editor metadata: when a caller
 doesn't pass an explicit `schemaRef`, saving reuses whatever `$schema` the project's existing
-config file already had. That key does not participate in runtime config semantics.
+config file already had. Beyond the schema version it declares (see [Schema version](#schema-version)),
+the key has no runtime meaning.
 
 ## Env Loading and Precedence
 
@@ -186,7 +201,7 @@ The `ambient` source label just means the value came from `process.env`.
 
 ## Raw Config Loading
 
-`CliConfig` is loaded by parsing the TOML/JSON file and decoding it against `CliConfigSchema`.
+`CliConfig` is loaded by parsing the TOML/JSON(C) file and decoding it against `CliConfigSchema`.
 
 Before decoding, most string values matching `env(NAME)` are substituted automatically using the
 resolved `CliProjectEnvironment` — this is required so numeric and boolean fields don't crash the
@@ -374,7 +389,7 @@ one order (ADR 0032):
 1. an explicit flag
 2. shell environment
 3. project `.env*` files
-4. config: `config.json` when present, else `config.toml`, with the matched `[remotes.*]` block
+4. config: `config.json` or `config.jsonc` when present, else `config.toml`, with the matched `[remotes.*]` block
    over the base document
 5. the default
 
@@ -470,8 +485,10 @@ The CLI also rejects a non-empty `SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION` enviro
 
 `@supabase/config/internal` exposes the stages the CLI composes in place of `loadCliConfig`:
 
-1. `parseCliConfigDocumentFile` reads `config.json` or `config.toml` without decoding, and fails
-   with `CliConfigRemovedKeyError` when the document uses a removed key.
+1. `parseCliConfigDocumentFile` reads `config.json`, `config.jsonc` or `config.toml` without decoding, and
+   fails with `CliConfigRemovedKeyError` when the document uses a removed key, or
+   `CliConfigFileConflictError` when both JSON files exist, or `CliConfigSchemaVersionError` when
+   the file declares a newer schema version.
 2. `mergeParsedCliConfig` applies the remote chosen by the `selectRemote` callback.
 3. The CLI overlays flag, env and default values onto the merged document.
 4. `decodeMergedCliConfig` expands `env()` references, then decodes and validates the overlaid
@@ -480,6 +497,44 @@ The CLI also rejects a non-empty `SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION` enviro
 The result is the `materialized` config on the resolved config; `get(key)` also reports the tier a value
 came from.
 
+## Schema version
+
+A config file declares its schema version with `$schema` in `config.json`/`config.jsonc`, or with a
+leading `#:schema <url>` directive in `config.toml` (a top-level `"$schema"` key is the fallback;
+the directive wins). The directive must come before any other content; blank lines and comments
+may precede it, and surrounding spaces or tabs are ignored. A file with no declaration is v1.
+
+- `https://supabase.com/schemas/config/v<N>.json` declares version `N`.
+- The legacy `https://supabase.com/docs/cli/config.schema.json` and paths ending in
+  `node_modules/@supabase/config/schema.json` or `node_modules/@supabase/config/dist/schema.json`
+  read as v1.
+- Any other reference is unrecognized: the file is read as v1 and the CLI warns on stderr, naming
+  the current schema URL.
+- A file declaring a version newer than the package supports fails with
+  `CliConfigSchemaVersionError` and an upgrade message, in `loadCliConfig`, `loadCliConfigFile`,
+  `parseCliConfigDocumentFile` and `saveCliConfig` alike. A save also fails when the `$schema` it
+  would write, explicit or carried over, is newer than the package supports, and checks every
+  existing config file, including a
+  shadowed sibling it would remove. With an explicit `schemaRef`, a save overwrites an existing
+  file that does not parse unless that file declares a newer version; without one, the save reads
+  the existing `$schema` and fails with `CliConfigParseError` on a file that does not parse. For TOML the directive is checked before
+  parsing, so a newer file this version cannot parse still reports the upgrade error.
+
+## Unknown keys
+
+`findUnknownCliConfigKeys(document)` (`@supabase/config/internal`) returns the sorted key paths
+(segment arrays) of keys in a raw config document that `CliConfigSchema` does not accept, derived from the schema
+itself: the document is decoded with excess-property errors enabled and the unexpected-key issues
+are collected. A key a union member accepts is not reported. The top-level `$schema` key is
+ignored, and `[remotes.<name>]` blocks report under `["remotes", <name>, ...]`. An unknown table
+reports as the table, not its leaves. Pass the document after
+deprecated spellings are folded, as `parseCliConfigDocumentFile` exposes it in `rawDocument`.
+
+The loader still ignores unknown keys. The CLI prints one `WARN:` line on stderr per file listing
+them, so they can be checked for typos, removed, or read by a newer CLI. Key names and schema refs
+are printed with control characters escaped. The CLI's document-only keys (`db.password`,
+`db.root_key`, `auth.external_url`, `[auth.passkey]`, `[auth.webauthn]`) are never listed.
+
 ## CLI-owned Repo State
 
 The CLI also keeps machine-local project state outside `@supabase/config`'s scope, in two places
@@ -496,8 +551,8 @@ Neither is part of `@supabase/config`'s input.
 
 Important distinction:
 
-- `@supabase/config` discovers committed config only from `supabase/config.toml` or
-  `supabase/config.json`
+- `@supabase/config` discovers committed config only from `supabase/config.toml`,
+  `supabase/config.json` or `supabase/config.jsonc`
 - the CLI may still resolve a project root from the nearest `.supabase/project.json` when it needs
   to find local machine state for commands like `link`, `unlink`, `start`, `stop`, `status`,
   `stack list`, or `logs`
diff --git a/packages/config/package.json b/packages/config/package.json
index 8fffa6469a..a2c324917d 100644
--- a/packages/config/package.json
+++ b/packages/config/package.json
@@ -74,6 +74,7 @@
   "dependencies": {
     "@standard-schema/spec": "^1.1.0",
     "dedent": "^1.7.2",
+    "jsonc-parser": "^3.3.1",
     "smol-toml": "^1.8.0"
   },
   "devDependencies": {
diff --git a/packages/config/src/auth/email.ts b/packages/config/src/auth/email.ts
index 771cfbaec5..66e2c388e9 100644
--- a/packages/config/src/auth/email.ts
+++ b/packages/config/src/auth/email.ts
@@ -1,5 +1,6 @@
 import { Effect, Schema } from "effect";
 import { secret } from "../lib/env.ts";
+import { withRecordValueDecodingDefault } from "../lib/schema.ts";
 
 const tags = ["auth"];
 
@@ -15,6 +16,7 @@ const defaultEnableSignup = true;
 const defaultDoubleConfirmChanges = true;
 const defaultEnableConfirmations = false;
 const defaultSecurePasswordChange = false;
+const defaultRequireCurrentPassword = false;
 const defaultMaxFrequency = "1s";
 const defaultOtpLength = 6;
 const defaultOtpExpiry = 3600;
@@ -58,7 +60,7 @@ const template = Schema.Struct({
     default: defaultContentPath,
     description: "Path to the HTML template.",
   }).pipe(Schema.withDecodingDefaultKey(Effect.succeed(defaultContentPath))),
-}).pipe(Schema.withDecodingDefault(Effect.succeed({})));
+}).pipe(withRecordValueDecodingDefault(Effect.succeed({})));
 
 const notification = Schema.Struct({
   enabled: Schema.Boolean.annotate({
@@ -73,7 +75,7 @@ const notification = Schema.Struct({
     default: defaultContentPath,
     description: "Path to the HTML notification template.",
   }).pipe(Schema.withDecodingDefaultKey(Effect.succeed(defaultContentPath))),
-}).pipe(Schema.withDecodingDefault(Effect.succeed({})));
+}).pipe(withRecordValueDecodingDefault(Effect.succeed({})));
 
 export const email = Schema.Struct({
   enabled: Schema.optionalKey(
@@ -112,6 +114,13 @@ export const email = Schema.Struct({
     tags,
     links: [links.auth],
   }).pipe(Schema.withDecodingDefaultKey(Effect.succeed(defaultSecurePasswordChange))),
+  require_current_password: Schema.Boolean.annotate({
+    default: defaultRequireCurrentPassword,
+    description:
+      "If enabled, users will need to provide their current password to change their password, unless they signed in with a one-time password, magic link, or recovery link.",
+    tags,
+    links: [links.auth],
+  }).pipe(Schema.withDecodingDefaultKey(Effect.succeed(defaultRequireCurrentPassword))),
   max_frequency: Schema.String.annotate({
     default: defaultMaxFrequency,
     description:
diff --git a/packages/config/src/base.ts b/packages/config/src/base.ts
index 6f6af2e211..72eaf53d81 100644
--- a/packages/config/src/base.ts
+++ b/packages/config/src/base.ts
@@ -8,6 +8,7 @@ import { experimental } from "./experimental.ts";
 import { functions } from "./functions.ts";
 import { inbucket } from "./inbucket.ts";
 import { local } from "./local.ts";
+import { withRecordValueDecodingDefault } from "./lib/schema.ts";
 import { toPublishedJsonSchemaDocument } from "./json-schema-document.ts";
 import { realtime } from "./realtime.ts";
 import { storage } from "./storage.ts";
@@ -59,7 +60,7 @@ const remoteCliConfigBlock = Schema.Struct({
   studio,
   compute,
   experimental,
-}).pipe(Schema.withDecodingDefault(Effect.succeed({})));
+}).pipe(withRecordValueDecodingDefault(Effect.succeed({})));
 
 /**
  * Exported separately (not inlined into {@link CliConfigSchema}) so
diff --git a/packages/config/src/cli-config.service.ts b/packages/config/src/cli-config.service.ts
index 0de82502c9..6f69b163fd 100644
--- a/packages/config/src/cli-config.service.ts
+++ b/packages/config/src/cli-config.service.ts
@@ -7,6 +7,8 @@ import type {
   SaveCliConfigOptions,
 } from "./config-document.ts";
 import type {
+  CliConfigFileConflictError,
+  CliConfigSchemaVersionError,
   CliConfigParseError,
   CliConfigRemovedKeyError,
   CliProjectEnvParseError,
@@ -23,6 +25,8 @@ import type {
  * consumer (`@supabase/config/io`) can distinguish these via `instanceof`.
  */
 type CliConfigStoreError =
+  | CliConfigFileConflictError
+  | CliConfigSchemaVersionError
   | CliConfigParseError
   | CliConfigRemovedKeyError
   | DuplicateRemoteProjectIdError
diff --git a/packages/config/src/config-edit.ts b/packages/config/src/config-edit.ts
index 5560e49f63..66a3e1da7c 100644
--- a/packages/config/src/config-edit.ts
+++ b/packages/config/src/config-edit.ts
@@ -1,14 +1,23 @@
+import {
+  applyEdits as applyJsonEditsToText,
+  findNodeAtLocation,
+  modify,
+  parseTree,
+  type FormattingOptions,
+} from "jsonc-parser";
 import * as SmolToml from "smol-toml";
 import type { ConfigFormat } from "./config-format.ts";
+import { parseJsonc } from "./jsonc.ts";
 
 /**
- * Format-preserving surgical editor for `supabase/config.{toml,json}`. Pure and synchronous:
+ * Format-preserving surgical editor for `supabase/config.{toml,json,jsonc}`. Pure and synchronous:
  * callers own reading the current file text and writing the returned text back out atomically.
  * Every edited document is re-parsed and deep-compared against the original before being
  * returned; any mismatch refuses rather than shipping wrong bytes. An edit either replaces an
  * existing value's span in place or inserts a new line/table — nothing else is touched, so
- * untouched comments, spacing, and quoting survive byte-for-byte. See ADR 0023 for the design
- * rationale and rejected alternatives.
+ * untouched comments, spacing, and quoting survive byte-for-byte. JSON/JSONC documents are
+ * span-edited through `jsonc-parser`'s `modify`, keeping comments and trailing commas. See ADR
+ * 0023 for the design rationale and rejected alternatives.
  */
 
 export type ConfigEditValue =
@@ -63,9 +72,8 @@ function isRemotesLabelRoot(path: ReadonlyArray<string>): boolean {
   return path.length === 2 && path[0] === REMOTES_TABLE_NAME;
 }
 
-// Duplicated from `lib/env.ts` rather than imported: this module is restricted to `smol-toml`
-// as its only import, so it stays independently embeddable without pulling in this package's
-// wider env-resolution graph.
+// Duplicated from `lib/env.ts` rather than imported so this module avoids pulling in this
+// package's wider env-resolution graph.
 const ENV_CAPTURE_REGEX = /^env\((.*)\)$/;
 
 function isPlainRecord(value: unknown): value is Readonly<Record<string, unknown>> {
@@ -180,26 +188,14 @@ function deepSetOne(root: unknown, path: ReadonlyArray<string>, value: unknown):
   return { ...base, [head]: deepSetOne(existingChild, rest, value) };
 }
 
-/** Applies one `path`/`value` pair per entry on top of `root`, immutably. Shared by `deepSet`
- * (the verification oracle, built from the original un-flattened edits) and the JSON arm's
- * actual per-leaf mutation (built from `flattenEdits`'s output) — the two intentionally use
- * different entry sets so an object-valued edit's write only touches leaves it mentions, while
- * verification still catches a dropped sibling. */
-function applyPathEntries(
-  root: unknown,
-  entries: ReadonlyArray<{ readonly path: ReadonlyArray<string>; readonly value: unknown }>,
-): unknown {
-  return entries.reduce<unknown>(
-    (accumulator, entry) => deepSetOne(accumulator, entry.path, entry.value),
-    root,
-  );
-}
-
 /** Applies every edit's `path`/`value` on top of `root`, immutably, replacing the whole
  * destination subtree for an object-valued edit. This is the expected-value side of mandatory
- * verification for both formats — see `applyPathEntries` for the actual per-leaf mutation. */
+ * verification for both formats. */
 function deepSet(root: unknown, edits: ReadonlyArray<ConfigEdit>): unknown {
-  return applyPathEntries(root, edits);
+  return edits.reduce<unknown>(
+    (accumulator, edit) => deepSetOne(accumulator, edit.path, edit.value),
+    root,
+  );
 }
 
 function describeError(cause: unknown): string {
@@ -1193,19 +1189,177 @@ function detectJsonNewline(source: string): "\n" | "\r\n" {
   return source.includes("\r\n") ? "\r\n" : "\n";
 }
 
-function detectJsonIndent(source: string): string | number {
+function detectJsonFormatting(source: string): FormattingOptions {
   const match = /\n([ \t]+)\S/.exec(source);
-  if (match === null) {
-    return 2;
+  const indent = match?.[1] ?? "  ";
+  const usesTabs = indent.includes("\t");
+  return {
+    insertSpaces: !usesTabs,
+    tabSize: usesTabs ? 1 : indent.length,
+    eol: detectJsonNewline(source),
+  };
+}
+
+function lineEndAfterTrailer(
+  text: string,
+  from: number,
+): { end: number; hadComma: boolean } | null {
+  let pos = from;
+  let hadComma = false;
+  for (;;) {
+    const ch = text[pos];
+    if (ch === " " || ch === "\t") {
+      pos++;
+    } else if (ch === "," && !hadComma) {
+      hadComma = true;
+      pos++;
+    } else if (ch === "/" && text[pos + 1] === "*") {
+      const close = text.indexOf("*/", pos + 2);
+      if (close === -1 || /[\r\n]/.test(text.slice(pos, close))) {
+        return null;
+      }
+      pos = close + 2;
+    } else if (ch === "/" && text[pos + 1] === "/") {
+      while (pos < text.length && text[pos] !== "\r" && text[pos] !== "\n") {
+        pos++;
+      }
+    } else if (ch === undefined || ch === "\r" || ch === "\n") {
+      return { end: pos, hadComma };
+    } else {
+      return null;
+    }
   }
-  const indent = match[1] ?? "";
-  return indent.includes("\t") ? "\t" : indent.length;
+}
+
+/** `modify` inserts right after the previous value and reformats that line, which moves a
+ * same-line trailing comment onto the new key; this appends after the line instead. */
+function insertAfterLastProperty(
+  text: string,
+  leaf: { readonly path: ReadonlyArray<string>; readonly value: unknown },
+  formatting: FormattingOptions,
+): string | undefined {
+  const root = parseTree(text, undefined, { allowTrailingComma: true });
+  if (root === undefined) {
+    return undefined;
+  }
+  let depth = leaf.path.length;
+  let parent = findNodeAtLocation(root, [...leaf.path]);
+  while (parent === undefined && depth > 0) {
+    depth--;
+    parent = findNodeAtLocation(root, leaf.path.slice(0, depth));
+  }
+  const prev = parent?.children?.[parent.children.length - 1];
+  if (parent?.type !== "object" || depth === leaf.path.length || prev === undefined) {
+    return undefined;
+  }
+  const prevEnd = prev.offset + prev.length;
+  const trailer = lineEndAfterTrailer(text, prevEnd);
+  if (trailer === null) {
+    return undefined;
+  }
+  const eol = formatting.eol ?? "\n";
+  const lineStart = Math.max(text.lastIndexOf("\n", prev.offset), -1) + 1;
+  const baseIndent = /^[ \t]*/.exec(text.slice(lineStart))?.[0] ?? "";
+  const [key, ...rest] = leaf.path.slice(depth);
+  const nested = rest.reduceRight<unknown>((value, segment) => ({ [segment]: value }), leaf.value);
+  const indentUnit = formatting.insertSpaces ? " ".repeat(formatting.tabSize ?? 2) : "\t";
+  const rendered = JSON.stringify(nested, null, indentUnit).split("\n").join(`${eol}${baseIndent}`);
+  const insertion = `${eol}${baseIndent}${JSON.stringify(key)}: ${rendered}${trailer.hadComma ? "," : ""}`;
+  return (
+    text.slice(0, prevEnd) +
+    (trailer.hadComma ? "" : ",") +
+    text.slice(prevEnd, trailer.end) +
+    insertion +
+    text.slice(trailer.end)
+  );
+}
+
+/** Edits `source` towards `target` with minimal span edits so comments survive; undefined when
+ * the result cannot be verified. */
+export function updateJsonDocument(source: string, target: unknown): string | undefined {
+  try {
+    const current = parseJsonc(source);
+    if (!isPlainRecord(current) || !isPlainRecord(target)) {
+      return undefined;
+    }
+    const formattingOptions = detectJsonFormatting(source);
+    let text = source;
+    const sync = (
+      path: ReadonlyArray<string>,
+      from: Readonly<Record<string, unknown>>,
+      to: Readonly<Record<string, unknown>>,
+    ): void => {
+      for (const key of Object.keys(from)) {
+        if (!Object.hasOwn(to, key)) {
+          text =
+            removeProperty(text, [...path, key]) ??
+            applyJsonEditsToText(
+              text,
+              modify(text, [...path, key], undefined, { formattingOptions }),
+            );
+        }
+      }
+      for (const [key, value] of Object.entries(to)) {
+        const keyPath = [...path, key];
+        const existing = Object.hasOwn(from, key) ? from[key] : undefined;
+        if (!Object.hasOwn(from, key)) {
+          text =
+            insertAfterLastProperty(text, { path: keyPath, value }, formattingOptions) ??
+            applyJsonEditsToText(text, modify(text, keyPath, value, { formattingOptions }));
+        } else if (isPlainRecord(existing) && isPlainRecord(value)) {
+          sync(keyPath, existing, value);
+        } else if (!deepEqualValue(existing, value)) {
+          text = applyJsonEditsToText(text, modify(text, keyPath, value, { formattingOptions }));
+        }
+      }
+    };
+    sync([], current, target);
+    return deepEqualValue(parseJsonc(text), target) ? text : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** `modify` removes from the end of the previous value, which moves a trailing comment onto the
+ * wrong key; this removes the property's own line and keeps the previous key's separator strict. */
+function removeProperty(text: string, path: ReadonlyArray<string>): string | undefined {
+  const root = parseTree(text, undefined, { allowTrailingComma: true });
+  const property = root === undefined ? undefined : findNodeAtLocation(root, [...path])?.parent;
+  const object = property?.parent;
+  if (property?.type !== "property" || object?.type !== "object" || object.children === undefined) {
+    return undefined;
+  }
+  const lineStart = text.lastIndexOf("\n", property.offset - 1) + 1;
+  if (!/^[ \t]*$/.test(text.slice(lineStart, property.offset))) {
+    return undefined;
+  }
+  const trailer = lineEndAfterTrailer(text, property.offset + property.length);
+  if (trailer === null) {
+    return undefined;
+  }
+  const eolLength = text.startsWith("\r\n", trailer.end) ? 2 : text[trailer.end] === "\n" ? 1 : 0;
+  const removed = text.slice(0, lineStart) + text.slice(trailer.end + eolLength);
+  const prev = object.children[object.children.length - 2];
+  if (
+    object.children[object.children.length - 1] !== property ||
+    trailer.hadComma ||
+    prev === undefined
+  ) {
+    return removed;
+  }
+  let commaPos = prev.offset + prev.length;
+  while (text[commaPos] === " " || text[commaPos] === "\t") {
+    commaPos++;
+  }
+  return text[commaPos] === ","
+    ? removed.slice(0, commaPos) + removed.slice(commaPos + 1)
+    : undefined;
 }
 
 function applyJsonEdits(source: string, edits: ReadonlyArray<ConfigEdit>): ConfigEditOutcome {
   let parsed: unknown;
   try {
-    parsed = JSON.parse(source);
+    parsed = parseJsonc(source);
   } catch (cause) {
     return refused("parse_error", [], describeError(cause));
   }
@@ -1229,24 +1383,29 @@ function applyJsonEdits(source: string, edits: ReadonlyArray<ConfigEdit>): Confi
     }
   }
 
-  const indent = detectJsonIndent(source);
-  const nextValue = applyPathEntries(parsed, leaves);
-  const rendered = JSON.stringify(nextValue, null, indent);
-  // `JSON.stringify` always renders `\n`, so a CRLF source needs its newline flavor restored
-  // post-render — otherwise every edit to a CRLF JSON config would silently flip it to LF.
-  const newline = detectJsonNewline(source);
-  const withNewlineFlavor = newline === "\r\n" ? rendered.replaceAll("\n", "\r\n") : rendered;
-  const nextText = source.endsWith("\n") ? `${withNewlineFlavor}${newline}` : withNewlineFlavor;
+  const formattingOptions = detectJsonFormatting(source);
+  let nextText = source;
+  for (const leaf of leaves) {
+    try {
+      nextText =
+        insertAfterLastProperty(nextText, leaf, formattingOptions) ??
+        applyJsonEditsToText(
+          nextText,
+          modify(nextText, [...leaf.path], leaf.value, { formattingOptions }),
+        );
+    } catch (cause) {
+      return refused("verification_mismatch", leaf.path, describeError(cause));
+    }
+  }
 
   let reparsed: unknown;
   try {
-    reparsed = JSON.parse(nextText);
+    reparsed = parseJsonc(nextText);
   } catch {
     return refused("verification_mismatch", [], "edited document failed to re-parse");
   }
-  // Verified against `deepSet` (the original, un-flattened `edits`), not `nextValue` (the
-  // flattened per-leaf mutation) — comparing against the mutation would be tautological, so a
-  // sibling an object-valued edit silently drops would never surface as a mismatch.
+  // Verified against `deepSet` (the original, un-flattened `edits`) so a sibling an object-valued
+  // edit would silently drop surfaces as a mismatch.
   const expected = deepSet(parsed, edits);
   if (!deepEqualValue(reparsed, expected)) {
     return refused(
diff --git a/packages/config/src/config-edit.unit.test.ts b/packages/config/src/config-edit.unit.test.ts
index 13fef19d00..885031edfc 100644
--- a/packages/config/src/config-edit.unit.test.ts
+++ b/packages/config/src/config-edit.unit.test.ts
@@ -724,6 +724,100 @@ describe("applyConfigEdits (json)", () => {
         }
     }
 }
+`);
+  });
+
+  test("replacing a scalar in a commented JSONC source changes only that value", () => {
+    const source = `{
+  // local overrides
+  "$schema": "s",
+  /* api settings */
+  "api": {
+    "max_rows": 1000, // keep small
+    "port": 5,
+  },
+}
+`;
+    const outcome = applyConfigEdits(source, "json", [{ path: ["api", "max_rows"], value: 500 }]);
+    expect(applied(outcome).text).toBe(source.replace("1000", "500"));
+    expect(applied(outcome).applied).toEqual([
+      { path: ["api", "max_rows"], action: "replaced", createdTables: [] },
+    ]);
+  });
+
+  test("inserting keys into a commented JSONC source keeps every comment and trailing comma", () => {
+    const source = `{
+  // local overrides
+  "api": {
+    // dev port
+    "port": 5,
+  },
+  /* auth settings */
+  "db": {
+    "port": 6,
+  },
+}
+`;
+    const outcome = applyConfigEdits(source, "json", [
+      { path: ["api", "max_rows"], value: 500 },
+      { path: ["auth", "site_url"], value: "http://x" },
+    ]);
+    expect(applied(outcome).text).toBe(`{
+  // local overrides
+  "api": {
+    // dev port
+    "port": 5,
+    "max_rows": 500,
+  },
+  /* auth settings */
+  "db": {
+    "port": 6,
+  },
+  "auth": {
+    "site_url": "http://x"
+  },
+}
+`);
+    expect(applied(outcome).applied).toEqual([
+      { path: ["api", "max_rows"], action: "inserted", createdTables: [] },
+      { path: ["auth", "site_url"], action: "inserted", createdTables: [] },
+    ]);
+  });
+
+  test("inserting a sibling after a property without a trailing comma keeps its inline comment on that line", () => {
+    const source = `{
+  "api": {
+    "port": 5 // dev port
+  }
+}
+`;
+    const outcome = applyConfigEdits(source, "json", [{ path: ["api", "max_rows"], value: 500 }]);
+    expect(applied(outcome).text).toBe(`{
+  "api": {
+    "port": 5, // dev port
+    "max_rows": 500
+  }
+}
+`);
+    expect(applied(outcome).applied).toEqual([
+      { path: ["api", "max_rows"], action: "inserted", createdTables: [] },
+    ]);
+  });
+
+  test("inserting a sibling after a trailing-comma property leaves its inline array and comment untouched", () => {
+    const source = `{
+  "api": {
+    "schemas": ["public"], // exposed
+  }
+}
+`;
+    const outcome = applyConfigEdits(source, "json", [{ path: ["api", "max_rows"], value: 500 }]);
+    expect(applied(outcome).text).toBe(`{
+  "api": {
+    "schemas": ["public"], // exposed
+    "max_rows": 500,
+  }
+}
 `);
   });
 });
diff --git a/packages/config/src/config-format.ts b/packages/config/src/config-format.ts
index 1c58d3c8cc..2101a1f31f 100644
--- a/packages/config/src/config-format.ts
+++ b/packages/config/src/config-format.ts
@@ -1,2 +1,2 @@
-/** The on-disk formats a CLI config document can be written or parsed as. */
+/** The on-disk formats a CLI config document can be written or parsed as; "json" covers both `config.json` and `config.jsonc`. */
 export type ConfigFormat = "json" | "toml";
diff --git a/packages/config/src/db-migration-checks.ts b/packages/config/src/db-migration-checks.ts
index 7dc5f5fbfd..c7ae965e17 100644
--- a/packages/config/src/db-migration-checks.ts
+++ b/packages/config/src/db-migration-checks.ts
@@ -80,7 +80,7 @@ const TypedMigrationChecks = Schema.Struct({
   ),
 }).annotate({
   description:
-    'Security checks run on each migration. Each rule takes "error", "warn" or "off"; a rule left unset uses "warn". When migrations run against --db-url, this section is read only from the local config.toml.',
+    'Security checks run on each migration. Each rule takes "error", "warn" or "off"; a rule left unset uses "warn". When migrations run against --db-url, this section is read only from the local config file.',
   tags,
 });
 
diff --git a/packages/config/src/entrypoint-purity.unit.test.ts b/packages/config/src/entrypoint-purity.unit.test.ts
index 0ac8237fef..1130df97b1 100644
--- a/packages/config/src/entrypoint-purity.unit.test.ts
+++ b/packages/config/src/entrypoint-purity.unit.test.ts
@@ -392,9 +392,11 @@ describe("src/index.ts export surface", () => {
     expect(Object.keys(defaultEntrypoint).sort()).toMatchInlineSnapshot(`
       [
         "CLI_CONFIG_SCHEMA_URL",
+        "CliConfigFileConflictError",
         "CliConfigParseError",
         "CliConfigRemovedKeyError",
         "CliConfigSchema",
+        "CliConfigSchemaVersionError",
         "CliProjectEnvParseError",
         "DuplicateRemoteProjectIdError",
         "InvalidRemoteProjectIdError",
@@ -432,9 +434,11 @@ describe("src/effect.ts is a superset of src/index.ts", () => {
     expect(Object.keys(effectEntrypoint).sort()).toMatchInlineSnapshot(`
       [
         "CLI_CONFIG_SCHEMA_URL",
+        "CliConfigFileConflictError",
         "CliConfigParseError",
         "CliConfigRemovedKeyError",
         "CliConfigSchema",
+        "CliConfigSchemaVersionError",
         "CliConfigStore",
         "CliProjectEnvParseError",
         "DuplicateRemoteProjectIdError",
@@ -518,17 +522,21 @@ describe("src/internal.ts export surface", () => {
         "CliConfigWriteError",
         "DEFAULT_MIGRATION_CHECK_SEVERITY",
         "ENV_CAPTURE_REGEX",
+        "JsoncSyntaxError",
         "MIGRATION_CHECK_RULES",
         "PROVIDER_SIGNUP_ALIASES",
         "applyConfigEdits",
+        "cliConfigFormatForPath",
         "decodeCliConfigDocumentForValidationEffect",
         "decodeMergedCliConfig",
         "dualScopeProjectConfigPaths",
+        "findUnknownCliConfigKeys",
         "loadCliConfig",
         "mapMigrationCheckRules",
         "mergeParsedCliConfig",
         "parseCliConfigDocument",
         "parseCliConfigDocumentFile",
+        "parseJsonc",
         "projectConfigApiBlockKeys",
         "projectConfigMappingRows",
         "remoteNameForProjectRef",
@@ -536,6 +544,7 @@ describe("src/internal.ts export surface", () => {
         "resolveCliConfigSubtree",
         "resolveCliConfigValue",
         "unmappedSecretApiPaths",
+        "withoutSafeIntegerBounds",
         "writeCliConfigDocumentText",
       ]
     `);
diff --git a/packages/config/src/errors.ts b/packages/config/src/errors.ts
index 252f763a00..1c02cbbe9f 100644
--- a/packages/config/src/errors.ts
+++ b/packages/config/src/errors.ts
@@ -37,6 +37,31 @@ export class CliConfigRemovedKeyError extends Data.TaggedError("CliConfigRemoved
   }
 }
 
+/** Both `config.json` and `config.jsonc` exist in one project; `paths` lists every conflicting file. */
+export class CliConfigFileConflictError extends Data.TaggedError("CliConfigFileConflictError")<{
+  readonly paths: ReadonlyArray<string>;
+}> {
+  override get message(): string {
+    const files = this.paths.map((path) => path.split(/[\\/]/).slice(-2).join("/"));
+    return `Found both ${files.join(" and ")}. Keep one and delete the other.`;
+  }
+}
+
+/** A config file declares a schema version newer than this package reads. */
+export class CliConfigSchemaVersionError extends Data.TaggedError("CliConfigSchemaVersionError")<{
+  readonly path: string;
+  readonly format: ConfigFormat;
+  readonly schemaRef: string;
+  /** The declared version in decimal digits, which can exceed the safe integer range. */
+  readonly declaredVersion: string;
+  readonly supportedVersion: number;
+}> {
+  override get message(): string {
+    const file = this.path.split(/[\\/]/).slice(-2).join("/");
+    return `${file} declares config schema v${this.declaredVersion}, but this version of the Supabase CLI only reads up to v${this.supportedVersion}. Upgrade the Supabase CLI to use this config.`;
+  }
+}
+
 const PROJECT_CONFIG_PARSE_ERROR_MESSAGE_PREFIX =
   "Could not read the project config from the Management API response";
 
diff --git a/packages/config/src/functions.ts b/packages/config/src/functions.ts
index b1ea383d24..6e3a6bd55b 100644
--- a/packages/config/src/functions.ts
+++ b/packages/config/src/functions.ts
@@ -1,6 +1,7 @@
 import dedent from "dedent";
 import { Effect, Schema } from "effect";
 import { env } from "./lib/env.ts";
+import { withRecordValueDecodingDefault } from "./lib/schema.ts";
 
 const tags = ["functions"];
 
@@ -83,7 +84,7 @@ const func = Schema.Struct({
       links,
     })
     .pipe(Schema.withDecodingDefaultKey(Effect.succeed({ ...defaultEnv }))),
-}).pipe(Schema.withDecodingDefault(Effect.succeed({ ...defaultFunction })));
+}).pipe(withRecordValueDecodingDefault(Effect.succeed({ ...defaultFunction })));
 
 export const functions = Schema.Record(functionName, func)
   .annotate({
diff --git a/packages/config/src/index.ts b/packages/config/src/index.ts
index 8ee4be4002..a8361e657e 100644
--- a/packages/config/src/index.ts
+++ b/packages/config/src/index.ts
@@ -13,6 +13,8 @@ export {
   type CliConfigJson,
 } from "./base.ts";
 export {
+  CliConfigFileConflictError,
+  CliConfigSchemaVersionError,
   CliConfigParseError,
   CliConfigRemovedKeyError,
   CliProjectEnvParseError,
diff --git a/packages/config/src/internal.ts b/packages/config/src/internal.ts
index c0ed0a93b2..73485b0f49 100644
--- a/packages/config/src/internal.ts
+++ b/packages/config/src/internal.ts
@@ -7,6 +7,7 @@
  * internal-only `cliCompat` knob.
  */
 export { ENV_CAPTURE_REGEX } from "./lib/env.ts";
+export { withoutSafeIntegerBounds } from "./json-schema-document.ts";
 export {
   DEFAULT_MIGRATION_CHECK_SEVERITY,
   MIGRATION_CHECK_RULES,
@@ -46,6 +47,9 @@ export {
   decodeCliConfigDocumentForValidationEffect,
   type DecodeCliConfigDocumentForValidationEffectOptions,
   parseCliConfigDocument,
+  cliConfigFormatForPath,
 } from "./io.ts";
+export { JsoncSyntaxError, parseJsonc } from "./jsonc.ts";
 export { PROVIDER_SIGNUP_ALIASES } from "./lib/provider-signup.ts";
 export { CliConfigWriteError } from "./errors.ts";
+export { findUnknownCliConfigKeys } from "./unknown-keys.ts";
diff --git a/packages/config/src/io.ts b/packages/config/src/io.ts
index 49b2c552b9..59e263b4f4 100644
--- a/packages/config/src/io.ts
+++ b/packages/config/src/io.ts
@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { Clock, Effect, FileSystem, Path, Predicate, Redacted } from "effect";
+import { Clock, Effect, FileSystem, Option, Path, Predicate, Redacted } from "effect";
 import * as SmolToml from "smol-toml";
 import { CliConfigSchema, type CliConfig } from "./base.ts";
 import {
@@ -12,17 +12,28 @@ import {
   type CliConfigValueSource,
   type SaveCliConfigOptions,
 } from "./config-document.ts";
+import { updateJsonDocument } from "./config-edit.ts";
 import type { ConfigFormat } from "./config-format.ts";
 import {
+  CliConfigFileConflictError,
   DuplicateRemoteProjectIdError,
   InvalidRemoteProjectIdError,
   CliConfigParseError,
+  CliConfigSchemaVersionError,
   CliConfigWriteError,
 } from "./errors.ts";
 import { interpolateEnvReferencesAgainstSchema } from "./lib/env.ts";
 import { normalizeDeprecatedProviderSignupKeys } from "./lib/provider-signup.ts";
+import { parseJsonc } from "./jsonc.ts";
 import { findCliProjectPaths } from "./paths.ts";
 import { rejectRemovedConfigKeys } from "./removed-config-keys.ts";
+import { SUPPORTED_CLI_CONFIG_SCHEMA_VERSION } from "./schema-metadata.ts";
+import {
+  readCliConfigSchemaDeclaration,
+  SCHEMA_DIRECTIVE_LINE,
+  versionOfSchemaRef,
+  type CliConfigSchemaDeclaration,
+} from "./schema-version.ts";
 import { setOwnProperty } from "./sparse.ts";
 import { loadCliProjectEnvironment } from "./project.ts";
 import { validateCliConfig } from "./validate.ts";
@@ -35,8 +46,13 @@ function configTomlPathWith(path: Path.Path, cwd: string): string {
   return path.join(cwd, "supabase", "config.toml");
 }
 
-function siblingConfigPathWith(path: Path.Path, cwd: string, format: ConfigFormat): string {
-  return format === "json" ? configTomlPathWith(path, cwd) : configJsonPathWith(path, cwd);
+function configJsoncPathWith(path: Path.Path, cwd: string): string {
+  return path.join(cwd, "supabase", "config.jsonc");
+}
+
+/** Not covered by semver — exported from `@supabase/config/internal` only. Maps a config file path to its document format. */
+export function cliConfigFormatForPath(filePath: string): ConfigFormat {
+  return filePath.endsWith(".json") || filePath.endsWith(".jsonc") ? "json" : "toml";
 }
 
 /**
@@ -218,7 +234,7 @@ const applyRemoteOverride = Effect.fnUntraced(function* (
 });
 
 export function parseCliConfigDocument(content: string, format: ConfigFormat): unknown {
-  return format === "json" ? JSON.parse(content) : SmolToml.parse(content);
+  return format === "json" ? parseJsonc(content) : SmolToml.parse(content);
 }
 
 /**
@@ -373,25 +389,52 @@ export const configTomlPath = Effect.fnUntraced(function* (cwd: string) {
   return configTomlPathWith(path, project?.projectRoot ?? cwd);
 });
 
+const failIfSchemaTooNew = Effect.fnUntraced(function* (
+  filePath: string,
+  format: ConfigFormat,
+  declaration: CliConfigSchemaDeclaration | undefined,
+) {
+  if (
+    declaration?.version !== undefined &&
+    declaration.version > BigInt(SUPPORTED_CLI_CONFIG_SCHEMA_VERSION)
+  ) {
+    return yield* new CliConfigSchemaVersionError({
+      path: filePath,
+      format,
+      schemaRef: declaration.ref,
+      declaredVersion: declaration.version.toString(),
+      supportedVersion: SUPPORTED_CLI_CONFIG_SCHEMA_VERSION,
+    });
+  }
+});
+
 const readCliConfigDocumentFile = Effect.fnUntraced(function* (filePath: string) {
   const fs = yield* FileSystem.FileSystem;
-  const format = filePath.endsWith(".json") ? "json" : "toml";
+  const format = cliConfigFormatForPath(filePath);
   const content = yield* fs.readFileString(filePath);
+  yield* failIfSchemaTooNew(
+    filePath,
+    format,
+    readCliConfigSchemaDeclaration(content, format, undefined),
+  );
   const document = yield* Effect.try({
     try: () => parseCliConfigDocument(content, format),
     catch: (cause) => new CliConfigParseError({ path: filePath, format, cause }),
   });
-  return { format, content, document } as const;
+  const schemaDeclaration = readCliConfigSchemaDeclaration(content, format, document);
+  yield* failIfSchemaTooNew(filePath, format, schemaDeclaration);
+  return { format, content, document, schemaDeclaration } as const;
 });
 
 const readAndNormalizeCliConfigFile = Effect.fnUntraced(function* (filePath: string) {
-  const { format, content, document } = yield* readCliConfigDocumentFile(filePath);
+  const { format, content, document, schemaDeclaration } =
+    yield* readCliConfigDocumentFile(filePath);
   const withoutRemoved = isObject(document)
     ? yield* rejectRemovedConfigKeys(document, filePath, format)
     : document;
   const { document: normalized, deprecatedPaths } =
     normalizeDeprecatedProviderSignupKeys(withoutRemoved);
-  return { format, content, document, normalized, deprecatedPaths } as const;
+  return { format, content, document, schemaDeclaration, normalized, deprecatedPaths } as const;
 });
 
 /**
@@ -628,27 +671,35 @@ const locateCliConfigFile = Effect.fnUntraced(function* (
   options: { readonly search?: boolean; readonly tomlOnly?: boolean } | undefined,
 ) {
   const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
   const project = yield* findCliProjectPaths(cwd, { search: options?.search });
 
   if (project === null) {
     return null;
   }
 
-  const jsonPath = project.configPath.endsWith(".json")
-    ? project.configPath
-    : project.configPath.replace(/config\.toml$/, "config.json");
-  const tomlPath = project.configPath.endsWith(".toml")
-    ? project.configPath
-    : project.configPath.replace(/config\.json$/, "config.toml");
+  const jsonPath = path.join(project.supabaseDir, "config.json");
+  const jsoncPath = path.join(project.supabaseDir, "config.jsonc");
+  const tomlPath = path.join(project.supabaseDir, "config.toml");
+  const tomlExists = yield* fs.exists(tomlPath);
 
-  if (!options?.tomlOnly && (yield* fs.exists(jsonPath))) {
-    return {
-      filePath: jsonPath,
-      ignoredPaths: (yield* fs.exists(tomlPath)) ? [tomlPath] : [],
-    };
+  if (!options?.tomlOnly) {
+    const jsonExists = yield* fs.exists(jsonPath);
+    const jsoncExists = yield* fs.exists(jsoncPath);
+
+    if (jsonExists && jsoncExists) {
+      return yield* new CliConfigFileConflictError({ paths: [jsonPath, jsoncPath] });
+    }
+
+    if (jsonExists || jsoncExists) {
+      return {
+        filePath: jsonExists ? jsonPath : jsoncPath,
+        ignoredPaths: tomlExists ? [tomlPath] : [],
+      };
+    }
   }
 
-  if (yield* fs.exists(tomlPath)) {
+  if (tomlExists) {
     return { filePath: tomlPath, ignoredPaths: [] };
   }
 
@@ -679,6 +730,7 @@ export interface ParsedCliConfigDocument {
   readonly format: ConfigFormat;
   readonly rawText: string;
   readonly schemaRef: string | undefined;
+  readonly schemaDeclaration: CliConfigSchemaDeclaration | undefined;
   readonly ignoredPaths: ReadonlyArray<string>;
   readonly deprecatedPaths: ReadonlyArray<string>;
   readonly rawDocument: Record<string, unknown> | undefined;
@@ -703,7 +755,7 @@ export const parseCliConfigDocumentFile = Effect.fn("CliConfig.parseDocument")(f
     return null;
   }
 
-  const { format, content, document, normalized, deprecatedPaths } =
+  const { format, content, document, schemaDeclaration, normalized, deprecatedPaths } =
     yield* readAndNormalizeCliConfigFile(located.filePath);
 
   return {
@@ -711,6 +763,7 @@ export const parseCliConfigDocumentFile = Effect.fn("CliConfig.parseDocument")(f
     format,
     rawText: content,
     schemaRef: getSchemaRef(document),
+    schemaDeclaration,
     ignoredPaths: located.ignoredPaths,
     deprecatedPaths,
     rawDocument: isObject(normalized) ? normalized : undefined,
@@ -748,28 +801,28 @@ export const mergeParsedCliConfig = Effect.fn("CliConfig.mergeParsed")(function*
   } satisfies MergedCliConfigDocument;
 });
 
-const resolveSaveFormat = Effect.fnUntraced(function* (
+const resolveSaveTarget = Effect.fnUntraced(function* (
   cwd: string,
   format: ConfigFormat | undefined,
 ) {
-  if (format !== undefined) {
-    return format;
-  }
-
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const jsonPath = configJsonPathWith(path, cwd);
+  const jsoncPath = configJsoncPathWith(path, cwd);
   const tomlPath = configTomlPathWith(path, cwd);
+  const jsonExists = yield* fs.exists(jsonPath);
+  const jsoncExists = yield* fs.exists(jsoncPath);
 
-  if (yield* fs.exists(jsonPath)) {
-    return "json" as const;
+  if (jsonExists && jsoncExists) {
+    return yield* new CliConfigFileConflictError({ paths: [jsonPath, jsoncPath] });
   }
 
-  if (yield* fs.exists(tomlPath)) {
-    return "toml" as const;
-  }
+  const resolved =
+    format ??
+    (jsonExists || jsoncExists || !(yield* fs.exists(tomlPath)) ? ("json" as const) : "toml");
+  const filePath = resolved === "toml" ? tomlPath : jsoncExists ? jsoncPath : jsonPath;
 
-  return "json" as const;
+  return { format: resolved, filePath, allPaths: [jsonPath, jsoncPath, tomlPath] } as const;
 });
 
 const DEFAULT_CLI_CONFIG_FILE_MODE = 0o644;
@@ -803,29 +856,73 @@ const readExistingSchemaRef = Effect.fnUntraced(function* (cwd: string) {
   return getSchemaRef(document);
 });
 
+/** Fails when any existing config file, including a shadowed sibling the save removes, declares a
+ * newer schema; a file that does not parse can still be overwritten. */
+const rejectNewerExistingSchema = Effect.fnUntraced(function* (paths: ReadonlyArray<string>) {
+  const fs = yield* FileSystem.FileSystem;
+  for (const filePath of paths) {
+    if (!(yield* fs.exists(filePath))) {
+      continue;
+    }
+    const format = cliConfigFormatForPath(filePath);
+    const content = yield* fs.readFileString(filePath);
+    const document = yield* Effect.try(() => parseCliConfigDocument(content, format)).pipe(
+      Effect.orElseSucceed(() => undefined),
+    );
+    yield* failIfSchemaTooNew(
+      filePath,
+      format,
+      readCliConfigSchemaDeclaration(content, format, document),
+    );
+  }
+});
+
+/** Saves `config`; an existing JSON/JSONC file is edited in place so comments survive, and a TOML
+ * file keeps its `#:schema` directive. */
 export const saveCliConfig = Effect.fn("CliConfig.save")(function* (options: SaveCliConfigOptions) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const project = yield* findCliProjectPaths(options.cwd);
   const baseCwd = project?.projectRoot ?? options.cwd;
-  const format = yield* resolveSaveFormat(baseCwd, options.format);
+  const { format, filePath, allPaths } = yield* resolveSaveTarget(baseCwd, options.format);
+  if (project !== null) {
+    yield* rejectNewerExistingSchema(allPaths);
+  }
   const existingSchemaRef =
     options.schemaRef !== undefined || project === null
       ? undefined
       : yield* readExistingSchemaRef(baseCwd);
   const schemaRef = options.schemaRef ?? existingSchemaRef;
-  const filePath =
-    format === "json" ? configJsonPathWith(path, baseCwd) : configTomlPathWith(path, baseCwd);
-  const siblingPath = siblingConfigPathWith(path, baseCwd, format);
-  const content =
+  if (schemaRef !== undefined) {
+    yield* failIfSchemaTooNew(filePath, cliConfigFormatForPath(filePath), {
+      ref: schemaRef,
+      version: versionOfSchemaRef(schemaRef),
+    });
+  }
+  let content =
     format === "json"
       ? encodeCliConfigToJsonDocument(options.config, schemaRef)
       : encodeCliConfigToTomlDocument(options.config, schemaRef);
+  const existingText = (yield* fs.exists(filePath))
+    ? yield* fs.readFileString(filePath).pipe(Effect.option)
+    : Option.none<string>();
+  if (Option.isSome(existingText)) {
+    if (format === "json") {
+      content = updateJsonDocument(existingText.value, parseJsonc(content)) ?? content;
+    } else {
+      const directive = SCHEMA_DIRECTIVE_LINE.exec(existingText.value)?.[0];
+      if (directive !== undefined && !content.startsWith("#:schema")) {
+        content = `${directive}\n${content}`;
+      }
+    }
+  }
 
   yield* fs.makeDirectory(path.dirname(filePath), { recursive: true });
   yield* writeFileAtomic(filePath, content);
-  if (yield* fs.exists(siblingPath)) {
-    yield* fs.remove(siblingPath);
+  for (const otherPath of allPaths) {
+    if (otherPath !== filePath && (yield* fs.exists(otherPath))) {
+      yield* fs.remove(otherPath);
+    }
   }
 
   return {
diff --git a/packages/config/src/io.unit.test.ts b/packages/config/src/io.unit.test.ts
index 75795f54bf..4730ae0608 100644
--- a/packages/config/src/io.unit.test.ts
+++ b/packages/config/src/io.unit.test.ts
@@ -32,12 +32,20 @@ import {
   decodeCliConfigDocumentForValidationEffect,
   loadCliConfig,
   loadCliConfigFile,
+  parseCliConfigDocumentFile,
   remoteNameForProjectRef,
   remoteProjectIdEntries,
   saveCliConfig,
   writeCliConfigDocumentText,
 } from "./io.ts";
 import { loadCliConfig as loadCliConfigFromNode } from "./node.ts";
+import { findCliProjectPaths } from "./paths.ts";
+import { JsoncSyntaxError } from "./jsonc.ts";
+import {
+  CliConfigFileConflictError,
+  CliConfigParseError,
+  CliConfigSchemaVersionError,
+} from "./errors.ts";
 import { cliConfigStoreLayer } from "./cli-config.layer.ts";
 import { CliConfigStore } from "./cli-config.service.ts";
 import { CLI_CONFIG_SCHEMA_URL } from "./schema-metadata.ts";
@@ -208,7 +216,7 @@ describe("config io", () => {
       }),
     ));
 
-  test("rejects JSON comments and trailing commas", () =>
+  test("loads config.json with comments and trailing commas", () =>
     runConfigEffect(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
@@ -221,7 +229,7 @@ describe("config io", () => {
           path,
           `{
   // project ref
-  "project_id": "abc123",
+  "project_id": "abcdefghijklmnopqrst",
   "db": {
     "major_version": 16,
   }
@@ -229,9 +237,9 @@ describe("config io", () => {
 `,
         );
 
-        const exit = yield* Effect.exit(loadCliConfigFile(path));
+        const loaded = yield* loadCliConfigFile(path);
 
-        expect(Exit.isFailure(exit)).toBe(true);
+        expect(loaded.config.db.major_version).toBe(16);
       }),
     ));
 
@@ -476,6 +484,177 @@ stack = true
       }),
     ));
 
+  test("loads a commented config.jsonc and discovers it from a nested cwd", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const nestedCwd = join(cwd, "apps", "web");
+        const jsoncPath = join(cwd, "supabase", "config.jsonc");
+
+        yield* fs.makeDirectory(nestedCwd, { recursive: true });
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(
+          jsoncPath,
+          `{
+  // project ref
+  "project_id": "jsonc_ref",
+  "db": { "major_version": 16, },
+}
+`,
+        );
+
+        const loaded = yield* loadCliConfig(nestedCwd);
+        expect(loaded?.format).toBe("json");
+        expect(loaded?.path.endsWith("config.jsonc")).toBe(true);
+        expect(loaded?.config.project_id).toBe("jsonc_ref");
+        expect(loaded?.config.db.major_version).toBe(16);
+
+        const paths = yield* findCliProjectPaths(nestedCwd);
+        expect(paths?.configPath).toBe(jsoncPath);
+        expect(paths?.projectRoot).toBe(cwd);
+      }),
+    ));
+
+  test("fails loading with CliConfigFileConflictError when config.json and config.jsonc both exist", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const jsonPath = join(cwd, "supabase", "config.json");
+        const jsoncPath = join(cwd, "supabase", "config.jsonc");
+
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(jsonPath, `{"project_id": "from_json"}`);
+        yield* fs.writeFileString(jsoncPath, `{"project_id": "from_jsonc"}`);
+
+        const exit = yield* Effect.exit(loadCliConfig(cwd));
+        const error = Exit.isFailure(exit) ? Cause.findErrorOption(exit.cause) : Option.none();
+
+        expect(Option.isSome(error)).toBe(true);
+        if (Option.isSome(error)) {
+          expect(error.value).toBeInstanceOf(CliConfigFileConflictError);
+          if (error.value instanceof CliConfigFileConflictError) {
+            expect(error.value.paths).toEqual([jsonPath, jsoncPath]);
+            expect(error.value.message).toBe(
+              "Found both supabase/config.json and supabase/config.jsonc. Keep one and delete the other.",
+            );
+          }
+        }
+      }),
+    ));
+
+  test("fails saving with CliConfigFileConflictError and leaves both files untouched", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const jsonPath = join(cwd, "supabase", "config.json");
+        const jsoncPath = join(cwd, "supabase", "config.jsonc");
+        const jsonText = `{"project_id": "from_json"}`;
+        const jsoncText = `// keep me\n{"project_id": "from_jsonc"}`;
+
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(jsonPath, jsonText);
+        yield* fs.writeFileString(jsoncPath, jsoncText);
+
+        const exit = yield* Effect.exit(saveCliConfig({ cwd, config: sampleConfig }));
+        const error = Exit.isFailure(exit) ? Cause.findErrorOption(exit.cause) : Option.none();
+
+        expect(Option.isSome(error)).toBe(true);
+        if (Option.isSome(error)) {
+          expect(error.value).toBeInstanceOf(CliConfigFileConflictError);
+          if (error.value instanceof CliConfigFileConflictError) {
+            expect(error.value.paths).toEqual([jsonPath, jsoncPath]);
+            expect(error.value.message).toBe(
+              "Found both supabase/config.json and supabase/config.jsonc. Keep one and delete the other.",
+            );
+          }
+        }
+        expect(yield* fs.readFileString(jsonPath)).toBe(jsonText);
+        expect(yield* fs.readFileString(jsoncPath)).toBe(jsoncText);
+      }),
+    ));
+
+  test("prefers config.jsonc over config.toml and reports the toml as ignored", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const jsoncPath = join(cwd, "supabase", "config.jsonc");
+        const tomlPath = yield* configTomlPath(cwd);
+
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(jsoncPath, `{ // wins\n "project_id": "jsonc_ref" }`);
+        yield* fs.writeFileString(tomlPath, `project_id = "toml-ref"\n`);
+
+        const loaded = yield* loadCliConfig(cwd);
+        expect(loaded?.path).toBe(jsoncPath);
+        expect(loaded?.config.project_id).toBe("jsonc_ref");
+        expect(loaded?.ignoredPaths).toEqual([tomlPath]);
+      }),
+    ));
+
+  test("saves back to config.jsonc without creating config.json and removes a sibling config.toml", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const jsonPath = join(cwd, "supabase", "config.json");
+        const jsoncPath = join(cwd, "supabase", "config.jsonc");
+        const tomlPath = yield* configTomlPath(cwd);
+
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(jsoncPath, `{ // old\n "project_id": "old_ref" }`);
+        yield* fs.writeFileString(tomlPath, `project_id = "toml-ref"\n`);
+
+        const saved = yield* saveCliConfig({ cwd, config: sampleConfig });
+
+        expect(saved.format).toBe("json");
+        expect(saved.path).toBe(jsoncPath);
+        expect(yield* fs.exists(jsonPath)).toBe(false);
+        expect(yield* fs.exists(tomlPath)).toBe(false);
+        const reloaded = yield* loadCliConfig(cwd);
+        expect(reloaded?.path).toBe(jsoncPath);
+        expect(reloaded?.config.project_id).toBe("ref_123");
+      }),
+    ));
+
+  test("returns a CliConfigParseError caused by a JsoncSyntaxError with line and column for malformed config.jsonc", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const jsoncPath = join(cwd, "supabase", "config.jsonc");
+
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(jsoncPath, `{\n  // note\n  "project_id": ,\n}`);
+
+        const exit = yield* Effect.exit(loadCliConfig(cwd));
+        const error = Exit.isFailure(exit) ? Cause.findErrorOption(exit.cause) : Option.none();
+
+        expect(Option.isSome(error)).toBe(true);
+        if (Option.isSome(error)) {
+          expect(error.value).toBeInstanceOf(CliConfigParseError);
+          if (error.value instanceof CliConfigParseError) {
+            expect(error.value.path).toBe(jsoncPath);
+            expect(error.value.format).toBe("json");
+            expect(error.value.cause).toBeInstanceOf(JsoncSyntaxError);
+            if (error.value.cause instanceof JsoncSyntaxError) {
+              expect(error.value.cause.line).toBe(3);
+              expect(error.value.cause.column).toBe(17);
+            }
+          }
+        }
+      }),
+    ));
+
   test("loads TOML instead of JSON when tomlOnly is set, even if JSON exists", () =>
     runConfigEffect(
       Effect.gen(function* () {
@@ -521,6 +700,61 @@ stack = true
       }),
     ));
 
+  test("loads TOML with tomlOnly when config.json and config.jsonc conflict", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(join(cwd, "supabase", "config.json"), `{"project_id": "a"}`);
+        yield* fs.writeFileString(join(cwd, "supabase", "config.jsonc"), `{"project_id": "b"}`);
+        yield* fs.writeFileString(
+          join(cwd, "supabase", "config.toml"),
+          `project_id = "toml-ref"\n`,
+        );
+
+        const loaded = yield* loadCliConfig(cwd, { tomlOnly: true });
+        expect(loaded?.format).toBe("toml");
+        expect(loaded?.config.project_id).toBe("toml-ref");
+      }),
+    ));
+
+  test("returns null when tomlOnly is set and only config.jsonc exists", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(join(cwd, "supabase", "config.jsonc"), `{"project_id": "b"}`);
+
+        const loaded = yield* loadCliConfig(cwd, { tomlOnly: true });
+        expect(loaded).toBeNull();
+      }),
+    ));
+
+  test("writes config.toml and removes config.jsonc when saving TOML in a JSONC project", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const jsoncPath = join(cwd, "supabase", "config.jsonc");
+
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(jsoncPath, `// c\n{"project_id": "b"}`);
+
+        const saved = yield* saveCliConfig({ cwd, config: sampleConfig, format: "toml" });
+
+        expect(saved.path).toBe(join(cwd, "supabase", "config.toml"));
+        expect(yield* fs.exists(saved.path)).toBe(true);
+        expect(yield* fs.exists(jsoncPath)).toBe(false);
+      }),
+    ));
+
   test("loads TOML when JSON is absent", () =>
     runConfigEffect(
       Effect.gen(function* () {
@@ -884,6 +1118,101 @@ major_version = 16
       }),
     ));
 
+  test("saving over a commented config.jsonc keeps comments, updates changed values and removes dropped keys cleanly", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const jsoncPath = join(cwd, "supabase", "config.jsonc");
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(
+          jsoncPath,
+          `{
+  // project identity
+  "project_id": "old_ref", // renamed below
+  /* database settings */
+  "db": {
+    "pooler": {
+      "enabled": true, // keep pooling on
+      "pool_mode": "session",
+    },
+  },
+}
+`,
+        );
+
+        const saved = yield* saveCliConfig({ cwd, config: sampleConfig });
+
+        expect(saved.path).toBe(jsoncPath);
+        expect(yield* fs.readFileString(jsoncPath)).toBe(`{
+  // project identity
+  "project_id": "ref_123", // renamed below
+  /* database settings */
+  "db": {
+    "pooler": {
+      "enabled": true, // keep pooling on
+    },
+  },
+}
+`);
+        const loaded = yield* loadCliConfig(cwd);
+        expect(loaded?.config).toEqual(sampleConfig);
+      }),
+    ));
+
+  test("removing the last key of an object in a strict config.json keeps the file valid JSON", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const jsonPath = yield* configJsonPath(cwd);
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(
+          jsonPath,
+          `{
+  "project_id": "ref_123",
+  "db": {
+    "pooler": {
+      "enabled": true,
+      "pool_mode": "session"
+    }
+  }
+}
+`,
+        );
+
+        yield* saveCliConfig({ cwd, config: sampleConfig });
+
+        const written = yield* fs.readFileString(jsonPath);
+        expect(yield* decodeJson(written)).toMatchObject({
+          project_id: "ref_123",
+          db: { pooler: { enabled: true } },
+        });
+        expect(written).not.toContain("pool_mode");
+      }),
+    ));
+
+  test("saving TOML over a config.toml keeps its leading #:schema directive first", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+        const tomlPath = yield* configTomlPath(cwd);
+        const directive = "#:schema https://example.com/config.schema.json";
+        yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+        yield* fs.writeFileString(tomlPath, `${directive}\nproject_id = "old_ref"\n`);
+
+        yield* saveCliConfig({ cwd, config: sampleConfig });
+
+        const written = yield* fs.readFileString(tomlPath);
+        expect(written.split("\n")[0]).toBe(directive);
+        expect(written).toContain('project_id = "ref_123"');
+      }),
+    ));
+
   test("preserves the discovered project format when saving from a nested cwd", () =>
     runConfigEffect(
       Effect.gen(function* () {
@@ -3159,3 +3488,341 @@ describe("decodeCliConfigDocumentForValidationEffect", () => {
       }),
     ));
 });
+
+describe("config io schema version", () => {
+  const v = (n: string) => `https://supabase.com/schemas/config/v${n}.json`;
+
+  const writeConfig = (name: string, content: string) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const { join } = yield* Path.Path;
+      const cwd = yield* makeTempProject();
+      const path = join(cwd, "supabase", name);
+      yield* fs.makeDirectory(join(cwd, "supabase"), { recursive: true });
+      yield* fs.writeFileString(path, content);
+      return { cwd, path };
+    });
+
+  const failureOf = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    Effect.gen(function* () {
+      const exit = yield* Effect.exit(effect);
+      const error = Exit.isFailure(exit) ? Cause.findErrorOption(exit.cause) : Option.none();
+      expect(Option.isSome(error)).toBe(true);
+      return Option.getOrThrow(error);
+    });
+
+  const tooNew: ReadonlyArray<{
+    readonly name: string;
+    readonly file: string;
+    readonly content: string;
+    readonly version: bigint;
+  }> = [
+    { name: "config.json", file: "config.json", content: `{"$schema": "${v("2")}"}`, version: 2n },
+    {
+      name: "config.jsonc",
+      file: "config.jsonc",
+      content: `{\n // c\n "$schema": "${v("2")}",\n}`,
+      version: 2n,
+    },
+    {
+      name: "config.toml directive",
+      file: "config.toml",
+      content: `#:schema ${v("2")}\nproject_id = "x"\n`,
+      version: 2n,
+    },
+    {
+      name: "config.toml $schema key",
+      file: "config.toml",
+      content: `"$schema" = "${v("2")}"\n`,
+      version: 2n,
+    },
+    {
+      name: "config.toml with a body smol-toml cannot parse",
+      file: "config.toml",
+      content: `#:schema ${v("2")}\n[db\nfuture = = syntax\n`,
+      version: 2n,
+    },
+    {
+      name: "config.toml with a version past the safe integer range",
+      file: "config.toml",
+      content: `#:schema ${v("99999999999999999999")}\n`,
+      version: 99999999999999999999n,
+    },
+  ];
+
+  test("a version past the safe integer range serializes to JSON with every digit", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const { cwd } = yield* writeConfig(
+          "config.toml",
+          `#:schema ${v("99999999999999999999")}\n`,
+        );
+
+        const error = yield* failureOf(loadCliConfig(cwd));
+
+        expect(error).toBeInstanceOf(CliConfigSchemaVersionError);
+        // oxlint-disable-next-line effecttsgo/prefer-schema-over-json -- the contract under test is plain JSON.stringify
+        expect(JSON.stringify(error)).toContain('"declaredVersion":"99999999999999999999"');
+      }),
+    ));
+
+  const whitespaceTolerantDirectives: ReadonlyArray<readonly [string, string]> = [
+    ["trailing spaces", `#:schema ${v("2")}  \nproject_id = "x"\n`],
+    ["a trailing tab", `#:schema ${v("2")}\t\nproject_id = "x"\n`],
+    ["an indented directive", `  #:schema ${v("2")}\nproject_id = "x"\n`],
+    ["an indented comment before it", `  # note\n\t#:schema ${v("2")}\nproject_id = "x"\n`],
+  ];
+
+  test.each(whitespaceTolerantDirectives)(
+    "loadCliConfig fails on a v2 directive with %s",
+    (_name, content) =>
+      runConfigEffect(
+        Effect.gen(function* () {
+          const { cwd } = yield* writeConfig("config.toml", content);
+
+          expect(yield* failureOf(loadCliConfig(cwd))).toBeInstanceOf(CliConfigSchemaVersionError);
+        }),
+      ),
+  );
+
+  test.each(tooNew)(
+    "loadCliConfig fails on a newer schema in $name",
+    ({ file, content, version }) =>
+      runConfigEffect(
+        Effect.gen(function* () {
+          const { cwd, path } = yield* writeConfig(file, content);
+
+          const error = yield* failureOf(loadCliConfig(cwd));
+
+          expect(error).toBeInstanceOf(CliConfigSchemaVersionError);
+          expect(error).toMatchObject({
+            _tag: "CliConfigSchemaVersionError",
+            path,
+            declaredVersion: String(version),
+            supportedVersion: 1,
+          });
+          expect(error instanceof CliConfigSchemaVersionError ? error.message : "").toBe(
+            `supabase/${file} declares config schema v${version}, but this version of the Supabase CLI only reads up to v1. Upgrade the Supabase CLI to use this config.`,
+          );
+        }),
+      ),
+  );
+
+  test("loadCliConfigFile and parseCliConfigDocumentFile fail on a newer schema", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const { cwd, path } = yield* writeConfig("config.json", `{"$schema": "${v("2")}"}`);
+
+        expect(yield* failureOf(loadCliConfigFile(path))).toBeInstanceOf(
+          CliConfigSchemaVersionError,
+        );
+        expect(yield* failureOf(parseCliConfigDocumentFile(cwd))).toBeInstanceOf(
+          CliConfigSchemaVersionError,
+        );
+      }),
+    ));
+
+  test("saveCliConfig over a newer-schema file fails and leaves the bytes unchanged", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const content = `// keep me\n{"$schema": "${v("2")}", "project_id": "x"}`;
+        const { cwd, path } = yield* writeConfig("config.jsonc", content);
+
+        const error = yield* failureOf(saveCliConfig({ cwd, config: sampleConfig }));
+
+        expect(error).toBeInstanceOf(CliConfigSchemaVersionError);
+        expect(yield* fs.readFileString(path)).toBe(content);
+      }),
+    ));
+
+  test("saveCliConfig with an explicit schemaRef over a newer-schema file fails and leaves the bytes unchanged", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const content = `// keep me\n{"$schema": "${v("2")}", "project_id": "x"}`;
+        const { cwd, path } = yield* writeConfig("config.jsonc", content);
+
+        const error = yield* failureOf(
+          saveCliConfig({ cwd, config: sampleConfig, schemaRef: CLI_CONFIG_SCHEMA_URL }),
+        );
+
+        expect(error).toBeInstanceOf(CliConfigSchemaVersionError);
+        expect(yield* fs.readFileString(path)).toBe(content);
+      }),
+    ));
+
+  test("saveCliConfig with an explicit schemaRef overwrites an existing file that does not parse", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { cwd, path } = yield* writeConfig("config.toml", `[db\nbroken = = 1\n`);
+
+        yield* saveCliConfig({ cwd, config: sampleConfig, schemaRef: CLI_CONFIG_SCHEMA_URL });
+
+        const written = yield* fs.readFileString(path);
+        expect(written).toContain('project_id = "ref_123"');
+        expect(written).not.toContain("broken");
+      }),
+    ));
+
+  test("saveCliConfig with an explicit schemaRef over an unparseable TOML with a v2 directive fails and leaves the bytes unchanged", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const content = `#:schema ${v("2")}\n[db\nbroken = = 1\n`;
+        const { cwd, path } = yield* writeConfig("config.toml", content);
+
+        const error = yield* failureOf(
+          saveCliConfig({ cwd, config: sampleConfig, schemaRef: CLI_CONFIG_SCHEMA_URL }),
+        );
+
+        expect(error).toBeInstanceOf(CliConfigSchemaVersionError);
+        expect(yield* fs.readFileString(path)).toBe(content);
+      }),
+    ));
+
+  test("saveCliConfig with a newer explicit schemaRef fails and writes nothing", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const cwd = yield* makeTempProject();
+
+        const error = yield* failureOf(
+          saveCliConfig({ cwd, config: sampleConfig, schemaRef: v("2") }),
+        );
+
+        expect(error).toBeInstanceOf(CliConfigSchemaVersionError);
+        expect(yield* fs.exists(join(cwd, "supabase", "config.json"))).toBe(false);
+      }),
+    ));
+
+  test("saveCliConfig to JSON fails and keeps a TOML file whose $schema key is newer than its directive", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const content = `#:schema ${v("1")}\n"$schema" = "${v("2")}"\nproject_id = "x"\n`;
+        const { cwd, path } = yield* writeConfig("config.toml", content);
+
+        const error = yield* failureOf(
+          saveCliConfig({ cwd, config: sampleConfig, format: "json" }),
+        );
+
+        expect(error).toBeInstanceOf(CliConfigSchemaVersionError);
+        expect(yield* fs.readFileString(path)).toBe(content);
+      }),
+    ));
+
+  test("saveCliConfig fails and keeps a shadowed config.toml that declares a newer schema", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const { join } = yield* Path.Path;
+        const { cwd } = yield* writeConfig("config.json", `{"project_id": "x"}`);
+        const tomlPath = join(cwd, "supabase", "config.toml");
+        const toml = `#:schema ${v("2")}\nproject_id = "y"\n`;
+        yield* fs.writeFileString(tomlPath, toml);
+
+        const error = yield* failureOf(saveCliConfig({ cwd, config: sampleConfig }));
+
+        expect(error).toBeInstanceOf(CliConfigSchemaVersionError);
+        expect(yield* fs.readFileString(tomlPath)).toBe(toml);
+      }),
+    ));
+
+  const loadsAsBefore: ReadonlyArray<{
+    readonly name: string;
+    readonly file: string;
+    readonly content: string;
+  }> = [
+    {
+      name: "v1 JSON",
+      file: "config.json",
+      content: `{"$schema": "${v("1")}", "project_id": "x"}`,
+    },
+    { name: "undeclared JSON", file: "config.json", content: `{"project_id": "x"}` },
+    {
+      name: "v1 TOML directive",
+      file: "config.toml",
+      content: `#:schema ${v("1")}\nproject_id = "x"\n`,
+    },
+    { name: "undeclared TOML", file: "config.toml", content: `project_id = "x"\n` },
+    {
+      name: "legacy docs URL",
+      file: "config.json",
+      content: `{"$schema": "https://supabase.com/docs/cli/config.schema.json", "project_id": "x"}`,
+    },
+    {
+      name: "legacy node_modules path",
+      file: "config.jsonc",
+      content: `{"$schema": "./node_modules/@supabase/config/schema.json", "project_id": "x"}`,
+    },
+    {
+      name: "unrecognized URL",
+      file: "config.json",
+      content: `{"$schema": "https://example.com/x.json", "project_id": "x"}`,
+    },
+    {
+      name: "a directive that follows other content",
+      file: "config.toml",
+      content: `project_id = "x"\n#:schema ${v("2")}\n`,
+    },
+  ];
+
+  test.each(loadsAsBefore)("loadCliConfig still loads $name", ({ file, content }) =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const { cwd } = yield* writeConfig(file, content);
+
+        const loaded = yield* loadCliConfig(cwd);
+
+        expect(loaded?.config.project_id).toBe("x");
+      }),
+    ),
+  );
+
+  test("a malformed TOML file without a newer schema still fails with CliConfigParseError", () =>
+    runConfigEffect(
+      Effect.gen(function* () {
+        const { cwd } = yield* writeConfig("config.toml", `#:schema ${v("1")}\n[db\n`);
+
+        expect(yield* failureOf(loadCliConfig(cwd))).toBeInstanceOf(CliConfigParseError);
+      }),
+    ));
+
+  const declarations: ReadonlyArray<{
+    readonly name: string;
+    readonly file: string;
+    readonly content: string;
+    readonly expected: { readonly ref: string; readonly version: bigint | undefined } | undefined;
+  }> = [
+    {
+      name: "a TOML directive",
+      file: "config.toml",
+      content: `#:schema ${v("1")}\n`,
+      expected: { ref: v("1"), version: 1n },
+    },
+    {
+      name: "a JSON $schema",
+      file: "config.json",
+      content: `{"$schema": "https://example.com/x.json"}`,
+      expected: { ref: "https://example.com/x.json", version: undefined },
+    },
+    { name: "nothing", file: "config.json", content: "{}", expected: undefined },
+  ];
+
+  test.each(declarations)(
+    "parseCliConfigDocumentFile exposes schemaDeclaration for $name",
+    ({ file, content, expected }) =>
+      runConfigEffect(
+        Effect.gen(function* () {
+          const { cwd } = yield* writeConfig(file, content);
+
+          const parsed = yield* parseCliConfigDocumentFile(cwd);
+
+          expect(parsed?.schemaDeclaration).toEqual(expected);
+        }),
+      ),
+  );
+});
diff --git a/packages/config/src/json-schema-document.ts b/packages/config/src/json-schema-document.ts
index 3972512f20..d95f918618 100644
--- a/packages/config/src/json-schema-document.ts
+++ b/packages/config/src/json-schema-document.ts
@@ -8,6 +8,12 @@ const HOISTED_ANNOTATIONS = new Set(["title", "description", "default", "example
 const DATA_KEYWORDS = new Set(["default", "examples", "enum", "const"]);
 const SCHEMA_MAP_KEYWORDS = new Set(["properties", "patternProperties"]);
 
+/**
+ * Annotation that keeps a union rendered as its own nested `anyOf` inside an enclosing union, which
+ * effect 4.1 otherwise splices into the parent; the key itself is not published.
+ */
+export const NESTED_UNION_ANNOTATION = "x-nested-union";
+
 /**
  * Renders a published draft-07 JSON Schema document, carrying the `x-secret` marker through and
  * keeping pattern-keyed records open: the generator writes a boolean `additionalProperties` on them
@@ -25,10 +31,10 @@ export function toPublishedJsonSchemaDocument(
 ) {
   const document = Schema.toJsonSchemaDocument(schema, {
     onExcessProperty: options.onExcessProperty,
-    includeAnnotationKey: (key) => key === "x-secret",
+    includeAnnotationKey: (key) => key === "x-secret" || key === NESTED_UNION_ANNOTATION,
   });
-  const root = openPatternKeyedRecords(document.schema);
-  const definitions = openPatternKeyedRecords(document.definitions);
+  const root = withoutSafeIntegerBounds(normalizeGeneratedSchema(document.schema));
+  const definitions = withoutSafeIntegerBounds(normalizeGeneratedSchema(document.definitions));
   const published = JsonSchema.toDocumentDraft07({
     dialect: "draft-2020-12",
     schema: options.acceptEnvReferences ? acceptEnvReferences(root) : root,
@@ -43,17 +49,31 @@ export function toPublishedJsonSchemaDocument(
   };
 }
 
-function openPatternKeyedRecords<T>(node: T): T {
-  if (Array.isArray(node)) return node.map(openPatternKeyedRecords) as T;
+function normalizeGeneratedSchema<T>(node: T): T {
+  if (Array.isArray(node)) return node.map(normalizeGeneratedSchema) as T;
   if (typeof node !== "object" || node === null) return node;
   const out: Record<string, unknown> = {};
-  for (const [key, value] of Object.entries(node)) out[key] = openPatternKeyedRecords(value);
+  for (const [key, value] of Object.entries(node)) out[key] = normalizeGeneratedSchema(value);
+  delete out[NESTED_UNION_ANNOTATION];
   if (isRecordLike(out) && typeof out["additionalProperties"] === "boolean") {
     delete out["additionalProperties"];
   }
   return (singleObjectAllOf(out) ?? out) as T;
 }
 
+/** Drops the safe-integer bounds effect 4.1 renders for `isInt`, which published schemas never carried. */
+export function withoutSafeIntegerBounds<T>(node: T): T {
+  if (Array.isArray(node)) return node.map(withoutSafeIntegerBounds) as T;
+  if (typeof node !== "object" || node === null) return node;
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(node)) out[key] = withoutSafeIntegerBounds(value);
+  if (out["type"] === "integer") {
+    if (out["minimum"] === Number.MIN_SAFE_INTEGER) delete out["minimum"];
+    if (out["maximum"] === Number.MAX_SAFE_INTEGER) delete out["maximum"];
+  }
+  return out as T;
+}
+
 function singleObjectAllOf(node: Record<string, unknown>): Record<string, unknown> | undefined {
   const allOf = node["allOf"];
   if (Object.keys(node).length !== 2 || node["type"] !== "object") return undefined;
diff --git a/packages/config/src/jsonc.ts b/packages/config/src/jsonc.ts
new file mode 100644
index 0000000000..dabc635b36
--- /dev/null
+++ b/packages/config/src/jsonc.ts
@@ -0,0 +1,92 @@
+import { printParseErrorCode, visit, type ParseErrorCode } from "jsonc-parser";
+import { setOwnProperty } from "./sparse.ts";
+
+/** A JSONC document failed to parse; `line` and `column` are 1-based and the message never quotes source text. */
+// oxlint-disable-next-line effecttsgo/extends-native-error -- only ever a thrown cause, never an Effect failure.
+export class JsoncSyntaxError extends Error {
+  override readonly name = "JsoncSyntaxError";
+  readonly reason: string;
+  readonly line: number;
+  readonly column: number;
+
+  constructor(reason: string, line: number, column: number) {
+    super(`${reason} (line ${line}, column ${column})`);
+    this.reason = reason;
+    this.line = line;
+    this.column = column;
+  }
+}
+
+function describeErrorCode(code: ParseErrorCode): string {
+  const words = printParseErrorCode(code)
+    .replace(/([a-z])([A-Z])/g, "$1 $2")
+    .toLowerCase();
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+
+type Container = { readonly value: Record<string, unknown> | unknown[]; key?: string };
+
+/** Parses JSON with comments and trailing commas, keeping `__proto__` keys as own properties like `JSON.parse`. */
+export function parseJsonc(text: string): unknown {
+  const source = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+  const stack: Container[] = [];
+  let root: unknown;
+  let failure: JsoncSyntaxError | undefined;
+
+  const attach = (value: unknown, key?: string) => {
+    const parent = stack[stack.length - 1];
+    if (parent === undefined) {
+      root = value;
+    } else if (Array.isArray(parent.value)) {
+      parent.value.push(value);
+    } else if (key !== undefined) {
+      setOwnProperty(parent.value, key, value);
+    }
+  };
+
+  visit(
+    source,
+    {
+      onObjectBegin: () => {
+        stack.push({ value: {} });
+      },
+      onObjectProperty: (property) => {
+        const top = stack[stack.length - 1];
+        if (top !== undefined) {
+          top.key = property;
+        }
+      },
+      onObjectEnd: () => {
+        const done = stack.pop();
+        if (done !== undefined) {
+          attach(done.value, stack[stack.length - 1]?.key);
+        }
+      },
+      onArrayBegin: () => {
+        stack.push({ value: [] });
+      },
+      onArrayEnd: () => {
+        const done = stack.pop();
+        if (done !== undefined) {
+          attach(done.value, stack[stack.length - 1]?.key);
+        }
+      },
+      onLiteralValue: (value) => {
+        attach(value, stack[stack.length - 1]?.key);
+      },
+      onError: (code, _offset, _length, startLine, startCharacter) => {
+        failure ??= new JsoncSyntaxError(
+          describeErrorCode(code),
+          startLine + 1,
+          startCharacter + 1,
+        );
+      },
+    },
+    { allowTrailingComma: true, disallowComments: false, allowEmptyContent: false },
+  );
+
+  if (failure !== undefined) {
+    throw failure;
+  }
+  return root;
+}
diff --git a/packages/config/src/jsonc.unit.test.ts b/packages/config/src/jsonc.unit.test.ts
new file mode 100644
index 0000000000..1e42e88b16
--- /dev/null
+++ b/packages/config/src/jsonc.unit.test.ts
@@ -0,0 +1,88 @@
+import { describe, expect, test } from "vitest";
+import { JsoncSyntaxError, parseJsonc } from "./jsonc.ts";
+
+function syntaxErrorFor(text: string): JsoncSyntaxError {
+  try {
+    parseJsonc(text);
+  } catch (error) {
+    if (error instanceof JsoncSyntaxError) {
+      return error;
+    }
+    throw error;
+  }
+  throw new Error("expected parseJsonc to throw");
+}
+
+describe("parseJsonc", () => {
+  test("parses comments and trailing commas to the value strict JSON gives for the cleaned text", () => {
+    const jsonc = `{
+  // line comment
+  "name": "a // not a comment",
+  /* block
+     comment */
+  "list": [1, 2, {"x": null,},],
+  "nested": {"on": true, "n": -1.5e2,},
+}`;
+    const strict = `{"name":"a // not a comment","list":[1,2,{"x":null}],"nested":{"on":true,"n":-1.5e2}}`;
+
+    expect(parseJsonc(jsonc)).toEqual(JSON.parse(strict));
+  });
+
+  test("keeps a __proto__ key as an own property without changing the prototype", () => {
+    const parsed = parseJsonc(`{"__proto__": {"polluted": true}, "safe": 1}`) as Record<
+      string,
+      unknown
+    >;
+    const strict = JSON.parse(`{"__proto__": {"polluted": true}, "safe": 1}`) as Record<
+      string,
+      unknown
+    >;
+
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+    expect(Object.hasOwn(parsed, "__proto__")).toBe(true);
+    expect(parsed["__proto__"]).toEqual({ polluted: true });
+    expect(Object.keys(parsed)).toEqual(Object.keys(strict));
+    expect(({} as Record<string, unknown>)["polluted"]).toBeUndefined();
+  });
+
+  test("keeps a nested __proto__ key as an own property", () => {
+    const parsed = parseJsonc(`{"a": {"__proto__": 1}}`) as { a: Record<string, unknown> };
+
+    expect(Object.getPrototypeOf(parsed.a)).toBe(Object.prototype);
+    expect(Object.hasOwn(parsed.a, "__proto__")).toBe(true);
+  });
+
+  test("reports a 1-based line and column for a syntax error", () => {
+    const error = syntaxErrorFor(`{\n  "a": 1,\n  "b": ,\n}`);
+
+    expect(error).toBeInstanceOf(JsoncSyntaxError);
+    expect(error.line).toBe(3);
+    expect(error.column).toBe(8);
+    expect(error.message).toBe(`${error.reason} (line 3, column 8)`);
+  });
+
+  test("reports line 1 column 1 for a leading syntax error", () => {
+    const error = syntaxErrorFor(`}`);
+
+    expect(error.line).toBe(1);
+    expect(error.column).toBe(1);
+  });
+
+  test("never quotes the surrounding source in the error message", () => {
+    const secret = "sk_live_SUPERSECRET123";
+    const error = syntaxErrorFor(`{"token": "${secret}" "other": 1}`);
+
+    expect(error.message).not.toContain(secret);
+    expect(error.reason).not.toContain(secret);
+    expect(error.message).toMatch(/\(line 1, column \d+\)$/);
+  });
+
+  test("accepts a leading BOM", () => {
+    expect(parseJsonc(`{"a": 1}`)).toEqual({ a: 1 });
+  });
+
+  test("throws on an empty document", () => {
+    expect(() => parseJsonc("")).toThrow(JsoncSyntaxError);
+    expect(() => parseJsonc("  // only a comment\n")).toThrow(JsoncSyntaxError);
+  });
+});
diff --git a/packages/config/src/lib/schema.ts b/packages/config/src/lib/schema.ts
index f00f2675f1..1895ec43d8 100644
--- a/packages/config/src/lib/schema.ts
+++ b/packages/config/src/lib/schema.ts
@@ -1,4 +1,4 @@
-import { Schema } from "effect";
+import { type Effect, Schema, SchemaGetter, type SchemaIssue } from "effect";
 
 interface LinkMetadata {
   readonly name: string;
@@ -22,3 +22,20 @@ export const stringEnum = <Values extends ReadonlyArray<string>>(
   const schema = Schema.Literals(values);
   return annotations === undefined ? schema : schema.annotate(annotations);
 };
+
+/**
+ * Record-value counterpart of `Schema.withDecodingDefault`: an entry whose value is `undefined`
+ * decodes to the `Encoded` default. Record values reject `Schema.optional`, so the encoded side is
+ * `Schema.UndefinedOr` instead.
+ */
+export const withRecordValueDecodingDefault =
+  <S extends Schema.Constraint, R = never>(
+    defaultValue: Effect.Effect<S["Encoded"], SchemaIssue.Issue, R>,
+  ) =>
+  (self: S) =>
+    Schema.UndefinedOr(Schema.toEncoded(self)).pipe(
+      Schema.decodeTo(self, {
+        decode: SchemaGetter.withDefault(defaultValue),
+        encode: SchemaGetter.passthrough(),
+      }),
+    );
diff --git a/packages/config/src/paths.ts b/packages/config/src/paths.ts
index 0e04e8905c..779a40e30e 100644
--- a/packages/config/src/paths.ts
+++ b/packages/config/src/paths.ts
@@ -22,19 +22,21 @@ const findConfigInRoot = Effect.fnUntraced(function* (root: string) {
   const path = yield* Path.Path;
   const supabaseDir = path.join(root, "supabase");
   const jsonPath = path.join(supabaseDir, "config.json");
+  const jsoncPath = path.join(supabaseDir, "config.jsonc");
   const tomlPath = path.join(supabaseDir, "config.toml");
 
   const jsonExists = yield* probeExists(fs.exists(jsonPath));
+  const jsoncExists = yield* probeExists(fs.exists(jsoncPath));
   const tomlExists = yield* probeExists(fs.exists(tomlPath));
 
-  if (!jsonExists && !tomlExists) {
+  if (!jsonExists && !jsoncExists && !tomlExists) {
     return null;
   }
 
   return {
     projectRoot: root,
     supabaseDir,
-    configPath: jsonExists ? jsonPath : tomlPath,
+    configPath: jsonExists ? jsonPath : jsoncExists ? jsoncPath : tomlPath,
     envPath: path.join(supabaseDir, ".env"),
     envLocalPath: path.join(supabaseDir, ".env.local"),
   } satisfies CliProjectPaths;
diff --git a/packages/config/src/project-config/api-attributes.ts b/packages/config/src/project-config/api-attributes.ts
index 2967b7408c..4852f7c021 100644
--- a/packages/config/src/project-config/api-attributes.ts
+++ b/packages/config/src/project-config/api-attributes.ts
@@ -69,6 +69,8 @@ const networkRestrictionsAttributes = Schema.Struct({
       }),
     ),
   ),
+  pending_allowed_cidrs: Schema.optionalKey(Schema.Unknown),
+  pending_requested_at: Schema.optionalKey(Schema.Unknown),
   updated_at: Schema.optionalKey(Schema.Unknown),
   applied_at: Schema.optionalKey(Schema.Unknown),
 });
@@ -101,6 +103,8 @@ const apiAttributes = Schema.Struct({
   max_rows: Schema.optionalKey(ApiNumber),
   db_pool_acquisition_timeout: Schema.optionalKey(Schema.Unknown),
   db_pool: Schema.optionalKey(Schema.Unknown),
+  db_pool_max_lifetime: Schema.optionalKey(Schema.Unknown),
+  db_pool_max_idletime: Schema.optionalKey(Schema.Unknown),
 });
 
 // No `realtime.*` field is mapped; keys stay declared as `Schema.Unknown` (rather than dropping
diff --git a/packages/config/src/project-config/registry-auth.ts b/packages/config/src/project-config/registry-auth.ts
index d87785978c..f1f13cbc2b 100644
--- a/packages/config/src/project-config/registry-auth.ts
+++ b/packages/config/src/project-config/registry-auth.ts
@@ -601,6 +601,10 @@ const emailBaseRows: ReadonlyArray<ProjectConfigMappingRow> = [
     ["auth", "email", "secure_password_change"],
     "security_update_password_require_reauthentication",
   ),
+  boolRow(
+    ["auth", "email", "require_current_password"],
+    "security_update_password_require_current_password",
+  ),
   uintRow(["auth", "email", "otp_length"], "mailer_otp_length"),
   uintRow(["auth", "email", "otp_expiry"], "mailer_otp_exp"),
   secondsDurationRow(["auth", "email", "max_frequency"], "smtp_max_frequency"),
diff --git a/packages/config/src/project-config/registry.ts b/packages/config/src/project-config/registry.ts
index 4843d1e9e2..1c0a3aa3b2 100644
--- a/packages/config/src/project-config/registry.ts
+++ b/packages/config/src/project-config/registry.ts
@@ -107,7 +107,8 @@ const apiSectionRows: ReadonlyArray<ProjectConfigMappingRow> = [
     },
     normalizeDocument: normalizeDocumentMaxRows,
   },
-  // Unmapped (no config counterpart): api.db_pool, api.db_pool_acquisition_timeout.
+  // Unmapped (no config counterpart): api.db_pool, api.db_pool_acquisition_timeout,
+  // api.db_pool_max_lifetime, api.db_pool_max_idletime.
 ];
 
 /** Settings fields whose remote value is a signed int, clamped to uint. */
@@ -269,7 +270,7 @@ const dbSectionRows: ReadonlyArray<ProjectConfigMappingRow> = [
     unit: "type-tagged {address,type}[] → filtered string[] (v6)",
   },
   // Unmapped (no faithful counterpart): database.network_restrictions.{entitlement,status,
-  // updated_at,applied_at}. `db.network_restrictions.enabled` has no API-side counterpart at
+  // pending_allowed_cidrs,pending_requested_at,updated_at,applied_at}. `db.network_restrictions.enabled` has no API-side counterpart at
   // all — it's a purely local management switch, not an unmapped API field.
   {
     configPath: ["db", "pooler", "pool_mode"],
diff --git a/packages/config/src/promise-facade.ts b/packages/config/src/promise-facade.ts
index 0757dbc04d..feb77033be 100644
--- a/packages/config/src/promise-facade.ts
+++ b/packages/config/src/promise-facade.ts
@@ -16,9 +16,9 @@ import { CliConfigStore } from "./cli-config.service.ts";
 
 /**
  * A rejection from `loadCliConfig`, `loadCliConfigFile`, or `saveCliConfig` carries one of
- * `CliConfigParseError`, `CliConfigRemovedKeyError`, `DuplicateRemoteProjectIdError`,
- * `InvalidRemoteProjectIdError`, `CliProjectEnvParseError`, or a `PlatformError` for a host/OS
- * failure — check with `instanceof`.
+ * `CliConfigParseError`, `CliConfigRemovedKeyError`, `CliConfigFileConflictError`,
+ * `CliConfigSchemaVersionError`, `DuplicateRemoteProjectIdError`, `InvalidRemoteProjectIdError`, `CliProjectEnvParseError`, or a
+ * `PlatformError` for a host/OS failure — check with `instanceof`.
  */
 export interface CliConfigIo {
   readonly loadCliConfig: (
diff --git a/packages/config/src/schema-metadata.ts b/packages/config/src/schema-metadata.ts
index 09fc1bcc5a..905330fa79 100644
--- a/packages/config/src/schema-metadata.ts
+++ b/packages/config/src/schema-metadata.ts
@@ -1,3 +1,5 @@
 export const CLI_CONFIG_SCHEMA_URL = "https://supabase.com/schemas/config/v1.json";
 /** Sibling of {@link CLI_CONFIG_SCHEMA_URL} for `ProjectConfigSchema`'s generated JSON Schema document. */
 export const PROJECT_CONFIG_SCHEMA_URL = "https://supabase.com/schemas/project-config/v1.json";
+/** Highest config schema version this package reads. */
+export const SUPPORTED_CLI_CONFIG_SCHEMA_VERSION = 1;
diff --git a/packages/config/src/schema-version.ts b/packages/config/src/schema-version.ts
new file mode 100644
index 0000000000..4312a36e7d
--- /dev/null
+++ b/packages/config/src/schema-version.ts
@@ -0,0 +1,55 @@
+import { cliConfigSchemaKey, isObject } from "./config-document.ts";
+import type { ConfigFormat } from "./config-format.ts";
+
+export interface CliConfigSchemaDeclaration {
+  readonly ref: string;
+  /** `undefined` when the reference is not a recognized Supabase config schema URL. */
+  readonly version: bigint | undefined;
+}
+
+export const SCHEMA_DIRECTIVE_LINE = /^[ \t]*#:schema[ \t]+(\S+)[ \t]*(?=\r?\n|$)/;
+
+const VERSIONED_SCHEMA_URL = /^https:\/\/supabase\.com\/schemas\/config\/v([1-9]\d*)\.json$/;
+const LEGACY_SCHEMA_URL = "https://supabase.com/docs/cli/config.schema.json";
+const PACKAGE_SCHEMA_PATH = /node_modules[\\/]@supabase[\\/]config[\\/](?:dist[\\/])?schema\.json$/;
+
+/** Returns the config schema version a `$schema`/`#:schema` reference declares, if any. */
+export function versionOfSchemaRef(ref: string): bigint | undefined {
+  if (ref === LEGACY_SCHEMA_URL || PACKAGE_SCHEMA_PATH.test(ref)) {
+    return 1n;
+  }
+  const digits = VERSIONED_SCHEMA_URL.exec(ref)?.[1];
+  return digits === undefined ? undefined : BigInt(digits);
+}
+
+function leadingTomlDirective(text: string): string | undefined {
+  for (const line of text.replace(/^/, "").split("\n")) {
+    const trimmed = line.replace(/\r$/, "");
+    if (trimmed.trim() === "") {
+      continue;
+    }
+    if (!trimmed.trimStart().startsWith("#")) {
+      return undefined;
+    }
+    const match = SCHEMA_DIRECTIVE_LINE.exec(trimmed);
+    if (match !== null) {
+      return match[1];
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Reads the schema a config file declares: `$schema` in JSON/JSONC, a leading `#:schema` directive
+ * (or a top-level `$schema` key) in TOML. Pass `document` as `undefined` before it has been parsed.
+ */
+export function readCliConfigSchemaDeclaration(
+  text: string,
+  format: ConfigFormat,
+  document: unknown,
+): CliConfigSchemaDeclaration | undefined {
+  const directive = format === "toml" ? leadingTomlDirective(text) : undefined;
+  const key = isObject(document) ? document[cliConfigSchemaKey] : undefined;
+  const ref = directive ?? (typeof key === "string" ? key : undefined);
+  return ref === undefined ? undefined : { ref, version: versionOfSchemaRef(ref) };
+}
diff --git a/packages/config/src/schema-version.unit.test.ts b/packages/config/src/schema-version.unit.test.ts
new file mode 100644
index 0000000000..70cf5e97f0
--- /dev/null
+++ b/packages/config/src/schema-version.unit.test.ts
@@ -0,0 +1,197 @@
+import { describe, expect, test } from "vitest";
+import type { ConfigFormat } from "./config-format.ts";
+import { readCliConfigSchemaDeclaration } from "./schema-version.ts";
+
+const versioned = (n: string) => `https://supabase.com/schemas/config/v${n}.json`;
+
+describe("readCliConfigSchemaDeclaration", () => {
+  const cases: ReadonlyArray<{
+    readonly name: string;
+    readonly text: string;
+    readonly format: ConfigFormat;
+    readonly document?: unknown;
+    readonly expected: { readonly ref: string; readonly version: bigint | undefined } | undefined;
+  }> = [
+    {
+      name: "reads $schema from a JSON document",
+      text: "",
+      format: "json",
+      document: { $schema: versioned("2") },
+      expected: { ref: versioned("2"), version: 2n },
+    },
+    {
+      name: "ignores a TOML-style directive in a JSON file",
+      text: `#:schema ${versioned("2")}\n`,
+      format: "json",
+      document: {},
+      expected: undefined,
+    },
+    {
+      name: "reads a leading TOML directive before the document is parsed",
+      text: `#:schema ${versioned("3")}\n[db]\n`,
+      format: "toml",
+      document: undefined,
+      expected: { ref: versioned("3"), version: 3n },
+    },
+    {
+      name: "allows a BOM, blank lines and comments before the directive",
+      text: `\n# a comment\n\r\n#:schema ${versioned("2")}\r\n[db]\r\n`,
+      format: "toml",
+      expected: { ref: versioned("2"), version: 2n },
+    },
+    {
+      name: "strips a BOM directly before the directive",
+      text: `\uFEFF#:schema ${versioned("2")}\r\n[db]\r\n`,
+      format: "toml",
+      expected: { ref: versioned("2"), version: 2n },
+    },
+    {
+      name: "reads a directive with trailing spaces",
+      text: `#:schema ${versioned("2")}  \n[db]\n`,
+      format: "toml",
+      expected: { ref: versioned("2"), version: 2n },
+    },
+    {
+      name: "reads a directive with a trailing tab and CRLF",
+      text: `#:schema ${versioned("2")}\t\r\n[db]\r\n`,
+      format: "toml",
+      expected: { ref: versioned("2"), version: 2n },
+    },
+    {
+      name: "reads an indented directive",
+      text: `  \t#:schema ${versioned("2")}\n[db]\n`,
+      format: "toml",
+      expected: { ref: versioned("2"), version: 2n },
+    },
+    {
+      name: "reads a directive after an indented ordinary comment",
+      text: `  # note\n#:schema ${versioned("2")}\n[db]\n`,
+      format: "toml",
+      expected: { ref: versioned("2"), version: 2n },
+    },
+    {
+      name: "ignores an indented table header before a directive",
+      text: `  [db]\n#:schema ${versioned("2")}\n`,
+      format: "toml",
+      document: { db: {} },
+      expected: undefined,
+    },
+    {
+      name: "ignores a directive that follows a non-comment line",
+      text: `project_id = "x"\n#:schema ${versioned("2")}\n`,
+      format: "toml",
+      document: { project_id: "x" },
+      expected: undefined,
+    },
+    {
+      name: "ignores a directive that follows a table header",
+      text: `[db]\n#:schema ${versioned("2")}\n`,
+      format: "toml",
+      document: { db: {} },
+      expected: undefined,
+    },
+    {
+      name: "ignores a comment that only looks like a directive",
+      text: `# :schema ${versioned("2")}\n`,
+      format: "toml",
+      document: {},
+      expected: undefined,
+    },
+    {
+      name: "falls back to a top-level $schema key in TOML",
+      text: `"$schema" = "${versioned("2")}"\n`,
+      format: "toml",
+      document: { $schema: versioned("2") },
+      expected: { ref: versioned("2"), version: 2n },
+    },
+    {
+      name: "prefers the TOML directive over the $schema key",
+      text: `#:schema ${versioned("1")}\n"$schema" = "${versioned("5")}"\n`,
+      format: "toml",
+      document: { $schema: versioned("5") },
+      expected: { ref: versioned("1"), version: 1n },
+    },
+    {
+      name: "ignores a non-string $schema",
+      text: "",
+      format: "json",
+      document: { $schema: 2 },
+      expected: undefined,
+    },
+    {
+      name: "returns undefined when nothing is declared",
+      text: "[db]\n",
+      format: "toml",
+      document: { db: {} },
+      expected: undefined,
+    },
+    {
+      name: "keeps every digit of a version beyond the safe integer range",
+      text: "",
+      format: "json",
+      document: { $schema: versioned("99999999999999999999") },
+      expected: { ref: versioned("99999999999999999999"), version: 99999999999999999999n },
+    },
+    {
+      name: "reads the legacy docs URL as v1",
+      text: "",
+      format: "json",
+      document: { $schema: "https://supabase.com/docs/cli/config.schema.json" },
+      expected: { ref: "https://supabase.com/docs/cli/config.schema.json", version: 1n },
+    },
+    {
+      name: "reads a node_modules package path with forward slashes as v1",
+      text: "",
+      format: "json",
+      document: { $schema: "../node_modules/@supabase/config/schema.json" },
+      expected: { ref: "../node_modules/@supabase/config/schema.json", version: 1n },
+    },
+    {
+      name: "reads a node_modules package path with backslashes as v1",
+      text: "",
+      format: "json",
+      document: { $schema: "..\\node_modules\\@supabase\\config\\schema.json" },
+      expected: { ref: "..\\node_modules\\@supabase\\config\\schema.json", version: 1n },
+    },
+    {
+      name: "reads the built dist/schema.json path with forward slashes as v1",
+      text: "",
+      format: "json",
+      document: { $schema: "../node_modules/@supabase/config/dist/schema.json" },
+      expected: { ref: "../node_modules/@supabase/config/dist/schema.json", version: 1n },
+    },
+    {
+      name: "reads the built dist/schema.json path with backslashes as v1",
+      text: "",
+      format: "json",
+      document: { $schema: "..\\node_modules\\@supabase\\config\\dist\\schema.json" },
+      expected: {
+        ref: "..\\node_modules\\@supabase\\config\\dist\\schema.json",
+        version: 1n,
+      },
+    },
+    ...[
+      versioned("0"),
+      versioned("01"),
+      versioned("-1"),
+      versioned("1.5"),
+      versioned(""),
+      "http://supabase.com/schemas/config/v2.json",
+      `${versioned("2")}?x=1`,
+      `${versioned("2")}#top`,
+      "https://example.com/x.json",
+      "./node_modules/@supabase/config/schema.json.bak",
+      "./node_modules/@supabase/config/dist/other/schema.json",
+    ].map((ref) => ({
+      name: `treats ${ref} as unrecognized`,
+      text: "",
+      format: "json" as const,
+      document: { $schema: ref },
+      expected: { ref, version: undefined },
+    })),
+  ];
+
+  test.each(cases)("$name", ({ text, format, document, expected }) => {
+    expect(readCliConfigSchemaDeclaration(text, format, document)).toEqual(expected);
+  });
+});
diff --git a/packages/config/src/storage.ts b/packages/config/src/storage.ts
index 876e527727..fa12d7b862 100644
--- a/packages/config/src/storage.ts
+++ b/packages/config/src/storage.ts
@@ -1,4 +1,6 @@
 import { Effect, Schema, SchemaGetter } from "effect";
+import { NESTED_UNION_ANNOTATION } from "./json-schema-document.ts";
+import { withRecordValueDecodingDefault } from "./lib/schema.ts";
 
 const links = [
   {
@@ -35,7 +37,7 @@ const defaultVectorBuckets = {};
 const emptyTable = Schema.Union([
   Schema.Record(Schema.String, Schema.Unknown),
   Schema.Array(Schema.Unknown),
-]);
+]).annotate({ [NESTED_UNION_ANNOTATION]: true });
 
 // Accepts a human-readable string (`"50MiB"`) or a bare byte count (`5000000`); a numeric
 // value is normalized to its decimal string so the decoded type is always a `string`.
@@ -77,7 +79,7 @@ const bucketSchema = Schema.Struct({
     description: "The path to the objects in the bucket.",
     tags,
   }).pipe(Schema.withDecodingDefaultKey(Effect.succeed(defaultBucketObjectsPath))),
-}).pipe(Schema.withDecodingDefault(Effect.succeed({})));
+}).pipe(withRecordValueDecodingDefault(Effect.succeed({})));
 
 export const storage = Schema.Struct({
   enabled: Schema.Boolean.annotate({
@@ -146,7 +148,9 @@ export const storage = Schema.Struct({
     }).pipe(Schema.withDecodingDefaultKey(Effect.succeed(defaultMaxCatalogs))),
     buckets: Schema.Record(
       Schema.String,
-      emptyTable.pipe(Schema.withDecodingDefault(Effect.succeed({ ...defaultAnalyticsBuckets }))),
+      emptyTable.pipe(
+        withRecordValueDecodingDefault(Effect.succeed({ ...defaultAnalyticsBuckets })),
+      ),
     )
       .annotate({
         default: defaultAnalyticsBuckets,
@@ -176,7 +180,7 @@ export const storage = Schema.Struct({
     }).pipe(Schema.withDecodingDefaultKey(Effect.succeed(defaultMaxIndexes))),
     buckets: Schema.Record(
       Schema.String,
-      emptyTable.pipe(Schema.withDecodingDefault(Effect.succeed({ ...defaultVectorBuckets }))),
+      emptyTable.pipe(withRecordValueDecodingDefault(Effect.succeed({ ...defaultVectorBuckets }))),
     )
       .annotate({
         default: defaultVectorBuckets,
diff --git a/packages/config/src/unknown-keys.ts b/packages/config/src/unknown-keys.ts
new file mode 100644
index 0000000000..40b98d4ea7
--- /dev/null
+++ b/packages/config/src/unknown-keys.ts
@@ -0,0 +1,54 @@
+import { Cause, Exit, Option, Schema, type SchemaIssue } from "effect";
+import { CliConfigSchema, RemotesSchema } from "./base.ts";
+import { cliConfigSchemaKey, isObject } from "./config-document.ts";
+
+const parseOptions = { onExcessProperty: "error", errors: "all", disableChecks: true } as const;
+const decodeCliConfig = Schema.decodeUnknownExit(CliConfigSchema, parseOptions);
+const decodeRemotes = Schema.decodeUnknownExit(RemotesSchema, parseOptions);
+
+type KeyPath = ReadonlyArray<string>;
+
+const SEPARATOR = "\u0000";
+const encodePath = (path: KeyPath): string => path.join(SEPARATOR);
+
+/** A union reports a key only when every member that rejected the value flagged it. */
+const intersect = (sets: ReadonlyArray<Set<string>>): Set<string> => {
+  const [first, ...rest] = sets;
+  return new Set([...(first ?? [])].filter((key) => rest.every((set) => set.has(key))));
+};
+
+const collect = (issue: SchemaIssue.Issue, prefix: KeyPath): Set<string> => {
+  switch (issue._tag) {
+    case "Pointer":
+      return collect(issue.issue, [...prefix, ...issue.path.map(String)]);
+    case "Composite":
+      return new Set(issue.issues.flatMap((child) => [...collect(child, prefix)]));
+    case "AnyOf":
+      return intersect(issue.issues.map((child) => collect(child, prefix)));
+    case "Encoding":
+    case "Filter":
+      return collect(issue.issue, prefix);
+    case "UnexpectedKey":
+      return new Set([encodePath(prefix)]);
+    default:
+      return new Set();
+  }
+};
+
+const unknownKeysOf = (exit: Exit.Exit<unknown, Schema.SchemaError>, prefix: KeyPath) => {
+  if (Exit.isSuccess(exit)) return new Set<string>();
+  const error = Cause.findErrorOption(exit.cause);
+  return Option.isSome(error) ? collect(error.value.issue, prefix) : new Set<string>();
+};
+
+/**
+ * Key paths in a raw config document that `CliConfigSchema` does not accept, remote blocks under
+ * `["remotes", <name>, ...]`. Pass a document already normalized for deprecated keys.
+ */
+export function findUnknownCliConfigKeys(document: unknown): ReadonlyArray<KeyPath> {
+  if (!isObject(document)) return [];
+  const { [cliConfigSchemaKey]: _schemaKey, remotes, ...base } = document;
+  const keys = unknownKeysOf(decodeCliConfig({ ...base, remotes: {} }), []);
+  const remoteKeys = unknownKeysOf(decodeRemotes(remotes ?? {}), ["remotes"]);
+  return [...keys, ...remoteKeys].sort().map((encoded) => encoded.split(SEPARATOR));
+}
diff --git a/packages/config/src/unknown-keys.unit.test.ts b/packages/config/src/unknown-keys.unit.test.ts
new file mode 100644
index 0000000000..4bb368d456
--- /dev/null
+++ b/packages/config/src/unknown-keys.unit.test.ts
@@ -0,0 +1,79 @@
+import { describe, expect, test } from "vitest";
+import { findUnknownCliConfigKeys } from "./unknown-keys.ts";
+
+describe("findUnknownCliConfigKeys", () => {
+  const unknown: ReadonlyArray<{
+    readonly name: string;
+    readonly document: unknown;
+    readonly expected: ReadonlyArray<ReadonlyArray<string>>;
+  }> = [
+    { name: "a top-level key", document: { bogus: 1 }, expected: [["bogus"]] },
+    { name: "a key in a table", document: { api: { foo: 1 } }, expected: [["api", "foo"]] },
+    {
+      name: "a key in a function entry",
+      document: { functions: { hello: { foo: true } } },
+      expected: [["functions", "hello", "foo"]],
+    },
+    {
+      name: "a key in an external auth provider",
+      document: { auth: { external: { github: { foo: 1 } } } },
+      expected: [["auth", "external", "github", "foo"]],
+    },
+    {
+      name: "a key in a storage bucket",
+      document: { storage: { buckets: { avatars: { foo: 1 } } } },
+      expected: [["storage", "buckets", "avatars", "foo"]],
+    },
+    {
+      name: "a key in a remote",
+      document: { remotes: { staging: { api: { foo: 1 } } } },
+      expected: [["remotes", "staging", "api", "foo"]],
+    },
+    {
+      name: "a key in a remote whose name contains a dot",
+      document: { remotes: { "a.b": { api: { foo: 1 } } } },
+      expected: [["remotes", "a.b", "api", "foo"]],
+    },
+    {
+      name: "unknown keys in the base and in a remote, sorted",
+      document: { bogus: 1, api: { foo: 1 }, remotes: { staging: { project_id: "x", nope: 1 } } },
+      expected: [["api", "foo"], ["bogus"], ["remotes", "staging", "nope"]],
+    },
+    {
+      name: "an unknown key beside a type error elsewhere",
+      document: { bogus: 1, api: { port: "not a number" } },
+      expected: [["bogus"]],
+    },
+  ];
+
+  test.each(unknown)("reports $name", ({ document, expected }) => {
+    expect(findUnknownCliConfigKeys(document)).toEqual(expected);
+  });
+
+  const clean: ReadonlyArray<{ readonly name: string; readonly document: unknown }> = [
+    { name: "an empty document", document: {} },
+    { name: "a non-object document", document: "nope" },
+    { name: "an undefined document", document: undefined },
+    { name: "the $schema key", document: { $schema: "https://example.com/x.json" } },
+    { name: "valid keys", document: { project_id: "x", api: { port: 54321 }, db: { port: 1 } } },
+    {
+      name: "env() strings on number and boolean fields",
+      document: {
+        api: { port: "env(API_PORT)", enabled: "env(API_ENABLED)" },
+        auth: { enable_signup: "env(SIGNUP)" },
+      },
+    },
+    {
+      name: "a valid document with type errors elsewhere",
+      document: { api: { port: "not a number" }, db: { port: [] } },
+    },
+    {
+      name: "a remote with only valid keys",
+      document: { remotes: { staging: { project_id: "x" } } },
+    },
+  ];
+
+  test.each(clean)("reports nothing for $name", ({ document }) => {
+    expect(findUnknownCliConfigKeys(document)).toEqual([]);
+  });
+});
diff --git a/packages/stack/ARCHITECTURE.md b/packages/stack/ARCHITECTURE.md
index 26afbad85c..84c9f08841 100644
--- a/packages/stack/ARCHITECTURE.md
+++ b/packages/stack/ARCHITECTURE.md
@@ -312,7 +312,7 @@ Validate composition references, input/output types and cycles when registering
 
 Composition start first assigns or reuses and binds every configured public listener of its selected members, including lazy members, and registers their routes. One worker per member then waits for its prerequisites' outcomes: a lazy member is armed (also after a prerequisite failed), and an eager member is started and awaited for readiness, or reported as blocked when a prerequisite failed. Prerequisites outside the configured members run as eager standalone instances. It does not select unrelated standalone instances. Successful start returns member observations with their public endpoints; credentials reads render usable connection strings from these assignments without starting lazy backends. A failed launch or readiness check makes the operation return an error with per-instance outcomes; a running but unhealthy instance remains running, and completed steps are not rolled back.
 
-After binding the shared API listener, default composition setup uses the endpoint renderer to populate ordinary configuration values: Studio receives `apiUrl` and `publicApiUrl`, Auth receives `externalApiUrl`, and Functions receives `apiUrl`. When the database has a configured SQL endpoint, Functions also receives its rendered `databaseUrl`; this saved value is refreshed when callers recompose the composition, and does not create a database readiness dependency for Function execution. These values are saved in each instance's configuration; individual starts and normal host reopening consume that configuration. This is concrete default setup code, not declarative input wiring or a public listener-binding API. The endpoint renderer owns the host/runtime reachability rules; custom configurations supply plain URLs through the same inputs. URL values do not imply graph edges.
+After binding the shared API listener, default composition setup uses the endpoint renderer to populate ordinary configuration values: Studio receives `apiUrl` and `publicApiUrl`, Auth receives `externalApiUrl`, plus `templateBaseUrl` beside a generated `templateToken` when it has templates, and Functions receives `apiUrl`. When the database has a configured SQL endpoint, Functions also receives its rendered `databaseUrl`; this saved value is refreshed when callers recompose the composition, and does not create a database readiness dependency for Function execution. These values are saved in each instance's configuration; individual starts and normal host reopening consume that configuration. This is concrete default setup code, not declarative input wiring or a public listener-binding API. The endpoint renderer owns the host/runtime reachability rules; custom configurations supply plain URLs through the same inputs. URL values do not imply graph edges.
 
 Composition restart is two passes: stop the selected instances in reverse dependency order, then perform composition start. If the stop pass fails, report partial results without beginning the start pass. Cancelling composition withdraws its waits; admitted executions continue in the owner scope, and launched instances remain until an explicit stop or owner close. Explicit empty selection is a no-op; there is no generic rollback engine.
 
@@ -604,7 +604,7 @@ The shared allocator manages physical public listeners. A service definition dec
 | Instance       | `(stack ID, instance ID, endpoint name)` | Database `sql`, Functions `inspector`                                  |
 | Stack          | `(stack ID, listener name)`              | Shared `api` listener serving REST, Auth, Storage and Functions routes |
 
-A shared listener is a networking resource, not a capability or service group. Composition maps each route to an individual instance ID. Traffic is attributed to the matched route's instance for wake and idle decisions; there is no aggregate service lifecycle.
+A shared listener is a networking resource, not a capability or service group. Composition maps each route to an individual instance ID. Traffic is attributed to the matched route's instance for wake and idle decisions; there is no aggregate service lifecycle. A file route, like Auth's `/email`, is answered by the owner process with no wake or activity; it reads its file on every request, only while the path resolves inside its root, through a no-follow handle that must still name the resolved file.
 
 | Address | Purpose                                                              | Lifetime                                                                               |
 | ------- | -------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
diff --git a/packages/stack/README.md b/packages/stack/README.md
index 21036cde44..076b6b8bcc 100644
--- a/packages/stack/README.md
+++ b/packages/stack/README.md
@@ -80,7 +80,7 @@ On Linux, native Functions project files must be outside `/tmp`: Edge Runtime us
 
 `find({ stateRoot, projectRoot, name })` derives the stack ID with the same identity rules as `create` and reads only that stack; `find({ stateRoot, id })` reads a known ID. It returns the saved definition with the live owner's endpoint, if any, or nothing when no such stack is saved. Unlike `discover`, an unreadable state document fails the call, naming the stack's directory, instead of being skipped. The Effect entrypoint's `StackId` schema validates an ID before lookup.
 
-`findDataConflicts({ stateRoot, projectRoot, requested })` reads the saved stacks of `projectRoot`, without any lease or owner probe, and lists what a start at the `requested` pins (a partial artifact selection) would refuse; it creates nothing, so a missing `stateRoot` has no conflicts. A `database-build` conflict is database data built from another upstream than `requested.database`: initialized data, judged by the rules a start applies for the stack's runtime, or the identity a Docker or Podman first start recorded before it was interrupted; its `recorded` is `undefined` for data with no recorded identity, and a newer slim-services revision of the same build is no conflict. A `schema-downgrade` conflict is a schema-owning service the saved composition binds to that database through its `databaseUrl`, requested older than the newest version recorded for it. Each conflict carries its `stackId`, the database `instanceId` that holds the data, and the `message` a start reports. Uninitialized data with no recorded identity never conflicts with a build. The messages offer to keep the data by pinning the recorded build in `[local.services.database] version`, also setting `[db] major_version` when the major differs and removing any `[db] orioledb_version` when an OrioleDB build is requested, before they offer to recreate the stack. `@supabase/stack/testing` exports `seedSavedStack` to save such a stack and its data records without starting anything.
+`findDataConflicts({ stateRoot, projectRoot, requested })` reads the saved stacks of `projectRoot`, without any lease or owner probe, and lists what a start at the `requested` pins (a partial artifact selection) would refuse; it creates nothing, so a missing `stateRoot` has no conflicts. A `database-build` conflict is database data built from another upstream than `requested.database`: initialized data, judged by the rules a start applies for the stack's runtime, or the identity a Docker or Podman first start recorded before it was interrupted; its `recorded` is `undefined` for data with no recorded identity, and a newer slim-services revision of the same build is no conflict. A `schema-downgrade` conflict is a schema-owning service the saved composition binds to that database through its `databaseUrl`, requested older than the newest version recorded for it. Each conflict carries its `stackId`, the database `instanceId` that holds the data, and the `message` a start reports. Uninitialized data with no recorded identity never conflicts with a build. The messages offer to keep the data by pinning the recorded build in `local.services.database.version`, also setting `db.major_version` when the major differs and removing any `db.orioledb_version` when an OrioleDB build is requested, in the project config file, before they offer to recreate the stack. `@supabase/stack/testing` exports `seedSavedStack` to save such a stack and its data records without starting anything.
 
 Pass `startOwner: true` to `open` when live status and other owner-backed operations are needed; this starts only the detached owner and does not start services. The owner writes its output to `<stateRoot>/<id>/owner.log`, which each owner start truncates; owner start and connection failures name that file. A client drives only an owner of its own release; other operations fail and ask you to stop or destroy the stack, which work across releases.
 
@@ -138,7 +138,10 @@ stacks still relies only on the kernel refusing a second bind. A native backend'
 ports are reserved directly from 10000–19999, disjoint from the public auto range and below the OS
 ephemeral range on every supported platform; this is not configurable, and a public port pinned
 inside it is rejected. A host whose ephemeral range has been widened to overlap 10000–19999
-reintroduces the ephemeral-port race this reservation exists to avoid.
+reintroduces the ephemeral-port race this reservation exists to avoid. The registry runs in SQLite's
+WAL mode, so `<passwd home>/.supabase` must be on a local filesystem: WAL's shared memory does not
+work over network mounts, and the registry location cannot be moved. While a connection is open,
+`ports.sqlite-wal` and `ports.sqlite-shm` sit next to `ports.sqlite`.
 
 Native PostgreSQL receives the owner's `SSL_CERT_FILE` and `SSL_CERT_DIR` when they are non-empty. When `SSL_CERT_FILE` is unset or empty, it receives the first of `/etc/ssl/certs/ca-certificates.crt`, `/etc/pki/tls/certs/ca-bundle.crt`, `/etc/ssl/ca-bundle.pem`, and `/etc/ssl/cert.pem` that exists, if any. The `http` and `pg_net` extensions verify HTTPS certificates against these. On macOS, `/etc/ssl/cert.pem` does not include roots added to the Keychain; to trust those, set `SSL_CERT_FILE` to a bundle that also holds the public roots, such as a copy of `/etc/ssl/cert.pem` with those roots appended. When PostgreSQL runs as a separate user, that user must be able to read the owner's `SSL_CERT_FILE` and `SSL_CERT_DIR` paths, which are not chowned to it. The detached owner inherits the environment of the client that starts it and keeps it until it exits, through restarts and repeated starts, so set these before the owner starts, and stop the stack before starting it again after changing them.
 
@@ -212,7 +215,9 @@ Bindings supply ordinary configuration values; a URL alone never creates a depen
 
 Exit confirmation is bounded. If cleanup is acknowledged but owner exit cannot be confirmed, the operation fails with `operation: "shutdown-exit"` and the owner PID in the message. A failed or cancelled call does not guarantee that teardown has completed. Do not start or restart the same stack concurrently with whole-stack shutdown; separate stacks remain independent.
 
-Each service exposes `status`, `followStatus`, `readLogs`, and `credentials`. The owner persists service output under `<stateRoot>/<id>/logs`; `readLogs({ from?, since?, tail?, follow? })` streams an instance's records through its live owner (`from` and `tail` are mutually exclusive), and `streamStackLogs({ stateRoot, stackId, instances?, since? })` from `@supabase/stack/effect` reads them without an owner, one instance after another in file order. Observations include the currently bound public endpoints, including listeners for sleeping services. Credentials default to host addressing. Use `from: "runtime"` for a URL passed to a service or command container.
+Each service exposes `status`, `followStatus`, `readLogs`, and `credentials`. The owner persists service output under `<stateRoot>/<id>/logs`; `readLogs({ from?, since?, tail?, follow? })` streams an instance's records through its live owner (`from` and `tail` are mutually exclusive), and `streamStackLogs({ stateRoot, stackId, instances?, since?, from? })` from `@supabase/stack/effect` reads them without an owner, one instance after another in file order. Each run of `streamStackLogs` captures the selected instances' segment generations and byte lengths before emitting records. It reads complete records within those bounds; later appends and rotations appear on the next run. `from` maps instance ids to record positions and resumes at each record's start, emitting that record again. If a resume generation or an intermediate segment is missing, a `lost` marker precedes the next retained record and uses its timestamp. `since` filters records and markers by timestamp.
+
+Observations include the currently bound public endpoints, including listeners for sleeping services. Credentials default to host addressing. Use `from: "runtime"` for a URL passed to a service or command container.
 
 ## Testing
 
@@ -253,7 +258,7 @@ const test = Effect.gen(function* () {
 The Effect entrypoint exposes the same operations as Effects and Streams. `create` and `open` return a handle that lasts until the enclosing `Scope` closes; closing the creating scope of a session stack destroys it. Database secrets use `Redacted` in the Effect configuration:
 
 ```ts
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { Effect, Layer } from "effect";
 import * as Stack from "@supabase/stack/effect";
 
@@ -268,7 +273,14 @@ const program = Effect.gen(function* () {
 await Effect.runPromise(
   program.pipe(
     Effect.scoped,
-    Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+    Effect.provide(
+      Layer.mergeAll(
+        NodeServices.layer,
+        NodeHttpClient.layerNodeHttp,
+        NodeCrypto.layerSecureRandom,
+        NodeCrypto.layerDigest,
+      ),
+    ),
   ),
 );
 ```
diff --git a/packages/stack/scripts/prepare-test-artifacts.ts b/packages/stack/scripts/prepare-test-artifacts.ts
index c98bb5c19c..63b54fadf3 100644
--- a/packages/stack/scripts/prepare-test-artifacts.ts
+++ b/packages/stack/scripts/prepare-test-artifacts.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeRuntime, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeRuntime, NodeServices } from "@effect/platform-node";
 import { Console, Effect, Layer } from "effect";
 import { catalogPins, prepareNativeArtifact } from "../src/Artifacts.ts";
 import { testArtifactCacheRoot } from "../tests/artifact-cache.ts";
@@ -21,6 +21,13 @@ const printImages = Effect.forEach(catalogPins(), ({ pin }) => Console.log(pin.i
 });
 
 (process.argv.includes("--images") ? printImages : prepareNative).pipe(
-  Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+  Effect.provide(
+    Layer.mergeAll(
+      NodeServices.layer,
+      NodeCrypto.layerSecureRandom,
+      NodeCrypto.layerDigest,
+      NodeHttpClient.layerNodeHttp,
+    ),
+  ),
   NodeRuntime.runMain,
 );
diff --git a/packages/stack/src/Artifacts.ts b/packages/stack/src/Artifacts.ts
index 0d0a81ebfa..a0034c74d1 100644
--- a/packages/stack/src/Artifacts.ts
+++ b/packages/stack/src/Artifacts.ts
@@ -127,23 +127,23 @@ const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
   database: definition(
     "postgres",
     {
-      upstreamVersion: "17.11.0.011",
+      upstreamVersion: "17.11.0.018",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/postgres:17.11.0.011-r0@sha256:9a0eae54eb663be4b8a021382e9d290eb1960398d3b9825856b81d6944c48834",
-      upstreamImage: "supabase/postgres:17.11.0.011",
+        "ghcr.io/supabase/cli/postgres:17.11.0.018-r0@sha256:4f5cf9d03718b200df8c8e4735081eaa55a74d11dca848f5c8283203921e5751",
+      upstreamImage: "supabase/postgres:17.11.0.018",
       natives: {
         "darwin-arm64": {
-          archive: "de01b042eb3da72a3bce4b00b8f07e4b22545d9a2aad83d5b312918eadb39f44",
-          manifest: "8298f20dac793bb997a3d0110bca2f7296ed038d18ded274a43317360955cbaf",
+          archive: "5033846ff2dc56a992e9bf929d62d132bd2819656e040d4a359632121a9722e7",
+          manifest: "9e6d77b467111e6b6dd822ebf5b100214ca5837b563556e97227b93332ae87ce",
         },
         "linux-amd64": {
-          archive: "986389e7cdfc81e30c5b2f8e3e15bca98377374c1124b80d1740d0035e657128",
-          manifest: "10ba0c16e8c5160be1dc7cf4e3698e661c8bd3bf7353b6f78e7022d9cf6a5591",
+          archive: "80c80a56481e65491eaafe1609eedafe0b35ee2ff10773adfb9ab34e5ebfa8c5",
+          manifest: "56c4b951f5dd16870fca927e221c2c289d23bd42514027594fab13ede672d9b1",
         },
         "linux-arm64": {
-          archive: "0baab2d07d1437c640aeed7cf60a851c1f81cb85426c8fe5ebfb7ac6ee06dbd0",
-          manifest: "ae8de4c02229ac55f5db9edd54cb01a674a3d06a858187245af97353707f4556",
+          archive: "e066fcea166bf302ba24779d32ff22150905860fe7fb067c415cff7efe7e5f3e",
+          manifest: "42883bbb35d4f165706eabc4bf66002636eb500ea1ff55915c539e970f768339",
         },
       },
     },
@@ -157,24 +157,24 @@ const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
       "bin/psql",
     ],
     {
-      "15.19.0.016": {
-        upstreamVersion: "15.19.0.016",
+      "15.19.0.018": {
+        upstreamVersion: "15.19.0.018",
         revision: 0,
         image:
-          "ghcr.io/supabase/cli/postgres:15.19.0.016-r0@sha256:722ac5537e2b5870253befe3e7edde371305038c03aa779c4cbee894f6d46cdf",
-        upstreamImage: "supabase/postgres:15.19.0.016",
+          "ghcr.io/supabase/cli/postgres:15.19.0.018-r0@sha256:b0b4057a43543546d54d74434b562721af4bf9a7802b53a00158dcec7059bb4b",
+        upstreamImage: "supabase/postgres:15.19.0.018",
         natives: {
           "darwin-arm64": {
-            archive: "39e86642da1e683d4cb318f6eee667ba3dc880aabe7555e3bec800105269fe98",
-            manifest: "7d97d341d01e2d2d871cd33235a1d391e9d226c8bc46ba212761f9438b98f162",
+            archive: "682bd39c23b0ef677e652f641f74862aa61b9a5472f51e29f5163b09876f6da4",
+            manifest: "27ad0dffd559ed1dc5e84ed368890dc1089d135d34a5591ce7b7640f5cf76aa6",
           },
           "linux-amd64": {
-            archive: "cc10dbbb79bcdc4cd34edb9343113a7849a17cabde39d4cbe7c2dbe977063f51",
-            manifest: "c965c997f85feba8273b30c56e351925c8eb3756e3beecfce351ad1d5446f91d",
+            archive: "3191c152650e7284d4168e71ab91f45e31fb690153c58d8f2a425e03ea86b4e1",
+            manifest: "0301008324b5df8c885066105dd59f4faf41974be54bec7a285b7d6dcc71a535",
           },
           "linux-arm64": {
-            archive: "35deb5146dfa49e6d4b5fc7eb329aa0cbbcbc2987cb331de81c6f2725f7b4836",
-            manifest: "e5f831e7e3a5caa255e5f2935115bd186785564483ad66fe6f9b55b08cfaa0c4",
+            archive: "21f3d647d844e19aa656802438992597f177d1b60545662e7244d6eb0be01248",
+            manifest: "04baea44897bd198c161460e0ae46bd304a349b0d8baf8885e158ec49aee8448",
           },
         },
       },
@@ -367,6 +367,48 @@ const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
           },
         },
       },
+      "17.11.0.017-orioledb": {
+        upstreamVersion: "17.11.0.017-orioledb",
+        revision: 0,
+        image:
+          "ghcr.io/supabase/cli/postgres:17.11.0.017-orioledb-r0@sha256:21e4be21bff828cf4164de76b526d695a5f58c7ba7bfeb152fc7a2065e82c9d1",
+        upstreamImage: "supabase/postgres:17.11.0.017-orioledb",
+        natives: {
+          "darwin-arm64": {
+            archive: "99055a53bd70fd72f5b42edf507f2f97fd9e1fcad85839f34cfb7958e5757752",
+            manifest: "b0dee24eb192969ec1dd2fbeca6f1f68f03e0a3f5760bd4b862796d4b7500bd1",
+          },
+          "linux-amd64": {
+            archive: "055f40a1bd648fac00d520f13e27a0b399f0495a327e89f3c3a02fdc462f4330",
+            manifest: "e284e1fc51a301cfb34866c31cd51224ca8d2adbcbbe96b3c7453530ff4d1b9f",
+          },
+          "linux-arm64": {
+            archive: "14baf5cfc84330a64e04f7ce28762a60dcde8fcff41bef85ce4c6491b3c7daf4",
+            manifest: "63f5b996fd842560f33b499bc36b0f8674cac2ab5b8941db22066f5b35ee6420",
+          },
+        },
+      },
+      "17.11.0.018-orioledb": {
+        upstreamVersion: "17.11.0.018-orioledb",
+        revision: 0,
+        image:
+          "ghcr.io/supabase/cli/postgres:17.11.0.018-orioledb-r0@sha256:5f160baf2fc9eb544aafa8dd33231a611d5c725242f0ecb89c41a422f35e3335",
+        upstreamImage: "supabase/postgres:17.11.0.018-orioledb",
+        natives: {
+          "darwin-arm64": {
+            archive: "ea145998919ee892a0f1b7d52163ba4d3665acc492a033f250a0de76b44886fb",
+            manifest: "c096a92f791110c000932877e1b6f83455a82d2da8cf9d7c273cbbbc8952721f",
+          },
+          "linux-amd64": {
+            archive: "eb715a98ed54059ca67fedf0c1bef6d8dce8e33d964d10531bce56dbe061459c",
+            manifest: "ce76378b7b29c3f47e16f70918e9357193eb229ef4cb30edb3a5c38b0fc3db03",
+          },
+          "linux-arm64": {
+            archive: "b8077d9a167a8341444d3185dbcb3cf57d5768f179ab7082740ba64d75925feb",
+            manifest: "57cbddaca5c392325b570c4e1f8166dbfce32c8e31ab0ad49d7fd88ce634d1d7",
+          },
+        },
+      },
     },
   ),
   rest: definition(
@@ -422,23 +464,23 @@ const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
   realtime: definition(
     "realtime",
     {
-      upstreamVersion: "v2.151.3",
+      upstreamVersion: "v2.154.0",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/realtime:v2.151.3-r0@sha256:7dfbc7b200b4c426bc069c5b736581a71d2606383ff84bc0d9f29c1b0fd8d413",
-      upstreamImage: "supabase/realtime:v2.151.3",
+        "ghcr.io/supabase/cli/realtime:v2.154.0-r0@sha256:e6b4e8032dcb0a83f355a860b061aa9b3a189f23d4e62ac9ae1f8cd5494ac54d",
+      upstreamImage: "supabase/realtime:v2.154.0",
       natives: {
         "darwin-arm64": {
-          archive: "6616f3c45dbf25200e59b12d989ab2a2e97513e87561f7a5c45eea56aa3cd9e6",
-          manifest: "44f950a123047828103d1955eb9e389e862f1159d429359958c10af04495ce6c",
+          archive: "15b041e0b8ade0d7cc7b195024930cf83d820f0a2118f18ffd3a9f6870eee143",
+          manifest: "761582da816b0c4f4fa4f77affcf194c3aff80d108d5be7783a06f8c0b26935d",
         },
         "linux-amd64": {
-          archive: "bf8cc9c184b2702273153ff1897ae890f75301727a586eaf13baedb856ad8198",
-          manifest: "3a5dded73d9f80ee30c378717e532f397c100debe65218925fb76c6d954811fc",
+          archive: "c70aed4bee8f0f2b4feea163b4ad410cfe029de957524b4122ec7d22077e8721",
+          manifest: "a22e690d7004d44d72860c097b5e863202946dd2f48148c2e635c8125a7d9b75",
         },
         "linux-arm64": {
-          archive: "4f752db9845d4621126974025b2942ac6440c7af0515212b6285cc6f4734e3fc",
-          manifest: "8bb1e37ffc611d38cc95eb21adbd1e712efd941e930bba5bad1bfe1b5cb7124a",
+          archive: "1c3d9f67fc8229d5fe8cf98f42f2a6038d31063bb68815ac16a1d46defb186fa",
+          manifest: "81b9b25e10f26e15b3c3da51f9660848e47e6735205285fc2c8f7b68df7a0145",
         },
       },
     },
@@ -448,23 +490,23 @@ const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
   storage: definition(
     "storage",
     {
-      upstreamVersion: "v1.88.0",
+      upstreamVersion: "v1.90.1",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/storage:v1.88.0-r0@sha256:59c0ac53a25df17578072e8121f8cb20ae2e72c762dcbf0120601aa7d4dbc138",
-      upstreamImage: "supabase/storage-api:v1.88.0",
+        "ghcr.io/supabase/cli/storage:v1.90.1-r0@sha256:21cffda72ebee5b43ee08f4f3add0f2b884cf751edca82759d7f81f69dffd9aa",
+      upstreamImage: "supabase/storage-api:v1.90.1",
       natives: {
         "darwin-arm64": {
-          archive: "5e820ff84e2a04c104e1ff188eb4afea5cec8ae0c4139410a58f37c38ff06308",
-          manifest: "8bdd6d989a489104d11151d5a7d108c1ca8a520d6704a86cf9d916b4947b24f9",
+          archive: "f9954fb4cea6bbb93dec7f5dd6064ae8acfeb5642a0eb5f64d0cf40866cff7f2",
+          manifest: "7c9ca7e1f6114d164215073ea70c89ace3f0e638c5a08644adecc10ff80560bc",
         },
         "linux-amd64": {
-          archive: "6e1b616343a8623cfa5176a851dc3bff89f11efd3bf3f533d36524597c6ef160",
-          manifest: "5e0a3be00a0d3d82a5b0566adb6a87a04dfc90feaabb6e4ce90472faa8a07ec2",
+          archive: "ea1d86e68d1c71a6f715b21093577ea40e51f8547b0ddac20077c3dc31adf56e",
+          manifest: "79f017444d2754525c1ac9b31c4705119007696841926616672a9792f5274490",
         },
         "linux-arm64": {
-          archive: "2d4c3726e6f89fdef9f3c87cea0228a99a63cba2e41d80874309b2cefaffb957",
-          manifest: "8059cfd35449c7f22b906cf46c1d3f655923c748605188cce830b4994a807387",
+          archive: "c9376533b4e1c35e636011c0ffe222852c51b76aa61842037f9019fd6f91d291",
+          manifest: "ad1f68a3bf9004d1fd87fe383864d0bb52ad018a7f60e4953efff54f626b1096",
         },
       },
     },
@@ -499,23 +541,23 @@ const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
   functions: definition(
     "edge-runtime",
     {
-      upstreamVersion: "v1.77.9",
+      upstreamVersion: "v1.78.1",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/edge-runtime:v1.77.9-r0@sha256:1d2d920e96fe72bdff308f855a30a60a51baf4d9c3b396c16b36eb193daf6f61",
-      upstreamImage: "supabase/edge-runtime:v1.77.9",
+        "ghcr.io/supabase/cli/edge-runtime:v1.78.1-r0@sha256:a38ced78be2ce14a251bb7e26f3daaf9c7d1970661d6985b59b2daae7183c359",
+      upstreamImage: "supabase/edge-runtime:v1.78.1",
       natives: {
         "darwin-arm64": {
-          archive: "d2d14cadc53254416c1ecc89dd0575efd4733cb72025ff97495d3a87980acf39",
-          manifest: "1d4ae4b525a5b6f5729e811664dbfdf60bb9bc453a5e71abf6947253c20563b0",
+          archive: "7cd12afbf4b0a77af110f0a1e69023b92d971fc01af5cdaba628c0b00167f3d9",
+          manifest: "7d03d2f1692c21ce59abea2766c4102584db2b60a7270b8da2cb9ecf4a698ae1",
         },
         "linux-amd64": {
-          archive: "d61748740756c192d83b2d5e6960bc20e2eb748fd7aee7620bfd4bf5854013b6",
-          manifest: "a25c0f4e9bfaa1583314906e1cb0ce06b5ac0a78f349e2db5f08a1ed669ce85e",
+          archive: "dc208bc658e4a60686aae6f6a463aa6ddd888732c23cf8a7fadd329fa94f3138",
+          manifest: "ce29be5661ee0f80636e4a05d09553230528ba1ce29788120504bfe7f37bc8e7",
         },
         "linux-arm64": {
-          archive: "5e247316b1965f84d8748de0da92e4c8d2af20d6d5e6dccdf5da35e7e0dfbff4",
-          manifest: "8e259a40d00950f311082b89517ebc04323d3c8106432c88f64e59f61c5c860e",
+          archive: "afaf0f11cb7887a147d6b3178a398f5de5a27fe2d52e1fb4e1efc5c1fec726a7",
+          manifest: "977f2bfab292118c28f7102c129c170357afd2afffb43ebd666453849e4e83a4",
         },
       },
     },
@@ -524,23 +566,23 @@ const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
   studio: definition(
     "studio",
     {
-      upstreamVersion: "2026.11.02-sha-a05e7ec",
+      upstreamVersion: "2026.11.09-sha-1567384",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/studio:2026.11.02-sha-a05e7ec-r0@sha256:1f52c2b338efac7ea4dc8717073c952d34956e1c9252052b1c1e3b9ce58c6158",
-      upstreamImage: "supabase/studio:2026.11.02-sha-a05e7ec",
+        "ghcr.io/supabase/cli/studio:2026.11.09-sha-1567384-r0@sha256:1f724b57e15a3f917a0a85d0bb2a8a103534c5de2ce3b5858f591c872384aa8d",
+      upstreamImage: "supabase/studio:2026.11.09-sha-1567384",
       natives: {
         "darwin-arm64": {
-          archive: "f1b1968ad29622e5f03091bf1088d3e9901d681887b65a04d7e69c0e22dc3765",
-          manifest: "88bbba67d77a30812ac4a776e64e7d8e90a301fa5e09543679cf88bfdeae859c",
+          archive: "3550504aa420ceb2cc817a35e4733c7ade51032c3000576685f46fa5ce25f945",
+          manifest: "d2d6e9d662ecb631503fe96de24fc918850dea3b1fee52cfd0aac039146d1aec",
         },
         "linux-amd64": {
-          archive: "90fa37ba2a3feced841d776c5ec5267beb6bcd4805ad87dbb60991e839ea1563",
-          manifest: "74b5a15a9ec239f9b03aa4a8bebfd231031f5bf8eac8794352d7b0ba40a5d55c",
+          archive: "b1eee34b803b0f50e5a44aba0d9d97e3acb9270b71134ba4fef0860e57e29c12",
+          manifest: "47c4aa51e821973b64431a06c6183b5f52ea79a52735eb7b1d2e400e970c7163",
         },
         "linux-arm64": {
-          archive: "ca61f893e5ac4db123a8d2a662a45d4648c9543030cb8be240d90744dae45aa9",
-          manifest: "cbbe733372e43c045c94ef7134e1fb362921e3e165341acf3511492e624469b5",
+          archive: "d01806320b1184078e69ebcbb3a87d83086c7f58cead5c45f540e69a449a25f6",
+          manifest: "a9f9a900a3b387c027dba2cb01e998ebe8cc738f0b3f516735194b0e274ad853",
         },
       },
     },
@@ -651,23 +693,23 @@ const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
   pooler: definition(
     "pooler",
     {
-      upstreamVersion: "v2.9.13",
-      revision: 1,
+      upstreamVersion: "v2.10.0",
+      revision: 0,
       image:
-        "ghcr.io/supabase/cli/pooler:v2.9.13-r1@sha256:f02ccc6e18ea77789978e248ac302a4e0955d03fdeeea0d63ac0b7a315595c60",
-      upstreamImage: "supabase/supavisor:2.9.13",
+        "ghcr.io/supabase/cli/pooler:v2.10.0-r0@sha256:c4badc5b631ed9a56b25d2726de251ba9b86d6d2a5dc08c339cb95bf3512798a",
+      upstreamImage: "supabase/supavisor:2.10.0",
       natives: {
         "darwin-arm64": {
-          archive: "aa53594e91144a6d33267b802152f0f42d35ca85e6efd13b9cd06f53e327fb5f",
-          manifest: "1c42764f1f706cb177ee4f066c6ebcb75e15a2399e8f552488a426718d9e2edd",
+          archive: "74a5b1df78eec18853d9f1e39a3d5e0333a3f9d7795c5e55763816843f332c49",
+          manifest: "0a27668907f5361eac033bd0ab75f82d1ee9a7479a2a9b2ebe0144015fdc860a",
         },
         "linux-amd64": {
-          archive: "ff1543cebb9331646294475c609c3e231618e46f1dca53108d35f3172c1fa705",
-          manifest: "1ef9f8041632ca0c96045f64092c880a3ad7a6af4febe7d0b43322b330fc19f8",
+          archive: "a9b51dd14ff6c77b71e559fab1616a3fb3ef67561dc09add37e6ea268cf37833",
+          manifest: "54731eb4f86dad54b28483892da51259612b7bed88eac253453558e3e1f5dc72",
         },
         "linux-arm64": {
-          archive: "ed08b8856a0516026321a47055fca5c30cea82f93dc3da8bb2ab81951342a20c",
-          manifest: "12e867a370fac6aa68f1e657840d30c9d4e5cae56f38da833a26e05c688c94ad",
+          archive: "31c56bc4cf405e9ee33648ef5ce515bcaa2f16ec815a03405e9c348e61c9792e",
+          manifest: "a99b2aab713a5da0738f81e7d7fb8552ca1bdcaa25d0bb7fd1729cf5d2d35050",
         },
       },
     },
@@ -705,7 +747,8 @@ const errorMessage = (cause: unknown): string =>
  * agent sandboxes that allow `*.amazonaws.com`.
  * @see ../../../infra/cli-artifacts/README.md
  */
-const SLIM_NATIVE_SUPABASE_S3_MIRROR = "https://supabase-cli-artifacts.s3.us-east-1.amazonaws.com";
+export const SLIM_NATIVE_SUPABASE_S3_MIRROR =
+  "https://supabase-cli-artifacts.s3.us-east-1.amazonaws.com";
 
 /** ECR Public mirror of every slim image, under the same tags and digests. */
 export const SLIM_IMAGE_SUPABASE_ECR_MIRROR = "public.ecr.aws/supabase/cli/";
diff --git a/packages/stack/src/Commands.integration.test.ts b/packages/stack/src/Commands.integration.test.ts
index 566f82d770..5ca57cc08e 100644
--- a/packages/stack/src/Commands.integration.test.ts
+++ b/packages/stack/src/Commands.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Context,
@@ -159,14 +159,22 @@ describe("finite PostgreSQL commands", { timeout: 180_000 }, () => {
           expect(dump.jobId).not.toBe(sql.jobId);
           expect(yield* Ref.get(stdout)).toContain("COPY public.tool_story");
           expect(yield* Ref.get(stdout)).toContain("streamed-row");
+          const clientFailure = (label: string, exitCode: number) =>
+            Effect.gen(function* () {
+              const [out, err] = [yield* Ref.get(stdout), yield* Ref.get(stderr)];
+              return `${label} psql exited ${exitCode}\nstdout:\n${out}\nstderr:\n${err}`;
+            });
+          yield* Ref.set(stdout, "");
+          yield* Ref.set(stderr, "");
           const failed = yield* runPostgres(runner, {
             postgres: postgres.psql({ pin: selection.database }),
             args: ["-X", "-v", "ON_ERROR_STOP=1", "-c", "SELECT missing_column FROM tool_story"],
             env,
             ...output,
           });
-          expect(failed.exitCode).not.toBe(0);
-          expect(yield* Ref.get(stderr)).toContain("missing_column");
+          const failedReport = yield* clientFailure("-c", failed.exitCode);
+          expect(failed.exitCode, failedReport).not.toBe(0);
+          expect(yield* Ref.get(stderr), failedReport).toContain("missing_column");
           const rejected = yield* Effect.flip(
             runPostgres(runner, {
               postgres: postgres.psql({ pin: selection.database }),
@@ -177,6 +185,7 @@ describe("finite PostgreSQL commands", { timeout: 180_000 }, () => {
             }),
           );
           expect(rejected.message).toContain("pgProve options require the pg_prove command");
+          yield* Ref.set(stdout, "");
           yield* Ref.set(stderr, "");
           const early = yield* runPostgres(runner, {
             postgres: postgres.psql({ pin: selection.database }),
@@ -189,8 +198,9 @@ describe("finite PostgreSQL commands", { timeout: 180_000 }, () => {
             ),
             ...output,
           });
-          expect(early.exitCode).not.toBe(0);
-          expect(yield* Ref.get(stderr)).toContain("missing_column");
+          const earlyReport = yield* clientFailure("early-exit stdin", early.exitCode);
+          expect(early.exitCode, earlyReport).not.toBe(0);
+          expect(yield* Ref.get(stderr), earlyReport).toContain("missing_column");
           const attached = yield* Deferred.make<void>();
           const job = yield* runPostgres(runner, {
             postgres: postgres.psql({ pin: selection.database }),
@@ -225,7 +235,11 @@ describe("finite PostgreSQL commands", { timeout: 180_000 }, () => {
           expect(yield* fs.readDirectory(`${root}/jobs`)).toEqual([]);
           yield* service.destroy;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     );
   }
 
@@ -426,7 +440,11 @@ describe("finite PostgreSQL commands", { timeout: 180_000 }, () => {
             }
             yield* service.destroy;
           }),
-        ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+        ).pipe(
+          Effect.provide(
+            Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+          ),
+        ),
       );
     }
   }
diff --git a/packages/stack/src/Defaults.ts b/packages/stack/src/Defaults.ts
index fde219822e..44f5325eef 100644
--- a/packages/stack/src/Defaults.ts
+++ b/packages/stack/src/Defaults.ts
@@ -39,6 +39,8 @@ export const DEFAULT_LOCAL_SERVICE_SECRET_KEY_BASE =
   "EAx3IQ/wRG1v47ZD4NE4/9RzBI8Jmil3x0yhcW4V2NHBP6c2iPIzwjofi2Ep4HIG";
 /** Key used to encrypt local Pooler tenant secrets. */
 export const DEFAULT_POOLER_VAULT_ENCRYPTION_KEY = "12345678901234567890123456789032";
+/** Keeps the BEAM port table at its 65536 default; a huge nofile limit inflates it to ~2 GiB. */
+export const DEFAULT_ERL_MAX_PORTS = "65536";
 
 /** The compiled default artifact pin of every service kind. */
 export { defaultArtifactSelection } from "./Artifacts.ts";
diff --git a/packages/stack/src/HostProcess.integration.test.ts b/packages/stack/src/HostProcess.integration.test.ts
index b3015b994d..40c836f1f5 100644
--- a/packages/stack/src/HostProcess.integration.test.ts
+++ b/packages/stack/src/HostProcess.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import {
   Context,
@@ -339,7 +339,11 @@ it.live("starts exactly one owner for concurrent launchers and attaches the othe
         expect(new Set(launched.map(({ endpoint }) => endpoint.port)).size).toBe(1);
       }).pipe(Effect.ensuring(bestEffortShutdownByState(root, state, "stack")));
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("relaunches after shutdown while a foreign listener holds the previous control port", () =>
@@ -388,7 +392,11 @@ it.live("relaunches after shutdown while a foreign listener holds the previous c
       expect(relaunched.endpoint.port).not.toBe(endpoint.port);
       expect(yield* connectHost(state, "stack")).toEqual(relaunched);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("ignores a stale endpoint record once no process holds the lease", () =>
@@ -424,7 +432,11 @@ it.live("ignores a stale endpoint record once no process holds the lease", () =>
       expect(published?.role === "owner" ? published.port : undefined).toBe(launched.endpoint.port);
       expect(unresponsive.connections()).toBe(0);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("discovers dead stacks from their free leases without contacting recorded endpoints", () =>
@@ -453,7 +465,11 @@ it.live("discovers dead stacks from their free leases without contacting recorde
       expect(entries.every(({ host }) => host === undefined)).toBe(true);
       expect(unresponsive.connections()).toBe(0);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live(
@@ -490,7 +506,11 @@ it.live(
           expect(connected.endpoint).toEqual(endpoint);
         }).pipe(Effect.ensuring(bestEffortShutdownByState(root, state, "stack")));
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
 );
 
 it.live("terminates a detached child when readiness is interrupted", () =>
@@ -525,7 +545,11 @@ it.live("terminates a detached child when readiness is interrupted", () =>
       yield* Fiber.interrupt(launch);
       expect(() => process.kill(pid, 0)).toThrow();
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("reports a structured owner startup error without the owner log tail", () =>
@@ -545,7 +569,11 @@ it.live("reports a structured owner startup error without the owner log tail", (
       expect(failure.message).toContain("owner log:");
       expect(failure.message).not.toContain("failing-owner-diagnostic");
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("keeps the owner secret out of recorded HTTP span attributes", () =>
@@ -578,7 +606,11 @@ it.live("keeps the owner secret out of recorded HTTP span attributes", () =>
       const attributes = spans.flatMap((span) => Array.from(span.attributes));
       expect(attributes.filter(([, value]) => String(value).includes(access.secret))).toEqual([]);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live(
@@ -619,7 +651,11 @@ it.live(
         expect(argv).not.toContain(marker);
         expect(argv).not.toContain(registerMarker);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 120_000 },
 );
 
@@ -646,7 +682,11 @@ it.live("hands the owner a private startup payload file that it deletes once rea
         expect(yield* leftoverStartupPayloads(ownerDir)).toEqual([]);
       }).pipe(Effect.ensuring(bestEffortShutdown(root)(access)));
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("deletes the spawned owner's startup payload file once it reports ready", () =>
@@ -672,7 +712,11 @@ it.live("deletes the spawned owner's startup payload file once it reports ready"
         Effect.ensuring(bestEffortShutdown(root)(access)),
       );
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("deletes the spawned owner's startup payload file even when its startup fails", () =>
@@ -697,7 +741,11 @@ it.live("deletes the spawned owner's startup payload file even when its startup
       expect(failure.message).toContain("owner startup failed");
       expect(yield* leftoverStartupPayloads(ownerDir)).toEqual([]);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("deletes a startup payload file that fails to write after creating partial content", () =>
@@ -750,7 +798,11 @@ it.live("deletes a startup payload file that fails to write after creating parti
       expect(failure.message).toContain("injected write failure");
       expect(yield* leftoverStartupPayloads(ownerDir)).toEqual([]);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("waits out a sweeper's hold before spawning the owner of a stack it registers", () =>
@@ -801,5 +853,9 @@ it.live("waits out a sweeper's hold before spawning the owner of a stack it regi
       yield* Effect.acquireRelease(Fiber.join(launching), bestEffortShutdown(root));
       expect(yield* state.read("stack")).toBeDefined();
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
diff --git a/packages/stack/src/HostProcess.ts b/packages/stack/src/HostProcess.ts
index fa79d4c8d5..288f9bdacb 100644
--- a/packages/stack/src/HostProcess.ts
+++ b/packages/stack/src/HostProcess.ts
@@ -1,7 +1,6 @@
 import { withAttemptCount } from "./internal/attempts.ts";
 import { NodeStream } from "@effect/platform-node";
 import {
-  Crypto,
   Data,
   Deferred,
   Duration,
@@ -17,6 +16,7 @@ import {
   Scope,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
@@ -62,7 +62,7 @@ const computeRelease = Effect.gen(function* () {
 export const currentRelease: Effect.Effect<
   string,
   never,
-  FileSystem.FileSystem | Path.Path | Crypto.Crypto
+  FileSystem.FileSystem | Path.Path | Digest.Digest
 > = Effect.runSync(Effect.cached(computeRelease));
 
 /**
@@ -280,7 +280,11 @@ export const connectHost = Effect.fn("HostProcess.connectHost")(function* (
 ): Effect.fn.Return<
   HostAccess,
   HostProcessError | NamespaceError,
-  HttpClient.HttpClient | FileSystem.FileSystem | Path.Path | Crypto.Crypto
+  | HttpClient.HttpClient
+  | FileSystem.FileSystem
+  | Path.Path
+  | SecureRandom.SecureRandom
+  | Digest.Digest
 > {
   const stack = yield* registered(state, stackId);
   // Lease and holder reads repeat every poll and stay untraced; the identity request is traced.
@@ -619,7 +623,7 @@ const withStartupPayload = Effect.fn("HostProcess.withStartupPayload")(function*
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const payload: HostStartupPayload = {
     ...(options.register === undefined ? {} : { register: options.register }),
     ...(options.requestedCreations === undefined
@@ -661,7 +665,12 @@ export const launchHost = Effect.fn("HostProcess.launchHost")(function* (
 ): Effect.fn.Return<
   HostAccess,
   HostProcessError | NamespaceError,
-  Scope.Scope | HttpClient.HttpClient | FileSystem.FileSystem | Path.Path | Crypto.Crypto
+  | Scope.Scope
+  | HttpClient.HttpClient
+  | FileSystem.FileSystem
+  | Path.Path
+  | SecureRandom.SecureRandom
+  | Digest.Digest
 > {
   const entrypoint = options.entrypoint ?? hostEntrypointFor(import.meta.url);
   const attempt = Effect.gen(function* () {
diff --git a/packages/stack/src/HttpProxy.integration.test.ts b/packages/stack/src/HttpProxy.integration.test.ts
index 93846f5e49..69f2cb30d0 100644
--- a/packages/stack/src/HttpProxy.integration.test.ts
+++ b/packages/stack/src/HttpProxy.integration.test.ts
@@ -9,6 +9,7 @@ import { WebSocket, WebSocketServer } from "ws";
 import { captureLogs } from "../tests/logs.ts";
 import { ProxyError } from "./Proxy.ts";
 import { makeHttpProxy, type HttpAccess, type HttpRoute } from "./HttpProxy.ts";
+import { sharedRoutes } from "./host/Endpoints.ts";
 
 const listen = (server: Server | NetServer, options?: { readonly beforeClose?: () => void }) =>
   Effect.acquireRelease(
@@ -746,6 +747,97 @@ it.live("adds a route's default headers only when the client sent none", () =>
   ).pipe(Effect.provide(NodeServices.layer)),
 );
 
+it.live(
+  "leaves CORS on the functions route to the function while other routes keep the gateway's",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const backend = createServer((incoming, response) => {
+          if (incoming.headers.origin === "https://app.example.com")
+            response.setHeader("access-control-allow-origin", "https://app.example.com");
+          const vary = incoming.headers["x-backend-vary"];
+          if (typeof vary === "string") response.setHeader("vary", vary);
+          response.statusCode = incoming.method === "OPTIONS" ? 403 : 200;
+          response.end(incoming.method);
+        });
+        const backendAddress = yield* listen(backend);
+        const proxy = yield* makeHttpProxy({ host: "127.0.0.1", port: 0 });
+        const keys = {
+          publishableKey: "sb_publishable_example",
+          secretKey: "sb_secret_example",
+          anonKey: "anon.jwt.value",
+          serviceRoleKey: "service.role.jwt",
+        };
+        yield* proxy.setRoutes([
+          ...(
+            sharedRoutes(
+              { service: "functions" },
+              "http",
+              keys,
+              () => Effect.die("unused"),
+              () => Effect.undefined,
+            ) ?? []
+          ).map((route) => ({ ...route, id: "functions", target: Effect.succeed(backendAddress) })),
+          { id: "rest", prefix: "/rest/v1", target: Effect.succeed(backendAddress) },
+        ]);
+        const client = yield* HttpClient.HttpClient;
+        const send = (
+          method: "OPTIONS" | "POST",
+          path: string,
+          origin: string,
+          headers: Record<string, string> = {},
+        ) =>
+          client.execute(
+            HttpClientRequest.make(method)(`http://127.0.0.1:${proxy.port}${path}`).pipe(
+              HttpClientRequest.setHeaders({ ...headers, origin }),
+            ),
+          );
+
+        const preflight = yield* send("OPTIONS", "/functions/v1/fn", "https://other.example.com");
+        expect(preflight.status).toBe(403);
+        expect(preflight.headers["access-control-allow-origin"]).toBeUndefined();
+        const denied = yield* send("POST", "/functions/v1/fn", "https://other.example.com");
+        expect(yield* denied.text).toBe("POST");
+        expect(denied.headers["access-control-allow-origin"]).toBeUndefined();
+        const allowed = yield* send("POST", "/functions/v1/fn", "https://app.example.com");
+        expect(allowed.headers["access-control-allow-origin"]).toBe("https://app.example.com");
+        const rest = yield* send("OPTIONS", "/rest/v1/todos", "https://other.example.com");
+        expect(rest.status).toBe(200);
+        expect(rest.headers["access-control-allow-origin"]).toBe("*");
+        expect(rest.headers["access-control-allow-methods"]).toBe(
+          "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT",
+        );
+        expect(rest.headers["access-control-allow-headers"]).toBe(
+          "accept-profile,apikey,authorization,x-client-info",
+        );
+        const requested = yield* send("OPTIONS", "/rest/v1/todos", "https://other.example.com", {
+          "access-control-request-headers": "authorization, x-custom-header",
+        });
+        expect(requested.headers["access-control-allow-headers"]).toBe(
+          "authorization, x-custom-header",
+        );
+        const proxied = yield* send("POST", "/rest/v1/todos", "https://other.example.com");
+        expect(yield* proxied.text).toBe("POST");
+        expect(proxied.headers["access-control-allow-origin"]).toBe("https://other.example.com");
+        expect(proxied.headers["access-control-allow-methods"]).toBeUndefined();
+        expect(proxied.headers["vary"]).toBe("Origin");
+        const originless = yield* client.execute(
+          HttpClientRequest.post(`http://127.0.0.1:${proxy.port}/rest/v1/todos`),
+        );
+        expect(originless.headers["access-control-allow-origin"]).toBe("*");
+        expect(originless.headers["vary"]).toBe("Origin");
+        const merged = yield* send("POST", "/rest/v1/todos", "https://other.example.com", {
+          "x-backend-vary": "accept-encoding",
+        });
+        expect(merged.headers["vary"]).toBe("accept-encoding, Origin");
+        const wildcard = yield* send("POST", "/rest/v1/todos", "https://other.example.com", {
+          "x-backend-vary": "*",
+        });
+        expect(wildcard.headers["vary"]).toBe("*");
+      }),
+    ).pipe(Effect.provide(Layer.mergeAll(NodeHttpClient.layerNodeHttp, NodeServices.layer))),
+);
+
 it.live("returns a gateway error naming the route and cause when a target cannot wake", () => {
   const logs: Array<string> = [];
   return Effect.scoped(
@@ -757,15 +849,25 @@ it.live("returns a gateway error naming the route and cause when a target cannot
           prefix: "/",
           target: Effect.fail(new ProxyError({ message: "readiness failed" })),
         },
+        {
+          id: "functions",
+          prefix: "/functions/v1",
+          upstreamCors: true,
+          target: Effect.fail(new ProxyError({ message: "readiness failed" })),
+        },
       ]);
       const client = yield* HttpClient.HttpClient;
       const response = yield* client.get(`http://127.0.0.1:${proxy.port}/`);
       expect(response.status).toBe(502);
       expect(response.headers["access-control-allow-origin"]).toBe("*");
       expect(yield* response.text).toBe("Bad Gateway");
-      expect(logs).toHaveLength(1);
+      const functions = yield* client.get(`http://127.0.0.1:${proxy.port}/functions/v1/fn`);
+      expect(functions.status).toBe(502);
+      expect(functions.headers["access-control-allow-origin"]).toBe("*");
+      expect(logs).toHaveLength(2);
       expect(logs[0]).toContain("Route rest request failed");
       expect(logs[0]).toContain("readiness failed");
+      expect(logs[1]).toContain("Route functions request failed");
     }),
   ).pipe(
     Effect.provide(
diff --git a/packages/stack/src/HttpProxy.ts b/packages/stack/src/HttpProxy.ts
index 60232c13c1..9cae624588 100644
--- a/packages/stack/src/HttpProxy.ts
+++ b/packages/stack/src/HttpProxy.ts
@@ -37,6 +37,15 @@ export interface HttpRoute {
   readonly keyRewrite?: HttpRouteKeyRewrite;
   /** Sends each write over a fresh upstream connection; reads still share the pool and its retry. */
   readonly freshWrites?: boolean;
+  /** Leaves CORS, preflights included, to the upstream, like Edge Functions on the platform. */
+  readonly upstreamCors?: boolean;
+}
+
+/** Answers plain GET from this process, with no CORS headers or backend; `undefined` is a 404. */
+export interface HttpFileRoute {
+  readonly id: string;
+  readonly prefix: string;
+  readonly file: (url: string) => Effect.Effect<Uint8Array | undefined>;
 }
 
 /** Configures Supabase API-key rewriting for one HTTP route. */
@@ -80,7 +89,7 @@ export type HttpAccessSink = (access: HttpAccess) => Effect.Effect<void>;
 export interface HttpProxy {
   readonly host: string;
   readonly port: number;
-  readonly setRoutes: (routes: ReadonlyArray<HttpRoute>) => Effect.Effect<void>;
+  readonly setRoutes: (routes: ReadonlyArray<HttpRoute | HttpFileRoute>) => Effect.Effect<void>;
 }
 
 const hopByHop = new Set([
@@ -215,13 +224,35 @@ interface Sent {
   clientLeft: boolean;
 }
 
-const respond = (response: ServerResponse, sent: Sent, status: number, body?: string) => {
+const respond = (
+  response: ServerResponse,
+  sent: Sent,
+  status: number,
+  body?: string | Uint8Array,
+) => {
   response.statusCode = status;
   // Node sends no body for a HEAD request.
   sent.bytes = body === undefined || response.req.method === "HEAD" ? 0 : Buffer.byteLength(body);
   response.end(body);
 };
 
+const serveFile = Effect.fnUntraced(function* (
+  request: IncomingMessage,
+  response: ServerResponse,
+  sent: Sent,
+  route: HttpFileRoute,
+) {
+  response.setHeader("content-type", "text/plain; charset=utf-8");
+  response.setHeader("x-content-type-options", "nosniff");
+  if (request.method !== "GET") {
+    response.setHeader("allow", "GET");
+    return respond(response, sent, 405, "Method Not Allowed");
+  }
+  const body = yield* route.file(request.url ?? "/");
+  if (body === undefined) return respond(response, sent, 404, "Not Found");
+  respond(response, sent, 200, body);
+});
+
 const responseSettled = (response: ServerResponse) =>
   Effect.callback<void>((resume) => {
     const onDone = () => resume(Effect.void);
@@ -287,7 +318,7 @@ const rewriteQuery = (query: string, route: HttpRoute) => {
 
 const pathnameFor = (url: string) => url.split("?", 1)[0] || "/";
 
-const routeFor = (url: string, routes: ReadonlyArray<HttpRoute>) => {
+const routeFor = (url: string, routes: ReadonlyArray<HttpRoute | HttpFileRoute>) => {
   const pathname = pathnameFor(url);
   return routes.find(
     (route) =>
@@ -295,12 +326,30 @@ const routeFor = (url: string, routes: ReadonlyArray<HttpRoute>) => {
   );
 };
 
-const setCors = (response: ServerResponse, request: IncomingMessage) => {
+const corsMethods = "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT";
+
+/** Headers the platform gateway puts on responses it answers itself. */
+const setCors = (response: ServerResponse) => {
   response.setHeader("access-control-allow-origin", "*");
-  response.setHeader("access-control-allow-methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS");
+  response.setHeader("access-control-allow-methods", corsMethods);
+};
+
+const varyOnOrigin = (response: ServerResponse) => {
+  const vary = response.getHeader("vary");
+  const values = (Array.isArray(vary) ? vary.join(",") : String(vary ?? ""))
+    .split(",")
+    .map((value) => value.trim())
+    .filter((value) => value !== "");
+  if (values.some((value) => value === "*" || value.toLowerCase() === "origin")) return;
+  response.setHeader("vary", [...values, "Origin"].join(", "));
+};
+
+const setPreflightCors = (response: ServerResponse, request: IncomingMessage) => {
+  setCors(response);
   response.setHeader(
     "access-control-allow-headers",
-    request.headers["access-control-request-headers"] ?? "authorization,apikey,content-type",
+    request.headers["access-control-request-headers"] ??
+      "accept-profile,apikey,authorization,x-client-info",
   );
 };
 
@@ -447,12 +496,16 @@ const forward = Effect.fn("HttpProxy.forward")(function* (
           sent.bytes += chunk.length;
         });
         response.once("finish", onFinish);
-        setCors(response, request);
         response.statusCode = value.statusCode ?? 502;
         for (const [name, header] of Object.entries(value.headers)) {
           if (header !== undefined && !hopByHop.has(name.toLowerCase()))
             response.setHeader(name, header);
         }
+        if (route.upstreamCors !== true) {
+          const origin = request.headers.origin;
+          response.setHeader("access-control-allow-origin", origin ?? "*");
+          varyOnOrigin(response);
+        }
         response.flushHeaders();
         value.pipe(response, { end: false });
         value.once("end", onUpstreamEnd);
@@ -641,7 +694,7 @@ export const makeHttpProxy = (options: {
   readonly onAccess?: HttpAccessSink | undefined;
 }): Effect.Effect<HttpProxy, PortError, Scope.Scope> =>
   Effect.gen(function* () {
-    const routes = yield* Ref.make<ReadonlyArray<HttpRoute>>([]);
+    const routes = yield* Ref.make<ReadonlyArray<HttpRoute | HttpFileRoute>>([]);
     // Sockets per upstream stay unbounded so long-lived streamed responses never queue requests.
     // Idle sockets close before an upstream's 5 s keep-alive timeout, the shortest in the stack,
     // can race a reuse.
@@ -676,10 +729,17 @@ export const makeHttpProxy = (options: {
               const route = yield* Ref.get(routes).pipe(
                 Effect.map((current) => routeFor(request.url ?? "/", current)),
               );
-              setCors(response, request);
-              if (request.method === "OPTIONS") respond(response, sent, 204);
-              else if (route === undefined) respond(response, sent, 404, "Not Found");
-              else {
+              if (route !== undefined && "file" in route) {
+                yield* serveFile(request, response, sent, route);
+                return;
+              }
+              if (request.method === "OPTIONS" && route?.upstreamCors !== true) {
+                setPreflightCors(response, request);
+                respond(response, sent, 200);
+              } else if (route === undefined) {
+                setCors(response);
+                respond(response, sent, 404, "Not Found");
+              } else {
                 yield* proxyRequest(request, response, route, agent, sent).pipe(
                   Effect.tapError((cause) =>
                     cause._tag === "HttpProxyDisconnected"
@@ -692,7 +752,7 @@ export const makeHttpProxy = (options: {
                       if (response.destroyed) return;
                       if (response.headersSent || sent.clientLeft) response.destroy();
                       else {
-                        setCors(response, request);
+                        setCors(response);
                         respond(response, sent, 502, "Bad Gateway");
                       }
                     }),
@@ -744,7 +804,7 @@ export const makeHttpProxy = (options: {
             Effect.map((current) => routeFor(request.url ?? "/", current)),
           );
           const outcome =
-            route === undefined
+            route === undefined || "file" in route
               ? yield* Effect.sync(() => {
                   socket.destroy();
                   return 404;
@@ -789,7 +849,7 @@ export const makeHttpProxy = (options: {
     return {
       host: address.address,
       port: address.port,
-      setRoutes: (next: ReadonlyArray<HttpRoute>) =>
+      setRoutes: (next: ReadonlyArray<HttpRoute | HttpFileRoute>) =>
         Ref.set(
           routes,
           [...next].sort((a, b) => b.prefix.length - a.prefix.length),
diff --git a/packages/stack/src/Network.integration.test.ts b/packages/stack/src/Network.integration.test.ts
index e4a5a93ee4..b6dc5c35ba 100644
--- a/packages/stack/src/Network.integration.test.ts
+++ b/packages/stack/src/Network.integration.test.ts
@@ -2,14 +2,22 @@ import { NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Context, Data, Deferred, Effect, Fiber, FileSystem, Hash, Layer, Path, Ref } from "effect";
 import { randomUUID } from "node:crypto";
+import { networkInterfaces } from "node:os";
 import * as Net from "node:net"; // oxlint-disable-line effecttsgo/node-builtin-import -- fixture retains an idle HTTP connection.
 import { createServer, type RequestListener } from "node:http"; // oxlint-disable-line effecttsgo/node-builtin-import -- real socket fixture.
 import { HttpBody, HttpClient } from "effect/http";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import type { HttpAccess, HttpAccessSink } from "./HttpProxy.ts";
 import * as Network from "./Network.ts";
 import * as PortReservations from "./namespace/PortReservations.ts";
+import * as Ports from "./Ports.ts";
 import { DOCKER_HOST_ALIAS } from "./runtime/Container.ts";
-import { freshWrites, joinRoutes, sharedRoutes } from "./host/Endpoints.ts";
+import { emailTemplateFile, freshWrites, joinRoutes, sharedRoutes } from "./host/Endpoints.ts";
+import { readResolvedFile } from "./namespace/drivers/FileSystem.ts";
+import type { ServiceCreation } from "./services/Catalog.ts";
 import * as StackNamespace from "./StackNamespace.ts";
+import { selection } from "../tests/pins.ts";
+import { captureLogs } from "../tests/logs.ts";
 
 const makeTestState = (root: string) =>
   Layer.build(StackNamespace.layer({ root })).pipe(
@@ -19,11 +27,14 @@ const makeTestNetwork = (options: {
   readonly stackId: string;
   readonly runtime: Network.NetworkRuntime;
   readonly state: StackNamespace.Interface;
+  readonly onAccess?: HttpAccessSink | undefined;
 }) =>
   Layer.build(
-    Network.layer({ stackId: options.stackId, runtime: options.runtime }).pipe(
-      Layer.provide(Layer.succeed(StackNamespace.Service, options.state)),
-    ),
+    Network.layer({
+      stackId: options.stackId,
+      runtime: options.runtime,
+      ...(options.onAccess === undefined ? {} : { onAccess: options.onAccess }),
+    }).pipe(Layer.provide(Layer.succeed(StackNamespace.Service, options.state))),
   ).pipe(Effect.map((context) => Context.get(context, Network.Service)));
 
 const stack = (id: string) => ({
@@ -615,8 +626,12 @@ it.live("serves legacy Kong's gateway routes while each service runs", () =>
             endpoints: {
               http: {
                 ...endpoint(api, Effect.succeed(true)),
-                shared: sharedRoutes({ service }, "http", keys, (name) =>
-                  Effect.succeed(name === "admin" ? admin : api),
+                shared: sharedRoutes(
+                  { service },
+                  "http",
+                  keys,
+                  (name) => Effect.succeed(name === "admin" ? admin : api),
+                  () => Effect.undefined,
                 ),
                 join: joinRoutes({ service }, "http"),
               },
@@ -742,18 +757,366 @@ it.live("addresses docker runtime endpoints through the stack host alias", () =>
   ).pipe(Effect.provide(NodeServices.layer)),
 );
 
-/** Ports Windows runners listen on: RDP, WinRM, Delivery Optimization and Windows services. */
-const windowsHeldPorts = new Set([3389, 5040, 5357, 5985, 5986, 7680]);
+/* Templates held inside `root`, the project directory the CLI passes. */
+const authWith = (
+  root: string,
+  templates: ReadonlyArray<{ readonly id: string; readonly path: string }>,
+  templateToken = "template-token",
+): ServiceCreation => ({
+  service: "auth",
+  pin: selection.auth,
+  config: { templates: templates.map((template) => ({ ...template, root })), templateToken },
+});
+
+/** An Auth shared route over a real project directory holding `invite.html`, beside `outside/`. */
+const emailTemplates = (runtime: Network.NetworkRuntime, onAccess?: HttpAccessSink) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const base = yield* fs.realPath(
+      yield* fs.makeTempDirectoryScoped({ prefix: "network-email-" }),
+    );
+    const root = path.join(base, "project");
+    const outside = path.join(base, "outside");
+    yield* fs.makeDirectory(root);
+    yield* fs.makeDirectory(outside);
+    const invite = path.join(root, "invite.html");
+    yield* fs.writeFileString(invite, "invite marker");
+    const stackId = `email-${randomUUID()}`;
+    const state = yield* makeTestState(path.join(base, "state"));
+    yield* state.save(stack(stackId));
+    const backendCalls = { count: 0 };
+    const target = yield* backendWith((_request, response) => {
+      backendCalls.count += 1;
+      response.end("backend");
+    });
+    const creation = yield* Ref.make(authWith(root, [{ id: "invite", path: invite }]));
+    const network = yield* makeTestNetwork({ stackId, runtime, state, onAccess });
+    const namespace = yield* network.register({
+      id: "auth",
+      endpoints: {
+        http: {
+          ...endpoint(target, Effect.succeed(false)),
+          shared: sharedRoutes(
+            { service: "auth" },
+            "http",
+            { publishableKey: "", secretKey: "", anonKey: "", serviceRoleKey: "" },
+            () => Effect.succeed(target),
+            emailTemplateFile(Ref.get(creation)),
+          ),
+        },
+      },
+    });
+    const [binding] = yield* namespace.bind;
+    if (binding === undefined) return yield* new FixtureError({ message: "no binding" });
+    yield* Effect.addFinalizer(() => network.releaseStack.pipe(Effect.ignore));
+    return { root, outside, invite, creation, backendCalls, port: binding.port };
+  });
+
+/** Sends bytes as written, so a client never normalizes the path, and answers with the raw reply. */
+const raw = (port: number, head: string, host = "127.0.0.1", connection = "close") =>
+  Effect.callback<string, FixtureError>((resume) => {
+    const socket = Net.connect({ host, port });
+    let received = "";
+    socket.on("data", (chunk) => {
+      received += chunk.toString();
+    });
+    socket.once("error", (cause) =>
+      resume(Effect.fail(new FixtureError({ message: cause.message }))),
+    );
+    socket.once("close", () => resume(Effect.succeed(received)));
+    socket.once("connect", () =>
+      socket.write(`${head}\r\nHost: stack\r\nConnection: ${connection}\r\n\r\n`),
+    );
+    return Effect.sync(() => {
+      socket.destroy();
+    });
+  });
+
+const invite = "/email/invite?token=template-token";
+
+it.live("serves configured templates from the live creation and fresh from disk", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { root, invite: file, creation, backendCalls, port } = yield* emailTemplates("native");
+
+      const first = yield* raw(port, `GET ${invite} HTTP/1.1`);
+      expect(first).toMatch(/^HTTP\/1\.1 200 /u);
+      expect(first.toLowerCase()).toContain("content-type: text/plain");
+      expect(first.toLowerCase()).toContain("x-content-type-options: nosniff");
+      expect(first).toContain("invite marker");
+
+      const replacement = path.join(root, "invite.html.next");
+      yield* fs.writeFileString(replacement, "replaced marker");
+      yield* fs.rename(replacement, file);
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toContain("replaced marker");
+
+      const notification = path.join(root, "changed.txt");
+      yield* fs.writeFileString(notification, "notification marker");
+      yield* Ref.set(
+        creation,
+        authWith(root, [{ id: "password_changed_notification", path: notification }], "next"),
+      );
+      expect(
+        yield* raw(port, "GET /email/password_changed_notification?token=next HTTP/1.1"),
+      ).toContain("notification marker");
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toMatch(/^HTTP\/1\.1 404 /u);
+      expect(backendCalls.count).toBe(0);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("serves a template whose filename is not URL-safe", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { root, creation, port } = yield* emailTemplates("native");
+      for (const name of [
+        "invite.html copy",
+        "invite.日本語",
+        "invite.v1#2",
+        ...(process.platform === "win32" ? [] : ["invite.ht?ml"]),
+      ]) {
+        const file = path.join(root, name);
+        yield* fs.writeFileString(file, `marker for ${name}`);
+        yield* Ref.set(creation, authWith(root, [{ id: "invite", path: file }]));
+        expect(yield* raw(port, `GET ${invite} HTTP/1.1`), name).toContain(`marker for ${name}`);
+      }
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("answers only the exact configured template path", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const { port, backendCalls } = yield* emailTemplates("native");
+      for (const target of [
+        "/email/other",
+        "/email",
+        "/email/",
+        "/email/invite/",
+        "/email/invite.html",
+        "/email/invit%65",
+        "/email/../../etc/passwd",
+      ])
+        expect(yield* raw(port, `GET ${target}?token=template-token HTTP/1.1`), target).toMatch(
+          /^HTTP\/1\.1 404 /u,
+        );
+      expect(backendCalls.count).toBe(0);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("refuses every template method but GET, and a WebSocket upgrade, without waking Auth", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const { port, backendCalls } = yield* emailTemplates("native");
+      for (const method of ["POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
+        expect(yield* raw(port, `${method} ${invite} HTTP/1.1`), method).toMatch(
+          /^HTTP\/1\.1 405 /u,
+        );
+      const upgrade = raw(
+        port,
+        `GET ${invite} HTTP/1.1\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==`,
+        "127.0.0.1",
+        "Upgrade",
+      ).pipe(Effect.orElseSucceed(() => ""));
+      expect(yield* upgrade).toBe("");
+      expect(backendCalls.count).toBe(0);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live(
+  "serves an in-root symlink at a template path, and its retargeted file on the next fetch",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const { root, invite: file, port } = yield* emailTemplates("native");
+        const shared = path.join(root, "shared");
+        yield* fs.makeDirectory(shared);
+        yield* fs.writeFileString(path.join(shared, "a.html"), "first shared marker");
+        yield* fs.writeFileString(path.join(shared, "b.html"), "second shared marker");
+        yield* fs.remove(file);
+        yield* fs.symlink(path.join("shared", "a.html"), file);
+        const linked = yield* raw(port, `GET ${invite} HTTP/1.1`);
+        expect(linked).toMatch(/^HTTP\/1\.1 200 /u);
+        expect(linked).toContain("first shared marker");
+        yield* fs.remove(file);
+        yield* fs.symlink(path.join(shared, "b.html"), file);
+        expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toContain("second shared marker");
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("never serves a link or directory escaping the root, or a FIFO, at a template path", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const { root, outside, invite: file, creation, port } = yield* emailTemplates("native");
+      const escapee = path.join(outside, "outside.html");
+      yield* fs.writeFileString(escapee, "outside marker");
+
+      const folder = path.join(root, "templates");
+      yield* fs.makeDirectory(folder);
+      yield* fs.writeFileString(path.join(folder, "nested.html"), "nested marker");
+      yield* fs.writeFileString(path.join(outside, "nested.html"), "outside marker");
+      yield* Ref.set(
+        creation,
+        authWith(root, [{ id: "invite", path: path.join(folder, "nested.html") }]),
+      );
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toContain("nested marker");
+      yield* fs.rename(folder, `${folder}.aside`);
+      yield* fs.symlink(outside, folder);
+      const throughParent = yield* raw(port, `GET ${invite} HTTP/1.1`);
+      expect(throughParent).toMatch(/^HTTP\/1\.1 404 /u);
+      expect(throughParent).not.toContain("outside marker");
+      yield* Ref.set(creation, authWith(root, [{ id: "invite", path: file }]));
+
+      yield* fs.remove(file);
+      yield* fs.symlink(escapee, file);
+      const escaped = yield* raw(port, `GET ${invite} HTTP/1.1`);
+      expect(escaped).toMatch(/^HTTP\/1\.1 404 /u);
+      expect(escaped).not.toContain("outside marker");
+
+      yield* fs.remove(file);
+      yield* fs.makeDirectory(file);
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toMatch(/^HTTP\/1\.1 404 /u);
+
+      if (process.platform === "win32") return;
+      yield* fs.remove(file, { recursive: true });
+      expect(yield* spawner.exitCode(ChildProcess.make("mkfifo", [file]))).toBe(0);
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toMatch(/^HTTP\/1\.1 404 /u);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+/* The open-and-verify step on POSIX; Windows checks its handle through `bun:ffi` instead. */
+it.live.skipIf(process.platform === "win32")(
+  "refuses a resolved template path whose final file was swapped for a link",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const base = yield* fs.realPath(yield* fs.makeTempDirectoryScoped());
+        const resolved = path.join(base, "invite.html");
+        yield* fs.writeFileString(resolved, "resolved marker");
+        expect(new TextDecoder().decode(yield* readResolvedFile(resolved, false))).toBe(
+          "resolved marker",
+        );
+        yield* fs.writeFileString(path.join(base, "other.html"), "other marker");
+        yield* fs.remove(resolved);
+        yield* fs.symlink(path.join(base, "other.html"), resolved);
+        const error = yield* Effect.flip(readResolvedFile(resolved, false));
+        expect(error.cause).toMatchObject({ code: "ELOOP" });
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live.skipIf(process.platform === "win32")(
+  "refuses a resolved template path whose parent directory was swapped for a link outside",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const base = yield* fs.realPath(yield* fs.makeTempDirectoryScoped());
+        const folder = path.join(base, "templates");
+        const outside = path.join(base, "outside");
+        yield* fs.makeDirectory(folder);
+        yield* fs.makeDirectory(outside);
+        const resolved = path.join(folder, "invite.html");
+        yield* fs.writeFileString(resolved, "resolved marker");
+        yield* fs.writeFileString(path.join(outside, "invite.html"), "outside marker");
+        yield* fs.rename(folder, `${folder}.aside`);
+        yield* fs.symlink(outside, folder);
+        const error = yield* Effect.flip(readResolvedFile(resolved, false));
+        expect(error.message).toContain("Not a regular file at this path");
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("sends no CORS header on any template response", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const { port } = yield* emailTemplates("native");
+      const origin = "Origin: https://example.test";
+      for (const head of [
+        `GET ${invite} HTTP/1.1\r\n${origin}`,
+        `GET /email/other HTTP/1.1\r\n${origin}`,
+        `OPTIONS ${invite} HTTP/1.1\r\n${origin}\r\nAccess-Control-Request-Method: GET`,
+      ])
+        expect((yield* raw(port, head)).toLowerCase()).not.toContain("access-control-allow");
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+const external = Object.values(networkInterfaces())
+  .flat()
+  .find((entry) => entry?.family === "IPv4" && !entry.internal)?.address;
+
+/* A LAN test that cannot reach the external interface fails rather than skips. */
+const externalAddress =
+  external === undefined
+    ? Effect.die("no external IPv4 address to reach the API from the LAN side")
+    : Effect.succeed(external);
+
+it.live("keeps a template behind its token on the external address, and off it on native", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const host = yield* externalAddress;
+      for (const runtime of ["docker", "podman"] as const) {
+        const { port } = yield* emailTemplates(runtime);
+        for (const target of ["/email/invite", "/email/invite?token=wrong"])
+          expect(yield* raw(port, `GET ${target} HTTP/1.1`, host), target).toMatch(
+            /^HTTP\/1\.1 404 /u,
+          );
+        const served = yield* raw(port, `GET ${invite} HTTP/1.1`, host);
+        expect(served).toMatch(/^HTTP\/1\.1 200 /u);
+        expect(served).toContain("invite marker");
+      }
+      const { port } = yield* emailTemplates("native");
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toMatch(/^HTTP\/1\.1 200 /u);
+      yield* Effect.flip(raw(port, `GET ${invite} HTTP/1.1`, host));
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("records a template request with its token redacted", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const access = yield* Deferred.make<HttpAccess>();
+      const { port } = yield* emailTemplates("native", (record) =>
+        Deferred.succeed(access, record).pipe(Effect.asVoid),
+      );
+      yield* raw(port, `GET ${invite} HTTP/1.1`);
+      expect((yield* Deferred.await(access)).target).toBe("/email/invite?token=redacted");
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
 
 /**
  * A pinned port below the stack's native and auto port ranges and every OS ephemeral range, so
  * neither another test's auto allocation nor an outbound socket can already hold it. It stays
- * under 9000, where other files pin fixed ports.
+ * under 9000, where other files pin fixed ports, and is redrawn until the bind's own vacancy guard
+ * would accept it.
  */
-const pinnedPort = (): number => {
+const pinnedPort: Effect.Effect<number> = Effect.gen(function* () {
   const port = 1024 + (Math.abs(Hash.string(randomUUID())) % (9_000 - 1024));
-  return windowsHeldPorts.has(port) ? pinnedPort() : port;
-};
+  const vacant = Ports.probeVacant(process.platform)("pinned", "127.0.0.1", port).pipe(
+    Effect.as(true),
+    Effect.catchTag("PortError", () => Effect.succeed(false)),
+  );
+  return !(yield* Ports.accepts("127.0.0.1", port)) && (yield* vacant) ? port : yield* pinnedPort;
+});
 
 it.live("addresses a pinned endpoint from its configured port without a registry row", () =>
   Effect.scoped(
@@ -763,7 +1126,7 @@ it.live("addresses a pinned endpoint from its configured port without a registry
       const state = yield* makeTestState(root);
       yield* state.save(stack("stack"));
       const target = yield* backend;
-      const port = pinnedPort();
+      const port = yield* pinnedPort;
       const network = yield* makeTestNetwork({ stackId: "stack", runtime: "native", state });
       const namespace = yield* network.register({
         id: "db",
@@ -786,7 +1149,7 @@ it.live("a pinned port is reserved only while its listener is open", () =>
       yield* state.save(stack("first"));
       yield* state.save(stack("second"));
       const target = yield* backend;
-      const port = pinnedPort();
+      const port = yield* pinnedPort;
       const firstEnabled = yield* Ref.make(true);
       const firstNetwork = yield* makeTestNetwork({ stackId: "first", runtime: "native", state });
       const first = yield* firstNetwork.register({
@@ -820,7 +1183,7 @@ it.live("a pinned shared listener keeps its reservation until its last route clo
       const state = yield* makeTestState(root);
       yield* state.save(stack("stack"));
       const target = yield* backend;
-      const port = pinnedPort();
+      const port = yield* pinnedPort;
       const firstEnabled = yield* Ref.make(true);
       const secondEnabled = yield* Ref.make(true);
       const network = yield* makeTestNetwork({ stackId: "stack", runtime: "native", state });
@@ -898,3 +1261,42 @@ it.live(
       }),
     ).pipe(Effect.provide(NodeServices.layer)),
 );
+
+it.live("serves a template only for its exact token", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const { port } = yield* emailTemplates("native");
+      for (const token of [
+        "template-tokex",
+        "template-toke",
+        "template-tokenn",
+        "",
+        "TEMPLATE-TOKEN",
+      ])
+        expect(yield* raw(port, `GET /email/invite?token=${token} HTTP/1.1`), token).toMatch(
+          /^HTTP\/1\.1 404 /u,
+        );
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toMatch(/^HTTP\/1\.1 200 /u);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("warns once about a template that keeps failing, and again after it recovers", () => {
+  const warnings: Array<string> = [];
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const { invite: file, port } = yield* emailTemplates("native");
+      const served = () => warnings.filter((line) => line.includes("was not served")).length;
+      yield* fs.remove(file);
+      for (const _ of [1, 2, 3])
+        expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toMatch(/^HTTP\/1\.1 404 /u);
+      expect(served()).toBe(1);
+      yield* fs.writeFileString(file, "invite marker");
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toMatch(/^HTTP\/1\.1 200 /u);
+      yield* fs.remove(file);
+      expect(yield* raw(port, `GET ${invite} HTTP/1.1`)).toMatch(/^HTTP\/1\.1 404 /u);
+      expect(served()).toBe(2);
+    }),
+  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, captureLogs(["Warn"])(warnings))));
+});
diff --git a/packages/stack/src/Network.ts b/packages/stack/src/Network.ts
index 36fc8cf230..fb88bac53a 100644
--- a/packages/stack/src/Network.ts
+++ b/packages/stack/src/Network.ts
@@ -4,16 +4,30 @@ import * as PortReservations from "./namespace/PortReservations.ts";
 import * as StackNamespace from "./StackNamespace.ts";
 import { makePorts, probeVacant, type PortError } from "./Ports.ts";
 import { bindTcp, serveTcp, type BackendAddress, type ProxyError } from "./Proxy.ts";
-import { makeHttpProxy, type HttpAccessSink, type HttpProxy, type HttpRoute } from "./HttpProxy.ts";
+import {
+  makeHttpProxy,
+  type HttpAccessSink,
+  type HttpFileRoute,
+  type HttpProxy,
+  type HttpRoute,
+} from "./HttpProxy.ts";
 
 export type NetworkRuntime = "native" | "docker" | "podman";
 
 /* `target` serves a route from another backend than its endpoint's, like PostgREST's admin port. */
-type RouteContribution = Pick<
-  HttpRoute,
-  "prefix" | "upstreamPrefix" | "upstreamHost" | "addHeaders" | "forwardedPrefix" | "keyRewrite"
-> &
-  Partial<Pick<HttpRoute, "target">>;
+type RouteContribution =
+  | (Pick<
+      HttpRoute,
+      | "prefix"
+      | "upstreamPrefix"
+      | "upstreamHost"
+      | "addHeaders"
+      | "forwardedPrefix"
+      | "keyRewrite"
+      | "upstreamCors"
+    > &
+      Partial<Pick<HttpRoute, "target">>)
+  | Pick<HttpFileRoute, "prefix" | "file">;
 
 export interface NetworkEndpoint {
   readonly protocol: "tcp" | "http";
@@ -110,13 +124,13 @@ const makeNetwork = (options: {
       | {
           readonly claim: number;
           readonly proxy: HttpProxy;
-          readonly routes: ReadonlyArray<HttpRoute>;
+          readonly routes: ReadonlyArray<HttpRoute | HttpFileRoute>;
           readonly scope: Scope.Closeable;
         }
       | undefined
     >(undefined);
     // Join routes queued before any claiming endpoint has created the shared listener.
-    const pendingJoins = yield* Ref.make<ReadonlyArray<HttpRoute>>([]);
+    const pendingJoins = yield* Ref.make<ReadonlyArray<HttpRoute | HttpFileRoute>>([]);
 
     const listenHost = options.runtime === "native" ? "127.0.0.1" : "0.0.0.0";
     const hostAddress = "127.0.0.1";
@@ -124,20 +138,24 @@ const makeNetwork = (options: {
 
     const routeKey = (route: Pick<HttpRoute, "id" | "prefix">) => `${route.id}:${route.prefix}`;
 
-    /** Maps one endpoint's route contributions to `HttpRoute`s; shared and joined ones are `gateway` routes. */
+    /** Maps one endpoint's route contributions to routes; shared and joined proxy routes are `gateway` routes. */
     const toHttpRoutes = (
       id: string,
       contributions: ReadonlyArray<RouteContribution>,
       endpoint: Pick<NetworkEndpoint, "backend" | "freshWrites">,
       gateway: boolean,
-    ): ReadonlyArray<HttpRoute> =>
-      contributions.map((route) => ({
-        ...route,
-        id,
-        ...(gateway ? { gateway: true } : {}),
-        ...(endpoint.freshWrites === true ? { freshWrites: true } : {}),
-        target: route.target ?? endpoint.backend,
-      }));
+    ): ReadonlyArray<HttpRoute | HttpFileRoute> =>
+      contributions.map((route) =>
+        "file" in route
+          ? { ...route, id }
+          : {
+              ...route,
+              id,
+              ...(gateway ? { gateway: true } : {}),
+              ...(endpoint.freshWrites === true ? { freshWrites: true } : {}),
+              target: route.target ?? endpoint.backend,
+            },
+      );
 
     /** Installs a namespace's joined routes onto the shared listener, or queues them if it does not exist yet. */
     const installJoin = Effect.fn("Network.installJoin")(function* (
@@ -237,7 +255,7 @@ const makeNetwork = (options: {
                   );
                   if (endpoint.shared !== undefined && result.listener.proxy !== undefined) {
                     const previous = yield* Ref.get(shared);
-                    let seeded: ReadonlyArray<HttpRoute> = [];
+                    let seeded: ReadonlyArray<HttpRoute | HttpFileRoute> = [];
                     if (previous === undefined) seeded = yield* Ref.get(pendingJoins);
                     const current = previous ?? {
                       claim: result.port,
diff --git a/packages/stack/src/Owner.analytics.integration.test.ts b/packages/stack/src/Owner.analytics.integration.test.ts
index a926590c78..ceed7c4e4a 100644
--- a/packages/stack/src/Owner.analytics.integration.test.ts
+++ b/packages/stack/src/Owner.analytics.integration.test.ts
@@ -1,9 +1,8 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { PgClient } from "@effect/sql-pg";
 import { expect, it } from "@effect/vitest";
 import {
   Context,
-  Crypto,
   Data,
   DateTime,
   Effect,
@@ -17,6 +16,7 @@ import {
   Schema,
   Stream,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 import { tmpdir } from "node:os";
 import { logflareEvent, logflareSources } from "./host/LogflareEvents.ts";
@@ -96,9 +96,9 @@ const startStack = (
 ) =>
   Effect.gen(function* () {
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
     const client = yield* HttpClient.HttpClient;
-    const stackId = `${name}-${(yield* crypto.randomUUIDv4).slice(0, 8)}`;
+    const stackId = `${name}-${(yield* crypto.uuidV4()).slice(0, 8)}`;
     const root = yield* makeDockerDatabaseRoot(`stack-${name}-`, stackId);
     const saved: SavedStack = {
       id: stackId,
@@ -314,7 +314,11 @@ it.live(
         expect(shippedAt).toBeGreaterThanOrEqual(raisedAt);
         expect(shippedAt).toBeLessThanOrEqual(wakeRequestedAt);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 600_000 },
 );
 
@@ -323,7 +327,7 @@ it.live(
   () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const client = yield* HttpClient.HttpClient;
         const { owner, idOf, analyticsUrl, wakeAnalytics, keepAwake } = yield* startStack(
           "owner-logflare",
@@ -338,7 +342,7 @@ it.live(
         // No composed service ships to this source, so only this test's posts reach its batches.
         const source = logflareSources.realtime;
         const event = Effect.fnUntraced(function* (message: string) {
-          const id = yield* crypto.randomUUIDv4;
+          const id = yield* crypto.uuidV4();
           const timestamp = DateTime.formatIso(yield* DateTime.now);
           return { id, ...logflareEvent("realtime", timestamp, message) };
         });
@@ -392,6 +396,10 @@ it.live(
 
         expect(yield* storedIds([first.id, ...added.map(({ id }) => id)])).toEqual([first.id]);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 600_000 },
 );
diff --git a/packages/stack/src/Owner.integration.test.ts b/packages/stack/src/Owner.integration.test.ts
index fffc45953d..d14eec8bdd 100644
--- a/packages/stack/src/Owner.integration.test.ts
+++ b/packages/stack/src/Owner.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { PgClient } from "@effect/sql-pg";
 import { describe, expect, it } from "@effect/vitest";
 import { Context, Effect, FileSystem, Layer, Redacted, Ref, Schema, Stream } from "effect";
@@ -141,7 +141,11 @@ it.effect("credential lookup leaves a fresh stack untouched for custom database
       });
       expect((yield* state.read(stack.id))?.credentials?.jwtSecret).toBe(jwtSecret);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("forwards and rotates saved identity across composed services in one owner", () =>
@@ -391,7 +395,11 @@ it.live("forwards and rotates saved identity across composed services in one own
         (yield* state.read(stack.id).pipe(Effect.map((saved) => saved?.credentials)))?.jwtSecret,
       ).toBe(customJwtSecret);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.effect("publishes service removal and composition pruning together", () =>
@@ -447,7 +455,11 @@ it.effect("publishes service removal and composition pruning together", () =>
       expect(saved.instances).toEqual([]);
       expect(saved.composition).toEqual({ members: [], dependencies: [] });
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live(
@@ -548,7 +560,11 @@ it.live(
         expect((yield* state.read(stack.id))?.instances).toHaveLength(3);
         expect((yield* reopenedOwner.rpc.status({ id: database.id })).lifecycle).toBe("stopped");
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -600,7 +616,11 @@ it.effect("isolates owner graphs built in one scope", () =>
         .pipe(Effect.flip);
       expect(isolated.operation).toBe("configureComposition");
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live(
@@ -669,7 +689,11 @@ it.live(
         expect(response.status).toBe(200);
         expect(yield* response.json).toEqual([{ value: "factory-row" }]);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -762,7 +786,11 @@ it.effect("validates Supabase composition recipes before creating instances", ()
         .pipe(Effect.flip);
       expect(missingSql.message).toBe("database requires configured sql endpoint");
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.effect("lets a retry choose other credentials after the first database creation failed", () =>
@@ -794,7 +822,11 @@ it.effect("lets a retry choose other credentials after the first database creati
       yield* owner.rpc.createService(database("second-password"));
       expect((yield* state.read(stack.id))?.credentials?.databasePassword).toBe("second-password");
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.effect(
@@ -845,6 +877,7 @@ it.effect(
       Effect.provide(
         Layer.mergeAll(
           NodeServices.layer,
+          NodeCrypto.layer,
           NodeHttpClient.layerNodeHttp,
           PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
         ),
@@ -891,6 +924,7 @@ it.live("destroying one service deletes its port reservation", () =>
     Effect.provide(
       Layer.mergeAll(
         NodeServices.layer,
+        NodeCrypto.layer,
         NodeHttpClient.layerNodeHttp,
         PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
       ),
@@ -921,6 +955,7 @@ it.live("destroying a stack leaves its data root empty after an owner was killed
     Effect.provide(
       Layer.mergeAll(
         NodeServices.layer,
+        NodeCrypto.layer,
         NodeHttpClient.layerNodeHttp,
         PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
       ),
@@ -961,6 +996,7 @@ it.live("refuses to destroy one service after its data directory became a symlin
     Effect.provide(
       Layer.mergeAll(
         NodeServices.layer,
+        NodeCrypto.layer,
         NodeHttpClient.layerNodeHttp,
         PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
       ),
@@ -993,6 +1029,7 @@ it.live("refuses to destroy a stack whose data directory is a symlink and keeps
     Effect.provide(
       Layer.mergeAll(
         NodeServices.layer,
+        NodeCrypto.layer,
         NodeHttpClient.layerNodeHttp,
         PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
       ),
@@ -1033,7 +1070,11 @@ it.effect("refuses to generate credentials for a stack whose saved instances con
       expect(current?.credentials).toBeUndefined();
       expect(current?.instances).toHaveLength(1);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("blocks a credential change while a standalone credential consumer runs", () =>
@@ -1079,7 +1120,11 @@ it.live("blocks a credential change while a standalone credential consumer runs"
       expect(yield* owner.getStackCredentials).toEqual(before);
       yield* owner.rpc.stopService({ id: standalone.id });
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live(
@@ -1134,7 +1179,11 @@ it.live(
         yield* owner.rpc.startService({ id: rest.id });
         yield* owner.rpc.stopService({ id: rest.id });
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
 );
 
 it.live("rejects a missing required input before starting or stopping the service", () =>
@@ -1181,7 +1230,11 @@ it.live("rejects a missing required input before starting or stopping the servic
       });
       yield* owner.rpc.stopService({ id: provided.id });
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live(
@@ -1246,6 +1299,7 @@ it.live(
       Effect.provide(
         Layer.mergeAll(
           NodeServices.layer,
+          NodeCrypto.layer,
           NodeHttpClient.layerNodeHttp,
           PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
         ),
@@ -1338,6 +1392,7 @@ describe.runIf(testEngine === "docker")("Docker volume storage", () => {
         Effect.provide(
           Layer.mergeAll(
             NodeServices.layer,
+            NodeCrypto.layer,
             NodeHttpClient.layerNodeHttp,
             PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
           ),
diff --git a/packages/stack/src/Owner.logs.integration.test.ts b/packages/stack/src/Owner.logs.integration.test.ts
index 31de225ccf..4f8cd295bd 100644
--- a/packages/stack/src/Owner.logs.integration.test.ts
+++ b/packages/stack/src/Owner.logs.integration.test.ts
@@ -1,8 +1,8 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Context,
-  Crypto,
+  Data,
   Effect,
   Exit,
   Fiber,
@@ -11,11 +11,13 @@ import {
   Path,
   Queue,
   Redacted,
+  Ref,
   Scope,
   Stream,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { HttpClient } from "effect/http";
-import { tmpdir } from "node:os";
+import { testArtifactCacheRoot as cacheRoot } from "../tests/artifact-cache.ts";
 import { engineTarget, testEngine } from "../tests/engine-target.ts";
 import { ownerFor } from "../tests/owner-rpc.ts";
 import type { LogRecord } from "./host/LogRecord.ts";
@@ -24,9 +26,9 @@ import * as LogStore from "./host/LogStore.ts";
 import * as StackNamespace from "./StackNamespace.ts";
 import type { SavedStack } from "./StackNamespace.ts";
 import { selection } from "../tests/pins.ts";
+import { failOnStall } from "../tests/stall-guard.ts";
 
-const cacheRoot = `${tmpdir()}/supabase-stack-artifacts`;
-const services = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const services = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 
 const stackFor = (id: string, runtime: SavedStack["runtime"]): SavedStack => ({
   id,
@@ -45,13 +47,10 @@ const openOwner = (
 ) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
     const path = yield* Path.Path;
     const root = kept?.root ?? (yield* fs.makeTempDirectoryScoped({ prefix }));
-    const stack = stackFor(
-      `owner-logs-${(yield* crypto.randomUUIDv4).replaceAll("-", "")}`,
-      runtime,
-    );
+    const stack = stackFor(`owner-logs-${(yield* crypto.uuidV4()).replaceAll("-", "")}`, runtime);
     const state = Context.get(
       yield* Layer.build(StackNamespace.layer({ root: `${root}/state` })),
       StackNamespace.Service,
@@ -96,6 +95,43 @@ const isOutput = (record: LogRecord) => record.kind === "stdout" || record.kind
 const firstOutput = (records: Stream.Stream<LogRecord, StackError>) =>
   records.pipe(Stream.filter(isOutput), Stream.take(1), Stream.runCollect);
 
+class NativeMailStallError extends Data.TaggedError("NativeMailStallError")<{
+  readonly message: string;
+}> {}
+
+type NativeMailPhase = {
+  readonly step: string;
+  readonly id?: string;
+  readonly history?: (id: string) => Stream.Stream<LogRecord, StackError>;
+};
+
+/** Fails a stalled native Mailpit step within the test timeout, naming the step and its persisted output. */
+const guardNativeMail = (phase: Ref.Ref<NativeMailPhase>) =>
+  failOnStall(
+    "25 seconds",
+    Effect.gen(function* () {
+      const { step, id, history } = yield* Ref.get(phase);
+      const output =
+        id === undefined || history === undefined
+          ? []
+          : yield* history(id).pipe(
+              Stream.filter(isOutput),
+              Stream.runCollect,
+              Effect.timeoutOrElse({
+                duration: "2 seconds",
+                orElse: () => Effect.succeed([]),
+              }),
+              Effect.orElseSucceed(() => []),
+            );
+      const text = Array.from(output, (record) => record.text ?? "")
+        .join("")
+        .slice(-2_000);
+      return yield* new NativeMailStallError({
+        message: `native Mailpit ${step}${id === undefined ? "" : ` (${id})`} did not finish within 25 seconds; output:\n${text || "(none)"}`,
+      });
+    }),
+  );
+
 /** Follows from the oldest record until `count` launch markers are persisted. */
 const awaitLaunches = (records: Stream.Stream<LogRecord, StackError>, count: number) =>
   records.pipe(
@@ -107,41 +143,56 @@ const awaitLaunches = (records: Stream.Stream<LogRecord, StackError>, count: num
 
 describe("owner persisted logs", () => {
   it.live("persists native output, serves history and follow, and deletes it on destroy", () =>
-    Effect.scoped(
-      Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const path = yield* Path.Path;
-        const owner = yield* openOwner("owner-logs-native-", "native");
-        const mail = yield* owner.rpc.createService({
-          service: "mail",
-          pin: selection.mail,
-          config: {},
-          endpoints: { http: { port: "auto" } },
-        });
-        yield* owner.rpc.startService({ id: mail.id });
-        yield* owner.rpc.readyService({ id: mail.id });
-
-        const [followed] = yield* firstOutput(owner.rpc.readLogs({ id: mail.id, follow: true }));
-        const history = Array.from(
-          yield* owner.rpc.readLogs({ id: mail.id, follow: false }).pipe(Stream.runCollect),
-        );
+    Effect.gen(function* () {
+      const phase = yield* Ref.make<NativeMailPhase>({ step: "owner start" });
+      const enter = (step: string, id?: string) =>
+        Ref.update(phase, (current) => ({ ...current, step, id }));
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const owner = yield* openOwner("owner-logs-native-", "native");
+          yield* Effect.addFinalizer(() => enter("owner teardown"));
+          yield* Ref.set(phase, {
+            step: "create",
+            history: (id) => owner.rpc.readLogs({ id, follow: false }),
+          });
+          const mail = yield* owner.rpc.createService({
+            service: "mail",
+            pin: selection.mail,
+            config: {},
+            endpoints: { http: { port: "auto" } },
+          });
+          yield* enter("artifact preparation and start", mail.id);
+          yield* owner.rpc.startService({ id: mail.id });
+          yield* enter("readiness", mail.id);
+          yield* owner.rpc.readyService({ id: mail.id });
+          yield* enter("first followed output", mail.id);
+          const [followed] = yield* firstOutput(owner.rpc.readLogs({ id: mail.id, follow: true }));
+          yield* enter("history read", mail.id);
+          const history = Array.from(
+            yield* owner.rpc.readLogs({ id: mail.id, follow: false }).pipe(Stream.runCollect),
+          );
 
-        expect(history[0]).toMatchObject({ kind: "launch", launchId: 1 });
-        expect(history).toContainEqual(followed);
-        const directory = path.join(owner.logsRoot, "mail", mail.id);
-        expect(yield* fs.exists(directory)).toBe(true);
-        const offline = yield* LogStore.streamStackLogs({ root: owner.logsRoot }).pipe(
-          Stream.filter(({ instanceId }) => instanceId === mail.id),
-          Stream.runCollect,
-        );
-        expect(offline.slice(0, history.length).map(({ position }) => position)).toEqual(
-          history.map(({ position }) => position),
-        );
+          expect(history[0]).toMatchObject({ kind: "launch", launchId: 1 });
+          expect(history).toContainEqual(followed);
+          const directory = path.join(owner.logsRoot, "mail", mail.id);
+          expect(yield* fs.exists(directory)).toBe(true);
+          yield* enter("offline history read", mail.id);
+          const offline = yield* LogStore.streamStackLogs({ root: owner.logsRoot }).pipe(
+            Stream.filter(({ instanceId }) => instanceId === mail.id),
+            Stream.runCollect,
+          );
+          expect(offline.slice(0, history.length).map(({ position }) => position)).toEqual(
+            history.map(({ position }) => position),
+          );
 
-        yield* owner.rpc.destroyService({ id: mail.id });
-        expect(yield* fs.exists(directory)).toBe(false);
-      }),
-    ).pipe(Effect.provide(services)),
+          yield* enter("destroy", mail.id);
+          yield* owner.rpc.destroyService({ id: mail.id });
+          expect(yield* fs.exists(directory)).toBe(false);
+        }),
+      ).pipe(guardNativeMail(phase));
+    }).pipe(Effect.provide(services)),
   );
 
   it.live("streams history through the public API after the owner stops", () =>
diff --git a/packages/stack/src/Owner.native-socket-sweep.integration.test.ts b/packages/stack/src/Owner.native-socket-sweep.integration.test.ts
index 5dd757a539..f4ef4c464d 100644
--- a/packages/stack/src/Owner.native-socket-sweep.integration.test.ts
+++ b/packages/stack/src/Owner.native-socket-sweep.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { createHash } from "node:crypto";
 import {
@@ -107,7 +107,7 @@ const ownerFor = (arrangement: Arrangement, fileSystem?: Layer.Layer<FileSystem.
 const inRuntimeRoot = (arrangement: Arrangement) =>
   Effect.provideService(NativeRuntimeRootBase, arrangement.runtimeRootBase);
 
-const platform = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const platform = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 
 it.live("destroy removes the socket directory a killed owner left behind", () =>
   Effect.scoped(
diff --git a/packages/stack/src/Owner.ts b/packages/stack/src/Owner.ts
index 397a70ce06..ec4efec9d1 100644
--- a/packages/stack/src/Owner.ts
+++ b/packages/stack/src/Owner.ts
@@ -1,6 +1,5 @@
 import {
   Context,
-  Crypto,
   Effect,
   Exit,
   Fiber,
@@ -15,6 +14,7 @@ import {
   Stream,
   SubscriptionRef,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
 import type { Rpc, RpcGroup } from "effect/rpc";
@@ -43,6 +43,7 @@ import { ProxyError } from "./Proxy.ts";
 import {
   backendAddress,
   credentialsFor,
+  emailTemplateFile,
   endpointNames,
   endpointPort,
   freshWrites,
@@ -229,13 +230,14 @@ const makeOwner = Effect.fn("Owner.make")(function* (
   const services = yield* Effect.context<
     | FileSystem.FileSystem
     | Path.Path
-    | Crypto.Crypto
+    | SecureRandom.SecureRandom
+    | Digest.Digest
     | ChildProcessSpawner.ChildProcessSpawner
     | HttpClient.HttpClient
     | Scope.Scope
   >();
   const ownerScope = Context.get(services, Scope.Scope);
-  const crypto = Context.get(services, Crypto.Crypto);
+  const crypto = Context.get(services, SecureRandom.SecureRandom);
   const path = Context.get(services, Path.Path);
   const fs = Context.get(services, FileSystem.FileSystem);
   const network = yield* Network.Service;
@@ -260,7 +262,7 @@ const makeOwner = Effect.fn("Owner.make")(function* (
     ),
   );
   const orchestrator = yield* Orchestrator.make<Entry>({ admit: () => rejectWhileDraining });
-  const helpers = yield* makeDockerHelperRegistry(yield* crypto.randomUUIDv4);
+  const helpers = yield* makeDockerHelperRegistry(yield* crypto.uuidV4());
   const logStore = yield* LogStore.make({
     root: StackNamespace.stackLogsRoot(path, options.state.root, options.saved.id),
   }).pipe(Effect.provideContext(services));
@@ -587,9 +589,10 @@ const makeOwner = Effect.fn("Owner.make")(function* (
           cause instanceof ProxyError ? cause : new ProxyError({ message: cause.message, cause }),
         ),
       );
+    const emailTemplate = emailTemplateFile(Ref.get(creation));
     const endpoints = Object.fromEntries(
       endpointNames(initial).map((name) => {
-        const shared = sharedRoutes(initial, name, routeKeys, backendFor);
+        const shared = sharedRoutes(initial, name, routeKeys, backendFor, emailTemplate);
         const join = joinRoutes(initial, name);
         const endpoint: NetworkEndpoint = {
           protocol: name === "http" ? "http" : "tcp",
@@ -685,7 +688,7 @@ const makeOwner = Effect.fn("Owner.make")(function* (
   const removeSaved = (id: string) => updateState((current) => withoutInstance(current, id));
 
   const addInstance = Effect.fn("Owner.addInstance")(function* (creation: ServiceCreation) {
-    const id = yield* crypto.randomUUIDv4;
+    const id = yield* crypto.uuidV4();
     const rollback = <E>(cause: E) => removeSaved(id).pipe(Effect.andThen(Effect.fail(cause)));
     const recipe = yield* recipeFor(creation, id);
     yield* updateState((current) => ({
@@ -787,6 +790,7 @@ const makeOwner = Effect.fn("Owner.make")(function* (
                     ),
                 ),
               ),
+          randomToken: crypto.uuidV4(),
           updateCreation: (id, values) =>
             Effect.gen(function* () {
               const entry = yield* orchestrator.get(id);
diff --git a/packages/stack/src/Ports.integration.test.ts b/packages/stack/src/Ports.integration.test.ts
index 4d075d7226..c6fa0dcc49 100644
--- a/packages/stack/src/Ports.integration.test.ts
+++ b/packages/stack/src/Ports.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeFileSystem, NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeFileSystem, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import {
   Context,
@@ -361,8 +361,9 @@ it.live(
       }),
     ).pipe(
       Effect.provide(
-        Layer.merge(
+        Layer.mergeAll(
           NodeServices.layer,
+          NodeCrypto.layer,
           Layer.merge(
             NodeHttpClient.layerNodeHttp,
             PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
@@ -442,8 +443,9 @@ it.live("a destroy that cannot remove the registration keeps every reservation",
     }),
   ).pipe(
     Effect.provide(
-      Layer.merge(
+      Layer.mergeAll(
         NodeServices.layer,
+        NodeCrypto.layer,
         Layer.merge(
           NodeHttpClient.layerNodeHttp,
           PortReservations.layer.pipe(Layer.provide(NodeServices.layer)),
diff --git a/packages/stack/src/PromiseClient.ts b/packages/stack/src/PromiseClient.ts
index dd509fcf1a..d8486fde3b 100644
--- a/packages/stack/src/PromiseClient.ts
+++ b/packages/stack/src/PromiseClient.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import {
   Cause,
   Effect,
@@ -131,7 +131,12 @@ export interface Stack extends Omit<DerivedStack, "services" | "composition" | "
   readonly close: () => Promise<void>;
 }
 
-const clientLayer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const clientLayer = Layer.mergeAll(
+  NodeServices.layer,
+  NodeCrypto.layerSecureRandom,
+  NodeCrypto.layerDigest,
+  NodeHttpClient.layerNodeHttp,
+);
 /** Every failure and defect of a cause, so none is hidden behind the first. */
 const causeErrors = (cause: Cause.Cause<unknown>): ReadonlyArray<unknown> =>
   cause.reasons.flatMap((reason) =>
diff --git a/packages/stack/src/StackHost.container-shutdown.integration.test.ts b/packages/stack/src/StackHost.container-shutdown.integration.test.ts
index 61dc222ece..180797e45f 100644
--- a/packages/stack/src/StackHost.container-shutdown.integration.test.ts
+++ b/packages/stack/src/StackHost.container-shutdown.integration.test.ts
@@ -1,18 +1,8 @@
 import { PgClient } from "@effect/sql-pg";
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
-import {
-  Context,
-  Crypto,
-  Effect,
-  Exit,
-  FileSystem,
-  Layer,
-  Path,
-  Redacted,
-  Schedule,
-  Stream,
-} from "effect";
+import { Context, Effect, Exit, FileSystem, Layer, Path, Redacted, Schedule, Stream } from "effect";
+import { SecureRandom } from "effect/crypto";
 import * as Reactivity from "effect/reactivity/Reactivity";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import * as Net from "node:net"; // oxlint-disable-line effecttsgo/node-builtin-import -- holds a raw TCP connection open across the owner stop.
@@ -120,9 +110,9 @@ it.live.skipIf(process.platform === "win32")(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const base = yield* fs.makeTempDirectoryScoped({ prefix: "stack-root-shutdown-" });
-        const stackId = `shared-${(yield* crypto.randomUUIDv4).replaceAll("-", "")}`;
+        const stackId = `shared-${(yield* crypto.uuidV4()).replaceAll("-", "")}`;
         const dataA = yield* makeDockerDatabaseRoot("stack-root-shutdown-a-", stackId).pipe(
           Effect.flatMap(fs.realPath),
         );
@@ -344,7 +334,11 @@ it.live.skipIf(process.platform === "win32")(
         activeB = undefined;
         expect(yield* containers(stackId, dataB), "destroy removes B containers").toEqual([]);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -355,9 +349,9 @@ it.live.skipIf(process.platform === "win32")(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const base = yield* fs.makeTempDirectoryScoped({ prefix: "stack-registration-lost-" });
-        const stackId = `registration-lost-${(yield* crypto.randomUUIDv4).replaceAll("-", "")}`;
+        const stackId = `registration-lost-${(yield* crypto.uuidV4()).replaceAll("-", "")}`;
         const dataRoot = yield* makeDockerDatabaseRoot(
           "stack-registration-lost-data-",
           stackId,
@@ -430,7 +424,11 @@ it.live.skipIf(process.platform === "win32")(
           "the data root is left in place for a successor or `destroy`",
         ).toBe(true);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -491,9 +489,9 @@ const losesRegistrationWhileStopRuns = (trigger: StopTrigger) =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
-      const crypto = yield* Crypto.Crypto;
+      const crypto = yield* SecureRandom.SecureRandom;
       const base = yield* fs.makeTempDirectoryScoped({ prefix: "stack-registration-lost-gated-" });
-      const stackId = `registration-lost-gated-${(yield* crypto.randomUUIDv4).replaceAll("-", "")}`;
+      const stackId = `registration-lost-gated-${(yield* crypto.uuidV4()).replaceAll("-", "")}`;
       const dataRoot = yield* makeDockerDatabaseRoot(
         "stack-registration-lost-gated-data-",
         stackId,
@@ -584,7 +582,11 @@ const losesRegistrationWhileStopRuns = (trigger: StopTrigger) =>
       ).toBe(true);
       expect(yield* containers(stackId, dataRoot), "the held stop still completed").toEqual([]);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)));
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  );
 
 it.live.skipIf(process.platform === "win32")(
   "finishes a signal-driven stop and exits when the registration disappears mid-stop",
@@ -605,9 +607,9 @@ it.live.skipIf(process.platform === "win32")(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const base = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-root-lost-" });
-        const stackId = `state-root-lost-${(yield* crypto.randomUUIDv4).replaceAll("-", "")}`;
+        const stackId = `state-root-lost-${(yield* crypto.uuidV4()).replaceAll("-", "")}`;
         const dataRoot = yield* makeDockerDatabaseRoot("stack-state-root-lost-data-", stackId).pipe(
           Effect.flatMap(fs.realPath),
         );
@@ -679,7 +681,7 @@ it.live.skipIf(process.platform === "win32")(
         const reclaimedBase = yield* fs.makeTempDirectoryScoped({
           prefix: "stack-state-root-lost-reclaim-",
         });
-        const reclaimedStackId = `state-root-lost-reclaim-${(yield* crypto.randomUUIDv4).replaceAll("-", "")}`;
+        const reclaimedStackId = `state-root-lost-reclaim-${(yield* crypto.uuidV4()).replaceAll("-", "")}`;
         const reclaimedDataRoot = yield* makeDockerDatabaseRoot(
           "stack-state-root-lost-reclaim-data-",
           reclaimedStackId,
@@ -712,7 +714,11 @@ it.live.skipIf(process.platform === "win32")(
           Effect.timeout("15 seconds"),
         );
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -723,9 +729,9 @@ it.live.skipIf(process.platform === "win32")(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const base = yield* fs.makeTempDirectoryScoped({ prefix: "stack-pinned-postgres-" });
-        const stackId = `pinned-postgres-${(yield* crypto.randomUUIDv4).replaceAll("-", "")}`;
+        const stackId = `pinned-postgres-${(yield* crypto.uuidV4()).replaceAll("-", "")}`;
         const dataRoot = yield* makeDockerDatabaseRoot("stack-pinned-postgres-data-", stackId).pipe(
           Effect.flatMap(fs.realPath),
         );
@@ -802,6 +808,10 @@ it.live.skipIf(process.platform === "win32")(
         const cut = yield* sql.unsafe("SELECT 1").pipe(Effect.timeout("5 seconds"), Effect.exit);
         expect(Exit.isFailure(cut), "the pinned connection is gone with the owner").toBe(true);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
diff --git a/packages/stack/src/StackHost.integration.test.ts b/packages/stack/src/StackHost.integration.test.ts
index 6c32a34b60..c3cf0f6977 100644
--- a/packages/stack/src/StackHost.integration.test.ts
+++ b/packages/stack/src/StackHost.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -283,7 +283,11 @@ it.live("preserves composition outcomes over RPC", () =>
       ]);
       yield* shutdownOwner(runtime.access, true);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("stops serving after a failed shutdown and keeps reporting that failure", () =>
@@ -324,7 +328,11 @@ it.live("stops serving after a failed shutdown and keeps reporting that failure"
       const again = yield* runtime.shutdown(true).pipe(Effect.flip);
       expect(again.message).toContain("Shutdown mode is already selected");
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("reports a destroy failure and the owner exits", () =>
@@ -387,7 +395,11 @@ it.live("reports a destroy failure and the owner exits", () =>
       // is reclaimed by the next stop or destroy.
       yield* Deferred.await(runtime.exit).pipe(Effect.timeout("5 seconds"));
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("rejects destroy while stop is in flight", () =>
@@ -432,7 +444,11 @@ it.live("rejects destroy while stop is in flight", () =>
       yield* Fiber.join(stop);
       yield* Deferred.await(runtime.exit).pipe(Effect.timeout("5 seconds"));
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("exits after a namespace shutdown defect without rerunning cleanup", () =>
@@ -475,7 +491,11 @@ it.live("exits after a namespace shutdown defect without rerunning cleanup", ()
       // The stop would succeed if it ran again; the failure is final for this owner.
       expect(Exit.isFailure(yield* runtime.shutdown(false).pipe(Effect.exit))).toBe(true);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live(
@@ -677,7 +697,11 @@ it.live(
         yield* waitForOwnerExit(endpoint.pid, ownerExitProbe(fs));
         yield* Ref.set(stopped, true);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 120_000 },
 );
 
@@ -728,7 +752,11 @@ it.live("finishes detached shutdown after the caller disconnects", () =>
       yield* Deferred.succeed(allow, undefined);
       yield* Deferred.await(runtime.exit).pipe(Effect.timeout("5 seconds"));
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("withdraws a command waiting for its prerequisite", () =>
@@ -788,7 +816,11 @@ it.live("withdraws a command waiting for its prerequisite", () =>
       expect((yield* client.status({ id: mail.id })).lifecycle).toBe("stopped");
       yield* shutdownOwner(runtime.access, false);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 const disconnectFixture = (prefix: string) =>
@@ -875,7 +907,11 @@ it.live("finishes a service creation after its caller disconnects", () =>
       yield* Deferred.await(runtime.exit).pipe(Effect.timeout("5 seconds"));
       expect(yield* state.read(saved.id)).toBeUndefined();
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("persists a composition change after its caller disconnects", () =>
@@ -941,7 +977,11 @@ it.live("persists a composition change after its caller disconnects", () =>
       yield* shutdownOwner(runtime.access, true);
       yield* Deferred.await(runtime.exit).pipe(Effect.timeout("5 seconds"));
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 const abandonedComposition = (prefix: string, destroy: boolean) =>
@@ -1023,7 +1063,11 @@ it.live("stops a stack only after an abandoned composition settles", () =>
       expect(instanceIds).toHaveLength(1);
       expect(current?.composition.members.map(({ id }) => id)).toEqual(instanceIds);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("destroys a stack only after an abandoned composition settles", () =>
@@ -1039,7 +1083,11 @@ it.live("destroys a stack only after an abandoned composition settles", () =>
       const data = `${root}/data`;
       expect((yield* fs.exists(data)) ? yield* fs.readDirectory(data) : []).toEqual([]);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 const endedOwnership = (prefix: string) =>
@@ -1109,7 +1157,11 @@ it.live.skipIf(process.platform === "win32")(
         );
         yield* shutdownOwner(successor, false);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 60_000 },
 );
 
@@ -1132,6 +1184,10 @@ it.live.skipIf(process.platform === "win32")(
 
         expect(yield* fs.readFileString(kept)).toBe("data");
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 60_000 },
 );
diff --git a/packages/stack/src/StackHost.ts b/packages/stack/src/StackHost.ts
index 12dec1b1e3..cc4848c44a 100644
--- a/packages/stack/src/StackHost.ts
+++ b/packages/stack/src/StackHost.ts
@@ -1,4 +1,5 @@
 import {
+  NodeCrypto,
   NodeHttpClient,
   NodeHttpServer,
   NodeHttpServerRequest,
@@ -7,7 +8,6 @@ import {
 import {
   Context,
   Cause,
-  Crypto,
   Data,
   DateTime,
   Deferred,
@@ -24,6 +24,7 @@ import {
   Semaphore,
   Path,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import * as HttpServer from "effect/http/HttpServer";
 import * as HttpServerRequest from "effect/http/HttpServerRequest";
 import * as NetAddress from "effect/net/NetAddress";
@@ -576,7 +577,7 @@ export const runStackHost = Effect.fn("StackHost.run")(
             port: control.port,
             release: options.release ?? (yield* currentRelease),
           };
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
           const secret = Array.from(yield* crypto.randomBytes(32), (byte) =>
             byte.toString(16).padStart(2, "0"),
           ).join("");
@@ -662,8 +663,10 @@ export const runStackHost = Effect.fn("StackHost.run")(
       }),
     ).pipe(
       Effect.provide(
-        Layer.merge(
+        Layer.mergeAll(
           NodeServices.layer,
+          NodeCrypto.layerSecureRandom,
+          NodeCrypto.layerDigest,
           // Idle sockets close before the 5 s keep-alive of the stack's shortest-lived upstream.
           Layer.provide(
             NodeHttpClient.layerNodeHttpNoAgent,
diff --git a/packages/stack/src/StackNamespace.ts b/packages/stack/src/StackNamespace.ts
index 0ea55bd1b9..eeb61dfc07 100644
--- a/packages/stack/src/StackNamespace.ts
+++ b/packages/stack/src/StackNamespace.ts
@@ -5,6 +5,7 @@ import * as Registry from "./namespace/Registry.ts";
 import { restrictDirectoryToOwner } from "./runtime/postgres-user.ts";
 
 export { NamespaceError } from "./namespace/Capabilities.ts";
+export { readContainedFile } from "./namespace/drivers/FileSystem.ts";
 export { LeaseHeldError, LeaseHolder } from "./namespace/Lease.ts";
 export { holdExclusiveLock, holdLock, holdSharedLock, isLockBusy } from "./namespace/Lock.ts";
 export { resolveStackDataRoot, stackDataRootLabel, stackLogsRoot } from "./namespace/Paths.ts";
diff --git a/packages/stack/src/Sweep.integration.test.ts b/packages/stack/src/Sweep.integration.test.ts
index ffc092ee92..09b1f84c33 100644
--- a/packages/stack/src/Sweep.integration.test.ts
+++ b/packages/stack/src/Sweep.integration.test.ts
@@ -1,9 +1,8 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import {
   Clock,
   Context,
-  Crypto,
   Data,
   Effect,
   Fiber,
@@ -13,6 +12,7 @@ import {
   Queue,
   Stream,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 // oxlint-disable-next-line effecttsgo/node-builtin-import -- test-only native watcher for synchronous attachment, no Effect wrapper gives this guarantee.
 import { watch as nodeWatch } from "node:fs";
@@ -131,8 +131,8 @@ it.live.skipIf(process.platform === "win32")(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
-        const suffix = (yield* crypto.randomUUIDv4).replaceAll("-", "");
+        const crypto = yield* SecureRandom.SecureRandom;
+        const suffix = (yield* crypto.uuidV4()).replaceAll("-", "");
         const deadId = `dead-${suffix}`;
         const dataA = yield* makeDockerDatabaseRoot("stack-sweep-a-", deadId).pipe(
           Effect.flatMap(fs.realPath),
@@ -221,7 +221,11 @@ it.live.skipIf(process.platform === "win32")(
         expect(yield* state.read(sessionId)).toBeUndefined();
         expect(yield* state.leased(deadId), "the sweeper released the dead stack").toBe(false);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -269,7 +273,11 @@ it.live(
         expect(yield* fs.exists(path.join(root, "old-with-lock", "owner.lock"))).toBe(true);
         expect(yield* fs.exists(path.join(root, "old-kept", "data"))).toBe(true);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
 );
 
 it.live("reclaiming a session stack refuses a symlinked data directory and keeps its target", () =>
@@ -301,7 +309,11 @@ it.live("reclaiming a session stack refuses a symlinked data directory and keeps
       expect(yield* fs.readFileString(path.join(outside, "precious.txt"))).toBe("keep");
       expect(yield* state.read(stack.id), "the registration stays for a retry").toBeDefined();
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("sweeps deleted stacks of its own root only, on the engine its owner pinned", () =>
@@ -387,7 +399,11 @@ it.live("sweeps deleted stacks of its own root only, on the engine its owner pin
         "the sweeper's lease leaves no directory behind",
       ).toBe(false);
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("does not reclaim a stack that is registered as a deleted one", () =>
diff --git a/packages/stack/src/composition/Supabase.native.integration.test.ts b/packages/stack/src/composition/Supabase.native.integration.test.ts
index a8716333ca..5c00f7c4ed 100644
--- a/packages/stack/src/composition/Supabase.native.integration.test.ts
+++ b/packages/stack/src/composition/Supabase.native.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import {
   Context,
@@ -68,6 +68,7 @@ it.live("reports the failed binding and cleanup reason with the retained instanc
     const unused = () => Effect.die("unused operation");
     const operations: SupabaseCompositionOperations = {
       currentComposition: Effect.succeed({ members: [], dependencies: [] }),
+      randomToken: Effect.succeed("token"),
       get: unused,
       status: unused,
       create: (creation) => Effect.succeed({ id: "retained-mail", creation }),
@@ -142,7 +143,11 @@ it.live("removes a managed SMTP binding when Mail is excluded", () =>
         }),
       () => owner.namespace.destroy,
     );
-  }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  }).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
 
 it.live("cleans created registrations when composition is interrupted", () =>
@@ -164,6 +169,7 @@ it.live("cleans created registrations when composition is interrupted", () =>
       Effect.fail(new SupabaseCompositionError({ message: `${operation} is unused` }));
     const operations: SupabaseCompositionOperations = {
       currentComposition: Effect.succeed({ members: [], dependencies: [] }),
+      randomToken: Effect.succeed("token"),
       get: () => unused("get"),
       status: () => unused("status"),
       create: (creation) =>
@@ -332,7 +338,145 @@ it.live(
         );
         expect(remove.status).toBe(200);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
+  { timeout: 180_000 },
+);
+
+const MailpitMessages = Schema.Struct({
+  messages: Schema.Array(
+    Schema.Struct({
+      ID: Schema.String,
+      To: Schema.Array(Schema.Struct({ Address: Schema.String })),
+    }),
+  ),
+});
+const MailpitMessage = Schema.Struct({ HTML: Schema.String });
+
+it.live(
+  "mails the configured template over unchanged listeners and follows a changed content_path",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const client = yield* HttpClient.HttpClient;
+        const root = yield* fs.realPath(
+          yield* fs.makeTempDirectoryScoped({ prefix: "catalog-native-templates-" }),
+        );
+        const first = `${root}/first.html`;
+        const second = `${root}/second.html`;
+        yield* fs.writeFileString(first, "<p>first template marker</p>");
+        yield* fs.writeFileString(second, "<p>second template marker</p>");
+        const saved = initial("catalog-native-templates");
+        const state = yield* stateFor(`${root}/state`);
+        yield* state.save(saved);
+        const owner = yield* ownerFor({ saved, state, root: `${root}/data`, cacheRoot });
+        yield* Effect.addFinalizer(() => owner.namespace.destroy.pipe(Effect.ignore));
+
+        const jwtSecret = "catalog-native-templates-secret-with-at-least-32-chars";
+        const services = (templates: ReadonlyArray<string>) => [
+          {
+            service: "database" as const,
+            pin: selection.database,
+            config: {
+              databasePassword: Redacted.make("postgres"),
+              jwtSecret: Redacted.make(jwtSecret),
+              jwtExpiry: 3600,
+            },
+            endpoints: { sql: { port: "auto" as const } },
+          },
+          {
+            service: "auth" as const,
+            pin: selection.auth,
+            config: {
+              jwtSecret,
+              jwtExpiry: 3600,
+              templates: templates.map((path) => ({ id: "invite", path, root })),
+            },
+            endpoints: { http: { port: "auto" as const } },
+          },
+          {
+            service: "mail" as const,
+            pin: selection.mail,
+            config: {},
+            endpoints: { http: { port: "auto" as const }, smtp: { port: "auto" as const } },
+          },
+        ];
+        const created = yield* owner.rpc.supabaseComposition({ services: services([]) });
+        const idOf = (service: string) => {
+          const id = created.find((entry) => entry.creation.service === service)?.id;
+          return id === undefined ? Effect.die(`${service} missing`) : Effect.succeed(id);
+        };
+        const reuseIds = [yield* idOf("database"), yield* idOf("auth"), yield* idOf("mail")];
+        const bindings = (
+          observations: Effect.Success<ReturnType<typeof owner.rpc.startComposition>>,
+        ) =>
+          observations
+            .flatMap(({ id, endpoints }) => endpoints.map((endpoint) => ({ id, ...endpoint })))
+            .toSorted((left, right) => left.port - right.port);
+        const withoutTemplates = bindings(yield* owner.rpc.startComposition());
+        yield* owner.rpc.stopComposition();
+
+        yield* owner.rpc.supabaseComposition({ services: services([first]), reuseIds });
+        expect(bindings(yield* owner.rpc.startComposition())).toEqual(withoutTemplates);
+
+        const auth = yield* owner.rpc.credentials({ id: yield* idOf("auth"), from: "host" });
+        const mail = yield* owner.rpc.credentials({ id: yield* idOf("mail"), from: "host" });
+        if (auth.url === undefined || auth.apiUrl === undefined || mail.url === undefined)
+          return yield* Effect.die("Native service URLs missing");
+        const serviceToken = yield* Effect.tryPromise(() =>
+          new SignJWT({ role: "service_role" })
+            .setProtectedHeader({ alg: "HS256", typ: "JWT" })
+            .setSubject("catalog-native-templates")
+            .setIssuedAt()
+            .setExpirationTime("1h")
+            .sign(new TextEncoder().encode(jwtSecret)),
+        );
+        /* Auth answers an invite with 200 and its built-in email even when its template fetch fails. */
+        const invitedBody = (email: string) =>
+          Effect.gen(function* () {
+            const invite = yield* client.execute(
+              yield* HttpClientRequest.bodyJson({ email })(
+                HttpClientRequest.post(`${auth.url}/invite`).pipe(
+                  HttpClientRequest.setHeader("Authorization", `Bearer ${serviceToken}`),
+                ),
+              ),
+            );
+            expect(invite.status, yield* invite.text).toBe(200);
+            const { messages } = yield* Schema.decodeUnknownEffect(MailpitMessages)(
+              yield* (yield* client.get(`${mail.url}/api/v1/messages`)).json,
+            );
+            const message = messages.find(({ To }) => To.some((to) => to.Address === email));
+            if (message === undefined) return yield* Effect.die(`No email for ${email}`);
+            const { HTML } = yield* Schema.decodeUnknownEffect(MailpitMessage)(
+              yield* (yield* client.get(`${mail.url}/api/v1/message/${message.ID}`)).json,
+            );
+            return HTML;
+          });
+        expect(yield* invitedBody("first@example.test")).toContain("first template marker");
+
+        yield* owner.rpc.stopComposition();
+        const changed = yield* owner.rpc.supabaseComposition({
+          services: services([second]),
+          reuseIds,
+        });
+        yield* owner.rpc.startComposition();
+        const composed = changed.find(({ creation }) => creation.service === "auth")?.creation;
+        if (composed?.service !== "auth") return yield* Effect.die("Auth missing");
+        const route = `${auth.apiUrl}/email/invite`;
+        expect((yield* client.get(route)).status).toBe(404);
+        const served = yield* client.get(`${route}?token=${composed.config.templateToken}`);
+        expect(yield* served.text).toContain("second template marker");
+        expect(yield* invitedBody("second@example.test")).toContain("second template marker");
+      }),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -430,7 +574,11 @@ it.live(
         expect((yield* client.get(restAddress.url)).status).toBe(200);
         expect((yield* client.get(`${authAddress.url}/health`)).status).toBe(200);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -492,7 +640,11 @@ it.live(
         });
         expect((yield* state.read(stack.id))?.composition.members).toHaveLength(1);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -580,7 +732,11 @@ it.live(
         if (studioCredentials.url === undefined) return yield* Effect.die("Studio URL missing");
         expect(new URL(studioCredentials.url).port).toBe(String(FIXED_STUDIO_PORT));
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -624,7 +780,11 @@ it.live(
         ]);
         yield* owner.rpc.stopComposition();
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
 
@@ -686,6 +846,10 @@ it.live(
         ]);
         yield* owner.rpc.stopService({ id: standaloneMail.id });
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 180_000 },
 );
diff --git a/packages/stack/src/composition/Supabase.ts b/packages/stack/src/composition/Supabase.ts
index b707855045..ad97e7dfe5 100644
--- a/packages/stack/src/composition/Supabase.ts
+++ b/packages/stack/src/composition/Supabase.ts
@@ -122,11 +122,14 @@ const managedBindings: ReadonlyArray<{
   },
 ];
 
-/** Inputs the composition derives, each from its shared API endpoint or a sibling member kind. */
+/**
+ * Inputs the composition derives, each from its shared API endpoint or a sibling member kind;
+ * `api` also covers a value it generates for that endpoint.
+ */
 const derivedInputs: Partial<
   Record<ServiceCreation["service"], Readonly<Record<string, "api" | ServiceCreation["service"]>>>
 > = {
-  auth: { externalApiUrl: "api" },
+  auth: { externalApiUrl: "api", templateBaseUrl: "api", templateToken: "api" },
   studio: {
     apiUrl: "api",
     publicApiUrl: "api",
@@ -189,6 +192,7 @@ export interface SupabaseCompositionOperations<E = SupabaseCompositionError> {
     from: "host" | "runtime",
   ) => Effect.Effect<string, E>;
   readonly output: (id: string, name: string) => Effect.Effect<string, E>;
+  readonly randomToken: Effect.Effect<string, E>;
   readonly updateCreation: (
     id: string,
     inputs: Record<string, string | undefined>,
@@ -775,7 +779,15 @@ export const makeSupabaseComposition = Effect.fn("Supabase.compose")(
           Effect.gen(function* () {
             const extra: Record<string, string> =
               entry.creation.service === "auth" && apiHostUrl !== undefined
-                ? { externalApiUrl: `${apiHostUrl}/auth/v1` }
+                ? {
+                    externalApiUrl: `${apiHostUrl}/auth/v1`,
+                    ...(apiRuntimeUrl === undefined || !entry.creation.config.templates?.length
+                      ? {}
+                      : {
+                          templateBaseUrl: apiRuntimeUrl,
+                          templateToken: yield* operations.randomToken,
+                        }),
+                  }
                 : entry.creation.service === "studio" &&
                     apiHostUrl !== undefined &&
                     apiRuntimeUrl !== undefined
diff --git a/packages/stack/src/composition/Supabase.unit.test.ts b/packages/stack/src/composition/Supabase.unit.test.ts
index 22b8ee1807..74745e287f 100644
--- a/packages/stack/src/composition/Supabase.unit.test.ts
+++ b/packages/stack/src/composition/Supabase.unit.test.ts
@@ -116,6 +116,7 @@ it.live(
         const captured = yield* Ref.make<Orchestrator.CompositionConfig | undefined>(undefined);
         const operations: SupabaseCompositionOperations = {
           currentComposition: Effect.succeed({ members: [], dependencies: [] }),
+          randomToken: Effect.succeed("token"),
           get: () => Effect.die("get is unused"),
           status: () => Effect.die("status is unused"),
           create: (creation) => Effect.succeed({ id: idFor(creation.service), creation }),
diff --git a/packages/stack/src/create.owner-rollback.integration.test.ts b/packages/stack/src/create.owner-rollback.integration.test.ts
index 89e38c9759..d9661d220c 100644
--- a/packages/stack/src/create.owner-rollback.integration.test.ts
+++ b/packages/stack/src/create.owner-rollback.integration.test.ts
@@ -1,11 +1,11 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Effect, Exit, Fiber, FileSystem, Layer, Path } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { create, discover } from "./effect.ts";
 import { deriveStackId, resolveStackIdentity } from "./identity/Identity.ts";
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 
 it.live(
   "removes a stack it just registered when the owner fails to launch, and lets a retry succeed",
diff --git a/packages/stack/src/credentials.integration.test.ts b/packages/stack/src/credentials.integration.test.ts
index 2f07e42fa7..27ff8df834 100644
--- a/packages/stack/src/credentials.integration.test.ts
+++ b/packages/stack/src/credentials.integration.test.ts
@@ -1,11 +1,11 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Redacted } from "effect";
 import { create, open } from "./effect.ts";
 import { testArtifactCacheRoot } from "../tests/artifact-cache.ts";
 import { selection } from "../tests/pins.ts";
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 
 it.live("persists effective credentials across service creation, reopen, and restart", () =>
   Effect.scoped(
diff --git a/packages/stack/src/data-conflicts.integration.test.ts b/packages/stack/src/data-conflicts.integration.test.ts
index 15fe9e9ad3..efa6ded864 100644
--- a/packages/stack/src/data-conflicts.integration.test.ts
+++ b/packages/stack/src/data-conflicts.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Path } from "effect";
 import { findDataConflicts } from "./effect.ts";
@@ -32,7 +32,7 @@ const project = Effect.gen(function* () {
 });
 
 const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-  effect.pipe(Effect.scoped, Effect.provide(NodeServices.layer));
+  effect.pipe(Effect.scoped, Effect.provide([NodeServices.layer, NodeCrypto.layer]));
 
 it.effect(
   "reports initialized data built by another upstream, but not a newer revision of its own",
@@ -151,7 +151,7 @@ it.effect(
           requested: "v2.196.1",
         });
         expect(found[0]?.message).toContain(
-          'keep this data by pinning `[local.services.auth] version = "v2.197.0"`',
+          'keep this data by pinning `local.services.auth.version` to `"v2.197.0"`',
         );
         expect(yield* conflicts({ auth: pinned(selection.auth, "v2.197.0") })).toEqual([]);
         expect(yield* conflicts({ auth: pinned(selection.auth, "v2.198.0") })).toEqual([]);
diff --git a/packages/stack/src/defaults.integration.test.ts b/packages/stack/src/defaults.integration.test.ts
index f2226674d6..53d3a46166 100644
--- a/packages/stack/src/defaults.integration.test.ts
+++ b/packages/stack/src/defaults.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Redacted } from "effect";
 import { DEFAULT_LOCAL_JWT_SECRET, DEFAULT_POSTGRES_ROOT_KEY } from "./Defaults.ts";
@@ -8,7 +8,11 @@ import { testArtifactCacheRoot } from "../tests/artifact-cache.ts";
 import { selection } from "../tests/pins.ts";
 
 const artifactCacheRoot = testArtifactCacheRoot;
-const effectLayer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const effectLayer = Layer.mergeAll(
+  NodeServices.layer,
+  NodeCrypto.layer,
+  NodeHttpClient.layerNodeHttp,
+);
 
 const effectDatabaseConfig = {
   databasePassword: Redacted.make("defaults-test-password"),
diff --git a/packages/stack/src/destroy.runtime-unavailable.integration.test.ts b/packages/stack/src/destroy.runtime-unavailable.integration.test.ts
index a5e6f22f64..bcd32db24c 100644
--- a/packages/stack/src/destroy.runtime-unavailable.integration.test.ts
+++ b/packages/stack/src/destroy.runtime-unavailable.integration.test.ts
@@ -1,9 +1,9 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { create, discover } from "./effect.ts";
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 
 // Strips the pinned `--host <endpoint>` prefix every invocation now carries, so a shim's own
 // `"$1"` checks see the real command unchanged; `DOCKER_HOST` below makes that prefix constant.
diff --git a/packages/stack/src/effect.integration.test.ts b/packages/stack/src/effect.integration.test.ts
index 7847586b06..6648fd3716 100644
--- a/packages/stack/src/effect.integration.test.ts
+++ b/packages/stack/src/effect.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, expectTypeOf, it } from "@effect/vitest";
 import {
   Cause,
@@ -41,7 +41,7 @@ import { deriveStackId, resolveStackIdentity } from "./identity/Identity.ts";
 import { testArtifactCacheRoot } from "../tests/artifact-cache.ts";
 import { database15, selection } from "../tests/pins.ts";
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 // Below the stack's native and auto port ranges and every OS ephemeral range, so neither another
 // test's auto allocation nor an outbound socket can already hold it.
 const FIXED_API_PORT = 9_393;
diff --git a/packages/stack/src/effect.ts b/packages/stack/src/effect.ts
index 72bcfe45f3..6caca1fab8 100644
--- a/packages/stack/src/effect.ts
+++ b/packages/stack/src/effect.ts
@@ -1,7 +1,6 @@
 import {
   Cause,
   Context,
-  Crypto,
   Deferred,
   Effect,
   Exit,
@@ -18,6 +17,7 @@ import {
   Semaphore,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
 import { RpcClientError } from "effect/rpc/RpcClientError";
@@ -390,12 +390,13 @@ const makeHandle = Effect.fn("Stack.makeHandle")(function* (
       | HttpClient.HttpClient
       | FileSystem.FileSystem
       | Path.Path
-      | Crypto.Crypto
+      | SecureRandom.SecureRandom
+      | Digest.Digest
       | ChildProcessSpawner.ChildProcessSpawner
       | Scope.Scope
     >(),
   );
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const handleScope = yield* Scope.Scope;
@@ -717,9 +718,7 @@ const makeHandle = Effect.fn("Stack.makeHandle")(function* (
           Effect.mapError((cause) => failure("command", cause)),
         );
         const { rpc } = current;
-        const attachmentId = yield* crypto.randomUUIDv4.pipe(
-          Effect.mapError((cause) => failure("command", cause)),
-        );
+        const attachmentId = yield* crypto.uuidV4();
         const scope = yield* Scope.Scope;
         const inputFailure = yield* Deferred.make<never, E | StackError>();
         const result = yield* Ref.make<{ jobId: string; exitCode: number } | undefined>(undefined);
@@ -1184,6 +1183,8 @@ export const findDeleted = Effect.fn("Stack.findDeleted")(
 
 /** Selects the persisted logs of a stack; its owner does not need to run. */
 export interface StreamStackLogsOptions extends Pick<StackLocations, "stateRoot"> {
+  /** Inclusive record positions by instance id; missing generations emit lost before retained records. */
+  readonly from?: ReadonlyMap<string, LogPosition>;
   readonly stackId: string;
   /** Instance ids to read; every instance with persisted logs by default. */
   readonly instances?: ReadonlyArray<string>;
@@ -1206,6 +1207,7 @@ export const streamStackLogs = (
       const root = StackNamespace.stackLogsRoot(path, options.stateRoot, options.stackId);
       return streamPersistedLogs({
         root,
+        ...(options.from === undefined ? {} : { from: options.from }),
         ...(options.instances === undefined ? {} : { instances: options.instances }),
         ...(options.since === undefined ? {} : { since: yield* sinceMillis(options.since) }),
       });
diff --git a/packages/stack/src/functions/FunctionsBootstrap.ts b/packages/stack/src/functions/FunctionsBootstrap.ts
index b4b72c5d7b..c90d76e154 100644
--- a/packages/stack/src/functions/FunctionsBootstrap.ts
+++ b/packages/stack/src/functions/FunctionsBootstrap.ts
@@ -1,4 +1,5 @@
-import { Crypto, Data, Effect, FileSystem, Path, type PlatformError, Schema } from "effect";
+import { Data, Effect, FileSystem, Path, type PlatformError, Schema } from "effect";
+import { Digest } from "effect/crypto";
 import { contentDigestHex } from "../internal/content-digest.ts";
 import { publishGeneration } from "../internal/generation-publish.ts";
 import { StackIdSchema, type StackId } from "../identity/StackId.ts";
@@ -42,7 +43,7 @@ export const makeFunctionsBootstrapOwner = Effect.fn("FunctionsBootstrap.makeOwn
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const digest = yield* Digest.Digest;
   yield* Schema.decodeEffect(StackIdSchema)(options.stackId).pipe(
     Effect.mapError((cause) => failure("Invalid stack identity", { cause })),
   );
@@ -57,7 +58,7 @@ export const makeFunctionsBootstrapOwner = Effect.fn("FunctionsBootstrap.makeOwn
     const hash = yield* mapFs(
       root,
       "hash functions bootstrap content",
-      contentDigestHex(crypto, input.content),
+      contentDigestHex(digest, input.content),
     );
     const generation = yield* mapFs(
       root,
diff --git a/packages/stack/src/functions/functions-bootstrap.integration.test.ts b/packages/stack/src/functions/functions-bootstrap.integration.test.ts
index 257420668e..531ecc73db 100644
--- a/packages/stack/src/functions/functions-bootstrap.integration.test.ts
+++ b/packages/stack/src/functions/functions-bootstrap.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Deferred, Effect, FileSystem, Fiber, Path } from "effect";
 import { StackIdSchema } from "../identity/StackId.ts";
@@ -40,7 +40,7 @@ describe("functions bootstrap owner", () => {
       expect(((yield* fs.stat(path.dirname(target))).mode ?? 0) & 0o777).toBe(0o700);
       expect(((yield* fs.stat(target)).mode ?? 0) & 0o777).toBe(0o600);
       expect(yield* fs.readFileString(target)).toBe("export default 1");
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("returns the canonical published path for a symlinked state root", () =>
@@ -72,7 +72,7 @@ describe("functions bootstrap owner", () => {
       expect(path.basename(target)).toBe("index.ts");
       expect(yield* fs.readFileString(target)).toBe("export default 2");
       expect(((yield* fs.stat(target)).mode ?? 0) & 0o777).toBe(0o600);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("keeps every published file's identity when identical content is written twice", () =>
@@ -87,7 +87,7 @@ describe("functions bootstrap owner", () => {
       expect(second).toBe(first);
       expect(yield* generationInodes(fs, path, second)).toEqual(before);
       expect(yield* fs.readFileString(first)).toBe("export default 1");
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("converges concurrent writers of identical content on one complete generation", () =>
@@ -108,6 +108,6 @@ describe("functions bootstrap owner", () => {
       expect(new Set(targets).size).toBe(1);
       const target = targets[0]!;
       expect(yield* fs.readFileString(target)).toBe("export default race");
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 });
diff --git a/packages/stack/src/functions/generated/serve-main-bundle.ts b/packages/stack/src/functions/generated/serve-main-bundle.ts
index 9f4dbbaeea..9ba90e6311 100644
--- a/packages/stack/src/functions/generated/serve-main-bundle.ts
+++ b/packages/stack/src/functions/generated/serve-main-bundle.ts
@@ -1,3 +1,3 @@
 // Generated by packages/stack/scripts/generate-functions-bootstrap.ts; run `pnpm generate`.
 /** Bundled Edge Runtime main service used when a Functions creation has no bootstrap. */
-export const defaultFunctionsBootstrap = "var eB=Object.defineProperty;var Eo=(e,t)=>{for(var r in t)eB(e,r,{get:t[r],enumerable:!0})};var Z=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Lg={pipe(){return Z(this,arguments)}},$s=(function(){function e(){}return e.prototype=Lg,e})();var l=function(e,t){if(typeof e==\"function\")return function(){return e(arguments)?t.apply(this,arguments):r=>t(r,...arguments)};switch(e){case 0:case 1:throw new RangeError(`Invalid arity ${e}`);case 2:return function(r,n){return arguments.length>=2?t(r,n):function(o){return t(o,r)}};case 3:return function(r,n,o){return arguments.length>=3?t(r,n,o):function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var R=e=>e;var je=e=>()=>e,Sr=je(!0),yf=je(!1),$g=je(null),bn=je(void 0),$n=bn;function Bg(e,...t){return Z(e,t)}function rC(e,t,r,n,o,s,a,i,c){switch(arguments.length){case 1:return e;case 2:return function(){return t(e.apply(this,arguments))};case 3:return function(){return r(t(e.apply(this,arguments)))};case 4:return function(){return n(r(t(e.apply(this,arguments))))};case 5:return function(){return o(n(r(t(e.apply(this,arguments)))))};case 6:return function(){return s(o(n(r(t(e.apply(this,arguments))))))};case 7:return function(){return a(s(o(n(r(t(e.apply(this,arguments)))))))};case 8:return function(){return i(a(s(o(n(r(t(e.apply(this,arguments))))))))};case 9:return function(){return c(i(a(s(o(n(r(t(e.apply(this,arguments)))))))))}}}function Vr(e){let t=new WeakMap;return r=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function Pa(e){let t=new WeakMap;return r=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o!==r&&t.set(o,o),o}}var Ft={};Eo(Ft,{AsyncFiberError:()=>vq,AsyncFiberErrorTypeId:()=>Aq,Done:()=>ub,DoneTypeId:()=>yq,ExceededCapacityError:()=>fb,ExceededCapacityErrorTypeId:()=>Cq,IllegalArgumentError:()=>ml,IllegalArgumentErrorTypeId:()=>Iq,InterruptorStackTrace:()=>XS,NoSuchElementError:()=>gq,NoSuchElementErrorTypeId:()=>xq,ReasonTypeId:()=>tq,StackTrace:()=>QS,TimeoutError:()=>Eq,TimeoutErrorTypeId:()=>Sq,TypeId:()=>eq,UnknownError:()=>Rq,UnknownErrorTypeId:()=>Oq,annotate:()=>Pq,annotations:()=>Mq,combine:()=>aq,die:()=>ci,done:()=>Y,empty:()=>nq,fail:()=>oq,filterInterruptors:()=>dq,findDefect:()=>dl,findDie:()=>uq,findError:()=>ab,findErrorOption:()=>ib,findFail:()=>iq,findInterrupt:()=>lq,fromReasons:()=>oa,hasDies:()=>cq,hasFails:()=>sb,hasInterrupts:()=>fq,hasInterruptsOnly:()=>ob,interrupt:()=>sq,interruptors:()=>pq,isAsyncFiberError:()=>kq,isCause:()=>eb,isDieReason:()=>rb,isDone:()=>qc,isExceededCapacityError:()=>wq,isFailReason:()=>na,isIllegalArgumentError:()=>Tq,isInterruptReason:()=>rq,isNoSuchElementError:()=>hq,isReason:()=>tb,isTimeoutError:()=>bq,isUnknownError:()=>_q,makeDieReason:()=>zc,makeFailReason:()=>jc,makeInterruptReason:()=>nb,map:()=>Ss,pretty:()=>cb,prettyErrors:()=>mq,reasonAnnotations:()=>Mm,squash:()=>Pm});var Sf=e=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;e instanceof Error&&t.delete(\"stack\");let r=Object.getPrototypeOf(e),n=r;for(;n!==null&&n!==Object.prototype;){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}return t.has(\"constructor\")&&typeof e.constructor==\"function\"&&r===e.constructor.prototype&&t.delete(\"constructor\"),t},lc=new WeakSet,bf=e=>new Uint8Array(e.buffer,e.byteOffset,e.byteLength);var Ma=0,oC=()=>{Ma++};function br(e){return typeof e==\"string\"}function Ef(e){return typeof e==\"number\"}function ad(e){return typeof e==\"boolean\"}function sC(e){return typeof e==\"bigint\"}function jg(e){return typeof e==\"symbol\"}function id(e){return br(e)||Ef(e)||jg(e)}function Zr(e){return typeof e==\"function\"}function aC(e){return e===void 0}function Io(e){return e!==void 0}function cd(e){return e!=null}function iC(e){return!1}function zg(e){return!0}function fr(e){return typeof e==\"object\"&&e!==null&&!Array.isArray(e)}function If(e){return typeof e==\"object\"&&e!==null||Zr(e)}var k=l(2,(e,t)=>If(e)&&t in e),At=l(2,(e,t)=>k(e,\"_tag\")&&e._tag===t);function cC(e){return e instanceof Error}function as(e){return k(e,Symbol.iterator)||br(e)}var se=\"~effect/Hash\",H=e=>{switch(typeof e){case\"number\":return It(e);case\"bigint\":return Re(e.toString(10));case\"string\":return Re(e);case\"function\":case\"object\":{if(e===null)break;if(e instanceof Date)return Number.isNaN(e.getTime())?Re(\"Invalid Date\"):Re(e.toISOString());if(e instanceof RegExp)return Re(e.toString());{if(lc.has(e))return ud(e);let t=fC.get(e);if(t!==void 0)return t;if(Wg.has(e))return oC(),Re(\"[Circular]\");Wg.add(e);let r=Ma,n;try{se in e?n=e[se]():typeof e==\"function\"?n=ud(e):e instanceof DataView?n=To(bf(e)):Array.isArray(e)||ArrayBuffer.isView(e)?n=To(e):e instanceof Map?n=tB(e):e instanceof Set?n=rB(e):n=Tf(e)}finally{Wg.delete(e)}return r===Ma&&fC.set(e,n),n}}}return qt(lC(Re(String(e))))},ud=e=>(Hg.has(e)||Hg.set(e,qt(Math.random()*4294967296|0)),Hg.get(e)),lC=e=>(e^=e>>>16,e=Math.imul(e,2246822507),e^=e>>>13,e=Math.imul(e,3266489909),e^e>>>16),le=l(2,(e,t)=>lC(Math.imul(e,2654435761)+Math.imul(t,2246822507))),qt=e=>e&3221225471|e>>>1&1073741824;var qg=new DataView(new ArrayBuffer(8)),It=e=>{let t=e|0;return t===e?qt(t):(qg.setFloat64(0,e!==e?NaN:e),qt(le(qg.getInt32(0),qg.getInt32(4))))},Re=e=>{let t=5381,r=e.length;for(;r;)t=t*33^e.charCodeAt(--r);return qt(t)},Jg=(e,t)=>{let r=12289;for(let n of t)r^=le(H(n),H(e[n]));return qt(r)},Tf=e=>Jg(e,Sf(e)),pC=(e,t)=>r=>{let n=e;for(let o of r)n^=t(o);return qt(n)},To=e=>{let t=6151;for(let r of e)t=le(t,H(r));return qt(t)},tB=pC(Re(\"Map\"),([e,t])=>le(H(e),H(t))),uC=Re(\"Set\"),rB=pC(uC,e=>le(uC,H(e))),Hg=new WeakMap,fC=new WeakMap,Wg=new WeakSet;var ae=\"~effect/Equal\";function J(){return arguments.length===1?e=>Fa(e,arguments[0]):Fa(arguments[0],arguments[1])}function Fa(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;return r!==typeof t?!1:r===\"number\"&&e!==e&&t!==t?!0:r!==\"object\"&&r!==\"function\"||lc.has(e)||lc.has(t)?!1:nB(e,t)}function nB(e,t){let r=fd.length;for(let s=r;s-- >0;)if(fd[s]===e&&Kg[s]===t)return!0;if(r)return dC(e,t);let n=mC.get(e);n||mC.set(e,n=new WeakMap);let o=n.get(t);return o===void 0&&n.set(t,o=dC(e,t)),o}function dC(e,t){fd.push(e),Kg.push(t);try{return oB(e,t)}finally{fd.pop(),Kg.pop()}}var fd=[],Kg=[],mC=new WeakMap;function oB(e,t){if(H(e)!==H(t))return!1;if(e instanceof Date){if(!(t instanceof Date))return!1;let n=e.getTime(),o=t.getTime();return n===o||Number.isNaN(n)&&Number.isNaN(o)}else if(e instanceof RegExp)return t instanceof RegExp&&e.toString()===t.toString();let r=xC(e);if(r!==xC(t)||typeof e==\"function\"&&!r)return!1;if(r)return e[ae](t);if(Array.isArray(e))return!Array.isArray(t)||e.length!==t.length?!1:sB(e,t);if(ArrayBuffer.isView(e)){let n=e instanceof DataView;return!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||n!==t instanceof DataView?!1:n?hC(bf(e),bf(t)):hC(e,t)}else{if(e instanceof Map)return!(t instanceof Map)||e.size!==t.size?!1:Gg(e,t,iB,cB);if(e instanceof Set)return!(t instanceof Set)||e.size!==t.size?!1:Gg(e,t,H,Fa)}return aB(e,t)}function sB(e,t){for(let r=0;r<e.length;r++)if(!Fa(e[r],t[r]))return!1;return!0}function hC(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function aB(e,t){let r=Sf(e),n=Sf(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!Fa(e[o],t[o]))return!1;return!0}function Gg(e,t,r,n){let o=new Map,s=0;for(let a of t){let i=r(a),c=o.get(i);c?c.push(a):o.set(i,[a]),s++}e:for(let a of e){let i=o.get(r(a));if(i){for(let c=0;c<i.length;c++)if(n(a,i[c])){i[c]=i[i.length-1],i.pop(),s--;continue e}}return!1}return s===0}var iB=e=>H(e[0]),cB=(e,t)=>Fa(e[0],t[0])&&Fa(e[1],t[1]),uB=()=>0;function ld(e,t){return wf((r,n)=>e(r[0],n[0])&&t(r[1],n[1]))}function wf(e){return function(r,n){return Gg(r,n,uB,e)}}var xC=e=>k(e,ae),Vg=()=>J;var gC=e=>(lc.add(e),e);var Na=Symbol.for(\"~effect/Redactable\"),fB=e=>k(e,Na);function is(e){return fB(e)?Zg(e):e}function Zg(e){return e[Na](globalThis[pc]?.context??lB)}var pc=\"~effect/Fiber/currentFiber\",yC=new Map,lB={\"~effect/Context\":{},base:yC,depth:0,mapUnsafe:yC,pipe(){return Z(this,arguments)}};function F(e,t){let r=t?.space??0,n=new WeakSet,o=r?typeof r==\"number\"?\" \".repeat(r):r:\"\",s=f=>o.repeat(f),a=(f,p)=>{let d=f?.constructor;return d&&d!==Object.prototype.constructor&&d.name?`${d.name}(${p})`:p},i=f=>{try{return Reflect.ownKeys(f)}catch{return[\"[ownKeys threw]\"]}};function c(f,p=0){try{return u(f,p)}catch{return(typeof f==\"object\"&&f!==null||typeof f==\"function\")&&n.delete(f),\"[inspection threw]\"}}function u(f,p=0){if(typeof f==\"string\")return JSON.stringify(f);if(typeof f==\"number\"||f==null||typeof f==\"boolean\"||typeof f==\"symbol\")return String(f);if(typeof f==\"bigint\")return String(f)+\"n\";if(typeof f==\"object\"||typeof f==\"function\"){if(n.has(f))return pB;n.add(f);let d;if(Na in f)d=c(Zg(f),p);else if(Array.isArray(f))d=!o||f.length<=1?`[${f.map(m=>c(m,p)).join(\",\")}]`:`[\n${s(p+1)}${f.map(m=>c(m,p+1)).join(`,\n`+s(p+1))}\n${s(p)}]`;else if(f instanceof Date)d=Yg(f);else if(!t?.ignoreToString&&k(f,\"toString\")&&typeof f.toString==\"function\"&&f.toString!==Object.prototype.toString&&f.toString!==Array.prototype.toString){let m=dB(f);d=f instanceof Error&&f.cause!==void 0?`${m} (cause: ${c(f.cause,p)})`:m}else if(Symbol.iterator in f)d=`${f.constructor.name}(${c(Array.from(f),p)})`;else{let m=i(f);if(!o||m.length<=1){let x=`{${m.map(y=>`${wo(y)}:${c(bC(f,y),p)}`).join(\",\")}}`;d=a(f,x)}else{let x=`{\n${m.map(y=>`${s(p+1)}${wo(y)}: ${c(bC(f,y),p+1)}`).join(`,\n`)}\n${s(p)}}`;d=a(f,x)}}return n.delete(f),d}return String(f)}return c(e,0)}var pB=\"[Circular]\";function wo(e){return typeof e==\"string\"?JSON.stringify(e):String(e)}function pd(e){return e.map(t=>`[${wo(t)}]`).join(\"\")}function Yg(e){try{return e.toISOString()}catch{return\"Invalid Date\"}}function dB(e){try{let t=e.toString();return typeof t==\"string\"?t:String(t)}catch{return\"[toString threw]\"}}function bC(e,t){try{return e[t]}catch{return\"[property access threw]\"}}function Ua(e,t){let r=[];return JSON.stringify(e,function(n,o){let s=Object.getOwnPropertyDescriptor(this,n)?.value,a=k(s,Na)?is(s):is(o);if(typeof a==\"bigint\")return F(a);if(typeof a!=\"object\"||a===null)return a;let i=a instanceof Error&&!k(a,\"toJSON\")?{...a,name:a.name,message:a.message}:a;for(;r.length>0&&r[r.length-1]!==this;)r.pop();if(r.includes(a))return;if(r.push(a),i!==a&&r.push(i),!mB(i)||hB(i))return i;let c=new Proxy(i,{get(u,f){let p=Reflect.get(u,f,u);return Object.getOwnPropertyDescriptor(u,f)?.get!==void 0?is(p):p}});return r.push(c),c},t?.space)??\"null\"}function mB(e){for(let t of Object.getOwnPropertyNames(e))if(Object.getOwnPropertyDescriptor(e,t)?.get!==void 0)return!0;return!1}function hB(e){for(let t of[Number.prototype.valueOf,Boolean.prototype.valueOf,String.prototype.valueOf])try{return Reflect.apply(t,e,[]),!0}catch{}return!1}var Te=Symbol.for(\"nodejs.util.inspect.custom\"),vt=e=>{try{return e=is(e),k(e,\"toJSON\")&&Zr(e.toJSON)&&e.toJSON.length===0?e.toJSON():Array.isArray(e)?e.map(vt):e}catch{return\"[toJSON threw]\"}},IC=(e,t=2)=>{if(typeof e==\"string\")return e;try{return typeof e==\"object\"?Ua(e,{space:t}):F(e,{space:t})}catch{return String(e)}},dc={toJSON(){return vt(this)},[Te](){return this.toJSON()},toString(){return F(this.toJSON())}},EC=class{[Te](){return this.toJSON()}toString(){return F(this.toJSON())}};var gB=()=>{let e=Object.getOwnPropertyDescriptor(Error,\"stackTraceLimit\");return e===void 0?Object.isExtensible(Error):Object.hasOwn(e,\"writable\")?e.writable===!0:e.set!==void 0},yB=gB(),Co=()=>Error.stackTraceLimit,Yr=e=>{yB&&(Error.stackTraceLimit=e)};var Bs=class{constructor(t){this.value=t,this.done=!1}next(t){return this.done?(this.value=t,this):(this.done=!0,{value:this.value,done:!1})}},SB=()=>{let e=\"~effect/Utils/internal\",t={[e]:o=>o()},r={[e]:o=>o()};return Co()!==0&&t[e](()=>new Error().stack)?.includes(e)===!0?t[e]:r[e]},js=SB();function M(e,t,r){t===\"__proto__\"?Object.defineProperty(e,t,{value:r,writable:!0,enumerable:!0,configurable:!0}):e[t]=r}function md(e,t){for(let r of Reflect.ownKeys(t))Object.prototype.propertyIsEnumerable.call(t,r)&&M(e,r,t[r])}var ko=\"~effect/Effect\",Da=\"~effect/Exit\",EB={_A:R,_E:R,_R:R},Qg=`${ko}/identifier`,ue=`${ko}/args`,Ke=`${ko}/evaluate`,_t=`${ko}/successCont`,Qr=`${ko}/failureCont`,La=`${ko}/ensureCont`,ja=Symbol.for(\"effect/Effect/Yield\"),rr={pipe(){return Z(this,arguments)},toJSON(){return{...this}},toString(){return F(this.toJSON(),{ignoreToString:!0,space:2})},[Te](){return this.toJSON()}},wC={[se](){return Jg(this,Object.keys(this))},[ae](e){let t=Object.keys(this),r=Object.keys(e);if(t.length!==r.length)return!1;for(let n=0;n<t.length;n++)if(t[n]!==r[n]||!J(this[t[n]],e[t[n]]))return!1;return!0}},IB={[ko]:EB,...rr,[Symbol.iterator](){return new Bs(this)},toJSON(){return{_id:\"Effect\",op:this[Qg],...ue in this?{args:this[ue]}:void 0}}},ie=e=>k(e,ko),vf=e=>k(e,Da),Cf=\"~effect/Cause\",mc=\"~effect/Cause/Reason\",xc=e=>k(e,Cf),CC=e=>k(e,mc),Ao=class{constructor(t){this[Cf]=Cf,this.reasons=t}pipe(){return Z(this,arguments)}toJSON(){return{_id:\"Cause\",failures:this.reasons.map(t=>t.toJSON())}}toString(){return`Cause(${F(this.reasons)})`}[Te](){return this.toJSON()}[ae](t){return xc(t)&&this.reasons.length===t.reasons.length&&this.reasons.every((r,n)=>J(r,t.reasons[n]))}[se](){return To(this.reasons)}},TC=new WeakMap,hc=class{[mc];annotations;_tag;constructor(t,r,n){if(this[mc]=mc,this._tag=t,r!==Of&&typeof n==\"object\"&&n!==null&&r.size>0){let o=TC.get(n);o&&(r=new Map([...o,...r])),TC.set(n,r)}this.annotations=r}annotate(t,r){if(t.mapUnsafe.size===0)return this;let n=new Map(this.annotations);t.mapUnsafe.forEach((s,a)=>{r?.overwrite!==!0&&n.has(a)||n.set(a,s)});let o=Object.assign(Object.create(Object.getPrototypeOf(this)),this);return o.annotations=n,o}pipe(){return Z(this,arguments)}toString(){return F(this)}[Te](){return this.toString()}},Of=new Map,$a=class extends hc{constructor(t,r=Of){super(\"Fail\",r,t),this.error=t}toString(){return`Fail(${F(this.error)})`}toJSON(){return{_tag:\"Fail\",error:this.error}}[ae](t){return jn(t)&&J(this.error,t.error)&&J(this.annotations,t.annotations)}[se](){return le(Re(this._tag))(le(H(this.error))(H(this.annotations)))}},cs=e=>new Ao(e),TB=(e,t)=>{let r=new Map,n=[];for(let o of e.concat(t)){let s=H(o),a=r.get(s);if(a===void 0)r.set(s,[o]);else{if(a.some(i=>J(i,o)))continue;a.push(o)}n.push(o)}return n},za=l(2,(e,t)=>{if(e.reasons.length===0)return t;if(t.reasons.length===0)return e;let r=new Ao(TB(e.reasons,t.reasons));return J(e,r)?e:r}),hd=new Ao([]),gc=e=>new Ao([new $a(e)]),Af=class extends hc{constructor(t,r=Of){super(\"Die\",r,t),this.defect=t}toString(){return`Die(${F(this.defect)})`}toJSON(){return{_tag:\"Die\",defect:this.defect}}[ae](t){return qa(t)&&J(this.defect,t.defect)&&J(this.annotations,t.annotations)}[se](){return le(Re(this._tag))(le(H(this.defect))(H(this.annotations)))}},Xg=e=>new Ao([new Af(e)]),yc=l(e=>xc(e[0]),(e,t,r)=>t.mapUnsafe.size===0?e:new Ao(e.reasons.map(n=>n.annotate(t,r)))),jn=e=>e._tag===\"Fail\",qa=e=>e._tag===\"Die\",Ha=e=>e._tag===\"Interrupt\";function wB(e){return Er(\"Effect.evaluate: Not implemented\")}var Xr=e=>({...IB,[Qg]:e.op,[Ke]:e[Ke]??wB,[_t]:e[_t],[Qr]:e[Qr],[La]:e[La]}),En=e=>{let t=Xr(e),r=function(n){this[ue]=n};return r.prototype=t,function(n){return new r(n)}},AC=e=>{let t={[Da]:Da,_tag:e.op,get[e.prop](){return this[ue]},...Xr(e),toString(){return`${e.op}(${F(this[ue])})`},toJSON(){return{_id:\"Exit\",_tag:e.op,[e.prop]:this[ue]}},[ae](n){return vf(n)&&n._tag===this._tag&&J(this[ue],n[ue])},[se](){return le(Re(e.op),H(this[ue]))}},r=function(n){this[ue]=n};return r.prototype=t,function(n){return new r(n)}},Ae=AC({op:\"Success\",prop:\"value\",[Ke](e){let t=e.getCont(_t);return t?t[_t](this[ue],e,this):e.yieldWith(this)}}),xd={key:\"effect/Cause/StackTrace\"},ey={key:\"effect/Cause/InterruptorStackTrace\"},Ht=AC({op:\"Failure\",prop:\"cause\",[Ke](e){let t=this[ue],r=!1;e.cache.stackFrame&&(t=yc(t,{mapUnsafe:new Map([[xd.key,e.cache.stackFrame]])}),r=!0);let n=e.getCont(Qr),o=e._interruptedCause;if(o&&e.interruptible){let s=!1;for(;n&&e.interruptible;)s||=Qg in n,n=e.getCont(Qr);s&&(t=cs(t.reasons.filter(a=>a._tag!==\"Fail\"))),t=za(t,o),r=!0}return n?n[Qr](t,e,r?void 0:this):e.yieldWith(r?Ht(t):this)}}),en=e=>Ht(gc(e)),Er=e=>Ht(Xg(e)),re=En({op:\"WithFiber\",[Ke](e){return this[ue](e)}}),kC=En({op:\"WithFiberSucceed\",[Ke](e){let t=this[ue](e),r=e.getCont(_t);return r?r[_t](t,e):e.yieldWith(Ae(t))}}),CB=(function(){class e extends globalThis.Error{}let t=Xr({op:\"YieldableError\",[Ke](){return en(this)}});return delete t.toString,Object.assign(e.prototype,t),e})(),_f=(function(){let e=Symbol.for(\"effect/Data/Error/plainArgs\");return class extends CB{constructor(r){super(r?.message,r?.cause?{cause:r.cause}:void 0),r&&(md(this,r),Object.defineProperty(this,e,{value:r,enumerable:!1}))}toJSON(){return{...this[e],...this}}}})(),us=e=>{class t extends _f{_tag=e}return t.prototype.name=e,t},kf=\"~effect/Cause/NoSuchElementError\",gd=e=>k(e,kf),Bn=class extends us(\"NoSuchElementError\"){[kf]=kf;constructor(t){super({message:t})}},Ba=\"~effect/Cause/Done\",vC=e=>k(e,Ba),OC={[Ba]:Ba,_tag:\"Done\",value:void 0},Wa=e=>e===void 0?OC:{[Ba]:Ba,_tag:\"Done\",value:e},AB=en(OC),_C=e=>e===void 0?AB:en(Wa(e));var yd=e=>Xr({op:e.label,[Ke]:e.evaluate});var xe={};Eo(xe,{Do:()=>fj,all:()=>ZB,andThen:()=>HB,as:()=>JC,asVoid:()=>zB,bind:()=>uj,bindTo:()=>ij,composeK:()=>GB,contains:()=>sj,containsWith:()=>ZC,exists:()=>aj,filter:()=>Va,filterMap:()=>ej,firstSomeOf:()=>BB,flatMap:()=>Ka,flatMapNullishOr:()=>WB,flatten:()=>Ga,fromIterable:()=>FB,fromNullOr:()=>cy,fromNullishOr:()=>Nf,fromUndefinedOr:()=>iy,gen:()=>lj,getFailure:()=>UB,getOrElse:()=>Ff,getOrNull:()=>Rd,getOrThrow:()=>uy,getOrThrowWith:()=>Pd,getOrUndefined:()=>qs,getSuccess:()=>NB,isNone:()=>fe,isOption:()=>wc,isSome:()=>be,let:()=>cj,lift2:()=>nj,liftNullishOr:()=>jB,liftPredicate:()=>oj,liftThrowable:()=>zn,makeCombinerFailFast:()=>YC,makeEquivalence:()=>tj,makeOrder:()=>rj,makeReducer:()=>pj,makeReducerFailFast:()=>dj,map:()=>Rt,match:()=>Wt,none:()=>v,orElse:()=>DB,orElseResult:()=>$B,orElseSome:()=>LB,partitionMap:()=>XB,product:()=>GC,productMany:()=>VB,reduceCompact:()=>YB,some:()=>O,tap:()=>KC,toArray:()=>QB,toRefinement:()=>MB,void:()=>qB,zipLeft:()=>KB,zipRight:()=>JB,zipWith:()=>VC});function RC(e){return{combine:e}}function ry(e,t,r){return{combine:e,initialValue:t,combineAll:r??(n=>{let o=t;for(let s of n)o=e(o,s);return o})}}var nr=e=>(t,r)=>t===r||e(t,r),kB=(e,t)=>e===t,Ja=()=>kB;function FC(e){return nr((t,r)=>{if(t.length!==r.length)return!1;for(let n=0;n<t.length;n++)if(!e[n](t[n],r[n]))return!1;return!0})}function Sd(e){return nr((t,r)=>{if(t.length!==r.length)return!1;for(let n=0;n<t.length;n++)if(!e(t[n],r[n]))return!1;return!0})}var bd=e=>l(3,(t,r,n)=>e(t,o=>({...o,[r]:n(o)}))),Ed=e=>l(2,(t,r)=>e(t,n=>({[r]:n}))),Id=(e,t)=>l(3,(r,n,o)=>t(r,s=>e(o(s),a=>({...s,[n]:a}))));var UC=\"~effect/Option\",DC={[UC]:{_A:e=>e},...rr,[Symbol.iterator](){return new Bs(this)}},vB=Object.defineProperty(Object.assign(Object.create(DC),{_tag:\"Some\",_op:\"Some\",[ae](e){return Td(e)&&ny(e)&&J(this.value,e.value)},[se](){return le(H(this._tag))(H(this.value))},toString(){return`some(${F(this.value)})`},toJSON(){return{_id:\"Option\",_tag:this._tag,value:vt(this.value)}}}),\"valueOrUndefined\",{get(){return this.value}}),OB=H(\"None\"),_B=Object.assign(Object.create(DC),{_tag:\"None\",_op:\"None\",valueOrUndefined:void 0,[ae](e){return Td(e)&&wd(e)},[se](){return OB},toString(){return\"none()\"},toJSON(){return{_id:\"Option\",_tag:this._tag}}}),Td=e=>k(e,UC),wd=e=>e._tag===\"None\",ny=e=>e._tag===\"Some\",Rf=Object.create(_B),LC=function(e){this.value=e};LC.prototype=vB;var Pf=e=>new LC(e);var BC=\"~effect/Result\",jC={[BC]:{_A:e=>e,_E:e=>e},...rr,[Symbol.iterator](){return new Bs(this)}},RB=Object.assign(Object.create(jC),{_tag:\"Success\",_op:\"Success\",[ae](e){return Cd(e)&&bc(e)&&J(this.success,e.success)},[se](){return le(H(this._tag))(H(this.success))},toString(){return`success(${F(this.success)})`},toJSON(){return{_id:\"Result\",_tag:this._tag,value:vt(this.success)}}}),PB=Object.assign(Object.create(jC),{_tag:\"Failure\",_op:\"Failure\",[ae](e){return Cd(e)&&Sc(e)&&J(this.failure,e.failure)},[se](){return le(H(this._tag))(H(this.failure))},toString(){return`failure(${F(this.failure)})`},toJSON(){return{_id:\"Result\",_tag:this._tag,failure:vt(this.failure)}}}),Cd=e=>k(e,BC),Sc=e=>e._tag===\"Failure\",bc=e=>e._tag===\"Success\",zC=function(e){this.failure=e};zC.prototype=PB;var Ad=e=>new zC(e),qC=function(e){this.success=e};qC.prototype=RB;var kd=e=>new qC(e),oy=e=>bc(e)?Rf:Pf(e.failure),sy=e=>Sc(e)?Rf:Pf(e.success);function zs(e){return(t,r)=>t===r?0:e(t,r)}var WC=zs((e,t)=>e<t?-1:1),fs=zs((e,t)=>globalThis.Number.isNaN(e)&&globalThis.Number.isNaN(t)?0:globalThis.Number.isNaN(e)?-1:globalThis.Number.isNaN(t)?1:e<t?-1:1);var Ec=zs((e,t)=>e<t?-1:1);var ay=l(2,(e,t)=>zs((r,n)=>e(t(r),t(n)))),Ic=ay(fs,e=>e.getTime());var vd=e=>l(2,(t,r)=>e(t,r)===-1),Tc=e=>l(2,(t,r)=>e(t,r)===1),Od=e=>l(2,(t,r)=>e(t,r)!==1),_d=e=>l(2,(t,r)=>e(t,r)!==-1);var v=()=>Rf,O=Pf,wc=Td,fe=wd,be=ny,Wt=l(2,(e,{onNone:t,onSome:r})=>fe(e)?t():r(e.value)),MB=e=>t=>be(e(t)),FB=e=>{for(let t of e)return O(t);return v()},NB=sy,UB=oy,Ff=l(2,(e,t)=>fe(e)?t():e.value),DB=l(2,(e,t)=>fe(e)?t():e),LB=l(2,(e,t)=>fe(e)?O(t()):e),$B=l(2,(e,t)=>fe(e)?Rt(t(),kd):Rt(e,Ad)),BB=e=>{let t=v();for(t of e)if(be(t))return t;return t},Nf=e=>e==null?v():O(e),iy=e=>e===void 0?v():O(e),cy=e=>e===null?v():O(e),jB=e=>(...t)=>Nf(e(...t)),Rd=Ff($g),qs=Ff(bn),zn=e=>(...t)=>{try{return O(e(...t))}catch{return v()}},Pd=l(2,(e,t)=>{if(be(e))return e.value;throw t()}),uy=Pd(()=>new Error(\"getOrThrow called on a None\")),Rt=l(2,(e,t)=>fe(e)?v():O(t(e.value))),JC=l(2,(e,t)=>Rt(e,()=>t)),zB=JC(void 0),qB=O(void 0);var Ka=l(2,(e,t)=>fe(e)?v():t(e.value)),HB=l(2,(e,t)=>Ka(e,r=>{let n=Zr(t)?t(r):t;return wc(n)?n:O(n)})),WB=l(2,(e,t)=>fe(e)?v():Nf(t(e.value))),Ga=Ka(R),JB=l(2,(e,t)=>Ka(e,()=>t)),KB=l(2,(e,t)=>KC(e,()=>t)),GB=l(2,(e,t)=>r=>Ka(e(r),t)),KC=l(2,(e,t)=>Ka(e,r=>Rt(t(r),()=>r))),GC=l(2,(e,t)=>be(e)&&be(t)?O([e.value,t.value]):v()),VB=l(2,(e,t)=>{if(fe(e))return v();let r=[e.value];for(let n of t){if(fe(n))return v();r.push(n.value)}return O(r)}),ZB=e=>{if(Symbol.iterator in e){let r=[];for(let n of e){if(fe(n))return v();r.push(n.value)}return O(r)}let t={};for(let r of Object.keys(e)){let n=e[r];if(fe(n))return v();M(t,r,n.value)}return O(t)},VC=l(3,(e,t,r)=>Rt(GC(e,t),([n,o])=>r(n,o))),YB=l(3,(e,t,r)=>{let n=t;for(let o of e)be(o)&&(n=r(n,o.value));return n}),QB=e=>fe(e)?[]:[e.value],XB=l(2,(e,t)=>{if(fe(e))return[v(),v()];let r=t(e.value);return Sc(r)?[v(),O(r.failure)]:[O(r.success),v()]}),ej=l(2,(e,t)=>{if(fe(e))return v();let r=t(e.value);return bc(r)?O(r.success):v()}),Va=l(2,(e,t)=>fe(e)?v():t(e.value)?O(e.value):v()),tj=e=>nr((t,r)=>fe(t)?fe(r):fe(r)?!1:e(t.value,r.value)),rj=e=>zs((t,r)=>be(t)?be(r)?e(t.value,r.value):1:-1),nj=e=>l(2,(t,r)=>VC(t,r,e)),oj=l(2,(e,t)=>t(e)?O(e):v()),ZC=e=>l(2,(t,r)=>fe(t)?!1:e(t.value,r)),sj=ZC(Vg()),aj=l(2,(e,t)=>fe(e)?!1:t(e.value)),ij=Ed(Rt),cj=bd(Rt);var uj=Id(Rt,Ka),fj=O({}),lj=(...e)=>{let r=(e.length===1?e[0]:e[1].bind(e[0]))(),n=r.next();for(;!n.done;){let o=n.value;if(fe(o))return o;n=r.next(o.value)}return O(n.value)};function pj(e){return ry((t,r)=>fe(t)?r:fe(r)?t:O(e.combine(t.value,r.value)),v())}function YC(e){return RC((t,r)=>fe(t)||fe(r)?v():O(e.combine(t.value,r.value)))}function dj(e){let t=YC(e).combine,r=O(e.initialValue);return ry(t,r,n=>{let o=r;for(let s of n)if(o=t(o,s),fe(o))return o;return o})}var QC=\"~effect/Context/Service\",lr=function(){function e(){}let t=e;Object.setPrototypeOf(t,mj);let r=(n,o)=>(t.key=n,o?.defaultValue&&(t[ly]=ly,t.defaultValue=o.defaultValue),o?.make&&(t.make=o.make),o?.fiberCached&&XC.add(n),t);return arguments.length>0?r(arguments[0],arguments[1]):r},mj={[QC]:QC,...yd({label:\"Service\",evaluate(e){return Ae(Fe(e.context,this))}}),toJSON(){return{_id:\"Service\",key:this.key}},of(e){return e},context(e){return Za(this,e)},use(e){return re(t=>e(Fe(t.context,this)))},useSync(e){return re(t=>Ae(e(Fe(t.context,this))))}},XC=new Set,ly=\"~effect/Context/Reference\",eA=\"~effect/Context\",hj=8,xj=8,py=(e,t,r,n)=>{let o=Object.create(yj);return o.cacheRoot=e??o,o.base=t,o.overlay=r,o.depth=n,o._flat=void 0,o.baseHits=0,o},tA=(e,t)=>{t&&(tA(e,t.parent),e.set(t.key,t.value))},rA=e=>{if(e._flat)return e._flat;if(!e.overlay)return e._flat=e.base;let t=new Map(e.base);return tA(t,e.overlay),e._flat=t},gj=(e,t)=>{let r=new Map(e.mapUnsafe);return t(r),Oo(r)},Md=Symbol(),dy=(e,t)=>{let r=e;for(let o=r.overlay;o;o=o.parent)if(o.key===t)return o.value;let n=r.base.get(t);return n===void 0&&!r.base.has(t)?Md:(r.overlay&&++r.baseHits>=r.base.size&&r.baseHits>=xj&&(r.base=rA(r),r.overlay=void 0,r.depth=0),n)},Oo=e=>py(void 0,e,void 0,0),yj={get mapUnsafe(){return rA(this)},...rr,[eA]:{_Services:e=>e},toJSON(){return{_id:\"Context\",services:Array.from(this.mapUnsafe).map(([e,t])=>({key:e,value:t}))}},[ae](e){if(!Uf(e))return!1;let t=this.mapUnsafe,r=e.mapUnsafe;if(t.size!==r.size)return!1;for(let[n,o]of t)if(!r.has(n)||!J(o,r.get(n)))return!1;return!0},[se](){return It(this.mapUnsafe.size)}},nA=(e,t)=>e.cacheRoot===t.cacheRoot,Uf=e=>k(e,eA);var oA=e=>!!e[ly],Ir=()=>Sj,Sj=Oo(new Map),Za=(e,t)=>Oo(new Map([[e.key,t]])),Jt=l(3,(e,t,r)=>bj(e,t.key,r)),bj=(e,t,r)=>{let n=e,o=XC.has(t)?void 0:n.cacheRoot;if(n.depth>=hj){let s=new Map(n.mapUnsafe);return s.set(t,r),py(o,s,void 0,0)}return py(o,n.base,{key:t,value:r,parent:n.overlay},n.depth+1)};var Fd=l(2,(e,t)=>Df(e,t.key)),Df=(e,t)=>{let r=dy(e,t);return r===Md?void 0:r},_o=l(2,(e,t)=>{let r=dy(e,t.key);if(r===Md){if(oA(t))return sA(t);throw Ej(t)}return r}),Fe=_o,fy=\"~effect/Context/defaultValue\",sA=e=>fy in e?e[fy]:e[fy]=e.defaultValue(),Ej=e=>{let t=new Error(`Service not found${e.key?`: ${String(e.key)}`:\"\"}`);if(t.stack){let r=t.stack.split(`\n`);r.splice(1,3),t.stack=r.join(`\n`)}return t},Nd=l(2,(e,t)=>{let r=dy(e,t.key);return r!==Md?O(r):oA(t)?O(sA(t)):v()}),Ud=l(2,(e,t)=>e.mapUnsafe.size===0?t:t.mapUnsafe.size===0?e:gj(e,r=>t.mapUnsafe.forEach((n,o)=>r.set(o,n)))),aA=(...e)=>{let t=new Map;for(let r=0;r<e.length;r++)e[r].mapUnsafe.forEach((n,o)=>{t.set(o,n)});return Oo(t)};var we=lr;var my=e=>e.length>0;var ot=e=>e>0?Math.floor(e):0,Tn=e=>Math.max(1,ot(e));var B=kd,W=Ad;var iA=Cd,ce=Sc,mt=bc;var Dd=l(2,(e,t)=>ce(e)?W(t(e.failure)):e),Tr=l(2,(e,t)=>mt(e)?B(t(e.success)):e),wr=l(2,(e,{onFailure:t,onSuccess:r})=>ce(e)?t(e.failure):r(e.success));var Lf=l(2,(e,t)=>ce(e)?t(e.failure):e.success);var Tj=l(2,(e,t)=>{if(mt(e))return e.success;throw t(e.failure)}),$f=Tj(R);var Lt=l(2,(e,t)=>ce(e)?W(e.failure):t(e.success));var hy=e=>{if(Symbol.iterator in e){let r=[];for(let n of e){if(ce(n))return n;r.push(n.success)}return B(r)}let t={};for(let r of Object.keys(e)){let n=e[r];if(ce(n))return n;M(t,r,n.success)}return B(t)};var cA=FC;var wj=(e,t)=>{let r=t?.length!==void 0?Tn(t.length):1/0;return{[Symbol.iterator](){let n=0;return{next(){return n<r?{value:e(n++),done:!1}:{done:!0,value:void 0}}}}}};var Cj=l(2,(e,t)=>Aj(wj(()=>e,{length:t}))),fA=e=>Cj(e,1/0);var lA=e=>{let r=e[Symbol.iterator]().next();if(r.done)throw new Error(\"headUnsafe: empty iterable\");return r.value};var pA=l(2,(e,t)=>{let r=0;for(let n of e){let o=t(n,r);if(ad(o)){if(o)return O(n)}else if(be(o))return o;r++}return v()});var Aj=e=>({[Symbol.iterator](){let t=e[Symbol.iterator](),r;function n(){for(;;){if(r===void 0){let s=t.next();if(s.done)return s;r=s.value[Symbol.iterator]()}let o=r.next();if(!o.done)return o;r=void 0}}return{next:n}}});var dA=l(2,(e,t)=>({[Symbol.iterator](){let r=e[Symbol.iterator](),n=0;return{next(){let o=r.next();for(;!o.done;){if(t(o.value,n++))return{done:!1,value:o.value};o=r.next()}return{done:!0,value:void 0}}}}}));var kj=l(2,(e,t)=>Object.hasOwn(e,t));var Ya=l(2,(e,t)=>{let r={...e};for(let n of mA(e))M(r,n,t(e[n],n));return r});var mA=e=>Object.keys(e);var vj=e=>l(2,(t,r)=>{for(let n of mA(t))if(!kj(r,n)||!e(t[n],r[n]))return!1;return!0});var hA=e=>{let t=vj(e);return(r,n)=>t(r,n)&&t(n,r)};var Ld=globalThis.Array;var xA=l(2,(e,t)=>{let r=Tn(e),n=new Ld(r);for(let o=0;o<r;o++)n[o]=t(o);return n}),xy=(e,t)=>e<=t?xA(t-e+1,r=>e+r):[e];var Ye=e=>Ld.isArray(e)?e:Ld.from(e);var $d=l(2,(e,t)=>[...e,t]),gy=l(2,(e,t)=>Ye(e).concat(Ye(t)));var gA=Ld.isArray;var or=my,tt=my;function Cc(e){let t=Number(e);return String(t)===e&&Number.isInteger(t)&&t>=0&&t<2**32-1}function Oj(e,t){return!Number.isFinite(e)||e<0||e>=t.length}var yA=l(2,(e,t)=>{let r=Math.floor(t);if(Oj(r,e))throw new Error(`Index out of bounds: ${r}`);return e[r]});var Bd=e=>e[e.length-1];var yy=pA;var _j=(e,t)=>{let r=H(t),n=e.get(r);if(n===void 0)return e.set(r,[t]),!0;for(let o of n)if(J(o,t))return!1;return n.push(t),!0};var Pt=()=>[],Ee=e=>[e],wn=l(2,(e,t)=>e.map(t));var jd=l(2,(e,t)=>{let r=Ye(e),n=[];for(let o=0;o<r.length;o++)t(r[o],o)&&n.push(r[o]);return n}),Sy=l(2,(e,t)=>{let r=[],n=[],o=0;for(let s of e){let a=t(s,o++);mt(a)?r.push(a.success):n.push(a.failure)}return[r,n]});var SA=Sd;var zd=e=>{let t=Ye(e);if(t.length<2)return[...t];let r=new Map,n=[];for(let o of t)_j(r,o)&&n.push(o);return n};var Hd=\"~effect/Duration\",kc=BigInt(0),CA=BigInt(1),Rj=BigInt(2),Pj=BigInt(10),bA=BigInt(24),qd=BigInt(60),by=BigInt(1e3),EA=BigInt(1e6);var Wd=e=>BigInt(e<0?Math.ceil(e-.5):Math.floor(e+.5)),AA=e=>Wd(e*1e6),IA=(e,t)=>{let r=e.indexOf(\".\");if(r===-1)return BigInt(e)*t;let n=e[0]===\"-\",o=e.slice(r+1),s=Pj**BigInt(o.length),a=(BigInt(e.slice(n?1:0,r))*s+BigInt(o))*t,i=a/s+(a%s*Rj>=s?CA:kc);return n?-i:i};var Mj=/^(-?\\d+(?:\\.\\d+)?)\\s+(nanos?|micros?|millis?|seconds?|minutes?|hours?|days?|weeks?)$/,Ge=e=>{switch(typeof e){case\"number\":return Js(e);case\"bigint\":return Ro(e);case\"string\":{if(e===\"Infinity\")return ls;if(e===\"-Infinity\")return Ac;let t=Mj.exec(e);if(!t)break;let[r,n,o]=t;if(o===\"nano\"||o===\"nanos\")return Ro(IA(n,CA));if(o===\"micro\"||o===\"micros\")return Ro(IA(n,by));let s=Number(n);switch(o){case\"milli\":case\"millis\":return Js(s);case\"second\":case\"seconds\":return Iy(s);case\"minute\":case\"minutes\":return $j(s);case\"hour\":case\"hours\":return Bj(s);case\"day\":case\"days\":return jj(s);case\"week\":case\"weeks\":return zj(s)}break}case\"object\":{if(e===null)break;if(Hd in e)return e;if(Array.isArray(e))return e.length!==2||!e.every(Ef)?TA(e):Number.isNaN(e[0])||Number.isNaN(e[1])?Ws:e[0]===-1/0||e[1]===-1/0?Ac:e[0]===1/0||e[1]===1/0?ls:ar(Wd(e[0]*1e9+e[1]));let t=e,r=0;return t.weeks&&(r+=t.weeks*6048e5),t.days&&(r+=t.days*864e5),t.hours&&(r+=t.hours*36e5),t.minutes&&(r+=t.minutes*6e4),t.seconds&&(r+=t.seconds*1e3),t.milliseconds&&(r+=t.milliseconds),!t.microseconds&&!t.nanoseconds?ar(r):ar(Wd(r*1e6+(t.microseconds??0)*1e3+(t.nanoseconds??0)))}}return TA(e)},TA=e=>{throw new Error(`Invalid Input: ${e}`)},kA=zn(Ge),wA={_tag:\"Millis\",millis:0},Fj={_tag:\"Infinity\"},Nj={_tag:\"NegativeInfinity\"},Uj={[Hd]:Hd,[se](){switch(this.value._tag){case\"Millis\":{let e=this.value.millis*1e6;return Number.isFinite(e)?H(Wd(e)):It(this.value.millis)}case\"Nanos\":return H(this.value.nanos);default:return Tf(this.value)}},[ae](e){return Ey(e)&&Hj(this,e)},toString(){switch(this.value._tag){case\"Infinity\":return\"Infinity\";case\"NegativeInfinity\":return\"-Infinity\";case\"Nanos\":return`${this.value.nanos} nanos`;case\"Millis\":return`${this.value.millis} millis`}},toJSON(){switch(this.value._tag){case\"Millis\":return{_id:\"Duration\",_tag:\"Millis\",millis:this.value.millis};case\"Nanos\":return{_id:\"Duration\",_tag:\"Nanos\",nanos:String(this.value.nanos)};case\"Infinity\":return{_id:\"Duration\",_tag:\"Infinity\"};case\"NegativeInfinity\":return{_id:\"Duration\",_tag:\"NegativeInfinity\"}}},[Te](){return this.toJSON()},pipe(){return Z(this,arguments)}},ar=e=>{let t=Object.create(Uj);return typeof e==\"number\"?isNaN(e)||e===0||Object.is(e,-0)?t.value=wA:Number.isFinite(e)?Number.isInteger(e)?t.value={_tag:\"Millis\",millis:e}:t.value={_tag:\"Nanos\",nanos:AA(e)}:t.value=e>0?Fj:Nj:e===kc?t.value=wA:t.value={_tag:\"Nanos\",nanos:e},t},Ey=e=>k(e,Hd),Ks=e=>e.value._tag!==\"Infinity\"&&e.value._tag!==\"NegativeInfinity\",vc=e=>{switch(e.value._tag){case\"Millis\":return e.value.millis===0;case\"Nanos\":return e.value.nanos===kc;case\"Infinity\":case\"NegativeInfinity\":return!1}},Dj=e=>{switch(e.value._tag){case\"Millis\":return e.value.millis<0;case\"Nanos\":return e.value.nanos<kc;case\"NegativeInfinity\":return!0;case\"Infinity\":return!1}};var Lj=e=>{switch(e.value._tag){case\"Infinity\":case\"NegativeInfinity\":return ls;case\"Millis\":return e.value.millis<0?ar(-e.value.millis):e;case\"Nanos\":return e.value.nanos<kc?ar(-e.value.nanos):e}};var Ws=ar(0),ls=ar(1/0),Ac=ar(-1/0),Ro=e=>ar(e);var Js=e=>ar(e),Iy=e=>ar(e*1e3),$j=e=>ar(e*6e4),Bj=e=>ar(e*36e5),jj=e=>ar(e*864e5),zj=e=>ar(e*6048e5),Cr=e=>_A(Ge(e),{onMillis:R,onNanos:t=>Number(t)/1e6,onInfinity:()=>1/0,onNegativeInfinity:()=>-1/0}),vA=e=>_A(Ge(e),{onMillis:t=>t/1e3,onNanos:t=>Number(t)/1e9,onInfinity:()=>1/0,onNegativeInfinity:()=>-1/0});var Jd=e=>{let t=Ge(e);switch(t.value._tag){case\"Infinity\":case\"NegativeInfinity\":throw new Error(\"Cannot convert infinite duration to nanos\");case\"Nanos\":return t.value.nanos;case\"Millis\":return AA(t.value.millis)}},OA=zn(Jd);var _A=l(2,(e,t)=>{switch(e.value._tag){case\"Millis\":return t.onMillis(e.value.millis);case\"Nanos\":return t.onNanos(e.value.nanos);case\"Infinity\":return t.onInfinity();case\"NegativeInfinity\":return(t.onNegativeInfinity??t.onInfinity)()}}),RA=l(3,(e,t,r)=>e.value._tag===\"Infinity\"||e.value._tag===\"NegativeInfinity\"||t.value._tag===\"Infinity\"||t.value._tag===\"NegativeInfinity\"?r.onInfinity(e,t):e.value._tag===\"Millis\"?t.value._tag===\"Millis\"?r.onMillis(e.value.millis,t.value.millis):r.onNanos(Jd(e),t.value.nanos):r.onNanos(e.value.nanos,Jd(t)));var qj=(e,t)=>RA(e,t,{onMillis:(r,n)=>r===n,onNanos:(r,n)=>r===n,onInfinity:(r,n)=>r.value._tag===n.value._tag});var PA=l(2,(e,t)=>RA(e,t,{onMillis:(r,n)=>ar(r-n),onNanos:(r,n)=>ar(r-n),onInfinity:(r,n)=>{let o=r.value._tag,s=n.value._tag;return o===\"Infinity\"?s===\"Infinity\"?Ws:ls:o===\"NegativeInfinity\"?s===\"NegativeInfinity\"?Ws:Ac:s===\"Infinity\"?Ac:ls}}));var Hj=l(2,(e,t)=>qj(e,t)),Wj=e=>{if(e.value._tag===\"Infinity\")return{days:1/0,hours:1/0,minutes:1/0,seconds:1/0,millis:1/0,nanos:1/0};if(e.value._tag===\"NegativeInfinity\")return{days:-1/0,hours:-1/0,minutes:-1/0,seconds:-1/0,millis:-1/0,nanos:-1/0};let t=Jd(e),r=t<kc,n=r?-t:t,o=n/EA,s=o/by,a=s/qd,i=a/qd,c=i/bA,u=r?-1:1;return{days:u*Number(c),hours:u*Number(i%bA),minutes:u*Number(a%qd),seconds:u*Number(s%qd),millis:u*Number(o%by),nanos:u*Number(n%EA)}},Ty=e=>{if(e.value._tag===\"Infinity\")return\"Infinity\";if(e.value._tag===\"NegativeInfinity\")return\"-Infinity\";if(vc(e))return\"0\";if(Dj(e))return\"-\"+Ty(Lj(e));let t=Wj(e),r=[];return t.days!==0&&r.push(`${t.days}d`),t.hours!==0&&r.push(`${t.hours}h`),t.minutes!==0&&r.push(`${t.minutes}m`),t.seconds!==0&&r.push(`${t.seconds}s`),t.millis!==0&&r.push(`${t.millis}ms`),t.nanos!==0&&r.push(`${t.nanos}ns`),r.join(\" \")};var wy=l(2,(e,t)=>r=>{let n=e(r);if(ce(n))return W(r);let o=t(n.success);return ce(o)?W(r):o}),MA=e=>t=>{let r=e(t);return ce(r)?v():O(r.success)};var zf=we(\"effect/Scheduler\",{fiberCached:!0,defaultValue:()=>new Qa}),NA=e=>{let t=!1;return Promise.resolve().then(()=>{t||e()}),()=>{t=!0}},Jj=\"setImmediate\"in globalThis?e=>{let t=globalThis.setImmediate(e);return()=>globalThis.clearImmediate(t)}:e=>{let t=setTimeout(e,0);return()=>clearTimeout(t)},UA=e=>{try{return Jj(e)}catch{return NA(e)}},Cy=class{buckets=[];scheduleTask(t,r){let n=this.buckets,o=n.length,s,a=0;for(;a<o&&!(n[a][0]>r);a++)s=n[a];s&&s[0]===r?s[1].push(t):a===o?n.push([r,[t]]):n.splice(a,0,[r,[t]])}drain(){let t=this.buckets;return this.buckets=[],t}},Qa=class{executionMode;setImmediate;constructor(t=\"async\",r){this.executionMode=t,this.setImmediate=r??(t===\"sync\"?NA:UA)}shouldYield(t){return t.currentOpCount>=t.cache.maxOpsBeforeYield}makeDispatcher(){return new Ay(this.setImmediate)}},Ay=class{tasks=new Cy;running=void 0;setImmediate;constructor(t=UA){this.setImmediate=t}scheduleTask(t,r){this.tasks.scheduleTask(t,r),this.running===void 0&&(this.running=this.setImmediate(this.afterScheduled))}afterScheduled=()=>{this.running=void 0,this.runTasks()};runTasks(){let t=this.tasks.drain();for(let r=0;r<t.length;r++){let n=t[r][1];for(let o=0;o<n.length;o++)n[o]()}}flush(){for(;this.tasks.buckets.length>0;)this.running!==void 0&&(this.running(),this.running=void 0),this.runTasks()}},DA=we(\"effect/Scheduler/MaxOpsBeforeYield\",{fiberCached:!0,defaultValue:()=>2048}),LA=we(\"effect/Scheduler/PreventSchedulerYield\",{fiberCached:!0,defaultValue:()=>!1});var Cn={};Eo(Cn,{Class:()=>Kd,Error:()=>Gd,TaggedClass:()=>Kj,TaggedError:()=>Fr,taggedEnum:()=>Gj});var Kd=class extends $s{constructor(e){super(),e&&md(this,e)}},Kj=e=>class extends Kd{_tag=e},Gj=()=>new Proxy({},{get(e,t,r){return t===\"$is\"?At:t===\"$match\"?Vj:n=>({...n,_tag:t})}});function Vj(){if(arguments.length===1){let r=arguments[0];return function(n){return r[n._tag](n)}}let e=arguments[0];return arguments[1][e._tag](e)}var Gd=_f,Fr=us;var $A=\"~effect/encoding/EncodingError\",An=class extends Fr(\"EncodingError\"){[$A]=$A};var zA=e=>BA(typeof e==\"string\"?Xj.encode(e):e),vy=e=>{switch(e){case 16:return Yj();case 32:return Qj();default:{let t=\"\";for(let r=e>>>3;r>0;r--)t+=Zj();return t}}},te=Uint8Array.from(\"0123456789abcdef\",e=>e.charCodeAt(0)),Xa=()=>Math.random()*4294967296>>>0,Zj=()=>{let e=Xa();return String.fromCharCode(te[e>>>28],te[e>>>24&15],te[e>>>20&15],te[e>>>16&15],te[e>>>12&15],te[e>>>8&15],te[e>>>4&15],te[e&15])},Yj=()=>{let e=Xa(),t=Xa();return String.fromCharCode(te[e>>>28],te[e>>>24&15],te[e>>>20&15],te[e>>>16&15],te[e>>>12&15],te[e>>>8&15],te[e>>>4&15],te[e&15],te[t>>>28],te[t>>>24&15],te[t>>>20&15],te[t>>>16&15],te[t>>>12&15],te[t>>>8&15],te[t>>>4&15],te[t&15])},Qj=()=>{let e=Xa(),t=Xa(),r=Xa(),n=Xa();return String.fromCharCode(te[e>>>28],te[e>>>24&15],te[e>>>20&15],te[e>>>16&15],te[e>>>12&15],te[e>>>8&15],te[e>>>4&15],te[e&15],te[t>>>28],te[t>>>24&15],te[t>>>20&15],te[t>>>16&15],te[t>>>12&15],te[t>>>8&15],te[t>>>4&15],te[t&15],te[r>>>28],te[r>>>24&15],te[r>>>20&15],te[r>>>16&15],te[r>>>12&15],te[r>>>8&15],te[r>>>4&15],te[r&15],te[n>>>28],te[n>>>24&15],te[n>>>20&15],te[n>>>16&15],te[n>>>12&15],te[n>>>8&15],te[n>>>4&15],te[n&15])},Oy=e=>{let t=new TextEncoder().encode(e);if(t.length%2!==0)return W(new An({module:\"Hex\",kind:\"Decode\",input:e,message:`Length must be a multiple of 2, but is ${t.length}`}));try{let r=t.length/2,n=new Uint8Array(r);for(let o=0;o<r;o++){let s=jA(t[o*2]),a=jA(t[o*2+1]);n[o]=s<<4|a}return B(n)}catch(r){return W(new An({module:\"Hex\",kind:\"Decode\",input:e,message:r instanceof Error?r.message:\"Invalid input\"}))}},qA=e=>Tr(Oy(e),t=>ez.decode(t)),Xj=new TextEncoder,ez=new TextDecoder,tz=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,\"0\")),BA=e=>{let t=\"\";for(let r=0;r<e.length;r++)t+=tz[e[r]];return t},jA=e=>{if(48<=e&&e<=57)return e-48;if(97<=e&&e<=102)return e-97+10;if(65<=e&&e<=70)return e-65+10;throw new TypeError(\"Invalid input\")};var Ry=\"effect/Tracer/ParentSpan\",ei=class extends lr()(Ry,{fiberCached:!0}){},rz=e=>e;var Vd=we(\"effect/Tracer/DisablePropagation\",{defaultValue:yf}),WA=we(\"effect/Tracer/CurrentTraceLevel\",{defaultValue:()=>\"Info\"}),JA=we(\"effect/Tracer/MinimumTraceLevel\",{defaultValue:()=>\"All\"}),Py=\"effect/Tracer\",My=we(Py,{fiberCached:!0,defaultValue:()=>Fy}),Fy=rz({span:e=>new _y(e)}),_y=class{_tag=\"Span\";sampled;name;parent;annotations;links;startTime;kind;status;_traceId=void 0;_spanId=void 0;_attributes=void 0;_events=void 0;constructor(t){this.name=t.name,this.parent=t.parent,this.annotations=t.annotations,this.links=t.links,this.startTime=t.startTime,this.kind=t.kind,this.sampled=t.sampled,this.status={_tag:\"Started\",startTime:t.startTime}}get traceId(){return this._traceId??=qs(this.parent)?.traceId??vy(32)}get spanId(){return this._spanId??=vy(16)}get attributes(){return this._attributes??=new Map}get events(){return this._events??=[]}end(t,r){this.status={_tag:\"Ended\",endTime:t,exit:r,startTime:this.status.startTime}}attribute(t,r){this.attributes.set(t,r)}event(t,r,n){this.events.push([t,r,n??{}])}addLinks(t){this.links.push(...t)}};var GA=\"effect/Metric/FiberRuntimeMetrics\";var VA=we(\"effect/ErrorReporter/CurrentErrorReporters\",{defaultValue:()=>new Set}),qf=we(\"effect/References/CurrentStackFrame\",{fiberCached:!0,defaultValue:bn}),Zd=we(\"effect/References/TracerEnabled\",{fiberCached:!0,defaultValue:Sr}),ti=we(\"effect/References/TracerTimingEnabled\",{defaultValue:Sr}),Hf=we(\"effect/References/TracerSpanAnnotations\",{defaultValue:()=>({})}),Wf=we(\"effect/References/TracerSpanLinks\",{defaultValue:()=>[]}),ps=we(\"effect/References/CurrentLogAnnotations\",{defaultValue:()=>({})}),Ny=we(\"effect/References/CurrentLogLevel\",{fiberCached:!0,defaultValue:()=>\"Info\"}),Uy=we(\"effect/References/MinimumLogLevel\",{fiberCached:!0,defaultValue:()=>\"Info\"});var Yd=we(\"effect/References/CurrentLogSpans\",{defaultValue:()=>[]});var Gs=e=>{if(e?.captureStackTrace===!1)return e;if(e?.captureStackTrace!==void 0&&typeof e.captureStackTrace!=\"boolean\")return e;let t=Co();if(t===0&&e?.captureStackTrace!==!0)return{...e,captureStackTrace:!1};Yr(3);let r=new Error;return Yr(t),{...e,captureStackTrace:sz(()=>r.stack)}},Dy=e=>t=>{let r;return()=>{if(r!==void 0)return r;let n=t();if(!n)return;let o=n.split(`\n`);if(o[e]!==void 0)return r=o[e].trim(),r}},sz=Dy(3);var Qd=class extends hc{constructor(t,r=Of){super(\"Interrupt\",r,\"Interrupted\"),this.fiberId=t}toString(){return`Interrupt(${this.fiberId})`}toJSON(){return{_tag:\"Interrupt\",fiberId:this.fiberId}}[ae](t){return Ha(t)&&this.fiberId===t.fiberId&&this.annotations===t.annotations}[se](){return le(Re(`${this._tag}:${this.fiberId}`))(ud(this.annotations))}},nk=e=>new Qd(e),Zs=e=>new Ao([new Qd(e)]),Gy=e=>e.reasons.some(jn),Vy=e=>{let t=e.reasons.find(jn);return t?B(t):W(e)},Ur=e=>{for(let t=0;t<e.reasons.length;t++){let r=e.reasons[t];if(r._tag===\"Fail\")return B(r.error)}return W(e)},ok=MA(Ur),sm=e=>e.reasons.some(qa),sk=e=>{let t=e.reasons.find(qa);return t?B(t):W(e)},tl=e=>{let t=e.reasons.find(qa);return t?B(t.defect):W(e)},am=e=>e.reasons.some(Ha),ak=e=>{let t=e.reasons.find(Ha);return t?B(t):W(e)},im=e=>{let t;for(let r=0;r<e.reasons.length;r++){let n=e.reasons[r];n._tag===\"Interrupt\"&&(t??=new Set,n.fiberId!==void 0&&t.add(n.fiberId))}return t?B(t):W(e)},ik=e=>{let t=im(e);return ce(t)?az:t.success},az=new Set,cm=e=>e.reasons.length>0&&e.reasons.every(Ha),ck=e=>Oo(e.annotations),uk=e=>{let t=new Map;for(let r of e.reasons)if(r.annotations.size>0)for(let[n,o]of r.annotations)t.set(n,o);return Oo(t)},fk=l(2,(e,t)=>{let r=!1,n=e.reasons.map(o=>jn(o)?(r=!0,new $a(t(o.error),o.annotations)):o);return r?cs(n):e}),um=e=>{let t;for(let r of e.reasons){if(r._tag===\"Fail\")return r.error;r._tag===\"Die\"&&(t??=r)}return t!==void 0?t.defect:e.reasons.length>0?new globalThis.Error(\"All fibers interrupted without error\"):new globalThis.Error(\"Empty cause\")},Zy=(e,t)=>{let r=[],n=[];if(e.reasons.length===0)return r;let o=Co();o!==0&&Yr(1);try{for(let s of e.reasons){if(s._tag===\"Interrupt\"){n.push(s);continue}r.push($y(s._tag===\"Die\"?s.defect:s.error,s.annotations,t))}if(r.length===0){let s=new Error(\"The fiber was interrupted by:\");s.name=\"InterruptCause\",s.stack=fz(s,n);let a=new globalThis.Error(\"All fibers interrupted without error\",{cause:s});a.name=\"InterruptError\",a.stack=`${a.name}: ${a.message}`,r.push($y(a,n[0].annotations,t))}}finally{o!==0&&Yr(o)}return r},$y=(e,t,r)=>{let n=typeof e,o;if(e&&n===\"object\"){if(o=new globalThis.Error(iz(e),{cause:e.cause?$y(e.cause):void 0}),typeof e.name==\"string\"&&(o.name=e.name),typeof e.stack==\"string\")o.stack=uz(e.stack,o,t);else{let s=`${o.name}: ${o.message}`;o.stack=t?By(s,t):s}r?.includeCauseInStack&&(o.stack=pk(o));for(let s of Object.keys(e))s in o||(o[s]=e[s])}else{o=new globalThis.Error(e?n===\"string\"?e:Ua(e):`Unknown error: ${e}`);let s=`${o.name}: ${o.message}`;o.stack=t?By(s,t):s}return o},iz=e=>{if(typeof e.message==\"string\")return e.message;if(typeof e.toString==\"function\"&&e.toString!==Object.prototype.toString&&e.toString!==Array.prototype.toString)try{return e.toString()}catch{}return Ua(e)},cz=/\\((.*)\\)/g,uz=(e,t,r)=>{let n=`${t.name}: ${t.message}`,o=(e.startsWith(n)?e.slice(n.length):e).split(`\n`),s=[n];for(let a=1;a<o.length&&!/Generator\\.next|~effect\\/(?:Effect|Utils)/.test(o[a]);a++)s.push(o[a]);return r?By(s.join(`\n`),r):s.join(`\n`)},By=(e,t)=>{let r=t?.get(xd.key);return r&&(e=`${e}\n${lk(r)}`),e},fz=(e,t)=>{let r=[`${e.name}: ${e.message}`];for(let n of t){let o=n.fiberId!==void 0?`#${n.fiberId}`:\"unknown\",s=n.annotations.get(ey.key);r.push(`    at fiber (${o})`),s&&r.push(lk(s))}return r.join(`\n`)},lk=e=>{let t=[],r=e,n=0;for(;r&&n<10;){let o=r.stack();if(o){let s=o.matchAll(cz),a=!1;for(let[,i]of s)a=!0,t.push(`    at ${r.name} (${i})`);a||t.push(`    at ${r.name} (${o.replace(/^at /,\"\")})`)}else t.push(`    at ${r.name}`);r=r.parent,n++}return t.join(`\n`)},fm=e=>Zy(e).map(pk).join(`\n`),pk=e=>e.cause?`${e.stack} {\n${dk(e.cause,\"  \")}\n}`:e.stack,dk=(e,t)=>{let r=e.stack.split(`\n`),n=`${t}[cause]: ${r[0]}`;for(let o=1,s=r.length;o<s;o++)n+=`\n${t}${r[o]}`;return e.cause&&(n+=` {\n${dk(e.cause,`${t}  `)}\n${t}}`),n},Yy=\"~effect/Fiber\",lz={_A:R,_E:R},pz={id:0},ZA=(()=>{try{return globalThis.process?.getBuiltinModule?.(\"node:async_hooks\")?.AsyncResource}catch{return}})(),mk=()=>ZA===void 0?void 0:new ZA(\"effect/Fiber\"),ds=()=>globalThis[pc],Xd=class{constructor(t,r=!0){this.setContext(t),this.id=++pz.id,this.currentOpCount=0,this.interruptible=r,this._stack=[],this._observers=void 0,this._exit=void 0,this._children=void 0,this._interruptedCause=void 0,this._yielded=void 0,this._running=!1,this._deferredInterrupt=!1,this._parent=void 0,this._asyncContext=void 0,this.cache.runtimeMetrics?.recordFiberStart(this.context)}get[Yy](){return lz}get currentDispatcher(){return this._dispatcher??=this.cache.scheduler.makeDispatcher()}getRef(t){return Fe(this.context,t)}addObserver(t){return this._exit?(t(this._exit),$n):(this._observers===void 0?this._observers=[t]:this._observers.push(t),()=>this.removeObserver(t))}removeObserver(t){if(this._exit||this._observers===void 0)return;let r=this._observers.indexOf(t);r>=0&&this._observers.splice(r,1)}interruptUnsafe(t,r){if(this._exit)return;let n=Zs(t);this.cache.stackFrame&&(n=yc(n,Za(xd,this.cache.stackFrame))),r&&(n=yc(n,r)),this._interruptedCause=this._interruptedCause?za(this._interruptedCause,n):n,this.interruptible&&(this._running?this._deferredInterrupt=!0:this.evaluate(De(this._interruptedCause)))}pollUnsafe(){return this._exit}evaluate(t){if(this._exit)return;if(this._asyncContext!==void 0){let o=this._asyncContext;return this._asyncContext=void 0,o.runInAsyncScope(this.evaluate,this,t)}else if(this._yielded!==void 0){let o=this._yielded;this._yielded=void 0,o()}let r=this.runLoop(t);if(r===ja){this._asyncContext=mk();return}let n=jy.interruptChildren&&jy.interruptChildren(this);if(n!==void 0)return this.evaluate(V(n,()=>r));if(this._exit=r,this.cache.runtimeMetrics?.recordFiberEnd(this.context,this._exit),this._parent&&(this._parent._children?.delete(this),this._parent=void 0),this._observers!==void 0){let o=this._observers;this._observers=void 0;for(let s=0;s<o.length;s++)o[s](r)}this._stack.length=0,this._children=void 0,this.context=Ir()}runLoop(t){let r=globalThis[pc];globalThis[pc]=this;let n=this._running;this._running=!0;let o=!1,s=t;this.currentOpCount=0;try{for(;;)try{this._deferredInterrupt&&(this._deferredInterrupt=!1,s=De(this._interruptedCause)),this.currentOpCount++;let a=this.cache;if(!o&&!a.preventYield&&a.scheduler.shouldYield(this)){o=!0;let i=s;s=V(Mc,()=>i)}if(s=a.tracerContext?a.tracerContext(s,this):s[Ke](this),s===ja){let i=this._yielded;if(Da in i)return this._deferredInterrupt=!1,this._yielded=void 0,i;if(this._deferredInterrupt){this._yielded=void 0,i();continue}return ja}}catch(a){if(!k(s,Ke))return Er(`Fiber.runLoop: Not a valid effect: ${String(s)}`);s=Er(a)}}finally{this._running=n,globalThis[pc]=r}}getCont(t){if(this._deferredInterrupt)return this._deferredInterrupt=!1,mz;for(;;){let r=this._stack.pop();if(!r)return;let n=r[La];if(n!==void 0){let o=n.call(r,this);if(o)return o[t]=o,o}if(r[t])return r}}succeedWith(t){if((++this.currentOpCount&hz-1)===0)return Ae(t);let r=this.getCont(_t);return r?r[_t](t,this):this.yieldWith(Ae(t))}yieldWith(t){return this._yielded=t,ja}children(){return this._children??=new Set}pipe(){return Z(this,arguments)}setContext(t){let r=this.context;if(this.context=t,r!==void 0&&nA(r,t))return;let n=t.cacheRoot,o=n._fiberCache??=dz(t);this.cache?.scheduler!==o.scheduler&&(this._dispatcher=void 0),this.cache=o}get currentSpanLocal(){let t=this.cache.span;return t?._tag===\"Span\"?t:void 0}},dz=e=>{let t=Df(e,Py);return{scheduler:Fe(e,zf),tracer:t,tracerContext:t?t.context:void 0,tracerEnabled:Fe(e,Zd),span:Df(e,Ry),logLevel:Fe(e,Ny),minimumLogLevel:Fe(e,Uy),stackFrame:Fe(e,qf),runtimeMetrics:Df(e,GA),maxOpsBeforeYield:Fe(e,DA),preventYield:Fe(e,LA)}},mz={[_t](e,t){return De(t._interruptedCause)},[Qr](e,t){return De(t._interruptedCause)}},hz=32,jy={interruptChildren:void 0},lm=e=>{if(!e.cache.stackFrame)return;let t=new Map;return t.set(ey.key,e.cache.stackFrame),Oo(t)},xz=e=>{if(!(e._children===void 0||e._children.size===0))return Oc(e._children)},Qy=e=>{let t=e;return t._exit?D(t._exit):ht(r=>t._exit?r(D(t._exit)):z(e.addObserver(n=>r(D(n)))))},pm=e=>ht(t=>{let r=e[Symbol.iterator](),n=[],o;function s(){let a=r.next();for(;!a.done;){if(a.value._exit){n.push(a.value._exit),a=r.next();continue}o=a.value.addObserver(i=>{n.push(i),s()});return}t(D(n))}return s(),z(()=>o?.())}),Xy=e=>{let t=e;return t._exit?t._exit:ht(r=>t._exit?r(t._exit):z(e.addObserver(r)))},hk=e=>ht(t=>{let r=Array.from(e);if(r.length===0)return t(D(Pt()));let n=new Array(r.length),o=Pt(),s=()=>{for(let c=0;c<o.length;c++)r[c].removeObserver(o[c])},a=0,i=!1;for(let c=0;c<r.length&&!i;c++){let u=f=>{if(a++,f._tag===\"Failure\")return i=!0,s(),t(f);n[c]=f.value,a===r.length&&t(D(n))};o.push(u),r[c].addObserver(u)}return z(()=>{i=!0,s()})}),rl=e=>re(t=>xk(e,t.id)),xk=l(e=>k(e[0],Yy),(e,t,r)=>re(n=>{let o=lm(n);return o=o&&r?Ud(o,r):o??r,e.interruptUnsafe(t,o),nl(Qy(e))})),Oc=e=>re(t=>{let r=lm(t),n=Pt();for(let o of e)o.interruptUnsafe(t.id,r),n.push(o);return nl(pm(n))});var D=Ae,De=Ht,Qe=en,z=En({op:\"Sync\",[Ke](e){let t=this[ue](),r=e.getCont(_t);return r?r[_t](t,e):e.yieldWith(Ae(t))}}),ne=En({op:\"Suspend\",[Ke](e){return this[ue]()}}),eS=l(e=>e.length>=2||wc(e[0]),(e,t)=>fe(e)?Qe(t?t():new Bn(\"Effect.fromOption: Option.none\")):D(e.value)),Pc=wr({onFailure:Qe,onSuccess:D}),gk=e=>e==null?Qe(new Bn):D(e),tS=En({op:\"Yield\",[Ke](e){let t=!1;return e.currentDispatcher.scheduleTask(()=>{t||e.evaluate(pr)},this[ue]??0),e.yieldWith(()=>{t=!0})}}),Mc=tS(0),rS=e=>D(O(e)),oi=D(v()),yk=e=>fe(e)?oi:ke(e.value,O),Sk=e=>ne(()=>De(e())),Ys=e=>Er(e),dm=e=>ne(()=>Qe(e())),pe=D(void 0);var bk=e=>{let t=typeof e==\"function\"?e:e.try,r=typeof e==\"function\"?n=>new Rc(n,\"An error occurred in Effect.try\"):e.catch;return ne(()=>{try{return D(t())}catch(n){return Qe(r(n))}})};var nS=e=>oS(function(t,r){e(r).then(n=>t(D(n)),n=>t(Ys(n)))},e.length!==0),Ek=e=>{let t=typeof e==\"function\"?e:e.try,r=typeof e==\"function\"?n=>new Rc(n,\"An error occurred in Effect.tryPromise\"):e.catch;return oS(function(n,o){let s=a=>ne(()=>{try{return Qe(js(()=>r(a)))}catch(i){return Ys(i)}});try{t(o).then(a=>n(D(a)),a=>n(s(a)))}catch(a){n(s(a))}},t.length!==0)},Ik=e=>re(t=>e(t.id)),Tk=re(D),wk=Ik(D),oS=(function(){let e=Xr({op:\"Async\",[Ke](r){let n=!1,o=!1,s=this.withSignal?new AbortController:void 0,a=this.register.call(r.cache.scheduler,i=>{n||(n=!0,o?r.evaluate(i):o=i)},s?.signal);return o!==!1?o:(o=!0,r._yielded=()=>{n=!0},s===void 0&&a===void 0?ja:(r._stack.push(gz(()=>(n=!0,s?.abort(),a??pr))),ja))}}),t=function(r,n){this.register=r,this.withSignal=n};return t.prototype=e,function(r,n){return new t(r,n)}})(),gz=En({op:\"AsyncFinalizer\",[La](e){e.interruptible&&(e.interruptible=!1,e._stack.push(fl))},[Qr](e,t){return am(e)?V(Ov(Ht(e),this[ue]()),()=>De(e)):De(e)}}),ht=e=>oS(e,e.length>=2),mm=ht($n),Ck=(...e)=>{if(e.length===1){let n=e[0];return ne(()=>ni(n()))}let[t,r]=e;return ne(()=>ni(r.call(t.self)))},sS=(e,...t)=>{let r=t.length===0?function(){return ne(()=>ni(e.apply(this,arguments)))}:function(){let n=ne(()=>ni(e.apply(this,arguments)));for(let o=0;o<t.length;o++)n=t[o](n,...arguments);return n};return aS(e.length,r)},aS=(e,t)=>Object.defineProperty(t,\"length\",{value:e,configurable:!0}),YA=Dy(2),Ak=function(){let e=typeof arguments[0]==\"string\",t=e?arguments[0]:\"Effect.fn\",r=e?arguments[1]:void 0,n=Co(),o;return n!==0&&(Yr(2),o=new globalThis.Error,Yr(n)),e?(s,...a)=>QA(t,s,o,a,e,r):QA(t,arguments[0],o,Array.prototype.slice.call(arguments,1),e,r)},QA=(e,t,r,n,o,s)=>{let a=typeof t==\"function\"?t:n.shift().bind(t.self),i=`${e} (definition)`,c=r?YA(()=>r.stack):bn;return aS(a.length,function(...u){let f=ne(()=>{let m=a.apply(this,arguments);return ie(m)?m:ni(m)});for(let m=0;m<n.length;m++)f=n[m](f,...u);if(!ie(f))return f;let p=Co(),d;return p!==0&&(Yr(2),d=new globalThis.Error,Yr(p)),hs(o?Kf(e,s,m=>Jy(f,m)):f,qf,m=>({name:e,stack:d?YA(()=>d.stack):bn,parent:{name:i,stack:c,parent:m}}))})},kk=(e,...t)=>aS(e.length,t.length===0?function(){return XA(()=>e.apply(this,arguments))}:function(){let r=XA(()=>e.apply(this,arguments));for(let n of t)r=n(r,...arguments);return r}),XA=e=>{try{let t=e(),r;for(;;){let n=t.next(r);if(n.done)return D(n.value);let o=n.value;if(o&&o._tag===\"Success\"){r=o.value;continue}else{if(o&&o._tag===\"Failure\")return n.value;{let s=!0;return ne(()=>s?(s=!1,V(n.value,a=>ni(t,a))):ne(()=>ni(e())))}}}}catch(t){return Ys(t)}},ni=(function(){let e=Xr({op:\"Iterator\",[_t](r,n){let o=this.iterator;for(;;){let s=o.next(r);if(s.done)return D(s.value);if(Ne(s.value)){if(s.value._tag===\"Failure\")return s.value}else return n._stack.push(this),s.value;r=s.value.value}},[Ke](r){return this[_t](this.initial,r)}}),t=function(r,n){this.iterator=r,this.initial=n};return t.prototype=e,function(r,n){return new t(r,n)}})(),Ar=l(2,(e,t)=>new ms(e,iS,D(t))),hm=function(e){return e._stack.push(this),this[ue]},yz=Xr({op:\"OnSuccess\",[Ke]:hm}),ms=function(e,t,r){this[ue]=e,this[_t]=t,this.payload=r};ms.prototype=yz;var iS=function(){return this.payload},vk=function(e,t){return t.succeedWith(this.payload)},xm=(()=>{let e=\"~effect/Effect/stackProbe\";return{[e]:function(){return new Error().stack}}[e]()?.includes(\"[as \"+e+\"]\")===!0})(),Sz=function(e,t){let r=this.payload;return t.succeedWith(xm?r(e):js(()=>r(e)))},Ok=function(e){let t=this.payload;return t(e)},bz=function(e){let t=this.payload;return new ms(t(e),vk,e)},Ez=function(e){return new ms(this.payload,vk,e)},Fc=e=>ke(e,O),_k=e=>Dc(e,{onFailure:D,onSuccess:Qe}),Fo=l(2,(e,t)=>new ms(e,ie(t)?iS:Ok,t)),si=l(2,(e,t)=>new ms(e,ie(t)?Ez:bz,t)),nl=e=>new ms(e,iS,pr),Rk=e=>nn(e,Qe),cS=(e,t)=>re(r=>{let n=new Set;return $c(r,()=>n.size===0?void 0:Oc(n)),ht(o=>{let s=Ye(e),a=s.length,i=0,c=!1,u=[],f=(p,d,m)=>{if(i++,p._tag===\"Failure\"){u.push(...p.cause.reasons),i>=a&&o(De(cs(u)));return}let x=!c;c=!0,o(p),x&&t?.onWinner&&t.onWinner({fiber:d,index:m,parentFiber:r})};for(let p=0;p<a;p++){let d=ra(r,s[p],!0,!0,!1);if(n.add(d),d.addObserver(m=>{n.delete(d),f(m,d,p)}),c)break}})}),uS=(e,t)=>re(r=>{let n=new Set;return $c(r,()=>n.size===0?void 0:Oc(n)),ht(o=>{let s=!1,a=0;for(let i of e){if(s)break;let c=a++,u=ra(r,i,!0,!0,!1);n.add(u),u.addObserver(f=>{n.delete(u);let p=!s;s=!0,o(f),p&&t?.onWinner&&t.onWinner({fiber:u,index:c,parentFiber:r})})}})}),Pk=l(e=>ie(e[1]),(e,t,r)=>cS([e,t],r)),fS=l(e=>ie(e[1]),(e,t,r)=>uS([e,t],r)),V=l(2,(e,t)=>new ms(e,Ok,t)),Mk=l(2,(e,t)=>Ne(e)?e._tag===\"Success\"?t.onSuccess(e.value):t.onFailure(e.cause):Mo(e,t)),Ne=e=>e[Da]!==void 0,Fk=l(2,(e,t)=>Ne(e)?e._tag===\"Success\"?t(e.value):e:V(e,t)),Nk=e=>V(e,R),ke=l(2,(e,t)=>new ms(e,Sz,t)),Uk=l(2,(e,t)=>Ne(e)?mS(e,t):ke(e,t)),Dk=l(2,(e,t)=>Ne(e)?hS(e,t):wS(e,t)),Lk=l(2,(e,t)=>Ne(e)?xS(e,t):CS(e,t)),$k=l(2,(e,t)=>{if(Ne(e)){if(e._tag===\"Success\")return e;let r=Ur(e.cause);return ce(r)?e:t(r.success)}return gs(e,t)}),Nc=e=>Ht(Zs(e)),Qs=e=>e._tag===\"Success\",Bk=e=>e._tag===\"Success\"?B(e):W(e),jk=e=>e._tag===\"Success\"?B(e.value):W(e),lS=e=>e._tag===\"Failure\",zk=e=>e._tag===\"Failure\"?B(e):W(e),ol=e=>e._tag===\"Failure\"?B(e.cause):W(e),pS=wy(ol,Ur),qk=wy(ol,tl),dS=e=>e._tag===\"Failure\"&&am(e.cause),Hk=e=>e._tag===\"Failure\"&&sm(e.cause),Wk=e=>e._tag===\"Failure\"&&Gy(e.cause),pr=Ae(void 0),mS=l(2,(e,t)=>e._tag===\"Success\"?Ae(t(e.value)):e),hS=l(2,(e,t)=>{if(e._tag===\"Success\")return e;let r=Ur(e.cause);return ce(r)?e:en(t(r.success))}),xS=l(2,(e,t)=>{if(e._tag===\"Success\")return Ae(t.onSuccess(e.value));let r=Ur(e.cause);return ce(r)?e:en(t.onFailure(r.success))}),Iz=l(2,(e,t)=>Qs(e)?Ae(t):e),Jk=l(2,(e,t)=>Qs(e)?t:e),Kk=l(2,(e,t)=>Qs(e)?t.onSuccess(e.value):t.onFailure(e.cause)),Gk=Iz(void 0),gS=e=>{let t=[];for(let r of e)r._tag===\"Failure\"&&t.push(...r.cause.reasons);return t.length===0?pr:Ht(cs(t))},Vk=e=>Qs(e)?O(e.value):v(),Zk=e=>lS(e)?O(e.cause):v(),Yk=e=>{let t=pS(e);return ce(t)?v():O(t.success)},Qk=e=>e,Xk=e=>re(t=>D(Nd(t.context,e))),Tz=e=>re(t=>eS(Nd(t.context,e))),Uc=l(2,(e,t)=>re(r=>{let n=r.context,o=t(n);return n===o||(r.setContext(o),$c(r,()=>{r.setContext(n)})),e})),hs=l(3,(e,t,r)=>Uc(e,n=>{let o=_o(n,t),s=r(o);return o===s?n:Jt(n,t,s)})),ev=(e,t,r)=>ii(re(n=>{let o=_o(n.context,e),s=t(o);return n.setContext(Jt(n.context,e,s)),ta(_o(n.context,ea),a=>{let i=Nd(n.context,e);if(fe(i))return pe;let c=i.value,u;if(r?.reset===void 0){if(c!==s)return pe;u=o}else u=r.reset(o,s,c);return n.setContext(Jt(n.context,e,u)),pe})})),yS=()=>wz,wz=re(e=>D(e.context)),Xs=e=>re(t=>e(t.context)),tv=l(2,(e,t)=>Uc(e,je(t))),rn=l(2,(e,t)=>Ne(e)?e:Uc(e,Ud(t))),kr=function(){return arguments.length===1?l(2,(e,t)=>ek(e,arguments[0],t)):l(3,(e,t,r)=>ek(e,t,r)).apply(this,arguments)},ek=(e,t,r)=>Uc(e,Jt(t,r)),gm=l(3,(e,t,r)=>V(r,n=>kr(e,t,n))),rv=l(e=>ie(e[1]),(e,t,r)=>SS(e,t,(n,o)=>[n,o],r)),SS=l(e=>ie(e[1]),(e,t,r,n)=>n?.concurrent?ke(ll([e,t],{concurrency:2}),([o,s])=>r(o,s)):V(e,o=>ke(t,s=>r(o,s)))),nv=l(e=>ie(e[0]),(e,t,r)=>BS(e,t,r?n=>Qe(r(n)):()=>Qe(new Bn))),ov=l(2,(e,t)=>V(t,r=>r?Fc(e):oi)),bS=l(2,(e,t)=>Array.from({length:t},()=>e)),sv=l(e=>ie(e[0]),(e,t,r)=>ll(bS(e,t),r)),ym=l(e=>ie(e[0]),(e,t)=>No({while:Sr,body:je(t?.disableYield?e:V(e,r=>Mc)),step:$n})),nn=l(2,(e,t)=>new av(e,t.length!==1?r=>t(r):t)),Cz=Xr({op:\"OnFailure\",[Ke]:hm}),av=function(e,t){this[ue]=e,this[Qr]=t};av.prototype=Cz;var ES=l(3,(e,t,r)=>nn(e,n=>t(n)?r(n):De(n))),xs=l(3,(e,t,r)=>nn(e,n=>{let o=t(n);return ce(o)?De(o.failure):r(o.success,n)})),gs=l(2,(e,t)=>xs(e,Ur,r=>t(r))),iv=e=>Dc(e,{onFailure:t=>gd(t)?oi:Qe(t),onSuccess:rS}),cv=l(2,(e,t)=>xs(e,tl,t)),uv=l(2,(e,t)=>nn(e,r=>Fo(t(r),De(r)))),fv=l(3,(e,t,r)=>ES(e,t,n=>Fo(r(n),De(n)))),Sm=l(3,(e,t,r)=>nn(e,n=>{let o=t(n);return ce(o)?De(n):Fo(r(o.success,n),De(n))})),IS=l(2,(e,t)=>Sm(e,Ur,r=>t(r))),lv=l(3,(e,t,r)=>{let n=Array.isArray(t)?o=>k(o,\"_tag\")&&t.includes(o._tag):At(t);return IS(e,o=>n(o)?r(o):pe)}),pv=l(2,(e,t)=>Sm(e,tl,r=>t(r))),sl=l(e=>ie(e[0]),(e,t,r,n)=>nn(e,o=>{let s=Ur(o);return ce(s)?De(s.failure):t(s.success)?r(s.success):n?n(s.success):De(o)})),bm=l(e=>ie(e[0]),(e,t,r,n)=>nn(e,o=>{let s=Ur(o);if(ce(s))return De(s.failure);let a=t(s.success);return ce(a)?n?n(a.failure):De(o):r(a.success)})),TS=l(e=>ie(e[0]),(e,t,r,n)=>{let o=Array.isArray(t)?s=>k(s,\"_tag\")&&t.includes(s._tag):At(t);return sl(e,o,r,n)}),dv=l(e=>ie(e[0]),(e,t,r)=>{let n;return bm(e,o=>(n??=Object.keys(t),k(o,\"_tag\")&&br(o._tag)&&n.includes(o._tag)?B(o):W(o)),o=>t[o._tag](o),r)}),mv=l(e=>ie(e[0]),(e,t,r,n,o)=>sl(e,s=>At(s,t)&&k(s,\"reason\")&&(o!==void 0||At(s.reason,r)),s=>{let a=s.reason;return At(a,r)?n(a,s):o?o(a,s):Qe(s)})),hv=l(e=>ie(e[0]),(e,t,r,n)=>{let o;return sl(e,s=>At(s,t)&&k(s,\"reason\")&&k(s.reason,\"_tag\")&&br(s.reason._tag)&&(n!==void 0||(o??=Object.keys(r)).includes(s.reason._tag)),s=>{let a=s.reason;return o??=Object.keys(r),o.includes(a._tag)?r[a._tag](a,s):n?n(a,s):Qe(s)})}),xv=l(2,(e,t)=>bm(e,r=>At(r,t)&&k(r,\"reason\")?B(r.reason):W(r),Qe)),wS=l(2,(e,t)=>gs(e,r=>dm(()=>t(r)))),CS=l(2,(e,t)=>Dc(e,{onFailure:r=>dm(()=>t.onFailure(r)),onSuccess:r=>z(()=>t.onSuccess(r))})),AS=e=>gs(e,Ys),gv=l(2,(e,t)=>gs(e,r=>z(()=>t(r)))),yv=e=>ne(()=>{let t=e[Symbol.iterator](),r=t.next();if(r.done)return Ys(new Error(\"Received an empty collection of effects\"));function n(o){let s=t.next();return s.done?o.value:gs(o.value,a=>n(s))}return n(r)}),kS=e=>gs(e,t=>V(Mc,()=>kS(e))),Sv=l(e=>ie(e[0]),(e,t)=>{if(!t?.log)return Dc(e,{onFailure:n=>pe,onSuccess:n=>pe});let r=Jn(t.log===!0?void 0:t.log);return Mo(e,{onFailure(n){let o=Vy(n);return ce(o)?De(o.failure):t.message===void 0?r(n):r(t.message,n)},onSuccess:n=>pe})}),Em=l(e=>ie(e[0]),(e,t)=>{if(!t?.log)return Mo(e,{onFailure:n=>pe,onSuccess:n=>pe});let r=Jn(t.log===!0?void 0:t.log);return Mo(e,{onFailure:n=>t.message===void 0?r(n):r(t.message,n),onSuccess:n=>pe})}),bv=e=>Im(e,{onFailure:v,onSuccess:O}),Vs=e=>al(e,{onFailure:W,onSuccess:B}),Mo=l(2,(e,t)=>new Ev(e,t.onSuccess.length!==1?r=>t.onSuccess(r):t.onSuccess,t.onFailure.length!==1?r=>t.onFailure(r):t.onFailure)),Az=Xr({op:\"OnSuccessAndFailure\",[Ke]:hm}),Ev=function(e,t,r){this[ue]=e,this[_t]=t,this[Qr]=r};Ev.prototype=Az;var kz=function(e,t){let r=this.payload;return t.succeedWith(xm?r.onSuccess(e):js(()=>r.onSuccess(e)))},Iv=(e,t)=>{let r=Xr({op:e,[Ke]:hm,[_t]:kz,[Qr]:t}),n=function(o,s){this[ue]=o,this.payload=s};return n.prototype=r,n},vz=Iv(\"Match\",function(e,t){let r=e.reasons.find(jn);if(r===void 0)return De(e);let n=this.payload;return t.succeedWith(xm?n.onFailure(r.error):js(()=>n.onFailure(r.error)))}),Oz=Iv(\"MatchCause\",function(e,t){let r=this.payload;return t.succeedWith(xm?r.onFailure(e):js(()=>r.onFailure(e)))}),vS=l(2,(e,t)=>new Oz(e,t)),Dc=l(2,(e,t)=>Mo(e,{onFailure:r=>{let n=r.reasons.find(jn);return n?t.onFailure(n.error):De(r)},onSuccess:t.onSuccess})),Im=l(2,(e,t)=>new vz(e,t)),al=l(2,(e,t)=>{if(Ne(e)){if(e._tag===\"Success\")return Ae(t.onSuccess(e.value));let r=Ur(e.cause);return ce(r)?e:Ae(t.onFailure(r.success))}return Im(e,t)}),Tv=l(2,(e,t)=>Ne(e)?e._tag===\"Success\"?Ae(t.onSuccess(e.value)):Ae(t.onFailure(e.cause)):vS(e,t)),il=e=>Ne(e)?Ae(e):_z(e),_z=En({op:\"Exit\",[Ke](e){return e._stack.push(this),this[ue]},[_t](e,t,r){return t.succeedWith(r??Ae(e))},[Qr](e,t,r){return t.succeedWith(r??Ht(e))}}),wv=al({onFailure:()=>!0,onSuccess:()=>!1}),Cv=al({onFailure:()=>!1,onSuccess:()=>!0}),Av=l(2,(e,t)=>Fo(Bc(t),e)),OS=l(2,(e,t)=>V(_S(e,t.duration),r=>fe(r)?t.orElse():D(r.value))),Rz=e=>new Vf(`Operation timed out after '${Ty(e)}'`),kv=l(2,(e,t)=>{let r=Ge(t);return OS(e,{duration:r,orElse:()=>Qe(Rz(r))})}),_S=l(2,(e,t)=>fS(Fc(e),Ar(Bc(t),v()))),vv=e=>Wn(t=>{let r=t.monotonicTimeNanosUnsafe();return ke(e,n=>[Ro(t.monotonicTimeNanosUnsafe()-r),n])}),zy=\"~effect/Scope\",qy=\"~effect/Scope/Closeable\",ea=lr(\"effect/Scope\"),RS=(e,t)=>re(r=>(Nz(r),Tm(e,t)??pe)),Tm=(e,t)=>{let r=e.state;if(r._tag===\"Closed\"||(e.state={_tag:\"Closed\",exit:t},e.parent!==void 0&&tm(e.parent,e),r._tag===\"Empty\"))return;if(r.finalizer!==void 0)return em(r.finalizer,t);let n=r.finalizers;return n.size===1?em(n.values().next().value,t):Pz(e,n,t)},em=(e,t)=>{try{return e(t)}catch(r){return Er(r)}},Ov=(e,t)=>Qs(e)?t:nn(t,r=>De(za(e.cause,r))),Pz=sS(function*(e,t,r){let n=[],o=[],s=Array.from(t.values()),a=ds();for(let i=s.length-1;i>=0;i--){let c=s[i];e.strategy===\"sequential\"?n.push(yield*il(em(c,r))):o.push(ra(a,em(c,r),!0,!0,\"inherit\"))}return o.length>0&&(n=yield*pm(o)),yield*gS(n)});var _v=(e,t)=>{let r=Pv(t,e);return e.state._tag===\"Closed\"?(r.state=e.state,r):(Lc(e,r,n=>RS(r,n)),r)},ta=(e,t)=>ne(()=>e.state._tag===\"Closed\"?t(e.state.exit):(Lc(e,{},t),pe)),Rv=(e,t)=>ta(e,je(t)),Lc=(e,t,r)=>{if(e.state._tag===\"Empty\")e.state={_tag:\"Open\",finalizerKey:t,finalizer:r,finalizers:void 0};else if(e.state._tag===\"Open\"){let n=e.state;n.finalizer!==void 0&&(n.finalizers=new Map([[n.finalizerKey,n.finalizer]]),n.finalizerKey=void 0,n.finalizer=void 0),n.finalizers.set(t,r)}},tm=(e,t)=>{if(e.state._tag!==\"Open\")return;let r=e.state;r.finalizerKey===t?e.state=Hy:r.finalizers!==void 0&&(r.finalizers.delete(t),r.finalizers.size===0&&(e.state=Hy))},wm=e=>Pv(e,void 0),Pv=(e=\"sequential\",t)=>({[qy]:qy,[zy]:zy,strategy:e,parent:t,state:Hy}),Hy={_tag:\"Empty\"};var cl=ea,Mv=kr(ea),PS=e=>re(t=>{let r=t.context,n=wm();return t.setContext(Jt(t.context,ea,n)),$c(t,o=>(t.setContext(r),Tm(n,o))),e});var Cm=e=>ne(()=>{let t=wm();return on(e(t),r=>ne(()=>Tm(t,r)??pe))}),ai=(e,t,r)=>Xs(n=>Hn(o=>V(cl,s=>si(r?.interruptible?o(e):e,a=>ta(s,i=>rn(t(a,i),n)))))),MS=e=>V(cl,t=>Xs(r=>ta(t,n=>rn(e(n),r)))),Fv=(function(){let e=Xr({op:\"OnExit\",[Ke](r){return r._stack.push(this),this.effect},[La](r){r.interruptible&&this.interruptible!==!0&&(r._stack.push(fl),r.interruptible=!1)},[_t](r,n,o){o??=Ae(r);let s;try{s=this.onExit(o)}catch(a){s=Er(a)}return s?V(s,a=>o):o},[Qr](r,n,o){o??=Ht(r);let s;try{s=this.onExit(o)}catch(a){s=Er(a)}return s?V(Ov(o,s),a=>o):o}}),t=function(r,n,o){this.effect=r,this.onExit=n,this.interruptible=o};return t.prototype=e,t})(),qn=(e,t,r)=>new Fv(e,t,r),$c=(e,t)=>{e._stack.push(new Fv(void 0,t,void 0))},on=l(2,qn),Nv=l(2,(e,t)=>on(e,r=>t)),FS=l(3,(e,t,r)=>on(e,n=>t(n)?r(n):pe)),NS=l(3,(e,t,r)=>on(e,n=>{let o=t(n);return ce(o)?pe:r(o.success,n)})),US=l(2,(e,t)=>NS(e,ol,t)),Uv=l(3,(e,t,r)=>FS(e,n=>n._tag!==\"Failure\"?!1:t(n.cause),n=>r(n.cause))),DS=l(3,(e,t,r)=>on(e,n=>{if(n._tag!==\"Failure\")return pe;let o=t(n.cause);return ce(o)?pe:r(o.success,n.cause)})),Dv=l(2,(e,t)=>DS(im,t)(e)),ul=(e,t,r)=>Hn(n=>V(e,o=>qn(ne(()=>n(t(o))),s=>r(o,s),!0))),Lv=e=>ai(e,t=>k(t,Symbol.asyncDispose)?nS(()=>t[Symbol.asyncDispose]()):z(()=>t[Symbol.dispose]())),LS=l(2,(e,t)=>z(()=>$v(e,typeof t==\"function\"?r=>Cr(Ge(t(r))):je(Cr(Ge(t)))))),Mz=je(1/0),$v=(e,t)=>{let r=0,n,o,s=(a,i)=>(i.awaiters++,$c(a,()=>{if(!(--i.awaiters>0||o!==i))return o=void 0,rl(i.fiber)}),Xy(i.fiber));return[re(a=>{if(o!==void 0)return s(a,o);if(n!==void 0&&(r===1/0||a.getRef(Nr).currentTimeMillisUnsafe()<r))return n;n=void 0;let i=a.getRef(Nr),c={fiber:void 0,awaiters:0};return o=c,c.fiber=ra(a,qn(e,u=>{if(o!==c||(o=void 0,dS(u)))return;let f=t(u);r=f===1/0?1/0:i.currentTimeMillisUnsafe()+f,n=u}),!0,!0),c.fiber._exit??s(a,c)}),z(()=>{n=void 0})]},Bv=l(2,(e,t)=>ke(LS(e,t),r=>r[0])),jv=e=>z(()=>$v(e,Mz)[0]),zv=re(e=>De(Zs(e.id))),ii=e=>re(t=>(t.interruptible&&(t.interruptible=!1,t._stack.push(fl)),e)),qv=En({op:\"SetInterruptible\",[La](e){if(e.interruptible=this[ue],e._interruptedCause&&e.interruptible)return()=>De(e._interruptedCause)}}),fl=qv(!0),Fz=qv(!1),Hv=e=>{if(e.interruptible=!0,e._stack.push(Fz),e._interruptedCause)return De(e._interruptedCause)},Nz=e=>{let t=e;t.interruptible&&(t.interruptible=!1,t._stack.push(fl))};var Am=e=>re(t=>t.interruptible?e:Hv(t)??e),Hn=e=>re(t=>t.interruptible?(t.interruptible=!1,t._stack.push(fl),e(Am)):e(R)),Wv=e=>re(t=>{if(t.interruptible)return e(R);let r=Hv(t),n=e(ii);return r??n}),Jv=ke(ai(z(()=>new AbortController),e=>z(()=>e.abort())),e=>e.signal),ll=(e,t)=>as(e)?t?.mode===\"result\"?tn(e,Vs,t):tn(e,R,t):t?.discard?t.mode===\"result\"?tn(Object.values(e),Vs,t):tn(Object.values(e),R,t):ne(()=>{let r={};return Ar(tn(Object.entries(e),([n,o])=>ke(t?.mode===\"result\"?Vs(o):o,s=>{M(r,n,s)}),{discard:!0,concurrency:t?.concurrency}),r)}),$S=l(e=>as(e[0])&&!ie(e[0]),(e,t,r)=>ke(tn(e,(n,o)=>Vs(t(n,o)),r),n=>Sy(n,R))),Kv=l(3,(e,t,r)=>{let n=Ye(e);return n.length===0?z(t):ne(()=>{let o=0,s=t();return ke(No({while:()=>o<n.length,body:()=>r(s,n[o],o),step(a){s=a,o++}}),()=>s)})}),Gv=l(e=>as(e[0])&&!ie(e[0]),(e,t,r)=>V($S(e,t,{concurrency:r?.concurrency}),([n,o])=>or(o)?Qe(o):r?.discard?pe:D(n))),Vv=l(e=>as(e[0])&&!ie(e[0]),(e,t)=>ne(()=>{let r=e[Symbol.iterator](),n=r.next();return n.done?D(v()):Zv(r,0,t,n.value)})),Zv=(e,t,r,n)=>V(r(n,t),o=>{if(o)return D(O(n));let s=e.next();return s.done?D(v()):Zv(e,t+1,r,s.value)}),Yv=l(e=>as(e[0])&&!ie(e[0]),(e,t)=>ne(()=>{let r=e[Symbol.iterator](),n=r.next();return n.done?D(v()):Qv(r,0,t,n.value)})),Qv=(e,t,r,n)=>V(r(n,t),o=>{if(mt(o))return D(O(o.success));let s=e.next();return s.done?D(v()):Qv(e,t+1,r,s.value)}),No=En({op:\"While\",[_t](e,t){return this[ue].step(e),this[ue].while()?(t._stack.push(this),this[ue].body()):pr},[Ke](e){return this[ue].while()?(e._stack.push(this),this[ue].body()):pr}}),tn=l(e=>typeof e[1]==\"function\",(e,t,r)=>ne(()=>{let n=pl(r?.concurrency);if(n===1)return Uz(e,t,r);let o=Ye(e),s=o.length;if(s===0)return r?.discard?pe:D([]);let a=r?.discard?void 0:new Array(s),i=Dz({f:t,out:a},o,{concurrency:n});return i?Ar(i,a):D(a)})),Xv=e=>V(e,t=>{let r=t[Symbol.iterator]().next();return r.done?Qe(new Bn):D(r.value)}),Uz=(e,t,r)=>ne(()=>{let n=r?.discard?void 0:[],o=e[Symbol.iterator](),s=o.next(),a=0;return Ar(No({while:()=>!s.done,body:()=>t(s.value,a++),step:i=>{n&&n.push(i),s=o.next()}}),n)}),pl=e=>e===\"unbounded\"?Number.POSITIVE_INFINITY:Math.max(1,e??1),km=()=>e=>{let t=e.onItem,r=e.step,n=(s,a,i,c,u)=>V(il(u),f=>r(s,a[i],f,i)??o(s,a,i+1,c)??pe),o=(s,a,i=0,c=a.length)=>{for(;i<c;i++){let u=a[i],f=t(s,u,i);if(!Ne(f))return n(s,a,i,c,f);let p=r(s,u,f,i);if(p)return p._tag===\"Failure\"?p:void 0}};return o},eO=e=>{let t=e.onItem,r=e.step;return(n,o,s)=>{let a=0,i=s.end??o.length,c=s.concurrency,u=!1,f,p,d,m,x,y=w=>{let E=Er(w);return m=E,u=!0,p&&p.size>0?V(ii(Oc(Array.from(p))),()=>m??E):E},S=()=>{let w=!1;for(;!m&&a<i;a++){let E=o[a],U=x??t(n,E,a);if(Ne(U)){if(m=r(n,E,U,a),m)break}else if(f){x=void 0;let _=ra(f,U,!0,!0,\"inherit\");if(_._exit){if(m=r(n,E,_._exit,a),m)break;continue}p.add(_);let h=a;if(_.addObserver(b=>{p.delete(_);try{if(m){if(b._tag===\"Failure\"){let T=b.cause.reasons.filter(C=>C._tag!==\"Interrupt\");if(T.length>0){let C=cs(T);m=Ht(m._tag===\"Failure\"?za(m.cause,C):C)}}}else{let T=r(n,E,b,h);T&&(m=T,S())}if(w){let T=S();T&&d(T)}else u&&p.size===0&&d(m??pe)}catch(T){d(y(T))}}),p.size<c)continue;w=!0,a++;return}else return ht(_=>{f=ds(),p=new Set,x=U,d=_;let h;try{h=S()}catch(b){return _(y(b))}return h?_(h):ne(()=>(m??=pr,V(p?Oc(p):pe,()=>m?._tag===\"Failure\"?m:pe)))})}if(u=!0,m){if(p&&p.size>0){let E=lm(f);p.forEach(U=>U.interruptUnsafe(f.id,E));return}if(d||m._tag===\"Failure\")return m}else if(d)if(p)p.size===0&&d(pe);else return pr};return S()}},vm=()=>e=>eO(e),Dz=eO({onItem(e,t,r){return e.f(t,r)},step(e,t,r,n){if(r._tag===\"Failure\")return r;e.out&&(e.out[n]=r.value)}}),BS=l(3,(e,t,r)=>V(e,n=>t(n)?D(n):r(n))),jS=l(3,(e,t,r)=>V(e,n=>{let o=t(n);return ce(o)?r(o.failure):D(o.success)})),tO=l(e=>ie(e[0]),(e,t,r)=>jS(e,t,r?n=>Qe(r(n)):()=>Qe(new Bn))),rO=l(e=>as(e[0])&&!ie(e[0]),(e,t,r)=>ne(()=>{let n=[];return Ar(tn(e,(o,s)=>{let a=t(o,s);return typeof a==\"boolean\"?(a&&n.push(o),pe):ke(a,i=>{i&&n.push(o)})},{discard:!0,concurrency:r?.concurrency}),n)})),nO=l(e=>as(e[0])&&!ie(e[0]),(e,t)=>ne(()=>{let r=[];for(let n of e){let o=t(n);mt(o)&&r.push(o.success)}return D(r)})),oO=l(e=>as(e[0])&&!ie(e[0]),(e,t,r)=>ne(()=>{let n=[];return Ar(tn(e,o=>ke(t(o),s=>{mt(s)&&n.push(s.success)}),{discard:!0,concurrency:r?.concurrency}),n)})),sO=D({}),aO=Ed(ke),iO=Id(ke,V),cO=bd(ke);var uO=l(e=>ie(e[0]),(e,t)=>re(r=>(Qz(),D(ra(r,e,t?.startImmediately,!1,t?.uninterruptible??!1))))),ra=(e,t,r=!1,n=!1,o=!1)=>{let s=e,a=o===\"inherit\"?s.interruptible:!o,i=new Xd(s.context,a);return n||(s.children().add(i),i._parent=s),r?i.evaluate(t):(i._asyncContext=mk(),s.currentDispatcher.scheduleTask(()=>i.evaluate(t),0)),i},fO=l(e=>ie(e[0]),(e,t)=>re(r=>D(ra(r,e,t?.startImmediately,!0,t?.uninterruptible)))),lO=e=>re(t=>{let r=t._children&&new Set(t._children),n=t.interruptible;return qn(e,o=>{let s=t._children;if(s===void 0||s.size===0)return pe;r&&(s=dA(s,i=>!r.has(i)));let a=nl(pm(s));return n?Am(a):a})}),zS=l(e=>ie(e[0]),(e,t,r)=>re(n=>{let o=ra(n,e,r?.startImmediately,!0,r?.uninterruptible);if(!o._exit)if(t.state._tag!==\"Closed\"){let s={};Lc(t,s,()=>Ik(i=>i===o.id?pe:rl(o))),o.addObserver(()=>tm(t,s))}else o.interruptUnsafe(n.id,lm(n));return D(o)})),pO=l(e=>ie(e[0]),(e,t)=>V(cl,r=>zS(e,r,t))),ys=e=>(t,r)=>{let n=new Xd(r?.scheduler?Jt(e,zf,r.scheduler):e,r?.uninterruptible!==!0);if(n.evaluate(t),n._exit)return n;if(r?.signal)if(r.signal.aborted)n.interruptUnsafe();else{let o=()=>n.interruptUnsafe();r.signal.addEventListener(\"abort\",o,{once:!0}),n.addObserver(()=>r.signal.removeEventListener(\"abort\",o))}return r?.onFiberStart&&r.onFiberStart(n),n},dO=l(2,(e,t)=>e._exit?e:t.state._tag===\"Closed\"?(e.interruptUnsafe(e.id),e):(tm(t,e),Lc(t,e,()=>rl(e)),e.addObserver(()=>tm(t,e)),e)),mO=ys(Ir()),qS=e=>{let t=ys(e);return(r,n)=>{let o=t(r,n);return n?.onExit&&o.addObserver(n.onExit),s=>o.interruptUnsafe(s)}},hO=qS(Ir()),Om=e=>{let t=ys(e);return(r,n)=>{let o=t(r,n);return new Promise(s=>{o.addObserver(a=>s(a))})}},xO=Om(Ir()),HS=e=>{let t=Om(e);return(r,n)=>t(r,n).then(o=>{if(o._tag===\"Failure\")throw um(o.cause);return o.value})},gO=HS(Ir()),_m=e=>{let t=ys(e);return r=>{if(Ne(r))return r;let n=new Qa(\"sync\"),o=t(r,{scheduler:n});return o._dispatcher?.flush(),o._exit??Er(new Xf(o))}},yO=_m(Ir()),WS=e=>{let t=_m(e);return r=>{let n=t(r);if(n._tag===\"Failure\")throw um(n.cause);return n.value}},SO=WS(Ir()),tk=D(!0),rk=D(!1),Wy=class{waiters=[];scheduled=void 0;_isOpen;constructor(t){this._isOpen=t}scheduleUnsafe(t){if(this.waiters.length===0)return tk;if(this.scheduled===void 0)this.scheduled=this.waiters,t.currentDispatcher.scheduleTask(this.flushScheduled,0);else for(let r=0;r<this.waiters.length;r++)this.scheduled.push(this.waiters[r]);return this.waiters=[],tk}flushScheduled=()=>{if(this.scheduled===void 0)return;let t=this.scheduled;this.scheduled=void 0;for(let r=0;r<t.length;r++)t[r](pr)};flushWaiters(){let t=this.waiters;this.waiters=[],this.flushScheduled();for(let r=0;r<t.length;r++)t[r](pr)}open=re(t=>this._isOpen?rk:(this._isOpen=!0,this.scheduleUnsafe(t)));release=re(t=>this._isOpen?rk:this.scheduleUnsafe(t));openUnsafe(){return this._isOpen?!1:(this._isOpen=!0,this.flushWaiters(),!0)}await=ht(t=>this._isOpen?t(pe):(this.waiters.push(t),z(()=>{let r=this.waiters.indexOf(t);r!==-1?this.waiters.splice(r,1):this.scheduled!==void 0&&(r=this.scheduled.indexOf(t),r!==-1&&this.scheduled.splice(r,1))})));closeUnsafe(){return this._isOpen?(this._isOpen=!1,!0):!1}close=z(()=>this.closeUnsafe());whenOpen=t=>V(this.await,()=>t);isOpen(){return this._isOpen}},JS=e=>new Wy(e??!1),bO=e=>z(()=>JS(e)),EO=re(e=>D(e.getRef(My))),IO=l(2,(e,t)=>kr(e,My,t)),TO=kr(Zd),wO=kr(ti),rm=BigInt(0),Lz={_tag:\"Span\",spanId:\"noop\",traceId:\"noop\",sampled:!1,status:{_tag:\"Ended\",startTime:rm,endTime:rm,exit:pr},attributes:new Map,links:[],kind:\"internal\",attribute(){},event(){},end(){},addLinks(){}},$z=e=>Object.assign(Object.create(Lz),e),CO=e=>e?Fe(e.annotations,Vd)?e._tag===\"Span\"?CO(qs(e.parent)):v():O(e):v(),KS=(e,t,r)=>{let n=!e.cache.tracerEnabled||r?.annotations&&Fe(r.annotations,Vd),o=r?.parent!==void 0?O(r.parent):r?.root?v():CO(e.cache.span),s;if(n)s=$z({name:t,parent:o,annotations:Jt(r?.annotations??Ir(),Vd,!0)});else{let a=e.cache.tracer??Fy,i=e.getRef(Nr),c=e.getRef(ti),u=e.getRef(Hf),f=e.getRef(Wf),p=r?.level??e.getRef(WA),d=r?.links!==void 0?[...f,...r.links]:f.length===0?[]:f.slice();s=a.span({name:t,parent:o,annotations:r?.annotations??Ir(),links:d,startTime:c?i.currentTimeNanosUnsafe():rm,kind:r?.kind??\"internal\",root:r?.root??!1,sampled:r?.sampled??(be(o)&&o.value.sampled===!1?!1:!qO(e.getRef(JA),p))});for(let m in u)s.attribute(m,u[m]);if(r?.attributes!==void 0)for(let m in r.attributes)s.attribute(m,r.attributes[m])}return s},AO=(e,t)=>re(r=>D(KS(r,e,t))),Jf=(e,t)=>ii(re(r=>{let n=_o(r.context,ea),o=KS(r,e,t??{}),s=r.getRef(Nr),a=r.getRef(ti);return Ar(ta(n,i=>Rm(o,i,s,a)),o)})),kO=function(){let e=typeof arguments[0]!=\"string\",t=e?arguments[1]:arguments[0],r=Gs(e?arguments[2]:arguments[1]);if(e){let n=arguments[0];return V(Jf(t,r),o=>_c(n,o,r))}return n=>V(Jf(t,r),o=>_c(n,o,r))},Bz=(e,t)=>(t=typeof t==\"function\"?t:bn,hs(qf,r=>({name:e,stack:t,parent:r}))),vO=Hf,OO=Wf,_O=l(e=>ie(e[0]),(e,t,r={})=>{let o=(Array.isArray(t)?t:[t]).map(s=>({span:s,attributes:r}));return hs(e,Wf,s=>[...s,...o])}),Rm=(e,t,r,n)=>z(()=>{e.status._tag!==\"Ended\"&&e.end(n?r.currentTimeNanosUnsafe():rm,t)}),Kf=(e,...t)=>{let r=t.length===1?void 0:t[0],n=t[t.length-1];return re(o=>{let s=KS(o,e,r),a=o.getRef(Nr),i=o.getRef(ti);return $c(o,c=>Rm(s,c,a,i)),n(s)})},Jy=kr(ei),_c=function(){let e=ie(arguments[0]),t=e?arguments[1]:arguments[0],r=e?arguments[2]:arguments[1],n=R;return t._tag===\"Span\"&&(r=Gs(r),n=Bz(t.name,r?.captureStackTrace)),e?Jy(n(arguments[0]),t):o=>Jy(n(o),t)},RO=function(){let e=typeof arguments[0]!=\"string\",t=e?arguments[1]:arguments[0],r=Gs(arguments[2]);if(e){let s=arguments[0];return Kf(t,arguments[2],a=>_c(s,a,r))}let n=typeof arguments[1]==\"function\"?arguments[1]:void 0,o=n?void 0:arguments[1];return(s,...a)=>Kf(t,n?n(...a):o,i=>_c(s,i,r))},PO=l(e=>ie(e[0]),(e,...t)=>hs(e,Hf,r=>{let n=t.length===1?{...r,...t[0]}:{...r};return t.length===1||M(n,t[0],t[1]),n})),MO=(...e)=>re(t=>{let r=t.currentSpanLocal;if(r)if(e.length===1)for(let[n,o]of Object.entries(e[0]))r.attribute(n,o);else r.attribute(e[0],e[1]);return pe}),FO=re(e=>{let t=e.currentSpanLocal;return t?D(t):Qe(new Bn)}),NO=Tz(ei),Nr=we(\"effect/Clock\",{defaultValue:()=>new Ky}),Ly=2**31-1,Ky=class{currentTimeMillisUnsafe(){return Date.now()}currentTimeMillis=z(()=>this.currentTimeMillisUnsafe());currentTimeNanosUnsafe(){return jz()}currentTimeNanos=z(()=>this.currentTimeNanosUnsafe());monotonicTimeNanosUnsafe(){return DO()}monotonicTimeNanos=z(()=>this.monotonicTimeNanosUnsafe());sleep(t){return this.sleepMillis(Cr(t))}sleepMillis(t){return t<=0?Mc:Number.isFinite(t)?ht(r=>{let n=t>Ly?this.sleepMillis(t-Ly):pe,o=setTimeout(()=>r(n),Math.min(t,Ly));return z(()=>clearTimeout(o))}):mm}},UO=BigInt(1e6),DO=(function(){let e=globalThis.process?.hrtime;if(typeof e?.bigint==\"function\")return()=>e.bigint();if(typeof performance<\"u\"&&typeof performance.now==\"function\")return()=>BigInt(Math.round(performance.now()*1e6));let t=BigInt(0);return()=>{let r=BigInt(Date.now())*UO;return r>t&&(t=r),t}})(),jz=(function(){let e=BigInt(1e9),t;return()=>{let r=DO(),n=BigInt(Date.now())*UO;if(t===void 0)t=n-r;else{let o=t+r;(n>o?n-o:o-n)>e&&(t=n-r)}return t+r}})(),Wn=e=>re(t=>e(t.getRef(Nr))),Bc=e=>Wn(t=>t.sleep(Ge(e))),GS=Wn(e=>e.currentTimeMillis);var Gf=\"~effect/Cause/TimeoutError\",LO=e=>k(e,Gf),Vf=class extends us(\"TimeoutError\"){[Gf]=Gf;constructor(t){super({message:t})}},Zf=\"~effect/Cause/IllegalArgumentError\",$O=e=>k(e,Zf),nm=class extends us(\"IllegalArgumentError\"){[Zf]=Zf;constructor(t){super({message:t})}},Yf=\"~effect/Cause/ExceededCapacityError\",BO=e=>k(e,Yf),om=class extends us(\"ExceededCapacityError\"){[Yf]=Yf;constructor(t){super({message:t})}},Qf=\"~effect/Cause/AsyncFiberError\",jO=e=>k(e,Qf),Xf=class extends us(\"AsyncFiberError\"){[Qf]=Qf;constructor(t){super({message:\"An asynchronous Effect was executed with Effect.runSync\",fiber:t})}},el=\"~effect/Cause/UnknownError\",zO=e=>k(e,el),Rc=class extends us(\"UnknownError\"){[el]=el;constructor(t,r){super({message:r,cause:t})}},VS=we(\"effect/Console\",{defaultValue:()=>globalThis.console}),zz=e=>{switch(e){case\"All\":return Number.MIN_SAFE_INTEGER;case\"Fatal\":return 5e4;case\"Error\":return 4e4;case\"Warn\":return 3e4;case\"Info\":return 2e4;case\"Debug\":return 1e4;case\"Trace\":return 0;case\"None\":return Number.MAX_SAFE_INTEGER}},qz=ay(fs,zz),qO=Tc(qz),ZS=we(\"effect/Logger/CurrentLoggers\",{defaultValue:()=>new Set([Zz,Yz])}),Hz=we(\"effect/Logger/LogToStderr\",{defaultValue:yf}),HO=function(){let e=typeof arguments[0]==\"string\"?[[arguments[0],arguments[1]]]:Object.entries(arguments[0]);return ii(re(t=>{let r=t.getRef(ps),n={...r};for(let o=0;o<e.length;o++){let[s,a]=e[o];M(n,s,a)}return t.setContext(Jt(t.context,ps,n)),ta(_o(t.context,ea),o=>{let s=t.getRef(ps),a={...s};for(let i=0;i<e.length;i++){let[c,u]=e[i];s[c]!==u&&!Object.is(s[c],u)||(Object.hasOwn(r,c)?M(a,c,r[c]):delete a[c])}return t.setContext(Jt(t.context,ps,a)),pe})}))},Wz=\"~effect/Logger\",Jz={[Wz]:{_Message:R,_Output:R},pipe(){return Z(this,arguments)}},WO=e=>{let t=Object.create(Jz);return t.log=e,t},Kz=e=>e.replace(/[\\s=\"]/g,\"_\"),Gz=(e,t)=>`${Kz(e[0])}=${t-e[1]}ms`;var Jn=e=>(...t)=>{let r;for(let n=0,o=t.length;n<o;n++){let s=t[n];xc(s)&&(r?t.splice(n,1):t=t.slice(0,n).concat(t.slice(n+1)),r=r?cs(r.reasons.concat(s.reasons)):s,n--)}return r===void 0&&(r=hd),re(n=>{let o=e??n.cache.logLevel;if(qO(n.cache.minimumLogLevel,o))return pe;let s=n.getRef(Nr),a=n.getRef(ZS);if(a.size>0){let i=new Date(s.currentTimeMillisUnsafe());for(let c of a)c.log({cause:r,fiber:n,date:i,logLevel:o,message:t})}return pe})};var ri={bold:\"1\",red:\"31\",green:\"32\",yellow:\"33\",blue:\"34\",cyan:\"36\",white:\"37\",gray:\"90\",black:\"30\",bgBrightRed:\"101\"},kre={None:[],All:[],Trace:[ri.gray],Debug:[ri.blue],Info:[ri.green],Warn:[ri.yellow],Error:[ri.red],Fatal:[ri.bgBrightRed,ri.black]};var Vz=e=>`${e.getHours().toString().padStart(2,\"0\")}:${e.getMinutes().toString().padStart(2,\"0\")}:${e.getSeconds().toString().padStart(2,\"0\")}.${e.getMilliseconds().toString().padStart(3,\"0\")}`;var Zz=WO(({cause:e,date:t,fiber:r,logLevel:n,message:o})=>{let s=Array.isArray(o)?o.slice():[o];e.reasons.length>0&&s.push(fm(e));let a=t.getTime(),i=r.getRef(Yd),c=\"\";for(let d of i)c+=` ${Gz(d,a)}`;let u=r.getRef(ps);Object.keys(u).length>0&&s.push(u);let f=r.getRef(VS);(r.getRef(Hz)?f.error:f.log)(`[${Vz(t)}] ${n.toUpperCase()} (#${r.id})${c}:`,...s)}),Yz=WO(({cause:e,fiber:t,logLevel:r,message:n})=>{let o=t.getRef(Nr),s=t.getRef(ps),a=t.cache.span;if(a===void 0||a._tag===\"ExternalSpan\")return;let i={};for(let[c,u]of Object.entries(s))M(i,c,u);i[\"effect.fiberId\"]=t.id,i[\"effect.logLevel\"]=r.toUpperCase(),e.reasons.length>0&&(i[\"effect.cause\"]=fm(e)),a.event(IC(Array.isArray(n)&&n.length===1?n[0]:n),o.currentTimeNanosUnsafe(),i)});function Qz(){jy.interruptChildren??=xz}var YS=D(void 0);var JO=l(e=>ie(e[0]),(e,t)=>US(e,r=>re(n=>(Xz(n,r,t?.defectsOnly),pe)))),Xz=(e,t,r)=>{let n=e.getRef(VA);if(n.size===0||r&&!sm(t))return;let o={cause:t,fiber:e,timestamp:e.getRef(Nr).currentTimeNanosUnsafe()};n.forEach(s=>s.report(o))};var eq=Cf,tq=mc,eb=xc,tb=CC,na=jn,rb=qa,rq=Ha,oa=cs,nq=hd,oq=gc,ci=Xg,sq=Zs,jc=e=>new $a(e),zc=e=>new Af(e),nb=nk,ob=cm,Ss=fk,aq=za,Pm=um,sb=Gy,iq=Vy,ab=Ur,ib=ok,cq=sm,uq=sk,dl=tl,fq=am,lq=ak,pq=ik,dq=im,mq=Zy,cb=fm,hq=gd,xq=kf,gq=Bn,qc=vC,yq=Ba,ub=Wa,Y=_C,Sq=Gf,bq=LO,Eq=Vf,Iq=Zf,Tq=$O,ml=nm,wq=BO,Cq=Yf,fb=om,Aq=Qf,kq=jO,vq=Xf,Oq=el,_q=zO,Rq=Rc,Pq=yc,Mm=ck,Mq=uk,QS=class extends lr()(\"effect/Cause/StackTrace\"){},XS=class extends lr()(\"effect/Cause/InterruptorStackTrace\"){};var N={};Eo(N,{Do:()=>XH,Transaction:()=>Vc,TypeId:()=>WH,abortSignal:()=>yJ,acquireDisposable:()=>iJ,acquireRelease:()=>gi,acquireUseRelease:()=>Y_,addFinalizer:()=>cJ,all:()=>Ym,andThen:()=>_r,annotateCurrentSpan:()=>OJ,annotateLogs:()=>aK,annotateLogsScoped:()=>iK,annotateSpans:()=>vJ,as:()=>Tt,asSome:()=>eh,asVoid:()=>ia,awaitAllChildren:()=>qJ,bind:()=>rW,bindTo:()=>eW,cached:()=>dJ,cachedInvalidateWithTTL:()=>hJ,cachedWithTTL:()=>mJ,callback:()=>Yc,catch:()=>ca,catchCause:()=>rt,catchCauseFilter:()=>EW,catchCauseIf:()=>bW,catchDefect:()=>Wb,catchEager:()=>ru,catchFilter:()=>yW,catchIf:()=>gW,catchNoSuchElement:()=>SW,catchReason:()=>mW,catchReasons:()=>hW,catchTag:()=>pW,catchTags:()=>dW,clockWith:()=>Si,context:()=>hi,contextWith:()=>Ml,currentParentSpan:()=>RJ,currentSpan:()=>_J,delay:()=>Jb,die:()=>an,effectify:()=>yK,ensuring:()=>yi,eventually:()=>kW,exit:()=>vn,fail:()=>P,failCause:()=>ze,failCauseSync:()=>Is,failSync:()=>Xm,fiber:()=>HJ,fiberId:()=>WJ,filter:()=>Gb,filterMap:()=>qW,filterMapEffect:()=>Vb,filterMapOrElse:()=>WW,filterMapOrFail:()=>KW,filterOrElse:()=>HW,filterOrFail:()=>JW,findFirst:()=>VH,findFirstFilter:()=>ZH,firstSuccessOf:()=>UW,flatMap:()=>I,flatMapEager:()=>st,flatten:()=>qb,flip:()=>fW,fn:()=>QJ,fnUntraced:()=>Se,fnUntracedEager:()=>oE,forEach:()=>sa,forever:()=>$t,forkChild:()=>eu,forkDetach:()=>zJ,forkIn:()=>Ut,forkScoped:()=>tu,fromNullishOr:()=>iW,fromOption:()=>sW,fromResult:()=>Pl,gen:()=>dr,head:()=>YH,ignore:()=>RW,ignoreCause:()=>PW,interrupt:()=>_n,interruptible:()=>xJ,interruptibleMask:()=>gJ,isEffect:()=>jo,isFailure:()=>XW,isSuccess:()=>eJ,let:()=>tW,linkSpans:()=>FJ,log:()=>XJ,logDebug:()=>nK,logError:()=>nE,logFatal:()=>eK,logInfo:()=>rK,logTrace:()=>oK,logWarning:()=>tK,logWithLevel:()=>ih,makeSpan:()=>eE,makeSpanScoped:()=>NJ,map:()=>j,mapBoth:()=>IW,mapBothEager:()=>Vt,mapEager:()=>Dr,mapError:()=>th,mapErrorEager:()=>Ul,match:()=>Zb,matchCause:()=>VW,matchCauseEager:()=>ZW,matchCauseEffect:()=>zo,matchCauseEffectEager:()=>YW,matchEager:()=>GW,matchEffect:()=>QW,never:()=>mi,onError:()=>Vn,onErrorFilter:()=>fJ,onErrorIf:()=>uJ,onExit:()=>un,onExitFilter:()=>pJ,onExitIf:()=>lJ,onExitPrimitive:()=>Fl,onInterrupt:()=>Xb,option:()=>uW,orDie:()=>TW,orElseSucceed:()=>NW,partition:()=>JH,promise:()=>Qm,provide:()=>tJ,provideContext:()=>On,provideService:()=>qo,provideServiceEffect:()=>aJ,race:()=>zW,raceAll:()=>Kb,raceAllFirst:()=>jW,raceFirst:()=>Xc,reduce:()=>KH,repeat:()=>SJ,repeatOrElse:()=>bJ,replicate:()=>EJ,replicateEffect:()=>IJ,request:()=>BJ,requestUnsafe:()=>jJ,result:()=>cW,retry:()=>vW,retryOrElse:()=>OW,runCallback:()=>KJ,runCallbackWith:()=>JJ,runFork:()=>Nl,runForkWith:()=>Rn,runPromise:()=>tE,runPromiseExit:()=>ah,runPromiseExitWith:()=>GJ,runPromiseWith:()=>rE,runSync:()=>VJ,runSyncExit:()=>Wo,runSyncExitWith:()=>YJ,runSyncWith:()=>ZJ,sandbox:()=>_W,satisfiesErrorType:()=>bK,satisfiesServicesType:()=>EK,satisfiesSuccessType:()=>SK,schedule:()=>TJ,scheduleFrom:()=>Q_,scope:()=>xi,scoped:()=>oh,scopedWith:()=>sh,service:()=>Yb,serviceOption:()=>Qb,setContext:()=>rJ,sleep:()=>ua,spanAnnotations:()=>PJ,spanLinks:()=>MJ,succeed:()=>g,succeedNone:()=>aa,succeedSome:()=>zb,suspend:()=>$,sync:()=>X,tap:()=>Rr,tapCause:()=>V_,tapCauseFilter:()=>AW,tapCauseIf:()=>CW,tapDefect:()=>Z_,tapError:()=>rh,tapErrorTag:()=>wW,timed:()=>BW,timeout:()=>DW,timeoutOption:()=>LW,timeoutOrElse:()=>$W,tracer:()=>wJ,track:()=>uK,trackDefects:()=>pK,trackDuration:()=>dK,trackErrors:()=>lK,trackSuccesses:()=>fK,transposeOption:()=>aW,try:()=>Qc,tryPromise:()=>Zc,tx:()=>mK,txRetry:()=>gK,undefined:()=>QH,uninterruptible:()=>Ts,uninterruptibleMask:()=>Ho,unwrapReason:()=>xW,updateContext:()=>nJ,updateService:()=>oJ,updateServiceScoped:()=>sJ,useSpan:()=>UJ,validate:()=>GH,void:()=>Q,when:()=>nh,whileLoop:()=>Gn,withErrorReporting:()=>FW,withExecutionPlan:()=>MW,withFiber:()=>cn,withFiberSucceed:()=>oW,withLogSpan:()=>cK,withLogger:()=>sK,withParentSpan:()=>$J,withSpan:()=>DJ,withSpanScoped:()=>LJ,withTracer:()=>CJ,withTracerEnabled:()=>AJ,withTracerTiming:()=>kJ,yieldNow:()=>Rl,yieldNowWith:()=>nW,zip:()=>Hb,zipWith:()=>lW});var ir={};Eo(ir,{asVoid:()=>Wq,asVoidAll:()=>hb,die:()=>lb,fail:()=>bs,failCause:()=>sn,filterCause:()=>$q,filterFailure:()=>Lq,filterSuccess:()=>Uq,filterValue:()=>Dq,findDefect:()=>jq,findError:()=>Bq,findErrorOption:()=>Gq,getCause:()=>Kq,getSuccess:()=>Jq,hasDies:()=>Nq,hasFails:()=>Fq,hasInterrupts:()=>db,interrupt:()=>pb,isExit:()=>hl,isFailure:()=>Uo,isSuccess:()=>Ve,map:()=>zq,mapBoth:()=>Hq,mapError:()=>qq,match:()=>mb,succeed:()=>vr,void:()=>xt});var hl=vf,vr=Ae,sn=Ht,bs=en,lb=Er,pb=Nc,xt=pr;var Ve=Qs,Uo=lS,Fq=Wk,Nq=Hk,db=dS,Uq=Bk,Dq=jk,Lq=zk,$q=ol,Bq=pS,jq=qk,mb=Kk,zq=mS,qq=hS,Hq=xS,Wq=Gk,hb=gS,Jq=Vk,Kq=Zk,Gq=Yk;var Vq=\"~effect/Deferred\";var Zq={[Vq]:{_A:R,_E:R},pipe(){return Z(this,arguments)}},KO=function(){this.resumes=void 0,this.effect=void 0};KO.prototype=Zq;var ui=()=>new KO;var Fm=e=>ht(t=>e.effect?t(e.effect):(e.resumes??=[],e.resumes.push(t),z(()=>{let r=e.resumes;if(r===void 0)return;let n=r.indexOf(t);n>=0&&r.splice(n,1)})));var Yq=l(2,(e,t)=>z(()=>Do(e,t))),Qq=Yq;var Xq=l(2,(e,t)=>Qq(e,Ht(t)));var xb=l(2,(e,t)=>Xq(e,Zs(t)));var Do=(e,t)=>{if(e.effect)return!1;if(e.effect=t,e.resumes){let r=e.resumes;e.resumes=void 0;for(let n=0;n<r.length;n++)r[n](t)}return!0};var GO=ps;var VO=Yd;var ZO=ti;var Or=ea;var kn=wm,Es=Mv,Lo=ta,Kt=Rv;var Nt=_v,Le=RS;var e_=\"~effect/Layer\",YO=\"~effect/Layer/MemoMap\",tH=(e,t)=>{let r={observers:0,deferred:ui(),scope:kn(),finalizer:n=>ne(()=>--r.observers>0?pe:(e.map.delete(t),Le(r.scope,n)))};return r},QO=(e,t)=>t.state._tag===\"Closed\"?!1:(e.observers++,Lc(t,{},e.finalizer),!0),t_=e=>k(e,e_),rH={[e_]:{_ROut:R,_E:R,_RIn:R},pipe(){return Z(this,arguments)}},r_=e=>{let t=Object.create(rH);return t.build=e,t},gb=e=>r_((t,r)=>{let n=Nt(r);return on(e(t,n),o=>o._tag===\"Failure\"?Le(n,o):pe)}),nH=e=>{let t=gb((r,n)=>r.getOrElseMemoize(t,n,e));return t},Um=class{get[YO](){return YO}parent;constructor(t){this.parent=t}map=new Map;get(t,r){let n=this.map.get(t);return n?(QO(n,r),n.deferred.effect??Fm(n.deferred)):this.parent?.get(t,r)}getOrElseMemoize(t,r,n){return ne(()=>{let o;return qn(ne(()=>{let s=this.get(t,r);if(s)return s;let a=tH(this,t);return QO(a,r)?(o=a.deferred,this.map.set(t,a),n(this,a.scope)):n(this,r)}),s=>{o&&Do(o,s)})})}},gl=()=>new Um,oH=e=>new Um(e);var xl=class e extends lr()(\"effect/Layer/CurrentMemoMap\"){static forkOrCreate(t){let r=Fd(t,e);return r?oH(r):gl()}},yl=l(3,(e,t,r)=>kr(ke(ne(()=>e.build(t,r)),Jt(xl,t)),xl,t));var Lm=l(2,(e,t)=>re(r=>yl(e,xl.forkOrCreate(r.context),t))),n_=function(){return arguments.length===1?e=>Dm(Za(arguments[0],e)):Dm(Za(arguments[0],arguments[1]))},Dm=e=>r_(je(D(e)));var yb=function(){return arguments.length===1?e=>XO(arguments[0],e):XO(arguments[0],arguments[1])},XO=(e,t)=>sH(ke(t,r=>Za(e,r))),sH=e=>nH((t,r)=>Es(e,r));var o_=(e,t,r)=>{let n=Nt(r,\"parallel\");return tn(e,o=>o.build(t,Nt(n,\"sequential\")),{concurrency:e.length}).pipe(ke(o=>aA(...o)))},s_=(...e)=>gb((t,r)=>o_(e,t,r));var aH=(e,t,r)=>gb((n,o)=>V(Array.isArray(t)?o_(t,n,o):t.build(n,o),s=>e.build(n,o).pipe(rn(s),ke(a=>r(a,s))))),a_=l(2,(e,t)=>aH(e,t,R));var Hc=Nr;var $m=\"~effect/DateTime\",Bm=\"~effect/DateTime/TimeZone\",c_={[$m]:$m,pipe(){return Z(this,arguments)},[Te](){return this.toString()},toJSON(){return Il(this).toJSON()}},cH={...c_,_tag:\"Utc\",[se](){return It(this.epochMilliseconds)},[ae](e){return Jc(e)&&e._tag===\"Utc\"&&this.epochMilliseconds===e.epochMilliseconds},toString(){return`DateTime.Utc(${Il(this).toJSON()})`}},uH={...c_,_tag:\"Zoned\",[se](){return le(It(this.epochMilliseconds))(H(this.zone))},[ae](e){return Jc(e)&&e._tag===\"Zoned\"&&this.epochMilliseconds===e.epochMilliseconds&&J(this.zone,e.zone)},toString(){return`DateTime.Zoned(${_b(this)})`}},u_={[Bm]:Bm,[Te](){return this.toString()}},fH={...u_,_tag:\"Named\",[se](){return Re(`Named:${this.id}`)},[ae](e){return li(e)&&e._tag===\"Named\"&&this.id===e.id},toString(){return`TimeZone.Named(${this.id})`},toJSON(){return{_id:\"TimeZone\",_tag:\"Named\",id:this.id}}},lH={...u_,_tag:\"Offset\",[se](){return Re(`Offset:${this.offset}`)},[ae](e){return li(e)&&e._tag===\"Offset\"&&this.offset===e.offset},toString(){return`TimeZone.Offset(${kb(this.offset)})`},toJSON(){return{_id:\"TimeZone\",_tag:\"Offset\",offset:this.offset}}},$o=(e,t,r)=>{let n=Object.create(uH);return n.epochMilliseconds=e,n.zone=t,Object.defineProperty(n,\"partsUtc\",{value:r,enumerable:!1,writable:!0}),Object.defineProperty(n,\"adjustedEpochMillis\",{value:void 0,enumerable:!1,writable:!0}),Object.defineProperty(n,\"partsAdjusted\",{value:void 0,enumerable:!1,writable:!0}),n},Jc=e=>k(e,$m);var li=e=>k(e,Bm),f_=e=>li(e)&&e._tag===\"Offset\",l_=e=>li(e)&&e._tag===\"Named\",p_=e=>e._tag===\"Utc\",Eb=e=>e._tag===\"Zoned\",d_=nr((e,t)=>e.epochMilliseconds===t.epochMilliseconds);var m_=e=>{let t=Object.create(cH);return t.epochMilliseconds=e,Object.defineProperty(t,\"partsUtc\",{value:void 0,enumerable:!1,writable:!0}),t},Wc=e=>{let t=e.getTime();if(Number.isNaN(t))throw new ml(\"Invalid date\");return m_(t)},zm=e=>{if(Jc(e))return e;if(e instanceof Date)return Wc(e);if(typeof e==\"object\"){if(\"epochMilliseconds\"in e)return Wc(new Date(e.epochMilliseconds));let t=new Date(0);return SH(t,e),Wc(t)}else if(typeof e==\"string\"&&!pH(e))return Wc(new Date(e+\"Z\"));return Wc(new Date(e))},pH=e=>/Z|GMT|[+-]\\d{2}$|[+-]\\d{2}:?\\d{2}$|\\]$/.test(e),dH=-864e13+720*60*1e3,mH=864e13-840*60*1e3,Ib=(e,t)=>{let r=t?.timeZone;if(r===void 0&&Jc(e)&&Eb(e))return e;let n=zm(e);if(n.epochMilliseconds<dH||n.epochMilliseconds>mH)throw new RangeError(`Epoch millis out of range: ${n.epochMilliseconds}`);r===void 0&&typeof e==\"object\"&&\"timeZoneId\"in e&&(r=e.timeZoneId);let o;if(r===void 0){let s=new Date(n.epochMilliseconds).getTimezoneOffset()*-60*1e3;o=El(s)}else if(li(r))o=r;else if(typeof r==\"number\")o=El(r);else{let s=Cb(r);if(fe(s))throw new ml(`Invalid time zone: ${r}`);o=s.value}return t?.adjustForTimeZone!==!0?$o(n.epochMilliseconds,o,n.partsUtc):bH(n.epochMilliseconds,o,t?.disambiguation??\"compatible\")},Sb=zn(Ib),h_=zn(zm),hH=/^(.{17,35})\\[(.+)\\]$/,x_=e=>{let t=hH.exec(e);if(t===null){let o=Ob(e);return o!==null?Sb(e,{timeZone:o}):v()}let[,r,n]=t;return Sb(r,{timeZone:n})};var g_=e=>m_(e.epochMilliseconds);var jm=new Map,xH={day:\"numeric\",month:\"numeric\",year:\"numeric\",hour:\"numeric\",minute:\"numeric\",second:\"numeric\",timeZoneName:\"longOffset\",fractionalSecondDigits:3,hourCycle:\"h23\"},gH=e=>{let t=e.resolvedOptions().timeZone,r=jm.get(t);if(r!==void 0)return r;let n=Object.create(fH);return n.id=t,n.format=e,jm.set(t,n),n},Tb=e=>{let t=jm.get(e);if(t!==void 0)return t;try{let r=gH(new Intl.DateTimeFormat(\"en-US\",{...xH,timeZone:e}));return jm.set(e,r),r}catch{throw new ml(`Invalid time zone: ${e}`)}},El=e=>{let t=Object.create(lH);return t.offset=e,t},wb=zn(Tb);var yH=/^(?:GMT|[+-])/,Cb=e=>{if(yH.test(e)){let t=Ob(e);return t===null?v():O(El(t))}return wb(e)},y_=e=>e._tag===\"Offset\"?kb(e.offset):e.id;var Il=e=>new Date(e.epochMilliseconds),qm=e=>{if(e._tag===\"Utc\")return new Date(e.epochMilliseconds);if(e.zone._tag===\"Offset\")return new Date(e.epochMilliseconds+e.zone.offset);if(e.adjustedEpochMilliseconds!==void 0)return new Date(e.adjustedEpochMilliseconds);let t=e.zone.format.formatToParts(e.epochMilliseconds).filter(n=>n.type!==\"literal\"),r=new Date(0);return r.setUTCFullYear(Number(t[2].value),Number(t[0].value)-1,Number(t[1].value)),r.setUTCHours(Number(t[3].value),Number(t[4].value),Number(t[5].value),t[6]?.type===\"fractionalSecond\"?Number(t[6].value):(e.epochMilliseconds%1e3+1e3)%1e3),e.adjustedEpochMilliseconds=r.getTime(),r},Ab=e=>qm(e).getTime()-vb(e),kb=e=>{let t=Math.abs(e),r=Math.floor(t/(3600*1e3)),n=Math.round(t%(3600*1e3)/(60*1e3));return n===60&&(r+=1,n=0),`${e<0?\"-\":\"+\"}${String(r).padStart(2,\"0\")}:${String(n).padStart(2,\"0\")}`},S_=e=>kb(Ab(e)),vb=e=>e.epochMilliseconds;var SH=(e,t)=>{if((t.year!==void 0||t.month!==void 0||t.day!==void 0)&&e.setUTCFullYear(t.year??e.getUTCFullYear(),t.month!==void 0?t.month-1:e.getUTCMonth(),t.day??e.getUTCDate()),t.weekDay!==void 0){let r=t.weekDay-e.getUTCDay();e.setUTCDate(e.getUTCDate()+r)}t.hour!==void 0&&e.setUTCHours(t.hour),t.minute!==void 0&&e.setUTCMinutes(t.minute),t.second!==void 0&&e.setUTCSeconds(t.second),t.millisecond!==void 0&&e.setUTCMilliseconds(t.millisecond)};var i_=1440*60*1e3,bH=(e,t,r)=>{if(t._tag===\"Offset\")return $o(e-t.offset,t);let n=bl(e-i_,e,t),o=bl(e+i_,e,t);if(n===o)return $o(e-n,t);let s=n<o,a=n-o;if(s){if(bl(e-o,e,t)===o)return $o(e-o,t);let u=$o(e-n,t),f=qm(u).getTime();if(e!==f)switch(r){case\"reject\":{let p=new Date(e).toISOString();throw new RangeError(`Gap time: ${p} does not exist in time zone ${t.id}`)}case\"earlier\":return $o(e-o,t);case\"compatible\":case\"later\":return u}return u}if(bl(e-n,e,t)===n){if(r===\"earlier\"||r===\"compatible\"||bl(e-n+a,e+a,t)===n)return $o(e-n,t);if(r===\"reject\"){let u=new Date(e).toISOString();throw new RangeError(`Ambiguous time: ${u} occurs twice in time zone ${t.id}`)}}return $o(e-o,t)},EH=/([+-])(\\d{2}):(\\d{2})$/,Ob=e=>{let t=EH.exec(e);if(t===null)return null;let[,r,n,o]=t;return(r===\"+\"?1:-1)*(Number(n)*60+Number(o))*60*1e3},bl=(e,t,r)=>{let n=r.format.formatToParts(e).find(s=>s.type===\"timeZoneName\")?.value??\"\";if(n===\"GMT\")return 0;let o=Ob(n);return o===null?Ab($o(t,r)):o};var b_=e=>Il(e).toISOString();var bb=e=>{let t=qm(e);return e._tag===\"Utc\"?t.toISOString():`${t.toISOString().slice(0,-1)}${S_(e)}`},_b=e=>e.zone._tag===\"Offset\"?bb(e):`${bb(e)}[${e.zone.id}]`;var zre=globalThis.Number;var I_=l(2,(e,t)=>{if(!globalThis.Number.isFinite(e)||!globalThis.Number.isFinite(t)||t===0)return NaN;if(globalThis.Number.isInteger(e)&&globalThis.Number.isInteger(t))return e%t;let[r,n]=E_(e),[o,s]=E_(t),a=Math.min(n,s),i=r*BigInt(10)**BigInt(n-a),c=o*BigInt(10)**BigInt(s-a),u=i%c;if(u===BigInt(0))return e<0||Object.is(e,-0)?-0:0;let f=globalThis.Number(`${u}e${a}`);return f===0?Math.sign(e)*globalThis.Number.MIN_VALUE:f});function E_(e){if(globalThis.Number.isInteger(e))return[BigInt(e),0];let t=Math.abs(e).toExponential(),r=t.indexOf(\"e\"),n=t.slice(0,r).replace(\".\",\"\");return[BigInt(n)*(e<0?-BigInt(1):BigInt(1)),globalThis.Number(t.slice(r+1))-n.length+1]}var T_=e=>{let t=Math.ceil(Math.log(e)/Math.log(2));return Math.max(Math.pow(2,t),2)};var Hre=globalThis.String,Hm=br;var w_=e=>e.toUpperCase();var C_=e=>e.trim();var wH=(e,t,r,n,o)=>{let s=e;for(let c of t)s=s.replace(c,\"$1\\0$2\");for(let c of r)s=s.replace(c,\"\\0\");let a=0,i=s.length;for(;s.charAt(a)===\"\\0\";)a++;for(;s.charAt(i-1)===\"\\0\";)i--;return s.slice(a,i).split(\"\\0\").map(o).join(n)};var CH=[/([a-z0-9])([A-Z])/g,/([A-Z])([A-Z][a-z])/g],AH=/[^A-Z0-9]+/gi;var A_=e=>wH(e,CH,[AH],\"_\",w_);var He=l(2,(e,t)=>xs(e,kH,r=>t(r))),Bo=e=>e.reasons.some(Rb),Rb=e=>e._tag===\"Fail\"&&qc(e.error),Tl=e=>{let t,r=!1;for(let n of e.reasons)Rb(n)?t??=n.error:n._tag!==\"Interrupt\"&&(r=!0);return t===void 0?W(e):r?W(oa(e.reasons.filter(n=>!Rb(n)))):B(t)};var kH=e=>{let t=Tl(e);return ce(t)?t:B(t.success.value)},Jm=e=>{let t=Tl(e);return ce(t)?sn(t.failure):vr(t.success.value)},Km=l(2,(e,t)=>Mo(e,{onSuccess:t.onSuccess,onFailure:r=>{let n=Tl(r);return ce(n)?t.onFailure(n.failure):t.onDone(n.success.value)}}));var k_=\"~effect/Schedule\";var Gt=we(\"effect/Schedule/CurrentMetadata\",{defaultValue:je({input:void 0,output:void 0,duration:Ws,attempt:0,start:0,now:0,elapsed:0,elapsedSincePrevious:0})}),vH={[k_]:{_Out:R,_In:R,_Env:R},pipe(){return Z(this,arguments)}},Pb=e=>k(e,k_),wl=e=>{let t=Object.create(vH);return t.step=e,t},Mb=()=>{let e=0,t,r;return(n,o)=>{r===void 0&&(r=n);let s=n-r,a=t===void 0?0:n-t;return t=n,{input:o,attempt:++e,start:r,now:n,elapsed:s,elapsedSincePrevious:a}}},OH=e=>wl(ke(e,t=>{let r=Mb();return(n,o)=>t(r(n,o))})),di=e=>nn(e.step,t=>D(()=>De(t))),Kn=e=>Wn(t=>ke(di(e),r=>{let n=Mb();return o=>ne(()=>{let s=t.currentTimeMillisUnsafe();return V(r(s,o),([a,i])=>{let c=n(s,o);return c.output=a,c.duration=i,Ar(Bc(i),c)})})})),Cl=e=>ke(Kn(e),t=>r=>ke(t(r),n=>n.output));var Fb=e=>wl(ke(di(e),t=>(r,n)=>Km(t(r,n),{onSuccess:o=>D([n,o[1]]),onFailure:De,onDone:()=>Y(n)}))),v_=e=>Al(kl,({attempt:t})=>D(t<=e)),Nb=e=>{let t=Ge(e);return OH(D(r=>D([r.attempt-1,t])))};var Al=l(2,(e,t)=>wl(ke(di(e),r=>{let n=Mb();return(o,s)=>V(r(o,s),a=>{let[i,c]=a,u=t({...n(o,s),output:i,duration:c});return V(ie(u)?u:D(u),f=>f?D(a):Y(i))})})));var kl=Nb(Ws);var O_=\"~effect/ExecutionPlan\";var _H={[O_]:O_,get captureRequirements(){let e=this;return Xs(t=>D(RH(e.steps.map(r=>({...r,while:r.while?n=>rn(r.while(n),t):void 0,schedule:r.schedule?wl(rn(ke(di(r.schedule),n=>(o,s)=>rn(n(o,s),t)),t)):void 0,provide:t_(r.provide)?a_(r.provide,Dm(t)):r.provide})))))},pipe(){return Z(this,arguments)}},RH=e=>{let t=Object.create(_H);return t.steps=e,t};var Gm=we(\"effect/ExecutionPlan/CurrentMetadata\",{defaultValue:je({attempt:0,stepIndex:0})});var PH=(e,t,r)=>Cm(n=>V(r?.local?yl(t,gl(),n):Lm(t,n),o=>rn(e,o))),Vm=l(e=>ie(e[0]),(e,t,r)=>Uf(t)?rn(e,t):PH(e,Array.isArray(t)?s_(...t):t,r));var R_=e=>e.reasons.every(jn)?Ur(e):W(e),Db=l(3,(e,t,r)=>V(Kn(t),n=>{let o=Gt.defaultValue();return xs(He(ym(si(V(ne(()=>kr(e,Gt,o)),n),s=>z(()=>{o=s})),{disableYield:!0}),s=>D(s)),R_,s=>r(s,o.attempt===0?v():O(o)))})),Lb=l(3,(e,t,r)=>V(Kn(t),n=>{let o=Gt.defaultValue(),s,a=xs(ne(()=>kr(e,Gt,o)),R_,i=>(s=i,V(n(i),c=>(o=c,a))));return He(a,i=>js(()=>r(s,i)))})),P_=l(2,(e,t)=>{let r=typeof t==\"function\"?t(R):Pb(t)?t:Ol(t);return Db(e,r,Qe)}),vl=l(2,(e,t)=>{let r=typeof t==\"function\"?t(R):Pb(t)?t:Ol(t);return Lb(e,r,Qe)}),M_=l(3,(e,t,r)=>V(Kn(r),n=>{let o=Gt.defaultValue(),s=ne(()=>kr(e,Gt,o));return He(V(n(t),a=>{o=a;let i=je(V(s,n));return No({while:Sr,body:i,step(c){o=c}})}),a=>D(a))})),MH=Fb(kl),Ol=e=>{let t=e.schedule?Fb(e.schedule):MH;return e.while&&(t=Al(t,({input:r})=>{let n=e.while(r);return ie(n)?n:D(n)})),e.until&&(t=Al(t,({input:r})=>{let n=e.until(r);return ie(n)?ke(n,o=>!o):D(!n)})),e.times!==void 0&&(t=Al(t,({attempt:r})=>D(r<=e.times))),t};var $b=(e,t)=>{let r=-1,n=0,o=s=>Em(e(s));return{begin:Wn(s=>ne(()=>{let a=t();a.stepIndex!==r&&(r=a.stepIndex,n=0),n++;let i={attempt:a.attempt,stepAttempt:n,stepIndex:a.stepIndex,startNanos:s.monotonicTimeNanosUnsafe()};return Ar(o({_tag:\"AttemptStart\",attempt:i.attempt,stepAttempt:i.stepAttempt,stepIndex:i.stepIndex}),i)})),end:(s,a)=>Wn(i=>{let c=Ro(i.monotonicTimeNanosUnsafe()-s.startNanos);return o(a._tag===\"Success\"?{_tag:\"AttemptSuccess\",attempt:s.attempt,stepAttempt:s.stepAttempt,stepIndex:s.stepIndex,duration:c}:{_tag:\"AttemptFailure\",attempt:s.attempt,stepAttempt:s.stepAttempt,stepIndex:s.stepIndex,duration:c,cause:a.cause})})}},N_=l(e=>ie(e[0]),(e,t,r)=>ne(()=>{let n=0,o={attempt:0,stepIndex:0},s=gm(Gm,z(()=>(o={attempt:o.attempt+1,stepIndex:n},o))),a=r?.onEvent===void 0?void 0:$b(r.onEvent,()=>o),i=a===void 0?R:u=>Hn(f=>V(a.begin,p=>on(f(u),d=>a.end(p,d)))),c;return V(No({while:()=>n<t.steps.length&&(c===void 0||ce(c)),body(){let u=t.steps[n],f=s(i(Vm(e,u.provide)));if(c){let p=!1,d=f;f=ne(()=>p?d:(p=!0,Pc(c))),f=vl(f,_l(u,!1))}else{let p=_l(u,!0);f=p?vl(f,p):f}return Vs(f)},step(u){c=u,n++}}),()=>Pc(c))})),_l=(e,t)=>{if(t){if(e.attempts===1||!(e.schedule||e.attempts))return}else return Ol({schedule:e.schedule?e.schedule:e.attempts?void 0:FH,times:e.attempts,while:e.while});return Ol({schedule:e.schedule,while:e.while,times:e.attempts?e.attempts-1:void 0})},FH=v_(1);var NH=\"~effect/Request\",UH=gC({_E:e=>e,_A:e=>e,_R:e=>e}),cne={...wC,[NH]:UH};var D_=e=>e;var $_=l(2,(e,t)=>{let r=n=>ht(o=>{let s=j_(n,e,o,ds());return LH(n,s)});return ie(t)?V(t,r):r(t)}),B_=(e,t)=>{let r=j_(t.resolver,e,t.onExit,{context:t.context,cache:{scheduler:Fe(t.context,zf)}});return()=>z_(t.resolver,r)},Zm=[],Bb=new WeakMap,j_=(e,t,r,n)=>{let o=Bb.get(e);o||(o=new Map,Bb.set(e,o));let s,a=!1,i=D_({request:t,context:n.context,uninterruptible:!1,completeUnsafe(u){a||(a=!0,!(s&&!s.entrySet.delete(i))&&r(u))}});if(e.preCheck!==void 0&&!e.preCheck(i))return i;let c=e.batchKey(i);if(s=o.get(c),!s){if(Zm.length>0)s=Zm.pop(),s.key=c,s.resolver=e,s.map=o;else{let u={key:c,resolver:e,map:o,entrySet:new Set,entries:new Set,delayEffect:V(ne(()=>u.resolver.delay),f=>L_(u)),run:on(ne(()=>u.resolver.runAll(Array.from(u.entries),u.key)),f=>{for(let p of u.entrySet)p.completeUnsafe(f._tag===\"Success\"?Er(new Error(\"Effect.request: RequestResolver did not complete request\",{cause:p.request})):f);return u.entries.clear(),Zm.length<128&&(u.entrySet.clear(),u.key=void 0,u.fiber=void 0,u.resolver=void 0,u.map=void 0,Zm.push(u)),pe})};s=u}o.set(c,s),s.fiber=ys(n.context)(s.delayEffect,{scheduler:n.cache.scheduler})}return s.entrySet.add(i),s.entries.add(i),s.resolver.collectWhile(s.entries)||(s.fiber.interruptUnsafe(n.id),s.fiber=ys(n.context)(L_(s),{scheduler:n.cache.scheduler})),i},z_=(e,t)=>{if(t.uninterruptible)return;let r=Bb.get(e);if(!r)return;let n=e.batchKey(t),o=r.get(n);if(!o||!o.entries.delete(t))return;o.entrySet.delete(t);let s;o.entries.size===0&&(r.delete(n),s=o.fiber),t.completeUnsafe(Nc()),s?.interruptUnsafe()},LH=(e,t)=>z(()=>z_(e,t));function L_(e){return e.map.has(e.key)?(e.map.delete(e.key),e.run):pe}var BH=\"effect/Metric/CurrentMetricAttributes\",jH=we(BH,{defaultValue:()=>({})}),zH=\"effect/Metric/MetricRegistry\",qH=we(zH,{defaultValue:()=>new Map}),q_=\"~effect/Metric\",H_=class{[q_]=q_;#t;#e=\"\";id;description;attributes;constructor(t,r,n){this.id=t,this.description=r,this.attributes=n}valueUnsafe(t){return this.hook(t).get(t)}modifyUnsafe(t,r){return this.hook(r).modify(t,r)}updateUnsafe(t,r){return this.hook(r).update(t,r)}hook(t){let r=Fe(t,jH);r!==this.#t&&(this.#t=r,this.#e=HH(this,W_(this.attributes,r)));let n=Fe(t,qH),o=n.get(this.#e);return aC(o)&&(o={id:this.id,type:this.type,description:this.description,attributes:Object.keys(r).length>0?W_(this.attributes,r):this.attributes,hooks:this.createHooks()},n.set(this.#e,o)),o.hooks}pipe(){return Z(this,arguments)}};var Gc=l(2,(e,t)=>Xs(r=>z(()=>e.updateUnsafe(t,r))));function HH(e,t){let r=Object.entries(t).sort((n,o)=>n[0]<o[0]?-1:n[0]>o[0]?1:0);return JSON.stringify([e.type,e.id,e.description,r])}function W_(e,t){return{...J_(e),...J_(t)}}function J_(e){return Io(e)&&Array.isArray(e)?e.reduce((t,[r,n])=>(M(t,r,n),t),{}):e}var WH=ko,jo=ie,Ym=ll,JH=$S,KH=Kv,GH=Gv,VH=Vv,ZH=Yv,sa=tn,YH=Xv,Gn=No,Qm=nS,Zc=Ek,g=D,aa=oi,zb=rS,$=ne,X=z,Q=pe;var QH=YS;var Yc=ht,mi=mm,XH=sO,eW=aO,tW=cO;var rW=iO,dr=Ck,P=Qe,Xm=dm,ze=De,Is=Sk,an=Ys,Qc=bk;var Rl=Mc,nW=tS,cn=re,oW=kC,Pl=Pc,sW=eS,aW=yk,iW=gk,I=V,qb=Nk,_r=Fo,Rr=si,cW=Vs,uW=bv,vn=il,j=ke,Tt=Ar,eh=Fc,ia=nl,fW=_k,Hb=rv,lW=SS,ca=gs;var pW=TS,dW=dv,mW=mv,hW=hv,xW=xv,rt=nn,Wb=cv,gW=sl,yW=bm,SW=iv,bW=ES,EW=xs,th=wS,IW=CS,TW=AS,rh=IS,wW=lv,V_=uv,CW=fv,AW=Sm,Z_=pv,kW=kS,vW=vl,OW=Lb,_W=Rk,RW=Sv,PW=Em,MW=N_,FW=JO,NW=gv,UW=yv,DW=kv,LW=_S,$W=OS,Jb=Av,ua=Bc,BW=vv,Kb=cS,jW=uS,zW=Pk,Xc=fS,Gb=rO,qW=nO,Vb=oO,HW=BS,WW=jS,JW=nv,KW=tO,nh=ov,Zb=Im,GW=al,VW=vS,ZW=Tv,YW=Mk,zo=Mo,QW=Dc,XW=wv,eJ=Cv,hi=yS,Ml=Xs,tJ=Vm,On=rn,rJ=tv,Yb=Qk,Qb=Xk,nJ=Uc,oJ=hs,sJ=ev,qo=kr,aJ=gm,xi=cl,oh=PS,sh=Cm,gi=ai,iJ=Lv,Y_=ul,cJ=MS,yi=Nv,Vn=US,uJ=Uv,fJ=DS,Fl=qn,un=on,lJ=FS,pJ=NS,dJ=jv,mJ=Bv,hJ=LS,_n=zv,xJ=Am,Xb=Dv,Ts=ii,Ho=Hn,gJ=Wv,yJ=Jv,$t=ym,SJ=P_,bJ=Db,EJ=bS,IJ=sv,TJ=l(2,(e,t)=>Q_(e,void 0,t)),Q_=M_,wJ=EO,CJ=IO,AJ=TO,kJ=wO,vJ=PO,OJ=MO,_J=FO,RJ=NO,PJ=vO,MJ=OO,FJ=_O,eE=AO,NJ=Jf,UJ=Kf,DJ=RO,LJ=kO,$J=_c,BJ=$_,jJ=B_,eu=uO,Ut=zS,tu=pO,zJ=fO,qJ=lO,HJ=Tk,WJ=wk,Nl=mO,Rn=ys,JJ=qS,KJ=hO,tE=gO,rE=HS,ah=xO,GJ=Om,VJ=SO,ZJ=WS,Wo=yO,YJ=_m,Se=sS,QJ=Ak,Si=Wn,ih=Jn,XJ=Jn(),eK=Jn(\"Fatal\"),tK=Jn(\"Warn\"),nE=Jn(\"Error\"),rK=Jn(\"Info\"),nK=Jn(\"Debug\"),oK=Jn(\"Trace\"),sK=l(2,(e,t)=>hs(e,ZS,r=>new Set([...r,t]))),aK=l(e=>jo(e[0]),(e,...t)=>hs(e,GO,r=>{let n=t.length===1?{...r,...t[0]}:{...r};return t.length===1||M(n,t[0],t[1]),n})),iK=HO,cK=l(2,(e,t)=>V(GS,r=>hs(e,VO,n=>[[t,r],...n]))),uK=l(e=>jo(e[0]),(e,t,r)=>un(e,n=>{let o=r===void 0?n:r(n);return Gc(t,o)})),fK=l(e=>jo(e[0]),(e,t,r)=>Rr(e,n=>{let o=r===void 0?n:r(n);return Gc(t,o)})),lK=l(e=>jo(e[0]),(e,t,r)=>rh(e,n=>{let o=r===void 0?n:r(n);return Gc(t,o)})),pK=l(e=>jo(e[0]),(e,t,r)=>Z_(e,n=>{let o=r===void 0?n:r(n);return Gc(t,o)})),dK=l(e=>jo(e[0]),(e,t,r)=>Si(n=>{let o=n.monotonicTimeNanosUnsafe();return un(e,()=>{let s=n.monotonicTimeNanosUnsafe(),a=PA(Ge(s),Ge(o)),i=r===void 0?a:r(a);return Gc(t,i)})})),Vc=class extends lr()(\"effect/Effect/Transaction\"){},mK=e=>cn(t=>{let r=Fd(t.context,Vc);if(r&&!G_.has(r))return e;r={journal:new Map,retry:!1};let n;return Ho(o=>I(Gn({while:()=>!n,body:je(o(e).pipe(qo(Vc,r),V_(s=>r.retry?cm(s)?o(hK(r)):X(()=>jb(r)):Q),vn)),step(s){if(r.retry||!X_(r))return jb(r);Ve(s)&&xK(t,r),jb(r),G_.add(r),n=s}}),()=>n))}),G_=new WeakSet,X_=e=>{for(let[t,{version:r}]of e.journal)if(t.version!==r)return!1;return!0},hK=e=>Yc(t=>{if(!X_(e))return t(Q);let r={},n=Array.from(e.journal.keys()),o=()=>{for(let a of n)a.pending.delete(r)},s=()=>{o(),t(Q)};for(let a of n)a.pending.set(r,s);return X(o)});function xK(e,t){for(let[r,{value:n,written:o}]of t.journal)if(o){Object.is(n,r.value)||(r.version=r.version+1,r.value=n);for(let s of r.pending.values())e.currentDispatcher.scheduleTask(s,0);r.pending.clear()}}function jb(e){e.retry=!1,e.journal.clear()}var gK=I(Vc,e=>(e.retry=!0,_n)),yK=(e,t,r)=>(...n)=>Yc(o=>{try{e(...n,(s,a)=>{o(s?t?$(()=>P(t(s,n))):P(s):g(a))})}catch(s){o(r?P(r(s,n)):an(s))}}),SK=()=>e=>e,bK=()=>e=>e,EK=()=>e=>e,Dr=Uk,Ul=Dk,Vt=Lk,st=Fk,ru=$k,oE=kk;var eR=/^[+-]?\\d+$/,aE=\"~effect/BigDecimal\",IK={[aE]:aE,[se](){let e=cE(this);return le(Re(String(e.value)),It(e.scale))},[ae](e){return iE(e)&&aR(this,e)===0},toString(){return`BigDecimal(${ws(this)})`},toJSON(){return{_id:\"BigDecimal\",value:String(this.value),scale:this.scale}},[Te](){return this.toJSON()},pipe(){return Z(this,arguments)}},iE=e=>k(e,aE),nR=(e,t)=>{if(!Number.isSafeInteger(t))throw new RangeError(`Scale must be a safe integer, got ${t}`);let r=Object.create(IK);return r.value=e,r.scale=t,r},oR=(e,t)=>{let r=nR(e,t);return r.normalized=r,r};var Zn=BigInt(0),TK=BigInt(1);var wK=BigInt(10),sR=oR(Zn,0);var cE=e=>{if(e.normalized===void 0)if(e.value===Zn)e.normalized=sR;else{let t=`${e.value}`,r=t.length;for(;t[r-1]===\"0\";)r--;e.normalized=oR(BigInt(t.slice(0,r)),e.scale-(t.length-r))}return e.normalized};var CK=100,AK=[TK],sE=(e,t)=>e===t?0:e<t?-1:1,tR=(e,t)=>{let r=`${e.value<Zn?-e.value:e.value}`,n=`${t.value<Zn?-t.value:t.value}`,o=BigInt(r.length-n.length)-BigInt(e.scale)+BigInt(t.scale);if(o!==Zn)return o<Zn?-1:1;let s=Math.max(r.length,n.length);return WC(r.padEnd(s,\"0\"),n.padEnd(s,\"0\"))},aR=(e,t)=>{if(e.scale===t.scale)return sE(e.value,t.value);let r=rR(e),n=rR(t);if(r!==n)return r<n?-1:1;if(r===0)return 0;let o=e.scale-t.scale,s=Math.abs(o);if(s>CK)return r===-1?tR(t,e):tR(e,t);let a=AK[s]??=wK**BigInt(s);return o>0?sE(e.value,t.value*a):sE(e.value*a,t.value)},nu=zs(aR);var rR=e=>e.value===Zn?0:e.value<Zn?-1:1;var iR=e=>{if(e===\"\")return O(sR);let t,r,n=e.search(/[eE]/);if(n!==-1){let c=e.slice(n+1);if(t=e.slice(0,n),r=Number(c),t===\"\"||!Number.isSafeInteger(r)||!eR.test(c))return v()}else t=e,r=0;let o,s,a=t.search(/\\./);if(a!==-1){let c=t.slice(0,a),u=t.slice(a+1);o=`${c}${u}`,s=u.length}else o=t,s=0;if(!eR.test(o))return v();let i=s-r;return Number.isSafeInteger(i)?O(nR(BigInt(o),i)):v()};var ws=e=>{let t=cE(e);if(Math.abs(t.scale)>=16)return kK(t);let r=t.value<Zn,n=`${r?-t.value:t.value}`,o=t.scale>0?n.padStart(t.scale+1,\"0\"):n.padEnd(n.length-t.scale,\"0\"),s=o.length-t.scale,a=t.scale>0?`${o.slice(0,s)}.${o.slice(s)}`:o;return r?`-${a}`:a},kK=e=>{if(vK(e))return\"0e+0\";let t=cE(e),r=`${t.value}`,n=t.value<Zn?2:1,o=r.slice(0,n),s=r.slice(n),a=s.length-t.scale;return`${o}${s===\"\"?\"\":`.${s}`}e${a>=0?\"+\":\"\"}${a}`};var vK=e=>e.value===Zn;var me={};Eo(me,{Any:()=>tV,Array:()=>$e,ArrayEnsure:()=>pV,BigDecimal:()=>pD,BigDecimalFromString:()=>JZ,BigInt:()=>Bu,BigIntFromString:()=>_Z,Boolean:()=>XT,BooleanFromBit:()=>DZ,BooleanLiterals:()=>nw,ByteSize:()=>Ju,ByteSizeFromBigInt:()=>GZ,ByteSizeFromNumber:()=>VZ,ByteSizeFromString:()=>KZ,Cause:()=>VT,CauseReason:()=>GT,Char:()=>hZ,Chunk:()=>ZZ,Class:()=>zD,Cookie:()=>$D,Cookies:()=>BD,Date:()=>Wu,DateFromMillis:()=>TZ,DateFromString:()=>IZ,DateTimeUtc:()=>Rx,DateTimeUtcFromDate:()=>r5,DateTimeUtcFromMillis:()=>o5,DateTimeUtcFromString:()=>n5,DateTimeZoned:()=>OD,DateTimeZonedFromString:()=>c5,Defect:()=>gZ,Duration:()=>Mx,DurationFromMillis:()=>Y5,DurationFromNanos:()=>Z5,DurationFromString:()=>hw,Enum:()=>X3,Error:()=>qD,ErrorInstance:()=>xZ,Exit:()=>Q5,FalseLiterals:()=>jU,File:()=>sD,Finite:()=>qu,FiniteFromString:()=>OZ,FormData:()=>aD,Graph:()=>r8,HashMap:()=>n8,HashSet:()=>o8,Headers:()=>u8,InetAddress:()=>DD,InetAddressFromString:()=>q5,InetAddressV4:()=>j5,InetAddressV6:()=>z5,Int:()=>lo,IpAddress:()=>Ki,IpAddressFromString:()=>Gu,IpInterface:()=>MD,IpInterfaceFromString:()=>D5,IpLinkLocalAddress:()=>T5,IpLinkLocalAddressFromString:()=>w5,IpLoopbackAddress:()=>E5,IpLoopbackAddressFromString:()=>I5,IpMulticastAddress:()=>u5,IpMulticastAddressFromString:()=>f5,IpNetwork:()=>UD,IpNetworkFromString:()=>B5,IpUnicastAddress:()=>d5,IpUnicastAddressFromString:()=>m5,IpUnspecifiedAddress:()=>C5,IpUnspecifiedAddressFromString:()=>A5,Ipv4Address:()=>Px,Ipv4AddressFromString:()=>dw,Ipv4BroadcastAddress:()=>g5,Ipv4BroadcastAddressFromString:()=>y5,Ipv4Interface:()=>RD,Ipv4InterfaceFromString:()=>N5,Ipv4Network:()=>FD,Ipv4NetworkFromString:()=>L5,Ipv4PrivateAddress:()=>k5,Ipv4PrivateAddressFromString:()=>v5,Ipv6Address:()=>mw,Ipv6AddressFromString:()=>_D,Ipv6Interface:()=>PD,Ipv6InterfaceFromString:()=>U5,Ipv6Network:()=>ND,Ipv6NetworkFromString:()=>$5,Ipv6UniqueLocalAddress:()=>O5,Ipv6UniqueLocalAddressFromString:()=>_5,Json:()=>Nx,JsonFromUrlParamsField:()=>f8,JsonObject:()=>L8,Literal:()=>Ct,Literals:()=>fo,MacAddress:()=>Ji,MacAddressFromString:()=>Ku,MacBroadcastAddress:()=>S5,MacBroadcastAddressFromString:()=>b5,MacLocallyAdministeredAddress:()=>R5,MacLocallyAdministeredAddressFromString:()=>P5,MacMulticastAddress:()=>l5,MacMulticastAddressFromString:()=>p5,MacUnicastAddress:()=>h5,MacUnicastAddressFromString:()=>x5,MacUniversallyAdministeredAddress:()=>M5,MacUniversallyAdministeredAddressFromString:()=>F5,MutableJson:()=>B8,Natural:()=>zi,Never:()=>eV,NonEmptyArray:()=>tw,NonEmptyString:()=>fw,Null:()=>wx,NullOr:()=>rw,NullishOr:()=>PU,Number:()=>Wi,NumberFromString:()=>vZ,ObjectKeyword:()=>oV,Opaque:()=>CV,Option:()=>Gi,OptionFromNullOr:()=>s8,OptionFromNullishOr:()=>i8,OptionFromOptional:()=>d8,OptionFromOptionalKey:()=>p8,OptionFromOptionalNullOr:()=>m8,OptionFromUndefinedOr:()=>a8,PropertyKey:()=>KT,ReadonlyMap:()=>yZ,ReadonlySet:()=>SZ,Record:()=>_s,RecordFromCookies:()=>c8,RecordFromUrlParams:()=>l8,Redacted:()=>Fx,RedactedFromValue:()=>h8,RegExp:()=>bZ,Result:()=>x8,SchemaError:()=>Os,SocketAddress:()=>W5,StandardSchemaV1FailureResult:()=>UZ,String:()=>K,StringForLiteralAutocomplete:()=>rV,StringFromBase64:()=>PZ,StringFromBase64Url:()=>MZ,StringFromHex:()=>FZ,StringFromUriComponent:()=>NZ,Struct:()=>Me,StructWithRest:()=>fV,Symbol:()=>OU,TaggedClass:()=>b8,TaggedError:()=>E8,TaggedStruct:()=>kx,TaggedUnion:()=>wV,TemplateLiteral:()=>Y3,TemplateLiteralParser:()=>Q3,TimeZone:()=>kD,TimeZoneFromString:()=>i5,TimeZoneNamed:()=>CD,TimeZoneNamedFromString:()=>a5,TimeZoneOffset:()=>s5,Tree:()=>D8,Trim:()=>RZ,Trimmed:()=>cD,TrueLiterals:()=>BU,Tuple:()=>Qo,TupleWithRest:()=>lV,URL:()=>Ox,URLFromString:()=>EZ,URLSearchParams:()=>iD,Uint8Array:()=>_x,Uint8ArrayFromBase64:()=>LZ,Uint8ArrayFromBase64Url:()=>$Z,Uint8ArrayFromHex:()=>BZ,Undefined:()=>QT,UndefinedOr:()=>Ax,Union:()=>it,UniqueArray:()=>dV,UniqueSymbol:()=>sV,UnixPathAddress:()=>LD,UnixPathAddressFromString:()=>H5,Unknown:()=>vp,UnknownFromJsonString:()=>CZ,UrlParams:()=>xw,Void:()=>nV,annotate:()=>w3,annotateEncoded:()=>C3,annotateKey:()=>A3,asserts:()=>R3,brand:()=>NU,catchDecoding:()=>gV,catchDecodingWithContext:()=>LU,catchEncoding:()=>yV,catchEncodingWithContext:()=>$U,check:()=>hV,declare:()=>Be,declareConstructor:()=>qr,decode:()=>SV,decodeEffect:()=>P3,decodeExit:()=>M3,decodeOption:()=>N3,decodePromise:()=>D3,decodeResult:()=>U3,decodeSync:()=>L3,decodeTo:()=>G,decodeUnknownEffect:()=>Ex,decodeUnknownExit:()=>bU,decodeUnknownOption:()=>F3,decodeUnknownPromise:()=>IU,decodeUnknownResult:()=>EU,decodeUnknownSync:()=>TU,encode:()=>bV,encodeEffect:()=>$3,encodeExit:()=>B3,encodeKeys:()=>cV,encodeOption:()=>z3,encodePromise:()=>H3,encodeResult:()=>q3,encodeSync:()=>W3,encodeTo:()=>ow,encodeUnknownEffect:()=>Ix,encodeUnknownExit:()=>wU,encodeUnknownOption:()=>j3,encodeUnknownPromise:()=>AU,encodeUnknownResult:()=>CU,encodeUnknownSync:()=>kU,extendTo:()=>uV,fieldsAssign:()=>aV,flip:()=>JT,fromBrand:()=>xV,fromFormData:()=>AZ,fromJsonString:()=>lw,fromURLSearchParams:()=>kZ,instanceOf:()=>ba,is:()=>_3,isBase64:()=>KU,isBase64Url:()=>FV,isBetween:()=>Hu,isBetweenBigDecimal:()=>WZ,isBetweenBigInt:()=>oZ,isBetweenCodePoints:()=>iZ,isBetweenDate:()=>eZ,isBetweenLength:()=>iw,isBetweenProperties:()=>dZ,isBetweenSize:()=>fZ,isCapitalized:()=>BV,isEndingWith:()=>UV,isFinite:()=>zV,isGUID:()=>PV,isGreaterThan:()=>HV,isGreaterThanBigDecimal:()=>jZ,isGreaterThanBigInt:()=>tZ,isGreaterThanDate:()=>ZV,isGreaterThanOrEqualTo:()=>GU,isGreaterThanOrEqualToBigDecimal:()=>zZ,isGreaterThanOrEqualToBigInt:()=>VU,isGreaterThanOrEqualToDate:()=>YV,isIncluding:()=>DV,isInt:()=>vx,isInt32:()=>GV,isLessThan:()=>WV,isLessThanBigDecimal:()=>qZ,isLessThanBigInt:()=>rZ,isLessThanDate:()=>QV,isLessThanOrEqualTo:()=>JV,isLessThanOrEqualToBigDecimal:()=>HZ,isLessThanOrEqualToBigInt:()=>nZ,isLessThanOrEqualToDate:()=>XV,isLowercased:()=>$V,isMaxCodePoints:()=>aZ,isMaxLength:()=>XU,isMaxProperties:()=>pZ,isMaxSize:()=>uZ,isMinCodePoints:()=>sZ,isMinLength:()=>ZU,isMinProperties:()=>lZ,isMinSize:()=>cZ,isMultipleOf:()=>KV,isNonEmpty:()=>QU,isPattern:()=>zu,isPropertyNames:()=>mZ,isSchema:()=>Tx,isSchemaError:()=>hU,isStartingWith:()=>NV,isStringBigInt:()=>vV,isStringFinite:()=>kV,isStringSymbol:()=>OV,isTrimmed:()=>JU,isULID:()=>MV,isUUID:()=>RV,isUint32:()=>VV,isUncapitalized:()=>jV,isUnique:()=>uw,isUniqueKey:()=>eD,isUppercased:()=>LV,link:()=>Oe,linkDecoding:()=>ju,make:()=>q,makeFilter:()=>Ue,makeFilterGroup:()=>AV,makeIsBetween:()=>Mp,makeIsGreaterThan:()=>Op,makeIsGreaterThanOrEqualTo:()=>_p,makeIsLessThan:()=>Rp,makeIsLessThanOrEqualTo:()=>Pp,makeIsMultipleOf:()=>qV,middlewareDecoding:()=>UU,middlewareEncoding:()=>DU,mutable:()=>mV,mutableKey:()=>G3,optional:()=>Lu,optionalKey:()=>qi,overrideToCodecIso:()=>N8,overrideToEquivalence:()=>w8,overrideToFormatter:()=>I8,readonlyKey:()=>V3,refine:()=>FU,required:()=>K3,requiredKey:()=>J3,resolveAnnotations:()=>j8,resolveAnnotationsKey:()=>z8,revealBottom:()=>T3,revealCodec:()=>k3,suspend:()=>MU,tag:()=>Hi,tagDefaultOmit:()=>TV,toCodecArrayFromSingle:()=>_8,toCodecIso:()=>O8,toCodecJson:()=>v8,toCodecStringTree:()=>Np,toDifferJsonPatch:()=>U8,toEncoded:()=>$u,toEncoderXml:()=>R8,toEquivalence:()=>C8,toFormatter:()=>T8,toIso:()=>P8,toIsoFocus:()=>F8,toIsoSource:()=>M8,toJsonSchemaDocument:()=>k8,toRepresentation:()=>A8,toStandardJSONSchemaV1:()=>O3,toStandardSchemaV1:()=>v3,toTaggedUnion:()=>WU,toType:()=>Hr,withArrayLengthConstraints:()=>Cx,withConstructorDefault:()=>zU,withDecodingDefault:()=>HU,withDecodingDefaultKey:()=>sw,withDecodingDefaultType:()=>IV,withDecodingDefaultTypeKey:()=>EV});var uR=globalThis.BigInt;var fR=e=>e>uR(Number.MAX_SAFE_INTEGER)||e<uR(Number.MIN_SAFE_INTEGER)?v():O(Number(e));var uE=BigInt(0),OK=BigInt(1),Jo=BigInt(1e3),fa=BigInt(1024),pR=[{symbol:\"B\",factor:OK,names:[\"B\",\"byte\",\"bytes\"]},{symbol:\"kB\",factor:Jo,names:[\"kB\",\"kilobyte\",\"kilobytes\"]},{symbol:\"MB\",factor:Jo**BigInt(2),names:[\"MB\",\"megabyte\",\"megabytes\"]},{symbol:\"GB\",factor:Jo**BigInt(3),names:[\"GB\",\"gigabyte\",\"gigabytes\"]},{symbol:\"TB\",factor:Jo**BigInt(4),names:[\"TB\",\"terabyte\",\"terabytes\"]},{symbol:\"PB\",factor:Jo**BigInt(5),names:[\"PB\",\"petabyte\",\"petabytes\"]},{symbol:\"EB\",factor:Jo**BigInt(6),names:[\"EB\",\"exabyte\",\"exabytes\"]},{symbol:\"ZB\",factor:Jo**BigInt(7),names:[\"ZB\",\"zettabyte\",\"zettabytes\"]},{symbol:\"YB\",factor:Jo**BigInt(8),names:[\"YB\",\"yottabyte\",\"yottabytes\"]},{symbol:\"RB\",factor:Jo**BigInt(9),names:[\"RB\",\"ronnabyte\",\"ronnabytes\"]},{symbol:\"QB\",factor:Jo**BigInt(10),names:[\"QB\",\"quettabyte\",\"quettabytes\"]}],_K=[pR[0],{symbol:\"KiB\",factor:fa,names:[\"KiB\",\"kibibyte\",\"kibibytes\"]},{symbol:\"MiB\",factor:fa**BigInt(2),names:[\"MiB\",\"mebibyte\",\"mebibytes\"]},{symbol:\"GiB\",factor:fa**BigInt(3),names:[\"GiB\",\"gibibyte\",\"gibibytes\"]},{symbol:\"TiB\",factor:fa**BigInt(4),names:[\"TiB\",\"tebibyte\",\"tebibytes\"]},{symbol:\"PiB\",factor:fa**BigInt(5),names:[\"PiB\",\"pebibyte\",\"pebibytes\"]},{symbol:\"EiB\",factor:fa**BigInt(6),names:[\"EiB\",\"exbibyte\",\"exbibytes\"]},{symbol:\"ZiB\",factor:fa**BigInt(7),names:[\"ZiB\",\"zebibyte\",\"zebibytes\"]},{symbol:\"YiB\",factor:fa**BigInt(8),names:[\"YiB\",\"yobibyte\",\"yobibytes\"]}],RK=[...pR,..._K.slice(1)],PK=new Map(RK.flatMap(e=>e.names.map(t=>[t,e])));var fE=e=>e;var ou=e=>{throw new Error(`Invalid ByteSize: ${e}`)},dR=e=>!Number.isSafeInteger(e)||e<0?ou(`expected a non-negative safe integer, received ${e}`):fE(BigInt(e));var mR=e=>{let t=/^\\s*(\\d+)(?:\\.(\\d+))?\\s*([A-Za-z]+)\\s*$/.exec(e);if(t===null)return ou(`unsupported syntax ${JSON.stringify(e)}`);let r=PK.get(t[3]);if(r===void 0)return ou(`unsupported unit ${JSON.stringify(t[3])}`);let n=t[2]??\"\",o=BigInt(10)**BigInt(n.length),s=BigInt(t[1]+n)*r.factor;return s%o!==uE?ou(`${JSON.stringify(e)} does not represent an integral number of bytes`):fE(s/o)},hR=zn(mR),ch=e=>{switch(typeof e){case\"bigint\":return e<uE?ou(`expected a non-negative bigint, received ${e}`):fE(e);case\"number\":return dR(e);case\"string\":return mR(e)}return ou(`unsupported input ${e}`)},lE=zn(ch),xR=e=>typeof e==\"bigint\"?ch(e):dR(e);var gR=e=>typeof e==\"bigint\"&&e>=uE;var uh=e=>e,yR=fR;var bR=\"~effect/Chunk\";function SR(e,t,r,n,o){for(let s=t;s<Math.min(e.length,t+o);s++)r[n+s-t]=e[s];return r}var ER=[],dE=e=>nr((t,r)=>{if(t.length!==r.length)return!1;let n=bi(t),o=bi(r);for(let s=0;s<n.length;s++)if(!e(n[s],o[s]))return!1;return!0}),NK=dE(J),UK={[bR]:{_A:e=>e},toString(){return`Chunk(${F(bi(this))})`},toJSON(){return{_id:\"Chunk\",values:vt(bi(this))}},[Te](){return this.toJSON()},[ae](e){return lh(e)&&NK(this,e)},[se](){return To(bi(this))},[Symbol.iterator](){switch(this.backing._tag){case\"IArray\":return this.backing.array[Symbol.iterator]();case\"IEmpty\":return ER[Symbol.iterator]();default:return bi(this)[Symbol.iterator]()}},pipe(){return Z(this,arguments)}},mE=e=>{let t=Object.create(UK);switch(t.backing=e,e._tag){case\"IEmpty\":{t.length=0,t.depth=0,t.left=t,t.right=t;break}case\"IConcat\":{t.length=e.left.length+e.right.length,t.depth=1+Math.max(e.left.depth,e.right.depth),t.left=e.left,t.right=e.right;break}case\"IArray\":{t.length=e.array.length,t.depth=0,t.left=Cs,t.right=Cs;break}case\"ISingleton\":{t.length=1,t.depth=0,t.left=Cs,t.right=Cs;break}case\"ISlice\":{t.length=e.length,t.depth=0,t.left=Cs,t.right=Cs;break}}return t},lh=e=>k(e,bR),Cs=mE({_tag:\"IEmpty\"}),DK=()=>Cs;var LK=e=>mE({_tag:\"ISingleton\",a:e}),hE=e=>lh(e)?e:BK(Ye(e)),pE=(e,t,r)=>{switch(e.backing._tag){case\"IArray\":{SR(e.backing.array,0,t,r,e.length);break}case\"IConcat\":{pE(e.left,t,r),pE(e.right,t,r+e.left.length);break}case\"ISingleton\":{t[r]=e.backing.a;break}case\"ISlice\":{SR(bi(e.backing.chunk),e.backing.offset,t,r,e.length);break}}};var $K=e=>{switch(e.backing._tag){case\"IEmpty\":return ER;case\"IArray\":return e.backing.array;default:{let t=new Array(e.length);return pE(e,t,0),e.backing={_tag:\"IArray\",array:t},e.left=Cs,e.right=Cs,e.depth=0,t}}},bi=$K;var BK=e=>e.length===0?DK():e.length===1?LK(e[0]):mE({_tag:\"IArray\",array:e});var IR=e=>e.length;var gE=Jc,TR=li,wR=f_,CR=l_,AR=p_,kR=Eb,vR=d_;var OR=zm;var _R=Ib;var yE=h_,RR=x_;var SE=g_;var bE=Tb,EE=El,PR=wb;var MR=Cb,Dl=y_;var FR=Il;var NR=vb;var UR=b_;var IE=_b;var su=e=>jK(typeof e==\"string\"?zK.encode(e):e),Ei=e=>{let t=HK(e),r=t.length;if(r%4!==0)return W(new An({kind:\"Decode\",module:\"Base64\",input:t,message:`Length must be a multiple of 4, but is ${r}`}));let n=t.indexOf(\"=\");if(n!==-1&&(n<r-2||n===r-2&&t[r-1]!==\"=\"))return W(new An({kind:\"Decode\",module:\"Base64\",input:t,message:\"Found a '=' character, but it is not at the end\"}));try{let o=t.endsWith(\"==\")?2:t.endsWith(\"=\")?1:0,s=new Uint8Array(3*(r/4)-o);for(let a=0,i=0;a<r;a+=4,i+=3){let c=ph(t.charCodeAt(a))<<18|ph(t.charCodeAt(a+1))<<12|ph(t.charCodeAt(a+2))<<6|ph(t.charCodeAt(a+3));s[i]=c>>16,s[i+1]=c>>8&255,s[i+2]=c&255}return B(s)}catch(o){return W(new An({kind:\"Decode\",module:\"Base64\",input:t,message:o instanceof Error?o.message:\"Invalid input\"}))}},LR=e=>Tr(Ei(e),t=>qK.decode(t)),jK=e=>{let t=e.length,r=\"\",n;for(n=2;n<t;n+=3)r+=Yn[e[n-2]>>2],r+=Yn[(e[n-2]&3)<<4|e[n-1]>>4],r+=Yn[(e[n-1]&15)<<2|e[n]>>6],r+=Yn[e[n]&63];return n===t+1&&(r+=Yn[e[n-2]>>2],r+=Yn[(e[n-2]&3)<<4],r+=\"==\"),n===t&&(r+=Yn[e[n-2]>>2],r+=Yn[(e[n-2]&3)<<4|e[n-1]>>4],r+=Yn[(e[n-1]&15)<<2],r+=\"=\"),r},zK=new TextEncoder,qK=new TextDecoder,HK=e=>e.replace(/[\\n\\r]/g,\"\"),Yn=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\",Ll=new Uint8Array(123).fill(255);for(let e=0;e<Yn.length;e++)Ll[Yn.charCodeAt(e)]=e;Ll[61]=0;var ph=e=>{if(e>=Ll.length||Ll[e]===255)throw new TypeError(`Invalid character ${String.fromCharCode(e)}`);return Ll[e]};var mh=\"~effect/HashMap\",Qn=5,Bl=1<<Qn,WK=Bl/4,$R=Bl/2,JK=Bl-1,KK=e=>(e=e-(e>>>1&1431655765),e=(e&858993459)+(e>>>2&858993459),(e+(e>>>4)&252645135)*16843009>>>24),$l=(e,t)=>e>>>t&JK,la=(e,t)=>1<<$l(e,t),dh=(e,t)=>KK(e&t-1);function BR(e,t,r,n,o,s){if(t>32)throw new Error(\"HashMap: max depth exceeded\");let a=la(r,t),i=la(o,t);if(a===i){let f=BR(e,t+Qn,r,n,o,s);return new wi(e,a,[f])}let c=a|i,u=a>>>0<i>>>0?[n,s]:[s,n];return new wi(e,c,u)}var GK=Re(\"HashMap\"),jR=(e,t)=>le(H(e),H(t)),zR=e=>{let t=0;for(let r=0;r<e.length;r++){let n=e[r];n&&(t^=n.subtreeHash())}return t},Ii=class{canEdit(t){return this.edit===t}subtreeHash(){let t=this._hash;if(t===void 0){let r=Ma;t=this.computeHash(),r===Ma&&(this._hash=t)}return t}},wE=class extends Ii{_tag=\"EmptyNode\";edit=0;get size(){return 0}get(t,r,n){return v()}has(t,r,n){return!1}set(t,r,n,o,s,a){return a.value=!0,new Ti(t,n,o,s)}remove(t,r,n,o,s){return this}canEdit(t){return!1}computeHash(){return 0}},Ti=class e extends Ii{_tag=\"LeafNode\";edit;hash;key;value;constructor(t,r,n,o){super(),this.edit=t,this.hash=r,this.key=n,this.value=o}get size(){return 1}get(t,r,n){return this.hash===r&&J(this.key,n)?O(this.value):v()}has(t,r,n){return this.hash===r&&J(this.key,n)}set(t,r,n,o,s,a){if(this.canEdit(t)&&(this._hash=void 0),this.hash===n&&J(this.key,o))return J(this.value,s)?this:this.canEdit(t)?(this.value=s,this):new e(t,n,o,s);if(a.value=!0,this.hash===n)return new CE(t,n,[[this.key,this.value],[o,s]]);let i=la(n,r),c=la(this.hash,r);if(i===c)return new wi(t,i,[this.set(t,r+Qn,n,o,s,a)]);let u=i|c,f=i>>>0<c>>>0?[new e(t,n,o,s),this]:[this,new e(t,n,o,s)];return new wi(t,u,f)}remove(t,r,n,o,s){if(this.hash===n&&J(this.key,o)){s.value=!0;return}return this}computeHash(){return jR(this.key,this.value)}},CE=class e extends Ii{_tag=\"CollisionNode\";edit;hash;entries;constructor(t,r,n){super(),this.edit=t,this.hash=r,this.entries=n}get size(){return this.entries.length}get(t,r,n){if(this.hash!==r)return v();for(let[o,s]of this.entries)if(J(o,n))return O(s);return v()}has(t,r,n){if(this.hash!==r)return!1;for(let[o]of this.entries)if(J(o,n))return!0;return!1}set(t,r,n,o,s,a){if(this.canEdit(t)&&(this._hash=void 0),this.hash!==n)return a.value=!0,BR(t,r,this.hash,this,n,new Ti(t,n,o,s));for(let i=0;i<this.entries.length;i++)if(J(this.entries[i][0],o)){if(J(this.entries[i][1],s))return this;if(this.canEdit(t))return this.entries[i]=[o,s],this;let c=[...this.entries];return c[i]=[o,s],new e(t,this.hash,c)}return a.value=!0,this.canEdit(t)?(this.entries.push([o,s]),this):new e(t,this.hash,[...this.entries,[o,s]])}remove(t,r,n,o,s){if(this.canEdit(t)&&(this._hash=void 0),this.hash!==n)return this;let a=this.entries.findIndex(([c])=>J(c,o));if(a===-1)return this;if(s.value=!0,this.entries.length===1)return;if(this.entries.length===2){let c=this.entries[a===0?1:0];return new Ti(t,this.hash,c[0],c[1])}if(this.canEdit(t))return this.entries.splice(a,1),this;let i=[...this.entries];return i.splice(a,1),new e(t,this.hash,i)}computeHash(){let t=0,r=this.entries;for(let n=0;n<r.length;n++)t^=jR(r[n][0],r[n][1]);return t}},wi=class e extends Ii{_tag=\"IndexedNode\";edit;_size;bitmap;children;constructor(t,r,n){super(),this.edit=t,this.bitmap=r,this.children=n}get size(){return this._size===void 0&&(this._size=this.children.reduce((t,r)=>t+r.size,0)),this._size}get(t,r,n){let o=la(r,t);if((this.bitmap&o)===0)return v();let s=dh(this.bitmap,o);return this.children[s].get(t+Qn,r,n)}has(t,r,n){let o=la(r,t);if((this.bitmap&o)===0)return!1;let s=dh(this.bitmap,o);return this.children[s].has(t+Qn,r,n)}set(t,r,n,o,s,a){this.canEdit(t)&&(this._hash=void 0);let i=la(n,r),c=dh(this.bitmap,i);if((this.bitmap&i)!==0){let u=this.children[c],f=u.set(t,r+Qn,n,o,s,a);if(u===f)return this;if(this.canEdit(t))return this.children[c]=f,this;let p=[...this.children];return p[c]=f,new e(t,this.bitmap,p)}else{a.value=!0;let u=new Ti(t,n,o,s),f=this.bitmap|i;if(this.canEdit(t))return this.children.splice(c,0,u),this.bitmap=f,this._size=void 0,this.children.length>$R?this.expand(t,f,this.children):this;let p=[...this.children];return p.splice(c,0,u),p.length>$R?this.expand(t,f,p):new e(t,f,p)}}remove(t,r,n,o,s){this.canEdit(t)&&(this._hash=void 0);let a=la(n,r);if((this.bitmap&a)===0)return this;let i=dh(this.bitmap,a),c=this.children[i],u=c.remove(t,r+Qn,n,o,s);if(!s.value)return this;if(u===void 0){let p=this.bitmap^a;if(p===0)return;if(this.children.length===2){let m=this.children[i===0?1:0];if(m._tag===\"LeafNode\")return m}if(this.canEdit(t))return this.children.splice(i,1),this.bitmap=p,this._size=void 0,this;let d=[...this.children];return d.splice(i,1),new e(t,p,d)}if(c===u)return this;if(this.canEdit(t))return this.children[i]=u,this;let f=[...this.children];return f[i]=u,new e(t,this.bitmap,f)}expand(t,r,n){let o=new globalThis.Array(Bl),s=0;for(let a=0;a<Bl;a++)(r&1<<a)!==0&&(o[a]=n[s++]);return new AE(t,n.length,o)}computeHash(){return zR(this.children)}},AE=class e extends Ii{_tag=\"ArrayNode\";edit;_size;count;children;constructor(t,r,n){super(),this.edit=t,this.count=r,this.children=n}get size(){return this._size===void 0&&(this._size=this.children.reduce((t,r)=>t+(r?.size??0),0)),this._size}get(t,r,n){let o=$l(r,t),s=this.children[o];return s?s.get(t+Qn,r,n):v()}has(t,r,n){let o=$l(r,t),s=this.children[o];return s?s.has(t+Qn,r,n):!1}set(t,r,n,o,s,a){this.canEdit(t)&&(this._hash=void 0);let i=$l(n,r),c=this.children[i];if(c){let u=c.set(t,r+Qn,n,o,s,a);if(c===u)return this;if(this.canEdit(t))return this.children[i]=u,this;let f=[...this.children];return f[i]=u,new e(t,this.count,f)}else{a.value=!0;let u=new Ti(t,n,o,s);if(this.canEdit(t))return this.children[i]=u,this.count++,this._size=void 0,this;let f=[...this.children];return f[i]=u,new e(t,this.count+1,f)}}remove(t,r,n,o,s){this.canEdit(t)&&(this._hash=void 0);let a=$l(n,r),i=this.children[a];if(!i)return this;let c=i.remove(t,r+Qn,n,o,s);if(!s.value)return this;let u=this.count-(c?0:1);if(u<WK)return this.pack(t,a,c);if(i===c)return this;if(this.canEdit(t))return this.children[a]=c,c||(this.count=u),this._size=void 0,this;let f=[...this.children];return f[a]=c,new e(t,u,f)}pack(t,r,n){let o=[],s=0,a=1;for(let i=0;i<this.children.length;i++){let c=i===r?n:this.children[i];c&&(o.push(c),s|=a),a<<=1}return new wi(t,s,o)}computeHash(){return zR(this.children)}},hh=class{stack;project;entries=[];index=0;constructor(t,r){this.stack=[t],this.project=r}next(){for(;;){if(this.index<this.entries.length){let r=this.entries[this.index++];return{done:!1,value:this.project(r[0],r[1])}}if(this.stack.length===0)return{done:!0,value:void 0};let t=this.stack.pop();switch(t._tag){case\"LeafNode\":{let r=t;return{done:!1,value:this.project(r.key,r.value)}}case\"CollisionNode\":{this.entries=t.entries,this.index=0;break}case\"IndexedNode\":case\"ArrayNode\":{let r=t.children;for(let n=r.length-1;n>=0;n--){let o=r[n];o&&this.stack.push(o)}}}}}[Symbol.iterator](){return this}},VK=(e,t)=>[e,t];var jl=class{[mh]=mh;_editable;_edit;_root;_size;constructor(t,r,n,o){this._editable=t,this._edit=r,this._root=n,this._size=o}get size(){return this._size}[Symbol.iterator](){return new hh(this._root,VK)}[ae](t){if(kE(t)){let r=t;if(this.size!==r.size)return!1;for(let[n,o]of this){let s=Bg(t,WR(n));if(fe(s)||!J(o,s.value))return!1}return!0}return!1}[se](){return qt(GK^this._root.subtreeHash())}[Te](){return vt(this)}toString(){return`HashMap(${F(Array.from(this))})`}toJSON(){return{_id:\"HashMap\",values:Array.from(this).map(([t,r])=>[vt(t),vt(r)])}}pipe(){return Z(this,arguments)}},qR=new wE,kE=e=>k(e,mh),vE=()=>new jl(!1,0,qR,0);var HR=e=>{let t=qR,r=0,n={value:!1};for(let[o,s]of e){let a=H(o);n.value=!1,t=t.set(NaN,0,a,o,s,n),n.value&&r++}return new jl(!1,0,t,r)};var WR=l(2,(e,t)=>e._root.get(0,H(t),t));var OE=l(2,(e,t)=>e._root.has(0,H(t),t));var ZK=(e,t,r,n)=>{let o=e,s={value:!1},a=o._editable?o._edit:NaN,i=o._root.set(a,0,r,t,n,s);return o._editable?(o._root=i,s.value&&o._size++,e):o._root===i?e:new jl(!1,o._edit,i,o._size+(s.value?1:0))},_E=l(3,(e,t,r)=>ZK(e,t,H(t),r)),RE=e=>new hh(e._root,R);var JR=e=>e[Symbol.iterator](),xh=e=>e.size;var GR=kE;var PE=HR;var XK=JR,zl=e=>Array.from(XK(e)),VR=xh;var ql=\"~effect/HashSet\",e4=Re(ql),t4={[se](){return qt(le(e4,H(gh(this))))},[ae](e){return FE(e)&&yh(this)===yh(e)&&QR(this,t=>YR(e,t))},[Symbol.iterator](){return RE(gh(this))},toString(){return`HashSet(${F(Array.from(this))})`},toJSON(){return{_id:\"HashSet\",values:vt(Array.from(this))}},[Te](){return this.toJSON()},pipe(){return Z(this,arguments)}},r4=e=>{let t=Object.create(t4);return t[ql]=ql,t.keyMap=e,t},FE=e=>k(e,ql),gh=e=>e.keyMap;var ZR=e=>{let t=vE();for(let r of e)t=_E(t,r,!0);return r4(t)},YR=(e,t)=>OE(gh(e),t);var yh=e=>xh(gh(e));var QR=(e,t)=>{for(let r of e)if(!t(r))return!1;return!0};var NE=ZR,XR=FE;var eP=yh;var DE=\"~effect/http/Cookies\",rP=e=>k(e,DE),LE=\"~effect/http/Cookies/Cookie\",nP=e=>k(e,LE),tP=\"~effect/http/Cookies/CookieError\",$E=class extends Gd{},Ci=class e extends Fr(\"CookiesError\"){static fromReason(t,r){return new e({reason:new $E({_tag:t,cause:r})})}[tP]=tP;get message(){return this.reason._tag}};var o4={[DE]:DE,...dc,toJSON(){return{_id:\"effect/Cookies\",cookies:Ya(this.cookies,e=>e.toJSON())}},pipe(){return Z(this,arguments)}},jE=e=>{let t=Object.create(o4);return t.cookies=e,t},zE=e=>{let t={};for(let r of e)M(t,r.name,r);return jE(t)},oP=e=>{let t=typeof e==\"string\"?[e]:e,r=[];for(let n of t){let o=s4(n.trim());o&&r.push(o)}return zE(r)};function s4(e){let t=e.split(\";\").map(i=>i.trim()).filter(i=>i!==\"\");if(t.length===0)return;let r=t[0].indexOf(\"=\");if(r===-1)return;let n=t[0].slice(0,r);if(!sP.test(n))return;let o=t[0].slice(r+1),s=l4(o);if(t.length===1)return Object.assign(Object.create(BE),{name:n,value:s,valueEncoded:o});let a={};for(let i=1;i<t.length;i++){let c=t[i],u=c.indexOf(\"=\"),f=u===-1?c:c.slice(0,u).trim(),p=u===-1?void 0:c.slice(u+1).trim();switch(f.toLowerCase()){case\"domain\":{if(p===void 0)break;let d=p.trim().replace(/^\\./,\"\");d&&(a.domain=d);break}case\"expires\":{if(p===void 0)break;let d=new Date(p);isNaN(d.getTime())||(a.expires=d);break}case\"max-age\":{if(p===void 0)break;let d=parseInt(p,10);isNaN(d)||(a.maxAge=Iy(d));break}case\"path\":{if(p===void 0)break;p[0]===\"/\"&&(a.path=p);break}case\"priority\":{if(p===void 0)break;switch(p.toLowerCase()){case\"low\":a.priority=\"low\";break;case\"medium\":a.priority=\"medium\";break;case\"high\":a.priority=\"high\";break}break}case\"httponly\":{a.httpOnly=!0;break}case\"secure\":{a.secure=!0;break}case\"partitioned\":{a.partitioned=!0;break}case\"samesite\":{if(p===void 0)break;switch(p.toLowerCase()){case\"lax\":a.sameSite=\"lax\";break;case\"strict\":a.sameSite=\"strict\";break;case\"none\":a.sameSite=\"none\";break}break}}}return Object.assign(Object.create(BE),{name:n,value:s,valueEncoded:o,options:Object.keys(a).length>0?a:void 0})}var a4=/^[\\u0009\\u0020-\\u007e\\u0080-\\u00ff]+$/,sP=/^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/,i4=/^[\\u0009\\u0020-\\u003a\\u003c-\\u007e\\u0080-\\u00ff]+$/,c4=/^[\\u0020-\\u003a\\u003c-\\u007e]+$/,BE={[LE]:LE,...dc,toJSON(){return{_id:\"effect/Cookies/Cookie\",name:this.name,value:this.value,options:this.options}}};function u4(e,t,r){let n=encodeURIComponent(t),o=aP(e,n,r);return o!==void 0?W(o):B(Object.assign(Object.create(BE),{name:e,value:t,valueEncoded:n,options:r}))}function aP(e,t,r){if(!sP.test(e))return Ci.fromReason(\"InvalidCookieName\");if(t&&!a4.test(t))return Ci.fromReason(\"InvalidCookieValue\");if(r?.domain!==void 0&&!i4.test(r.domain))return Ci.fromReason(\"InvalidCookieDomain\");if(r?.path!==void 0&&!c4.test(r.path))return Ci.fromReason(\"InvalidCookiePath\");if(r?.maxAge!==void 0&&!Ks(Ge(r.maxAge)))return Ci.fromReason(\"CookieInfinityMaxAge\")}var iP=(e,t,r)=>$f(u4(e,t,r));function f4(e){let t=aP(e.name,e.valueEncoded,e.options);if(t!==void 0)throw t;let r=e.name+\"=\"+e.valueEncoded;if(e.options===void 0)return r;let n=e.options;if(n.maxAge!==void 0){let o=vA(Ge(n.maxAge));r+=\"; Max-Age=\"+Math.trunc(o)}if(n.domain!==void 0&&(r+=\"; Domain=\"+n.domain),n.path!==void 0&&(r+=\"; Path=\"+n.path),n.priority!==void 0)switch(n.priority){case\"low\":r+=\"; Priority=Low\";break;case\"medium\":r+=\"; Priority=Medium\";break;case\"high\":r+=\"; Priority=High\";break}if(n.expires!==void 0&&(r+=\"; Expires=\"+n.expires.toUTCString()),n.httpOnly&&(r+=\"; HttpOnly\"),n.secure&&(r+=\"; Secure\"),n.partitioned&&(r+=\"; Partitioned\"),n.sameSite!==void 0)switch(n.sameSite){case\"lax\":r+=\"; SameSite=Lax\";break;case\"strict\":r+=\"; SameSite=Strict\";break;case\"none\":r+=\"; SameSite=None\";break}return r}var cP=e=>{let t={},r=Object.values(e.cookies);for(let n=0;n<r.length;n++){let o=r[n];M(t,o.name,o.value)}return t},uP=e=>Object.values(e.cookies).map(f4);var l4=e=>{try{return decodeURIComponent(e)}catch{return e}};var Ai=new WeakMap,fP=e=>{if(Ai.has(e))return Ai.get(e);throw new Error(\"Unable to get redacted value\"+(e.label?` with label: \"${e.label}\"`:\"\"))};var lP=\"~effect/Redacted\",qE=e=>k(e,lP),ki=(e,t)=>{let r=Object.create(m4);return t?.label&&(r.label=t.label),Ai.set(r,e),r},m4={[lP]:{_A:e=>e},label:void 0,...rr,toJSON(){return this.toString()},toString(){return`<redacted${br(this.label)?\":\"+this.label:\"\"}>`},[se](){return H(Ai.get(this))},[ae](e){return qE(e)&&J(Ai.get(this),Ai.get(e))}},au=fP;var pP=e=>nr((t,r)=>e(au(t),au(r)));var WE=Symbol.for(\"~effect/http/Headers\"),dP=e=>k(e,WE),JE=Object.defineProperties(Object.create(null),{[WE]:{value:WE},[Na]:{value(e){return x4(this,Fe(e,g4))}},toJSON:{value(){return is(this)}},[ae]:{value(e){return KE(this,e)}},[se]:{value(){return Tf(this)}},toString:{value:dc.toString},[Te]:{value:dc[Te]}});var KE=hA(Ja()),h4=Object.create(JE),mP=e=>{if(e===void 0)return h4;if(Symbol.iterator in e){let r=Object.create(JE);for(let[n,o]of e)r[n.toLowerCase()]=o;return r}let t=Object.create(JE);for(let[r,n]of Object.entries(e))Array.isArray(n)?t[r.toLowerCase()]=n.join(\", \"):n!==void 0&&(t[r.toLowerCase()]=n);return t};var x4=l(2,(e,t)=>{let r={...e},n=o=>{if(typeof o==\"string\"){let s=o.toLowerCase();s in e&&(r[s]=ki(e[s]))}else for(let s in e)s.search(o)!==-1&&(r[s]=ki(e[s]))};if(Array.isArray(t))for(let o=0;o<t.length;o++)n(t[o]);else n(t);return r});var g4=we(\"effect/Headers/CurrentRedactedNames\",{defaultValue:()=>[\"authorization\",\"cookie\",\"set-cookie\",\"x-api-key\",\"AWSAccessKeyId\",\"Signature\",\"sig\",\"X-Goog-Signature\"]});var GE=\"~effect/http/UrlParams\",VE=e=>k(e,GE),S4={...rr,[GE]:GE,[Symbol.iterator](){return this.params[Symbol.iterator]()},toJSON(){return{_id:\"UrlParams\",params:Object.fromEntries(this.params)}},[ae](e){return ZE(this,e)},[se](){return To(this.params.flat())}},Sh=e=>{let t=Object.create(S4);return t.params=e,t},hP=e=>{if(VE(e))return e;let t=xP(e),r=[];for(let n=0;n<t.length;n++)if(Array.isArray(t[n][0])){let[o,s]=t[n];r.push([`${o[0]}[${o.slice(1).join(\"][\")}]`,s])}else r.push(t[n]);return Sh(r)},xP=e=>{let t=typeof e[Symbol.iterator]==\"function\"?Ye(e):Object.entries(e),r=[];for(let[n,o]of t)if(Array.isArray(o))for(let s=0;s<o.length;s++)o[s]!==void 0&&r.push([n,String(o[s])]);else if(o!==null&&typeof o==\"object\"){let s=xP(o);for(let[a,i]of s)r.push([[n,...typeof a==\"string\"?[a]:a],i])}else o!==void 0&&r.push([n,String(o)]);return r},ZE=nr((e,t)=>b4(e.params,t.params)),b4=SA(cA([Ja(),Ja()]));var gP=l(2,(e,t)=>yy(e.params,([r])=>r===t).pipe(Rt(([,r])=>r)));var E4=e=>{let t={};for(let[r,n]of e.params)if(!Object.hasOwn(t,r))M(t,r,n);else{let o=t[r];typeof o==\"string\"?M(t,r,[o,n]):o.push(n)}return t},yP=E4;var YE=\"~effect/Graph\",QE=e=>k(e,YE),SP=e=>e;var T4=(e,t,r)=>(e===\"directed\"?t.source===r.source&&t.target===r.target:t.source===r.source&&t.target===r.target||t.source===r.target&&t.target===r.source)&&J(t.data,r.data),w4=(e,t)=>e===\"directed\"?H(t):qt(le(H(t.data),C4(t.source,t.target))),C4=(e,t)=>le(0,H(e))+le(0,H(t)),A4=Re(\"Graph\"),k4={[YE]:{_N:e=>e,_E:e=>e},[Symbol.iterator](){return this.nodes[Symbol.iterator]()},[Te](){return this.toJSON()},[ae](e){if(k(e,YE)){let t=SP(e);if(this.nodes.size!==t.nodes.size||this.edges.size!==t.edges.size||this.type!==t.type)return!1;for(let[r,n]of this.nodes)if(!t.nodes.has(r)||!J(n,t.nodes.get(r)))return!1;for(let[r,n]of this.edges){let o=t.edges.get(r);if(o===void 0||!T4(this.type,n,o))return!1}return!0}return!1},[se](){let e=A4;e=e^Re(this.type),e=e^It(this.nodes.size),e=e^It(this.edges.size);for(let[t,r]of this.nodes)e^=le(H(t),H(r));for(let[t,r]of this.edges)e^=le(H(t),w4(this.type,r));return qt(e)},toJSON(){return{_id:\"Graph\",nodeCount:this.nodes.size,edgeCount:this.edges.size,type:this.type}},toString(){return`Graph(${this.type}, ${this.nodes.size}, ${this.edges.size})`},pipe(){return Z(this,arguments)}},v4=(e,t)=>{let r=Object.create(k4);return r.type=e,r.mutable=t,r.transforming=!1,r.nodes=new Map,r.edges=new Map,r.adjacency=new Map,r.reverseAdjacency=new Map,r.nextNodeIndex=0,r.nextEdgeIndex=0,r.acyclic=O(!0),r};var Hl=e=>{let t=SP(e);return{type:e.type,nodes:Array.from(t.nodes,([r,n])=>({index:r,data:n})).sort((r,n)=>r.index-n.index),edges:Array.from(t.edges,([r,n])=>({index:r,source:n.source,target:n.target,data:n.data})).sort((r,n)=>r.index-n.index)}},bh=e=>{let t=v4(e.type,!1);for(let r of e.nodes)t.nodes.set(r.index,r.data),t.adjacency.set(r.index,[]),t.reverseAdjacency.set(r.index,[]);for(let r of e.edges)t.edges.set(r.index,{source:r.source,target:r.target,data:r.data}),t.adjacency.get(r.source).push(r.index),t.reverseAdjacency.get(r.target).push(r.index),e.type===\"undirected\"&&(t.adjacency.get(r.target).push(r.index),t.reverseAdjacency.get(r.source).push(r.index));return t.nextNodeIndex=e.nodes.length===0?0:e.nodes[e.nodes.length-1].index+1,t.nextEdgeIndex=e.edges.length===0?0:e.edges[e.edges.length-1].index+1,t.acyclic=v(),t};function As(e){return e.checks?e.checks[e.checks.length-1].annotations:e.annotations}function Eh(e){return t=>As(t)?.[e]}var Lr=\"~structural\",vi=\"~identifier\",Wl=\"~sentinels\",Ih=\"~constructor\",bP=[\"title\",\"description\",\"default\",\"examples\",\"readOnly\",\"writeOnly\",\"format\",\"contentEncoding\",\"contentMediaType\",\"contentSchema\"],iu=Eh(\"identifier\"),XE=Eh(vi),eI=Eh(\"title\");var Jl=Vr(e=>{let t=As(e)?.identifier;return typeof t==\"string\"?t:e.getExpected(Jl)}),EP=new Set([Wl,Lr,\"representation\",\"arbitraryConstraint\",\"toJsonSchema\",\"toCode\",\"toEquivalence\",\"toFormatter\",\"toCodec\",\"toCodecJson\",\"toCodecStringTree\",\"toCodecIso\",\"toCodecArbitrary\"]);var ge=Symbol();var Zt=vr,$r=Zt(ge),qe=Zt(ge),Kl=e=>e===ge?v():O(e),tI=e=>e._tag===\"None\"?$r:Zt(e.value);var Zl=\"~effect/SchemaIssue/Issue\";function nI(e){return k(e,Zl)&&e[Zl]===Zl}function _4(e){return Object.hasOwn(e,\"input\")}var fn=class{[Zl]=Zl;constructor(t,r){r?.reportInput===!0&&t!==ge&&(this.input=t)}},IP=class extends fn{_tag=\"Filter\";filter;issue;constructor(e,t,r,n){super(r,n),this.filter=e,this.issue=t}},TP=class extends fn{_tag=\"Encoding\";ast;issue;constructor(e,t,r,n){super(r,n),this.ast=e,this.issue=t}},ut=class extends fn{_tag=\"Pointer\";path;issue;constructor(e,t){super(),this.path=e,this.issue=t}},ma=class extends fn{_tag=\"MissingKey\";annotations;constructor(e){super(),this.annotations=e}},oI=class extends fn{_tag=\"UnexpectedKey\";ast;constructor(e,t,r){super(t,r),this.ast=e}},wt=class extends fn{_tag=\"Composite\";ast;issues;constructor(e,t,r,n){super(r,n),this.ast=e,this.issues=t}},ft=class extends fn{_tag=\"InvalidType\";ast;constructor(e,t,r){super(t,r),this.ast=e}},de=class extends fn{_tag=\"InvalidValue\";annotations;constructor(e,t,r){super(t,r),this.annotations=e}};function Br(e,t,r,n,o){return new wt(e,[new ut([t],r)],n,o)}var Yl=class extends fn{_tag=\"Forbidden\";annotations;constructor(e,t,r){super(t,r),this.annotations=e}},Ql=class extends fn{_tag=\"AnyOf\";ast;issues;constructor(e,t,r,n){super(r,n),this.ast=e,this.issues=t}},wP=class extends fn{_tag=\"OneOf\";ast;successes;constructor(e,t,r,n){super(r,n),this.ast=e,this.successes=t}};function rI(e,t,r){if(nI(e))return e;if(typeof e==\"string\")return new de({message:e},t,r);let n=typeof e.issue==\"string\"?new de({message:e.issue},t,r):e.issue;return new ut(e.path,n)}function CP(e,t,r){if(e!==void 0)return typeof e==\"boolean\"?e?void 0:new de(void 0,t,r):rI(e,t,r)}function AP(e,t,r,n){return Array.isArray(t)?tt(t)?t.length===1?rI(t[0],r,n):new wt(e,wn(t,o=>rI(o,r,n)),r,n):void 0:CP(t,r,n)}var kP=e=>{let t=uu(e);if(t!==void 0)return t;switch(e._tag){case\"InvalidType\":return da(Jl(e.ast),e);case\"InvalidValue\":{let r=sI(e);if(r!==void 0)return da(r,e);let n=Th(e);return n===void 0?\"Expected a valid value\":`Invalid data ${n}`}case\"MissingKey\":return\"Missing key\";case\"UnexpectedKey\":{let r=Th(e);return r===void 0?\"Expected no excess property\":`Unexpected key with value ${r}`}case\"Forbidden\":return\"Forbidden operation\";case\"OneOf\":{let r=Th(e);return r===void 0?\"Expected exactly one member to match\":`Expected exactly one member to match the input ${r}`}}},vP=e=>uu(e.issue)??uu(e);function OP(e){return t=>({issues:cu(t,[],e?.leafHook??kP,e?.checkHook??vP)})}function Th(e){return _4(e)?F(e.input):void 0}function sI(e){let t=e.annotations?.expected;return typeof t==\"string\"?t:void 0}function da(e,t){let r=Th(t);return r===void 0?`Expected ${e}`:`Expected ${e}, got ${r}`}function cu(e,t,r,n){switch(e._tag){case\"Filter\":{let o=n(e);if(o!==void 0)return[{path:t,message:o}];if(e.issue._tag!==\"InvalidValue\")return cu(e.issue,t,r,n);let s=sI(e.issue);return[{path:t,message:s===void 0?da(aI(e.filter),e):da(s,e.issue)}]}case\"Encoding\":return cu(e.issue,t,r,n);case\"Pointer\":return cu(e.issue,[...t,...e.path],r,n);case\"Composite\":return e.issues.flatMap(o=>cu(o,t,r,n));case\"AnyOf\":return e.issues.length===0?[{path:t,message:uu(e)??da(Jl(e.ast),e)}]:e.issues.flatMap(o=>cu(o,t,r,n));default:return[{path:t,message:r(e)}]}}function aI(e){let t=e.annotations?.expected;if(typeof t==\"string\")return t;switch(e._tag){case\"Filter\":return\"<filter>\";case\"FilterGroup\":return e.checks.map(r=>aI(r)).join(\" & \")}}function R4(){return e=>Vl(e,\"\")}var _P=R4();function Vl(e,t){let r;switch(e._tag){case\"Filter\":{let n=vP(e);if(n!==void 0)r=n;else{if(e.issue._tag!==\"InvalidValue\")return Vl(e.issue,t);let o=sI(e.issue);r=o===void 0?da(aI(e.filter),e):da(o,e.issue)}break}case\"Encoding\":return Vl(e.issue,t);case\"Pointer\":return Vl(e.issue,t+pd(e.path));case\"Composite\":case\"AnyOf\":{if(e._tag===\"Composite\"||e.issues.length>0)return e.issues.map(n=>Vl(n,t)).join(`\n`);r=uu(e)??da(Jl(e.ast),e);break}default:r=kP(e);break}return t?`${r}\n  at ${t}`:r}function uu(e){if(e._tag===\"Pointer\")return;if(e._tag===\"Encoding\")return uu(e.issue);let r=(e._tag===\"Filter\"?e.filter.annotations:\"annotations\"in e?e.annotations:e.ast.annotations)?.[e._tag===\"MissingKey\"?\"messageMissingKey\":e._tag===\"UnexpectedKey\"?\"messageUnexpectedKey\":\"message\"];if(typeof r==\"string\")return r}function Xl(e){let t;for(let r of e.reasons){if(!na(r)||!nI(r.error))return;t??=r.error}return t}function ln(e,t){let r=Xl(e);if(r===void 0)throw new Error(t,{cause:e});return r}var PP=e=>su(e).replace(/=/g,\"\").replace(/\\+/g,\"-\").replace(/\\//g,\"_\"),iI=e=>{let t=e.replace(/[\\n\\r]/g,\"\"),r=t.length;if(r%4===1)return W(new An({module:\"Base64Url\",kind:\"Decode\",input:t,message:`Length should be a multiple of 4, but is ${r}`}));if(!/^[-_A-Z0-9]*?={0,2}$/i.test(t))return W(new An({module:\"Base64Url\",kind:\"Decode\",input:t,message:\"Invalid input\"}));let n=r%4===2?`${t}==`:r%4===3?`${t}=`:t;return n=n.replace(/-/g,\"+\").replace(/_/g,\"/\"),Ei(n)},MP=e=>Tr(iI(e),t=>P4.decode(t)),P4=new TextDecoder;var FP=(e,t,r)=>{switch(e._tag){case\"Passthrough\":return g(t);case\"Transform\":return g(Rt(t,e.transform));case\"TransformOptional\":return g(e.transform(t));case\"TransformEffect\":return fe(t)?aa:Dr(e.transform(t.value,r),O);case\"TransformOptionalEffect\":return e.transform(t,r)}};var ep=e=>Object.assign(Object.create(Lg),e),wh=(e,t)=>cI((r,n)=>st(FP(e,r,n),o=>FP(t,o,n))),Ch=l(2,(e,t)=>{if(e._tag===\"Passthrough\")return t;if(t._tag===\"Passthrough\")return e;switch(e._tag){case\"Transform\":switch(t._tag){case\"Transform\":return oe(r=>t.transform(e.transform(r)));case\"TransformOptional\":return Oi(r=>t.transform(Rt(r,e.transform)));case\"TransformEffect\":return gt((r,n)=>t.transform(e.transform(r),n));case\"TransformOptionalEffect\":return wh(e,t)}case\"TransformOptional\":switch(t._tag){case\"Transform\":return Oi(r=>Rt(e.transform(r),t.transform));case\"TransformOptional\":return Oi(r=>t.transform(e.transform(r)));case\"TransformEffect\":case\"TransformOptionalEffect\":return wh(e,t)}case\"TransformEffect\":switch(t._tag){case\"Transform\":return gt((r,n)=>Dr(e.transform(r,n),t.transform));case\"TransformOptional\":case\"TransformOptionalEffect\":return wh(e,t);case\"TransformEffect\":return gt((r,n)=>st(e.transform(r,n),o=>t.transform(o,n)))}case\"TransformOptionalEffect\":return wh(e,t)}});function F4(e){return cI((t,r)=>P(e(t,r)))}function Ah(e){return F4((t,r)=>{let n={message:e(t)};return be(t)?new Yl(n,t.value,r):new Yl(n)})}var NP=Ah(()=>\"Encoding is not supported\"),N4=ep({_tag:\"Passthrough\"});function jr(){return N4}function oe(e){return ep({_tag:\"Transform\",transform:e})}function gt(e){return ep({_tag:\"TransformEffect\",transform:e})}function Oi(e){return ep({_tag:\"TransformOptional\",transform:e})}function cI(e){return ep({_tag:\"TransformOptionalEffect\",transform:e})}function uI(){return Oi(()=>v())}function fI(e){return cI(t=>{let r=Va(t,Io);return be(r)?g(r):Dr(e,O)})}function _i(){return oe(globalThis.String)}function kh(){return oe(globalThis.Number)}function UP(){return oe(globalThis.BigInt)}function lI(){return oe(e=>new globalThis.Date(e))}function DP(){return oe(C_)}function LP(e){return gt((t,r)=>Qc({try:()=>JSON.parse(t,e?.reviver),catch:()=>new de({expected:\"a valid JSON string\"},t,r)}))}function $P(e){return gt((t,r)=>Qc({try:()=>{let n=JSON.stringify(t,e?.replacer,e?.space);if(n===void 0)throw new TypeError(\"Value cannot be represented as JSON\");return n},catch:()=>new de({expected:\"a JSON-serializable value\"},t,r)}))}function BP(e){let t=e?.separator??\",\",r=e?.keyValueSeparator??\"=\";return oe(n=>n.split(t).reduce((o,s)=>{if(r===\"\"){let[u,f]=s.split(\"\");return u&&f&&M(o,u,f),o}let a=s.indexOf(r);if(a<=0)return o;let i=s.slice(0,a),c=s.slice(a+r.length);return c&&M(o,i,c),o},{}))}function jP(e){let t=e?.separator??\",\",r=e?.keyValueSeparator??\"=\";return oe(n=>Object.entries(n).map(([o,s])=>`${o}${r}${s}`).join(t))}function zP(e){let t=e?.separator??\",\";return oe(r=>r===\"\"?[]:r.split(t))}function pI(){return oe(su)}function vh(){return oe(PP)}function Oh(){return oe(zA)}function qP(){return gt((e,t)=>Ul(Pl(Ei(e)),()=>new de({expected:\"a valid Base64 string\"},e,t)))}function HP(){return gt((e,t)=>wr(LR(e),{onFailure:()=>P(new de({expected:\"a valid Base64 string\"},e,t)),onSuccess:g}))}function WP(){return gt((e,t)=>wr(iI(e),{onFailure:()=>P(new de({expected:\"a valid Base64Url string\"},e,t)),onSuccess:g}))}function JP(){return gt((e,t)=>wr(MP(e),{onFailure:()=>P(new de({expected:\"a valid Base64Url string\"},e,t)),onSuccess:g}))}function KP(){return gt((e,t)=>wr(Oy(e),{onFailure:()=>P(new de({expected:\"a valid hexadecimal string\"},e,t)),onSuccess:g}))}function GP(){return gt((e,t)=>wr(qA(e),{onFailure:()=>P(new de({expected:\"a valid hexadecimal string\"},e,t)),onSuccess:g}))}function VP(){return oe(encodeURIComponent)}function ZP(){return gt((e,t)=>{try{return g(globalThis.decodeURIComponent(e))}catch{return P(new de({expected:\"a valid URI component\"},e,t))}})}function YP(){return oe(e=>tM(Array.from(e.entries())))}var U4=rM(e=>typeof e==\"string\"||typeof Blob<\"u\"&&e instanceof Blob);function QP(){return oe(e=>{let t=new FormData;return typeof e==\"object\"&&e!==null&&U4(e).forEach(([n,o])=>{t.append(n,o)}),t})}function XP(){return oe(e=>tM(Array.from(e.entries())))}var D4=rM(br);function eM(){return oe(e=>typeof e==\"object\"&&e!==null?new URLSearchParams(D4(e)):new URLSearchParams)}function L4(e){if(e===\"\")return[\"\"];let t=e.replace(/\\[(.*?)\\]/g,\".$1\"),r=t.split(\".\"),n=t.startsWith(\".\")?1:0;return r.slice(n).map(o=>Cc(o)?globalThis.Number(o):o)}function tM(e){let t={},r=new WeakSet,n=new WeakSet;function o(s,a,i){let c=Object.hasOwn(s,a)?s[a]:void 0;if(r.has(c)&&Array.isArray(c)===i)return c;let u=i?[]:{};return r.add(u),M(s,a,u),u}return e.forEach(([s,a])=>{let i=L4(s),c=t;i.forEach((u,f)=>{let p=f===i.length-1;if(Array.isArray(c)&&u===\"\")if(p)c.push(a);else{let d=i[f+1],m=typeof d==\"number\"||d===\"\",x=c.length;c=o(c,x,m)}else if(p){let d=Object.hasOwn(c,u);if(d&&Array.isArray(c[u])&&(r.has(c[u])||n.has(c[u])))c[u].push(a);else if(d){let m=[c[u],a];n.add(m),M(c,u,m)}else M(c,u,a)}else{let d=i[f+1];c=o(c,u,typeof d==\"number\"||d===\"\")}})}),t}function rM(e){return t=>{let r=[];function n(o,s){if(e(s))r.push([o,s]);else if(Array.isArray(s))s.every(e)?s.forEach(i=>{r.push([o,i])}):s.forEach((i,c)=>{n(`${o}[${c}]`,i)});else if(typeof s==\"object\"&&s!==null)for(let[a,i]of Object.entries(s))n(`${o}[${a}]`,i)}for(let[o,s]of Object.entries(t))n(o,s);return r}}var _h=class extends $s{_tag=\"Middleware\";decode;encode;constructor(e,t){super(),this.decode=e,this.encode=t}flip(){return new _h(this.encode,this.decode)}},tp=\"~effect/SchemaTransformation/Transformation\",ve=class extends $s{[tp]=tp;_tag=\"Transformation\";decode;encode;constructor(e,t){super(),this.decode=e,this.encode=t}flip(){return new ve(this.encode,this.decode)}};function $4(e){return k(e,tp)&&e[tp]===tp}var Rh=e=>$4(e)?e:new ve(e.decode,e.encode);function Yt(e){return new ve(gt(e.decode),gt(e.encode))}function Pe(e){return new ve(oe(e.decode),oe(e.encode))}function Ph(e){return new ve(Oi(e.decode),Oi(e.encode))}function nM(){return new ve(DP(),jr())}function oM(e){return new ve(BP(e),jP(e))}var B4=new ve(jr(),jr());function lu(){return B4}var pu=new ve(kh(),_i()),Mh=new ve(UP(),_i()),dI=new ve(lI(),oe(Yg)),sM=new ve(lI(),oe(e=>e.getTime()));var mI=Yt({decode:(e,t)=>Wt(hR(e),{onNone:()=>P(new de({expected:\"a valid ByteSize string\"},e,t)),onSome:g}),encode:e=>g(`${e} ${e===BigInt(1)?\"byte\":\"bytes\"}`)}),aM=Yt({decode:(e,t)=>Wt(lE(e),{onNone:()=>P(new de({expected:\"a non-negative bigint byte count\"},e,t)),onSome:g}),encode:e=>g(uh(e))}),iM=Yt({decode:(e,t)=>Wt(lE(e),{onNone:()=>P(new de({expected:\"a non-negative safe-integer byte count\"},e,t)),onSome:g}),encode:(e,t)=>Wt(yR(e),{onNone:()=>P(new de({expected:\"a ByteSize representable as a safe integer\"},e,t)),onSome:g})}),j4=e=>fr(e)&&typeof e.message==\"string\",cM=e=>{let r=Object.hasOwn(e,\"cause\")?new Error(e.message,{cause:fM(e.cause)}):new Error(e.message);return typeof e.name==\"string\"&&e.name!==\"Error\"&&(r.name=e.name),typeof e.stack==\"string\"&&(r.stack=e.stack),r},z4=e=>{try{let t=Ua(e);return t===void 0?F(e):JSON.parse(t)}catch{return F(e)}},q4=(e,t,r)=>{let n={name:e.name,message:typeof e.message==\"string\"?e.message:\"\"};return t?.includeStack&&typeof e.stack==\"string\"&&(n.stack=e.stack),!t?.excludeCause&&e.cause!==void 0&&(n.cause=r(e.cause)),n},uM=e=>{let t=new WeakSet,r=n=>{if(cC(n)){if(t.has(n))return\"[Circular]\";t.add(n);let o=q4(n,e,r);return t.delete(n),o}return z4(n)};return r},fM=e=>j4(e)?cM(e):e,lM=e=>Pe({decode:cM,encode:t=>uM(e)(t)}),pM=e=>Pe({decode:fM,encode:uM(e)});function dM(){return Pe({decode:cy,encode:Rd})}function mM(){return Pe({decode:iy,encode:qs})}function hM(e){return Pe({decode:Nf,encode:e?.onNoneEncoding===null?Rd:qs})}function xM(){return Ph({decode:O,encode:Ga})}function gM(){return Ph({decode:e=>e.pipe(Va(Io),O),encode:Ga})}var hI=Yt({decode:(e,t)=>URL.canParse(e)?g(new URL(e)):P(new de({expected:\"a valid URL string\"},e,t)),encode:e=>g(e.href)});var xI=new ve(qP(),pI()),yM=new ve(HP(),pI()),SM=new ve(JP(),vh()),bM=new ve(GP(),Oh()),EM=new ve(ZP(),VP());function IM(e){return new ve(LP(e??{}),$P(e))}var TM=new ve(YP(),QP()),wM=new ve(XP(),eM());function xa(e){return t=>t._tag===e}var gu=xa(\"Declaration\");var H4=xa(\"Never\");var mu=xa(\"Literal\"),yI=xa(\"UniqueSymbol\");var AI=xa(\"Arrays\"),W4=xa(\"Objects\"),MM=xa(\"Union\"),FM=xa(\"Suspend\"),at=class{to;transformation;constructor(e,t){this.to=e,this.transformation=t}},Go={},Ko=class{isOptional;isMutable;constructorDefault;annotations;constructor(e,t,r=void 0,n=void 0){this.isOptional=e,this.isMutable=t,this.constructorDefault=r,this.annotations=n}},CM=\"~effect/Schema\",lt=class{[CM]=CM;annotations;checks;encoding;context;constructor(t=void 0,r=void 0,n=void 0,o=void 0){this.annotations=t,this.checks=r,this.encoding=n,this.context=o}toString(){return`<${this._tag}>`}},yu=class extends lt{_tag=\"Declaration\";typeParameters;run;encodingChecks;encodingRun;constructor(e,t,r,n,o,s,a,i){super(r,n,o,s),this.typeParameters=e,this.run=t,this.encodingChecks=a,this.encodingRun=i}getParser(){let e;return(t,r)=>t===ge?$r:(e??=this.run(this.typeParameters))(t,this,r)}_rebuild(e,t,r,n,o){let s=Pi(this.typeParameters,e);return s===this.typeParameters&&t===this.checks&&r===this.encodingChecks&&n===this.run&&o===this.encodingRun?this:new yu(s,n,this.annotations,t,void 0,this.context,r,o)}recur(e){return this._rebuild(e,this.checks,this.encodingChecks,this.run,this.encodingRun)}flip(e){return this._rebuild(e,this.encodingChecks,this.checks,this.encodingRun??this.run,this.run)}getExpected(){let e=this.annotations?.expected;return typeof e==\"string\"?e:\"<Declaration>\"}},J4=class extends lt{_tag=\"Null\";getParser(){return qh(this,null)}getExpected(){return\"null\"}},kI=new J4;var K4=class extends lt{_tag=\"Undefined\";getParser(){return qh(this,void 0)}toCodecJson(){return We(this,[NM])}getExpected(){return\"undefined\"}},NM=new at(kI,new ve(oe(()=>{}),oe(()=>null))),vI=new K4;var G4=class extends lt{_tag=\"Void\";getParser(){let e=Zt(void 0);return t=>t===ge?$r:e}toCodecJson(){return We(this,[NM])}getExpected(){return\"void\"}},UM=new G4;var V4=class extends lt{_tag=\"Never\";getParser(){return ro(this,iC)}getExpected(){return\"never\"}},OI=new V4,Z4=class extends lt{_tag=\"Any\";getParser(){return ro(this,zg)}getExpected(){return\"any\"}},DM=new Z4,Y4=class extends lt{_tag=\"Unknown\";getParser(){return ro(this,zg)}getExpected(){return\"unknown\"}},eo=new Y4,Q4=class extends lt{_tag=\"ObjectKeyword\";getParser(){return ro(this,If)}getExpected(){return\"object | array | function\"}},LM=new Q4,$M=class extends lt{_tag=\"Enum\";enums;constructor(e,t,r,n,o){super(t,r,n,o);for(let[,s]of e)if(typeof s==\"number\"&&!globalThis.Number.isFinite(s))throw new Error(`A numeric enum value must be finite, got ${F(s)}`);this.enums=e}getParser(){let e=new Set(this.enums.map(([,t])=>t));return ro(this,t=>e.has(t))}toCodecStringTree(){if(this.enums.some(([e,t])=>typeof t==\"number\")){let e=Object.fromEntries(this.enums.map(([t,r])=>[globalThis.String(r),r]));return We(this,[new at(new zr(Object.keys(e).map(t=>new dn(t))),new ve(oe(t=>e[t]),_i()))])}return this}getExpected(){return this.enums.map(([e,t])=>JSON.stringify(t)).join(\" | \")}};function gI(e){return typeof e==\"number\"?`parts[${e}]`:e}function SI(e,t,r){if(r.has(e))return!0;if(e.encoding)throw new Error(`TemplateLiteral parts cannot have an encoding at ${gI(t)}`);let n;switch(e._tag){case\"String\":case\"Number\":case\"BigInt\":n=!0;break;case\"Literal\":n=!e.checks;break;case\"TemplateLiteral\":{let o=gI(t);n=!e.checks&&e.parts.every((s,a)=>SI(s,`${o}.parts[${a}]`,r));break}case\"Union\":{let o=gI(t);n=!e.checks&&e.types.every((s,a)=>SI(s,`${o}.types[${a}]`,r));break}default:return!1}return n&&r.add(e),n}var _I=class extends lt{_tag=\"TemplateLiteral\";parts;encodedParts;literals;suffixLengths;constructor(e,t,r,n,o){super(t,r,n,o);let s=[],a=[],i=new Set;for(let u=0;u<e.length;u++){let f=e[u];if(!SI(f,u,i))throw new Error(`Invalid TemplateLiteral part ${f._tag}`);s.push(f),a.push(f._tag===\"Literal\"?globalThis.String(f.literal):void 0)}let c=new Array(s.length+1);c[s.length]=0;for(let u=s.length-1;u>=0;u--)c[u]=c[u+1]+(a[u]?.length??0);this.parts=e,this.encodedParts=s,this.literals=a,this.suffixLengths=c}getParser(e){let t=new Pn(!1,this.parts.map(WI),[]),r=e(ga(pn,t,jM(this)));return(n,o)=>{if(n===ge)return $r;let s=r(n,o);return s._tag===\"Success\"?qe:Vt(s,{onSuccess:()=>n,onFailure:a=>new wt(this,[a],n,o)})}}getExpected(){return\"string\"}matchPart(e,t){return dF(this,e,t)===void 0?void 0:e}};function BM(e){let t=Vr(o=>{if(o._tag!==\"Union\")return o;let s=Pi(o.types,t);return(o.options?.mode??\"anyOf\")===\"anyOf\"&&s===o.types?o:new zr(s,o.options===void 0?void 0:{...o.options,mode:\"anyOf\"},o.annotations,o.checks,void 0,o.context)}),r=new _I(e.map(o=>t(hn(o)))),n=new Pn(!1,e.map(WI),[]);return ga(r,n,jM(r))}function jM(e){return new ve(gt((t,r)=>{let n=dF(e,t,r);return n?g(n):P(new de({expected:\"a string matching template literal parts\"},t,r))}),oe(t=>t.join(\"\")))}var zM=class extends lt{_tag=\"UniqueSymbol\";symbol;constructor(e,t,r,n,o){super(t,r,n,o),this.symbol=e}getParser(){return qh(this,this.symbol)}toCodecStringTree(){let e=globalThis.Symbol.keyFor(this.symbol);return We(this,[new at(e===void 0?OI:new dn(globalThis.String(this.symbol)),xF.transformation)])}getExpected(){return globalThis.String(this.symbol)}},dn=class extends lt{_tag=\"Literal\";literal;constructor(e,t,r,n,o){if(super(t,r,n,o),typeof e==\"number\"&&!globalThis.Number.isFinite(e))throw new Error(`A numeric literal must be finite, got ${F(e)}`);this.literal=e}getParser(){return qh(this,this.literal)}matchPart(e,t){return e===globalThis.String(this.literal)?this.literal:void 0}toCodecJson(){return typeof this.literal==\"bigint\"?AM(this):this}toCodecStringTree(){return typeof this.literal==\"string\"?this:AM(this)}getExpected(){return typeof this.literal==\"string\"?JSON.stringify(this.literal):globalThis.String(this.literal)}};function AM(e){let t=globalThis.String(e.literal);return We(e,[new at(new dn(t),new ve(oe(()=>e.literal),oe(()=>t)))])}var X4=class extends lt{_tag=\"String\";getParser(){return ro(this,br)}matchPart(e,t){let r=this.checks;return r&&!t.disableChecks&&no(r,e,void 0,this,t)?void 0:e}getExpected(){return\"string\"}},pn=new X4,e6=class extends lt{_tag=\"Number\";getParser(){return ro(this,Ef)}matchKey(e,t){return this._match(y6,e,t)}matchPart(e,t){return this._match(TI,e,t)}_match(e,t,r){if(!e.test(t))return;let n=globalThis.Number(t);return r.disableChecks||!this.checks?n:no(this.checks,n,void 0,this,r)?void 0:n}toCodecJson(){return this.checks&&(bI(this.checks,\"effect/schema/isFinite\")||bI(this.checks,\"effect/schema/isInt\"))?this:We(this,[l6])}toCodecStringTree(){return this.toCodecJson()===this?We(this,[S6]):We(this,[b6])}getExpected(){return\"number\"}};function bI(e,t){return e.some(r=>r.annotations?.representation?.id===t||r._tag===\"FilterGroup\"&&bI(r.checks,t))}var RI=new e6,t6=class extends lt{_tag=\"Boolean\";getParser(){return ro(this,ad)}getExpected(){return\"boolean\"}},qM=new t6,r6=class extends lt{_tag=\"Symbol\";getParser(){return ro(this,jg)}matchKey(e,t){return t.disableChecks||!this.checks?e:no(this.checks,e,void 0,this,t)?void 0:e}toCodecStringTree(){return We(this,[xF])}getExpected(){return\"symbol\"}},HM=new r6,n6=class extends lt{_tag=\"BigInt\";getParser(){return ro(this,sC)}matchPart(e,t){if(!wI.test(e))return;let r=globalThis.BigInt(e);return t.disableChecks||!this.checks?r:no(this.checks,r,void 0,this,t)?void 0:r}toCodecStringTree(){return We(this,[I6])}getExpected(){return\"bigint\"}},WM=new n6,Pn=class extends lt{_tag=\"Arrays\";isMutable;elements;rest;encodingChecks;constructor(e,t,r,n,o,s,a,i){super(n,o,s,a),this.isMutable=e,this.elements=t,this.rest=r,this.encodingChecks=i;let c=!1;for(let u=0;u<t.length;u++)if(Qt(t[u]))c=!0;else if(c)throw new Error(\"A required element cannot follow an optional element. ts(1257)\");if(c&&r.length>1)throw new Error(\"A required element cannot follow an optional element. ts(1257)\");for(let u=1;u<r.length;u++)if(Qt(r[u]))throw new Error(\"An optional element cannot follow a rest element. ts(1266)\")}getParser(e,t=e){let r=this,n,o,s=r.elements.length,a=Math.max(0,r.rest.length-1);function i(f,p){return p<s?n[p]:p>=f?o[p-f+1]:o[0]}let c=f=>{let{input:p,len:d,options:m}=f;if(r.rest.length===0&&d>s)for(let x=s;x<d;x++){let y=new oI(r,p[x],m),S=new ut([x],y);if(m.errors===\"all\")f.issues?f.issues.push(S):f.issues=[S];else return P(new wt(r,[S],p,m))}return f.issues?P(new wt(r,f.issues,p,m)):Zt(f.output)},u=(f,p)=>{let d=f.length,m={ast:r,getParser:i,input:f,len:d,tailThreshold:Math.max(s,d-a),output:new globalThis.Array(d),issues:void 0,options:p},x=r.rest.length===0?s:Math.max(d,s+a),y=p.concurrency===void 0?1:pl(p.concurrency),S=y===1?s6(m,f,0,x):a6(m,f,{concurrency:y,end:x});if(!S)return c(m);if(Ne(S))return st(S,()=>c(m));let w=!0;return $(()=>w?(w=!1,I(S,()=>c(m))):u(f,p))};return(f,p)=>{if(f===ge)return $r;try{return Array.isArray(f)?(n||(n=r.elements.map(d=>({ast:d,parser:t(d)})),o=r.rest.map(d=>({ast:d,parser:t(d)}))),u(f,p)):P(new ft(r,f,p))}catch(d){return an(d)}}}_rebuild(e,t,r){let n=Pi(this.elements,e),o=Pi(this.rest,e);return n===this.elements&&o===this.rest&&t===this.checks&&r===this.encodingChecks?this:new Pn(this.isMutable,n,o,this.annotations,t,void 0,this.context,r)}recur(e){return this._rebuild(e,this.checks,this.encodingChecks)}flip(e){return this._rebuild(e,this.encodingChecks,this.checks)}getExpected(){return\"array\"}};function o6(e,t,r,n){if(r._tag===\"Failure\")return Nh(e,e.ast,n,r);let o=r===qe?t:r[ue];if(o!==ge)e.output[n]=o;else{let s=e.getParser(e.tailThreshold,n);if(Qt(s.ast))return;let a=new ut([n],new ma(s.ast.context?.annotations));if(e.options.errors===\"all\")e.issues?e.issues.push(a):e.issues=[a];else return bs(new wt(e.ast,[a],e.input,e.options))}}var JM={onItem(e,t,r){let n=r<e.len?t:ge;return e.getParser(e.tailThreshold,r).parser(n,e.options)},step:o6},s6=km()(JM),a6=vm()(JM),Nh=(e,t,r,n)=>{if(n.cause.reasons.length===0)return n;let o=Xl(n.cause);if(o===void 0)return sn(Ss(n.cause,a=>new wt(t,[new ut([r],a)],e.input,e.options)));let s=new ut([r],o);if(e.options.errors===\"all\")e.issues?e.issues.push(s):e.issues=[s];else return bs(new wt(t,[s],e.input,e.options))},Dh=\"[+-]?\\\\d*\\\\.?\\\\d+(?:[Ee][+-]?\\\\d+)?\";function ha(e,t,r=Go){let n,o;function s(a){switch(a._tag){case\"String\":case\"TemplateLiteral\":return(n??=Object.keys(e)).filter(i=>a.matchPart(i,r)!==void 0);case\"Number\":return(n??=Object.keys(e)).filter(i=>a.matchKey(i,r)!==void 0);case\"Symbol\":return(o??=Object.getOwnPropertySymbols(e)).filter(i=>Object.prototype.propertyIsEnumerable.call(e,i)&&a.matchKey(i,r)!==void 0);case\"Union\":return[...new Set(a.types.flatMap(s))];default:return[]}}return s(HI(hn(t)))}var PI=class{name;type;constructor(e,t){this.name=e,this.type=t}};function KM(e){switch(e._tag){case\"String\":case\"Number\":case\"Symbol\":case\"TemplateLiteral\":return!0;case\"Union\":return e.types.every(KM);default:return!1}}function GM(e){let t=bu(e);switch(t._tag){case\"String\":case\"Number\":case\"Symbol\":case\"TemplateLiteral\":return!0;case\"Union\":return t.types.every(GM);default:return!1}}function i6(e){return KM(e)&&GM(e)}var MI=class{parameter;type;constructor(e,t){if(!i6(e))throw new Error(`Invalid index signature parameter ${e._tag}`);if(this.parameter=e,this.type=t,Qt(t)&&!pF(t))throw new Error(\"Cannot use `Schema.optionalKey` with index signatures, use `Schema.optional` instead.\")}},np=class extends lt{_tag=\"Objects\";propertySignatures;indexSignatures;encodingChecks;constructor(e,t,r,n,o,s,a){super(r,n,o,s),this.propertySignatures=e,this.indexSignatures=t,this.encodingChecks=a}getParser(e,t=e){let r=this,n=r.propertySignatures.length,o=r.indexSignatures.length;if(!n&&!o)return ro(r,cd);let s,a,i=()=>(s||(s=r.propertySignatures.map(p=>({parser:t(p.type),name:p.name,type:p.type})),a=o?r.indexSignatures.map(p=>({is:p,parserKey:e(HI(p.parameter)),parserValue:t(p.type)})):void 0),s),c=()=>{let p=new Set(r.propertySignatures.map(S=>typeof S.name==\"number\"?globalThis.String(S.name):S.name)),d=(S,w,E,U,_)=>{if(_._tag===\"Failure\")return Nh(S,r,w,_)??xt;let h=_===qe?U:_[ue];if(E!==ge&&h!==ge){if(n&&(p.has(w)||p.has(typeof E==\"number\"?globalThis.String(E):E)))return xt;M(S.out,E,h)}return xt},m=(S,w,E,U)=>{if(!U){let T=E.parserKey(w,S.options);if(!Ne(T))return I(vn(T),C=>m(S,w,E,C));U=T}if(U._tag===\"Failure\")return Nh(S,r,w,U)??xt;let _=U===qe?w:U[ue],h=S.input[w],b=E.parserValue(h,S.options);return Ne(b)?d(S,w,_,h,b):I(vn(b),T=>d(S,w,_,h,T))},x=(S,w,E)=>{let U=S.input[w],_=E.parserValue(U,S.options);return Ne(_)?d(S,w,w,U,_):I(vn(_),h=>d(S,w,w,U,h))},y=o?vm()({onItem:(S,[w,E])=>E.is.parameter===pn?x(S,w,E):m(S,w,E),step:(S,w,E)=>E._tag===\"Failure\"?E:void 0}):void 0;return oE(function*(S,w){if(S===ge)return ge;if(!(typeof S==\"object\"&&S!==null&&!Array.isArray(S)))return yield*P(new ft(r,S,w));i();let E=S,U={},_={ast:r,input:E,out:U,issues:void 0,options:w},h=w.errors===\"all\",b=w.onExcessProperty===\"error\",T=w.concurrency===void 0?1:pl(w.concurrency),C=o&&b?r.indexSignatures.map(L=>ha(E,L.parameter,w)):void 0;if(b){let L=C?new Set(p):p;if(C)for(let ye of C)for(let _e of ye)L.add(_e);let ee=Reflect.ownKeys(E);for(let ye=0;ye<ee.length;ye++){let _e=ee[ye];if(!L.has(_e)&&Object.prototype.propertyIsEnumerable.call(E,_e)){let Et=new oI(r,E[_e],w),Ze=new ut([_e],Et);if(h){_.issues?_.issues.push(Ze):_.issues=[Ze];continue}else return yield*P(new wt(r,[Ze],S,w))}}}if(n){let L=T===1?kM(_,s):c6(_,s,{concurrency:T});L&&(yield*L)}if(o&&T===1)for(let L=0;L<o;L++){let ee=a[L],ye=ee.is.parameter===pn?x:m,_e=C?.[L]??(ee.is.parameter===pn?Object.keys(E):ha(E,ee.is.parameter,w));for(let Et=0;Et<_e.length;Et++){let Ze=ye(_,_e[Et],ee);if(!Ne(Ze))yield*Ze;else if(Ze._tag===\"Failure\")return yield*Ze}}else if(y){let L=Pt();for(let ye=0;ye<o;ye++){let _e=a[ye],Et=C?.[ye]??(_e.is.parameter===pn?Object.keys(E):ha(E,_e.is.parameter,w));for(let Ze=0;Ze<Et.length;Ze++)L.push([Et[Ze],_e])}let ee=y(_,L,{concurrency:T});ee&&(yield*ee)}return _.issues?yield*P(new wt(r,_.issues,S,w)):U})};if(o)return c();let u,f=(p,d,m)=>{let x=s[d];return I(vn(m),y=>{let S=EI(p,x,y);if(S)return S;let w=()=>Zt(p.out),E=kM(p,s.slice(d+1));return E?st(E,w):w()})};return(p,d)=>{if(p===ge)return $r;if(d.errors===\"all\"||d.onExcessProperty!==void 0||d.concurrency!==void 0&&pl(d.concurrency)!==1)return(u??=c())(p,d);if(!(typeof p==\"object\"&&p!==null&&!Array.isArray(p)))return P(new ft(r,p,d));let m=i(),x=p,y={},S={ast:r,input:x,out:y,issues:void 0,options:d};try{for(let w=0;w<m.length;w++){let E=m[w],U=E.name,_=du(x,U),h=_?x[U]:ge,b=E.parser(h,d);if(!Ne(b))return f(S,w,b);if(b===qe){_&&M(y,U,h);continue}let T=EI(S,E,b);if(T)return T}}catch(w){return an(w)}return Zt(y)}}_rebuild(e,t,r,n){let o=Pi(this.propertySignatures,a=>{let i=e(a.type);return i===a.type?a:new PI(a.name,i)}),s=Pi(this.indexSignatures,a=>{let i=t(a.parameter),c=e(a.type);return i===a.parameter&&c===a.type?a:new MI(i,c)});return o===this.propertySignatures&&s===this.indexSignatures&&r===this.checks&&n===this.encodingChecks?this:new np(o,s,this.annotations,r,void 0,this.context,n)}flip(e){return this._rebuild(e,e,this.encodingChecks,this.checks)}recur(e,t=e){return this._rebuild(e,t,this.checks,this.encodingChecks)}getExpected(){return this.propertySignatures.length===0&&this.indexSignatures.length===0?\"object | array\":\"object\"}};function EI(e,t,r){if(r._tag===\"Failure\")return Nh(e,e.ast,t.name,r);if(r===qe)return;let n=r[ue];if(n!==ge){M(e.out,t.name,n);return}if(delete e.out[t.name],!Qt(t.type)){let o=new ut([t.name],new ma(t.type.context?.annotations));if(e.options.errors===\"all\"){e.issues?e.issues.push(o):e.issues=[o];return}else return bs(new wt(e.ast,[o],e.input,e.options))}}var VM={onItem(e,t){if(!du(e.input,t.name))return t.parser(ge,e.options);let r=e.input[t.name];return M(e.out,t.name,r),t.parser(r,e.options)},step:EI},kM=km()(VM),c6=vm()(VM);function FI(e,t){return e?t?[...e,...t]:e:t}function Lh(e,t,r){return new np(Reflect.ownKeys(e).map(n=>new PI(n,e[n].ast)),[],r,t)}function op(e){return e.ast}function NI(e,t=void 0){return new Pn(!1,e.map(r=>r.ast),[],void 0,t)}function $h(e,t,r){return new zr(e.map(op),t,void 0,r)}function ZM(e,t){if(e.encoding||t.some(s=>s.encoding))throw new Error(\"StructWithRest does not support encodings\");let r=e.propertySignatures,n=e.indexSignatures,o=e.checks;for(let s of t){for(let a of s.propertySignatures)if(r.some(i=>i.name===a.name))throw new Error(`Duplicate identifier: ${JSON.stringify(a.name)}. ts(2300)`);r=r.concat(s.propertySignatures),n=n.concat(s.indexSignatures),o=FI(o,s.checks)}return new np(r,n,void 0,o)}function YM(e,t){if(e.encoding)throw new Error(\"TupleWithRest does not support encodings\");return new Pn(e.isMutable,e.elements,t,void 0,e.checks)}function QM(e){if(e.encoding)throw new Error(\"mutable does not support encodings\");return new Pn(!0,e.elements,e.rest,e.annotations,e.checks,void 0,e.context,e.encodingChecks)}var UI=Pa(e=>{for(;;){if(FM(e))return eo;let t=e.encoding;if(!t)return e.recur?.(UI,R)??e;if(t.some(r=>r.transformation._tag===\"Middleware\"&&r.transformation.decode!==R))return eo;e=t[t.length-1].to}});function XM(e){switch(e._tag){case\"Null\":return[\"null\"];case\"Undefined\":return[\"undefined\"];case\"String\":case\"TemplateLiteral\":return[\"string\"];case\"Number\":return[\"number\"];case\"Boolean\":return[\"boolean\"];case\"Symbol\":case\"UniqueSymbol\":return[\"symbol\"];case\"BigInt\":return[\"bigint\"];case\"Arrays\":return[\"array\"];case\"ObjectKeyword\":return[\"object\",\"array\",\"function\"];case\"Objects\":return e.propertySignatures.length||e.indexSignatures.length?[\"object\"]:[\"string\",\"number\",\"boolean\",\"symbol\",\"bigint\",\"object\",\"array\",\"function\"];case\"Enum\":return Array.from(new Set(e.enums.map(([,t])=>typeof t)));case\"Literal\":return[typeof e.literal];case\"Union\":return Array.from(new Set(e.types.flatMap(XM)));default:return[\"null\",\"undefined\",\"string\",\"number\",\"boolean\",\"symbol\",\"bigint\",\"object\",\"array\",\"function\"]}}function hu(e){switch(e._tag){default:return[];case\"Declaration\":{let t=e.annotations?.[Wl];return Array.isArray(t)?t:[]}case\"Objects\":return e.propertySignatures.flatMap(t=>{let r=t.type;if(!Qt(r)){if(mu(r))return[{key:t.name,literal:r.literal}];if(yI(r))return[{key:t.name,literal:r.symbol}]}return[]});case\"Arrays\":return e.elements.flatMap((t,r)=>{if(!Qt(t)){if(mu(t))return[{key:r,literal:t.literal}];if(yI(t))return[{key:r,literal:t.symbol}]}return[]});case\"Union\":{if(e.types.length===0)return[];let t=e.types.map(r=>hu(UI(r)));return t[0].filter(r=>t.every(n=>n.some(o=>o.key===r.key&&o.literal===r.literal)))}case\"Suspend\":return hu(e.thunk())}}var vM=new WeakMap,Fh=Object.freeze([]),OM=e=>e===null?\"null\":Array.isArray(e)?\"array\":typeof e,du=(e,t)=>t===\"__proto__\"?Object.hasOwn(e,t):t in e;function sp(e){let t=vM.get(e);if(t)return t;let r,n=0,o,s,a=!0,i=[];for(let f=0;f<e.length;f++){let p=e[f],d=UI(p);if(H4(d))continue;if(mu(d)||yI(d)){s??=new Map;let x=mu(d)?d.literal:d.symbol;i[f]=x;let y=s.get(x);y||s.set(x,y=[]),y.push(f)}else a=!1;let m=hu(d);if(m.length){r??=new Map,n++;for(let{key:x,literal:y}of m){let S=r.get(x);S||r.set(x,S=[new Map,new Set]),S[1].add(f);let w=S[0].get(y);w||S[0].set(y,w=new Set),w.add(f)}}else{o??={};let x=XM(d);for(let y of x)(o[y]??=[]).push(f)}}let c={},u=f=>c[f]??=Object.freeze(o?.[f]??Fh);if(a&&s)s.forEach(Object.freeze),t=f=>s.get(f)??Fh;else if(r?.size===1&&!o){let[f,[p]]=r.entries().next().value,d=new Map;for(let[x,y]of p)d.set(x,Object.freeze(Array.from(y)));let m=Object.freeze(e.map((x,y)=>y));t=(x,y)=>{if(If(x)){let S=du(x,f)?x[f]:void 0;if(S!==void 0)return d.get(S)??Fh;if(y)return m}return Fh}}else if(r){let f;for(let p of r)(!f||p[1][0].size>f[1][0].size)&&p[1][1].size===n&&(f=p);t=(p,d)=>{let m=OM(p);if(!If(p))return u(m);let x=new Set(o?.[m]),y;if(f){let[S,[w]]=f,E=du(p,S),U=E?p[S]:void 0;if(E&&(!d||U!==void 0)){let _=w.get(U);if(!_)return u(m);for(let h of _)x.add(h);y=S}}if(y===void 0)for(let[S,[w,E]]of r){let U=du(p,S),_=U?p[S]:void 0;if(U&&(!d||_!==void 0)){let h=w.get(_);if(h)for(let b of h)x.add(b)}else if(d)for(let h of E)x.add(h)}for(let[S,[w,E]]of r){if(S===y)continue;let U=du(p,S),_=U?p[S]:void 0;if(U&&(!d||_!==void 0)){let h=w.get(_);for(let b of x)E.has(b)&&!h?.has(b)&&x.delete(b)}}return Array.from(x).sort((S,w)=>S-w)}}else t=f=>{let p=u(OM(f));return s?p.filter(d=>i[d]===void 0||i[d]===f):p};return vM.set(e,t),t}var zr=class extends lt{_tag=\"Union\";types;options;encodingChecks;constructor(e,t,r,n,o,s,a){super(r,n,o,s),this.types=e,this.options=t,this.encodingChecks=a}getParser(e,t){let r=this,n=t!==void 0,o=[],s=i=>o[i]??=e(r.types[i]),a;return(i,c)=>{if(i===ge)return $r;let u=(a??=sp(r.types))(i,n);if(u.length===0)return P(new Ql(r,[],i,c));if(u.length===1){let f=s(u[0])(i,c);return f._tag===\"Success\"?f:Ne(f)?eF(r,f.cause,i,c):u6(r,f,i,c)}return tF(r,s,u,i,c)}}_rebuild(e,t,r){let n=Pi(this.types,e);return n===this.types&&t===this.checks&&r===this.encodingChecks?this:new zr(n,this.options,this.annotations,t,void 0,this.context,r)}recur(e){return this._rebuild(e,this.checks,this.encodingChecks)}flip(e){return this._rebuild(e,this.encodingChecks,this.checks)}matchPart(e,t){for(let r of this.types){let n=r.matchPart(e,t);if(n!==void 0)return n}}getExpected(e){let t=this.annotations?.expected;if(typeof t==\"string\")return t;if(this.types.length===0)return\"never\";let r=this.types.map(n=>{let o=hn(n);switch(o._tag){case\"Arrays\":{let s=o.elements.filter(mu);if(s.length>0)return`${RM(o.isMutable)}[ ${s.map(a=>e(a)+PM(a.context?.isOptional)).join(\", \")}, ... ]`;break}case\"Objects\":{let s=o.propertySignatures.filter(a=>mu(a.type));if(s.length>0)return`{ ${s.map(a=>`${RM(a.type.context?.isMutable)}${wo(a.name)}${PM(a.type.context?.isOptional)}: ${e(a.type)}`).join(\", \")}, ... }`;break}}return e(o)});return Array.from(new Set(r)).join(\" | \")}};function eF(e,t,r,n){let o=Xl(t);return o?bs(new Ql(e,[o],r,n)):sn(t)}function u6(e,t,r,n){return rt(t,o=>eF(e,o,r,n))}function tF(e,t,r,n,o){let s={ast:e,parser:t,input:n,out:void 0,successes:e.options?.mode===\"oneOf\"?[]:void 0,issues:void 0,options:o},a=f6(s,r);if(!a)return s.out?s.out:P(new Ql(e,s.issues??[],n,o));if(Ne(a))return _M(a,s);let i=!0;return $(()=>i?(i=!1,_M(a,s)):tF(e,t,r,n,o))}function _M(e,t){return st(e,r=>t.out===qe?g(t.input):t.out?t.out:P(new Ql(t.ast,t.issues??[],t.input,t.options)))}var f6=km()({onItem(e,t){return e.parser(t)(e.input,e.options)},step(e,t,r){if(r._tag===\"Failure\"){let n=Xl(r.cause);if(n===void 0)return r;e.issues?e.issues.push(n):e.issues=[n]}else{if(e.out&&e.successes)return e.successes.push(e.ast.types[t]),bs(new wP(e.ast,e.successes,e.input,e.options));if(e.out=r,e.successes)e.successes.push(e.ast.types[t]);else return xt}}}),rF=new zr([new dn(\"Infinity\"),new dn(\"-Infinity\"),new dn(\"NaN\")]);function RM(e){return e?\"\":\"readonly \"}function PM(e){return e?\"?\":\"\"}var DI=class extends lt{_tag=\"Suspend\";thunk;constructor(e,t,r,n,o){if(r)throw new Error(\"Cannot add checks to Suspend\");super(t,void 0,n,o);let s;this.thunk=()=>s??=e()}getParser(e){let t;return(r,n)=>(t??=e(this.thunk()))(r,n)}recur(e){return new DI(()=>e(this.thunk()),this.annotations,void 0,void 0,this.context)}getExpected(e){return e(this.thunk())}},Uh=class extends $s{_tag=\"Filter\";run;annotations;aborted;constructor(e,t=void 0,r=!1){super(),this.run=e,this.annotations=t,this.aborted=r}annotate(e){return new Uh(this.run,{...this.annotations,...e},this.aborted)}abort(){return new Uh(this.run,this.annotations,!0)}and(e,t){return new Ri([this,e],t)}},Ri=class extends $s{_tag=\"FilterGroup\";checks;annotations;constructor(e,t=void 0){super(),this.checks=e,this.annotations=t}annotate(e){return new Ri(this.checks,{...this.annotations,...e})}and(e,t){return new Ri([this,e],t)}};function Bh(e,t,r=!1){return new Uh((n,o,s)=>AP(o,e(n,o,s),n,s),t,r)}function jh(e,t){return new Uh((r,n,o)=>e(r)?void 0:new de(void 0,r,o),t,!0)}function LI(e){return Bh(t=>globalThis.Number.isFinite(t),{expected:\"a finite number\",representation:{id:\"effect/schema/isFinite\",payload:null},toJsonSchema:()=>({type:\"number\"}),toCode:()=>({runtime:\"Schema.isFinite()\"}),arbitraryConstraint:{number:\"finite\"},...e})}var $I=Vo(RI,[LI()]),l6=new at(new zr([$I,rF]),new ve(kh(),oe(e=>globalThis.Number.isFinite(e)?e:globalThis.String(e))));function ap(e,t){let r=new globalThis.RegExp(e),n={source:r.source,flags:r.flags};return Bh(o=>(r.lastIndex=0,r.test(o)),{expected:`a string matching the RegExp ${n.source}`,representation:{id:\"effect/schema/isPattern\",payload:n},toJsonSchema:()=>[{},!0],arbitraryConstraint:{patterns:[n]},...t})}var II=new WeakMap;function ip(e,t){let r=Object.assign(Object.create(Object.getPrototypeOf(e)),e,t);return Reflect.ownKeys(t).every(n=>n===\"context\"||n===\"encoding\")&&II.set(r,Su(e)),r}function Su(e){let t=II.get(e);if(t!==void 0)return t;if(e.encoding===void 0)return e;let r=Object.assign(Object.create(Object.getPrototypeOf(e)),e,{encoding:void 0});return II.set(e,r),r}function We(e,t){return e.encoding===t?e:ip(e,{encoding:t})}function Mi(e,t){if(e.context===t)return e;let r=Su(e);return r.context===t&&r.encoding===e.encoding?r:ip(e,{context:t})}function bu(e){return e.encoding?bu(e.encoding[e.encoding.length-1].to):e}function to(e,t){if(e.checks){let r=e.checks[e.checks.length-1];return nF(e,$d(e.checks.slice(0,-1),r.annotate(t)))}return ip(e,{annotations:{...e.annotations,...t}})}function nF(e,t){if(e._tag===\"Suspend\"&&t)throw new Error(\"Cannot add checks to Suspend\");return e.checks===t?e:ip(e,{checks:t})}function Vo(e,t){return nF(e,FI(e.checks,t))}function Eu(e,t){let r=t(e.to);return r===e.to?e:new at(r,e.transformation)}function BI(e,t){let r=e,n=r[r.length-1],o=Eu(n,t);return o===n?e:$d(e.slice(0,e.length-1),o)}function jI(e){return t=>t.encoding?We(t,BI(t.encoding,e)):t}function zh(e,t){return jI(r=>Mi(r,t))(e)}function oF(e){function t(r){return r.encoding?We(r,BI(r.encoding,t)):e(r)}return Vr(t)}function Fi(e,t){function r(n){if(n.encoding){let o=n.encoding[n.encoding.length-1];return t?.stopAt?.(o)?n:We(n,BI(n.encoding,r))}return e(n)}return Pa(r)}function sF(e,t){return zI(e,t,yt(e))}function aF(e,t){return zI(hn(e),t,e)}function zI(e,t,r){let n=new at(e,t);return We(r,r.encoding?[...r.encoding,n]:[n])}function Pi(e,t){let r;for(let n=0;n<e.length;n++){let o=e[n],s=t(o);if(r)r[n]=s;else if(s!==o){r=new Array(e.length);for(let a=0;a<n;a++)r[a]=e[a];r[n]=s}}return r??e}function cp(e,t){let r=e.context?new Ko(e.context.isOptional,e.context.isMutable,e.context.constructorDefault,{...e.context.annotations,...t}):new Ko(!1,!1,void 0,t);return Mi(e,r)}var Ni=Pa(e=>{let t=e.context?e.context.isOptional===!1?new Ko(!0,e.context.isMutable,e.context.constructorDefault,e.context.annotations):e.context:new Ko(!0,!1);return p6(Mi(e,t))}),p6=jI(Ni),iF=Vr(e=>Ni(new zr([e,vI]))),qI=Pa(e=>{let t=e.context?e.context.isMutable===!1?new Ko(e.context.isOptional,!0,e.context.constructorDefault,e.context.annotations):e.context:new Ko(!1,!0);return d6(Mi(e,t))}),d6=jI(qI);function cF(e,t){let r=e.context?new Ko(e.context.isOptional,e.context.isMutable,t,e.context.annotations):new Ko(!1,!1,t);return Mi(e,r)}function ga(e,t,r){return zI(e,r,t)}function m6(e){let t=[],r=[];function n(o){switch(o._tag){case\"Literal\":id(o.literal)&&!t.includes(o.literal)&&t.push(o.literal);return;case\"UniqueSymbol\":t.includes(o.symbol)||t.push(o.symbol);return;case\"Never\":return;case\"Union\":for(let s=0;s<o.types.length;s++)n(o.types[s]);return;default:r.push(o)}}return n(e),{literals:t,parameters:r}}function uF(e,t){let{literals:r,parameters:n}=m6(e);return new np(r.map(o=>new PI(o,t)),n.map(o=>new MI(o,t)))}function Qt(e){return e.context?.isOptional??!1}function fF(e){return e.context?.isMutable??!1}function lF(e){return e.annotations?.[Lr]===!0||e._tag===\"FilterGroup\"&&e.checks.every(lF)}function h6(e){function t(n){return lF(n)?[n]:n._tag===\"FilterGroup\"?n.checks.flatMap(t):[]}let r=e.flatMap(t);return or(r)?r:void 0}function x6(e){let t=!0;function r(n){return t=t&&!n.encoding&&!FM(n),t&&\"recur\"in n&&n.recur(r),n}return\"recur\"in e&&e.recur(r),t}var yt=Pa(e=>{let t=Su(e);if(t!==e){let n=yt(t);return n===t&&e.encoding===void 0?e:Mi(n,e.context)}let r=\"recur\"in e?e.recur(yt):e;if(\"encodingChecks\"in r&&r.encodingChecks){let n=x6(e)?r.encodingChecks:AI(r)||W4(r)||gu(r)&&r.typeParameters.length>0?h6(r.encodingChecks):void 0;return ip(r,{encodingChecks:void 0,checks:FI(r.checks,n)})}return r}),hn=Pa(e=>yt(mn(e)));function g6(e,t){let r=t,n=r.length,o=r[n-1],s=[new at(mn(We(e,void 0)),r[0].transformation.flip())];for(let i=1;i<n;i++)s.unshift(new at(mn(r[i-1].to),r[i].transformation.flip()));let a=mn(o.to);return a.encoding?We(a,[...a.encoding,...s]):We(a,s)}var mn=Vr(e=>{if(e.encoding)return g6(e,e.encoding);let t=Su(e);if(t!==e){let r=mn(t);return r===t?e:Mi(r,e.context)}return\"flip\"in e?e.flip(mn):\"recur\"in e?e.recur(mn):e});function pF(e){switch(e._tag){case\"Undefined\":return!0;case\"Union\":return e.types.some(pF);default:return!1}}function qh(e,t){let r=t===0?qe:Zt(t);return(n,o)=>n===ge?$r:n===t?r:P(new ft(e,n,o))}function ro(e,t){return(r,n)=>r===ge?$r:t(r)?qe:P(new ft(e,r,n))}function dF(e,t,r){let n=e.encodedParts,o=e.literals,s=t.length;for(let u=0;u<o.length;u++){let f=o[u];if(f&&!t.includes(f))return}if(e.suffixLengths[0]>s)return;let a=new Array(n.length),i;function c(u,f){if(u===n.length)return f===s;if(i?.has(u*(s+1)+f))return!1;let p=n[u];if(u===n.length-1){let d=t.slice(f);if(p.matchPart(d,r)!==void 0)return a[u]=d,!0}else if(p._tag===\"Literal\"){let d=o[u];if(t.startsWith(d,f)&&c(u+1,f+d.length))return a[u]=d,!0}else{let d=s-e.suffixLengths[u+1],m=o[u+1],x=m===void 0?d:t.lastIndexOf(m,d);for(;x>=f;){let y=t.slice(f,x);if(p.matchPart(y,r)!==void 0&&c(u+1,x))return a[u]=y,!0;if(x===0)break;x=m===void 0?x-1:t.lastIndexOf(m,x-1)}}return i??=new Set,i.add(u*(s+1)+f),!1}return c(0,0)?a:void 0}var HI=Fi(e=>{switch(e._tag){default:return e;case\"Number\":return e.toCodecStringTree();case\"Union\":return e.recur(HI)}}),Hh=Fi(e=>{switch(e._tag){default:return e;case\"Symbol\":case\"UniqueSymbol\":return e.toCodecStringTree();case\"Union\":return e.recur(Hh)}}),WI=Fi(e=>{switch(e._tag){default:return e;case\"Number\":case\"Literal\":case\"BigInt\":return e.toCodecStringTree();case\"Union\":return e.recur(WI)}}),mF=\"[\\\\s\\\\S]*?\",TI=new globalThis.RegExp(`^${Dh}$`),y6=new globalThis.RegExp(`^(?:${Dh}|Infinity|-Infinity|NaN)$`);function JI(e){return ap(TI,{expected:\"a string representing a finite number\",representation:{id:\"effect/schema/isStringFinite\",payload:null},toJsonSchema:()=>({pattern:TI.source}),...e})}var hF=Vo(pn,[JI()]),S6=new at(hF,pu),b6=new at(new zr([hF,rF]),pu),E6=\"-?\\\\d+\",wI=new globalThis.RegExp(`^${E6}$`);function KI(e){return ap(wI,{expected:\"a string representing a bigint\",representation:{id:\"effect/schema/isStringBigInt\",payload:null},toJsonSchema:()=>({pattern:wI.source}),...e})}var GI=Vo(pn,[KI({expected:\"a string representing a bigint\"})]),I6=new at(GI,Mh),T6=\"Symbol\\\\(([\\\\s\\\\S]*)\\\\)\",CI=new globalThis.RegExp(`^${T6}$`),w6=Vo(pn,[VI()]),xF=new at(w6,new ve(oe(e=>globalThis.Symbol.for(CI.exec(e)[1])),gt((e,t)=>globalThis.Symbol.keyFor(e)!==void 0?g(globalThis.String(e)):P(new Yl({message:\"cannot serialize to string, Symbol is not registered\"},e,t)))));function VI(e){return ap(CI,{expected:\"a string representing a symbol\",representation:{id:\"effect/schema/isStringSymbol\",payload:null},toJsonSchema:()=>({pattern:CI.source}),...e})}function no(e,t,r,n,o){for(let s=0;s<e.length;s++){let a=e[s];if(a._tag===\"FilterGroup\"){if(r=no(a.checks,t,r,n,o),r&&(o.errors!==\"all\"||r[r.length-1].filter.aborted))return r}else{let i=a.run(t,n,o);if(i){let c=new IP(a,i,t,o);if(r?r.push(c):r=[c],o.errors!==\"all\"||a.aborted)return r}}}return r}function gF(e,t){let r=no(e,t,void 0,eo,{errors:\"all\"});if(r){let n=new wt(eo,r);return W(n)}return B(t)}function yF(e){if(!gu(e))return;let t=e.annotations?.[Ih];return Zr(t)?t(e.typeParameters):void 0}function C6(e){return e===null||typeof e==\"string\"||typeof e==\"boolean\"||typeof e==\"number\"&&globalThis.Number.isFinite(e)}function A6(e){return e===void 0||typeof e==\"string\"}function SF(e,t){let r=new WeakMap,n=[];e:for(;;){if(typeof e!=\"object\"||e===null){if(!t(e))return!1}else{let o=e,s=r.get(o);if(s===!1)return!1;if(s===void 0){let a=Array.isArray(o);if(!a){let i=Object.getPrototypeOf(o);if(i!==null&&i!==Object.prototype&&Object.getPrototypeOf(i)!==null)return!1}r.set(o,!1),n.push({value:o,keys:a?o.length:Object.keys(o),index:0})}}for(;n.length>0;){let o=n[n.length-1],s=o.keys;if(typeof s==\"number\"){if(o.index<s){e=o.value[o.index++];continue e}}else if(o.index<s.length){e=o.value[s[o.index++]];continue e}r.set(o.value,!0),n.pop()}return!0}}function Iu(e){return SF(e,C6)}var xu=new yu([],()=>(e,t,r)=>Iu(e)?qe:P(new ft(t,e,r)),{representation:{id:\"effect/schema/Json\",payload:null},expected:\"JSON value\",toCodecJson:()=>{},toCodecStringTree:()=>YI}),bF=to(xu,{representation:{id:\"effect/schema/MutableJson\",payload:null}}),ZI=new at(xu,lu()),EF=new at(new zr([new Pn(!1,[],[xu]),new np([],[new MI(pn,xu)])]),lu());function k6(e){return SF(e,A6)}var v6=new yu([],()=>(e,t,r)=>k6(e)?qe:P(new ft(t,e,r)),{expected:\"StringTree\",toCodecStringTree:()=>{}}),YI=new at(v6,lu());var Wh=(e,t,r)=>e===qe?r(t):st(e,r);function TF(e){if(e._tag===\"Middleware\")return(r,n,o)=>{let s=r===qe?e.decode(Zt(Kl(n)),o):e.decode(Dr(r,Kl),o);return IF(s)};let t=e.decode;switch(t._tag){case\"Passthrough\":return(r,n)=>r===qe?Zt(n):r;case\"Transform\":{let r=n=>n===ge?$r:Zt(t.transform(n));return(n,o)=>Wh(n,o,r)}case\"TransformOptional\":{let r=n=>tI(t.transform(Kl(n)));return(n,o)=>Wh(n,o,r)}case\"TransformEffect\":return(r,n,o)=>Wh(r,n,s=>s===ge?$r:t.transform(s,o));case\"TransformOptionalEffect\":return(r,n,o)=>Wh(r,n,s=>IF(t.transform(Kl(s),o)))}}var IF=e=>st(e,tI),wF=(e,t,r,n)=>rt(n,o=>Is(()=>Ss(o,s=>new TP(e,s,t,r))));function O6(e,t){let r=TF(e.link.transformation),n;return(o,s)=>{if(o===ge)return $r;if(e.isConstructed(o))return qe;let a=(n??=t(e.link.to))(o,s);return r(a,o,s)}}function _6(e,t){let r=e.context.constructorDefault;return(n,o)=>{if(n!==ge&&n!==void 0)return t(n,o);let s=r;if(Ne(s)&&s._tag===\"Success\"){let a=t(s[ue],o);return a===qe?s:a}return st(wF(e,n,o,s),a=>{let i=t(a,o);return i===qe?Zt(a):i})}}function QI(e,t){let r=t(e);return e.context?.constructorDefault===void 0?r:_6(e,r)}function up(e,t,r,n,o){if(e._tag===\"Declaration\")for(let x of e.typeParameters)t(x);let s=r?yF(e):void 0,a=s?O6(s,t):n??e.getParser(t,r),i=e.checks,c=e.encoding,u=c?.map(x=>TF(x.transformation)),f=e.encodingChecks;if(!c&&!i&&!f)return a;let p,d=(x,y)=>{let S=a(x,y);if(f&&!y.disableChecks)if(Ne(S)){if(S._tag===\"Success\"){let w=S===qe?x:S[ue];if(x!==ge&&w!==ge){let E=no(f,x,void 0,e,y);E&&(S=P(new wt(e,E,x,y)))}}}else S=I(S,w=>{if(x!==ge&&w!==ge){let E=no(f,x,void 0,e,y);if(E)return P(new wt(e,E,x,y))}return g(w)});if(i&&!y.disableChecks)if(Ne(S)){if(S._tag===\"Success\"){let w=S===qe?x:S[ue];if(w===ge)return S;let E=no(i,w,void 0,e,y);E&&(S=P(new wt(e,E,w,y)))}}else S=I(S,w=>{if(w!==ge){let E=no(i,w,void 0,e,y);if(E)return P(new wt(e,E,w,y))}return g(w)});return S},m=o===void 0?d:o(d);return c?(x,y)=>{let S=p??=c.map(U=>t(U.to)),w=x,E=S[S.length-1](x,y);for(let U=c.length-1;U>=0;U--)if(E=u[U](E,w,y),U!==0){let _=S[U-1];E._tag===\"Success\"?(w=E[ue],E=_(w,y)):E=st(E,h=>{let b=_(h,y);return b===qe?Zt(h):b})}if(E._tag===\"Success\"){let U=E[ue],_=m(U,y);return _===qe?E:_}return E=wF(e,x,y,E),st(E,U=>{let _=m(U,y);return _===qe?Zt(U):_})}:m}var Gh=Symbol(),CF=new WeakMap,AF,Tu=!1;var P6=e=>Tu?Kh(gn,e,\"parser\"):gn(e).parser,kF=e=>Tu?Kh(gn,e,\"makeEffect\"):gn(e).makeEffect,M6=e=>QI(e,kF),Jh=class{ast;constructor(t){this.ast=t}get decodeEffect(){return this.cachedDecodeEffect??=up(this.ast,P6)}get parser(){return this.decodeEffect}get makeEffect(){return this.cachedMakeEffect??=up(this.ast,kF,M6)}},XI=class extends Jh{compiled;resolve;constructor(t,r,n){super(t),this.compiled=r,this.resolve=n}save(t,r){return Object.defineProperty(this,t,{value:r}),r}operation(t){let r=this.compiled;return typeof r==\"function\"?r(this.ast,this.resolve,t):r?.[t]}get is(){return this.save(\"is\",this.operation(\"is\"))}get decode(){return this.save(\"decode\",this.operation(\"decode\"))}get make(){return this.save(\"make\",this.operation(\"make\"))}get decodeEffect(){return this.save(\"decodeEffect\",this.operation(\"decodeEffect\")??up(this.ast,t=>Kh(this.resolve,t,\"parser\")))}get parser(){let t=this.decode;return t===void 0?this.decodeEffect:this.save(\"parser\",F6(t,()=>this.decodeEffect))}get makeEffect(){let t=this.operation(\"makeEffect\");if(t!==void 0)return this.save(\"makeEffect\",t);let r=n=>Kh(this.resolve,n,\"makeEffect\");return this.save(\"makeEffect\",up(this.ast,r,n=>QI(n,r)))}};function F6(e,t){let r;return(n,o)=>{if(n!==ge)try{let s=e(n,o);if(s!==Gh)return s===n?qe:Zt(s)}catch(s){return an(s)}return(r??=t())(n,o)}}function Kh(e,t,r){let n=e(t);if(n.compiled===void 0||Object.hasOwn(n,r))return n[r];let o;return(s,a)=>(o??=n[r])(s,a)}function gn(e){let t=CF.get(e);if(t!==void 0)return t;let r=AF===void 0?new Jh(e):new XI(e,AF(e,gn),gn);return CF.set(e,r),r}function tT(e){let t=e.ast,r;return(n,o)=>(r??=cT(q6,yt(t)))(n,o?.disableChecks?o?.parseOptions?{...o.parseOptions,disableChecks:!0}:{disableChecks:!0}:o?.parseOptions)}function Zh(e){let t=tT(e);return(r,n)=>{let o=Wo(t(r,n));return Ve(o)?O(o.value):(ln(o.cause,\"Option adapter can only return none for schema issues\"),v())}}function Yh(e){return j6(yt(e.ast))}function rT(e){return Ui(e.ast)}function U6(e){if(!Tu){let o=wu(ex(e));return s=>{let a=o(s,Go);return Ve(a)?!0:(ln(a.cause,\"Type guard adapter can only return false for schema issues\"),!1)}}let t=gn(e),r=t.is;if(r!==void 0)return o=>{try{return r(o,Go)}catch(s){return ln(ci(s),\"Type guard adapter can only return false for schema issues\"),!1}};let n=t.parser;return o=>{let s=Wo(iT(n(o,Go),o));return Ve(s)?!0:(ln(s.cause,\"Type guard adapter can only return false for schema issues\"),!1)}}function Ui(e){let t=yt(e),r=n=>(r=U6(t),r(n));return n=>r(n)}function vF(e){let t=ex(e);return(r,n)=>{let o=Wo(t(r,n));if(!Ve(o))return ln(o.cause,\"Issue adapter can only return schema issues\")}}function OF(e,t){let r=yt(e.ast),n=gn(r).parser(t,Go),o=Wo(iT(n,t));if(Uo(o)){let s=ln(o.cause,\"Assertion adapter can only throw schema issues\");throw new Error(\"Schema validation failed\",{cause:s})}}function nt(e,t){let r=ex(e.ast);return t===void 0?r:(n,o)=>r(n,aT(t,o))}var nT=nt;function _F(e,t){return wu(nt(e,t))}function oT(e,t){return DF(nt(e,t))}var RF=oT;function PF(e,t){return LF(nt(e,t))}function D6(e,t){return Tu?$F(e.ast,t):uT(nt(e,t))}var Qh=D6;function Di(e,t){let r=ex(mn(e.ast));return t===void 0?r:(n,o)=>r(n,aT(t,o))}var MF=Di;function FF(e,t){return wu(Di(e,t))}function sT(e,t){return DF(Di(e,t))}var NF=sT;function UF(e,t){return LF(Di(e,t))}function L6(e,t){return Tu?$F(mn(e.ast),t):uT(Di(e,t))}var Xh=L6,aT=(e,t)=>t?{...e,...t}:e,Vh=e=>e===ge?P(new de):g(e);function ex(e){return cT(z6,e)}function iT(e,t){return e===qe?g(t):Ne(e)?e[ue]===ge?Vh(ge):e:st(e,Vh)}function cT(e,t){let r;return(n,o)=>{let s=(r??=e(t))(n,o??Go);return s===qe?g(n):Ne(s)?s[ue]===ge?Vh(ge):s:st(s,Vh)}}function wu(e){return(t,r)=>Wo(e(t,r))}function DF(e){let t=wu(e);return(r,n)=>{let o=t(r,n);return Ve(o)?O(o.value):(ln(o.cause,\"Option adapter can only return none for schema issues\"),v())}}function LF(e){let t=wu(e);return(r,n)=>{let o=t(r,n);return Ve(o)?B(o.value):W(ln(o.cause,\"Result adapter can only return schema issues\"))}}function $F(e,t){let r;return(n,o)=>(r??=$6(gn(e),t))(n,o)}function $6(e,t){let r=e.decode,n,o=r===void 0?(s,a=Go)=>(n??=eT(e))(s,a):(s,a=Go)=>{if(s===ge)return(n??=eT(e))(s,a);let i;try{i=r(s,a)}catch(c){throw ln(ci(c),\"Sync adapter can only throw schema issues\"),c}return i!==Gh?i:(n??=eT(e))(s,a)};return t===void 0?o:(s,a)=>o(s,aT(t,a))}function eT(e){return uT(cT(()=>e.decodeEffect,e.ast))}function uT(e){let t=wu(e);return(r,n)=>{let o=t(r,n);if(Ve(o))return o.value;let s=ln(o.cause,\"Sync adapter can only throw schema issues\");throw new Error(\"Schema validation failed\",{cause:s})}}function B6(e,t){let r=Wo(e);if(Ve(r))return r.value;let n=ln(r.cause,t);throw new Error(\"Schema validation failed\",{cause:n})}function j6(e){let t,r;return(n,o)=>{t??=gn(e);let s=o?.disableChecks?o.parseOptions?{...o.parseOptions,disableChecks:!0}:{disableChecks:!0}:o?.parseOptions??Go,a=t.make;if(a!==void 0&&n!==ge){let c;try{c=a(n,s)}catch(u){throw ln(ci(u),\"Constructor adapter can only throw schema issues\"),u}if(c!==Gh&&c!==ge)return c}let i=(r??=t.makeEffect)(n,s);return B6(iT(i,n),\"Constructor adapter can only throw schema issues\")}}var z6=e=>gn(e).parser,q6=e=>gn(e).makeEffect;var tx=\"~effect/Schema/Schema\",BF=Symbol(),H6={[tx]:tx,get make(){let e=Yh(this);return Object.defineProperty(this,\"make\",{value:e,enumerable:!0}),e},get makeEffect(){let e=tT(this);return Object.defineProperty(this,\"makeEffect\",{value:e,enumerable:!0}),e},get makeOption(){let e=Zh(this);return Object.defineProperty(this,\"makeOption\",{value:e,enumerable:!0}),e},pipe(){return Z(this,arguments)},annotate(e){return this.rebuild(to(this.ast,e))},annotateKey(e){return this.rebuild(cp(this.ast,e))},check(...e){return this.rebuild(Vo(this.ast,e))},rebuild(e){return oo(e,this[BF])}};function oo(e,t){function r(){}let n=Object.setPrototypeOf(r,H6);return t&&(Object.hasOwn(t,\"name\")||Object.hasOwn(t,\"length\")||Object.hasOwn(t,\"__proto__\"))?Object.defineProperties(n,Object.getOwnPropertyDescriptors({...t})):Object.assign(n,t),n[BF]=t,n.ast=e,n}function fT(e){return e.replace(/~/g,\"~0\").replace(/\\//g,\"~1\")}function fp(e){return e.replace(/~1/g,\"/\").replace(/~0/g,\"~\")}function lT(e){return encodeURI(fT(e)).replace(/#/g,\"%23\")}function pT(e){if(e.length===0||e===\"#\")return\"\";if(!e.startsWith(\"#\"))return;let t=e.slice(1);try{if(encodeURI(t).replace(/%25/g,\"%\").replace(/#/g,\"%23\")!==t)return;let r=decodeURIComponent(t);return r.startsWith(\"/\")&&!/~(?:[^01]|$)/.test(r)?r:void 0}catch{return}}function zF(e){let t=pT(e);return t===void 0?void 0:t.length===0?[]:t.slice(1).split(\"/\").map(fp)}function qF(e){return e.reduce((t,r)=>`${t}/${lT(r)}`,\"#\")}var J6=\"http://json-schema.org/draft-07/schema#\",HF=\"https://json-schema.org/draft/2020-12/schema\";function WF(e,t){return e===t||e===(t.endsWith(\"#\")?t.slice(0,-1):`${t}#`)}function GF(e){return{dialect:\"draft-07\",...Y6(e,iG)}}function K6(e,t){return r(e,!1,!0);function r(n,o,s=!1){if(!fr(n))return n;let a=o||!s&&YF(n.$id),i={};for(let c of Object.keys(n)){let u=n[c],f=u;switch(c){case\"$defs\":case\"properties\":case\"patternProperties\":case\"dependentSchemas\":f=mT(u,p=>r(p,a))??u;break;case\"allOf\":case\"anyOf\":case\"oneOf\":case\"prefixItems\":f=Array.isArray(u)?u.map(p=>r(p,a)):u;break;case\"not\":case\"additionalProperties\":case\"propertyNames\":case\"unevaluatedProperties\":case\"items\":case\"contains\":case\"unevaluatedItems\":case\"if\":case\"then\":case\"else\":case\"contentSchema\":f=r(u,a)}M(i,c,f)}return t(i,a),i}}function VF(e,t){return K6(e,r=>{G6(r,t)})}function G6(e,t){typeof e.$ref==\"string\"&&M(e,\"$ref\",t(e.$ref,\"$ref\")),typeof e.$dynamicRef==\"string\"&&M(e,\"$dynamicRef\",t(e.$dynamicRef,\"$dynamicRef\"))}function mT(e,t){if(!fr(e))return;let r={};for(let n of Object.keys(e))M(r,n,t(e[n],n));return r}function V6(e,t,r){let n=new Map,o=[],s=dT;function a(d,m=[],x=[]){if(m.length===0&&t?.trackIds){let y=fr(d)?f(d):void 0;s=JF(y,dT)??dT}return u(d,m,x,{sourceRoot:[],targetRoot:[],uri:s})}function i(){for(let[d,m,x]of o){let y=m,S=ZF(m,x);if(S!==void 0){let w=zF(S.hash);if(S.hash=\"\",w!==void 0){let E=n.get(KF(S.href,w));E!==void 0&&(y=Z6(m,E))}}M(d,\"$ref\",y)}}let c=r(a);return i(),c;function u(d,m,x,y){if(typeof d==\"boolean\")return p(m,x,y),t?.booleanAdapter?.(d)??d;if(!fr(d))return d;let S=y,w=f(d);if(m.length>0&&t?.trackIds&&YF(w)){let _=JF(w,y.uri);_!==void 0&&(S={parent:y,sourceRoot:m,targetRoot:x,uri:_})}p(m,x,S);let E=S.uri,U={isDocumentRoot:m.length===0,schema(_,h,b=h){return u(_,[...m,h],[...x,b],S)},schemaAt(_,h,b){return u(_,[...m,...h],[...x,...b],S)},schemaArray(_,h,b=h){return Array.isArray(_)?_.map((T,C)=>u(T,[...m,h,String(C)],[...x,b,String(C)],S)):_},schemaMap(_,h,b=h){return fr(_)?mT(_,(T,C)=>u(T,[...m,h,C],[...x,b,C],S)):_},reference(_,h){typeof h==\"string\"?o.push([_,h,E]):M(_,\"$ref\",h)}};return e(d,U)}function f(d){return t?.ignoreRefSiblings===!0&&typeof d.$ref==\"string\"?void 0:d.$id}function p(d,m,x){x.parent!==void 0&&p(d,m,x.parent),n.set(KF(x.uri,d.slice(x.sourceRoot.length)),m.slice(x.targetRoot.length))}}var dT=\"https://effect.invalid/.json-schema/\";function ZF(e,t){return URL.canParse(e,t)?new URL(e,t):void 0}function JF(e,t){if(typeof e!=\"string\")return;let r=ZF(e,t);if(r!==void 0)return r.hash=\"\",r.href}function Z6(e,t){let r=e.indexOf(\"#\");return r===-1&&t.length===0?e:`${r===-1?e:e.slice(0,r)}${qF(t)}`}function KF(e,t){return`${e}\\0${JSON.stringify(t)}`}function YF(e){return typeof e==\"string\"&&e.length>0&&e[0]!==\"#\"}function Y6(e,t,r){return V6(t,{...r,trackIds:!0},n=>({schema:n(e.schema),definitions:mT(e.definitions,(o,s)=>n(o,[\"$defs\",s],[\"definitions\",s]))}))}var Q6=new Set([\"properties\",\"patternProperties\"]),X6=new Set([\"allOf\",\"anyOf\",\"oneOf\"]),eG=new Set([\"not\",\"additionalProperties\",\"propertyNames\",\"contains\",\"if\",\"then\",\"else\",\"contentSchema\"]);function tG(e,t,r,n,o,s=Q6){let a;if(s.has(t))a=n.schemaMap(r,t);else if(X6.has(t))a=n.schemaArray(r,t);else if(o.has(t))a=n.schema(r,t);else return!1;return M(e,t,a),!0}var QF=[\"$anchor\",\"$defs\",\"$dynamicAnchor\",\"$dynamicRef\",\"$vocabulary\",\"contentSchema\",\"dependentRequired\",\"dependentSchemas\",\"maxContains\",\"minContains\",\"prefixItems\",\"unevaluatedItems\",\"unevaluatedProperties\"],Iie=[...QF,\"deprecated\"],Tie=[...QF,\"$comment\",\"$id\",\"$schema\",\"const\",\"contains\",\"contentEncoding\",\"contentMediaType\",\"else\",\"examples\",\"if\",\"patternProperties\",\"propertyNames\",\"then\"],rG=/^[A-Za-z_][-A-Za-z0-9._]*$/,nG=/^[A-Za-z][-A-Za-z0-9._:]*$/;function Li(e,t,r){throw new Error(`Cannot convert JSON Schema keyword \"${e}\" to ${t}: ${r}`)}function oG(e,t,r,n){for(let o of t)Object.hasOwn(e,o)&&Li(o,r,`it is not active in ${n} but would become active in the target`)}var sG=[\"additionalItems\",\"definitions\",\"dependencies\"];function aG(e,t,r,n,o){r.isDocumentRoot?M(e,\"$schema\",WF(t,HF)?n:t):WF(t,HF)||Li(\"$schema\",o,\"an embedded resource cannot declare a different dialect\")}function iG(e,t){oG(e,sG,\"Draft-07\",\"Draft 2020-12\");let r={},n,o,s;for(let a of Object.keys(e)){let i=e[a];if(!tG(r,a,i,t,eG))switch(a){case\"$ref\":n=i;break;case\"$schema\":aG(r,i,t,J6,\"Draft-07\");break;case\"$id\":case\"$anchor\":break;case\"$defs\":M(r,\"definitions\",t.schemaMap(i,a,\"definitions\"));break;case\"prefixItems\":o=i;break;case\"items\":s=i;break;case\"dependentRequired\":case\"dependentSchemas\":case\"minContains\":case\"maxContains\":break;case\"$dynamicRef\":case\"$dynamicAnchor\":case\"$vocabulary\":case\"unevaluatedProperties\":case\"unevaluatedItems\":Li(a,\"Draft-07\",\"the target dialect has no equivalent\");case\"required\":if(Array.isArray(i)&&i.length===0)break;M(r,a,i);break;default:M(r,a,i)}}if(cG(r,o,s,t),Object.hasOwn(e,\"contains\")){let a=e.minContains,i=e.maxContains;(a!==void 0&&a!==1||i!==void 0)&&Li(\"minContains/maxContains\",\"Draft-07\",\"contains cardinality cannot be represented\"),Object.hasOwn(e,\"minContains\")&&M(r,\"minContains\",a)}else Object.hasOwn(e,\"minContains\")&&M(r,\"minContains\",e.minContains),Object.hasOwn(e,\"maxContains\")&&M(r,\"maxContains\",e.maxContains);return fG(e,r,t,\"draft-07\"),pG(e,r,\"$id\",\"Draft-07\"),uG(r,n,t),r}function cG(e,t,r,n){if(t===void 0){r!==void 0&&M(e,\"items\",n.schema(r,\"items\"));return}M(e,\"items\",n.schemaArray(t,\"prefixItems\",\"items\")),r!==void 0&&M(e,\"additionalItems\",n.schema(r,\"items\",\"additionalItems\"))}function uG(e,t,r){if(t!==void 0)if(typeof t==\"string\"&&Object.keys(e).length>0){let n={};r.reference(n,t),lG(e,n)}else r.reference(e,t)}function fG(e,t,r,n){let o=fr(e.dependentRequired)?e.dependentRequired:void 0,s=fr(e.dependentSchemas)?e.dependentSchemas:void 0;if(o===void 0&&s===void 0)return;let a={},i=new Set([...Object.keys(o??{}),...Object.keys(s??{})]);for(let c of i){let u=o?.[c],f=s?.[c],p=n===\"draft-04\"&&Array.isArray(u)&&u.length===0;f===void 0?p||M(a,c,u):u===void 0||p?M(a,c,r.schemaAt(f,[\"dependentSchemas\",c],[\"dependencies\",c])):M(a,c,{allOf:[r.schemaAt(f,[\"dependentSchemas\",c],[\"dependencies\",c,\"allOf\",\"0\"]),{required:u}]})}Object.keys(a).length>0&&M(t,\"dependencies\",a)}function lG(e,t){Array.isArray(e.allOf)?e.allOf.push(t):M(e,\"allOf\",[t])}function pG(e,t,r,n){let o=e.$id,s=e.$anchor;if(s===void 0){o!==void 0&&M(t,r,o);return}(typeof s!=\"string\"||!rG.test(s))&&Li(\"$anchor\",n,\"the anchor is not valid\"),nG.test(s)||Li(\"$anchor\",n,\"the anchor cannot be represented as a plain-name fragment identifier\"),o===void 0?M(t,r,`#${s}`):Li(\"$anchor\",n,\"it cannot be combined with the schema $id\")}function rx(e){return oo(Cu(e.ast),{schema:e})}var Cu=Fi(e=>{let t=mG(e,Cu),r=e.context;return t===e||r===void 0?t:zh(t,hT(r))});function hT(e){return e.constructorDefault===void 0?e:new Ko(e.isOptional,e.isMutable,void 0,e.annotations)}function tN(e){if(e.propertySignatures.some(t=>typeof t.name!=\"string\"))throw new globalThis.Error(\"Objects property names must be strings\",{cause:e})}function rN(e){return t=>{let r=[...t].sort((o,s)=>e(hn(o))-e(hn(s)));return r.some((o,s)=>o!==t[s])?r:t}}var dG=rN(e=>{switch(e._tag){case\"BigInt\":case\"Symbol\":case\"UniqueSymbol\":return 0;default:return 1}});function mG(e,t){switch(e._tag){case\"Declaration\":{let r=e.annotations?.toCodecJson??e.annotations?.toCodec;if(!Zr(r))return We(e,[ZI]);let n=e.typeParameters.map(s=>oo(hn(s))),o=r(n);return o===void 0?e:We(e,[Eu(o,t)])}case\"Unknown\":return We(e,[ZI]);case\"ObjectKeyword\":return We(e,[EF]);case\"Undefined\":case\"Void\":case\"Literal\":case\"Number\":return e.toCodecJson();case\"UniqueSymbol\":case\"Symbol\":case\"BigInt\":return e.toCodecStringTree();case\"Objects\":return tN(e),e.recur(t,Hh);case\"Union\":{let r=dG(e.types);return r!==e.types?new zr(r,e.options,e.annotations,e.checks,e.encoding,e.context,e.encodingChecks).recur(t):e.recur(t)}case\"Arrays\":case\"Suspend\":return e.recur(t)}return e}function nx(e){return oo(nN(yt(e.ast)))}var nN=Vr(e=>{let t=hG(e,nN);return t!==e&&e.context!==void 0?zh(t,hT(e.context)):t});function hG(e,t){switch(e._tag){case\"Declaration\":{let r=e.annotations?.toCodecIso??e.annotations?.toCodec;if(Zr(r)){let n=r(e.typeParameters.map(o=>oo(o)));return We(e,[Eu(n,t)])}return e}case\"Arrays\":case\"Objects\":case\"Union\":case\"Suspend\":return e.recur(t)}return e}function ox(e){return oo(iN(e.ast),{schema:e})}function oN(e){return oo(cN(e.ast))}var xG=rN(e=>{switch(e._tag){case\"Null\":case\"Boolean\":case\"Number\":case\"BigInt\":case\"Symbol\":case\"UniqueSymbol\":return 0;default:return 1}});function gG(e,t,r){switch(e._tag){case\"Declaration\":{let n=e.typeParameters.map(u=>oo(t(hn(u)))),o=e.annotations?.toCodecStringTree;if(Zr(o)){let u=o(n);return u===void 0?e:We(e,[Eu(u,t)])}let s=e.annotations?.toCodecJson,a=Zr(s)?s(n):void 0,i=a===void 0?e.annotations?.toCodec:void 0,c=a??(Zr(i)?i(n):void 0);return c===void 0?r(e):We(e,[Eu(c,t)])}case\"Null\":return We(e,[yG]);case\"Boolean\":return We(e,[SG]);case\"Unknown\":case\"ObjectKeyword\":return We(e,[YI]);case\"Enum\":case\"Number\":case\"Literal\":case\"UniqueSymbol\":case\"Symbol\":case\"BigInt\":return e.toCodecStringTree();case\"Objects\":return tN(e),e.recur(t,Hh);case\"Union\":{let n=xG(e.types);return n!==e.types?new zr(n,e.options,e.annotations,e.checks,e.encoding,e.context,e.encodingChecks).recur(t):e.recur(t)}case\"Arrays\":case\"Suspend\":return e.recur(t)}return e}var yG=new at(new dn(\"null\"),new ve(oe(()=>null),oe(()=>\"null\"))),SG=new at(new zr([new dn(\"true\"),new dn(\"false\")]),new ve(oe(e=>e===\"true\"),_i())),sN=new ve(oe(e=>typeof e==\"string\"?[e]:e),jr()),aN=e=>e.transformation===sN,iN=Fi(e=>{let t=gG(e,iN,r=>{throw new globalThis.Error(\"Missing structural codec for StringTree\",{cause:r})});return t!==e&&e.context!==void 0?zh(t,hT(e.context)):t},{stopAt:aN}),eN=e=>Qt(e)?Ni(eo):eo,cN=Fi(e=>{let t=bG(e);if(AI(t)){let r=ga(new zr([new Pn(t.isMutable,t.elements.map(eN),t.rest.map(eN)),pn],{mode:\"anyOf\"}),t,sN);return Qt(e)?Ni(r):r}return t},{stopAt:aN});function bG(e){return e._tag===\"Declaration\"||e._tag===\"Arrays\"||e._tag===\"Objects\"||e._tag===\"Union\"||e._tag===\"Suspend\"?e.recur(cN):e}var Cie=globalThis.RegExp;var ks=e=>e.replace(/[/\\\\^$*+?.()|[\\]{}]/g,\"\\\\$&\");function ya(e,t){return t.length>0&&(e+=`\n  at ${pd(t)}`),new Error(e)}function uN(e){return`#/$defs/${lT(e)}`}var EG=new Set([...EP,vi,...bP]);function pp(e,t){if(e===void 0)return;let r={},n=e.title;typeof n==\"string\"&&(r.title=n);let o=e.description,s=e.expected;typeof o==\"string\"?r.description=o:t?.generateDescriptions===!0&&typeof s==\"string\"&&(r.description=s);let a=e.default;Iu(a)&&(r.default=a);let i=e.examples;Array.isArray(i)&&Iu(i)&&(r.examples=i);let c=e.readOnly;typeof c==\"boolean\"&&(r.readOnly=c);let u=e.writeOnly;typeof u==\"boolean\"&&(r.writeOnly=u);let f=e.format;typeof f==\"string\"&&(r.format=f);let p=e.contentEncoding;typeof p==\"string\"&&(r.contentEncoding=p);let d=e.contentMediaType;typeof d==\"string\"&&(r.contentMediaType=d);let m=e.contentSchema;if(Iu(m)&&(r.contentSchema=m),t?.includeAnnotationKey!==void 0)for(let[x,y]of Object.entries(e))EG.has(x)||!t.includeAnnotationKey(x)||Iu(y)&&M(r,x,y);return Object.keys(r).length===0?void 0:r}function lN(e){let t=e.type===\"number\"||e.type===\"integer\"?e.type:void 0,r=e;if(t!==void 0&&(r={...e},delete r.type),Array.isArray(r.allOf)){let n=[],o=!1;for(let s of r.allOf){let a=lN(s);a.type!==void 0&&(o=!0,(t===void 0||a.type===\"integer\")&&(t=a.type)),Object.keys(a.schema).length>0&&n.push(a.schema)}if(o){let{allOf:s,...a}=r;r=n.length===0?a:{...a,allOf:n}}}return{type:t,schema:r}}function IG(e){if(!Array.isArray(e.anyOf)||e.anyOf.length!==2||e.anyOf[0]?.type!==\"number\")return!1;let t=e.anyOf[1];return t?.type===\"string\"&&Array.isArray(t.enum)&&t.enum.length===3&&t.enum.includes(\"NaN\")&&t.enum.includes(\"Infinity\")&&t.enum.includes(\"-Infinity\")}var pN=\"|type|format|pattern|multipleOf|minimum|maximum|exclusiveMinimum|exclusiveMaximum|minLength|maxLength|minItems|maxItems|uniqueItems|minProperties|maxProperties|propertyNames|\";function sx(e,t){return Object.keys(e).every(r=>t.includes(`|${r}|`))}function fN(e,t){return typeof e.$ref!=\"string\"&&t.every(r=>!Object.hasOwn(e,r))}var yT=\"|title|description|default|examples|readOnly|writeOnly|\",TG=pN+yT;function dp(e,t,r){if(Object.keys(e).length===0)return t;let n=Object.keys(t);if(n.length===0)return e;let o=e.type===\"number\"||e.type===\"integer\"?e.type:void 0,s=IG(e);if(o!==void 0||s){let i=lN(t);if(i.type!==void 0){let c=o===\"integer\"||i.type===\"integer\"?\"integer\":\"number\",u={...e,type:c};s&&delete u.anyOf;let f=Object.keys(i.schema);return f.length===0?u:sx(i.schema,yT)&&fN(u,f)?{...u,...i.schema}:dp(u,i.schema,r)}}if(r&&fN(e,n))return{...e,...t};let a=Array.isArray(t.allOf)&&n.length===1?t.allOf:[t];return Array.isArray(e.allOf)?{...e,allOf:[...e.allOf,...a]}:typeof e.$ref==\"string\"?{allOf:[e,...a]}:{...e,allOf:a}}function gT(e,t=new Set){return typeof e==\"boolean\"?e:t.has(e)?!0:(t.add(e),e.every(r=>gT(r,t)))}function wG(e){return Array.isArray(e)}function CG(e,t,r,n){let o=new Map,s=new Map,a=new WeakMap,i=new Map,c=new Map,u=Object.keys(r);for(let h of u)x(h,[\"references\",h]);let f=wn(e,(h,b)=>E(h,t[b],[]));for(let[h,b]of i.values())if(!gT(h))for(let T of b)Array.isArray(T.oneOf)&&(T.anyOf=T.oneOf,delete T.oneOf);for(let h of u){let b=r[h],T=S(b);if(T===void 0)continue;let C=o.get(h)[0],L=c.get(T),ee=L?.find(ye=>J(o.get(ye)[0],C));ee===void 0?L===void 0?c.set(T,[h]):L.push(h):s.set(h,ee)}let p=wn(f,y),d={};for(let h of u)s.has(h)||M(d,h,y(o.get(h)[0]));return{dialect:\"draft-2020-12\",schemas:p,definitions:d};function m(h){return Array.isArray(h.oneOf)&&i.get(h.oneOf)?.[1].push(h),h}function x(h,b){if(!Object.hasOwn(r,h))throw ya(`Invalid reference ${h}`,[...b,\"$ref\"]);let T=o.get(h);if(T!==void 0)return T;let C=[{},[]];return o.set(h,C),C[0]=E(r[h],[\"references\",h],C[1]),C}function y(h){return VF(h,b=>{let T=pT(b);if(T===void 0){if(/^#(?:\\/|%2f)/i.test(b))throw new Error(`Invalid JSON Pointer URI fragment ${JSON.stringify(b)}`);return b}if(!T.startsWith(\"/$defs/\"))return b;let C=T.indexOf(\"/\",7),L=s.get(fp(T.slice(7,C<0?void 0:C)));return L===void 0?b:b.replace(/^#(?:\\/|%2f).*?(?:\\/|%2f).*?(?=\\/|%2f|$)/i,uN(L))})}function S(h){if(h._tag===\"Reference\")return;let b=h.checks.length===0?h.annotations:h.checks[h.checks.length-1].annotations;return typeof b?.identifier!=\"string\"&&typeof b?.[vi]==\"string\"?b[vi]:void 0}function w(h,b,T,C){let L=h.annotations,ee=L?.toJsonSchema;if(ee!==void 0){let Ze=h.representation?.schemas?.map((gf,X$)=>E(gf,[...T,\"representation\",\"schemas\",X$],C))??[],Ls=ee({type:b,schemas:Ze}),et=wG(Ls);et&&C.push(!1);let zt=et?Ls[0]:Ls,ur=pp(L,n),ss=ur===void 0?zt:{...zt,...ur},_a=ur===void 0?pN:TG;return[ss,h._tag===\"Filter\"&&sx(ss,_a)&&(ur===void 0||sx(ur,yT))?!0:void 0]}if(h._tag===\"Filter\"){C.push(!1);return}let ye=h.checks.flatMap((Ze,Ls)=>{let et=w(Ze,b,[...T,\"checks\",Ls],C);return et===void 0?[]:[et[0]]});if(ye.length===0)return;let _e=pp(L,n),Et={allOf:ye};return[_e===void 0?Et:{...Et,..._e}]}function E(h,b,T){if(h._tag===\"Reference\")return T.push(x(h.$ref,b)[1]),{$ref:uN(h.$ref)};let C=a.get(h);if(C!==void 0)return T.push(C[1]),C[0];let L=[];T.push(L);let ee=U(h,b,L),ye=pp(h.annotations,n);ye!==void 0&&(ee={...ee,...ye});for(let _e=0;_e<h.checks.length;_e++){let Et=typeof ee.type==\"string\"&&AG(ee.type)?ee.type:void 0,Ze=w(h.checks[_e],Et,[...b,\"checks\",_e],L);Ze!==void 0&&(ee=dp(ee,...Ze))}return a.set(h,[ee,L]),m(ee)}function U(h,b,T){switch(h._tag){case\"Any\":case\"Unknown\":return{};case\"ObjectKeyword\":return{anyOf:[{type:\"object\"},{type:\"array\"}]};case\"Void\":case\"Undefined\":case\"Null\":return{type:\"null\"};case\"BigInt\":return{type:\"string\",allOf:[{pattern:\"^-?\\\\d+$\"}]};case\"Symbol\":return{type:\"string\",allOf:[{pattern:\"^Symbol\\\\(([\\\\s\\\\S]*)\\\\)$\"}]};case\"UniqueSymbol\":return globalThis.Symbol.keyFor(h.symbol)===void 0?{not:{}}:{type:\"string\",enum:[globalThis.String(h.symbol)]};case\"Declaration\":return T.push(!1),{};case\"Suspend\":return E(h.thunk,[...b,\"thunk\"],T);case\"Never\":return{not:{}};case\"String\":return{type:\"string\"};case\"Number\":return{anyOf:[{type:\"number\"},{type:\"string\",enum:[\"NaN\",\"Infinity\",\"-Infinity\"]}]};case\"Boolean\":return{type:\"boolean\"};case\"Literal\":{let C=h.literal;return typeof C==\"bigint\"?{type:\"string\",enum:[globalThis.String(C)]}:{type:typeof C,enum:[C]}}case\"Enum\":{let C=h.enums.map(([L,ee],ye)=>{if(typeof ee==\"number\"&&!globalThis.Number.isFinite(ee))throw ya(`Invalid numeric enum value ${globalThis.String(ee)}`,[...b,\"enums\",ye,1]);return{type:typeof ee,enum:[ee],title:L}});return C.length===0?{not:{}}:{anyOf:C}}case\"TemplateLiteral\":return{type:\"string\",pattern:`^${h.parts.map(ax).join(\"\")}$`};case\"Arrays\":{if(h.rest.length>1)throw ya(\"Invalid schema representation document\",[...b,\"rest\"]);let C={type:\"array\"},L=h.elements.length,ee=h.elements.map((ye,_e)=>{ye.isOptional&&L--;let Et=E(ye.type,[...b,\"elements\",_e,\"type\"],T),Ze=pp(ye.annotations,n);return Ze===void 0?Et:m(dp(Et,Ze))});if(ee.length>0?(C.prefixItems=ee,C.maxItems=h.elements.length,L>0&&(C.minItems=L)):C.items=!1,h.rest.length===1){delete C.maxItems;let ye=E(h.rest[0],[...b,\"rest\",0],T);Object.keys(ye).length>0?C.items=ye:delete C.items}return C}case\"Objects\":{if(h.propertySignatures.length===0&&h.indexSignatures.length===0)return{not:{type:\"null\"}};let C={type:\"object\"},L={},ee=[];for(let et=0;et<h.propertySignatures.length;et++){let zt=h.propertySignatures[et];if(typeof zt.name!=\"string\")throw ya(\"Invalid schema representation document\",[...b,\"propertySignatures\",et,\"name\"]);let ur=zt.name,ss=E(zt.type,[...b,\"propertySignatures\",et,\"type\"],T),_a=pp(zt.annotations,n);M(L,ur,_a===void 0?ss:m(dp(ss,_a))),zt.isOptional||ee.push(ur)}h.propertySignatures.length>0&&(C.properties=L),ee.length>0&&(C.required=ee);let ye={},_e=[],Et=[],Ze=!1;for(let et=0;et<h.indexSignatures.length;et++){let zt=h.indexSignatures[et],ur=E(zt.type,[...b,\"indexSignatures\",et,\"type\"],T);J(ur,{not:{}})&&(ur=!1),Et.push(ur);let ss=_(zt.parameter,[...b,\"indexSignatures\",et,\"parameter\"],new Set);if(ss===void 0){Ze=!0,T.push(!1);continue}if(ss.length===0)_e.push(ur);else for(let _a of ss){let gf=ye[_a];M(ye,_a,gf===void 0?ur:gf===!1||ur===!1?!1:m(dp(gf,ur)))}}let Ls=Object.keys(ye).length>0;if(Ls&&(C.patternProperties=ye),Ze&&n?.onExcessProperty===\"error\"){let et=[];h.propertySignatures.length>0&&et.push({enum:Object.keys(L)});for(let zt=0;zt<h.indexSignatures.length;zt++)et.push(E(h.indexSignatures[zt].parameter,[...b,\"indexSignatures\",zt,\"parameter\"],T));C.propertyNames=et.length===1?et[0]:{anyOf:et},C.additionalProperties=Et.length===1?Et[0]:{anyOf:Et},_e.length>0&&(C.allOf=_e.map(zt=>({type:\"object\",additionalProperties:zt})))}else _e.length===0?C.additionalProperties=Ze||n?.onExcessProperty!==\"error\":_e.length===1&&h.propertySignatures.length===0&&!Ls?C.additionalProperties=_e[0]:_e.length>0&&(C.allOf=_e.map(et=>({type:\"object\",additionalProperties:et})));return typeof C.additionalProperties==\"object\"&&C.additionalProperties!==null&&Object.keys(C.additionalProperties).length===0&&delete C.additionalProperties,C}case\"Union\":{let C=[],L=h.types.map((ye,_e)=>E(ye,[...b,\"types\",_e],C));if(T.push(C),L.length===0)return{not:{}};let ee=h.options?.mode??\"anyOf\";if(ee===\"anyOf\"&&L.length>1){let ye=kG(L);if(ye!==void 0)return ye}return ee===\"oneOf\"&&i.set(L,[C,[]]),{[ee]:L}}}}function _(h,b,T){switch(h._tag){case\"Reference\":{if(!Object.hasOwn(r,h.$ref))throw ya(`Invalid reference ${h.$ref}`,[...b,\"$ref\"]);if(x(h.$ref,b),T.has(h.$ref))return;let C=new Set(T).add(h.$ref);return _(r[h.$ref],[\"references\",h.$ref],C)}case\"String\":{if(h.checks.length===0)return[];if(h.checks.length!==1||h.checks[0]._tag!==\"Filter\"||h.checks[0].annotations?.toJsonSchema===void 0)return;let C=[],L=E(h,b,C);return gT(C)&&L.type===\"string\"&&typeof L.pattern==\"string\"&&sx(L,\"|type|pattern|title|description|default|examples|readOnly|writeOnly|\")?[L.pattern]:void 0}case\"TemplateLiteral\":return h.checks.length===0?[`^${h.parts.map(ax).join(\"\")}$`]:void 0;case\"Union\":{if(h.types.length===0||h.checks.length>0||h.options?.mode===\"oneOf\")return;let C=[];for(let L=0;L<h.types.length;L++){let ee=_(h.types[L],[...b,\"types\",L],T);if(ee===void 0)return;if(ee.length===0)return[];C.push(...ee)}return C}default:throw ya(\"Invalid schema representation document\",b)}}}function AG(e){return e===\"string\"||e===\"number\"||e===\"boolean\"||e===\"array\"||e===\"object\"||e===\"null\"||e===\"integer\"}function kG(e){let t,r=[];for(let n of e){if(Object.keys(n).length!==2||n.type===void 0||!Array.isArray(n.enum)||n.enum.length===0)return;if(t===void 0)t=n.type;else if(n.type!==t)return;for(let s of n.enum){if(r.includes(s))return;r.push(s)}}return{type:t,enum:r}}function ax(e){switch(e._tag){case\"Literal\":return ks(globalThis.String(e.literal));case\"String\":return mF;case\"Number\":return Dh;case\"TemplateLiteral\":return e.parts.map(ax).join(\"\");case\"Union\":return`(?:${e.types.map(ax).join(\"|\")})`;default:throw ya(\"Invalid schema representation document\",[])}}function ix(e,t){let r=CG([e.representation],[[\"representation\"]],e.references,t);return{dialect:r.dialect,schema:r.schemas[0],definitions:r.definitions}}var vG=({identifier:e})=>e;function so(e){return e===void 0?void 0:{annotations:e}}function mp(e,t){let{references:r,representations:n}=OG([e],t);return{representation:n[0],references:r}}function OG(e,t){let r={},n=new Map,o=new Set,s=new Map,a=new Set;for(let h of e)m(h);let i=t?.referencePolicy??vG;for(let h of s.values())for(let b of h.values()){let T=i({ast:b.ast,occurrences:b.occurrences,identifier:b.identifier});if(T!==void 0){let C=T===b.identifier||!T.endsWith(\"_\")?\"_\":\"\";b.reference=u(T,b,C)}else b.isRecursive&&(b.reference=u(`${b.ast._tag}_`,b,\"\"))}return{representations:wn(e,h=>y(h)),references:r};function u(h,b,T=\"_\"){let C=h,L=0;for(;n.has(C);){if(n.get(C)===b)return C;C=`${h}${T}${++L}`}return n.set(C,b),C}function f(h,b,T){let C=b.fallback;return C!==void 0?XE(h)===C?h:to(h,{[vi]:C}):T===b.identifier?h:to(h,{identifier:T})}function p(h,b){if(!Object.hasOwn(r,h)&&!o.has(h)){o.add(h);let T=S(b);o.delete(h),M(r,h,T)}return{_tag:\"Reference\",$ref:h}}function d(h){let b=bu(h),T=Su(b),C=iu(b),L=C===void 0?(b!==h?iu(h):void 0)??XE(b):void 0;L!==void 0&&(C=`${L}Encoded`);let ee=s.get(T);ee===void 0&&(ee=new Map,s.set(T,ee));let ye=ee.get(C);return ye===void 0&&(ye={ast:T,identifier:C,fallback:L,occurrences:0,isRecursive:!1,reference:void 0},ee.set(C,ye)),ye}function m(h){let b=d(h),T=b.ast;if(b.occurrences++,a.has(b)){b.isRecursive=!0;return}if(!(b.occurrences>1)){switch(a.add(b),x(T.checks),T._tag){case\"Declaration\":case\"Arrays\":case\"Objects\":case\"Union\":T.recur(C=>(m(C),C));break;case\"TemplateLiteral\":T.parts.forEach(m);break;case\"Suspend\":m(T.thunk());break}a.delete(b)}}function x(h){h?.forEach(b=>{b.annotations?.representation?.schemas?.forEach(T=>m(yt(T))),b._tag===\"FilterGroup\"&&x(b.checks)})}function y(h){let b=d(h),T=b.ast,C=b.reference;if(C!==void 0){let L=b.identifier===void 0?T:f(T,b,C);return p(C,L)}return S(T)}function S(h){let b=w(h.checks);switch(h._tag){case\"Declaration\":return{_tag:\"Declaration\",typeParameters:h.typeParameters.map(T=>y(T)),checks:b,...U(h.annotations)};case\"Null\":case\"Undefined\":case\"Void\":case\"Never\":case\"Unknown\":case\"Any\":case\"String\":case\"Boolean\":case\"Number\":case\"BigInt\":case\"Symbol\":case\"ObjectKeyword\":return{_tag:h._tag,checks:b,...so(h.annotations)};case\"Literal\":return{_tag:\"Literal\",literal:h.literal,checks:b,...so(h.annotations)};case\"UniqueSymbol\":return{_tag:\"UniqueSymbol\",symbol:h.symbol,checks:b,...so(h.annotations)};case\"Enum\":return{_tag:\"Enum\",enums:h.enums,checks:b,...so(h.annotations)};case\"TemplateLiteral\":return{_tag:\"TemplateLiteral\",parts:h.parts.map(T=>y(T)),checks:b,...so(h.annotations)};case\"Arrays\":return{_tag:\"Arrays\",elements:h.elements.map(T=>{let C=bu(T),L=C.context?.annotations;return{isOptional:Qt(C),type:y(T),...so(L)}}),rest:h.rest.map(T=>y(T)),checks:b,...so(h.annotations)};case\"Objects\":return{_tag:\"Objects\",propertySignatures:h.propertySignatures.map(T=>{let C=bu(T.type),L=C.context?.annotations;return{name:T.name,type:y(T.type),isOptional:Qt(C),isMutable:fF(C),...so(L)}}),indexSignatures:h.indexSignatures.map(T=>({parameter:y(T.parameter),type:y(T.type)})),checks:b,...so(h.annotations)};case\"Union\":return{_tag:\"Union\",types:h.types.map(T=>y(T)),...h.options===void 0?{}:{options:h.options},checks:b,...so(h.annotations)};case\"Suspend\":return{_tag:\"Suspend\",checks:[],thunk:y(h.thunk()),...so(h.annotations)}}}function w(h){return h?.map(E)??[]}function E(h){switch(h._tag){case\"Filter\":return{_tag:\"Filter\",aborted:h.aborted,..._(h.annotations)};case\"FilterGroup\":return{_tag:\"FilterGroup\",checks:wn(h.checks,E),..._(h.annotations)}}}function U(h){if(h===void 0)return;let{representation:b,...T}=h;return{...b===void 0?void 0:{representation:b},...Object.keys(T).length===0?void 0:{annotations:T}}}function _(h){if(h===void 0)return;let{representation:b,...T}=h,C=b===void 0?void 0:b.schemas===void 0?b:{...b,schemas:b.schemas.map(L=>y(yt(L)))};return{...C===void 0?void 0:{representation:C},...Object.keys(T).length===0?void 0:{annotations:T}}}}function hN(e){return Ve(e)?e.value:{issues:[{message:cb(e.cause)}]}}function gN(e,t){let r=nt(e),n={errors:\"all\",...t?.parseOptions},o=OP(t),s=a=>{let i=new Qa(\"sync\"),c=Nl(Zb(r(a,n),{onFailure:o,onSuccess:f=>({value:f})}),{scheduler:i});c.currentDispatcher?.flush();let u=c.pollUnsafe();return u?hN(u):new Promise(f=>{c.addObserver(p=>{f(hN(p))})})};if(Object.hasOwn(e,\"~standard\")){let a=e;return\"validate\"in a[\"~standard\"]||Object.assign(a[\"~standard\"],{validate:s}),a}return Object.assign(e,{\"~standard\":{version:1,vendor:\"effect\",validate:s}})}function _G(e){let t=mp(Cu(e));return ix(t)}function xN(e,t){let r=_G(e);if(t===\"draft-2020-12\"){let n=r.schema;return Object.keys(r.definitions).length>0&&(n.$defs=r.definitions),n}else if(t===\"draft-07\"){let n=GF(r),o=n.schema;return Object.keys(n.definitions).length>0&&(o.definitions=n.definitions),o}throw new globalThis.Error(`Unsupported target: ${t}`)}function yN(e){let t={input(r){return xN(e.ast,r.target)},output(r){return xN(yt(e.ast),r.target)}};if(Object.hasOwn(e,\"~standard\")){let r=e;return\"jsonSchema\"in r[\"~standard\"]||Object.assign(r[\"~standard\"],{jsonSchema:t}),r}return Object.assign(e,{\"~standard\":{version:1,vendor:\"effect\",jsonSchema:t}})}function bN(e,t){let r=[];return ST(e,t,\"\",r),r}function ST(e,t,r,n){if(!Object.is(e,t)){if(Array.isArray(e)&&Array.isArray(t)){let o=e.length,s=t.length,a=Math.min(o,s);for(let i=0;i<a;i++)ST(e[i],t[i],`${r}/${i}`,n);for(let i=o-1;i>=s;i--)n.push({op:\"remove\",path:`${r}/${i}`});for(let i=o;i<s;i++)n.push({op:\"add\",path:`${r}/${i}`,value:t[i]});return}if(cx(e)&&cx(t)){let o=Object.keys(e),s=Object.keys(t),a=Array.from(new Set([...o,...s])).sort();for(let i of a){let c=`${r}/${fT(i)}`,u=Object.hasOwn(e,i),f=Object.hasOwn(t,i);u&&f?ST(e[i],t[i],c,n):!u&&f?n.push({op:\"add\",path:c,value:t[i]}):n.push({op:\"remove\",path:c})}return}n.push({op:\"replace\",path:r,value:t})}}function EN(e,t){let r=t;for(let n of e)r=MG(r,n);return r}function cx(e){return typeof e==\"object\"&&e!==null&&!Array.isArray(e)}function PG(e){if(e===\"\")return[];if(e.charCodeAt(0)!==47)throw new Error(`Invalid JSON Pointer, it must start with \"/\": ${JSON.stringify(e)}`);return e.split(\"/\").slice(1).map(fp)}function IN(e){if(!/^(0|[1-9]\\d*)$/.test(e))throw new Error(`Invalid array index: \"${e}\"`);return Number(e)}function MG(e,t){if(t.path===\"\"){if(t.op===\"remove\")throw new Error(\"Unsupported operation at the root\");return t.value}let r=FG(e,t.path);if(r===null)throw new Error(`Cannot ${t.op} at \"${t.path}\" (parent not found or not a container).`);let{lastToken:n,parent:o,stack:s}=r;if(Array.isArray(o)){if(n===\"-\"&&t.op!==\"add\")throw new Error(`\"-\" is not valid for ${t.op} at \"${t.path}\".`);let a=n===\"-\"?o.length:IN(n),i=t.op===\"add\"?o.length:o.length-1;if(a>i)throw new Error(`Array index out of bounds at \"${t.path}\".`);let c=o.slice();return t.op===\"add\"?c.splice(a,0,t.value):t.op===\"remove\"?c.splice(a,1):c[a]=t.value,SN(s,c)}if(cx(o)){if(t.op!==\"add\"&&!Object.hasOwn(o,n))throw new Error(`Property \"${n}\" does not exist at \"${t.path}\".`);let a={...o};return t.op===\"remove\"?delete a[n]:M(a,n,t.value),SN(s,a)}throw new Error(`Cannot ${t.op} at \"${t.path}\" (parent not found or not a container).`)}function FG(e,t){let r=PG(t);if(r.length===0)return null;let n=r[r.length-1],o=[],s=e;for(let a=0;a<r.length-1;a++){let i=r[a];if(Array.isArray(s)){let c=IN(i);if(c>=s.length)return null;o.push({container:s,token:c}),s=s[c];continue}if(cx(s)){if(!Object.hasOwn(s,i))return null;o.push({container:s,token:i}),s=s[i];continue}return null}return{stack:o,parent:s,lastToken:n}}function SN(e,t){let r=t;for(let n=e.length-1;n>=0;n--){let{container:o,token:s}=e[n];if(Array.isArray(o)){let a=o.slice();a[s]=r,r=a}else{let a={...o};M(a,s,r),r=a}}return r}function wN(e){let t=rx(e),r=Xh(t),n=Qh(t);return{empty:[],diff:(o,s)=>bN(r(o),r(s)),combine:(o,s)=>[...o,...s],patch:(o,s)=>{let a=r(o),i=EN(s,a);return Object.is(i,a)?o:n(i)}}}function CN(e,t){let r=iu(e.ast)??eI(e.ast),n=MF(ox(e));return o=>n(o).pipe(j(s=>UG(s,{rootName:r,...t})))}function UG(e,t){let r=t.rootName??\"root\",n=t.arrayItemName??\"item\",o=t.pretty??!0,s=t.indent??\"  \",a=t.sortKeys??!0,i=new Set,c=[];return f(r,e,0),c.join(o?`\n`:\"\");function u(p,d){c.push(o?s.repeat(p)+d:d)}function f(p,d,m,x){let{attrs:y,safe:S}=Au.tagInfo(p,x);if(d===void 0)u(m,`<${S}${y}/>`);else if(typeof d==\"string\")u(m,`<${S}${y}>${Au.escapeText(d)}</${S}>`);else if(typeof d!=\"object\"||d===null)u(m,`<${S}${y}>${Au.escapeText(F(d))}</${S}>`);else{if(i.has(d))throw new globalThis.Error(\"Cycle detected while serializing to XML.\",{cause:d});i.add(d);try{if(globalThis.Array.isArray(d)){if(d.length===0){u(m,`<${S}${y}/>`);return}u(m,`<${S}${y}>`);for(let U of d)f(n,U,m+1);u(m,`</${S}>`);return}let w=d,E=Object.keys(w);if(a&&E.sort(),E.length===0){u(m,`<${S}${y}/>`);return}u(m,`<${S}${y}>`);for(let U of E)f(Au.parseTagName(U).safe,w[U],m+1,U);u(m,`</${S}>`)}finally{i.delete(d)}}}}var Au={escapeText(e){return e.replace(/&/g,\"&amp;\").replace(/</g,\"&lt;\").replace(/>/g,\"&gt;\")},escapeAttribute(e){return e.replace(/&/g,\"&amp;\").replace(/\"/g,\"&quot;\").replace(/</g,\"&lt;\").replace(/>/g,\"&gt;\")},parseTagName(e){let t=e,r=e;return/^[A-Za-z_]/.test(r)||(r=\"_\"+r),r=r.replace(/[^A-Za-z0-9._-]/g,\"_\"),/^xml/i.test(r)&&(r=\"_\"+r),{safe:r,changed:r!==t}},tagInfo(e,t){let{changed:r,safe:n}=Au.parseTagName(e),s=r||t&&t!==e?` data-name=\"${Au.escapeAttribute(t??e)}\"`:\"\";return{safe:n,attrs:s}}};var bT=Vr(e=>Sa(e));function Sa(e){let t=As(e)?.toEquivalence;if(t)return t(gu(e)?e.typeParameters.map(Sa):[]);switch(e._tag){case\"Never\":return Ja();case\"Declaration\":return LG(e);case\"Null\":case\"Undefined\":case\"Void\":case\"Unknown\":case\"Any\":case\"String\":case\"Number\":case\"Boolean\":case\"BigInt\":case\"Symbol\":case\"Literal\":case\"UniqueSymbol\":case\"ObjectKeyword\":case\"Enum\":case\"TemplateLiteral\":return J;case\"Arrays\":{let r=e.elements.map(Sa),n=e.rest.map(Sa),[o,...s]=n,a=s.length;return nr((i,c)=>{if(!Array.isArray(i)||!Array.isArray(c))return!1;let u=i.length;if(u!==c.length)return!1;let f=0;for(;f<Math.min(u,e.elements.length);f++)if(!r[f](i[f],c[f]))return!1;if(n.length>0){for(;f<u-a;f++)if(!o(i[f],c[f]))return!1;for(let p=0;p<a;p++)if(!s[p](i[f+p],c[f+p]))return!1}return!0})}case\"Objects\":{if(e.propertySignatures.length===0&&e.indexSignatures.length===0)return J;let r=e.propertySignatures.map(o=>Sa(o.type)),n=e.indexSignatures.map(o=>Sa(o.type));return nr((o,s)=>{if(!fr(o)||!fr(s))return!1;for(let a=0;a<r.length;a++){let i=e.propertySignatures[a],c=i.name,u=Object.hasOwn(o,c),f=Object.hasOwn(s,c);if(Qt(i.type)&&u!==f||u&&f&&!r[a](o[c],s[c]))return!1}for(let a=0;a<n.length;a++){let i=e.indexSignatures[a],c=ha(o,i.parameter),u=ha(s,i.parameter);if(c.length!==u.length)return!1;for(let f=0;f<c.length;f++){let p=c[f];if(!Object.hasOwn(s,p)||!n[a](o[p],s[p]))return!1}}return!0})}case\"Union\":{let r=yt(e).types,n=sp(r),o=r.map((s,a)=>[Ui(s),Sa(e.types[a])]);return nr((s,a)=>{let i=n(s,!1);for(let c=0;c<i.length;c++){let[u,f]=o[i[c]];if(u(s)&&u(a))return f(s,a)}return!1})}case\"Suspend\":{let r;return nr((n,o)=>(r??=bT(e.thunk()))(n,o))}}}function LG(e){let t=e.annotations?.representation;if(t===void 0)return J;switch(t.id){case\"effect/schema/Option\":{let[r]=$i(e);return(n,o)=>n._tag===o._tag&&(n._tag===\"None\"||r(n.value,o.value))}case\"effect/schema/Result\":{let[r,n]=$i(e);return(o,s)=>o._tag===s._tag&&(o._tag===\"Success\"?r(o.success,s.success):n(o.failure,s.failure))}case\"effect/schema/CauseReason\":{let[r,n]=$i(e);return kN(r,n)}case\"effect/schema/Cause\":{let[r,n]=$i(e);return AN(r,n)}case\"effect/schema/Exit\":{let[r,n,o]=$i(e),s=AN(n,o);return(a,i)=>a._tag===i._tag&&(a._tag===\"Success\"?r(a.value,i.value):s(a.cause,i.cause))}case\"effect/schema/ReadonlyMap\":{let[r,n]=$i(e);return ld(r,n)}case\"effect/schema/ReadonlySet\":return wf($i(e)[0]);case\"effect/schema/RegExp\":return(r,n)=>r.source===n.source&&r.flags===n.flags;case\"effect/schema/URL\":return(r,n)=>r.toString()===n.toString();default:return J}}function $i(e){return e.typeParameters.map(Sa)}function kN(e,t){return(r,n)=>{if(r._tag!==n._tag)return!1;switch(r._tag){case\"Fail\":return e(r.error,n.error);case\"Die\":return t(r.defect,n.defect);case\"Interrupt\":return r.fiberId===n.fiberId}}}function AN(e,t){let r=Sd(kN(e,t));return(n,o)=>r(n.reasons,o.reasons)}function ON(e,t){return r=>{switch(r._tag){case\"Fail\":return`Fail(${e(r.error)})`;case\"Die\":return`Die(${t(r.defect)})`;case\"Interrupt\":return\"Interrupt\"}}}function vN(e,t){let r=ON(e,t);return n=>`Cause([${n.reasons.map(r).join(\", \")}])`}function _N(e,t){let r=new Map;return n(e);function n(a){let i=r.get(a);return i===void 0&&(i=o(a),r.set(a,i)),i}function o(a){let i=As(a)?.toFormatter;if(typeof i==\"function\")return i(gu(a)?a.typeParameters.map(n):[]);if(t?.onBefore){let c=t.onBefore(a,n);if(c!==void 0)return c}return s(a)}function s(a){switch(a._tag){default:return F;case\"Never\":return()=>\"never\";case\"Void\":return()=>\"void\";case\"Declaration\":{let i=a.annotations?.representation;if(i===void 0)return F;let c=a.typeParameters.map(n);switch(i.id){case\"effect/schema/Option\":{let[u]=c;return Wt({onNone:()=>\"none()\",onSome:f=>`some(${u(f)})`})}case\"effect/schema/Result\":{let[u,f]=c;return wr({onSuccess:p=>`success(${u(p)})`,onFailure:p=>`failure(${f(p)})`})}case\"effect/schema/CauseReason\":return ON(c[0],c[1]);case\"effect/schema/Cause\":return vN(c[0],c[1]);case\"effect/schema/Exit\":{let[u,f,p]=c,d=vN(f,p);return m=>{switch(m._tag){case\"Success\":return`Exit.Success(${u(m.value)})`;case\"Failure\":return`Exit.Failure(${d(m.cause)})`}}}case\"effect/schema/ReadonlyMap\":{let[u,f]=c;return p=>{let d=p.size;if(d===0)return\"ReadonlyMap(0) {}\";let m=globalThis.Array.from(p.entries()).sort().map(([x,y])=>`${u(x)} => ${f(y)}`);return`ReadonlyMap(${d}) { ${m.join(\", \")} }`}}case\"effect/schema/HashMap\":{let[u,f]=c;return p=>{let d=VR(p);if(d===0)return\"HashMap(0) {}\";let m=zl(p).sort().map(([x,y])=>`${u(x)} => ${f(y)}`);return`HashMap(${d}) { ${m.join(\", \")} }`}}case\"effect/schema/ReadonlySet\":{let[u]=c;return f=>{let p=f.size;if(p===0)return\"ReadonlySet(0) {}\";let d=globalThis.Array.from(f.values()).sort().map(m=>`${u(m)}`);return`ReadonlySet(${p}) { ${d.join(\", \")} }`}}case\"effect/schema/HashSet\":{let[u]=c;return f=>{let p=eP(f);if(p===0)return\"HashSet(0) {}\";let d=globalThis.Array.from(f).sort().map(m=>`${u(m)}`);return`HashSet(${p}) { ${d.join(\", \")} }`}}case\"effect/schema/Chunk\":{let[u]=c;return f=>{let p=IR(f);if(p===0)return\"Chunk(0) {}\";let d=globalThis.Array.from(f).sort().map(m=>`${u(m)}`);return`Chunk(${p}) { ${d.join(\", \")} }`}}default:return F}}case\"Arrays\":{let i=a.elements.map(d=>n(d)),c=a.rest.map(n),[u,...f]=c,p=f.length;return d=>{let m=[],x=0;for(;x<i.length;x++)if(d.length<x+1){if(Qt(a.elements[x]))continue}else m.push(i[x](d[x]));if(c.length>0){for(;x<d.length-p;x++)m.push(u(d[x]));for(let y=0;y<p;y++)m.push(f[y](d[x+y]))}return\"[\"+m.join(\", \")+\"]\"}}case\"Objects\":{let i=a.propertySignatures.map(u=>n(u.type)),c=a.indexSignatures.map(u=>n(u.type));return a.propertySignatures.length===0&&a.indexSignatures.length===0?F:u=>{let f=[],p=new Set;for(let d=0;d<i.length;d++){let m=a.propertySignatures[d],x=m.name;p.add(x),!(Qt(m.type)&&!Object.hasOwn(u,x))&&f.push(`${wo(x)}: ${i[d](u[x])}`)}for(let d=0;d<c.length;d++){let m=ha(u,a.indexSignatures[d].parameter);for(let x of m)p.has(x)||(p.add(x),f.push(`${wo(x)}: ${c[d](u[x])}`))}return f.length>0?\"{ \"+f.join(\", \")+\" }\":\"{}\"}}case\"Union\":{let i=yt(a).types,c=sp(i),u=i.map((f,p)=>[Ui(f),n(a.types[p])]);return f=>{let p=c(f,!1);for(let d=0;d<p.length;d++){let[m,x]=u[p[d]];if(m(f))return x(f)}return F(f)}}case\"Suspend\":{let i;return c=>(i??=n(a.thunk()))(c)}}}}var ET=l(2,(e,t)=>wT(e,(r,n)=>PN(t,r)?[r,n]:void 0)),IT=l(2,(e,t)=>wT(e,(r,n)=>PN(t,r)?void 0:[r,n])),RN=l(2,(e,t)=>({...e,...t}));var TT=l(2,(e,t)=>wT(e,(r,n)=>[Object.hasOwn(t,r)?t[r]:r,n]));var mr=e=>e;function PN(e,t){return e.some(r=>r===t||typeof r==\"number\"&&String(r)===t)}function wT(e,t){let r={};for(let n of Reflect.ownKeys(e)){if(!Object.prototype.propertyIsEnumerable.call(e,n))continue;let o=t(n,e[n]);if(o){let[s,a]=o;M(r,s,a)}}return r}function NN(e,t){return ao(ku(\"Iso\",e,t))}function MN(e,t){return ao(ku(\"Lens\",e,t))}function ku(e,t,r){return[{_tag:\"PrimitiveNode\",kind:e,get:t,set:r}]}var jG={kind:\"Iso\",get:R,set:R},ux=class{_tag=\"PathNode\";kind=\"Lens\";path;get;set;constructor(t){this.path=t,this.get=r=>{let n=r;for(let o=0;o<t.length;o++)n=n[t[o]];return n},this.set=(r,n)=>{let o=fx(n),s=o,a=0;for(;a<t.length-1;a++){let i=t[a];M(s,i,fx(s[i])),s=s[i]}return M(s,t[a],r),o}}},hp=class{_tag=\"CheckNode\";kind=\"Prism\";checks;get;set=R;constructor(t){this.checks=t,this.get=r=>gF(t,r)}};function Bi(e,t){if(e.length===0)return t;if(t.length===0)return e;let r=e.slice();for(let n=0;n<t.length;n++){let o=t[n],s=r[r.length-1];s._tag===\"PathNode\"&&o._tag===\"PathNode\"?r[r.length-1]=new ux([...s.path,...o.path]):s._tag===\"CheckNode\"&&o._tag===\"CheckNode\"?r[r.length-1]=new hp([...s.checks,...o.checks]):r.push(o)}return r}function zG(e,t){return ao(ku(\"Optional\",e,t))}var vu=class{node;getResult;replaceResult;constructor(t,r,n){this.node=t,this.getResult=r,this.replaceResult=n}replace(t,r){return Lf(this.replaceResult(t,r),()=>r)}modify(t){return r=>Lf(Lt(this.getResult(r),n=>this.replaceResult(t(n),r)),()=>r)}compose(t){return ao(Bi(this.node,t.node))}key(t){return ao(Bi(this.node,[new ux([t])]))}optionalKey(t){return ao(Bi(this.node,ku(\"Lens\",r=>r[t],(r,n)=>{let o=fx(n);return r===void 0?Array.isArray(o)&&(typeof t==\"number\"||typeof t==\"string\"&&Cc(t))?o.splice(Number(t),1):delete o[t]:M(o,t,r),o})))}check(...t){return ao(Bi(this.node,[new hp(t)]))}refine(t,r){return ao(Bi(this.node,[new hp([jh(t,r)])]))}tag(t){let r=W(new de({expected:`${JSON.stringify(t)} tag`}));return ao(Bi(this.node,ku(\"Prism\",n=>n._tag===t?B(n):r,R)))}at(t,...r){let n=W(new ut([t],new ma(void 0)));return ao(Bi(this.node,ku(\"Optional\",o=>Object.hasOwn(o,t)?B(o[t]):n,(o,s)=>{if(Object.hasOwn(s,t)){let a=fx(s);return M(a,t,o),B(a)}else return n})))}pick(t){return this.compose(MN(ET(t),(r,n)=>({...IT(n,t),...r})))}omit(t){return this.compose(MN(IT(t),(r,n)=>({...ET(n,t),...r})))}notUndefined(){return this.refine(Io,{expected:\"a value other than `undefined`\"})}forEach(t){let r=t(lx());return zG(n=>Tr(this.getResult(n),o=>{let s=[];for(let a=0;a<o.length;a++){let i=r.getResult(o[a]);mt(i)&&s.push(i.success)}return s}),(n,o)=>Lt(this.getResult(o),s=>{let a=[];for(let c=0;c<s.length;c++)mt(r.getResult(s[c]))&&a.push(c);if(n.length!==a.length)return W(new de({message:`each: replacement length mismatch: ${n.length} !== ${a.length}`}));let i=s.slice();for(let c=0;c<a.length;c++){let u=a[c],f=r.replaceResult(n[c],s[u]);if(ce(f))return W(new ut([u],f.failure));i[u]=f.success}return this.replaceResult(i,o)}))}modifyAll(t){return r=>Lf(Lt(this.getResult(r),n=>this.replaceResult(n.map(t),r)),()=>r)}},AT=class extends vu{get;set;constructor(t,r,n){super(t,o=>B(r(o)),o=>B(n(o))),this.get=r,this.set=n}replace(t,r){return this.set(t)}modify(t){return r=>this.set(t(this.get(r)))}},kT=class extends vu{get;constructor(t,r,n){super(t,o=>B(r(o)),(o,s)=>B(n(o,s))),this.get=r,this.replace=n}modify(t){return r=>this.replace(t(this.get(r)),r)}},vT=class extends vu{set;constructor(t,r,n){super(t,r,(o,s)=>B(n(o))),this.set=n}replace(t,r){return this.set(t)}modify(t){return r=>Lf(Tr(this.getResult(r),n=>this.set(t(n))),()=>r)}};function ao(e){let t=e[0]??jG;if(e.length>1){let r=e.reduce((n,o)=>WG(n,o.kind),\"Iso\");t={kind:r,get:qG(e,r),set:HG(e,r)}}switch(t.kind){case\"Iso\":return new AT(e,t.get,t.set);case\"Lens\":return new kT(e,t.get,t.set);case\"Prism\":return new vT(e,t.get,t.set);case\"Optional\":return new vu(e,t.get,t.set)}}function fx(e){if(Array.isArray(e))return e.slice();if(typeof e==\"object\"&&e!==null){let t=Object.getPrototypeOf(e);if(t!==Object.prototype&&t!==null)throw new Error(\"Cannot clone object with non-Object constructor or null prototype\");return{...e}}return e}function qG(e,t){return r=>{for(let n=0;n<e.length;n++){let o=e[n],s=o.get(r);if(OT(o.kind)){if(ce(s))return s;r=s.success}else r=s}return OT(t)?B(r):r}}function HG(e,t){return FN(t)?r=>{for(let n=e.length-1;n>=0;n--)r=e[n].set(r);return r}:(r,n)=>{let o=e.length,s=new Array(o);for(let a=0;a<o;a++){s[a]=n;let i=e[a];if(OT(i.kind)){let c=i.get(n);if(ce(c))return c;n=c.success}else n=i.get(n)}for(let a=o-1;a>=0;a--){let i=e[a];if(FN(i.kind))r=i.set(r);else if(i.kind===\"Lens\")r=i.set(r,s[a]);else{let c=i.set(r,s[a]);if(ce(c))return c;r=c.success}}return t===\"Optional\"?B(r):r}}function OT(e){return e===\"Prism\"||e===\"Optional\"}function FN(e){return e===\"Iso\"||e===\"Prism\"}function WG(e,t){return e===\"Iso\"?t:t===\"Iso\"||e===t?e:\"Optional\"}var JG=ao([]);function lx(){return JG}function DN(e){let t=nx(e);return NN(Xh(t),Qh(t))}function LN(e){return lx()}function $N(e){return lx()}var Ou=\"~effect/Schema/SchemaError\";function BN(e){return k(e,Ou)&&e[Ou]===Ou}var yn=\"~effect/net/NetAddress\";var io=e=>e.value,co=e=>e,vs=e=>e.bytes,ji=class extends Fr(\"NetAddressError\"){},_u=e=>k(e,yn),hr=e=>_u(e)&&e._tag===\"Ipv4Address\",Yo=e=>_u(e)&&e._tag===\"Ipv6Address\",jN=e=>hr(e)||Yo(e),Ru=e=>hr(e)?32:128,Pu=e=>_u(e)&&e._tag===\"MacAddress\",gp=e=>_u(e)&&e._tag===\"InetAddressV4\",yp=e=>_u(e)&&e._tag===\"InetAddressV6\",_T=e=>gp(e)||yp(e),px=e=>_u(e)&&e._tag===\"UnixPathAddress\",zN=e=>_T(e)||px(e),GG={_tag:\"Ipv4Address\",[yn]:yn,[ae](e){return hr(e)&&io(this)===io(e)},[se](){return qt(le(QG,io(this)|0))},toString(){return uo(this)},toJSON(){return this.toString()},[Te](){return this.toJSON()}},VG={_tag:\"Ipv6Address\",[yn]:yn,[ae](e){if(!Yo(e))return!1;let t=co(this),r=co(e);return t.w0===r.w0&&t.w1===r.w1&&t.w2===r.w2&&t.w3===r.w3},[se](){let e=co(this),t=le(XG,e.w0|0);return t=le(t,e.w1|0),t=le(t,e.w2|0),qt(le(t,e.w3|0))},toString(){return uo(this)},toJSON(){return this.toString()},[Te](){return this.toJSON()}},ZG={_tag:\"MacAddress\",[yn]:yn,[ae](e){return Pu(e)&&YG(vs(this),vs(e))},[se](){return le(e3,To(vs(this)))},toString(){return PT(this)},toJSON(){return this.toString()},[Te](){return this.toJSON()}},YG=(e,t)=>{if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0},QG=Re(\"Ipv4Address\"),XG=Re(\"Ipv6Address\"),e3=Re(\"MacAddress\"),t3=e=>{let t=Object.create(GG);return t.value=e>>>0,Object.freeze(t)},r3=(e,t,r,n)=>{let o=Object.create(VG);return o.w0=e>>>0,o.w1=t>>>0,o.w2=r>>>0,o.w3=n>>>0,Object.freeze(o)},n3=(e,t,r,n)=>(e<<24|t<<16|r<<8|n)>>>0;var xp=e=>[e>>>24,e>>>16&255,e>>>8&255,e&255],o3=e=>{let t=Object.assign(Object.create(ZG),{bytes:new Uint8Array(e)});return Object.freeze(t)};var St=(e,t)=>W(new ji({input:e,message:t})),s3=e=>e.every(t=>Number.isInteger(t)&&t>=0&&t<=255)?B(t3(n3(e[0],e[1],e[2],e[3]))):St(e,\"octets must be integers from 0 through 255\"),a3=e=>e.every(t=>Number.isInteger(t)&&t>=0&&t<=65535)?B(r3(e[0]*65536+e[1],e[2]*65536+e[3],e[4]*65536+e[5],e[6]*65536+e[7])):St(e,\"segments must be integers from 0 through 65535\");var qN=e=>/^(?:[0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$/.test(e)?B(o3(new Uint8Array(e.split(\":\").map(t=>Number.parseInt(t,16))))):St(e,\"expected six two-digit hexadecimal octets separated by colons\");var Mu=e=>{let t=e.split(\".\");if(t.length!==4||t.some(n=>!/^\\d{1,3}$/.test(n)))return St(e,\"expected exactly four decimal octets\");if(t.some(n=>n.length>1&&n[0]===\"0\"))return St(e,\"leading zeroes are not allowed\");let r=t.map(Number);return r.some(n=>n>255)?St(e,\"octets must be at most 255\"):s3([r[0],r[1],r[2],r[3]])},i3=e=>{if(e.includes(\"[\")||e.includes(\"]\")||e.includes(\"%\"))return St(e,\"brackets and zone identifiers are not valid in a bare IPv6 address\");let t=e.split(\"::\");if(t.length>2)return St(e,\"only one compression marker is allowed\");let r=t[0]===\"\"?[]:t[0].split(\":\"),n=t.length===2&&t[1]!==\"\"?t[1].split(\":\"):[];if(r.some(f=>f===\"\")||n.some(f=>f===\"\"))return St(e,\"empty segments are only valid in the compression marker\");let o=n.length>0?n[n.length-1]:r.length>0?r[r.length-1]:\"\",s;if(o.includes(\".\")){if(t.length===2&&n.length===0)return St(e,\"embedded IPv4 syntax must be trailing\");let f=Tr(Mu(o),p=>{let d=io(p);return[d>>>16,d&65535]});if(ce(f))return f;s=f.success,n.length>0?n.pop():r.pop()}let a=r.length+n.length+(s?2:0);if(t.length===1?a!==8:a>=8)return St(e,t.length===1?\"expected eight segments\":\"compression must replace at least one segment\");let i=f=>/^[0-9a-fA-F]{1,4}$/.test(f)?Number.parseInt(f,16):void 0,c=r.map(i),u=n.map(i);return c.some(f=>f===void 0)||u.some(f=>f===void 0)?St(e,\"segments must contain one through four hexadecimal digits\"):B([...c,...Array(8-a).fill(0),...u,...s??[]])},Sp=e=>Lt(i3(e),t=>a3(t)),bp=e=>e.includes(\":\")?Sp(e):Mu(e);var RT=e=>xp(io(e)),c3=e=>{let{w0:t,w1:r,w2:n,w3:o}=co(e);return[t>>>16,t&65535,r>>>16,r&65535,n>>>16,n&65535,o>>>16,o&65535]},HN=e=>{let{w0:t,w1:r,w2:n,w3:o}=co(e);return[...xp(t),...xp(r),...xp(n),...xp(o)]};var PT=e=>Array.from(vs(e),t=>t.toString(16).padStart(2,\"0\")).join(\":\"),dx=e=>vs(e).every(t=>t===255),u3=e=>(vs(e)[0]&1)!==0,mx=e=>(vs(e)[0]&1)===0,MT=e=>(vs(e)[0]&2)!==0,FT=e=>(vs(e)[0]&2)===0;var uo=e=>{if(hr(e))return RT(e).join(\".\");let t=c3(e);if(f3(e))return`::ffff:${t[6]>>8}.${t[6]&255}.${t[7]>>8}.${t[7]&255}`;let r=-1,n=0,o=-1;for(let i=0;i<=8;i++)i<8&&t[i]===0?o===-1&&(o=i):o!==-1&&(i-o>n&&(r=o,n=i-o),o=-1);if(n<2)return t.map(i=>i.toString(16)).join(\":\");let s=t.slice(0,r).map(i=>i.toString(16)).join(\":\"),a=t.slice(r+n).map(i=>i.toString(16)).join(\":\");return`${s}::${a}`},hx=e=>{if(hr(e))return io(e)===0;let{w0:t,w1:r,w2:n,w3:o}=co(e);return t===0&&r===0&&n===0&&o===0},NT=e=>{if(hr(e))return io(e)>>>24===127;let{w0:t,w1:r,w2:n,w3:o}=co(e);return t===0&&r===0&&n===0&&o===1},Fu=e=>Pu(e)?u3(e):hr(e)?io(e)>>>28===14:co(e).w0>>>24===255,xx=e=>Pu(e)?dx(e):io(e)===4294967295,UT=e=>Pu(e)?mx(e):!Fu(e)&&!hx(e)&&(!hr(e)||!xx(e)),DT=e=>hr(e)?io(e)>>>16===43518:(co(e).w0>>>16&65472)===65152,LT=e=>{let t=io(e);return t>>>24===10||(t>>>16&65520)===44048||t>>>16===49320},$T=e=>(co(e).w0>>>24&254)===252,f3=e=>{let{w0:t,w1:r,w2:n}=co(e);return t===0&&r===0&&n===65535};var l3={_tag:\"InetAddressV4\",[yn]:yn,[ae](e){return gp(e)&&this.port===e.port&&J(this.address,e.address)},[se](){return le(H(this.address),It(this.port))},toString(){return gx(this)},toJSON(){return this.toString()},[Te](){return this.toJSON()}},p3={_tag:\"InetAddressV6\",[yn]:yn,[ae](e){return yp(e)&&this.port===e.port&&this.scopeId===e.scopeId&&J(this.address,e.address)},[se](){return le(le(H(this.address),It(this.port)),It(this.scopeId))},toString(){return gx(this)},toJSON(){return this.toString()},[Te](){return this.toJSON()}},WN=e=>Number.isInteger(e)&&e>=0&&e<=65535,d3=(e,t)=>{if(!WN(t))return St(e,\"port must be an integer from 0 through 65535\");let r=Object.create(l3);return r.address=e,r.port=t,B(Object.freeze(r))},m3=(e,t,r)=>{if(!WN(t))return St(e,\"port must be an integer from 0 through 65535\");let n=r?.scopeId??0;if(!Number.isInteger(n)||n<0||n>4294967295)return St(e,\"scopeId must be an unsigned 32-bit integer\");let o=Object.create(p3);return o.address=e,o.port=t,o.scopeId=n,B(Object.freeze(o))};var JN=e=>{let t,r,n=0,o=e.startsWith(\"[\");if(o){let s=e.indexOf(\"]\");if(s<0||e[s+1]!==\":\"||e.indexOf(\"]\",s+1)!==-1)return St(e,\"expected [IPv6]:port\");t=e.slice(1,s),r=e.slice(s+2);let a=t.indexOf(\"%\");if(a!==-1){let i=t.slice(a+1);if(t.indexOf(\"%\",a+1)!==-1||!/^\\d+$/.test(i))return St(e,\"scope identifier must be decimal\");if(n=Number(i),!Number.isInteger(n)||n>4294967295)return St(e,\"scope identifier must be an unsigned 32-bit integer\");t=t.slice(0,a)}}else{let s=e.lastIndexOf(\":\");if(s<0)return St(e,\"expected host:port or [IPv6]:port\");if(e.indexOf(\":\")!==s)return St(e,\"IPv6 addresses must be bracketed\");t=e.slice(0,s),r=e.slice(s+1)}return/^(0|[1-9]\\d*)$/.test(r)?Lt(bp(t),s=>o!==Yo(s)?St(e,\"only IPv6 addresses use brackets\"):Yo(s)?m3(s,Number(r),{scopeId:n}):d3(s,Number(r))):St(e,\"port must be an unpadded decimal integer\")};var h3=e=>uo(e.address)+(yp(e)&&e.scopeId!==0?`%${e.scopeId}`:\"\");var gx=e=>{let t=h3(e);return gp(e)?`${t}:${e.port}`:`[${t}]:${e.port}`};var x3={_tag:\"UnixPathAddress\",[yn]:yn,[ae](e){return px(e)&&this.path===e.path},[se](){return le(Re(\"UnixPathAddress\"),Re(this.path))},toString(){return this.path},toJSON(){return this.toString()},[Te](){return this.toJSON()}},KN=e=>{let t=Object.create(x3);return t.path=e,Object.freeze(t)};var jT=\"~effect/net/IpInterface\",GN=e=>Ep(e)&&hr(e.address),VN=e=>Ep(e)&&Yo(e.address),Ep=e=>k(e,jT),g3={_tag:\"IpInterface\",[jT]:jT,[ae](e){return Ep(e)&&this.prefixLength===e.prefixLength&&J(this.address,e.address)},[se](){return le(H(this.address),It(this.prefixLength))},toString(){return Tp(this)},toJSON(){return this.toString()},[Te](){return this.toJSON()}},zT=(e,t)=>W(new ji({input:e,message:t})),Ip=(e,t)=>{let r=Ru(e);if(!Number.isInteger(t)||t<0||t>r)return zT(e,`prefix length must be an integer from 0 through ${r}`);let n=Object.assign(Object.create(g3),{address:e,prefixLength:t});return B(Object.freeze(n))},qT=(e,t)=>{let r=e.indexOf(\"/\");if(r===-1&&t?.prefix!==\"required\")return B({address:e,prefixLength:void 0});if(r<=0||r!==e.lastIndexOf(\"/\")||r===e.length-1)return zT(e,\"expected an address and prefix length separated by one slash\");let n=e.slice(r+1);return/^(0|[1-9][0-9]*)$/.test(n)?B({address:e.slice(0,r),prefixLength:Number(n)}):zT(e,\"prefix length must be an unpadded ASCII decimal integer\")},yx=(e,t)=>Lt(qT(e,t),r=>Lt(Mu(r.address),n=>Ip(n,r.prefixLength??Ru(n)))),Sx=(e,t)=>Lt(qT(e,t),r=>Lt(Sp(r.address),n=>Ip(n,r.prefixLength??Ru(n)))),bx=(e,t)=>Lt(qT(e,t),r=>Lt(bp(r.address),n=>Ip(n,r.prefixLength??Ru(n))));var Tp=e=>`${uo(e.address)}/${e.prefixLength}`;var HT=\"~effect/net/IpNetwork\",YN=e=>wp(e)&&hr(e.address),QN=e=>wp(e)&&Yo(e.address),wp=e=>k(e,HT),y3={_tag:\"IpNetwork\",[HT]:HT,[ae](e){return wp(e)&&this.prefixLength===e.prefixLength&&J(this.address,e.address)},[se](){return le(H(this.address),It(this.prefixLength))},toString(){return Cp(this)},toJSON(){return this.toString()},[Te](){return this.toJSON()}},S3=e=>{let t=Object.assign(Object.create(y3),{address:e.address,prefixLength:e.prefixLength});return Object.freeze(t)},b3=e=>hr(e)?RT(e):HN(e);var E3=(e,t)=>{let r=Math.floor(t/8),n=t%8;return e.map((o,s)=>s<r?o:s===r&&n!==0?o&(255<<8-n&255):0)},WT=(e,t)=>Lt(Ip(e,t),r=>{let n=b3(e),o=E3(n,t);return n.some((s,a)=>s!==o[a])?W(new ji({input:e,message:\"address has non-zero host bits\"})):B(S3(r))});var XN=e=>Lt(yx(e,{prefix:\"required\"}),t=>WT(t.address,t.prefixLength)),eU=e=>Lt(Sx(e,{prefix:\"required\"}),t=>WT(t.address,t.prefixLength)),tU=e=>Lt(bx(e,{prefix:\"required\"}),t=>WT(t.address,t.prefixLength));var Cp=e=>`${uo(e.address)}/${e.prefixLength}`;var Ap=tx;function qr(){return(e,t,r)=>q(new yu(e.map(op),n=>t(n.map(o=>q(o))),r))}function Be(e,t){return qr()([],()=>(r,n,o)=>e(r)?g(r):P(new ft(n,r,o)),t)}function T3(e){return e}function w3(e){return t=>t.annotate(e)}function C3(e){return t=>JT(JT(t).annotate(e))}function A3(e){return t=>t.rebuild(cp(t.ast,e))}function k3(e){return e}var Os=class extends Fr(\"SchemaError\"){[Ou]=Ou;constructor(t){let r=Co();Yr(0);try{super({issue:t})}finally{Yr(r)}}get message(){return _P(this.issue)}toString(){return`SchemaError(${this.message})`}};function hU(e){return BN(e)}function xU(e){return Ne(e)?YT(e):rt(e,t=>Is(()=>Ss(t,r=>new Os(r))))}function YT(e){return Ve(e)?e:sn(Ss(e.cause,t=>new Os(t)))}function gU(e,t){let r;for(let n of e.reasons){if(!na(n)||!hU(n.error))throw new globalThis.Error(t,{cause:e});r??=n.error}if(r===void 0)throw new globalThis.Error(t,{cause:e});return r}function yU(e){return ah(e).then(t=>{if(Ve(t))return t.value;throw gU(t.cause,\"Promise adapter can only reject schema errors\")})}function SU(e){let t=Wo(e);if(Ve(t))return t.value;throw gU(t.cause,\"Sync adapter can only throw schema errors\")}function v3(e,t){return gN(e,t)}function O3(e){return yN(e)}var _3=rT,R3=OF;function Ex(e,t){let r=nt(e,t);return(n,o)=>xU(r(n,o))}var P3=Ex;function bU(e,t){let r=_F(e,t);return(n,o)=>YT(r(n,o))}var M3=bU,F3=oT,N3=RF;function EU(e,t){let r=PF(e,t);return(n,o)=>Dd(r(n,o),s=>new Os(s))}var U3=EU;function IU(e,t){let r=Ex(e,t);return(n,o)=>yU(r(n,o))}var D3=IU;function TU(e,t){let r=Ex(e,t);return(n,o)=>SU(r(n,o))}var L3=TU;function Ix(e,t){let r=Di(e,t);return(n,o)=>xU(r(n,o))}var $3=Ix;function wU(e,t){let r=FF(e,t);return(n,o)=>YT(r(n,o))}var B3=wU,j3=sT,z3=NF;function CU(e,t){let r=UF(e,t);return(n,o)=>Dd(r(n,o),s=>new Os(s))}var q3=CU;function AU(e,t){let r=Ix(e,t);return(n,o)=>yU(r(n,o))}var H3=AU;function kU(e,t){let r=Ix(e,t);return(n,o)=>SU(r(n,o))}var W3=kU,q=oo;function Tx(e){return k(e,Ap)&&e[Ap]===Ap}var qi=mr(e=>q(Ni(e.ast),{schema:e})),J3=mr(e=>e.schema),Lu=mr(e=>{let t=Ax(e);return q(iF(e.ast),{schema:t})}),K3=mr(e=>e.schema.members[0]),G3=mr(e=>q(qI(e.ast),{schema:e})),V3=mr(e=>e.schema),Hr=mr(e=>q(yt(e.ast),{schema:e})),$u=mr(e=>q(hn(e.ast),{schema:e})),kp=\"~effect/Schema/flip\";function Z3(e){return k(e,kp)&&e[kp]===kp}function JT(e){return Z3(e)?e.schema.rebuild(mn(e.ast)):q(mn(e.ast),{[kp]:kp,schema:e})}function Ct(e){let t=q(new dn(e),{literal:e,transform(r){return t.pipe(G(Ct(r),{decode:oe(()=>r),encode:oe(()=>e)}))}});return t}function vU(e){return e.map(t=>Tx(t)?t.ast:new dn(t))}function Y3(e){return q(new _I(vU(e)),{parts:e})}function Q3(e){return q(BM(vU(e)),{parts:e})}function X3(e){return q(new $M(Object.keys(e).filter(t=>typeof e[e[t]]!=\"number\").map(t=>[t,e[t]])),{enums:e})}var eV=q(OI),tV=q(DM),vp=q(eo),wx=q(kI),QT=q(vI),K=q(pn),rV=K,Wi=q(RI),XT=q(qM),OU=q(HM),Bu=q(WM),nV=q(UM),oV=q(LM);function sV(e){return q(new zM(e))}function ew(e,t){return q(e,{fields:t,mapFields(r,n){let o=r(this.fields);return ew(Lh(o,n?.unsafePreserveChecks?this.ast.checks:void 0),o)}})}function Me(e){return ew(Lh(e,void 0),e)}function aV(e){return mr(t=>t.mapFields(RN(e)))}var iV=e=>typeof e==\"symbol\"?e:globalThis.String(e);function cV(e){return function(t){let r={},n=Object.create(null),o=Object.create(null),s=new Set;for(let a of Reflect.ownKeys(t.fields)){let i=$u(t.fields[a]),c=Object.hasOwn(e,a),u=c?e[a]:a,f=iV(u);if(s.has(f))throw new globalThis.Error(`Duplicate encoded keys: ${wo(u)}`);s.add(f),M(r,u,i),c&&(n[a]=u,o[u]=a)}return Me(r).pipe(G(t,Pe({decode:TT(o),encode:TT(n)})))}}function uV(e,t){return r=>{let n=Ya(r.fields,Hr),o=Me({...n,...e});return r.pipe(G(o,Pe({decode:s=>{let a={...s};for(let i in e){let c=t[i],u=c(s);be(u)&&M(a,i,u.value)}return a},encode:s=>{let a={...s};for(let i in e)delete a[i];return a}})))}}function _s(e,t){return q(uF(e.ast,t.ast),{key:e,value:t})}function fV(e,t){return q(ZM(e.ast,t.map(op)),{schema:e,records:t})}function _U(e,t){return q(e,{elements:t,mapElements(r,n){let o=r(this.elements);return _U(NI(o,n?.unsafePreserveChecks?this.ast.checks:void 0),o)}})}function Qo(e){return _U(NI(e),e)}function lV(e,t){return q(YM(e.ast,t.map(op)),{schema:e,rest:t})}var $e=mr(e=>q(new Pn(!1,[],[e.ast]),{value:e}));function Cx(e,t,r){return t!==void 0&&r!==void 0?e.check(iw(t,r)):t!==void 0?e.check(ZU(t)):r!==void 0?e.check(XU(r)):e}var tw=mr(e=>q(new Pn(!1,[e.ast],[e.ast]),{value:e}));function pV(e){let t=$e(e),r=$e(Hr(e)),n=G(Qo([vp]),Pe({decode:o=>[o],encode:([o])=>o}))(e);return q(it([n,t]).pipe(G(r)).ast,{from:it([e,t]),to:r})}function dV(e){return $e(e).check(uw())}var mV=mr(e=>q(QM(e.ast),{schema:e}));function RU(e,t){return q(e,{members:t,mapMembers(r,n){let o=r(this.members);return RU($h(o,this.ast.options,n?.unsafePreserveChecks?this.ast.checks:void 0),o)}})}function it(e,t){return RU($h(e,t,void 0),e)}function fo(e){let t=e.map(Ct);return q($h(t,void 0,void 0),{literals:e,members:t,mapMembers(r){return it(r(this.members))},pick(r){return fo(r)},transform(r){return it(t.map((n,o)=>n.transform(r[o])))}})}var rw=mr(e=>it([e,wx])),Ax=mr(e=>it([e,QT])),PU=mr(e=>it([e,wx,QT]));function MU(e){return q(new DI(()=>e().ast))}function hV(...e){return t=>t.check(...e)}function FU(e,t){return r=>q(Vo(r.ast,[jh(e,t)]),{schema:r})}function NU(e){return t=>q(t.ast,{schema:t,identifier:e})}function xV(e,t){return r=>(t.checks?r.check(...t.checks):r).pipe(NU(e))}function UU(e){return t=>q(sF(t.ast,new _h(e,R)),{schema:t})}function DU(e){return t=>q(aF(t.ast,new _h(R,e)),{schema:t})}function gV(e){return LU(e)}function LU(e){return t=>UU(ru(e))(t)}function yV(e){return $U(e)}function $U(e){return t=>DU(ru(e))(t)}function G(e,t){return r=>q(ga(r.ast,e.ast,t?Rh(t):lu()),{from:r,to:e})}function ju(){return(e,t)=>Oe()(e,{decode:t,encode:NP})}var BU=fo([\"true\",\"yes\",\"on\",\"1\",\"y\"]),jU=fo([\"false\",\"no\",\"off\",\"0\",\"n\"]),nw=fo([...BU.literals,...jU.literals]).pipe(G(XT,Pe({decode:e=>e===\"true\"||e===\"yes\"||e===\"on\"||e===\"1\"||e===\"y\",encode:e=>e?\"true\":\"false\"})));function SV(e){return t=>G(Hr(t),e)(t)}function ow(e,t){return r=>t?G(r,t)(e):G(r)(e)}function bV(e){return t=>G(t,e)($u(t))}function zU(e){return t=>q(cF(t.ast,e),{schema:t})}function qU(e){return rt(e,t=>Is(()=>Ss(t,r=>r.issue)))}function sw(e,t){let r=t?.encodingStrategy===\"omit\"?uI():jr();return n=>qi($u(n)).pipe(G(n,{decode:fI(qU(e)),encode:r}))}function EV(e,t){return r=>Hr(r).pipe(sw(e,t),ow(qi(r)))}function HU(e,t){let r=t?.encodingStrategy===\"omit\"?uI():jr();return n=>Lu($u(n)).pipe(G(n,{decode:fI(qU(e)),encode:r}))}function IV(e,t){return r=>Hr(r).pipe(HU(e,t),ow(Lu(r)))}function Hi(e){return Ct(e).pipe(zU(g(e)))}function TV(e){return Hi(e).pipe(sw(g(e),{encodingStrategy:\"omit\"}))}function kx(e,t){return Me({_tag:Hi(e),...t})}function WU(e){return t=>{let r={},n=[],o=new Set,s={},a=f=>p=>f.includes(p[e]);return i(t),Object.assign(t,{tag:e,cases:r,discriminants:n,isAnyOf:a,guards:s,match:c,matchOrElse:u});function i(f){let p=f.ast;if(MM(p)&&\"members\"in f&&globalThis.Array.isArray(f.members)&&f.members.every(Tx))return f.members.forEach(i);let d=hu(p);if(d.length>0){let m=d.find(x=>x.key===e)?.literal;if(id(m)){let x=typeof m==\"number\"?globalThis.String(m):m;if(o.has(x))throw new globalThis.Error(`Duplicate discriminant: ${globalThis.String(m)}`);o.add(x),n.push(m),M(r,m,f),M(s,m,rT(Hr(f)));return}}throw new globalThis.Error(\"No literal or unique symbol found\")}function c(){if(arguments.length===1){let x=arguments[0];return function(y){let S=y[e];return(Object.hasOwn(x,S)?x[S]:void 0)(y)}}let f=arguments[0],p=arguments[1],d=f[e];return(Object.hasOwn(p,d)?p[d]:void 0)(f)}function u(){if(arguments.length===2){let y=arguments[0],S=arguments[1];return function(w){let E=w[e];return(Object.hasOwn(y,E)?y[E]??S:S)(w)}}let f=arguments[0],p=arguments[1],d=arguments[2],m=f[e];return(Object.hasOwn(p,m)?p[m]??d:d)(f)}}}function wV(e){let t={},r=[];for(let u of Object.keys(e)){let f=kx(u,e[u]);M(t,u,f),r.push(f)}let n=it(r),{tag:o,guards:s,isAnyOf:a,match:i,matchOrElse:c}=WU(\"_tag\")(n);return q(n.ast,{tag:o,cases:t,isAnyOf:a,guards:s,match:i,matchOrElse:c})}function CV(){return e=>e}function ba(e,t){return Be(r=>r instanceof e,t)}function Oe(){return(e,t)=>new at(e.ast,Rh(t))}var Ue=Bh;function AV(e,t=void 0){return new Ri(e,t)}var rU=\"^\\\\S[\\\\s\\\\S]*\\\\S$|^\\\\S$|^$\";function JU(e){let t=new globalThis.RegExp(rU);return Ue(r=>r.trim()===r,{expected:\"a string with no leading or trailing whitespace\",representation:{id:\"effect/schema/isTrimmed\",payload:null},toJsonSchema:()=>({pattern:t.source}),toCode:()=>({runtime:\"Schema.isTrimmed()\"}),arbitraryConstraint:{patterns:[{source:rU,flags:\"\"}]},...e})}function zu(e,t){let r=e.source,n=e.flags,o=/^[dg]*uy?$/.test(n),s=n===\"\"?`new RegExp(${F(r)})`:`new RegExp(${F(r)}, ${F(n)})`;return ap(e,{toJsonSchema:()=>o?{pattern:n.endsWith(\"y\")?`^(?:${r})`:r}:[{},!0],toCode:()=>({runtime:`Schema.isPattern(${s})`}),...t})}function kV(e){return JI({toCode:()=>({runtime:\"Schema.isStringFinite()\"}),...e})}function vV(e){return KI({toCode:()=>({runtime:\"Schema.isStringBigInt()\"}),...e})}function OV(e){return VI({toCode:()=>({runtime:\"Schema.isStringSymbol()\"}),...e})}var _V=e=>e?new globalThis.RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${e}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`):/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|[fF]{8}-[fF]{4}-[fF]{4}-[fF]{4}-[fF]{12})$/;function RV(e,t){let r=_V(e);return zu(r,{expected:e?`a UUID v${e}`:\"a UUID\",representation:{id:\"effect/schema/isUUID\",payload:{version:e??null}},toJsonSchema:()=>({pattern:r.source,format:\"uuid\"}),toCode:()=>({runtime:e===void 0?\"Schema.isUUID()\":`Schema.isUUID(${e})`}),...t})}var nU=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;function PV(e){return zu(nU,{expected:\"a GUID\",representation:{id:\"effect/schema/isGUID\",payload:null},toJsonSchema:()=>({pattern:nU.source}),toCode:()=>({runtime:\"Schema.isGUID()\"}),...e})}function MV(e){let t=/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;return zu(t,{representation:{id:\"effect/schema/isULID\",payload:null},toJsonSchema:()=>({pattern:t.source}),toCode:()=>({runtime:\"Schema.isULID()\"}),...e})}function KU(e){let t=/^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/;return zu(t,{expected:\"a base64 encoded string\",representation:{id:\"effect/schema/isBase64\",payload:null},toJsonSchema:()=>({pattern:t.source}),toCode:()=>({runtime:\"Schema.isBase64()\"}),...e})}function FV(e){let t=/^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/;return zu(t,{expected:\"a base64url encoded string\",representation:{id:\"effect/schema/isBase64Url\",payload:null},toJsonSchema:()=>({pattern:t.source}),toCode:()=>({runtime:\"Schema.isBase64Url()\"}),...e})}function aw(e,t,r){if(e.length===0)return t.length===0?{}:[{},!0];let n={pattern:new globalThis.RegExp(r).source};return e===t?n:[n,!0]}function NV(e,t){let r=JSON.stringify(e),n=new globalThis.RegExp(`^${ks(e)}`),o=e.replace(/[\\uD800-\\uDBFF]$/,\"\");return Ue(s=>s.startsWith(e),{expected:`a string starting with ${r}`,representation:{id:\"effect/schema/isStartingWith\",payload:{startsWith:e}},toJsonSchema:()=>aw(o,e,`^${ks(o)}`),toCode:()=>({runtime:`Schema.isStartingWith(${F(e)})`}),arbitraryConstraint:{patterns:[{source:n.source,flags:n.flags}]},...t})}function UV(e,t){let r=JSON.stringify(e),n=new globalThis.RegExp(`${ks(e)}$`),o=e.replace(/^[\\uDC00-\\uDFFF]/,\"\");return Ue(s=>s.endsWith(e),{expected:`a string ending with ${r}`,representation:{id:\"effect/schema/isEndingWith\",payload:{endsWith:e}},toJsonSchema:()=>aw(o,e,`${ks(o)}$`),toCode:()=>({runtime:`Schema.isEndingWith(${F(e)})`}),arbitraryConstraint:{patterns:[{source:n.source,flags:n.flags}]},...t})}function DV(e,t){let r=JSON.stringify(e),n=new globalThis.RegExp(ks(e)),o=e.replace(/^[\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF]$/g,\"\");return Ue(s=>s.includes(e),{expected:`a string including ${r}`,representation:{id:\"effect/schema/isIncluding\",payload:{includes:e}},toJsonSchema:()=>aw(o,e,ks(o)),toCode:()=>({runtime:`Schema.isIncluding(${F(e)})`}),arbitraryConstraint:{patterns:[{source:n.source,flags:n.flags}]},...t})}var oU=\"^[^a-z]*$\";function LV(e){let t=new globalThis.RegExp(oU);return Ue(r=>r.toUpperCase()===r,{expected:\"a string with all characters in uppercase\",representation:{id:\"effect/schema/isUppercased\",payload:null},toJsonSchema:()=>[{pattern:t.source},!0],toCode:()=>({runtime:\"Schema.isUppercased()\"}),arbitraryConstraint:{patterns:[{source:oU,flags:\"\"}]},...e})}var sU=\"^[^A-Z]*$\";function $V(e){let t=new globalThis.RegExp(sU);return Ue(r=>r.toLowerCase()===r,{expected:\"a string with all characters in lowercase\",representation:{id:\"effect/schema/isLowercased\",payload:null},toJsonSchema:()=>[{pattern:t.source},!0],toCode:()=>({runtime:\"Schema.isLowercased()\"}),arbitraryConstraint:{patterns:[{source:sU,flags:\"\"}]},...e})}var aU=\"^(?:[^a-z][\\\\s\\\\S]*)?$\";function BV(e){let t=new globalThis.RegExp(aU);return Ue(r=>r.charAt(0).toUpperCase()===r.charAt(0),{expected:\"a string with the first character in uppercase\",representation:{id:\"effect/schema/isCapitalized\",payload:null},toJsonSchema:()=>[{pattern:t.source},!0],toCode:()=>({runtime:\"Schema.isCapitalized()\"}),arbitraryConstraint:{patterns:[{source:aU,flags:\"\"}]},...e})}var iU=\"^(?:[^A-Z][\\\\s\\\\S]*)?$\";function jV(e){let t=new globalThis.RegExp(iU);return Ue(r=>r.charAt(0).toLowerCase()===r.charAt(0),{expected:\"a string with the first character in lowercase\",representation:{id:\"effect/schema/isUncapitalized\",payload:null},toJsonSchema:()=>[{pattern:t.source},!0],toCode:()=>({runtime:\"Schema.isUncapitalized()\"}),arbitraryConstraint:{patterns:[{source:iU,flags:\"\"}]},...e})}var qu=q($I),zV=LI;function Op(e){let t=Tc(e.order),r=e.formatter??F;return(n,o)=>Ue(s=>t(s,n),{expected:`a value greater than ${r(n)}`,arbitraryConstraint:{order:e.order,minimum:n,exclusiveMinimum:!0},...e.annotate?.(n),...o})}function _p(e){let t=_d(e.order),r=e.formatter??F;return(n,o)=>Ue(s=>t(s,n),{expected:`a value greater than or equal to ${r(n)}`,arbitraryConstraint:{order:e.order,minimum:n},...e.annotate?.(n),...o})}function Rp(e){let t=vd(e.order),r=e.formatter??F;return(n,o)=>Ue(s=>t(s,n),{expected:`a value less than ${r(n)}`,arbitraryConstraint:{order:e.order,maximum:n,exclusiveMaximum:!0},...e.annotate?.(n),...o})}function Pp(e){let t=Od(e.order),r=e.formatter??F;return(n,o)=>Ue(s=>t(s,n),{expected:`a value less than or equal to ${r(n)}`,arbitraryConstraint:{order:e.order,maximum:n},...e.annotate?.(n),...o})}function Mp(e){let t=_d(e.order),r=Tc(e.order),n=Od(e.order),o=vd(e.order),s=e.formatter??F;return(a,i)=>{let c=a.exclusiveMinimum?r:t,u=a.exclusiveMaximum?o:n;return Ue(f=>c(f,a.minimum)&&u(f,a.maximum),{expected:`a value between ${s(a.minimum)}${a.exclusiveMinimum?\" (excluded)\":\"\"} and ${s(a.maximum)}${a.exclusiveMaximum?\" (excluded)\":\"\"}`,arbitraryConstraint:{order:e.order,minimum:a.minimum,maximum:a.maximum,...a.exclusiveMinimum&&{exclusiveMinimum:!0},...a.exclusiveMaximum&&{exclusiveMaximum:!0}},...e.annotate?.(a),...i})}}function qV(e){return(t,r)=>{let n=e.formatter??F;return Ue(o=>e.remainder(o,t)===e.zero,{expected:`a value that is a multiple of ${n(t)}`,...e.annotate?.(t),...r})}}function Nu(e){if(!globalThis.Number.isFinite(e))throw new globalThis.RangeError(`Expected a finite number, got ${F(e)}`);return e}var HV=Op({order:fs,annotate:e=>({representation:{id:\"effect/schema/isGreaterThan\",payload:{exclusiveMinimum:Nu(e)}},toJsonSchema:()=>({exclusiveMinimum:e}),toCode:()=>({runtime:`Schema.isGreaterThan(${F(e)})`})})}),GU=_p({order:fs,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanOrEqualTo\",payload:{minimum:Nu(e)}},toJsonSchema:()=>({minimum:e}),toCode:()=>({runtime:`Schema.isGreaterThanOrEqualTo(${F(e)})`})})}),WV=Rp({order:fs,annotate:e=>({representation:{id:\"effect/schema/isLessThan\",payload:{exclusiveMaximum:Nu(e)}},toJsonSchema:()=>({exclusiveMaximum:e}),toCode:()=>({runtime:`Schema.isLessThan(${F(e)})`})})}),JV=Pp({order:fs,annotate:e=>({representation:{id:\"effect/schema/isLessThanOrEqualTo\",payload:{maximum:Nu(e)}},toJsonSchema:()=>({maximum:e}),toCode:()=>({runtime:`Schema.isLessThanOrEqualTo(${F(e)})`})})}),Hu=Mp({order:fs,annotate:e=>{let t=e.exclusiveMinimum?!0:void 0,r=e.exclusiveMaximum?!0:void 0;return{representation:{id:\"effect/schema/isBetween\",payload:{minimum:Nu(e.minimum),maximum:Nu(e.maximum),...t&&{exclusiveMinimum:t},...r&&{exclusiveMaximum:r}}},toJsonSchema:()=>({[t?\"exclusiveMinimum\":\"minimum\"]:e.minimum,[r?\"exclusiveMaximum\":\"maximum\"]:e.maximum}),toCode:()=>({runtime:`Schema.isBetween({ minimum: ${F(e.minimum)}, maximum: ${F(e.maximum)}, exclusiveMinimum: ${F(t)}, exclusiveMaximum: ${F(r)} })`})}}});function KV(e,t){if(!globalThis.Number.isFinite(e)||e===0)throw new globalThis.RangeError(`Expected a finite non-zero number, got ${globalThis.String(e)}`);return e=globalThis.Math.abs(e),Ue(r=>I_(r,e)===0,{expected:`a value that is a multiple of ${e}`,representation:{id:\"effect/schema/isMultipleOf\",payload:{divisor:e}},toJsonSchema:()=>({multipleOf:e}),toCode:()=>({runtime:`Schema.isMultipleOf(${F(e)})`}),...t})}function vx(e){return Ue(t=>globalThis.Number.isSafeInteger(t),{expected:\"an integer\",representation:{id:\"effect/schema/isInt\",payload:null},toJsonSchema:()=>[{type:\"integer\"},!0],toCode:()=>({runtime:\"Schema.isInt()\"}),arbitraryConstraint:{number:\"integer\"},...e})}var lo=Wi.check(vx()),zi=lo.check(GU(0));function GV(e){return new Ri([vx(),Hu({minimum:-2147483648,maximum:2147483647})],{expected:\"a 32-bit integer\",...e})}function VV(e){return new Ri([vx(),Hu({minimum:0,maximum:4294967295})],{expected:\"a 32-bit unsigned integer\",...e})}function Uu(e){if(globalThis.Number.isNaN(e.getTime()))throw new globalThis.RangeError(`Expected a valid Date, got ${F(e)}`);return e.toISOString()}function Du(e){return`new Date(${F(e.getTime())})`}var ZV=Op({order:Ic,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanDate\",payload:{exclusiveMinimum:Uu(e)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isGreaterThanDate(${Du(e)})`})})}),YV=_p({order:Ic,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanOrEqualToDate\",payload:{minimum:Uu(e)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isGreaterThanOrEqualToDate(${Du(e)})`})})}),QV=Rp({order:Ic,annotate:e=>({representation:{id:\"effect/schema/isLessThanDate\",payload:{exclusiveMaximum:Uu(e)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isLessThanDate(${Du(e)})`})})}),XV=Pp({order:Ic,annotate:e=>({representation:{id:\"effect/schema/isLessThanOrEqualToDate\",payload:{maximum:Uu(e)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isLessThanOrEqualToDate(${Du(e)})`})})}),eZ=Mp({order:Ic,annotate:e=>{let t=e.exclusiveMinimum?!0:void 0,r=e.exclusiveMaximum?!0:void 0;return{representation:{id:\"effect/schema/isBetweenDate\",payload:{minimum:Uu(e.minimum),maximum:Uu(e.maximum),...t&&{exclusiveMinimum:t},...r&&{exclusiveMaximum:r}}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isBetweenDate({ minimum: ${Du(e.minimum)}, maximum: ${Du(e.maximum)}, exclusiveMinimum: ${F(t)}, exclusiveMaximum: ${F(r)} })`})}}}),tZ=Op({order:Ec,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanBigInt\",payload:{exclusiveMinimum:e.toString(10)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isGreaterThanBigInt(${F(e)})`})})}),VU=_p({order:Ec,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanOrEqualToBigInt\",payload:{minimum:e.toString(10)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isGreaterThanOrEqualToBigInt(${F(e)})`})})}),rZ=Rp({order:Ec,annotate:e=>({representation:{id:\"effect/schema/isLessThanBigInt\",payload:{exclusiveMaximum:e.toString(10)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isLessThanBigInt(${F(e)})`})})}),nZ=Pp({order:Ec,annotate:e=>({representation:{id:\"effect/schema/isLessThanOrEqualToBigInt\",payload:{maximum:e.toString(10)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isLessThanOrEqualToBigInt(${F(e)})`})})}),oZ=Mp({order:Ec,annotate:e=>{let t=e.exclusiveMinimum?!0:void 0,r=e.exclusiveMaximum?!0:void 0;return{representation:{id:\"effect/schema/isBetweenBigInt\",payload:{minimum:e.minimum.toString(10),maximum:e.maximum.toString(10),...t&&{exclusiveMinimum:t},...r&&{exclusiveMaximum:r}}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isBetweenBigInt({ minimum: ${F(e.minimum)}, maximum: ${F(e.maximum)}, exclusiveMinimum: ${F(t)}, exclusiveMaximum: ${F(r)} })`})}}});function ZU(e,t){return e=xr(e),YU(e,Math.ceil(e/2),t)}function YU(e,t,r){return Ue(n=>n.length>=e,{expected:`a value with a length of at least ${e}`,representation:{id:\"effect/schema/isMinLength\",payload:{minLength:e}},toJsonSchema:({type:n})=>n===\"string\"?e<=1?{minLength:t}:[{minLength:t},!0]:n===\"array\"?{minItems:e}:n===void 0?[{minLength:t,minItems:e},!0]:[{},!0],toCode:()=>({runtime:`Schema.isMinLength(${e})`}),[Lr]:!0,arbitraryConstraint:{minLength:e},...r})}function QU(e){return YU(1,1,e)}function XU(e,t){return e=xr(e),Ue(r=>r.length<=e,{expected:`a value with a length of at most ${e}`,representation:{id:\"effect/schema/isMaxLength\",payload:{maxLength:e}},toJsonSchema:({type:r})=>r===\"string\"?e===0?{maxLength:e}:[{maxLength:e},!0]:r===\"array\"?{maxItems:e}:r===void 0?[{maxLength:e,maxItems:e},!0]:[{},!0],toCode:()=>({runtime:`Schema.isMaxLength(${e})`}),[Lr]:!0,arbitraryConstraint:{maxLength:e},...t})}function iw(e,t,r){return e=xr(e),t=xr(t),Ue(n=>n.length>=e&&n.length<=t,{expected:e===t?`a value with a length of ${e}`:`a value with a length between ${e} and ${t}`,representation:{id:\"effect/schema/isBetweenLength\",payload:{minimum:e,maximum:t}},toJsonSchema:({type:n})=>n===\"string\"?t===0||Math.ceil(e/2)>t?{minLength:Math.ceil(e/2),maxLength:t}:[{minLength:Math.ceil(e/2),maxLength:t},!0]:n===\"array\"?{minItems:e,maxItems:t}:n===void 0?[{minLength:Math.ceil(e/2),maxLength:t,minItems:e,maxItems:t},!0]:[{},!0],toCode:()=>({runtime:`Schema.isBetweenLength(${e}, ${t})`}),[Lr]:!0,arbitraryConstraint:{minLength:e,maxLength:t},...r})}function sZ(e,t){return e=xr(e),Ue(r=>cw(r,e)>=e,{expected:`a string with at least ${e} code points`,representation:{id:\"effect/schema/isMinCodePoints\",payload:{minCodePoints:e}},toJsonSchema:()=>({minLength:e}),toCode:()=>({runtime:`Schema.isMinCodePoints(${e})`}),arbitraryConstraint:{minCodePoints:e},...t})}function aZ(e,t){return e=xr(e),Ue(r=>cw(r,e+1)<=e,{expected:`a string with at most ${e} code points`,representation:{id:\"effect/schema/isMaxCodePoints\",payload:{maxCodePoints:e}},toJsonSchema:()=>({maxLength:e}),toCode:()=>({runtime:`Schema.isMaxCodePoints(${e})`}),arbitraryConstraint:{maxCodePoints:e},...t})}function iZ(e,t,r){return e=xr(e),t=xr(t),Ue(n=>{let o=cw(n,t+1);return o>=e&&o<=t},{expected:e===t?`a string with ${e} code points`:`a string with between ${e} and ${t} code points`,representation:{id:\"effect/schema/isBetweenCodePoints\",payload:{minimum:e,maximum:t}},toJsonSchema:()=>({allOf:[{minLength:e},{maxLength:t}]}),toCode:()=>({runtime:`Schema.isBetweenCodePoints(${e}, ${t})`}),arbitraryConstraint:{minCodePoints:e,maxCodePoints:t},...r})}function cw(e,t){if(t===0)return 0;let r=0;for(let n of e)if(++r>=t)break;return r}function xr(e){if(!globalThis.Number.isFinite(e))throw new globalThis.RangeError(`Expected a finite number, got ${e}`);return Math.max(0,Math.floor(e))}function cZ(e,t){return e=xr(e),Ue(r=>r.size>=e,{expected:`a value with a size of at least ${e}`,representation:{id:\"effect/schema/isMinSize\",payload:{minSize:e}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isMinSize(${e})`}),[Lr]:!0,arbitraryConstraint:{minSize:e},...t})}function uZ(e,t){return e=xr(e),Ue(r=>r.size<=e,{expected:`a value with a size of at most ${e}`,representation:{id:\"effect/schema/isMaxSize\",payload:{maxSize:e}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isMaxSize(${e})`}),[Lr]:!0,arbitraryConstraint:{maxSize:e},...t})}function fZ(e,t,r){return e=xr(e),t=xr(t),Ue(n=>n.size>=e&&n.size<=t,{expected:e===t?`a value with a size of ${e}`:`a value with a size between ${e} and ${t}`,representation:{id:\"effect/schema/isBetweenSize\",payload:{minimum:e,maximum:t}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isBetweenSize(${e}, ${t})`}),[Lr]:!0,arbitraryConstraint:{minSize:e,maxSize:t},...r})}function lZ(e,t){return e=xr(e),Ue(r=>Reflect.ownKeys(r).length>=e,{expected:`a value with at least ${e===1?\"1 entry\":`${e} entries`}`,representation:{id:\"effect/schema/isMinProperties\",payload:{minProperties:e}},toJsonSchema:({type:r})=>r===\"object\"?{minProperties:e}:[{minProperties:e},!0],toCode:()=>({runtime:`Schema.isMinProperties(${e})`}),[Lr]:!0,arbitraryConstraint:{minProperties:e},...t})}function pZ(e,t){return e=xr(e),Ue(r=>Reflect.ownKeys(r).length<=e,{expected:`a value with at most ${e===1?\"1 entry\":`${e} entries`}`,representation:{id:\"effect/schema/isMaxProperties\",payload:{maxProperties:e}},toJsonSchema:({type:r})=>r===\"object\"?{maxProperties:e}:[{maxProperties:e},!0],toCode:()=>({runtime:`Schema.isMaxProperties(${e})`}),[Lr]:!0,arbitraryConstraint:{maxProperties:e},...t})}function dZ(e,t,r){return e=xr(e),t=xr(t),Ue(n=>Reflect.ownKeys(n).length>=e&&Reflect.ownKeys(n).length<=t,{expected:e===t?`a value with exactly ${e===1?\"1 entry\":`${e} entries`}`:`a value with between ${e} and ${t} entries`,representation:{id:\"effect/schema/isBetweenProperties\",payload:{minimum:e,maximum:t}},toJsonSchema:({type:n})=>n===\"object\"?{minProperties:e,maxProperties:t}:[{minProperties:e,maxProperties:t},!0],toCode:()=>({runtime:`Schema.isBetweenProperties(${e}, ${t})`}),[Lr]:!0,arbitraryConstraint:{minProperties:e,maxProperties:t},...r})}function mZ(e,t){let r=$u(e),n=vF(r.ast);return Ue((o,s,a)=>{let i=Reflect.ownKeys(o),c=[];for(let u of i){let f=n(u,a);if(f!==void 0&&(c.push(new ut([u],f)),a.errors===\"first\"))break}return or(c)?new wt(s,c,o,a):!0},{expected:\"an object with property names matching the schema\",representation:{id:\"effect/schema/isPropertyNames\",payload:null,schemas:[r.ast]},toJsonSchema:({schemas:o,type:s})=>s===\"object\"?{propertyNames:o[0]}:[{propertyNames:o[0]},!0],toCode:({schemas:o})=>({runtime:`Schema.isPropertyNames(${o[0].runtime})`}),[Lr]:!0,...t})}function uw(e){return Ue(t=>zd(t).length===t.length,{expected:\"an array with unique items\",representation:{id:\"effect/schema/isUnique\",payload:null},toJsonSchema:()=>({uniqueItems:!0}),toCode:()=>({runtime:\"Schema.isUnique()\"}),arbitraryConstraint:{uniqueBy:R},...e})}function eD(e){return Ue(t=>zd(t.map(([r])=>r)).length===t.length,{expected:\"an array with unique keys\",representation:{id:\"effect/schema/isUniqueKey\",payload:null},toCode:()=>({runtime:\"Schema.isUniqueKey()\"}),arbitraryConstraint:{uniqueBy:t=>t[0]},...e})}var fw=K.check(QU()),hZ=K.check(iw(1,1)),tD=e=>(e?.includeStack===!0?1:0)|(e?.excludeCause===!0?2:0),rD=e=>{switch(e){case 0:return;case 1:return{includeStack:!0};case 2:return{excludeCause:!0};case 3:return{includeStack:!0,excludeCause:!0}}},cU=[];function xZ(e){let t=tD(e),r=cU[t];if(r!==void 0)return r;let n=rD(t),o=ba(globalThis.Error,{representation:{id:\"effect/schema/Error\",payload:n??null},toCode:()=>({runtime:n!==void 0?`Schema.ErrorInstance(${F(n)})`:\"Schema.ErrorInstance()\",Type:\"globalThis.Error\"}),expected:\"Error\",toCodecJson:()=>Oe()($8,lM(n))});return cU[t]=o,o}var uU=[];function gZ(e){let t=tD(e),r=uU[t];if(r!==void 0)return r;let n=Nx.pipe(G(vp,pM(rD(t))));return uU[t]=n,n}function yZ(e,t){let r=qr()([e,t],([n,o])=>{let s=$e(Qo([n,o]));return(a,i,c)=>a instanceof globalThis.Map?Vt(nt(s)([...a],c),{onSuccess:u=>new globalThis.Map(u),onFailure:u=>Br(i,\"entries\",u,a,c)}):P(new ft(i,a,c))},{representation:{id:\"effect/schema/ReadonlyMap\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.ReadonlyMap(${n[0].runtime}, ${n[1].runtime})`,Type:`globalThis.ReadonlyMap<${n[0].Type}, ${n[1].Type}>`}),expected:\"ReadonlyMap\",toCodec:([n,o])=>Oe()($e(Qo([n,o])),Pe({decode:s=>new globalThis.Map(s),encode:s=>[...s.entries()]}))});return q(r.ast,{key:e,value:t})}function SZ(e){let t=qr()([e],([r])=>{let n=$e(r);return(o,s,a)=>o instanceof globalThis.Set?Vt(nt(n)([...o],a),{onSuccess:i=>new globalThis.Set(i),onFailure:i=>Br(s,\"values\",i,o,a)}):P(new ft(s,o,a))},{representation:{id:\"effect/schema/ReadonlySet\",payload:null},toCode:({typeParameters:r})=>({runtime:`Schema.ReadonlySet(${r[0].runtime})`,Type:`globalThis.ReadonlySet<${r[0].Type}>`}),expected:\"ReadonlySet\",toCodec:([r])=>Oe()($e(r),Pe({decode:n=>new globalThis.Set(n),encode:n=>[...n.values()]}))});return q(t.ast,{value:e})}var bZ=ba(globalThis.RegExp,{representation:{id:\"effect/schema/RegExp\",payload:null},toCode:()=>({runtime:\"Schema.RegExp\",Type:\"globalThis.RegExp\"}),expected:\"RegExp\",toCodecJson:()=>Oe()(Me({source:K,flags:K}),Yt({decode:(e,t)=>Qc({try:()=>new globalThis.RegExp(e.source,e.flags),catch:()=>new de({expected:\"valid RegExp source and flags\"},e,t)}),encode:e=>g({source:e.source,flags:e.flags})}))}),nD=K.annotate({expected:\"a string that will be decoded as a URL\"}),Ox=ba(globalThis.URL,{representation:{id:\"effect/schema/URL\",payload:null},toCode:()=>({runtime:\"Schema.URL\",Type:\"globalThis.URL\"}),expected:\"URL\",toCodecJson:()=>Oe()(nD,hI)}),EZ=nD.pipe(G(Ox,hI)),oD=K.annotate({expected:\"a string that will be decoded as a Date\"}),Wu=Be(e=>e instanceof globalThis.Date&&!globalThis.Number.isNaN(e.getTime()),{representation:{id:\"effect/schema/Date\",payload:null},toCode:()=>({runtime:\"Schema.Date\",Type:\"globalThis.Date\"}),expected:\"a valid Date\",toCodecJson:()=>Oe()(oD,dI)}),IZ=oD.pipe(G(Wu,dI)),TZ=lo.pipe(G(Wu,sM)),wZ=K.annotate({expected:\"a string that will be decoded as JSON\",contentMediaType:\"application/json\"});function lw(e,t){return wZ.pipe(G(e,IM(t)))}var CZ=lw(vp),sD=ba(globalThis.File,{representation:{id:\"effect/schema/File\",payload:null},toCode:()=>({runtime:\"Schema.File\",Type:\"globalThis.File\"}),expected:\"File\",toCodecJson:()=>Oe()(Me({data:K.check(KU()),type:K,name:K,lastModified:lo}),Yt({decode:(e,t)=>wr(Ei(e.data),{onFailure:()=>P(new de({expected:\"a valid Base64 string\"},e.data,t)),onSuccess:r=>{let n=new globalThis.Uint8Array(r);return g(new globalThis.File([n],e.name,{type:e.type,lastModified:e.lastModified}))}}),encode:(e,t)=>Zc({try:async()=>{let r=new globalThis.Uint8Array(await e.arrayBuffer());return{data:su(r),type:e.type,name:e.name,lastModified:e.lastModified}},catch:()=>new de({expected:\"a readable File\"},e,t)})}))}),aD=ba(globalThis.FormData,{representation:{id:\"effect/schema/FormData\",payload:null},toCode:()=>({runtime:\"Schema.FormData\",Type:\"globalThis.FormData\"}),expected:\"FormData\",toCodecJson:()=>Oe()($e(Qo([K,it([Me({_tag:Hi(\"String\"),value:K}),Me({_tag:Hi(\"File\"),value:sD})])])),Yt({decode:e=>{let t=new globalThis.FormData;for(let[r,n]of e)t.append(r,n.value);return g(t)},encode:e=>g(globalThis.Array.from(e.entries()).map(([t,r])=>typeof r==\"string\"?[t,{_tag:\"String\",value:r}]:[t,{_tag:\"File\",value:r}]))}))});function AZ(e){return aD.pipe(G(e,TM))}var iD=ba(globalThis.URLSearchParams,{representation:{id:\"effect/schema/URLSearchParams\",payload:null},toCode:()=>({runtime:\"Schema.URLSearchParams\",Type:\"globalThis.URLSearchParams\"}),expected:\"URLSearchParams\",toCodecJson:()=>Oe()(K.annotate({expected:\"a query string that will be decoded as URLSearchParams\"}),Pe({decode:e=>new globalThis.URLSearchParams(e),encode:e=>e.toString()}))});function kZ(e){return iD.pipe(G(e,wM))}var vZ=K.annotate({expected:\"a string that will be decoded as a number\"}).pipe(G(Wi,pu)),OZ=K.annotate({expected:\"a string that will be decoded as a finite number\"}).pipe(G(qu,pu)),_Z=q(GI).pipe(G(Bu,Mh)),cD=K.check(JU()),RZ=K.annotate({expected:\"a string that will be decoded as a trimmed string\"}).pipe(G(cD,nM())),PZ=K.annotate({expected:\"a base64 encoded string that will be decoded as a UTF-8 string\"}).pipe(G(K,yM)),MZ=K.annotate({expected:\"a base64 (URL) encoded string that will be decoded as a UTF-8 string\"}).pipe(G(K,SM)),FZ=K.annotate({expected:\"a hex encoded string that will be decoded as a UTF-8 string\"}).pipe(G(K,bM)),NZ=K.annotate({expected:\"a URI component encoded string that will be decoded as a UTF-8 string\"}).pipe(G(K,EM)),KT=it([qu,OU,K]),UZ=Me({issues:$e(Me({message:K,path:Lu($e(it([KT,Me({key:KT})])))}))}),DZ=fo([0,1]).pipe(G(XT,Pe({decode:e=>e===1,encode:e=>e?1:0}))),uD=K.annotate({expected:\"a base64 encoded string that will be decoded as Uint8Array\",format:\"byte\",contentEncoding:\"base64\"}),_x=ba(globalThis.Uint8Array,{representation:{id:\"effect/schema/Uint8Array\",payload:null},toCode:()=>({runtime:\"Schema.Uint8Array\",Type:\"globalThis.Uint8Array\"}),expected:\"Uint8Array\",toCodecJson:()=>Oe()(uD,xI)}),LZ=uD.pipe(G(_x,xI)),$Z=K.annotate({expected:\"a base64 (URL) encoded string that will be decoded as a Uint8Array\"}).pipe(G(_x,{decode:WP(),encode:vh()})),BZ=K.annotate({expected:\"a hex encoded string that will be decoded as a Uint8Array\"}).pipe(G(_x,{decode:KP(),encode:Oh()})),fD=Yt({decode:(e,t)=>{let r=iR(e);return fe(r)?P(new de({expected:\"a valid BigDecimal string\"},e,t)):g(r.value)},encode:e=>g(ws(e))}),jZ=Op({order:nu,formatter:e=>ws(e)}),zZ=_p({order:nu,formatter:e=>ws(e)}),qZ=Rp({order:nu,formatter:e=>ws(e)}),HZ=Pp({order:nu,formatter:e=>ws(e)}),WZ=Mp({order:nu,formatter:e=>ws(e)}),lD=K.annotate({expected:\"a string that will be decoded as a BigDecimal\"}),pD=Be(iE,{representation:{id:\"effect/schema/BigDecimal\",payload:null},toCode:()=>({runtime:\"Schema.BigDecimal\",Type:\"BigDecimal.BigDecimal\",importDeclarations:['import * as BigDecimal from \"effect/BigDecimal\"']}),expected:\"BigDecimal\",toCodecJson:()=>Oe()(lD,fD),toFormatter:()=>e=>ws(e)}),JZ=lD.pipe(G(pD,fD)),Ju=Be(gR,{representation:{id:\"effect/schema/ByteSize\",payload:null},toCode:()=>({runtime:\"Schema.ByteSize\",Type:\"ByteSize.ByteSize\",importDeclarations:['import * as ByteSize from \"effect/ByteSize\"']}),expected:\"ByteSize\",toCodecJson:()=>Oe()(Bu.check(VU(globalThis.BigInt(0))),Pe({decode:xR,encode:uh})),toCodecStringTree:()=>Oe()(dD,mI)}),dD=K.annotate({expected:\"a string that will be decoded as a ByteSize\"}),KZ=dD.pipe(G(Ju,mI)),GZ=Bu.pipe(G(Ju,aM)),VZ=Wi.pipe(G(Ju,iM));function GT(e,t){let r=qr()([e,t],([n,o])=>(s,a,i)=>{if(!tb(s))return P(new ft(a,s,i));switch(s._tag){case\"Fail\":return Vt(nt(n)(s.error,i),{onSuccess:jc,onFailure:c=>Br(a,\"error\",c,s,i)});case\"Die\":return Vt(nt(o)(s.defect,i),{onSuccess:zc,onFailure:c=>Br(a,\"defect\",c,s,i)});case\"Interrupt\":return g(s)}},{representation:{id:\"effect/schema/CauseReason\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.CauseReason(${n[0].runtime}, ${n[1].runtime})`,Type:`Cause.Failure<${n[0].Type}, ${n[1].Type}>`,importDeclarations:['import * as Cause from \"effect/Cause\"']}),expected:\"Cause.Failure\",toCodec:([n,o])=>Oe()(it([Me({_tag:Ct(\"Fail\"),error:n}),Me({_tag:Ct(\"Die\"),defect:o}),Me({_tag:Ct(\"Interrupt\"),fiberId:Ax(qu)})]),Pe({decode:s=>{switch(s._tag){case\"Fail\":return jc(s.error);case\"Die\":return zc(s.defect);case\"Interrupt\":return nb(s.fiberId)}},encode:s=>{switch(s._tag){case\"Fail\":return{_tag:\"Fail\",error:s.error};case\"Die\":return{_tag:\"Die\",defect:s.defect};case\"Interrupt\":return{_tag:\"Interrupt\",fiberId:s.fiberId}}}}))});return q(r.ast,{error:e,defect:t})}function VT(e,t){let r=qr()([e,t],([n,o])=>{let s=$e(GT(n,o));return(a,i,c)=>eb(a)?Vt(nt(s)(a.reasons,c),{onSuccess:oa,onFailure:u=>Br(i,\"failures\",u,a,c)}):P(new ft(i,a,c))},{representation:{id:\"effect/schema/Cause\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.Cause(${n[0].runtime}, ${n[1].runtime})`,Type:`Cause.Cause<${n[0].Type}, ${n[1].Type}>`,importDeclarations:['import * as Cause from \"effect/Cause\"']}),expected:\"Cause\",toCodec:([n,o])=>Oe()($e(GT(n,o)),Pe({decode:oa,encode:({reasons:s})=>s}))});return q(r.ast,{error:e,defect:t})}function fU(e){return Oe()(e,Pe({decode:hE,encode:Ye}))}function ZZ(e){let t=qr()([e],([r])=>{let n=$e(r);return(o,s,a)=>lh(o)?Vt(nt(n)(Ye(o),a),{onSuccess:hE,onFailure:i=>Br(s,\"values\",i,o,a)}):P(new ft(s,o,a))},{representation:{id:\"effect/schema/Chunk\",payload:null},toCode:({typeParameters:r})=>({runtime:`Schema.Chunk(${r[0].runtime})`,Type:`Chunk.Chunk<${r[0].Type}>`}),expected:\"Chunk\",toCodec:([r])=>fU($e(r)),toCodecArbitrary:({constraint:r,typeParameters:[n]})=>fU(Cx($e(n),r?.minLength,r?.maxLength)),toEquivalence:([r])=>dE(r)});return q(t.ast,{value:e})}function mD(){return gt((e,t)=>Wt(yE(e),{onNone:()=>P(new de({message:\"Invalid DateTime input\"},e,t)),onSome:r=>g(SE(r))}))}var YZ=Pe({decode:e=>EE(e),encode:e=>e.offset}),hD=Yt({decode:(e,t)=>Wt(PR(e),{onNone:()=>P(new de({expected:\"a valid IANA time zone\"},e,t)),onSome:g}),encode:e=>g(e.id)}),xD=Yt({decode:(e,t)=>Wt(MR(e),{onNone:()=>P(new de({expected:\"a valid time zone\"},e,t)),onSome:g}),encode:e=>g(Dl(e))}),gD=Yt({decode:(e,t)=>Wt(yE(e),{onNone:()=>P(new de({expected:\"a valid UTC DateTime string\"},e,t)),onSome:r=>g(SE(r))}),encode:e=>g(UR(e))}),yD=Yt({decode:(e,t)=>Wt(RR(e),{onNone:()=>P(new de({expected:\"a valid Zoned DateTime string\"},e,t)),onSome:g}),encode:e=>g(IE(e))}),SD=-864e13,bD=864e13,QZ=SD+840*60*1e3,XZ=bD-840*60*1e3,e5=-720*60*1e3,t5=840*60*1e3,ED=[\"UTC\",\"Europe/London\",\"America/New_York\",\"Asia/Tokyo\",\"Australia/Sydney\"];function ID(e,t,r){let n=Math.max(t,e?.minimum===void 0?t:e.minimum.epochMilliseconds+(e.exclusiveMinimum===!0?1:0)),o=Math.min(r,e?.maximum===void 0?r:e.maximum.epochMilliseconds-(e.exclusiveMaximum===!0?1:0));return n<=o?[n,o]:[t,r]}function pw(e,t){return lo.check(Hu({minimum:e,maximum:t}))}function TD(){return it([pw(e5,t5),fo(ED)])}var Rx=Be(e=>gE(e)&&AR(e),{representation:{id:\"effect/schema/DateTimeUtc\",payload:null},toCode:()=>({runtime:\"Schema.DateTimeUtc\",Type:\"DateTime.Utc\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.Utc\",toCodecArbitrary:({constraint:e})=>{let[t,r]=ID(e,SD,bD);return ju()(pw(t,r),oe(OR))},toCodecJson:()=>Oe()(K,gD),toFormatter:()=>e=>e.toString()}),r5=Wu.pipe(G(Rx,{decode:mD(),encode:oe(FR)})),n5=K.annotate({expected:\"a string that will be decoded as a DateTime.Utc\"}).pipe(G(Rx,gD)),o5=lo.pipe(G(Rx,{decode:mD(),encode:oe(NR)})),s5=Be(wR,{representation:{id:\"effect/schema/TimeZoneOffset\",payload:null},toCode:()=>({runtime:\"Schema.TimeZoneOffset\",Type:\"DateTime.TimeZone.Offset\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.TimeZone.Offset\",toCodecJson:()=>Oe()(lo,YZ),toFormatter:()=>e=>Dl(e)}),wD=K.annotate({expected:\"an IANA time zone identifier\"}),CD=Be(CR,{representation:{id:\"effect/schema/TimeZoneNamed\",payload:null},toCode:()=>({runtime:\"Schema.TimeZoneNamed\",Type:\"DateTime.TimeZone.Named\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.TimeZone.Named\",toCodecArbitrary:()=>ju()(fo(ED),oe(bE)),toCodecJson:()=>Oe()(wD,hD),toFormatter:()=>e=>Dl(e)}),a5=wD.pipe(G(CD,hD)),AD=K.annotate({expected:\"a time zone string (IANA identifier or offset like +03:00)\"}),kD=Be(TR,{representation:{id:\"effect/schema/TimeZone\",payload:null},toCode:()=>({runtime:\"Schema.TimeZone\",Type:\"DateTime.TimeZone\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.TimeZone\",toCodecArbitrary:()=>ju()(TD(),oe(e=>typeof e==\"number\"?EE(e):bE(e))),toCodecJson:()=>Oe()(AD,xD),toFormatter:()=>e=>Dl(e)}),i5=AD.pipe(G(kD,xD)),vD=K.annotate({expected:\"a zoned DateTime string (e.g. 2024-01-01T00:00:00.000+00:00[Europe/London])\"}),OD=Be(e=>gE(e)&&kR(e),{representation:{id:\"effect/schema/DateTimeZoned\",payload:null},toCode:()=>({runtime:\"Schema.DateTimeZoned\",Type:\"DateTime.Zoned\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.Zoned\",toCodecArbitrary:({constraint:e})=>{let[t,r]=ID(e,QZ,XZ);return ju()(Me({epochMilliseconds:pw(t,r),timeZone:TD()}),oe(({epochMilliseconds:n,timeZone:o})=>_R(n,{timeZone:o})))},toCodecJson:()=>Oe()(vD,yD),toFormatter:()=>e=>IE(e),toEquivalence:()=>vR}),c5=vD.pipe(G(OD,yD)),po=(e,t,r,n)=>K.pipe(G(e,Yt({decode:(o,s)=>{let a=t(o);return mt(a)?g(a.success):P(new de({message:a.failure.message},o,s))},encode:o=>g(r(o))}))).annotate({identifier:n}),Ji=Be(Pu,{identifier:\"MacAddress\"}),Ku=po(Ji,qN,PT,\"MacAddressFromString\"),Px=Be(hr,{identifier:\"Ipv4Address\"}),dw=po(Px,Mu,uo,\"Ipv4AddressFromString\"),mw=Be(Yo,{identifier:\"Ipv6Address\"}),_D=po(mw,Sp,uo,\"Ipv6AddressFromString\"),Ki=Be(jN,{identifier:\"IpAddress\"}),Gu=po(Ki,bp,uo,\"IpAddressFromString\"),Xe=(e,t,r,n)=>FU(t,{expected:r})(e).annotate({identifier:n}),u5=Xe(Ki,Fu,\"a multicast address\",\"IpMulticastAddress\"),f5=Xe(Gu,Fu,\"a multicast address\",\"IpMulticastAddressFromString\"),l5=Xe(Ji,Fu,\"a multicast address\",\"MacMulticastAddress\"),p5=Xe(Ku,Fu,\"a multicast address\",\"MacMulticastAddressFromString\"),d5=Xe(Ki,UT,\"a unicast address\",\"IpUnicastAddress\"),m5=Xe(Gu,UT,\"a unicast address\",\"IpUnicastAddressFromString\"),h5=Xe(Ji,mx,\"a unicast address\",\"MacUnicastAddress\"),x5=Xe(Ku,mx,\"a unicast address\",\"MacUnicastAddressFromString\"),g5=Xe(Px,xx,\"a broadcast address\",\"Ipv4BroadcastAddress\"),y5=Xe(dw,xx,\"a broadcast address\",\"Ipv4BroadcastAddressFromString\"),S5=Xe(Ji,dx,\"a broadcast address\",\"MacBroadcastAddress\"),b5=Xe(Ku,dx,\"a broadcast address\",\"MacBroadcastAddressFromString\"),E5=Xe(Ki,NT,\"a loopback address\",\"IpLoopbackAddress\"),I5=Xe(Gu,NT,\"a loopback address\",\"IpLoopbackAddressFromString\"),T5=Xe(Ki,DT,\"a link-local address\",\"IpLinkLocalAddress\"),w5=Xe(Gu,DT,\"a link-local address\",\"IpLinkLocalAddressFromString\"),C5=Xe(Ki,hx,\"an unspecified address\",\"IpUnspecifiedAddress\"),A5=Xe(Gu,hx,\"an unspecified address\",\"IpUnspecifiedAddressFromString\"),k5=Xe(Px,LT,\"a private address\",\"Ipv4PrivateAddress\"),v5=Xe(dw,LT,\"a private address\",\"Ipv4PrivateAddressFromString\"),O5=Xe(mw,$T,\"a unique-local address\",\"Ipv6UniqueLocalAddress\"),_5=Xe(_D,$T,\"a unique-local address\",\"Ipv6UniqueLocalAddressFromString\"),R5=Xe(Ji,MT,\"a locally administered address\",\"MacLocallyAdministeredAddress\"),P5=Xe(Ku,MT,\"a locally administered address\",\"MacLocallyAdministeredAddressFromString\"),M5=Xe(Ji,FT,\"a universally administered address\",\"MacUniversallyAdministeredAddress\"),F5=Xe(Ku,FT,\"a universally administered address\",\"MacUniversallyAdministeredAddressFromString\"),RD=Be(GN,{identifier:\"Ipv4Interface\"}),N5=po(RD,yx,Tp,\"Ipv4InterfaceFromString\"),PD=Be(VN,{identifier:\"Ipv6Interface\"}),U5=po(PD,Sx,Tp,\"Ipv6InterfaceFromString\"),MD=Be(Ep,{identifier:\"IpInterface\"}),D5=po(MD,bx,Tp,\"IpInterfaceFromString\"),FD=Be(YN,{identifier:\"Ipv4Network\"}),L5=po(FD,XN,Cp,\"Ipv4NetworkFromString\"),ND=Be(QN,{identifier:\"Ipv6Network\"}),$5=po(ND,eU,Cp,\"Ipv6NetworkFromString\"),UD=Be(wp,{identifier:\"IpNetwork\"}),B5=po(UD,tU,Cp,\"IpNetworkFromString\"),j5=Be(gp,{identifier:\"InetAddressV4\"}),z5=Be(yp,{identifier:\"InetAddressV6\"}),DD=Be(_T,{identifier:\"InetAddress\"}),q5=po(DD,JN,gx,\"InetAddressFromString\"),LD=Be(px,{identifier:\"UnixPathAddress\"}),H5=K.pipe(G(LD,Pe({decode:KN,encode:e=>e.path}))).annotate({identifier:\"UnixPathAddressFromString\"}),W5=Be(zN,{identifier:\"SocketAddress\"}),J5=Yt({decode:(e,t)=>Wt(kA(e),{onNone:()=>P(new de({expected:\"a valid Duration string\"},e,t)),onSome:g}),encode:e=>g(globalThis.String(e))}),K5=Yt({decode:e=>g(Ro(e)),encode:(e,t)=>Wt(OA(e),{onNone:()=>P(new de({expected:\"a Duration representable as a bigint\"},e,t)),onSome:r=>g(r)})}),G5=Pe({decode:e=>Js(e),encode:e=>Cr(e)}),Mx=Be(Ey,{representation:{id:\"effect/schema/Duration\",payload:null},toCode:()=>({runtime:\"Schema.Duration\",Type:\"Duration.Duration\",importDeclarations:['import * as Duration from \"effect/Duration\"']}),expected:\"Duration\",toCodecJson:()=>Oe()(it([Me({_tag:Ct(\"Infinity\")}),Me({_tag:Ct(\"NegativeInfinity\")}),Me({_tag:Ct(\"Nanos\"),value:Bu}),Me({_tag:Ct(\"Millis\"),value:lo})]),Pe({decode:e=>{switch(e._tag){case\"Infinity\":return ls;case\"NegativeInfinity\":return Ac;case\"Nanos\":return Ro(e.value);case\"Millis\":return Js(e.value)}},encode:e=>{switch(e.value._tag){case\"Infinity\":return{_tag:\"Infinity\"};case\"NegativeInfinity\":return{_tag:\"NegativeInfinity\"};case\"Nanos\":return{_tag:\"Nanos\",value:e.value.nanos};case\"Millis\":return{_tag:\"Millis\",value:e.value.millis}}}}))}),V5=K.annotate({expected:\"a string that will be decoded as a Duration\"}),hw=V5.pipe(G(Mx,J5)),Z5=Bu.pipe(G(Mx,K5)),Y5=Wi.pipe(G(Mx,G5));function Q5(e,t,r){let n=qr()([e,t,r],([o,s,a])=>{let i=VT(s,a);return(c,u,f)=>{if(!hl(c))return P(new ft(u,c,f));switch(c._tag){case\"Success\":return Vt(nt(o)(c.value,f),{onSuccess:vr,onFailure:p=>Br(u,\"value\",p,c,f)});case\"Failure\":return Vt(nt(i)(c.cause,f),{onSuccess:sn,onFailure:p=>Br(u,\"cause\",p,c,f)})}}},{representation:{id:\"effect/schema/Exit\",payload:null},toCode:({typeParameters:o})=>({runtime:`Schema.Exit(${o[0].runtime}, ${o[1].runtime}, ${o[2].runtime})`,Type:`Exit.Exit<${o[0].Type}, ${o[1].Type}, ${o[2].Type}>`,importDeclarations:['import * as Exit from \"effect/Exit\"']}),expected:\"Exit\",toCodec:([o,s,a])=>Oe()(it([Me({_tag:Ct(\"Success\"),value:o}),Me({_tag:Ct(\"Failure\"),cause:VT(s,a)})]),Pe({decode:i=>i._tag===\"Success\"?vr(i.value):sn(i.cause),encode:i=>Ve(i)?{_tag:\"Success\",value:i.value}:{_tag:\"Failure\",cause:i.cause}}))});return q(n.ast,{value:e,error:t,defect:r})}function lU(e,t,r){return Me({type:Ct(e),nodes:$e(Me({index:zi,data:t})),edges:$e(Me({index:zi,source:zi,target:zi,data:r}))})}function pU(e,t){let r=-1,n=new Set;for(let o=0;o<e.nodes.length;o++){let s=e.nodes[o].index;if(s<=r)return P(new ut([\"nodes\",o,\"index\"],new de({expected:\"a strictly increasing node index\"},s,t)));r=s,n.add(s)}r=-1;for(let o=0;o<e.edges.length;o++){let s=e.edges[o];if(s.index<=r)return P(new ut([\"edges\",o,\"index\"],new de({expected:\"a strictly increasing edge index\"},s.index,t)));if(r=s.index,!n.has(s.source))return P(new ut([\"edges\",o,\"source\"],new de({expected:\"an encoded node index\"},s.source,t)));if(!n.has(s.target))return P(new ut([\"edges\",o,\"target\"],new de({expected:\"an encoded node index\"},s.target,t)))}return g(bh(e))}function X5(e,t,r){return!QE(e)||e.mutable||e.type!==t?P(new de({expected:`an immutable ${t} Graph`},e,r)):g(Hl(e))}function e8(e,t){return(r,n)=>{let o=Hl(r),s=Hl(n);if(o.type!==s.type||o.nodes.length!==s.nodes.length||o.edges.length!==s.edges.length)return!1;for(let a=0;a<o.nodes.length;a++)if(o.nodes[a].index!==s.nodes[a].index||!e(o.nodes[a].data,s.nodes[a].data))return!1;for(let a=0;a<o.edges.length;a++){let i=o.edges[a],c=s.edges[a],u=o.type===\"directed\"?i.source===c.source&&i.target===c.target:i.source===c.source&&i.target===c.target||i.source===c.target&&i.target===c.source;if(i.index!==c.index||!u||!t(i.data,c.data))return!1}return!0}}function t8(e,t,r){return ju()(it([wx,Me({nodes:tw(t),edges:$e(Qo([zi,zi,r]))})]),oe(n=>{if(n===null)return bh({type:e,nodes:[],edges:[]});let o=n.nodes.map((s,a)=>({index:a,data:s}));return bh({type:e,nodes:o,edges:n.edges.map(([s,a,i],c)=>({index:c,source:s%o.length,target:a%o.length,data:i}))})}))}function r8(e,t,r){let n=qr()([t,r],([o,s])=>{let a=lU(e,o,s);return(i,c,u)=>!QE(i)||i.mutable||i.type!==e?P(new ft(c,i,u)):I(nt(a)(Hl(i),u),f=>pU(f,u))},{representation:{id:\"effect/schema/Graph\",payload:e},toCode:({typeParameters:o})=>({runtime:`Schema.Graph(${F(e)}, ${o[0].runtime}, ${o[1].runtime})`,Type:`Graph.Graph<${o[0].Type}, ${o[1].Type}, ${F(e)}>`,importDeclarations:['import * as Graph from \"effect/Graph\"']}),expected:`an immutable ${e} Graph`,toCodec:([o,s])=>Oe()(lU(e,o,s),Yt({decode:pU,encode:(a,i)=>X5(a,e,i)})),toCodecArbitrary:({typeParameters:[o,s]})=>t8(e,o,s),toEquivalence:([o,s])=>e8(o,s)});return q(n.ast,{type:e,node:t,edge:r})}function dU(e){return Oe()(e,Pe({decode:PE,encode:zl}))}function n8(e,t){let r=qr()([e,t],([n,o])=>{let s=$e(Qo([n,o]));return(a,i,c)=>GR(a)?Vt(nt(s)(zl(a),c),{onSuccess:PE,onFailure:u=>Br(i,\"entries\",u,a,c)}):P(new ft(i,a,c))},{representation:{id:\"effect/schema/HashMap\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.HashMap(${n[0].runtime}, ${n[1].runtime})`,Type:`HashMap.HashMap<${n[0].Type}, ${n[1].Type}>`,importDeclarations:['import * as HashMap from \"effect/HashMap\"']}),expected:\"HashMap\",toCodec:([n,o])=>dU($e(Qo([n,o]))),toCodecArbitrary:({constraint:n,typeParameters:[o,s]})=>dU(Cx($e(Qo([o,s])).check(eD()),n?.minSize,n?.maxSize)),toEquivalence:([n,o])=>ld(n,o)});return q(r.ast,{key:e,value:t})}function mU(e){return Oe()(e,Pe({decode:NE,encode:Ye}))}function o8(e){let t=qr()([e],([r])=>{let n=$e(r);return(o,s,a)=>XR(o)?Vt(nt(n)(Ye(o),a),{onSuccess:NE,onFailure:i=>Br(s,\"values\",i,o,a)}):P(new ft(s,o,a))},{representation:{id:\"effect/schema/HashSet\",payload:null},toCode:({typeParameters:r})=>({runtime:`Schema.HashSet(${r[0].runtime})`,Type:`HashSet.HashSet<${r[0].Type}>`}),expected:\"HashSet\",toCodec:([r])=>mU($e(r)),toCodecArbitrary:({constraint:r,typeParameters:[n]})=>mU(Cx($e(n).check(uw()),r?.minSize,r?.maxSize)),toEquivalence:([r])=>wf(r)});return q(t.ast,{value:e})}function Gi(e){let t=qr()([e],([r])=>(n,o,s)=>wc(n)?fe(n)?aa:Vt(nt(r)(n.value,s),{onSuccess:O,onFailure:a=>Br(o,\"value\",a,n,s)}):P(new ft(o,n,s)),{representation:{id:\"effect/schema/Option\",payload:null},toCode:({typeParameters:r})=>({runtime:`Schema.Option(${r[0].runtime})`,Type:`Option.Option<${r[0].Type}>`,importDeclarations:['import * as Option from \"effect/Option\"']}),expected:\"Option\",toCodec:([r])=>Oe()(it([Me({_tag:Ct(\"Some\"),value:r}),Me({_tag:Ct(\"None\")})]),Pe({decode:n=>n._tag===\"None\"?v():O(n.value),encode:n=>be(n)?{_tag:\"Some\",value:n.value}:{_tag:\"None\"}}))});return q(t.ast,{value:e})}function s8(e){return rw(e).pipe(G(Gi(Hr(e)),dM()))}function a8(e){return Ax(e).pipe(G(Gi(Hr(e)),mM()))}function i8(e,t){return PU(e).pipe(G(Gi(Hr(e)),hM(t)))}var $D=Be(nP,{representation:{id:\"effect/http/Cookie\",payload:null},toCode:()=>({runtime:\"Schema.Cookie\",Type:\"Cookies.Cookie\",importDeclarations:['import * as Cookies from \"effect/http/Cookies\"']}),expected:\"Cookie\"}),BD=Be(rP,{representation:{id:\"effect/http/Cookies\",payload:null},toCode:()=>({runtime:\"Schema.Cookies\",Type:\"Cookies.Cookies\",importDeclarations:['import * as Cookies from \"effect/http/Cookies\"']}),expected:\"Cookies\",toCodecJson:()=>Oe()($e(K),Pe({decode:oP,encode:uP})),toCodecIso:()=>Oe()(_s(K,$D),Pe({decode:jE,encode:e=>e.cookies}))}),c8=BD.pipe(G(_s(K,K),Pe({decode:cP,encode:e=>zE(globalThis.Object.entries(e).map(([t,r])=>iP(t,r)))}))),u8=Be(dP,{representation:{id:\"effect/http/Headers\",payload:null},toCode:()=>({runtime:\"Schema.Headers\",Type:\"Headers.Headers\",importDeclarations:['import * as Headers from \"effect/http/Headers\"']}),expected:\"Headers\",toEquivalence:()=>KE,toCodec:()=>Oe()(_s(K,K),Pe({decode:mP,encode:e=>({...e})}))}),xw=Be(VE,{representation:{id:\"effect/http/UrlParams\",payload:null},toCode:()=>({runtime:\"Schema.UrlParams\",Type:\"UrlParams.UrlParams\",importDeclarations:['import * as UrlParams from \"effect/http/UrlParams\"']}),expected:\"UrlParams\",toEquivalence:()=>ZE,toCodec:()=>Oe()($e(Qo([K,K])),Pe({decode:Sh,encode:e=>e.params}))}),f8=(e,t)=>xw.pipe(G(lw(vp,t),Yt({decode:r=>Wt(gP(r,e),{onNone:()=>P(new ut([e],new ma(void 0))),onSome:g}),encode:r=>g(Sh([[e,r]]))}))),l8=xw.pipe(G(_s(K,it([K,tw(K)])),Pe({decode:yP,encode:hP})));function p8(e){return qi(e).pipe(G(Gi(Hr(e)),xM()))}function d8(e){return Lu(e).pipe(G(Gi(Hr(e)),gM()))}function m8(e,t){let r=t===void 0?\"omit\":t.onNoneEncoding,n=r===null?null:void 0;return Lu(rw(e)).pipe(G(Gi(Hr(e)),Ph({decode:o=>o.pipe(Va(cd),O),encode:r===\"omit\"?Ga:o=>O(Ff(Ga(o),()=>n))})))}function Fx(e,t){let r=typeof t?.label==\"string\"?t.label:void 0,n=t?.disallowJsonEncode===!0,o=r!==void 0?n?{label:r,disallowJsonEncode:!0}:{label:r}:n?{disallowJsonEncode:!0}:void 0,s=r!==void 0?nt(Ct(r)):void 0,a=qr()([e],([i])=>(c,u,f)=>{if(qE(c)){let p=s!==void 0?Ul(s(c.label,f),d=>new ut([\"label\"],d)):Q;return st(p,()=>Vt(nt(i)(au(c),f),{onSuccess:d=>ki(d,{label:c.label}),onFailure:()=>new wt(u,[new ut([\"value\"],new de(void 0,c,f))],c,f)}))}return P(new ft(u,c,f))},{representation:{id:\"effect/schema/Redacted\",payload:o??null},toCode:({typeParameters:i})=>({runtime:o!==void 0?`Schema.Redacted(${i[0].runtime}, ${F(o)})`:`Schema.Redacted(${i[0].runtime})`,Type:`Redacted.Redacted<${i[0].Type}>`,importDeclarations:['import * as Redacted from \"effect/Redacted\"']}),expected:\"Redacted\",toCodecJson:([i])=>Oe()(i,{decode:oe(c=>ki(c,{label:r})),encode:n?Ah(c=>\"Cannot serialize Redacted\"+(be(c)&&typeof c.value.label==\"string\"?` with label: \"${c.value.label}\"`:\"\")):oe(au)}),toEquivalence:([i])=>pP(i)});return q(a.ast,{value:e})}function h8(e,t){return G(Fx(Hr(e),{label:t?.label,disallowJsonEncode:t?.disallowEncode}),{decode:oe(r=>ki(r,{label:t?.label})),encode:t?.disallowEncode?Ah(r=>\"Cannot encode Redacted\"+(be(r)&&typeof r.value.label==\"string\"?` with label: \"${r.value.label}\"`:\"\")):oe(au)})(e)}function x8(e,t){let r=qr()([e,t],([n,o])=>(s,a,i)=>{if(!iA(s))return P(new ft(a,s,i));switch(s._tag){case\"Success\":return Vt(nT(n)(s.success,i),{onSuccess:B,onFailure:c=>Br(a,\"success\",c,s,i)});case\"Failure\":return Vt(nT(o)(s.failure,i),{onSuccess:W,onFailure:c=>Br(a,\"failure\",c,s,i)})}},{representation:{id:\"effect/schema/Result\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.Result(${n[0].runtime}, ${n[1].runtime})`,Type:`Result.Result<${n[0].Type}, ${n[1].Type}>`,importDeclarations:['import * as Result from \"effect/Result\"']}),expected:\"Result\",toCodec:([n,o])=>Oe()(it([Me({_tag:Ct(\"Success\"),success:n}),Me({_tag:Ct(\"Failure\"),failure:o})]),Pe({decode:s=>s._tag===\"Success\"?B(s.success):W(s.failure),encode:s=>mt(s)?{_tag:\"Success\",success:s.success}:{_tag:\"Failure\",failure:s.failure}}))});return q(r.ast,{success:e,failure:t})}var g8=globalThis.Symbol.for(\"immer-draftable\"),ZT={};function gw(e,t,r,n,o){let s=S8(r,t,n),a=jD(t),i=class extends e{constructor(...[c,u]){let p=u?.[\"~payload\"],d=p?.token===ZT?p.value:r.make(c??{},u);super(d,{...u,disableChecks:!0,\"~payload\":{token:ZT,value:d}})}static[Ap]=Ap;get[a](){return a}static[g8]=!0;static identifier=t;static fields=r.fields;static get ast(){return s(this).ast}static pipe(){return Z(this,arguments)}static rebuild(c){return s(this).rebuild(c)}static make(c,u){return Yh(s(this))(c??{},u)}static makeOption(c,u){return Zh(s(this))(c??{},u)}static makeEffect(c,u){return s(this).makeEffect(c??{},u)}static annotate(c){return this.rebuild(to(this.ast,c))}static annotateKey(c){return this.rebuild(cp(this.ast,c))}static check(...c){return this.rebuild(Vo(this.ast,c))}static extend(c){return(u,f)=>{let p=Fp(u)?u:Me(u),d={...r.fields,...p.fields},m=Lh(d,r.ast.checks,{identifier:c});return gw(this,c,ew(Vo(m,p.ast.checks),d),f,o)}}static mapFields(c,u){return r.mapFields(c,u)}};return o!==void 0&&Object.assign(i.prototype,o(t)),i}function y8(e){return new ve(oe(t=>new e(t,{\"~payload\":{token:ZT,value:t}})),jr())}function jD(e){return`~effect/Schema/Class/${e}`}function S8(e,t,r){let n;return o=>{if(n!==void 0)return n;let s=jD(t),a=u=>u instanceof o||k(u,s),i=y8(o),c=q(new yu([e.ast],()=>(u,f,p)=>a(u)?g(u):P(new ft(f,u,p)),{identifier:t,[Ih]:([u])=>({isConstructed:a,link:new at(u,i)}),toCodec:([u])=>new at(u.ast,i),toEquivalence:([u])=>u,toFormatter:([u])=>f=>`${o.identifier}(${u(f)})`,[Wl]:hu(e.ast),...r}));return n=G(c,i)(e)}}function Fp(e){return Tx(e)}var zD=e=>(t,r)=>{let n=Fp(t)?t:Me(t);return gw(Kd,e,n,r,o=>({toString(){return`${o}(${F({...this})})`}}))},b8=e=>(t,r,n)=>{let o=Fp(r)?r.mapFields(s=>({_tag:Hi(t),...s}),{unsafePreserveChecks:!0}):kx(t,r);return zD(e??t)(o,n)},qD=e=>(t,r)=>{let n=Fp(t)?t:Me(t);return gw(_f,e,n,r,s=>({name:s}))},E8=e=>(t,r,n)=>{let o=Fp(r)?r.mapFields(s=>({_tag:Hi(t),...s}),{unsafePreserveChecks:!0}):kx(t,r);return qD(e??t)(o,n)};function I8(e){return t=>t.annotate({toFormatter:e})}function T8(e,t){return _N(e.ast,t)}function w8(e){return t=>t.annotate({toEquivalence:e})}function C8(e){return bT(e.ast)}function A8(e,t){return mp(e.ast,t)}function k8(e,t){let r=mp(Cu(e.ast),t);return ix(r,t)}var v8=rx,O8=nx,Np=ox,_8=oN;function R8(e,t){return CN(e,t)}function P8(e){return DN(e)}function M8(e){return LN(e)}function F8(e){return $N(e)}function N8(e,t){return r=>q(to(r.ast,{toCodecIso:()=>new at(e.ast,Rh(t))}),{schema:r})}function U8(e){return wN(e)}function D8(e){let t=MU(()=>r),r=it([e,$e(t),_s(K,t)]);return r}var Nx=q(to(xu,{toCode:()=>({runtime:\"Schema.Json\",Type:\"Schema.Json\"})})),L8=_s(K,Nx),$8=Me({message:K,name:qi(K),stack:qi(K),cause:qi(Nx)}),B8=q(to(bF,{toCode:()=>({runtime:\"Schema.MutableJson\",Type:\"Schema.MutableJson\"})}));function j8(e){return As(e.ast)}function z8(e){return e.ast.context?.annotations}var HD=\"~effect/MutableHashMap\";var q8={[HD]:HD,[Symbol.iterator](){return this.backing[Symbol.iterator]()},toString(){return`MutableHashMap(${F(Array.from(this))})`},toJSON(){return{_id:\"MutableHashMap\",values:vt(Array.from(this))}},[Te](){return this.toJSON()},pipe(){return Z(this,arguments)}},Up=()=>{let e=Object.create(q8);return e.backing=new Map,e.buckets=new Map,e};var Xo=l(2,(e,t)=>{if(e.backing.has(t))return O(e.backing.get(t));if(yw(t))return v();let r=H(t),n=e.buckets.get(r);return n===void 0?v():H8(e,n,t)}),yw=e=>typeof e!=\"object\"&&typeof e!=\"function\";var H8=(e,t,r)=>{for(let n=0,o=t.length;n<o;n++)if(J(r,t[n])){let s=t[n];return O(e.backing.get(s))}return v()};var Dp=l(3,(e,t,r)=>{if(e.backing.has(t)||yw(t))return e.backing.set(t,r),e;let n=H(t),o=e.buckets.get(n);if(o===void 0)return e.buckets.set(n,[t]),e.backing.set(t,r),e;let s=W8(o,t);return s===void 0&&(o.push(t),s=t),e.backing.set(s,r),e}),W8=(e,t)=>{for(let r=0,n=e.length;r<n;r++)if(J(t,e[r]))return e[r]};var Vu=l(2,(e,t)=>{if(yw(t))return e.backing.delete(t),e;let r=H(t),n=e.buckets.get(r);if(n===void 0)return e;for(let o=0,s=n.length;o<s;o++){let a=n[o];if(a===t||J(t,a)){e.backing.delete(a),n.splice(o,1);break}}return n.length===0&&e.buckets.delete(r),e}),Ux=e=>(e.backing.clear(),e.buckets.clear(),e),WD=e=>e.backing.size;var JD=Qy;var Ea=Xy,KD=hk,mo=rl;var Zu=ds,Ia=dO;var Pr=JS,GD=bO;var VD=\"~effect/MutableRef\",J8={[VD]:VD,...rr,toJSON(){return{_id:\"MutableRef\",current:vt(this.current)}}},Yu=e=>{let t=Object.create(J8);return t.current=e,t};var ZD=e=>e.current;var Lx=l(2,(e,t)=>(e.current=t,e));var Xt=Symbol.for(\"effect/MutableList/Empty\"),Ps=()=>({head:void 0,tail:void 0,length:0}),Ew=e=>{let t=e.head;t.offset>=1024&&t===e.tail&&t.mutable&&(t.array.length-t.offset)*8<=t.offset&&(e.head=e.tail={array:t.array.slice(t.offset),mutable:!0,offset:0,next:void 0})},YD=()=>({array:[],mutable:!0,offset:0,next:void 0}),ho=(e,t)=>{e.tail?e.tail.mutable||(e.tail.next=YD(),e.tail=e.tail.next):e.head=e.tail=YD(),e.tail.array.push(t),e.length++},Iw=(e,t)=>{e.head={array:[t],mutable:!0,offset:0,next:e.head},e.tail||(e.tail=e.head),e.length++};var $x=(e,t)=>Bx(e,Ye(t),!Array.isArray(t)),Bx=(e,t,r=!1)=>{if(t.length===0)return 0;let n={array:t,mutable:r,offset:0,next:void 0};return e.head?e.tail=e.tail.next=n:e.head=e.tail=n,e.length+=t.length,t.length},Rs=e=>{e.head=e.tail=void 0,e.length=0},Vi=(e,t)=>{if(t=ot(t),t<=0||!e.head)return[];if(t=Math.min(t,e.length),t===e.length&&e.head?.offset===0&&!e.head.next){let s=e.head.array;return Rs(e),s}let r=new Array(t),n=0,o=e.head;for(;o;){for(;o.offset<o.array.length;)if(r[n++]=o.array[o.offset],o.mutable&&(o.array[o.offset]=void 0),o.offset++,n===t)return e.head=o.offset===o.array.length&&o.next?o.next:o,e.length-=t,e.length===0?Rs(e):Ew(e),r;o=o.next}return Rs(e),r},jx=(e,t)=>{if(t=ot(t),t<=0||!e.head)return;if(t=Math.min(t,e.length),t===e.length&&e.head?.offset===0&&!e.head.next){Rs(e);return}let r=0,n=e.head;for(;n;){let o=n.array.length-n.offset;if(r+o>t){n.offset+=t-r,e.head=n,e.length-=t,Ew(e);return}r+=o,n=n.next}Rs(e)},Ta=e=>Vi(e,e.length),Zi=e=>{if(!e.head)return Xt;let t=e.head.array[e.head.offset];return e.head.mutable&&(e.head.array[e.head.offset]=void 0),e.head.offset++,e.length--,e.head.offset===e.head.array.length?e.head.next?e.head=e.head.next:Rs(e):Ew(e),t},QD=(e,t)=>{if(t=ot(t),t<=0)return[];let r=Math.min(t,e.length),n=new Array(r),o=0,s=e.head;for(;s;){for(let a=s.offset;a<s.array.length;a++)if(n[o++]=s.array[a],o===r)return n;s=s.next}return n};var Tw=(e,t)=>{let r=[],n=e.head,o=0;for(;n;){for(let s=n.offset;s<n.array.length;s++)t(n.array[s],o++)&&r.push(n.array[s]);n=n.next}if(r.length===0){Rs(e);return}e.head=e.tail={array:r,mutable:!0,offset:0,next:void 0},e.length=r.length},XD=(e,t)=>Tw(e,r=>r!==t);var K8=\"~effect/PubSub\";var G8=\"~effect/PubSub/Subscription\",Jx=e=>X(()=>eY(e.atomicPubSub(),new Map,kn(),Pr(!1),Yu(!1),e.strategy(),Yu(v()))),Kx=e=>Jx({atomicPubSub:()=>Nw(e),strategy:()=>new qx}),Gx=e=>Jx({atomicPubSub:()=>Nw(e),strategy:()=>new Hx}),Vx=e=>Jx({atomicPubSub:()=>Nw(e),strategy:()=>new Fw}),Zx=e=>Jx({atomicPubSub:()=>e1(e),strategy:()=>new Hx}),Nw=e=>{let t=typeof e==\"number\"?{capacity:e}:e;if(tY(t.capacity),t.capacity===1/0)return e1(t);let r=t.replay&&t.replay>0?new Wx(Math.ceil(t.replay)):void 0;return t.capacity===1?new vw(r):T_(t.capacity)===t.capacity?new Aw(t.capacity,r):new ww(t.capacity,r)},e1=e=>{let t=e?.replay;return new _w(t&&t>0?new Wx(Math.ceil(t)):void 0)};var $p=e=>Ts(cn(t=>(Lx(e.shutdownFlag,!0),Le(e.scope,pb(t.id)).pipe(_r(e.strategy.shutdown),nh(e.shutdownHook.open),ia)))),Yx=l(2,(e,t)=>X(()=>V8(e,t))),V8=l(2,(e,t)=>{if(e.shutdownFlag.current||be(e.ended.current))return!1;if(Lx(e.ended,O(t)),e.strategy instanceof qx)for(let[n,o,s]of Ta(e.strategy.publishers))s&&Do(o,vr(!1));let r=vr(t);for(let n of e.subscribers.values())for(let o of n){let s;for(;(s=Zi(o))!==Xt;)Do(s,r)}return e.subscribers.clear(),!0});var Qx=l(2,(e,t)=>$(()=>e.shutdownFlag.current||be(e.ended.current)?g(!1):e.pubsub.publish(t)?(e.strategy.completeSubscribersUnsafe(e.pubsub,e.subscribers),g(!0)):e.strategy.handleSurplus(e.pubsub,e.subscribers,[t],e.shutdownFlag,e.ended)));var t1=l(2,(e,t)=>$(()=>{if(e.shutdownFlag.current||be(e.ended.current))return g(!1);let r=e.pubsub.publishAll(t);return e.strategy.completeSubscribersUnsafe(e.pubsub,e.subscribers),r.length===0?g(!0):e.strategy.handleSurplus(e.pubsub,e.subscribers,r,e.shutdownFlag,e.ended)})),Bp=e=>Ts(Ml(t=>{let r=Fe(t,Or),n=Nt(e.scope),o=X8(e.pubsub,e.subscribers,e.strategy,e.ended);return Kt(n,Z8(o)).pipe(_r(Lo(r,s=>Le(n,s))),Tt(o))})),Z8=e=>Ts(cn(t=>(Lx(e.shutdownFlag,!0),sa(Ta(e.pollers),r=>xb(r,t.id),{discard:!0,concurrency:\"unbounded\"}).pipe(Rr(()=>X(()=>{e.subscribers.delete(e.subscription),e.subscription.unsubscribe(),e.replayWindow.close(),e.strategy.onPubSubEmptySpaceUnsafe(e.pubsub,e.subscribers)})),nh(e.shutdownHook.open),ia)))),Xx=e=>$(()=>{if(e.shutdownFlag.current)return _n;if(e.replayWindow.remaining>0){let r=e.replayWindow.take();return g(r)}let t=e.pollers.length===0?e.subscription.poll():Xt;return t===Xt?n1(e):(e.strategy.onPubSubEmptySpaceUnsafe(e.pubsub,e.subscribers),g(t))}),r1=e=>$(function t(r){if(e.shutdownFlag.current)return _n;let n=e.pollers.length===0?e.subscription.pollUpTo(Number.POSITIVE_INFINITY):[];return r&&(n=r.concat(n)),e.strategy.onPubSubEmptySpaceUnsafe(e.pubsub,e.subscribers),e.replayWindow.remaining>0?g(e.replayWindow.takeAll().concat(n)):or(n)?g(n):I(n1(e),o=>t([o]))}),n1=e=>Yc(t=>{if(e.shutdownFlag.current)return t(_n);if(be(e.ended.current)){let o=e.pollers.length===0?e.subscription.poll():Xt;return o!==Xt?(e.strategy.onPubSubEmptySpaceUnsafe(e.pubsub,e.subscribers),t(g(o))):t(g(e.ended.current.value))}let r=ui(),n=e.subscribers.get(e.subscription);return n||(n=new Set,e.subscribers.set(e.subscription,n)),n.add(e.pollers),ho(e.pollers,r),e.strategy.completePollersUnsafe(e.pubsub,e.subscribers,e.subscription,e.pollers),r.effect?t(r.effect):(r.resumes=[t],X(()=>XD(e.pollers,r)))});var bt=Symbol.for(\"effect/PubSub/AbsentValue\"),Y8=(e,t,r)=>{e.has(t)||e.set(t,new Set),e.get(t).add(r)},Q8=(e,t,r)=>{if(!e.has(t))return;let n=e.get(t);n.delete(r),n.size===0&&e.delete(t)},X8=(e,t,r,n)=>new Pw(e,t,e.subscribe(),Ps(),Pr(!1),Yu(!1),r,e.replayWindow(),n),ww=class{array;replayIndices;publisherIndex=0;subscribers;subscriberCount=0;subscribersIndex=0;capacity;replayBuffer;constructor(t,r){this.capacity=t,this.replayBuffer=r,this.array=Array.from({length:t}),this.replayIndices=r?Array.from({length:t}):[],this.subscribers=Array.from({length:t})}replayWindow(){return this.replayBuffer?new Qu(this.replayBuffer):eg}isEmpty(){return this.publisherIndex===this.subscribersIndex}isFull(){return this.publisherIndex===this.subscribersIndex+this.capacity}size(){return this.publisherIndex-this.subscribersIndex}publish(t){if(this.isFull())return!1;let r=this.replayBuffer?.offer(t);if(this.subscriberCount!==0){let n=this.publisherIndex%this.capacity;this.array[n]=t,r!==void 0&&(this.replayIndices[n]=r),this.subscribers[n]=this.subscriberCount,this.publisherIndex+=1}return!0}publishAll(t){if(this.subscriberCount===0)return this.replayBuffer&&this.replayBuffer.offerAll(t),[];let r=Ye(t),n=r.length,o=this.publisherIndex-this.subscribersIndex,s=this.capacity-o,a=Math.min(n,s);if(a===0)return r;let i=0,c=this.publisherIndex+a;for(;this.publisherIndex!==c;){let u=r[i++],f=this.publisherIndex%this.capacity;this.array[f]=u;let p=this.replayBuffer?.offer(u);p!==void 0&&(this.replayIndices[f]=p),this.subscribers[f]=this.subscriberCount,this.publisherIndex+=1}return r.slice(i)}slide(){if(this.subscribersIndex!==this.publisherIndex){let t=this.subscribersIndex%this.capacity,r=this.array[t];this.array[t]=bt,this.subscribers[t]=0,this.subscribersIndex+=1,this.replayBuffer?.slide(r,this.replayIndices[t])}}subscribe(){return this.subscriberCount+=1,new Cw(this,this.publisherIndex,!1)}},Cw=class{self;subscriberIndex;unsubscribed;constructor(t,r,n){this.self=t,this.subscriberIndex=r,this.unsubscribed=n}isEmpty(){return this.unsubscribed||this.self.publisherIndex===this.subscriberIndex||this.self.publisherIndex===this.self.subscribersIndex}size(){return this.unsubscribed?0:this.self.publisherIndex-Math.max(this.subscriberIndex,this.self.subscribersIndex)}poll(){if(this.unsubscribed)return Xt;if(this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex),this.subscriberIndex!==this.self.publisherIndex){let t=this.subscriberIndex%this.self.capacity,r=this.self.array[t];return this.self.subscribers[t]-=1,this.self.subscribers[t]===0&&(this.self.array[t]=bt,this.self.subscribersIndex+=1),this.subscriberIndex+=1,r}return Xt}pollUpTo(t){if(t=ot(t),this.unsubscribed)return[];this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex);let r=this.self.publisherIndex-this.subscriberIndex,n=Math.min(t,r);if(n<=0)return[];let o=[],s=this.subscriberIndex+n;for(;this.subscriberIndex!==s;){let a=this.subscriberIndex%this.self.capacity,i=this.self.array[a];this.self.subscribers[a]-=1,this.self.subscribers[a]===0&&(this.self.array[a]=bt,this.self.subscribersIndex+=1),o.push(i),this.subscriberIndex+=1}return o}unsubscribe(){if(!this.unsubscribed)for(this.unsubscribed=!0,this.self.subscriberCount-=1,this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex);this.subscriberIndex!==this.self.publisherIndex;){let t=this.subscriberIndex%this.self.capacity;this.self.subscribers[t]-=1,this.self.subscribers[t]===0&&(this.self.array[t]=bt,this.self.subscribersIndex+=1),this.subscriberIndex+=1}}},Aw=class{array;replayIndices;mask;publisherIndex=0;subscribers;subscriberCount=0;subscribersIndex=0;capacity;replayBuffer;constructor(t,r){this.capacity=t,this.replayBuffer=r,this.array=Array.from({length:t}),this.replayIndices=r?Array.from({length:t}):[],this.mask=t-1,this.subscribers=Array.from({length:t})}replayWindow(){return this.replayBuffer?new Qu(this.replayBuffer):eg}isEmpty(){return this.publisherIndex===this.subscribersIndex}isFull(){return this.publisherIndex===this.subscribersIndex+this.capacity}size(){return this.publisherIndex-this.subscribersIndex}publish(t){if(this.isFull())return!1;let r=this.replayBuffer?.offer(t);if(this.subscriberCount!==0){let n=this.publisherIndex&this.mask;this.array[n]=t,r!==void 0&&(this.replayIndices[n]=r),this.subscribers[n]=this.subscriberCount,this.publisherIndex+=1}return!0}publishAll(t){if(this.subscriberCount===0)return this.replayBuffer&&this.replayBuffer.offerAll(t),[];let r=Ye(t),n=r.length,o=this.publisherIndex-this.subscribersIndex,s=this.capacity-o,a=Math.min(n,s);if(a===0)return r;let i=0,c=this.publisherIndex+a;for(;this.publisherIndex!==c;){let u=r[i++],f=this.publisherIndex&this.mask;this.array[f]=u;let p=this.replayBuffer?.offer(u);p!==void 0&&(this.replayIndices[f]=p),this.subscribers[f]=this.subscriberCount,this.publisherIndex+=1}return r.slice(i)}slide(){if(this.subscribersIndex!==this.publisherIndex){let t=this.subscribersIndex&this.mask,r=this.array[t];this.array[t]=bt,this.subscribers[t]=0,this.subscribersIndex+=1,this.replayBuffer?.slide(r,this.replayIndices[t])}}subscribe(){return this.subscriberCount+=1,new kw(this,this.publisherIndex,!1)}},kw=class{self;subscriberIndex;unsubscribed;constructor(t,r,n){this.self=t,this.subscriberIndex=r,this.unsubscribed=n}isEmpty(){return this.unsubscribed||this.self.publisherIndex===this.subscriberIndex||this.self.publisherIndex===this.self.subscribersIndex}size(){return this.unsubscribed?0:this.self.publisherIndex-Math.max(this.subscriberIndex,this.self.subscribersIndex)}poll(){if(this.unsubscribed)return Xt;if(this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex),this.subscriberIndex!==this.self.publisherIndex){let t=this.subscriberIndex&this.self.mask,r=this.self.array[t];return this.self.subscribers[t]-=1,this.self.subscribers[t]===0&&(this.self.array[t]=bt,this.self.subscribersIndex+=1),this.subscriberIndex+=1,r}return Xt}pollUpTo(t){if(t=ot(t),this.unsubscribed)return[];this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex);let r=this.self.publisherIndex-this.subscriberIndex,n=Math.min(t,r);if(n<=0)return[];let o=[],s=this.subscriberIndex+n;for(;this.subscriberIndex!==s;){let a=this.subscriberIndex&this.self.mask,i=this.self.array[a];this.self.subscribers[a]-=1,this.self.subscribers[a]===0&&(this.self.array[a]=bt,this.self.subscribersIndex+=1),o.push(i),this.subscriberIndex+=1}return o}unsubscribe(){if(!this.unsubscribed)for(this.unsubscribed=!0,this.self.subscriberCount-=1,this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex);this.subscriberIndex!==this.self.publisherIndex;){let t=this.subscriberIndex&this.self.mask;this.self.subscribers[t]-=1,this.self.subscribers[t]===0&&(this.self.array[t]=bt,this.self.subscribersIndex+=1),this.subscriberIndex+=1}}},vw=class{publisherIndex=0;subscriberCount=0;subscribers=0;value=bt;replayIndex=0;capacity=1;replayBuffer;constructor(t){this.replayBuffer=t}replayWindow(){return this.replayBuffer?new Qu(this.replayBuffer):eg}pipe(){return Z(this,arguments)}isEmpty(){return this.subscribers===0}isFull(){return!this.isEmpty()}size(){return this.isEmpty()?0:1}publish(t){if(this.isFull())return!1;let r=this.replayBuffer?.offer(t);return this.subscriberCount!==0&&(this.value=t,r!==void 0&&(this.replayIndex=r),this.subscribers=this.subscriberCount,this.publisherIndex+=1),!0}publishAll(t){if(this.subscriberCount===0)return this.replayBuffer&&this.replayBuffer.offerAll(t),[];let r=Ye(t);return r.length===0?r:this.publish(r[0])?r.slice(1):r}slide(){if(this.isFull()){let t=this.value;this.subscribers=0,this.value=bt,this.replayBuffer?.slide(t,this.replayIndex)}}subscribe(){return this.subscriberCount+=1,new Ow(this,this.publisherIndex,!1)}},Ow=class{self;subscriberIndex;unsubscribed;constructor(t,r,n){this.self=t,this.subscriberIndex=r,this.unsubscribed=n}isEmpty(){return this.unsubscribed||this.self.subscribers===0||this.subscriberIndex===this.self.publisherIndex}size(){return this.isEmpty()?0:1}poll(){if(this.isEmpty())return Xt;let t=this.self.value;return this.self.subscribers-=1,this.self.subscribers===0&&(this.self.value=bt),this.subscriberIndex=this.self.publisherIndex,t}pollUpTo(t){return ot(t)<1||this.isEmpty()?[]:[this.poll()]}unsubscribe(){this.unsubscribed||(this.unsubscribed=!0,this.self.subscriberCount-=1,this.self.subscribers!==0&&this.subscriberIndex!==this.self.publisherIndex&&(this.self.subscribers-=1,this.self.subscribers===0&&(this.self.value=bt)))}},_w=class{publisherHead={value:bt,replayIndex:void 0,subscribers:0,next:null};publisherTail=this.publisherHead;publisherIndex=0;subscribersIndex=0;capacity=Number.MAX_SAFE_INTEGER;replayBuffer;constructor(t){this.replayBuffer=t}replayWindow(){return this.replayBuffer?new Qu(this.replayBuffer):eg}isEmpty(){return this.publisherHead===this.publisherTail}isFull(){return!1}size(){return this.publisherIndex-this.subscribersIndex}publish(t){let r=this.replayBuffer?.offer(t),n=this.publisherTail.subscribers;if(n!==0){let o={value:t,replayIndex:r,subscribers:n,next:null};this.publisherTail.next=o,this.publisherTail=this.publisherTail.next,this.publisherIndex+=1}return!0}publishAll(t){if(this.publisherTail.subscribers!==0)for(let r of t)this.publish(r);else this.replayBuffer&&this.replayBuffer.offerAll(t);return[]}slide(){if(this.publisherHead!==this.publisherTail){let t=this.publisherHead.next,r=t.value;this.publisherHead=this.publisherHead.next,this.publisherHead.value=bt,this.subscribersIndex+=1,this.replayBuffer?.slide(r,t.replayIndex)}}subscribe(){return this.publisherTail.subscribers+=1,new Rw(this,this.publisherTail,this.publisherIndex,!1)}},Rw=class{self;subscriberHead;subscriberIndex;unsubscribed;constructor(t,r,n,o){this.self=t,this.subscriberHead=r,this.subscriberIndex=n,this.unsubscribed=o}isEmpty(){if(this.unsubscribed)return!0;let t=!0,r=!0;for(;r;)this.subscriberHead===this.self.publisherTail?r=!1:this.subscriberHead.next.value!==bt?(t=!1,r=!1):(this.subscriberHead=this.subscriberHead.next,this.subscriberIndex+=1);return t}size(){return this.unsubscribed?0:this.self.publisherIndex-Math.max(this.subscriberIndex,this.self.subscribersIndex)}poll(){if(this.unsubscribed)return Xt;let t=!0,r=Xt;for(;t;)if(this.subscriberHead===this.self.publisherTail)t=!1;else{let n=this.subscriberHead.next.value;n!==bt&&(r=n,this.subscriberHead.subscribers-=1,this.subscriberHead.subscribers===0&&(this.self.publisherHead=this.self.publisherHead.next,this.self.publisherHead.value=bt,this.self.subscribersIndex+=1),t=!1),this.subscriberHead=this.subscriberHead.next,this.subscriberIndex+=1}return r}pollUpTo(t){t=ot(t);let r=[],n=0;for(;n!==t;){let o=this.poll();o===Xt?n=t:(r.push(o),n+=1)}return r}unsubscribe(){if(!this.unsubscribed)for(this.unsubscribed=!0,this.self.publisherTail.subscribers-=1;this.subscriberHead!==this.self.publisherTail;)this.subscriberHead.next.value!==bt&&(this.subscriberHead.subscribers-=1,this.subscriberHead.subscribers===0&&(this.self.publisherHead=this.self.publisherHead.next,this.self.publisherHead.value=bt,this.self.subscribersIndex+=1)),this.subscriberHead=this.subscriberHead.next}},Pw=class{[G8]={_A:R};pubsub;subscribers;subscription;pollers;shutdownHook;shutdownFlag;strategy;replayWindow;ended;constructor(t,r,n,o,s,a,i,c,u){this.pubsub=t,this.subscribers=r,this.subscription=n,this.pollers=o,this.shutdownHook=s,this.shutdownFlag=a,this.strategy=i,this.replayWindow=c,this.ended=u}pipe(){return Z(this,arguments)}},Mw=class{[K8]={_A:R};pubsub;subscribers;scope;shutdownHook;shutdownFlag;strategy;ended;constructor(t,r,n,o,s,a,i){this.pubsub=t,this.subscribers=r,this.scope=n,this.shutdownHook=o,this.shutdownFlag=s,this.strategy=a,this.ended=i}pipe(){return Z(this,arguments)}},eY=(e,t,r,n,o,s,a)=>new Mw(e,t,r,n,o,s,a),tY=e=>{if(e<=0||e!==1/0&&!Number.isInteger(e))throw new Error(`Cannot construct PubSub with capacity of ${e}`)},qx=class{publishers=Ps();get shutdown(){return cn(t=>sa(Ta(this.publishers),([r,n,o])=>o?xb(n,t.id):Q,{concurrency:\"unbounded\",discard:!0}))}handleSurplus(t,r,n,o,s){return Yc(a=>{if(be(s.current))return a(g(!1));let i=ui();return this.offerUnsafe(n,i),this.onPubSubEmptySpaceUnsafe(t,r),this.completeSubscribersUnsafe(t,r),ZD(o)?(this.removeUnsafe(i),a(_n)):i.effect?a(i.effect):(i.resumes=[a],X(()=>this.removeUnsafe(i)))})}onPubSubEmptySpaceUnsafe(t,r){let n=!0;for(;n&&!t.isFull();){let o=Zi(this.publishers);if(o===Xt)n=!1;else{let[s,a]=o,i=t.publish(s);i&&o[2]?Do(a,vr(!0)):i||Iw(this.publishers,o),this.completeSubscribersUnsafe(t,r)}}}completePollersUnsafe(t,r,n,o){return Uw(this,t,r,n,o)}completeSubscribersUnsafe(t,r){return Dw(this,t,r)}offerUnsafe(t,r){let n=t[Symbol.iterator](),o=n.next();if(!o.done)for(;;){let s=o.value;if(o=n.next(),o.done){ho(this.publishers,[s,r,!0]);break}ho(this.publishers,[s,r,!1])}}removeUnsafe(t){Tw(this.publishers,([r,n])=>n!==t)}},Hx=class{get shutdown(){return Q}handleSurplus(t,r,n,o){return g(!1)}onPubSubEmptySpaceUnsafe(t,r){}completePollersUnsafe(t,r,n,o){return Uw(this,t,r,n,o)}completeSubscribersUnsafe(t,r){return Dw(this,t,r)}},Fw=class{get shutdown(){return Q}handleSurplus(t,r,n,o,s){return X(()=>be(s.current)?!1:(this.slidingPublishUnsafe(t,n),this.completeSubscribersUnsafe(t,r),!0))}onPubSubEmptySpaceUnsafe(t,r){}completePollersUnsafe(t,r,n,o){return Uw(this,t,r,n,o)}completeSubscribersUnsafe(t,r){return Dw(this,t,r)}slidingPublishUnsafe(t,r){let n=r[Symbol.iterator](),o=n.next();if(!o.done&&t.capacity>0){let s=o.value,a=!0;for(;a;){t.slide();let i=t.publish(s);i&&(o=n.next())&&!o.done?s=o.value:i&&(a=!1)}}}},Uw=(e,t,r,n,o)=>{let s=!0;for(;s&&!n.isEmpty();){let a=Zi(o);if(a===Xt)Q8(r,n,o),o.length===0?s=!1:Y8(r,n,o);else{let i=n.poll();i===Xt?Iw(o,a):(Do(a,vr(i)),e.onPubSubEmptySpaceUnsafe(t,r))}}},Dw=(e,t,r)=>{for(let[n,o]of r)for(let s of o)e.completePollersUnsafe(t,r,n,s)},Wx=class{capacity;head={value:bt,index:0,next:null};tail=this.head;slideValues=[];size=0;index=0;publisherIndex=0;constructor(t){this.capacity=t}slide(t,r){this.slideValues[this.index%this.capacity]={value:t,index:r},this.index++}offer(t){let r=this.publisherIndex++;return this.tail.value=t,this.tail.index=r,this.tail.next={value:bt,index:0,next:null},this.tail=this.tail.next,this.size===this.capacity?this.head=this.head.next:this.size+=1,r}offerAll(t){for(let r of t)this.offer(r)}},Qu=class{buffer;values;index=0;remaining;slideIndex;newestIndex=-1;constructor(t){this.buffer=t,this.remaining=t.size,this.slideIndex=t.index,this.values=new Array(this.remaining);let r=t.head;for(let n=0;n<this.remaining;n++)this.values[n]=r.value,this.newestIndex=r.index,r=r.next}close(){this.values.length=0,this.remaining=0}sync(){let t=this.buffer.index-this.slideIndex;if(t===0||this.remaining===0)return;let r=Math.min(t,this.buffer.capacity),n=this.buffer.index-r;for(let o=0;o<r;o++){let s=this.buffer.slideValues[(n+o)%this.buffer.capacity];s.index>this.newestIndex&&(this.index=(this.index+1)%this.values.length,this.values[(this.index+this.remaining-1)%this.values.length]=s.value,this.newestIndex=s.index)}this.slideIndex=this.buffer.index}take(){if(this.remaining===0)return;this.sync();let t=this.values[this.index];return this.values[this.index]=bt,this.index=(this.index+1)%this.values.length,this.remaining--,this.remaining===0&&this.close(),t}takeN(t){t=ot(t);let r=Math.min(t,this.remaining),n=new Array(r);for(let o=0;o<r;o++)n[o]=this.take();return n}takeAll(){return this.takeN(this.remaining)}},eg={remaining:0,take:()=>{},takeN:()=>[],takeAll:()=>[],close:()=>{}};var rY=\"~effect/Queue\",nY=\"~effect/Queue/Enqueue\",oY=\"~effect/Queue/Dequeue\";var $w={_A:R,_E:R},sY={[rY]:$w,[nY]:$w,[oY]:$w,...rr,toJSON(){return{_id:\"effect/Queue\",state:this.state._tag,size:cY(this)}}},Mn=e=>re(t=>{let r=Object.create(sY);return r.dispatcher=t.currentDispatcher,r.capacity=e?.capacity??Number.POSITIVE_INFINITY,r.strategy=e?.strategy??\"suspend\",r.messages=Ps(),r.scheduleRunning=!1,r.state={_tag:\"Open\",takers:new Set,offers:new Set,awaiters:new Set},D(r)}),jp=e=>Mn({capacity:e});var o1=()=>Mn(),Sn=l(2,(e,t)=>ne(()=>rg(e,t)?sg:e.state._tag===\"Open\"&&e.strategy===\"suspend\"?pY(e,t):a1)),rg=(e,t)=>e.state._tag!==\"Open\"?!1:e.messages.length>=e.capacity?e.strategy===\"sliding\"?(Zi(e.messages),ho(e.messages,t),!0):e.capacity<=0&&e.state.takers.size>0?(ho(e.messages,t),i1(e),!0):!1:(ho(e.messages,t),tg(e),!0),Yi=l(2,(e,t)=>ht(r=>{let n=ng(e,t);return n.length===0||e.strategy===\"dropping\"?r(Ae(n)):f1(e,{_tag:\"Array\",remaining:n,offset:0,resume:r})})),ng=(e,t)=>{if(e.state._tag!==\"Open\")return Ye(t);if(e.capacity===Number.POSITIVE_INFINITY||e.strategy===\"sliding\")return $x(e.messages,t),e.strategy===\"sliding\"&&Vi(e.messages,e.messages.length-e.capacity),tg(e),[];let r=e.capacity<=0?e.state.takers.size:e.capacity-e.messages.length;if(r===0)return Ye(t);let n=[],o=0;for(let s of t)o<r?ho(e.messages,s):n.push(s),o++;return tg(e),n};var Bt=l(2,(e,t)=>z(()=>wa(e,t))),wa=(e,t)=>{if(e.state._tag!==\"Open\")return!1;let r=Ht(t),n=Jk(r,uY);return e.state.offers.size===0&&e.messages.length===0?(ag(e,n),!0):(e.state={...e.state,_tag:\"Closing\",exit:n},tg(e),!0)},jw=e=>Bt(e,gc(Wa())),og=e=>wa(e,gc(Wa()));var Fn=e=>z(()=>aY(e)),aY=e=>{if(e.state._tag===\"Done\")return!1;Rs(e.messages);let t=e.state.offers;ag(e,e.state._tag===\"Open\"?fY:e.state.exit);for(let r of t)l1(r);return!0};var Qi=e=>s1(e,1,Number.POSITIVE_INFINITY);var s1=l(3,(e,t,r)=>(t=ot(t),r=ot(r),c1(()=>lY(e,t,r)??Fo(u1(e,()=>zw(e,t)),s1(e,t,r))))),Ms=e=>c1(()=>iY(e)??Fo(u1(e,()=>zw(e,1)),Ms(e)));var iY=e=>{if(e.state._tag===\"Done\")return e.state.exit;if(e.messages.length>0){let t=Zi(e.messages);return Bw(e),Ae(t)}else if(e.capacity<=0&&e.state.offers.size>0){let t=p1(e.state.offers);return Bw(e),Ae(t)}};var cY=e=>e.state._tag===\"Done\"?0:e.messages.length;var a1=Ae(!1),sg=Ae(!0),uY=en(Wa()),fY=Nc(),i1=e=>{if(!(e.state._tag===\"Done\"||e.state.takers.size===0)){for(let t of e.state.takers)if(t.ready()&&(e.state.takers.delete(t),t.resume(pr),e.messages.length===0))break}},tg=e=>{e.scheduleRunning||e.state._tag===\"Done\"||e.state.takers.size===0||(e.scheduleRunning=!0,e.dispatcher.scheduleTask(()=>{e.scheduleRunning=!1,i1(e)},0))},lY=(e,t,r)=>{if(e.state._tag===\"Done\")return e.state.exit;if(r<=0||t<=0)return Ae([]);if(!zw(e,t))return;let n=e.messages.length>0?Vi(e.messages,r):[p1(e.state.offers)];return Bw(e),Ae(n)},c1=En({op:\"QueueTake\",[Ke](e){let t=this[ue]();return vf(t)?t[Ke](e):t}}),zw=(e,t)=>e.messages.length>=(e.state._tag===\"Closing\"?1:Math.min(t,e.capacity||1))||e.capacity<=0&&e.state._tag!==\"Done\"&&e.state.offers.size>0,u1=(e,t)=>ht(r=>{if(e.state._tag===\"Done\")return r(e.state.exit);if(t())return r(pr);let n={ready:t,resume:r};return e.state.takers.add(n),z(()=>{e.state._tag!==\"Done\"&&e.state.takers.delete(n)})}),pY=(e,t)=>ht(r=>rg(e,t)?r(sg):f1(e,{_tag:\"Single\",message:t,resume:r})),f1=(e,t)=>{if(e.state._tag!==\"Open\")return l1(t);let r=e.state.offers;return r.add(t),z(()=>{e.state._tag!==\"Done\"&&(r.delete(t),e.state._tag===\"Closing\"&&r.size===0&&e.messages.length===0&&ag(e,e.state.exit))})},l1=e=>e._tag===\"Single\"?e.resume(a1):e.resume(Ae(e.remaining.slice(e.offset))),p1=e=>{let t=e.values().next().value;if(t._tag===\"Single\")return e.delete(t),t.resume(sg),t.message;let r=t.remaining[t.offset++];return t.offset===t.remaining.length&&(e.delete(t),t.resume(Ae([]))),r},Bw=e=>{if(e.state._tag===\"Done\")return Bo(e.state.exit.cause);if(e.state.offers.size===0)return e.state._tag===\"Closing\"&&e.messages.length===0?(ag(e,e.state.exit),Bo(e.state.exit.cause)):!1;for(let t of e.state.offers){let r=e.capacity-e.messages.length;if(r<=0)break;if(t._tag===\"Single\")ho(e.messages,t.message),e.state.offers.delete(t),t.resume(sg);else{for(;t.offset<t.remaining.length;t.offset++){if(r===0)return!1;ho(e.messages,t.remaining[t.offset]),r--}e.state.offers.delete(t),t.resume(Ae([]))}let n=e.state;if(n._tag===\"Done\")return Bo(n.exit.cause)}return!1};var ag=(e,t)=>{if(e.state._tag===\"Done\")return;let r=e.state;e.state={_tag:\"Done\",exit:t};for(let n of r.takers)n.resume(t);r.takers.clear();for(let n of r.awaiters)n(t);r.awaiters.clear()};var ig=e=>new Hw(e),d1=(e,t,r)=>ht(n=>{if(e.free>=t)return n(r);let o=()=>{e.free<t||(e.waiters.delete(o),n(r))};return e.waiters.add(o),z(()=>{e.waiters.delete(o)})}),Hw=class{waiters=new Set;taken=0;permits;constructor(t){this.permits=t}get free(){return this.permits-this.taken}take(t){let r=ne(()=>this.free<t?d1(this,t,r):(this.taken+=t,D(t)));return r}takeIfAvailable(t){return ne(()=>this.free<t?D(!1):(this.taken+=t,D(!0)))}releaseUnsafe(t,r){return this.taken-=r,this.waiters.size>0&&t.currentDispatcher.scheduleTask(()=>{for(let n of this.waiters){if(this.free<=0)break;n()}},0),this.free}resize(t){return re(r=>(this.permits=t,this.free<0?pe:(this.releaseUnsafe(r,0),pe)))}release(t){return re(r=>D(this.releaseUnsafe(r,t)))}get releaseAll(){return re(t=>D(this.releaseUnsafe(t,this.taken)))}withPermits(t){return r=>Hn(n=>{let o=ne(()=>{if(this.free<t){let s=d1(this,t,pe);return V(n(s),()=>o)}return this.taken+=t,qn(n(r),()=>{this.releaseUnsafe(ds(),t)},!0)});return o})}withPermit=this.withPermits(1);withPermitsIfAvailable(t){return r=>Hn(n=>this.free<t?oi:(this.taken+=t,qn(n(Fc(r)),()=>{this.releaseUnsafe(ds(),t)},!0)))}};var Ww=e=>hl(e)?Ve(e)?Y(e.value):e:g(e);var y1=\"~effect/Channel\",cr=e=>k(e,y1),dY={[y1]:{_Env:R,_InErr:R,_InElem:R,_OutErr:R,_OutElem:R},pipe(){return Z(this,arguments)}},Ce=e=>{let t=Object.create(dY);return t.transform=(r,n)=>rt(e(r,n),o=>g(ze(o))),t},Nn=(e,t)=>Ce((r,n)=>I(he(e)(r,n),o=>t(o,n))),er=e=>Ce((t,r)=>e),go=e=>Ce(Se(function*(t,r){let n=Nt(r),o=a=>Le(n,Jm(a)),s=yield*Vn(e(t,r,n),o);return Vn(s,o)})),he=e=>e.transform,zp=4096,mY=(e,t,r)=>Mn({capacity:r?.bufferSize,strategy:r?.strategy}).pipe(Rr(n=>Kt(e,Fn(n))),Rr(n=>Es(t(n),e).pipe(rt(o=>Bt(n,o)),Ut(e))));var S1=(e,t)=>Ce((r,n)=>j(mY(n,e,t),Qi)),cg=e=>Ce((t,r)=>$(()=>he(e())(t,r))),hY=(e,t,r)=>go(Se(function*(n,o,s){let a=v();yield*Lo(s,c=>be(a)?r(a.value,c):Q);let i=yield*Ts(j(e,c=>(a=O(c),c)));return yield*he(t(i))(n,o)}));var b1=e=>er(X(()=>{let t=e();return $(()=>{let r=t.next();return r.done?Y(r.value):g(r.value)})})),Jw=e=>er(X(()=>{let t=0;return $(()=>t>=e.length?Y():g(e[t++]))}));var Kw=(e,t=zp)=>{let r=Tn(t);return er(X(()=>{let n=e(),o=v();return $(()=>{if(o._tag===\"Some\")return Y(o.value);let s=[];for(;s.length<r;){let a=n.next();if(a.done){if(s.length===0)return Y(a.value);o=O(a.value);break}s.push(a.value)}return g(s)})}))};var E1=(e,t=zp)=>Kw(()=>e[Symbol.iterator](),t),ug=e=>fg(g(e));var I1=e=>fg(X(e)),Xu=er(g(Y())),T1=er(g(mi)),es=e=>er(g(P(e))),w1=e=>er(Xm(e)),qp=e=>er(ze(e)),C1=e=>er(Is(e)),Gw=e=>qp(ci(e)),fg=e=>er(X(()=>{let t=!1;return $(()=>t?Y():(t=!0,e))}));var A1=e=>er(I(e,()=>Y())),Vw=e=>er(g(I(e,Ww)));var k1=e=>er(g(Qi(e)));var Zw=e=>er(g(Xb(r1(e),()=>Y())));var v1=e=>Ca(j(Bp(e),Zw)),O1=e=>Ca(j(Bp(e),t=>Vw(Xx(t))));var _1=e=>Ce((t,r)=>xY({scope:r,readable:e.evaluate(),onError:e.onError,releaseLockOnEnd:e.releaseLockOnEnd}));var xY=e=>{let t=e.readable.getReader(),r=e.exit??Yu(void 0),n=$(()=>r.current?r.current:zo(Zc({try:()=>t.read(),catch:e.onError}),{onFailure:o=>r.current??ze(o),onSuccess:({done:o,value:s})=>r.current?r.current:o?Y():g(Ee(s))}));return Tt(Kt(e.scope,e.releaseLockOnEnd?X(()=>t.releaseLock()):Qm(()=>t.cancel().catch($n))),n)},gY=(e,t)=>Ce(Se(function*(r,n){let o=e[Symbol.asyncIterator]();return o.return&&(yield*Kt(n,Qm(()=>o.return()))),I(Zc({try:()=>o.next(),catch:t}),s=>s.done?Y(s.value):g(s.value))})),R1=(e,t)=>yo(gY(e,t),Ee),yo=l(2,(e,t)=>Nn(e,r=>X(()=>{let n=0;return j(r,o=>t(o,n++))})));var P1=l(2,(e,t)=>Nn(e,r=>g(He(r,n=>I(t(n),Y))))),M1=e=>e===void 0||e!==\"unbounded\"&&e<=1,lg=l(e=>cr(e[0]),(e,t,r)=>M1(r?.concurrency)?F1(e,t):yY(e,t,r)),F1=(e,t)=>Ce((r,n)=>{let o=0;return j(he(e)(r,n),I(s=>t(s,o++)))}),yY=(e,t,r)=>go(Se(function*(n,o,s){let a=0,i=yield*he(e)(n,o),c=r.concurrency===\"unbounded\"?Number.MAX_SAFE_INTEGER:r.concurrency,u=yield*jp(0);yield*Kt(s,Fn(u));let f=Rn(yield*hi()),p=Ia(s);if(r.unordered){let d=ig(c),m=je(d.release(1)),x=zo({onFailure:y=>I(Bt(u,y),m),onSuccess:y=>I(Sn(u,y),m)});yield*d.take(1).pipe(I(()=>i),I(y=>{let S=a++;return p(f(x($(()=>t(y,S))))),Q}),$t({disableYield:!0}),rt(y=>d.withPermits(c-1)(Bt(u,y))),Ut(s))}else{let d=yield*jp(c-2);yield*Kt(s,Fn(d)),yield*Ms(d).pipe(qb,I(y=>Sn(u,y)),$t({disableYield:!0}),rt(y=>Bt(u,y)),Ut(s));let m,x=y=>{y._tag!==\"Success\"&&(m=y.cause,wa(u,y.cause))};yield*i.pipe(I(y=>{if(m)return ze(m);let S=a++,w=f($(()=>t(y,S)));return p(w),w.addObserver(x),Sn(d,Ea(w))}),$t({disableYield:!0}),rt(y=>Sn(d,sn(y)).pipe(_r(Bt(d,y)))),Ut(s))}return Ms(u)}));var Yw=l(e=>cr(e[0]),(e,t,r)=>M1(r?.concurrency)?SY(e,t):bY(e,t,r)),SY=(e,t)=>Ce((r,n)=>j(he(e)(r,n),o=>{let s,a,i=I(o,u=>(a??=Nt(n),st(he(t(u))(r,a),f=>(s=c(f),s)))),c=He(u=>{if(s=void 0,a.state._tag===\"Empty\")return i;let f=Le(a,xt);return a=void 0,I(f,()=>i)});return $(()=>s??i)})),bY=(e,t,r)=>e.pipe(yo(t),mg(r)),N1=l(2,(e,t)=>Ce((r,n)=>X(()=>{let o,s=Nt(n),a=I(he(e)(r,s),i=>(o=He(i,c=>Le(s,xt).pipe(I(()=>he(t(c))(r,n)),I(u=>(o=u,u)))),o));return $(()=>o??a)})));var Qw=l(4,(e,t,r,n)=>Ce(Se(function*(o,s){let a=yield*he(e)(o,s),i=yield*he(t)(o,s),c=r();return $(()=>{let u=n(c,a,i);return j(u,([f,p])=>(c=p,f))})}))),U1=l(2,(e,t)=>Ce((r,n)=>X(()=>{let o,s=Nt(n),a=I(he(e)(r,s),i=>{let c=i.pipe(Rr(()=>(o=i,Q)),He(u=>Le(s,vr(u)).pipe(_r(he(t(u))(r,n)),I(f=>(o=f,f)))));return o=c,c});return $(()=>o??a)}))),D1=e=>Yw(e,R),gr=e=>Nn(e,t=>{let r,n=0,o=$(function s(){if(r===void 0)return I(t,i=>{switch(i.length){case 0:return s();case 1:return g(i[0]);default:return r=i,g(i[n++])}});let a=r[n++];return n>=r.length&&(r=void 0,n=0),g(a)});return g(o)}),L1=e=>F1(e,Ww),$1=e=>Nn(e,t=>g($t(t,{disableYield:!0}))),B1=l(2,(e,t)=>Kn(typeof t==\"function\"?t(R):t).pipe(j(r=>{let n=Gt.defaultValue();return j1(yg(e,Gt,X(()=>n)),o=>r(o).pipe(j(s=>{n=s}),He(()=>Y(o))))}),Ca)),j1=(e,t)=>Ce((r,n)=>X(()=>{let o,s=()=>{let a=Nt(n);return I(he(e)(r,a),i=>(o=He(i,c=>Le(a,xt).pipe(I(()=>t(c)),I(s))),o))};return $(()=>o??s())})),z1=e=>j1(e,()=>Q),q1=l(2,(e,t)=>Nn(e,(r,n)=>j(Cl(t),o=>Rr(r,o)))),H1=l(2,(e,t)=>Ce((r,n)=>j(he(e)(r,n),o=>I(o,function s(a){return t(a)?g(a):I(o,s)}))));var W1=l(2,(e,t)=>Nn(e,r=>g(I(r,function n(o){let s=[];for(let a=0;a<o.length;a++)t(o[a])&&s.push(o[a]);return tt(s)?g(s):I(r,n)})))),J1=l(2,(e,t)=>Nn(e,r=>g(I(r,function n(o){let s=[];for(let a=0;a<o.length;a++){let i=t(o[a]);mt(i)&&s.push(i.success)}return tt(s)?g(s):I(r,n)})))),K1=l(2,(e,t)=>Nn(e,r=>{let n=I(r,o=>Gb(o,t));return g(I(n,function o(s){return tt(s)?g(s):I(n,o)}))})),G1=l(2,(e,t)=>Nn(e,r=>g(I(r,function n(o){return I(Vb(o,t),s=>tt(s)?g(s):I(r,n))})))),ef=l(e=>cr(e[0]),(e,t,r,n)=>Ce((o,s)=>j(he(e)(o,s),a=>{let i=t(),c,u=0,f,p=zo(a,{onFailure(m){f=m;let x=n?.onHalt&&n.onHalt(i);return x&&x.length>0?g([i,x]):ze(m)},onSuccess(m){let x=r(i,m);return gA(x)?g(x):x}});return $(function m(){if(c===void 0)return f?ze(f):I(p,([y,S])=>(i=y,S.length===0?m():S.length===1?g(S[0]):(c=S,m())));let x=c[u++];return u>=c.length&&(c=void 0,u=0),g(x)})})));var V1=l(3,(e,t,r)=>Ce((n,o)=>j(he(e)(n,o),s=>{let a=t,i=!0;return $(()=>i?(i=!1,g(a)):j(I(s,c=>r(a,c)),c=>(a=c,a)))}))),tf=l(2,(e,t)=>Ce((r,n)=>{let o=Nt(n);return j(he(e)(r,o),s=>{let a=s.pipe(rt(i=>{if(Bo(i))return ze(i);let c=o;return o=Nt(n),Le(c,sn(i)).pipe(_r(he(t(i))(r,o)),I(u=>(a=u,u)))}));return $(()=>a)})})),Z1=l(2,(e,t)=>dg(e,dl,t)),pg=l(2,(e,t)=>tf(e,r=>A1(I(t(r),n=>ze(r))))),Y1=l(3,(e,t,r)=>tf(e,n=>t(n)?r(n):qp(n))),dg=l(3,(e,t,r)=>tf(e,n=>{let o=t(n);return ce(o)?qp(o.failure):r(o.success,n)})),xo=l(2,(e,t)=>dg(e,ab,r=>t(r)));var Q1=l(2,(e,t)=>Nn(e,r=>g(rh(r,n=>qc(n)?Q:ia(t(n)))))),X1=l(e=>cr(e[0]),(e,t,r,n)=>xo(e,o=>t(o)?r(o):n?n(o):es(o))),e2=l(e=>cr(e[0]),(e,t,r,n)=>xo(e,o=>{let s=t(o);return ce(s)?n?n(s.failure):es(s.failure):r(s.success)}));var t2=l(e=>cr(e[0]),(e,t,r,n,o)=>xo(e,s=>{if(At(s,t)&&k(s,\"reason\")){let a=s.reason;return At(a,r)?n(a,s):o?o(a,s):es(s)}return es(s)})),r2=l(e=>cr(e[0]),(e,t,r,n)=>{let o;return xo(e,s=>{if(At(s,t)&&k(s,\"reason\")&&k(s.reason,\"_tag\")&&Hm(s.reason._tag)){let a=s.reason;return o??=new Set(Object.keys(r)),o.has(a._tag)?r[a._tag](a,s):n?n(a,s):es(s)}return es(s)})});var n2=l(2,(e,t)=>xo(e,r=>es(t(r)))),o2=e=>xo(e,Gw),s2=l(e=>cr(e[0]),(e,t)=>{if(!t?.log)return xo(e,()=>Xu);let r=ih(t.log===!0?void 0:t.log);return xo(pg(e,n=>sb(n)?r(n):Q),()=>Xu)}),x1=e=>tf(e,()=>Xu),a2=l(e=>cr(e[0]),(e,t)=>{if(!t?.log)return x1(e);let r=ih(t.log===!0?void 0:t.log);return x1(pg(e,n=>r(n)))}),i2=l(2,(e,t)=>cg(()=>{let r,n=Gt.defaultValue(),o=yg(e,Gt,X(()=>n)),s=r0(o,()=>(r=void 0,Q)),a=typeof t==\"function\"?t(R):t,i=xo(s,Se(function*(c){return r||(r=yield*Kn(a)),n=yield*r(c),i},(c,u)=>He(c,()=>g(es(u))),Ca));return i})),c2=l(e=>cr(e[0]),(e,t,r)=>e.pipe(yo(t),mg({...r,concurrency:r?.concurrency??1,switch:!0}))),mg=l(2,(e,{bufferSize:t=16,concurrency:r,switch:n=!1})=>go(Se(function*(o,s,a){let i=r===\"unbounded\"?Number.MAX_SAFE_INTEGER:Math.max(1,r),c=n?void 0:ig(i),u=yield*GD(!0),f=new Set,p=yield*jp(t);yield*Kt(a,Fn(p));let d=yield*he(e)(o,s);return yield*dr(function*(){for(;;){let m;c&&(f.size<i?yield*c.take(1):(m=yield*eu(d),yield*Xc(c.take(1),_r(Ea(m),mi))));let x=m===void 0?yield*d:yield*Ea(m),y=Nt(a),S=yield*he(x)(o,y);for(;f.size>=i;){let E=lA(f);f.delete(E),f.size===0&&(yield*u.open),yield*mo(E)}let w=yield*S.pipe(Rr(()=>Rl),I(E=>Sn(p,E)),$t({disableYield:!0}),Vn(Se(function*(E){let U=Jm(E),_=yield*vn(Le(y,U));if(!f.has(w))return;let h=hb([U,_]);Uo(h)&&(yield*Bt(p,h.cause)),f.delete(w),c&&(yield*c.release(1)),f.size===0&&(yield*u.open)})),eu);u.closeUnsafe(),f.add(w)}}).pipe(rt(m=>{let x=Tl(m);return mt(x)?u.whenOpen(Bt(p,m)):Bt(p,m)}),Ut(a)),Ms(p)}))),hg=l(e=>cr(e[0])&&cr(e[1]),(e,t,r)=>go(Se(function*(n,o,s){let a=r?.haltStrategy??\"both\",i=yield*jp(0);yield*Kt(s,Fn(i));let c=0;function u(p,d){if(c++,!Bo(d))return Bt(i,d);switch(a){case\"both\":return c===2?Bt(i,d):Q;case\"left\":case\"right\":return p===a?Bt(i,d):Q;case\"either\":return Bt(i,d)}}let f=(p,d,m)=>he(d)(n,m).pipe(I(x=>x.pipe(I(y=>Sn(i,y)),$t)),Vn(x=>Fl(Jm(x),y=>Le(m,y)).pipe(zo({onFailure:y=>u(p,y),onSuccess:()=>u(p,x)}))),Ut(s));return yield*f(\"left\",e,Nt(s)),yield*f(\"right\",t,Nt(s)),Ms(i)}))),u2=l(2,(e,t)=>hg(e,A1(t),{haltStrategy:\"left\"})),f2=()=>Ce((e,t)=>X(()=>{let r=\"\",n=!1,o=v();function s(c){let u=[];function f(p){r.length===0?u.push(p):(u.push(r+p),r=\"\")}for(let p=0;p<c.length;p++){let d=c[p];if(d.length!==0){let m=0,x=d.indexOf(\"\\r\"),y=d.indexOf(`\n`);for(n&&(y===0&&(m=1,y=d.indexOf(`\n`,m)),n=!1);x!==-1||y!==-1;)x===-1||y!==-1&&y<x?(f(d.substring(m,y)),m=y+1,y=d.indexOf(`\n`,m)):(f(d.substring(m,x)),d.length===x+1?(n=!0,m=d.length,x=-1):(m=x+(y===x+1?2:1),x=d.indexOf(\"\\r\",m),y=d.indexOf(`\n`,m)));r=r+d.substring(m)}}return tt(u)?u:null}let a=$(()=>o._tag===\"Some\"?Y(o.value):Km(e,{onSuccess:i,onFailure:ze,onDone:c=>{if(o=O(c),r.length>0){let u=r;return r=\"\",n=!1,g([u])}return Y(c)}}));function i(c){let u=s(c);return u!==null?g(u):a}return a}));var Xw=l(2,(e,t)=>Ce((r,n)=>I(he(e)(r,n),o=>he(t)(o,n)))),e0=l(2,(e,t)=>Ce((r,n)=>I(he(e)(r,n),o=>{let s=rt(o,a=>Bo(a)?ze(a):an(ub(a)));return j(he(t)(s,n),a=>Wb(a,i=>qc(i)?ze(i.value):an(i)))}))),Ca=e=>Ce((t,r)=>{let n;return g($(()=>n||e.pipe(Es(r),I(o=>he(o)(t,r)),I(o=>n=o))))}),l2=e=>go((t,r,n)=>j(Es(he(e)(t,r),n),Es(n)));var p2=l(2,(e,t)=>Ce(Se(function*(r,n){let o=yield*he(e)(r,n),s=yield*Mn({capacity:t.capacity===\"unbounded\"?void 0:t.capacity,strategy:t.capacity===\"unbounded\"?void 0:t.strategy});return yield*Kt(n,Fn(s)),yield*o.pipe(I(a=>Sn(s,a)),$t({disableYield:!0}),Vn(a=>Bt(s,a)),Ut(n)),Ms(s)}))),d2=l(2,(e,t)=>Ce(Se(function*(r,n){let o=yield*he(e)(r,n),s=yield*Mn({capacity:t.capacity===\"unbounded\"?void 0:t.capacity,strategy:t.capacity===\"unbounded\"?void 0:t.strategy});return yield*Kt(n,Fn(s)),yield*o.pipe(I(a=>Yi(s,a)),$t({disableYield:!0}),Vn(a=>Bt(s,a)),Ut(n)),Qi(s)}))),t0=l(2,(e,t)=>hg(e,er(g(I(t,Y))),{haltStrategy:\"either\"})),m2=l(2,(e,t)=>go(Se(function*(r,n,o){let s=yield*he(e)(r,n),a=yield*Ut(t,o,{startImmediately:!0});return $(()=>{let i=a.pollUnsafe();return i===void 0?s:mb(i,{onFailure:ze,onSuccess:Y})})}))),h2=l(2,(e,t)=>Hp(e,r=>Uo(r)?t(r.cause):Q)),Hp=l(2,(e,t)=>go((r,n,o)=>Lo(o,t).pipe(_r(he(e)(r,n))))),x2=l(2,(e,t)=>Ca(Tt(t,e))),r0=l(2,(e,t)=>Nn(e,r=>X(()=>{let n=!0,o=Rr(r,s=>(n=!1,t(s)));return $(()=>n?o:r)}))),g2=l(2,(e,t)=>Nn(e,r=>g(He(r,n=>I(t,()=>Y(n)))))),y2=l(2,(e,t)=>Hp(e,r=>t)),Xi=(e,t,r)=>$(()=>{let n=kn(),o=he(e)(Y(),n);return He(I(o,t),r||g).pipe(un(s=>Le(n,s)))});var xg=l(2,(e,t)=>Ce((r,n)=>j(On(he(e)(r,n),t),On(t)))),gg=l(3,(e,t,r)=>Ce((n,o)=>j(qo(he(e)(n,o),t,r),qo(t,r)))),yg=l(3,(e,t,r)=>Ce((n,o)=>I(r,s=>he(gg(e,t,s))(n,o)))),S2=l(e=>cr(e[0]),(e,t,r)=>Uf(t)?xg(e,t):Ce((n,o)=>I(r?.local?yl(t,gl(),o):Lm(t,o),s=>j(On(he(e)(n,o),s),On(s))))),b2=l(2,(e,t)=>Ce((r,n)=>Ml(o=>{let s=t(o);return he(xg(e,s))(r,n)})));var n0=function(){let e=cr(arguments[0]),t=e?arguments[1]:arguments[0],r=Gs(e?arguments[2]:arguments[1]);if(e){let n=arguments[0];return g1(n,t,r)}return n=>g1(n,t,r)},g1=(e,t,r)=>hY(eE(t,r),n=>gg(e,ei,n),(n,o)=>cn(s=>{let a=s.getRef(Nr),i=s.getRef(ZO);return Rm(n,o,a,i)}));var E2=e=>Xi(e,t=>$t(t,{disableYield:!0})),ec=l(2,(e,t)=>Xi(e,r=>$t(I(r,t),{disableYield:!0}))),I2=l(2,(e,t)=>Xi(e,r=>r.pipe(I(t),I(n=>n?Q:Y()),$t({disableYield:!0})))),o0=e=>j(tc(e,()=>({bytes:0,arrays:[]}),(t,r)=>{for(let n=0;n<r.length;n++)t.bytes+=r[n].length,t.arrays.push(r[n]);return t}),({arrays:t,bytes:r})=>{let n=new Uint8Array(r),o=0;for(let s=0;s<t.length;s++){let a=t[s];n.set(a,o),o+=a.length}return n});var T2=e=>$(()=>{let t=v();return Xi(e,r=>r.pipe(eh,I(n=>(t=n,Y()))),()=>g(t))}),w2=e=>$(()=>{let t=Symbol(),r=t;return Xi(e,n=>$t(I(n,o=>(r=o,Q)),{disableYield:!0}),()=>r===t?aa:zb(r))}),tc=l(3,(e,t,r)=>$(()=>{let n=t();return Xi(e,o=>Gn({while:Sr,body:()=>o,step:s=>{n=r(n,s)}}),()=>g(n))})),C2=l(3,(e,t,r)=>$(()=>{let n=t();return Xi(e,o=>Gn({while:Sr,body:je(o.pipe(I(s=>r(n,s)),j(s=>{n=s}))),step:$n}),()=>g(n))})),s0=Se(function*(e){let t=ig(1),r=yield*hi(),n=Fe(r,Or);return(yield*he(e)(Y(),n)).pipe(On(r),t.withPermits(1))},rt(e=>g(ze(e)))),ts=(e,t)=>he(e)(Y(),t);var a0=l(e=>cr(e[0]),(e,t)=>Ho(r=>ec(e,n=>Yi(t,n)).pipe(r,vn,I(n=>(Ve(n)?og(t):wa(t,n.cause),Q)))));var A2=l(e=>cr(e[0]),Se(function*(e,t){let r=yield*xi,n=yield*Mn({capacity:typeof t.capacity==\"number\"?t.capacity:void 0,strategy:typeof t.capacity==\"number\"?t.strategy:void 0});return yield*Kt(r,Fn(n)),yield*Ut(a0(e,n),r),n}));var k2=e=>gi(e.capacity===\"unbounded\"?Zx(e):e.strategy===\"dropping\"?Gx(e):e.strategy===\"sliding\"?Vx(e):Kx(e),$p),v2=l(2,Se(function*(e,t){let r=yield*k2(t);return yield*tu(i0(e,r,{shutdownOnEnd:t.shutdownOnEnd!==!1})),r})),i0=l(e=>cr(e[0]),(e,t,r)=>ec(e,n=>t1(t,n)).pipe(r?.shutdownOnEnd===!0?yi($p(t)):R)),O2=l(2,Se(function*(e,t){let r=yield*k2(t);return yield*ec(e,n=>Qx(r,n)).pipe(un(n=>Yx(r,n)),tu),r}));var Mr={};Eo(Mr,{Array:()=>DX,Boolean:()=>$X,ByteSize:()=>jX,ConfigError:()=>af,Date:()=>JX,Duration:()=>BX,Finite:()=>MX,Int:()=>FX,Literal:()=>NX,Literals:()=>UX,LogLevel:()=>qX,NonEmptyString:()=>RX,Number:()=>PX,Port:()=>zX,Record:()=>LX,Redacted:()=>HX,String:()=>_X,URL:()=>WX,all:()=>XL,fail:()=>vX,flatMap:()=>SX,isConfig:()=>YL,map:()=>QL,mapEffect:()=>bX,nested:()=>KX,option:()=>IX,orElse:()=>EX,schema:()=>tr,succeed:()=>OX,unwrap:()=>t$,withDefault:()=>e$});var sf={};Eo(sf,{ConfigProvider:()=>ac,SourceError:()=>Tg,constantCase:()=>rX,fromDir:()=>gX,fromDotEnv:()=>xX,fromDotEnvContents:()=>JL,fromEnv:()=>WL,fromEnvRecord:()=>R0,fromUnknown:()=>aX,layer:()=>oX,layerAdd:()=>sX,make:()=>Cg,makeArray:()=>O0,makeRecord:()=>wg,makeValue:()=>Yp,mapInput:()=>_0,nested:()=>nX,orElse:()=>v0});var _2=\"~effect/PlatformError\",rf=class extends Fr(\"BadArgument\"){get message(){return`${this.module}.${this.method}${this.description?`: ${this.description}`:\"\"}`}};var R2=class extends Fr(\"PlatformError\"){constructor(t){\"cause\"in t?super({reason:t,cause:t.cause}):super({reason:t})}[_2]=_2;get message(){return this.reason.message}};var IY=\"~effect/Stream\",TY={_R:R,_E:R,_A:R},P2=function(e){this.channel=e};P2.prototype={[IY]:TY,pipe(){return Z(this,arguments)}};var M2=e=>new P2(e);var CY=\"~effect/Sink\";var AY={_A:R,_In:R,_L:R,_E:R,_R:R},kY={[CY]:AY,pipe(){return Z(this,arguments)}};var vY=e=>{let t=Object.create(kY);return t.transform=e,t},F2=e=>Ce((t,r)=>g(I(e.transform(t,r),Y)));var N2=e=>{let t=ot(e);return vY(r=>{let n=[];if(t===0)return g([n]);let o;return r.pipe(I(s=>{if(n.length+s.length<=t)return n.push(...s),n.length===t?Y():Q;for(let a=0;a<s.length;a++)if(n.push(s[a]),n.length===t)return a+1<s.length&&(o=s.slice(a+1)),Y();return Q}),$t({disableYield:!0}),He(()=>g([n,o])))})};var ns={};Eo(ns,{DefaultChunkSize:()=>V2,Do:()=>y7,TypeId:()=>G2,accumulate:()=>t7,aggregate:()=>K9,aggregateWithin:()=>b0,as:()=>uQ,bind:()=>b7,bindEffect:()=>E7,bindTo:()=>I7,broadcast:()=>TL,broadcastN:()=>G9,buffer:()=>e9,bufferArray:()=>t9,callback:()=>Q2,catch:()=>Zp,catchCause:()=>uL,catchCauseFilter:()=>l9,catchCauseIf:()=>f9,catchDefect:()=>r9,catchFilter:()=>y0,catchIf:()=>lL,catchReason:()=>i9,catchReasons:()=>c9,catchTag:()=>s9,catchTags:()=>a9,changes:()=>r7,changesWith:()=>wL,changesWithEffect:()=>n7,chunks:()=>yL,collect:()=>e7,combine:()=>_9,combineArray:()=>R9,concat:()=>nc,cross:()=>MQ,crossWith:()=>iL,debounce:()=>D9,decodeText:()=>o7,die:()=>HY,drain:()=>yQ,drainFork:()=>SQ,drop:()=>S0,dropRight:()=>k9,dropUntil:()=>w9,dropUntilEffect:()=>C9,dropWhile:()=>xL,dropWhileEffect:()=>gL,dropWhileFilter:()=>A9,empty:()=>Ns,encodeText:()=>s7,ensuring:()=>d7,fail:()=>nf,failCause:()=>X2,failCauseSync:()=>WY,failSync:()=>qY,filter:()=>JQ,filterEffect:()=>GQ,filterMap:()=>KQ,filterMapEffect:()=>VQ,flatMap:()=>of,flatten:()=>oL,flattenArray:()=>gQ,flattenEffect:()=>lQ,flattenIterable:()=>CQ,flattenTake:()=>AQ,forever:()=>wQ,fromArray:()=>Gp,fromArrayEffect:()=>VY,fromArrays:()=>ZY,fromAsyncIterable:()=>eQ,fromChannel:()=>A,fromEffect:()=>Sg,fromEffectDrain:()=>Z2,fromEffectRepeat:()=>Y2,fromEffectSchedule:()=>$Y,fromEventListener:()=>nQ,fromIterable:()=>oc,fromIterableEffect:()=>KY,fromIterableEffectRepeat:()=>GY,fromIteratorSucceed:()=>JY,fromPubSub:()=>QY,fromPubSubTake:()=>eL,fromPull:()=>rs,fromQueue:()=>YY,fromReadableStream:()=>XY,fromSchedule:()=>tQ,fromSubscription:()=>rQ,groupAdjacentBy:()=>W9,groupBy:()=>q9,groupByKey:()=>H9,grouped:()=>j9,groupedWithin:()=>z9,haltWhen:()=>f7,ignore:()=>h9,ignoreCause:()=>x9,interleave:()=>c7,interleaveWith:()=>AL,interruptWhen:()=>u7,intersperse:()=>CL,intersperseAffixes:()=>i7,isStream:()=>Ie,iterate:()=>sQ,let:()=>S7,limitBytes:()=>b9,make:()=>jY,map:()=>Jr,mapAccum:()=>P9,mapAccumArray:()=>sc,mapAccumArrayEffect:()=>F9,mapAccumEffect:()=>M9,mapArray:()=>rL,mapArrayEffect:()=>pQ,mapBoth:()=>fQ,mapEffect:()=>Vp,mapError:()=>pL,merge:()=>d0,mergeAll:()=>PQ,mergeEffect:()=>bg,mergeLeft:()=>_Q,mergeResult:()=>OQ,mergeRight:()=>RQ,mkArrayBuffer:()=>F7,mkString:()=>M7,mkUint8Array:()=>N7,never:()=>iQ,onEnd:()=>p7,onError:()=>l7,onExit:()=>kL,onFirst:()=>OL,onStart:()=>vL,orDie:()=>m9,orElseIfEmpty:()=>p9,orElseSucceed:()=>d9,paginate:()=>oQ,partition:()=>YQ,partitionEffect:()=>ZQ,partitionQueue:()=>x0,peel:()=>XQ,pipeThrough:()=>X9,pipeThroughChannel:()=>Y9,pipeThroughChannelOrFail:()=>Q9,prepend:()=>vQ,provide:()=>_L,provideContext:()=>m7,provideService:()=>h7,provideServiceEffect:()=>E0,race:()=>WQ,raceAll:()=>cL,range:()=>aQ,rechunk:()=>SL,repeat:()=>bQ,repeatElements:()=>TQ,result:()=>dQ,retry:()=>g9,run:()=>T7,runCollect:()=>PL,runCount:()=>w7,runDrain:()=>Ig,runFold:()=>A7,runFoldEffect:()=>k7,runForEach:()=>_7,runForEachArray:()=>ML,runForEachWhile:()=>R7,runHead:()=>v7,runIntoPubSub:()=>B7,runIntoQueue:()=>q7,runLast:()=>O7,runSum:()=>C7,scan:()=>N9,scanEffect:()=>U9,schedule:()=>EQ,scoped:()=>cQ,service:()=>DY,serviceOption:()=>LY,share:()=>Z9,sliding:()=>v9,slidingSize:()=>bL,split:()=>O9,splitLines:()=>a7,succeed:()=>rc,suspend:()=>Wr,switchMap:()=>xQ,sync:()=>zY,take:()=>S9,takeRight:()=>E9,takeUntil:()=>dL,takeUntilEffect:()=>mL,takeWhile:()=>hL,takeWhileEffect:()=>T9,takeWhileFilter:()=>I9,tap:()=>nL,tapBoth:()=>mQ,tapCause:()=>fL,tapDefect:()=>o9,tapError:()=>g0,tapErrorTag:()=>n9,tapSink:()=>hQ,throttle:()=>B9,throttleEffect:()=>EL,tick:()=>BY,timeout:()=>IQ,timeoutOrElse:()=>sL,toAsyncIterable:()=>$7,toAsyncIterableEffect:()=>L7,toAsyncIterableWith:()=>T0,toChannel:()=>Un,toPubSub:()=>j7,toPubSubTake:()=>FL,toPull:()=>P7,toQueue:()=>z7,toReadableStream:()=>U7,toReadableStreamEffect:()=>D7,toReadableStreamWith:()=>I0,transduce:()=>J9,transformPull:()=>Dt,transformPullBracket:()=>p0,unfold:()=>tL,unwrap:()=>Aa,unwrapReason:()=>u9,updateContext:()=>RL,updateService:()=>x7,when:()=>QQ,withExecutionPlan:()=>y9,withSpan:()=>g7,zip:()=>NQ,zipFlatten:()=>LQ,zipLatest:()=>qQ,zipLatestAll:()=>h0,zipLatestWith:()=>HQ,zipLeft:()=>UQ,zipRight:()=>DQ,zipWith:()=>m0,zipWithArray:()=>Eg,zipWithIndex:()=>$Q,zipWithNext:()=>BQ,zipWithPrevious:()=>jQ,zipWithPreviousAndNext:()=>zQ});var D2=\"~effect/RcMap\",OY=e=>({[D2]:D2,lookup:e.lookup,context:e.context,scope:e.scope,idleTimeToLive:e.idleTimeToLive,capacity:e.capacity,state:{_tag:\"Open\",map:Up()},pipe(){return Z(this,arguments)}}),L2=e=>cn(t=>{let r=t.context,n=Fe(r,Or),o=OY({lookup:e.lookup,context:r,scope:n,idleTimeToLive:typeof e.idleTimeToLive==\"function\"?rC(e.idleTimeToLive,Ge):je(Ge(e.idleTimeToLive??Ws)),capacity:Math.max(e.capacity??Number.POSITIVE_INFINITY,0)});return Tt(Lo(n,()=>{if(o.state._tag===\"Closed\")return Q;let s=o.state.map;return o.state={_tag:\"Closed\"},sa(s,([,a])=>vn(Wp(a))).pipe(Rr(()=>X(()=>{Ux(s)})))}),o)}),u0=l(2,(e,t)=>Ho(r=>{if(e.state._tag===\"Closed\")return _n;let n=e.state,o=Zu(),s=Xo(n.map,t),a;if(s._tag===\"Some\")a=s.value,a.refCount++;else{if(Number.isFinite(e.capacity)&&WD(e.state.map)>=e.capacity)return P(new fb(`RcMap attempted to exceed capacity of ${e.capacity}`));{a={deferred:ui(),scope:kn(),idleTimeToLive:e.idleTimeToLive(t),finalizer:void 0,fiber:void 0,expiresAt:0,refCount:1},a.finalizer=RY(e,t,a),Dp(n.map,t,a);let c=new Map(e.context.mapUnsafe);o.context.mapUnsafe.forEach((f,p)=>{c.set(p,f)}),c.set(Or.key,a.scope);let u=Oo(c);$(()=>e.lookup(t)).pipe(Rn(u),Ia(a.scope)).addObserver(f=>{db(f)&&_Y(e,t,a,u),Do(a.deferred,f)})}}let i=_o(o.context,Or);return Kt(i,a.finalizer).pipe(_r(r(Fm(a.deferred))))}));var _Y=(e,t,r,n)=>{if(e.state._tag===\"Closed\")return;let o=Xo(e.state.map,t);o._tag===\"None\"||o.value!==r||(Vu(e.state.map,t),!(r.refCount>0)&&Wp(r).pipe(Rn(n),Ia(e.scope)))},Wp=e=>e.fiber?mo(e.fiber).pipe(_r(Le(e.scope,xt))):Le(e.scope,xt),RY=(e,t,r)=>cn(n=>{if(r.refCount--,r.refCount>0)return Q;if(e.state._tag===\"Closed\")return Wp(r);let o=Xo(e.state.map,t);if(o._tag===\"None\"||o.value!==r)return Wp(r);if(vc(r.idleTimeToLive))return Vu(e.state.map,t),Wp(r);if(!Ks(r.idleTimeToLive))return Q;let s=n.getRef(Hc);return r.expiresAt=s.currentTimeMillisUnsafe()+Cr(r.idleTimeToLive),r.fiber?Q:(r.fiber=Ho(function a(i){let c=s.currentTimeMillisUnsafe(),u=r.expiresAt-c;if(u<=0){if(e.state._tag===\"Closed\"||r.refCount>0)return Q;let f=Xo(e.state.map,t);return f._tag===\"None\"||f.value!==r?Q:(Vu(e.state.map,t),Le(r.scope,xt))}return I(i(s.sleep(Js(u))),()=>a(i))}).pipe(yi(X(()=>{r.fiber=void 0})),Rn(n.context),Ia(e.scope)),Q)});var f0=l(2,(e,t)=>Si(r=>{if(e.state._tag===\"Closed\")return Q;let n=Xo(e.state.map,t);if(n._tag===\"None\"||vc(n.value.idleTimeToLive))return Q;let o=n.value;return o.expiresAt=r.currentTimeMillisUnsafe()+Cr(o.idleTimeToLive),Q}));var PY=\"~effect/RcRef\",Jp={_tag:\"Empty\"},MY={_tag:\"Closed\"},FY={_A:R,_E:R},l0=class{[PY]=FY;pipe(){return Z(this,arguments)}state=Jp;acquire;context;scope;idleTimeToLive;constructor(t,r,n,o){this.acquire=t,this.context=r,this.scope=n,this.idleTimeToLive=o}},j2=e=>cn(t=>{let r=t.context,n=Fe(r,Or),o=new l0(e.acquire,r,n,e.idleTimeToLive!==void 0?Ge(e.idleTimeToLive):void 0);return Tt(Lo(n,()=>{let s=o.state;return o.state=MY,s._tag===\"Acquired\"?Le(s.scope,xt):s._tag===\"Acquiring\"?mo(s.fiber):Q}),o)}),NY=(e,t)=>{switch(e.state._tag){case\"Closed\":return _n;case\"Acquired\":{let r=e.state;return r.refCount++,r.fiber?Tt(mo(r.fiber),r):g(r)}case\"Acquiring\":{let r=e.state;return r.awaiters++,B2(e,r,t)}case\"Empty\":{let r={_tag:\"Acquiring\",fiber:void 0,awaiters:1,acquired:void 0};e.state=r;let n=kn(),o=On(e.acquire,Jt(e.context,Or,n)).pipe(I(s=>{if(e.state!==r)return _n;let a={_tag:\"Acquired\",value:s,scope:n,fiber:void 0,refCount:r.awaiters,invalidated:!1};return e.state=a,r.acquired=a,g(a)}),un(s=>Ve(s)?Q:(e.state===r&&(e.state=Jp),Le(n,s))));return r.fiber=Rn(Zu().context)(o),B2(e,r,t)}}},B2=(e,t,r)=>un(r(Ea(t.fiber)),n=>{let o=t.acquired;return o!==void 0?Uo(n)?q2(e,o):Q:--t.awaiters>0||e.state!==t?Q:(e.state=Jp,mo(t.fiber))}),z2=e=>{let t=e;return Ho(r=>I(xi,n=>I(NY(t,r),o=>Tt(Lo(n,()=>q2(t,o)),o.value))))},q2=(e,t)=>{if(t.refCount--,t.refCount>0)return Q;let r=e.idleTimeToLive;return r===void 0||t.invalidated?(e.state===t&&(e.state=Jp),Le(t.scope,xt)):Ks(r)?(t.fiber=Ho(n=>I(n(ua(r)),()=>e.state===t&&t.refCount===0?(e.state=Jp,Le(t.scope,xt)):Q)).pipe(yi(X(()=>{t.fiber=void 0})),Rn(e.context),Ia(e.scope)),Q):Q};var H2=j2,W2=z2;var G2=\"~effect/Stream\",Ie=e=>k(e,G2),V2=zp,A=M2,Sg=e=>A(fg(j(e,Ee))),DY=e=>Sg(Yb(e)),LY=e=>Sg(Qb(e)),Z2=e=>rs(g(I(e,()=>Y()))),Y2=e=>rs(g(j(e,Ee))),$Y=(e,t)=>rs(dr(function*(){let r=yield*Kn(t),n=yield*qo(e,Gt,Gt.defaultValue()),o=!0,s=$(()=>r(n)).pipe(I(a=>qo(e,Gt,a)),j(a=>(n=a,Ee(a))));return $(()=>o?(o=!1,g(Ee(n))):s)})),BY=e=>rs(X(()=>{let t=!0,r=g(Ee(void 0)),n=Jb(r,e);return $(()=>t?(t=!1,r):n)})),rs=e=>A(er(e)),Dt=(e,t)=>A(Ce((r,n)=>I(ts(e.channel,n),o=>t(o,n)))),p0=(e,t)=>A(go((r,n,o)=>I(ts(e.channel,n),s=>t(s,n,o)))),Un=e=>e.channel,Q2=(e,t)=>A(S1(e,t)),Ns=A(Xu),rc=e=>A(ug(Ee(e))),jY=(...e)=>Gp(e),zY=e=>A(I1(()=>Ee(e()))),Wr=e=>A(cg(()=>e().channel)),nf=e=>A(es(e)),qY=e=>A(w1(e)),X2=e=>A(qp(e)),HY=e=>A(Gw(e)),WY=e=>A(C1(e)),JY=(e,t)=>A(Kw(()=>e,t)),oc=(e,t)=>Array.isArray(e)&&t?.chunkSize===void 0?Gp(e):A(E1(e,t?.chunkSize)),KY=e=>Aa(j(e,oc)),GY=e=>of(Y2(e),oc),Gp=e=>tt(e)?A(ug(e)):Ns,VY=e=>Aa(j(e,Gp)),ZY=(...e)=>A(Jw(jd(e,tt))),YY=e=>A(k1(e)),QY=e=>A(v1(e)),eL=e=>A(O1(e)),XY=e=>A(_1(e)),eQ=(e,t)=>A(R1(e,t)),tQ=e=>rs(j(Cl(e),t=>He(j(t(void 0),Ee),()=>Y()))),rQ=e=>A(Zw(e)),nQ=(e,t,r)=>Q2(n=>{let o=typeof r==\"object\"&&r.once;function s(a){rg(n,a),o&&og(n)}return gi(X(()=>e.addEventListener(t,s,r)),()=>X(()=>e.removeEventListener(t,s,r)))},{bufferSize:typeof r==\"object\"?r.bufferSize:void 0}),tL=(e,t)=>rs(X(()=>{let r=e;return I($(()=>t(r)),n=>n===void 0?Y():(r=n[1],g(Ee(n[0]))))})),oQ=(e,t)=>rs(X(()=>{let r=e,n=!1;return $(function o(){return n?Y():I(t(r),([s,a])=>(fe(a)?n=!0:r=a.value,tt(s)?g(s):o()))})})),sQ=(e,t)=>tL(e,r=>g([r,t(r)])),aQ=(e,t,r=zp)=>e>t?Ns:rs(X(()=>{let n=Tn(r),o=e,s=!1;return $(()=>{if(s)return Y();let a=t-o+1;if(a>n){let c=xy(o,o+n-1);return o+=n,g(c)}let i=xy(o,o+a-1);return s=!0,g(i)})})),iQ=A(T1),Aa=e=>A(Ca(j(e,Un))),cQ=e=>A(l2(e.channel)),Jr=l(2,(e,t)=>Wr(()=>{let r=0;return A(yo(e.channel,wn(n=>t(n,r++))))})),uQ=l(2,(e,t)=>Jr(e,()=>t)),fQ=l(2,(e,t)=>e.pipe(Jr(t.onElement),pL(t.onError))),rL=l(2,(e,t)=>A(yo(e.channel,t))),Vp=l(e=>Ie(e[0]),(e,t,r)=>e.channel.pipe(gr,lg(t,r),yo(Ee),A)),lQ=l(e=>Ie(e[0]),(e,t)=>Vp(e,R,t)),pQ=l(2,(e,t)=>A(lg(e.channel,t))),dQ=e=>e.pipe(Jr(B),Zp(t=>rc(W(t)))),nL=l(e=>Ie(e[0]),(e,t,r)=>Vp(e,n=>Tt(t(n),n),r)),mQ=l(2,(e,t)=>e.pipe(g0(t.onError),nL(t.onElement,{concurrency:t.concurrency}))),hQ=l(2,(e,t)=>p0(e,Se(function*(r,n,o){let s=Pr(),a=Pr(),i,c,u=!1,f=!1,p=s.whenOpen($(()=>{if(i){let m=i;return i=void 0,f||s.closeUnsafe(),Tt(a.open,m)}return Y()}));yield*$(()=>t.transform(p,o)).pipe(m=>Fl(m,x=>(u=!0,Uo(x)&&(c=x.cause),a.open),!0),Ut(o));let d=r.pipe(I(m=>c?ze(c):u?g(m):(i=m,a.closeUnsafe(),s.openUnsafe(),Tt(a.await,m))),He(()=>c?ze(c):u?Y():(f=!0,a.closeUnsafe(),s.openUnsafe(),I(a.await,()=>c?ze(c):Y()))));return $(()=>c?ze(c):u?r:d)}))),of=l(e=>Ie(e[0]),(e,t,r)=>e.channel.pipe(gr,Yw(n=>t(n).channel,r),A)),xQ=l(e=>Ie(e[0]),(e,t,r)=>e.channel.pipe(gr,c2(n=>t(n).channel,r),A)),oL=l(e=>Ie(e[0]),(e,t)=>of(e,R,t)),gQ=e=>A(gr(e.channel)),yQ=e=>A($1(e.channel)),SQ=l(2,(e,t)=>bg(e,Ig(t))),bQ=l(2,(e,t)=>A(B1(e.channel,t))),EQ=l(2,(e,t)=>e.channel.pipe(gr,q1(t),yo(Ee),A)),IQ=l(2,(e,t)=>sL(e,{duration:t,orElse:()=>Ns})),sL=l(2,(e,t)=>{let r=Ge(t.duration);if(!Ks(r))return e;if(vc(r))return Wr(t.orElse);let n=Symbol();return uL(Wr(()=>{let s=Zu().getRef(Hc),a=Cr(r),i,c=Pr(!1);return d0(Dt(e,(u,f)=>$(()=>(i=s.currentTimeMillisUnsafe()+a,c.openUnsafe(),u)).pipe(j(p=>(c.closeUnsafe(),i=void 0,p)),g)),Z2(dr(function*(){for(;;)if(yield*c.await,!(i===void 0||(yield*ua(i-s.currentTimeMillisUnsafe()),i===void 0)||i-s.currentTimeMillisUnsafe()>0))return yield*an(n)})),{haltStrategy:\"left\"})}),o=>o.reasons.find(a=>a._tag===\"Die\"&&a.defect===n)?t.orElse():X2(o))}),TQ=l(2,(e,t)=>A(Ce((r,n)=>j(he(gr(e.channel))(r,n),o=>{let s,a=dr(function*(){let i=yield*o,c=Ee(i);return s=(yield*Cl(t))(i).pipe(Tt(c),He(f=>(s=void 0,a))),c});return $(()=>s??a)})))),wQ=e=>A(z1(e.channel)),CQ=e=>of(e,oc),AQ=e=>e.channel.pipe(gr,L1,A),nc=l(2,(e,t)=>{let r=A(D1(b1(()=>kQ(e,t))));return aL.set(r,[e,t]),r}),aL=new WeakMap;function*kQ(e,t){let r=[t,e];for(;r.length>0;){let n=r.pop(),o=aL.get(n);o===void 0?yield n.channel:r.push(o[1],o[0])}}var vQ=l(2,(e,t)=>nc(oc(t),e)),d0=l(e=>Ie(e[0])&&Ie(e[1]),(e,t,r)=>A(hg(Un(e),Un(t),r))),bg=l(2,(e,t)=>e.channel.pipe(u2(t),A)),OQ=l(2,(e,t)=>d0(Jr(e,B),Jr(t,W))),_Q=l(2,(e,t)=>bg(e,Ig(t))),RQ=l(2,(e,t)=>bg(t,Ig(e))),PQ=l(2,(e,t)=>oL(oc(e),t)),MQ=l(2,(e,t)=>iL(e,t,(r,n)=>[r,n])),iL=l(3,(e,t,r)=>of(e,n=>Jr(t,o=>r(n,o)))),m0=l(3,(e,t,r)=>Eg(e,t,FQ(r))),FQ=e=>(t,r)=>{let n=Math.min(t.length,r.length),o=[];for(let s=0;s<n;s++)o.push(e(t[s],r[s]));return[o,t.slice(n),r.slice(n)]},Eg=l(3,(e,t,r)=>A(go(Se(function*(n,o){let s=yield*ts(e.channel,o),a=yield*ts(t.channel,o),i=dr(function*(){let f=yield*Ut(s,o),p=yield*Ut(a,o);return yield*KD([f,p])}),c={_tag:\"PullBoth\"};return dr(function*(){let[f,p]=c._tag===\"PullBoth\"?yield*i:c._tag===\"PullLeft\"?[yield*s,c.rightArray]:[c.leftArray,yield*a],d=r(f,p);return tt(d[1])?c={_tag:\"PullRight\",leftArray:d[1]}:tt(d[2])?c={_tag:\"PullLeft\",rightArray:d[2]}:c={_tag:\"PullBoth\"},d[0]})})))),NQ=l(2,(e,t)=>m0(e,t,(r,n)=>[r,n])),UQ=l(2,(e,t)=>Eg(e,t,(r,n)=>{let o=Math.min(r.length,n.length),s=r.slice(0,o),a=r.slice(o),i=n.slice(o);return[s,a,i]})),DQ=l(2,(e,t)=>Eg(e,t,(r,n)=>{let o=Math.min(r.length,n.length),s=n.slice(0,o),a=r.slice(o),i=n.slice(o);return[s,a,i]})),LQ=l(2,(e,t)=>m0(e,t,(r,n)=>[...r,n])),$Q=e=>Jr(e,(t,r)=>[t,r]),BQ=e=>sc(e,v,(t,r)=>{let n=0;t._tag===\"None\"&&(n=1,t=O(r[0]));let o=Pt();for(;n<r.length;n++){let s=t.value;t=O(r[n]),o.push([s,t])}return[t,o]},{onHalt(t){return t._tag===\"Some\"?[[t.value,v()]]:[]}}),jQ=e=>sc(e,v,(t,r)=>{let n=Pt();for(let o=0;o<r.length;o++){let s=r[o];n.push([t,s]),t=O(r[o])}return[t,n]}),zQ=e=>sc(e,()=>({prev:v(),current:v()}),(t,r)=>{let n=0,o;t.current._tag===\"None\"?(n=1,o=r[0],t.current=O(o)):o=t.current.value;let s=Pt();for(;n<r.length;n++){let a=r[n];t.current=O(a),s.push([t.prev,o,t.current]),t.prev=O(o),o=a}return[t,s]},{onHalt(t){return t.current._tag===\"Some\"?[[t.prev,t.current.value,v()]]:[]}}),h0=(...e)=>A(cg(()=>{let t=[],r=new Set,n=Pr(),o=Pr();return mg(Jw(e.map((s,a)=>s.channel.pipe(gr,lg(i=>(t[a]=i,r.has(a)?g(Ee(t.slice())):(r.add(a),r.size<e.length?n.await:Tt(n.open,Ee(t.slice()))))),H1(Io),P1(()=>r.has(a)?Q:o.open)))),{concurrency:\"unbounded\",bufferSize:0}).pipe(t0(o.await))})),qQ=l(2,(e,t)=>h0(e,t)),HQ=l(3,(e,t,r)=>Jr(h0(e,t),([n,o])=>r(n,o))),cL=(...e)=>A(Ce((t,r)=>X(()=>{let n,o=Kb(e.map(s=>{let a=Nt(r);return ts(s.channel,a).pipe(I(i=>Hb(g(i),i)),un(i=>i._tag===\"Success\"?n?Le(a,i):(n=i.value[0],Q):Le(a,i)),j(([,i])=>i))}));return $(()=>n??o)}))),WQ=l(2,(e,t)=>cL(e,t)),JQ=l(2,(e,t)=>A(W1(Un(e),t))),KQ=l(2,(e,t)=>A(J1(Un(e),t))),GQ=l(2,(e,t)=>A(K1(Un(e),t))),VQ=l(2,(e,t)=>A(G1(Un(e),t))),x0=l(e=>Ie(e[0]),Se(function*(e,t,r){let n=yield*xi,o=yield*ts(e.channel,n),s=r?.capacity===\"unbounded\"?void 0:r?.capacity??V2,a=yield*Mn({capacity:s}),i=yield*Mn({capacity:s});return yield*dr(function*(){for(;;){let c=yield*o,u=[],f=[];for(let d=0;d<c.length;d++){let m=t(c[d]);ce(m)?u.push(m.failure):f.push(m.success)}let p;if(f.length>0){let d=ng(a,f);d.length>0&&(p=yield*eu(Yi(a,d)))}if(u.length>0){let d=ng(i,u);d.length>0&&(yield*Yi(i,d))}p&&(yield*Ea(p))}}).pipe(Vn(c=>(wa(a,c),wa(i,c),Q)),Ut(n)),[a,i]})),Kp=e=>A(Ce((t,r)=>Tt(Kt(r,Fn(e)),Qi(e)))),ZQ=l(e=>Ie(e[0]),(e,t,r)=>j(x0(Vp(e,n=>t(n),r),n=>n,r),([n,o])=>[Kp(n),Kp(o)])),YQ=l(e=>Ie(e[0]),(e,t,r)=>j(x0(e,t,{capacity:r?.capacity??16}),([n,o])=>[Kp(n),Kp(o)])),QQ=l(2,(e,t)=>t.pipe(j(r=>r?e:Ns),Aa)),XQ=l(2,Se(function*(e,t){let r,n=yield*s0(e.channel),o=rt(n,c=>(r=c,ze(c))),[s,a]=yield*sh(c=>t.transform(o,c)),i=r?Ns:rs(g(n));return a&&(i=nc(Gp(a),i)),[s,i]})),e9=l(2,(e,t)=>A(d2(e.channel,t))),t9=l(2,(e,t)=>A(p2(e.channel,t))),uL=l(2,(e,t)=>e.channel.pipe(tf(r=>t(r).channel),A)),r9=l(2,(e,t)=>e.channel.pipe(Z1(r=>t(r).channel),A)),fL=l(2,(e,t)=>e.channel.pipe(pg(t),A)),Zp=l(2,(e,t)=>A(xo(e.channel,r=>t(r).channel)));var g0=l(2,(e,t)=>e.channel.pipe(Q1(t),A)),n9=l(3,(e,t,r)=>{let n=Array.isArray(t)?o=>k(o,\"_tag\")&&t.includes(o._tag):At(t);return g0(e,o=>n(o)?r(o):Q)}),o9=l(2,(e,t)=>fL(e,r=>{let n=dl(r);return mt(n)?t(n.success):Q})),lL=l(e=>Ie(e[0]),(e,t,r,n)=>A(X1(Un(e),t,o=>r(o).channel,n&&(o=>n(o).channel)))),y0=l(e=>Ie(e[0]),(e,t,r,n)=>A(e2(Un(e),t,o=>r(o).channel,n&&(o=>n(o).channel)))),s9=l(e=>Ie(e[0]),(e,t,r,n)=>{let o=Array.isArray(t)?s=>k(s,\"_tag\")&&t.includes(s._tag):At(t);return lL(e,o,r,n)}),a9=l(e=>Ie(e[0]),(e,t,r)=>{let n;return y0(e,o=>(n??=Object.keys(t),k(o,\"_tag\")&&Hm(o._tag)&&n.includes(o._tag)?B(o):W(o)),o=>t[o._tag](o),r)}),i9=l(e=>Ie(e[0]),(e,t,r,n,o)=>A(t2(Un(e),t,r,(s,a)=>n(s,a).channel,o&&((s,a)=>o(s,a).channel)))),c9=l(e=>Ie(e[0]),(e,t,r,n)=>{let o=Object.create(null);for(let a of Object.keys(r)){let i=r[a];o[a]=(c,u)=>i(c,u).channel}let s=n&&((a,i)=>n(a,i).channel);return A(r2(e.channel,t,o,s))}),u9=l(2,(e,t)=>y0(e,r=>At(r,t)&&k(r,\"reason\")?B(r.reason):W(r),nf)),pL=l(2,(e,t)=>A(n2(e.channel,t))),f9=l(3,(e,t,r)=>A(Y1(e.channel,t,n=>r(n).channel))),l9=l(3,(e,t,r)=>A(dg(e.channel,t,(n,o)=>r(n,o).channel))),p9=l(2,(e,t)=>A(U1(e.channel,r=>Un(t())))),d9=l(2,(e,t)=>Zp(e,r=>rc(t(r)))),m9=e=>A(o2(e.channel)),h9=l(e=>Ie(e[0]),(e,t)=>A(s2(e.channel,t))),x9=l(e=>Ie(e[0]),(e,t)=>A(a2(e.channel,t))),g9=l(2,(e,t)=>A(i2(e.channel,t))),K2=(e,t)=>Aa(j(Kn(t),r=>{let n=Gt.defaultValue(),o=()=>Zp(E0(e,Gt,X(()=>n)),s=>Aa(He(j(r(s),a=>(n=a,Aa(Tt(Rl,o())))),()=>g(nf(s)))));return o()})),y9=l(e=>Ie(e[0]),(e,t,r)=>Wr(()=>{let n=r?.preventFallbackOnPartialStream??!1,o=0,s={attempt:0,stepIndex:0},a=E0(Gm,X(()=>(s={attempt:s.attempt+1,stepIndex:o},s))),i=r?.onEvent===void 0?void 0:$b(r.onEvent,()=>s),c,u=i===void 0?R:d=>kL(vL(d,j(i.begin,m=>{c=m})),m=>$(()=>{if(c===void 0)return Q;let x=c;return c=void 0,i.end(x,m)})),f=v(),p=Wr(()=>{let d=t.steps[o];if(!d)return nf(uy(f));let m=a(u(_L(e,d.provide))),x=!1;if(be(f)){let y=f.value,S=!1,w=m;m=Wr(()=>S?w:(S=!0,nf(y))),m=K2(m,_l(d,!1))}else{let y=_l(d,!0);m=y?K2(m,y):m}return Zp(n?OL(m,y=>(x=!0,Q)):m,y=>(o++,n&&x?nf(y):(f=O(y),p)))});return p})),S9=l(2,(e,t)=>{let r=ot(t);return r===0?Ns:dL(e,(n,o)=>o===r-1)}),b9=l(3,(e,t,r)=>Wr(()=>{let n=ch(t),o=BigInt(0),s=!1;return nc(hL(e,a=>{let i=o+BigInt(a.length);return i>n?(s=!0,!1):(o=i,!0)}),Wr(()=>s?r():Ns))})),E9=l(2,(e,t)=>{let r=ot(t);return r===0?Ns:sc(e,Ps,(n,o)=>($x(n,o),n.length>r&&jx(n,n.length-r),[n,Fs]),{onHalt(n){return Ta(n)}})}),dL=l(e=>Ie(e[0]),(e,t,r)=>Dt(e,(n,o)=>X(()=>{let s=0,a=!1;return I($(()=>a?Y():n),c=>{let u=c.findIndex(f=>t(f,s++));if(u>=0){a=!0;let f=c.slice(0,r?.excludeLast?u:u+1);return tt(f)?g(f):Y()}return g(c)})}))),mL=l(e=>Ie(e[0]),(e,t,r)=>Dt(e,(n,o)=>X(()=>{let s=0,a=!1;return dr(function*(){if(a)return yield*Y();let i=yield*n;for(let c=0;c<i.length;c++)if(yield*t(i[c],s++)){a=!0;let u=i.slice(0,r?.excludeLast?c:c+1);return tt(u)?u:yield*Y()}return i})}))),hL=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o=0,s=!1,a=I($(()=>s?Y():r),i=>{let c=[];for(let u=0;u<i.length;u++){if(!t(i[u],o++)){s=!0;break}c.push(i[u])}return tt(c)?g(c):s?Y():a});return a}))),I9=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o=!1,s=I($(()=>o?Y():r),a=>{let i=[];for(let c=0;c<a.length;c++){let u=t(a[c]);if(ce(u)){o=!0;break}i.push(u.success)}return tt(i)?g(i):o?Y():s});return s}))),T9=l(2,(e,t)=>mL(e,(r,n)=>j(t(r,n),o=>!o),{excludeLast:!0})),S0=l(2,(e,t)=>{let r=ot(t);return r===0?e:Dt(e,(n,o)=>X(()=>{let s=0,a=n.pipe(I(i=>s>=r?g(i):(s+=i.length,s<=r?a:g(i.slice(r-s)))));return a}))}),w9=l(2,(e,t)=>S0(xL(e,(r,n)=>!t(r,n)),1)),C9=l(2,(e,t)=>S0(gL(e,(r,n)=>j(t(r,n),o=>!o)),1)),xL=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o=!0,s=0,a=I(r,i=>{let c=i.findIndex(u=>!t(u,s++));return c===-1?a:(o=!1,g(i.slice(c)))});return $(()=>o?a:r)}))),A9=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o=!0,s=I(r,a=>{let i=a.findIndex(c=>ce(t(c)));return i===-1?s:(o=!1,g(a.slice(i)))});return $(()=>o?s:r)}))),gL=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o=!0,s=0,a=dr(function*(){for(;;){let i=yield*r;for(let c=0;c<i.length;c++)if(!(yield*t(i[c],s++)))return o=!1,i.slice(c)}});return $(()=>o?a:r)}))),k9=l(2,(e,t)=>{let r=ot(t);return r===0?e:Dt(e,(n,o)=>X(()=>{let s=Ps(),a=I(n,i=>{Bx(s,i);let c=s.length-r,u=Vi(s,c);return or(u)?g(u):a});return a}))}),yL=e=>e.channel.pipe(yo(Ee),A),SL=l(2,(e,t)=>(t=Tn(t),Dt(e,(r,n)=>X(()=>{let o=Pt(),s=0,a,i=!1;return $(function c(){if(i)return Y();if(a===void 0)return I(r,u=>{if(o.length===0&&u.length===t)return g(u);if(o.length+u.length<t){for(let f=0;f<u.length;f++)o.push(u[f]);return c()}return a=u,c()});for(;s<a.length;)if(o.push(a[s++]),o.length===t){let u=o;return o=[],g(u)}return s=0,a=void 0,c()}).pipe(He(()=>{if(o.length===0)return Y();let c=o;return i=!0,o=[],g(c)}))})))),v9=l(2,(e,t)=>bL(e,t,1)),bL=l(3,(e,t,r)=>{let n=Tn(t),o=Tn(r);return Dt(e,(s,a)=>X(()=>{let i=null,c=Ps(),u=!1,f=0,p=zo(s,{onSuccess(d){if(Bx(c,d),f>0){let x=c.length;jx(c,f),f=Math.max(0,f-x)}if(c.length<n)return p;u=!0;let m=[];for(;c.length>=n;)if(n===o)m.push(Vi(c,n));else{m.push(QD(c,n));let x=c.length;jx(c,o),f=Math.max(0,o-x)}return g(m)},onFailure(d){return c.length===0||u&&c.length<=n-o?ze(d):(i=d,g(Ee(Ta(c))))}});return $(()=>i?ze(i):p)}))}),O9=l(2,(e,t)=>sc(e,Pt,(r,n)=>{let o=Pt();for(let s=0;s<n.length;s++)t(n[s])?or(r)&&(o.push(r),r=[]):r.push(n[s]);return[r,o]},{onHalt(r){return or(r)?Ee(r):Fs}})),_9=l(4,(e,t,r,n)=>Qw(gr(e.channel),gr(t.channel),r,n).pipe(yo(Ee),A)),R9=l(4,(e,t,r,n)=>A(Qw(e.channel,t.channel,r,n))),P9=l(e=>Ie(e[0]),(e,t,r,n)=>A(ef(e.channel,t,(o,s)=>{let a=Pt();for(let i=0;i<s.length;i++){let[c,u]=r(o,s[i]);o=c,a.push(...u)}return[o,or(a)?Ee(a):Fs]},n?.onHalt?{onHalt(o){let s=n.onHalt(o);return tt(s)?Ee(s):Fs}}:void 0))),sc=l(e=>Ie(e[0]),(e,t,r,n)=>A(ef(e.channel,t,(o,s)=>{let[a,i]=r(o,s);return o=a,[o,tt(i)?Ee(i):Fs]},n?.onHalt?{onHalt(o){let s=n.onHalt(o);return tt(s)?Ee(s):Fs}}:void 0))),Fs=Pt(),M9=l(e=>Ie(e[0]),(e,t,r,n)=>e.channel.pipe(gr,ef(t,(o,s)=>j(r(o,s),([a,i])=>[a,tt(i)?Ee(i):Pt()]),n?.onHalt?{onHalt(o){let s=n.onHalt(o);return tt(s)?Ee(s):Fs}}:void 0),A)),F9=l(e=>Ie(e[0]),(e,t,r,n)=>e.channel.pipe(ef(t,(o,s)=>j(r(o,s),([a,i])=>[a,tt(i)?Ee(i):Fs]),n?.onHalt?{onHalt(o){let s=n.onHalt(o);return tt(s)?Ee(s):Fs}}:void 0),A)),N9=l(3,(e,t,r)=>Wr(()=>{let n=t();return nc(rc(n),A(ef(e.channel,()=>n,(o,s)=>{let a=Pt();for(let i=0;i<s.length;i++)o=r(o,s[i]),a.push(o);return[o,Ee(a)]})))})),U9=l(3,(e,t,r)=>Wr(()=>e.channel.pipe(gr,V1(t(),r),yo(Ee),A))),D9=l(2,(e,t)=>Dt(e,Se(function*(r,n){let o=yield*Hc,s=Cr(Ge(t)),a,i,c=1/0,u=Pr(),f=Pr(),p=Pr();yield*r.pipe(u.whenOpen,I(m=>(f.openUnsafe(),a=m,c=o.currentTimeMillisUnsafe()+s,Q)),$t({disableYield:!0}),Vn(m=>(i=m,c=o.currentTimeMillisUnsafe(),f.openUnsafe(),p.openUnsafe(),Q)),Ut(n));let d=$(function m(){let x=o.currentTimeMillisUnsafe(),y=c<x?s:Math.min(s,c-x);return I(Xc(ua(y),p.await),()=>{if(o.currentTimeMillisUnsafe()<c)return m();if(a){f.closeUnsafe(),u.closeUnsafe();let w=g(Ee(Bd(a)));return a=void 0,w}else if(i)return ze(i);return m()})});return $(()=>{if(i){if(a){let m=g(Ee(Bd(a)));return a=void 0,m}return ze(i)}return u.openUnsafe(),f.whenOpen(d)})}))),EL=l(2,(e,t)=>{let r=t.burst??0;return t.strategy===\"enforce\"?L9(e,t.cost,t.units,t.duration,r):$9(e,t.cost,t.units,t.duration,r)}),L9=(e,t,r,n,o)=>Dt(e,s=>Si(a=>{let i=Cr(Ge(n)),c=r+o<0?Number.POSITIVE_INFINITY:r+o,u=r,f=a.currentTimeMillisUnsafe();return g(I(s,function p(d){return I(t(d),m=>{let x=a.currentTimeMillisUnsafe(),S=(x-f)/i,w=u+S*r,E=w<0?c:Math.min(w,c);return m<=E?(u=E-m,f=x,g(d)):I(s,p)})}))})),$9=(e,t,r,n,o)=>Dt(e,s=>Si(a=>{let i=Cr(Ge(n)),c=r+o<0?Number.POSITIVE_INFINITY:r+o,u=r,f=a.monotonicTimeNanosUnsafe();return g(I(s,p=>I(t(p),d=>{let m=a.monotonicTimeNanosUnsafe(),y=Number(m-f)/1e6/i,S=u+y*r,E=Math.min(S,c)-d;if(E>=0)return u=E,f=m,g(p);let U=-E/r,_=Math.max(0,U*i);return _>0?I(ua(_),()=>(u=E,f=m,g(p))):(u=E,f=m,g(p))})))})),B9=l(2,(e,t)=>EL(e,{...t,cost:r=>g(t.cost(r))})),j9=l(2,(e,t)=>yL(SL(e,t))),z9=l(3,(e,t,r)=>b0(e,N2(Tn(t)),Nb(r))),q9=l(e=>Ie(e[0]),(e,t,r)=>IL(e,Se(function*(n,o,s){for(let a=0;a<n.length;a++){let[i,c]=yield*t(n[a]),u=Xo(s,i),f=be(u)?u.value:yield*oh(u0(o,i));yield*f0(o,i),yield*Sn(f,c)}}),r)),H9=l(e=>Ie(e[0]),(e,t,r)=>Wr(()=>{let n=Up();return IL(e,Se(function*(o,s,a){for(let i=0;i<o.length;i++){let c=t(o[i]),u=Xo(n,c);fe(u)?Dp(n,c,[o[i]]):u.value.push(o[i])}for(let[i,c]of n){let u=Xo(a,i),f=be(u)?u.value:yield*oh(u0(s,i));yield*f0(s,i),yield*Yi(f,c)}Ux(n)}),r)})),IL=(e,t,r)=>p0(e,Se(function*(n,o,s){let a=yield*o1();yield*Kt(o,Fn(a));let i=Up(),c=yield*L2({lookup:u=>gi(Mn({capacity:r?.bufferSize??4096}).pipe(Rr(f=>(Dp(i,u,f),Sn(a,[u,Kp(f)])))),f=>(Vu(i,u),jw(f))),idleTimeToLive:r?.idleTimeToLive??ls}).pipe(Es(s));return yield*Gn({while:Sr,body:je(I(n,u=>t(u,c,i))),step:$n}).pipe(rt(u=>Bt(a,u)),Ut(o)),Qi(a)})),W9=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o,s,a=Pt(),i=r.pipe(I(u=>{for(let f=0;f<u.length;f++){let p=u[f],d=t(p);if(s===void 0){o=d,s=[p];continue}else if(J(d,o)){s.push(p);continue}a.push([o,s]),o=d,s=[p]}if(or(a)){let f=a;return a=[],g(f)}return i})),c=!1;return He($(()=>c?Y():i),()=>{c=!0;let u=s;return s=void 0,u&&or(u)?g(Ee([o,u])):Y()})}))),J9=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o,s,a=$(()=>{if(s!==void 0){let c=s;return s=void 0,g(c)}return r}).pipe(ca(c=>(o=bs(c),Y()))),i=j($(()=>t.transform(a,n)),([c,u])=>(s=u,Ee(c)));return $(()=>o||i)}))),K9=l(2,(e,t)=>b0(e,t,kl)),b0=l(3,(e,t,r)=>A(go(Se(function*(n,o,s){let a=yield*ts(e.channel,o),i=Pr(!1),c=Symbol(),u=yield*Mn({capacity:0});yield*a.pipe(i.whenOpen,I(h=>(i.closeUnsafe(),Sn(u,h))),$t,rt(h=>Bt(u,h)),Ut(s));let f=yield*Hc,p=yield*di(r),d=Pr(!1),m=f.currentTimeMillisUnsafe(),x=0,y=v(),S,w=h=>(d.openUnsafe()&&(x=f.currentTimeMillisUnsafe()),g(h)),E=d.await.pipe(I(()=>p(m,y)),I(([,h])=>ua(h)),I(()=>Sn(u,c)),He(()=>jw(u)),I(()=>mi)),U=$(()=>{if(S!==void 0){let h=S;return S=void 0,w(h)}return u.state._tag===\"Open\"&&i.openUnsafe(),I(Ms(u),h=>h===c?Y():w(h))}),_=I(([h,b])=>{if(d.isOpen())m+=f.currentTimeMillisUnsafe()-x;else if(u.state._tag===\"Done\")return Y();return y=O(h),S=b,g(Ee(h))});return $(()=>{if(u.state._tag===\"Done\"&&S===void 0)return u.state.exit;d.closeUnsafe();let h=_($(()=>t.transform(U,s)));return u.state._tag===\"Open\"?Xc(h,E):h})})))),G9=l(2,Se(function*(e,t){let r=ot(t.n),n=yield*V9(t),o=new Array(r),s=yield*Or;for(let a=0;a<r;a++){let i=Nt(s),c=yield*Bp(n).pipe(qo(Or,i));o[a]=Vw(Xx(c)).pipe(Hp(u=>Le(i,u)),A)}return yield*ec(e.channel,a=>Qx(n,a)).pipe(un(a=>Yx(n,a)),tu),o})),V9=e=>gi(e.capacity===\"unbounded\"?Zx(e):e.strategy===\"dropping\"?Gx(e):e.strategy===\"sliding\"?Vx(e):Kx(e),$p),TL=l(2,(e,t)=>j(FL(e,t),eL)),Z9=l(2,(e,t)=>j(H2({acquire:TL(e,t),idleTimeToLive:t.idleTimeToLive}),r=>Aa(W2(r)))),Y9=l(2,(e,t)=>A(Xw(e.channel,t))),Q9=l(2,(e,t)=>A(e0(e.channel,t))),X9=l(2,(e,t)=>e.channel.pipe(e0(F2(t)),N1(([r,n])=>n?ug(n):Xu),A)),e7=e=>Sg(PL(e)),t7=e=>sc(e,Pt,(t,r)=>{let n=gy(t,r);return[n,[n]]}),r7=e=>wL(e,J),wL=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o=!0,s;return I(r,function a(i){let c=[],u=0;for(o&&(o=!1,s=i[0],u=1,c.push(s));u<i.length;u++){let f=i[u];t(f,s)||(s=f,c.push(f))}return or(c)?g(c):I(r,a)})}))),n7=l(2,(e,t)=>Dt(e,(r,n)=>X(()=>{let o=!0,s;return I(r,Se(function*a(i){let c=[],u=0;for(o&&(o=!1,s=i[0],u=1,c.push(s));u<i.length;u++){let f=i[u];(yield*t(f,s))||(s=f,c.push(f))}return or(c)?c:yield*I(r,Se(a))}))}))),o7=l(e=>Ie(e[0]),(e,t)=>Wr(()=>{let r=new TextDecoder(t?.encoding);return Jr(e,n=>r.decode(n,{stream:!0}))})),s7=e=>Wr(()=>{let t=new TextEncoder;return Jr(e,r=>t.encode(r))}),a7=e=>e.channel.pipe(Xw(f2()),A),CL=l(2,(e,t)=>rL(e,(r,n)=>{let o=n===0?[]:[t],s=r.length-1;for(let a=0;a<r.length;a++)a===s?o.push(r[a]):o.push(r[a],t);return o})),i7=l(2,(e,t)=>rc(t.start).pipe(nc(CL(e,t.middle)),nc(rc(t.end)))),c7=l(2,(e,t)=>AL(e,t,oc(fA([!0,!1])))),AL=l(3,(e,t,r)=>A(Ce(Se(function*(n,o){let s=yield*he(gr(r.channel))(n,o),a=Symbol(),i=!1,c=!1,u=(yield*he(gr(e.channel))(n,o)).pipe(He(()=>(i=!0,g(a)))),f=(yield*he(gr(t.channel))(n,o)).pipe(He(()=>(c=!0,g(a))));return dr(function*(){for(;;){if(i&&c)return yield*Y();let p=yield*s;if(p&&i||!p&&c)continue;let d=yield*p?u:f;if(d!==a)return Ee(d)}})})))),u7=l(2,(e,t)=>A(t0(e.channel,t))),f7=l(2,(e,t)=>A(m2(e.channel,t))),kL=l(2,(e,t)=>A(Hp(e.channel,t))),l7=l(2,(e,t)=>A(h2(e.channel,t))),vL=l(2,(e,t)=>A(x2(e.channel,t))),OL=l(2,(e,t)=>A(r0(e.channel,r=>t(r[0])))),p7=l(2,(e,t)=>A(g2(e.channel,t))),d7=l(2,(e,t)=>A(y2(e.channel,t))),_L=l(e=>Ie(e[0]),(e,t,r)=>A(S2(e.channel,t,r))),m7=l(2,(e,t)=>A(xg(e.channel,t))),h7=l(3,(e,t,r)=>A(gg(e.channel,t,r))),E0=l(3,(e,t,r)=>A(yg(e.channel,t,r))),RL=l(2,(e,t)=>A(b2(e.channel,t))),x7=l(3,(e,t,r)=>RL(e,n=>Jt(n,t,r(Fe(n,t))))),g7=function(){let e=Ie(arguments[0]),t=e?arguments[1]:arguments[0],r=Gs(e?arguments[2]:arguments[1]);if(e){let n=arguments[0];return A(n0(n.channel,t,r))}return n=>A(n0(n.channel,t,r))},y7=rc({}),S7=l(3,(e,t,r)=>Jr(e,n=>({...n,[t]:r(n)})));var b7=l(e=>Ie(e[0]),(e,t,r,n)=>of(e,o=>Jr(r(o),s=>({...o,[t]:s})),n)),E7=l(e=>Ie(e[0]),(e,t,r,n)=>Vp(e,o=>j(r(o),s=>({...o,[t]:s})),n)),I7=l(2,(e,t)=>Jr(e,r=>({[t]:r}))),T7=l(2,(e,t)=>sh(r=>ts(e.channel,r).pipe(I(n=>t.transform(n,r)),j(([n])=>n)))),PL=e=>tc(e.channel,()=>[],(t,r)=>{for(let n=0;n<r.length;n++)t.push(r[n]);return t}),w7=e=>tc(e.channel,()=>0,(t,r)=>t+r.length),C7=e=>tc(e.channel,()=>0,(t,r)=>{for(let n=0;n<r.length;n++)t+=r[n];return t}),A7=l(3,(e,t,r)=>tc(e.channel,t,(n,o)=>{for(let s=0;s<o.length;s++)n=r(n,o[s]);return n})),k7=l(3,(e,t,r)=>C2(e.channel,t,(n,o)=>{let s=0,a=n;return j(Gn({while:()=>s<o.length,body:()=>r(a,o[s]),step(i){a=i,s++}}),()=>a)})),v7=e=>j(T2(e.channel),Rt(yA(0))),O7=e=>j(w2(e.channel),Rt(Bd)),_7=l(2,(e,t)=>ec(e.channel,r=>{let n=0;return Gn({while:()=>n<r.length,body:()=>t(r[n++]),step:$n})})),R7=l(2,(e,t)=>I2(e.channel,r=>{let n=!1,o=0;return j(Gn({while:()=>!n&&o<r.length,body:()=>t(r[o]),step(s){o++,s||(n=!0)}}),()=>!n)})),ML=l(2,(e,t)=>ec(e.channel,t)),Ig=e=>E2(e.channel),P7=e=>s0(e.channel),M7=e=>tc(e.channel,()=>\"\",(t,r)=>t+r.join(\"\")),F7=e=>j(o0(e.channel),t=>t.buffer),N7=e=>o0(e.channel),I0=l(e=>Ie(e[0]),(e,t,r)=>{let n,o,s=Pr(!1);return new ReadableStream({start(a){o=Nl(On(ML(e,i=>s.whenOpen(X(()=>{s.closeUnsafe();for(let c=0;c<i.length;c++)a.enqueue(i[c]);n(),n=void 0}))),t)),o.addObserver(i=>{i._tag===\"Failure\"?a.error(Pm(i.cause)):a.close()})},pull(){return new Promise(a=>{n=a,s.openUnsafe()})},cancel(){if(o)return tE(ia(mo(o)))}},r?.strategy)}),U7=l(e=>Ie(e[0]),(e,t)=>I0(e,Ir(),t)),D7=l(e=>Ie(e[0]),(e,t)=>j(hi(),r=>I0(e,r,t))),T0=l(2,(e,t)=>({[Symbol.asyncIterator](){let r=rE(t),n=Rn(t),o=kn(),s,a,i,c,u=p=>{if(c)return c;let d=i;return c=r(Tt(_r(d?mo(d):Q,Le(o,p)),{done:!0,value:void 0})),c},f=async p=>{try{await u(p)}catch(d){await r(nE(\"Suppressed error while closing Stream async iterator\",d))}};return{async next(){if(c)return c;if(a){let m=a.next();if(!m.done)return m;a=void 0}let p=n(s??I(ts(e.channel,o),m=>(s=m,m)));i=p;let d=await r(JD(p));if(i===p&&(i=void 0),Ve(d))return a=d.value[Symbol.iterator](),a.next();if(Bo(d.cause))return u(xt);if(c&&ob(d.cause))return c;throw await f(d),Pm(d.cause)},return(){return u(xt)},async throw(p){throw await f(lb(p)),p}}}})),L7=e=>j(hi(),t=>T0(e,t)),$7=e=>T0(e,Ir()),B7=l(e=>Ie(e[0]),(e,t,r)=>i0(e.channel,t,r)),j7=l(2,(e,t)=>v2(e.channel,t)),FL=l(2,(e,t)=>O2(e.channel,t)),z7=l(2,(e,t)=>A2(e.channel,t)),q7=l(2,(e,t)=>a0(e.channel,t));var w0=lr(\"effect/FileSystem\");var UL=\"~effect/Path\",A0=lr(\"effect/Path\");function DL(e,t){let r=\"\",n=0,o=-1,s=0,a;for(let i=0;i<=e.length;++i){if(i<e.length)a=e.charCodeAt(i);else{if(a===47)break;a=47}if(a===47){if(!(o===i-1||s===1))if(o!==i-1&&s===2){if(r.length<2||n!==2||r.charCodeAt(r.length-1)!==46||r.charCodeAt(r.length-2)!==46){if(r.length>2){let c=r.lastIndexOf(\"/\");if(c!==r.length-1){c===-1?(r=\"\",n=0):(r=r.slice(0,c),n=r.length-1-r.lastIndexOf(\"/\")),o=i,s=0;continue}}else if(r.length===2||r.length===1){r=\"\",n=0,o=i,s=0;continue}}t&&(r.length>0?r+=\"/..\":r=\"..\",n=2)}else r.length>0?r+=\"/\"+e.slice(o+1,i):r=e.slice(o+1,i),n=i-o-1;o=i,s=0}else a===46&&s!==-1?++s:s=-1}return r}function H7(e,t){let r=t.dir||t.root,n=t.base||(t.name||\"\")+(t.ext||\"\");return r?r===t.root?r+n:r+e+n:n}function W7(e){if(e.protocol!==\"file:\")return P(new rf({module:\"Path\",method:\"fromFileUrl\",description:\"URL must be of scheme file\"}));if(e.hostname!==\"\")return P(new rf({module:\"Path\",method:\"fromFileUrl\",description:\"Invalid file URL host\"}));let t=e.pathname;for(let r=0;r<t.length;r++)if(t[r]===\"%\"){let n=t.codePointAt(r+2)|32;if(t[r+1]===\"2\"&&n===102)return P(new rf({module:\"Path\",method:\"fromFileUrl\",description:\"must not include encoded / characters\"}))}return g(decodeURIComponent(t))}var LL=function(){let t=\"\",r=!1,n;for(let o=arguments.length-1;o>=-1&&!r;o--){let s;if(o>=0)s=arguments[o];else{let a=globalThis.process;n===void 0&&\"process\"in globalThis&&typeof a==\"object\"&&a!==null&&typeof a.cwd==\"function\"&&(n=a.cwd()),s=n}s.length!==0&&(t=s+\"/\"+t,r=s.charCodeAt(0)===47)}return t=DL(t,!r),r?t.length>0?\"/\"+t:\"/\":t.length>0?t:\".\"},J7=47;function K7(e){let t=new URL(\"file://\"),r=LL(e);return e.charCodeAt(e.length-1)===J7&&r[r.length-1]!==\"/\"&&(r+=\"/\"),t.pathname=X7(r),g(t)}var G7=/%/g,V7=/\\\\/g,Z7=/\\n/g,Y7=/\\r/g,Q7=/\\t/g;function X7(e){return e.includes(\"%\")&&(e=e.replace(G7,\"%25\")),e.includes(\"\\\\\")&&(e=e.replace(V7,\"%5C\")),e.includes(`\n`)&&(e=e.replace(Z7,\"%0A\")),e.includes(\"\\r\")&&(e=e.replace(Y7,\"%0D\")),e.includes(\"\t\")&&(e=e.replace(Q7,\"%09\")),e}var C0=A0.of({[UL]:UL,resolve:LL,normalize(e){if(e.length===0)return\".\";let t=e.charCodeAt(0)===47,r=e.charCodeAt(e.length-1)===47;return e=DL(e,!t),e.length===0&&!t&&(e=\".\"),e.length>0&&r&&(e+=\"/\"),t?\"/\"+e:e},isAbsolute(e){return e.length>0&&e.charCodeAt(0)===47},join(){if(arguments.length===0)return\".\";let e;for(let t=0;t<arguments.length;++t){let r=arguments[t];r.length>0&&(e===void 0?e=r:e+=\"/\"+r)}return e===void 0?\".\":C0.normalize(e)},relative(e,t){if(e===t||(e=C0.resolve(e),t=C0.resolve(t),e===t))return\"\";let r=1;for(;r<e.length&&e.charCodeAt(r)===47;++r);let n=e.length,o=n-r,s=1;for(;s<t.length&&t.charCodeAt(s)===47;++s);let i=t.length-s,c=o<i?o:i,u=-1,f=0;for(;f<=c;++f){if(f===c){if(i>c){if(t.charCodeAt(s+f)===47)return t.slice(s+f+1);if(f===0)return t.slice(s+f)}else o>c&&(e.charCodeAt(r+f)===47?u=f:f===0&&(u=0));break}let d=e.charCodeAt(r+f),m=t.charCodeAt(s+f);if(d!==m)break;d===47&&(u=f)}let p=\"\";for(f=r+u+1;f<=n;++f)(f===n||e.charCodeAt(f)===47)&&(p.length===0?p+=\"..\":p+=\"/..\");return p.length>0?p+t.slice(s+u):(s+=u,t.charCodeAt(s)===47&&++s,t.slice(s))},dirname(e){if(e.length===0)return\".\";let t=e.charCodeAt(0),r=t===47,n=-1,o=!0;for(let s=e.length-1;s>=1;--s)if(t=e.charCodeAt(s),t===47){if(!o){n=s;break}}else o=!1;return n===-1?r?\"/\":\".\":r&&n===1?\"//\":e.slice(0,n)},basename(e,t){let r=0,n=-1,o=!0,s;if(t!==void 0&&t.length>0&&t.length<=e.length){if(t.length===e.length&&t===e)return\"\";let a=t.length-1,i=-1;for(s=e.length-1;s>=0;--s){let c=e.charCodeAt(s);if(c===47){if(!o){r=s+1;break}}else i===-1&&(o=!1,i=s+1),a>=0&&(c===t.charCodeAt(a)?--a===-1&&(n=s):(a=-1,n=i))}return r===n?n=i:n===-1&&(n=e.length),e.slice(r,n)}else{for(s=e.length-1;s>=0;--s)if(e.charCodeAt(s)===47){if(!o){r=s+1;break}}else n===-1&&(o=!1,n=s+1);return n===-1?\"\":e.slice(r,n)}},extname(e){let t=-1,r=0,n=-1,o=!0,s=0;for(let a=e.length-1;a>=0;--a){let i=e.charCodeAt(a);if(i===47){if(!o){r=a+1;break}continue}n===-1&&(o=!1,n=a+1),i===46?t===-1?t=a:s!==1&&(s=1):t!==-1&&(s=-1)}return t===-1||n===-1||s===0||s===1&&t===n-1&&t===r+1?\"\":e.slice(t,n)},format:function(t){if(t===null||typeof t!=\"object\")throw new TypeError('The \"pathObject\" argument must be of type Object. Received type '+typeof t);return H7(\"/\",t)},parse(e){let t={root:\"\",dir:\"\",base:\"\",ext:\"\",name:\"\"};if(e.length===0)return t;let r=e.charCodeAt(0),n=r===47,o;n?(t.root=\"/\",o=1):o=0;let s=-1,a=0,i=-1,c=!0,u=e.length-1,f=0;for(;u>=o;--u){if(r=e.charCodeAt(u),r===47){if(!c){a=u+1;break}continue}i===-1&&(c=!1,i=u+1),r===46?s===-1?s=u:f!==1&&(f=1):s!==-1&&(f=-1)}return s===-1||i===-1||f===0||f===1&&s===i-1&&s===a+1?i!==-1&&(a===0&&n?t.base=t.name=e.slice(1,i):t.base=t.name=e.slice(a,i)):(a===0&&n?(t.name=e.slice(1,s),t.base=e.slice(1,i)):(t.name=e.slice(a,s),t.base=e.slice(a,i)),t.ext=e.slice(s,i)),a>0?t.dir=e.slice(0,a-1):n&&(t.dir=\"/\"),t},sep:\"/\",fromFileUrl:W7,toFileUrl:K7,toNamespacedPath:R});function Yp(e){return{_tag:\"Value\",value:e}}function wg(e,t){return{_tag:\"Record\",keys:e,value:t}}function O0(e,t){return{_tag:\"Array\",length:e,value:t}}var Tg=class extends Fr(\"SourceError\"){},ac=we(\"effect/ConfigProvider\",{defaultValue:()=>WL()}),eX={...rr,toJSON(){return{_id:\"ConfigProvider\"}}},tX=e=>e;function BL(e,t){let r=Object.create(eX);return r.load=e,r.mapInput=t,r}function jL(e,t){return BL(r=>e(t(r)),r=>jL(e,n=>r(t(n))))}function zL(e,t){return BL(r=>I(e.load(r),n=>n!==void 0?g(n):t.load(r)),r=>zL(e.mapInput(r),t.mapInput(r)))}function Cg(e){return jL(e,tX)}var v0=l(2,(e,t)=>zL(e,t)),_0=l(2,(e,t)=>e.mapInput(t)),rX=_0(e=>e.map(t=>typeof t==\"number\"?t:A_(t))),nX=l(2,(e,t)=>{let r=typeof t==\"string\"?[t]:t;return _0(e,n=>[...r,...n])}),oX=e=>jo(e)?yb(ac)(e):n_(ac)(e),sX=(e,t)=>yb(ac)(dr(function*(){let r=yield*ac,n=jo(e)?yield*e:e;return t?.asPrimary?v0(n,r):v0(r,n)}));function aX(e,t){let r=t?.preserveEmptyStrings===!0;return Cg(n=>g(iX(e,n,r)))}function iX(e,t,r){let n=e;for(let o of t){if(n==null)return;if(Array.isArray(n)){if(typeof o!=\"number\"||!Number.isInteger(o)||o<0||o>=n.length)return;n=n[o];continue}if(fr(n)){if(typeof o!=\"string\"||!Object.hasOwn(n,o))return;n=n[o];continue}return}return cX(n,r)}function cX(e,t){if(e!=null)return typeof e==\"string\"?qL(e,t):typeof e==\"number\"||typeof e==\"boolean\"||typeof e==\"bigint\"?Yp(String(e)):Array.isArray(e)?O0(e.length):fr(e)?wg(new Set(Object.keys(e))):Yp(F(e))}function qL(e,t){let r=HL(e,t);return r===void 0?void 0:Yp(r)}function HL(e,t){return e===\"\"&&!t?void 0:e}function R0(e,t){let r=t?.preserveEmptyStrings===!0,n=uX(e);return Cg(o=>g(fX(n,e,o,r)))}function WL(e){let t=e?.env??{...globalThis.process?.env,...import.meta?.env};return R0(t,{preserveEmptyStrings:e?.preserveEmptyStrings})}function uX(e){let t={};for(let[r,n]of Object.entries(e)){if(n===void 0)continue;let o=r.split(\"_\"),s=t;for(let a of o){let i=s.children??=Object.create(null);s=i[a]??={}}}return t}function fX(e,t,r,n){let o=r.map(String).join(\"_\"),s=HL(Object.hasOwn(t,o)?t[o]:void 0,n),a=lX(e,r),i=a?.children?Object.keys(a.children):[];if(i.length===0)return s===void 0?void 0:Yp(s);if(i.every(Cc)){let u=Math.max(...i.map(f=>parseInt(f,10)))+1;return O0(u,s)}return wg(new Set(i),s)}function lX(e,t){if(t.length===0)return e;let r=e;for(let n of t)if(r=r?.children?.[String(n)],!r)return;return r}function JL(e,t){let r=dX(e);return t?.expandVariables&&(r=mX(r)),R0(r,{preserveEmptyStrings:t?.preserveEmptyStrings})}var pX=/(?:^|^)\\s*(?:export\\s+)?([\\w.-]+)(?:\\s*=\\s*?|:\\s+?)(\\s*'(?:\\\\'|[^'])*'|\\s*\"(?:\\\\\"|[^\"])*\"|\\s*`(?:\\\\`|[^`])*`|[^#\\r\\n]+)?\\s*(?:#.*)?(?:$|$)/mg;function dX(e){let t=Object.create(null);e=e.replace(/\\r\\n?/gm,`\n`);let r;for(;(r=pX.exec(e))!=null;){let n=r[1],o=r[2]||\"\";o=o.trim();let s=o[0];o=o.replace(/^(['\"`])([\\s\\S]*)\\1$/gm,\"$2\"),s==='\"'&&(o=o.replace(/\\\\n/g,`\n`),o=o.replace(/\\\\r/g,\"\\r\")),t[n]=o}return t}function mX(e){let t=Object.create(null);for(let r of Object.keys(e))t[r]=KL(e[r],e).replace(/\\\\\\$/g,\"$\");return t}function KL(e,t){let r=hX(e,/(?!(?<=\\\\))\\$/g);if(r===-1)return e;let n=e.slice(r),o=/((?!(?<=\\\\))\\${?([\\w]+)(?::-([^}\\\\]*))?}?)/,s=n.match(o);if(s!==null){let[a,i,c,u]=s,f=Object.hasOwn(t,c)&&t[c]!==\"\"?t[c]:u??\"\";return KL(e.replace(i,()=>f),t)}return e}function hX(e,t){let r=Array.from(e.matchAll(t));return r.length>0?r.slice(-1)[0].index:-1}var xX=Se(function*(e){let r=yield*(yield*w0).readFileString(e?.path??\".env\");return JL(r,e)}),gX=Se(function*(e){let t=yield*A0,r=yield*w0,n=e?.rootPath??\"/\",o=e?.preserveEmptyStrings===!0;return Cg(s=>{let a=t.join(n,...s.map(String)),i=r.readFileString(a).pipe(j(u=>qL(u.trim(),o))),c=r.readDirectory(a).pipe(j(u=>wg(new Set(u.map(f=>t.basename(f))))));return i.pipe(ca(u=>c.pipe(ca(f=>k0(u)&&k0(f)?g(void 0):P(k0(u)?f:u)))),th(u=>new Tg({message:`Failed to read file at ${t.join(n,...s.map(String))}`,cause:u})))})}),k0=e=>e.reason._tag===\"NotFound\";var GL=[\"All\",\"Fatal\",\"Error\",\"Warn\",\"Info\",\"Debug\",\"Trace\",\"None\"];var M0=\"~effect/Config\",YL=e=>k(e,M0),af=class{_tag=\"ConfigError\";name=\"ConfigError\";cause;constructor(t){this.cause=t}get message(){return this.cause.toString()}toString(){return`ConfigError(${this.message})`}},yX={...yd({label:\"Config\",evaluate(e){return this.parse(e.getRef(ac))}}),[M0]:M0,toJSON(){return{_id:\"Config\"}}};function os(e){let t=Object.create(yX);return t.evaluator=e,t.parse=r=>st(e(r,[]),Pl),t}var So=(e,t,r)=>e.evaluator(t,r),QL=l(2,(e,t)=>os((r,n)=>j(So(e,r,n),Tr(t)))),SX=l(2,(e,t)=>os((r,n)=>I(So(e,r,n),wr({onSuccess:o=>So(t(o),r,n),onFailure:o=>g(W(o))})))),bX=l(2,(e,t)=>os((r,n)=>I(So(e,r,n),o=>mt(o)?Dr(t(o.success),B):g(W(o.failure))))),EX=l(2,(e,t)=>os((r,n)=>zo(So(e,r,n),{onFailure:o=>{let s=ib(o);return be(s)&&o.reasons.every(na)?So(t(s.value),r,n):ze(o)},onSuccess:o=>ce(o)?So(t(o.failure),r,n):g(o)})));function XL(e){let t=globalThis.Array.isArray(e)?e:Symbol.iterator in e?[...e]:e;return os((r,n)=>globalThis.Array.isArray(t)?Dr(Ym(t.map(o=>So(o,r,n))),hy):Dr(Ym(Ya(t,o=>So(o,r,n))),hy))}var e$=l(2,(e,t)=>os((r,n)=>Dr(So(e,r,n),o=>ce(o)?B(t):o))),IX=e=>e.pipe(QL(O),e$(v())),t$=e=>YL(e)?e:XL(Ya(e,t=>t$(t))),TX=e=>At(e,\"SourceError\"),wX=()=>\"<configuration>\",r$=e=>t=>rt(t,r=>ze(oa(r.reasons.map(e)))),n$=(e,t)=>e.load(t).pipe(r$(r=>na(r)?zc(r.error).annotate(Mm(r)):r),Dr(r=>({provider:e,path:t,node:r,toString:wX}))),ZL=(e,t)=>n$(e.provider,[...e.path,t]),P0=(e,t)=>ga(eo,e,new ve(gt(r=>t(r)),jr())),o$=e=>{switch(e._tag){case\"Union\":return e.types.every(o$);case\"Objects\":case\"Arrays\":case\"Suspend\":return!1;default:return!0}},F0=(e,t)=>{switch(e._tag){case\"Objects\":return t?._tag===\"Record\";case\"Arrays\":return t?._tag===\"Array\";case\"Union\":return e.types.some(r=>F0(r,t));case\"Suspend\":return F0(e.thunk(),t);default:return t?.value!==void 0}},CX=Vr(e=>{let t=new WeakSet,r=oF(n=>{switch(t.add(n),n._tag){case\"Objects\":{let o=n.indexSignatures.map(a=>Ui(a.parameter)),s=Se(function*(a){if(a.node?._tag!==\"Record\")return;let i=a.node,c=new Set;for(let f of n.propertySignatures)typeof f.name==\"string\"&&c.add(f.name);if(o.length>0)for(let f of i.keys)o.some(p=>p(f))&&c.add(f);let u={};for(let f of c){let p=yield*ZL(a,f);p.node!==void 0&&M(u,f,p)}return u});return P0(n.recur(r,a=>a),s)}case\"Arrays\":{let o=Se(function*(s){if(s.node?._tag!==\"Array\")return;let a=[];for(let i=0;i<s.node.length;i++)a.push(yield*ZL(s,i));return a});return P0(n.recur(r),o)}case\"Union\":for(let o of n.types)r(o);if(!o$(n))return n.recur(r);break;case\"Suspend\":{let o=n.thunk();return t.has(o)||r(o),n.recur(r)}case\"Declaration\":case\"Any\":throw new globalThis.Error(\"Config.schema does not support opaque StringTree encodings\",{cause:n})}return P0(n,o=>g(o.node?.value))});return r(e)});function tr(e,t){let r=Np(e),n=hn(r.ast),o=nt(q(CX(r.ast))),s=typeof t==\"string\"?[t]:t??[];return os((a,i)=>{let c=[...i,...s];return n$(a,c).pipe(st(u=>o(u).pipe(Dr(B),ru(f=>{let p=new af(new Os(c.length>0?new ut(c,f):f));return F0(n,u.node)?P(p):g(W(p))}))),r$(u=>rb(u)&&TX(u.defect)?jc(new af(u.defect)).annotate(Mm(u)):u))})}var AX=lo.check(Hu({minimum:1,maximum:65535})),kX=fo(GL),s$=e=>br(e)||globalThis.Array.isArray(e);function vX(e){return os(()=>P(new af(e)))}function OX(e){return os(()=>g(B(e)))}function _X(e){return tr(K,e)}function RX(e){return tr(fw,e)}function PX(e){return tr(Wi,e)}function MX(e){return tr(qu,e)}function FX(e){return tr(lo,e)}function NX(e,t){return tr(Ct(e),t)}function UX(e,t){return tr(fo(e),t)}function DX(e,t,r){let n=s$(t),o=n?r:t,s=$e(e),a=o?.separator??\",\",i=K.pipe(G(Np(s),{decode:zP(o),encode:Ch(jr({strict:!1}),oe(c=>c.join(a)))}));return tr(it([i,s]),n?t:void 0)}function LX(e,t,r,n){let o=s$(r),s=_s(e,t),a=oM(o?n:r),i=K.pipe(G(Np(s),{decode:a.decode,encode:Ch(jr({strict:!1}),a.encode)}));return tr(it([s,i]),o?r:void 0)}function $X(e){return tr(nw,e)}function BX(e){return tr(hw,e)}function jX(e){return tr(Ju,e)}function zX(e){return tr(AX,e)}function qX(e){return tr(kX,e)}function HX(e){return tr(Fx(K),e)}function WX(e){return tr(Ox,e)}function JX(e){return tr(Wu,e)}var KX=l(2,(e,t)=>os((r,n)=>So(e,r,[...n,t])));var ic={};Eo(ic,{Console:()=>a$,assert:()=>GX,clear:()=>VX,consoleWith:()=>jt,count:()=>ZX,countReset:()=>YX,debug:()=>QX,dir:()=>XX,dirxml:()=>eee,error:()=>tee,group:()=>ree,info:()=>nee,log:()=>oee,table:()=>see,time:()=>aee,timeLog:()=>iee,trace:()=>cee,warn:()=>uee,withGroup:()=>fee,withTime:()=>lee});var a$=VS,jt=e=>re(t=>e(t.getRef(a$))),GX=(e,...t)=>jt(r=>z(()=>{r.assert(e,...t)})),VX=jt(e=>z(()=>{e.clear()})),ZX=e=>jt(t=>z(()=>{t.count(e)})),YX=e=>jt(t=>z(()=>{t.countReset(e)})),QX=(...e)=>jt(t=>z(()=>{t.debug(...e)})),XX=(e,t)=>jt(r=>z(()=>{r.dir(e,t)})),eee=(...e)=>jt(t=>z(()=>{t.dirxml(...e)})),tee=(...e)=>jt(t=>z(()=>{t.error(...e)})),ree=e=>jt(t=>ai(z(()=>{e?.collapsed?t.groupCollapsed(e.label):t.group(e?.label)}),()=>z(()=>{t.groupEnd()}))),nee=(...e)=>jt(t=>z(()=>{t.info(...e)})),oee=(...e)=>jt(t=>z(()=>{t.log(...e)})),see=(e,t)=>jt(r=>z(()=>{r.table(e,t)})),aee=e=>jt(t=>ai(z(()=>{t.time(e)}),()=>z(()=>{t.timeEnd(e)}))),iee=(e,...t)=>jt(r=>z(()=>{r.timeLog(e,...t)})),cee=(...e)=>jt(t=>z(()=>{t.trace(...e)})),uee=(...e)=>jt(t=>z(()=>{t.warn(...e)})),fee=l(e=>ie(e[0]),(e,t)=>jt(r=>ul(z(()=>{t?.collapsed?r.groupCollapsed(t.label):r.group(t?.label)}),()=>e,()=>z(()=>{r.groupEnd()})))),lee=l(e=>ie(e[0]),(e,t)=>jt(r=>ul(z(()=>{r.time(t)}),()=>e,()=>z(()=>{r.timeEnd(t)}))));var Kr={OK:200,Unauthorized:401,NotFound:404,InternalServerError:500,ServiceUnavailable:503},N0={[Kr.OK]:\"OK\",[Kr.Unauthorized]:\"Unauthorized\",[Kr.NotFound]:\"Not Found\",[Kr.InternalServerError]:\"Internal Server Error\",[Kr.ServiceUnavailable]:\"Service Unavailable\"},pee=e=>{let t=e.startsWith(\"/\"),r=[];for(let o of e.split(\"/\"))if(!(o===\"\"||o===\".\")){if(o===\"..\"){r.length>0&&r.at(-1)!==\"..\"?r.pop():t||r.push(\"..\");continue}r.push(o)}let n=r.join(\"/\");return t?`/${n}`:n||\".\"},ka=(...e)=>pee(e.filter(Boolean).join(\"/\")),cf=e=>{if(e.length===0)return\".\";let t=e.length;for(;t>1&&e[t-1]===\"/\";)t-=1;let r=e.slice(0,t),n=r.lastIndexOf(\"/\");return n<0?\".\":n===0?\"/\":r.slice(0,n)},i$=e=>{if(!e.startsWith(\"/\"))throw new TypeError(\"Path must be absolute\");let t=new URL(\"file:///\");return t.pathname=e.replace(/%/g,\"%25\").replace(/\\\\/g,\"%5C\"),t};var dee=/^[A-Za-z0-9_-]+$/u,c$=/[*?[{]/u,Ag=(e,t)=>t===e||t.startsWith(`${e.replace(/\\/+$/u,\"\")}/`),uf=class extends Cn.TaggedError(\"FunctionFileSystemError\"){},Dn=(e,t)=>e.lstat(t).pipe(N.catch(()=>N.undefined)),cc=(e,t,r)=>N.all([e.realPath(t),e.realPath(r)],{concurrency:2}).pipe(N.map(([n,o])=>Ag(n,o)),N.orElseSucceed(()=>!1)),u$=(e,t,r)=>N.gen(function*(){let n=yield*Dn(e,r);if(n===void 0)return!0;if(n.isSymbolicLink||!(yield*cc(e,t,r)))return!1;if(!n.isDirectory)return!0;let o=yield*e.readDirectory(r).pipe(N.catch(()=>N.undefined));if(o===void 0)return!1;for(let s of o)if(!(yield*u$(e,t,ka(r,s))))return!1;return!0}),Qp=(e,t)=>t.length===0?\"\":t.startsWith(\"/\")?t:ka(e,t),U0=[\"deno.json\",\"deno.jsonc\"],f$=e=>U0.includes(e.slice(e.lastIndexOf(\"/\")+1)),mee=(e,t,r)=>N.gen(function*(){let n=cf(ka(r));for(;Ag(t,n);){for(let s of U0){let a=ka(n,s),i=yield*Dn(e,a);if(i!==void 0)return i.isFile&&!i.isSymbolicLink?a:void 0}let o=cf(n);if(o===n)break;n=o}}),hee=(e,t,r)=>N.all([e.realPath(t),e.realPath(r)],{concurrency:2}).pipe(N.map(([n,o])=>n===o),N.orElseSucceed(()=>!1)),l$=N.fn(\"Functions.resolveFunctionConfig\")(function*(e){let{root:t,slug:r,overrides:n,fs:o}=e;if(!t.startsWith(\"/\")||!dee.test(r)||r===\"_shared\"||(yield*Dn(o,t))===void 0)return;let a=yield*o.realPath(t).pipe(N.orElseSucceed(()=>\"\"));if(!a.startsWith(\"/\"))return;let i=yield*Dn(o,a);if(i===void 0||!i.isDirectory)return;let c=e.filesRoot===void 0?a:yield*o.realPath(e.filesRoot).pipe(N.orElseSucceed(()=>\"\"));if(!c.startsWith(\"/\")||!Ag(c,a))return;let u=n.$default,f=n[r],p={...u,...f};if(p.enabled===!1)return;let d=ka(a,r),m=p?.entrypointPath&&p.entrypointPath.length>0?p.entrypointPath:p.entrypoint&&p.entrypoint.length>0?p.entrypoint:\"index.ts\";if(!m.startsWith(\"/\")){let b=yield*Dn(o,d);if(b===void 0||!b.isDirectory||!(yield*cc(o,a,d)))return}let x=Qp(d,m);if(!(yield*cc(o,c,x)))return;let y=yield*Dn(o,x);if(y===void 0||!y.isFile||y.isSymbolicLink)return;let S=f?.importMapPath??f?.import_map,w=u?.importMapRoot??u?.import_map_root,E=S!==void 0?Qp(d,S):w!==void 0?Qp(a,w):Qp(d,\"\");if(E.length>0){if(!(yield*cc(o,c,E)))return;let b=yield*Dn(o,E);if(b===void 0||!b.isFile||b.isSymbolicLink)return}else for(let b of U0){let T=ka(d,b),C=yield*Dn(o,T);if(C!==void 0){if(!C.isFile||C.isSymbolicLink||!(yield*cc(o,c,T)))return;E=T;break}}let U=E.length===0?void 0:yield*mee(o,c,x),_=U!==void 0&&(yield*hee(o,U,E)),h=(p.staticFiles??p.static_files??[]).map(b=>Qp(d,b));for(let b of h){if(!Ag(c,b))return;let T=b.search(c$),C=T<0?b:b.slice(0,T),L=T<0?cf(b):C.slice(0,Math.max(0,C.lastIndexOf(\"/\")))||a;if(!(yield*u$(o,c,L)))return;if(!c$.test(b)){let ee=yield*Dn(o,b);if(ee!==void 0&&(!(yield*cc(o,c,b))||ee.isSymbolicLink))return}}return{entrypointPath:x,importMapPath:E,importMapDiscoveredByRuntime:_,staticFiles:h,verifyJWT:p.verifyJWT??p.verify_jwt??!0,env:p.env}}),xee=e=>ka(cf(e.entrypointPath),\"package.json\"),p$=e=>{let t=new Map,r=new Map;return(n,o)=>{let s=r.get(n);if(s!==void 0)return s;let a=cf(o.entrypointPath),i=t.get(a),c=i===void 0||i===n?a:e();return i===void 0&&t.set(a,n),r.set(n,c),c}},d$=N.fn(\"Functions.packageJsonContainedFor\")(function*(e){if(!e.root.startsWith(\"/\"))return!1;let t=yield*Dn(e.fs,e.root);if(t===void 0||!t.isDirectory&&!t.isSymbolicLink)return!1;let r=yield*e.fs.realPath(e.root).pipe(N.orElseSucceed(()=>\"\"));if(!r.startsWith(\"/\"))return!1;let n=yield*Dn(e.fs,r);if(n===void 0||!n.isDirectory)return!1;let o=xee(e.config),s=yield*Dn(e.fs,o);return s===void 0||!s.isFile||s.isSymbolicLink?!1:yield*cc(e.fs,r,o)});var D0=new TextEncoder,Xp=new TextDecoder,kg=new TextDecoder(\"utf-8\",{fatal:!0}),efe=2**32;function m$(...e){let t=e.reduce((o,{length:s})=>o+s,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function ff(e){let t=new Uint8Array(e.length);for(let r=0;r<e.length;r++){let n=e.charCodeAt(r);if(n>127)throw new TypeError(\"non-ASCII string encountered in encode()\");t[r]=n}return t}var vg=(e,t=\"algorithm.name\")=>new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function gee(e,t){if(t&&!e.usages.includes(t))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function h$(e,t){let{modulusLength:r}=t.algorithm;if(typeof r!=\"number\"||r<2048)throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function x$(e,t,r){let n=e.algorithm;if(n.name!==t.name)throw vg(t.name);if(t.hash&&n.hash?.name!==t.hash)throw vg(t.hash,\"algorithm.hash\");if(t.namedCurve&&n.namedCurve!==t.namedCurve)throw vg(t.namedCurve,\"algorithm.namedCurve\");if(t.length!==void 0&&n.length!==t.length)throw vg(t.length,\"algorithm.length\");gee(e,r)}function yee(e,t,...r){if(r.length>2){let n=r.pop();e+=`one of type ${r.join(\", \")}, or ${n}.`}else r.length===2?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return t==null?e+=` Received ${t}`:typeof t==\"function\"&&t.name?e+=` Received function ${t.name}`:typeof t==\"object\"&&t!=null&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var ed=(e,t,...r)=>yee(`Key for the ${e} algorithm must be `,t,...r);var yr=class extends Error{static code=\"ERR_JOSE_GENERIC\";code=\"ERR_JOSE_GENERIC\";constructor(t,r){super(t,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},Us=class extends yr{static code=\"ERR_JWT_CLAIM_VALIDATION_FAILED\";code=\"ERR_JWT_CLAIM_VALIDATION_FAILED\";claim;reason;payload;constructor(t,r,n=\"unspecified\",o=\"unspecified\"){super(t,{cause:{claim:n,reason:o,payload:r}}),this.claim=n,this.reason=o,this.payload=r}},td=class extends yr{static code=\"ERR_JWT_EXPIRED\";code=\"ERR_JWT_EXPIRED\";claim;reason;payload;constructor(t,r,n=\"unspecified\",o=\"unspecified\"){super(t,{cause:{claim:n,reason:o,payload:r}}),this.claim=n,this.reason=o,this.payload=r}},Og=class extends yr{static code=\"ERR_JOSE_ALG_NOT_ALLOWED\";code=\"ERR_JOSE_ALG_NOT_ALLOWED\"},bo=class extends yr{static code=\"ERR_JOSE_NOT_SUPPORTED\";code=\"ERR_JOSE_NOT_SUPPORTED\"};var Gr=class extends yr{static code=\"ERR_JWS_INVALID\";code=\"ERR_JWS_INVALID\"},lf=class extends yr{static code=\"ERR_JWT_INVALID\";code=\"ERR_JWT_INVALID\"};var rd=class extends yr{static code=\"ERR_JWKS_INVALID\";code=\"ERR_JWKS_INVALID\"},pf=class extends yr{static code=\"ERR_JWKS_NO_MATCHING_KEY\";code=\"ERR_JWKS_NO_MATCHING_KEY\";constructor(t=\"no applicable key found in the JSON Web Key Set\",r){super(t,r)}},_g=class extends yr{[Symbol.asyncIterator]=async function*(){};static code=\"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";code=\"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";constructor(t=\"multiple matching keys found in the JSON Web Key Set\",r){super(t,r)}},Rg=class extends yr{static code=\"ERR_JWKS_TIMEOUT\";code=\"ERR_JWKS_TIMEOUT\";constructor(t=\"request timed out\",r){super(t,r)}},Pg=class extends yr{static code=\"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";code=\"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";constructor(t=\"signature verification failed\",r){super(t,r)}};var L0=e=>{if(e?.[Symbol.toStringTag]===\"CryptoKey\")return!0;try{return e instanceof CryptoKey}catch{return!1}},See=e=>e?.[Symbol.toStringTag]===\"KeyObject\",g$=e=>L0(e)||See(e);function y$(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}var $0=\"The input to be decoded is not correctly encoded.\";function nd(e){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof e==\"string\"?e:Xp.decode(e),{alphabet:\"base64url\"})}catch(r){throw new TypeError($0,{cause:r})}let t=e;if(t instanceof Uint8Array&&(t=Xp.decode(t)),t.includes(\"+\")||t.includes(\"/\"))throw new TypeError($0);t=t.replace(/-/g,\"+\").replace(/_/g,\"/\");try{return y$(t)}catch{throw new TypeError($0)}}function va(e){if(typeof e!=\"object\"||e===null||Object.prototype.toString.call(e)!==\"[object Object]\")return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function Mg(e){return va(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(va)}function B0(e,t,r){try{return nd(e)}catch{throw new r(`Failed to base64url decode the ${t}`)}}function S$(e,t,r){try{return ff(e)}catch{throw new r(`The ${t} is not a valid base64url string`)}}function Fg(e,t,r){let n;try{n=JSON.parse(kg.decode(nd(e)))}catch{throw new t(r)}if(!va(n))throw new t(r);return n}async function Ng(e,t){if(t.kty===\"RSA\"&&\"oth\"in t&&t.oth!==void 0)throw new bo('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');if(!e.kty.includes(t.kty))throw new bo('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,n=!!(t.d||t.priv),o={...t};return o.kty!==\"AKP\"&&delete o.alg,delete o.use,crypto.subtle.importKey(\"jwk\",o,r,t.ext??!n,t.key_ops??e.usages[n?1:0])}function j0(e){return{__proto__:null,...e}}function b$(e){let t=j0(e);if(t.ext!==void 0&&typeof t.ext!=\"boolean\")throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');if(t.key_ops!==void 0){let r=t.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some(o=>typeof o!=\"string\")||new Set(n).size!==n.length)throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');t.key_ops=n}return t}var z0=e=>e[Symbol.toStringTag],bee=(e,t,r)=>{let{alg:n}=e;if(t.use!==void 0){let o=r===\"sign\"||r===\"verify\"?\"sig\":\"enc\";if(t.use!==o)throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${o}\" when present`)}if(t.alg!==void 0&&t.alg!==n)throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${n}\" when present`);if(Array.isArray(t.key_ops)){let o=r===\"encrypt\"||r===\"decrypt\"?e.ops?.[r===\"encrypt\"?0:1]:r;if(o&&!t.key_ops.includes(o))throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${o}\" when present`)}};function Eee(e,t,r){let{alg:n,secret:o}=e,s=r===\"decrypt\"||r===\"sign\";if(o&&t instanceof Uint8Array)return[I$,t];if(va(t)){let a=b$(t);if(typeof a.kty!=\"string\")throw new TypeError(o?ed(n,t,\"CryptoKey\",\"KeyObject\",\"JSON Web Key\",\"Uint8Array\"):ed(n,t,\"CryptoKey\",\"KeyObject\",\"JSON Web Key\"));if(!(o?a.kty===\"oct\"&&typeof a.k==\"string\":a.kty!==\"oct\"&&(s?a.kty===\"AKP\"&&typeof a.priv==\"string\"||typeof a.d==\"string\":a.d===void 0&&a.priv===void 0)))throw new TypeError(o?'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present':`JSON Web Key for this operation must be a ${s?\"private\":\"public\"} JWK`);return bee(e,a,r),[C$,t,a]}if(!g$(t))throw new TypeError(o?ed(n,t,\"CryptoKey\",\"KeyObject\",\"JSON Web Key\",\"Uint8Array\"):ed(n,t,\"CryptoKey\",\"KeyObject\",\"JSON Web Key\"));if(o){if(t.type!==\"secret\")throw new TypeError(`${z0(t)} instances for symmetric algorithms must be of type \"secret\"`)}else{if(t.type===\"secret\")throw new TypeError(`${z0(t)} instances for asymmetric algorithms must not be of type \"secret\"`);let a=s?\"private\":\"public\";if((t.type===\"public\"||t.type===\"private\")&&t.type!==a){let i=r===\"sign\"?\"signing\":r===\"verify\"?\"verifying\":`${r.slice(0,-1)}tion`;throw new TypeError(`${z0(t)} instances for asymmetric algorithm ${i} must be of type \"${a}\"`)}}return L0(t)?[T$,t]:[w$,t]}var I$=0,T$=1,w$=2,C$=3,q0,Iee={__proto__:null,prime256v1:\"P-256\",secp384r1:\"P-384\",secp521r1:\"P-521\"};function Ug(e,t,r){q0||=new WeakMap;let n=q0.get(e);return r&&(n?n[t]=r:q0.set(e,{[t]:r})),r??n?.[t]}var E$=async(e,t,r)=>Ug(e,r.alg)??Ug(e,r.alg,await Ng(r,{...t,alg:r.alg})),Tee=(e,t)=>{let r=Ug(e,t.alg);if(r)return r;let n=e.type===\"public\",o=t.usages[n?0:1],{asymmetricKeyType:s}=e,a=Iee[e.asymmetricKeyDetails?.namedCurve],i=t.resolve?.({crv:a,asymmetricKeyType:s})??t.subtle;return Ug(e,t.alg,e.toCryptoKey(i,n,o))};async function A$(e,t,r){let n=Eee(e,t,r);switch(n[0]){case I$:case T$:return n[1];case C$:{let o=n[1],s=n[2];if(s.kty===\"oct\")return nd(s.k);if(!Object.isFrozen(o)){let{key_ops:a}=o;Array.isArray(a)&&Object.freeze(a),Object.freeze(o)}return E$(o,s,e)}case w$:{let o=n[1];return o.type===\"secret\"?o.export():\"toCryptoKey\"in o&&typeof o.toCryptoKey==\"function\"?Tee(o,e):E$(o,o.export({format:\"jwk\"}),e)}}}function k$(e){let t={__proto__:null};for(let r in e)t[r]={...e[r],alg:r};return t}var v$={__proto__:null,b64:!0};function O$(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some(r=>typeof r!=\"string\")))throw new TypeError(`\"${e}\" option must be an array of strings`);if(t)return new Set(t)}function _$(e,t,r,n,o){if(o.crit!==void 0&&n?.crit===void 0)throw new e('\"crit\" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(a=>typeof a!=\"string\"||a.length===0))throw new e('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s=r===void 0?t:{__proto__:null,...r,...t};for(let a of n.crit){if(!(a in s))throw new bo(`Extension Header Parameter \"${a}\" is not recognized`);if(!Object.hasOwn(o,a)||o[a]===void 0)throw new e(`Extension Header Parameter \"${a}\" is missing`);if(s[a]&&(!Object.hasOwn(n,a)||n[a]===void 0))throw new e(`Extension Header Parameter \"${a}\" MUST be integrity protected`)}return n.crit}function R$(e,t){if(t.includes(\"b64\")){let r=e.b64;if(typeof r!=\"boolean\")throw new Gr('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}async function wee(e,t,r){return t instanceof Uint8Array?crypto.subtle.importKey(\"raw\",t,e.subtle,!1,[r]):(x$(t,e.subtle,r),e.minRsaBits&&h$(e.alg,t),t)}async function P$(e,t,r,n){let o=await wee(e,t,\"verify\");try{return await crypto.subtle.verify(e.signing,o,r,n)}catch{return!1}}var od=[[\"verify\"],[\"sign\"]];function H0(e){let t={name:\"HMAC\",hash:`SHA-${e}`};return{kty:[\"oct\"],secret:!0,subtle:t,signing:t,usages:od}}function df(e,t){let n={name:t?\"RSA-PSS\":\"RSASSA-PKCS1-v1_5\",hash:`SHA-${e}`};return{kty:[\"RSA\"],subtle:n,signing:t?{...n,saltLength:t}:n,usages:od,minRsaBits:2048}}function W0(e,t){return{kty:[\"EC\"],crv:e,subtle:{name:\"ECDSA\",namedCurve:e},signing:{name:\"ECDSA\",hash:`SHA-${t}`},usages:od}}function M$(){let e={name:\"Ed25519\"};return{kty:[\"OKP\"],crv:\"Ed25519\",subtle:e,signing:e,usages:od}}function J0(e){let r={name:`ML-DSA-${e}`};return{kty:[\"AKP\"],subtle:r,signing:r,usages:od}}var K0=k$({HS256:H0(256),HS384:H0(384),HS512:H0(512),RS256:df(256),RS384:df(384),RS512:df(512),PS256:df(256,32),PS384:df(384,48),PS512:df(512,64),ES256:W0(\"P-256\",256),ES384:W0(\"P-384\",384),ES512:W0(\"P-521\",512),EdDSA:M$(),Ed25519:M$(),\"ML-DSA-44\":J0(44),\"ML-DSA-65\":J0(65),\"ML-DSA-87\":J0(87)});function F$(e){let t=typeof e==\"string\"?K0[e]:void 0;if(!t)throw new bo(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}function N$(e){return[e&&O$(\"algorithms\",e.algorithms),e?.crit]}function Cee(e,t=e===void 0?{}:Fg(e,Gr,\"JWS Protected Header is invalid\")){return t}function Aee(e,t,r){let n=R$(e,_$(Gr,v$,r[1],e,t)),o=t.alg;if(typeof o!=\"string\"||!o)throw new Gr('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');if(r[0]&&!r[0].has(o))throw new Og('\"alg\" (Algorithm) Header Parameter value not allowed');return[n,o]}function kee(e){try{return ff(e)}catch{throw new Gr(\"JWS Compact Serialization payload must use only ASCII characters\")}}async function vee(e,t,r,n,o,s,a){let i=!1;typeof r==\"function\"&&(r=await r(o,e),i=!0);let c=typeof a==\"string\",u=F$(s),f=m$(n!==void 0?ff(n):new Uint8Array,ff(\".\"),c?t[2]??=S$(a,\"payload\",Gr):a),p=B0(e.signature,\"signature\",Gr),d=await A$(u,r,\"verify\");if(!await P$(u,d,p,f))throw new Pg;return[c?B0(a,\"payload\",Gr):a,o,c,d,i]}async function U$(e,t,r){if(e instanceof Uint8Array&&(e=Xp.decode(e)),typeof e!=\"string\")throw new Gr(\"Compact JWS must be a string or Uint8Array\");let{0:n,1:o,2:s,length:a}=e.split(\".\");if(a!==3)throw new Gr(\"Invalid Compact JWS\");let i={payload:o,protected:n,signature:s},c=Cee(n),[u,f]=Aee(c,c,t),p=u?o:kee(o);return vee(i,t,r,n,c,f,p)}var Oee=e=>Math.floor(e.getTime()/1e3),_ee={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},Ree=/^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,mf=\"check_failed\";function G0(){throw new TypeError(\"Invalid time period format\")}function D$(e){typeof e!=\"string\"&&G0();let t=Ree.exec(e);(!t||t[4]&&t[1])&&G0();let r=parseFloat(t[2]),n=Math.round(r*_ee[t[3][0].toLowerCase()]);return Number.isFinite(n)||G0(),t[1]===\"-\"||t[4]===\"ago\"?-n:n}function V0(e,t){if(!Number.isFinite(t))throw new TypeError(`Invalid ${e} input`);return t}var L$=e=>{let t=e.toLowerCase();return e.includes(\"/\")?t:`application/${t}`},Pee=(e,t)=>typeof e==\"string\"?t.includes(e):Array.isArray(e)?t.some(r=>e.includes(r)):!1;function Z0(e,t,r=!1){let n=e[t];if(!(n===void 0&&!r)){if(typeof n!=\"number\")throw new Us(`\"${t}\" claim must be a number`,e,t,\"invalid\");return n}}function Y0(e,t){throw new Us(`unexpected \"${t}\" claim value`,e,t,mf)}function $$(e,t,r={}){let n;try{n=JSON.parse(kg.decode(t))}catch{}if(!va(n))throw new lf(\"JWT Claims Set must be a top-level JSON object\");let{typ:o}=r;if(o!==void 0&&(typeof e.typ!=\"string\"||L$(e.typ)!==L$(o)))throw new Us('unexpected \"typ\" JWT header value',n,\"typ\",mf);let{requiredClaims:s=[],issuer:a,subject:i,audience:c,maxTokenAge:u}=r,f=[...s];u!==void 0&&f.push(\"iat\"),c!==void 0&&f.push(\"aud\"),i!==void 0&&f.push(\"sub\"),a!==void 0&&f.push(\"iss\");for(let E of new Set(f.reverse()))if(!Object.hasOwn(n,E))throw new Us(`missing required \"${E}\" claim`,n,E,\"missing\");a!==void 0&&!(Array.isArray(a)?a:[a]).includes(n.iss)&&Y0(n,\"iss\"),i!==void 0&&n.sub!==i&&Y0(n,\"sub\"),c!==void 0&&!Pee(n.aud,typeof c==\"string\"?[c]:c)&&Y0(n,\"aud\");let{clockTolerance:p}=r,d=0;if(typeof p==\"string\")d=D$(p);else if(p!==void 0){if(typeof p!=\"number\")throw new TypeError(\"Invalid clockTolerance option type\");d=p}V0(\"clockTolerance option\",d);let{currentDate:m}=r,x=V0(\"currentDate option\",Oee(m===void 0?new Date:m)),y=Z0(n,\"iat\",u!==void 0),S=Z0(n,\"nbf\");if(S!==void 0&&S>x+d)throw new Us('\"nbf\" claim timestamp check failed',n,\"nbf\",mf);let w=Z0(n,\"exp\");if(w!==void 0&&w<=x-d)throw new td('\"exp\" claim timestamp check failed',n,\"exp\",mf);if(u!==void 0){let E=x-y,U=V0(\"maxTokenAge option\",typeof u==\"number\"?u:D$(u));if(E-d>U)throw new td('\"iat\" claim timestamp check failed (too far in the past)',n,\"iat\",mf);if(E<-d)throw new Us('\"iat\" claim timestamp check failed (it should be in the past)',n,\"iat\",mf)}return n}async function Dg(e,t,r){let n=await U$(e,N$(r),t);if(!n[2])throw new lf(\"JWTs MUST NOT use unencoded payload\");let s={payload:$$(n[1],n[0],r),protectedHeader:n[1]};return typeof t==\"function\"?{...s,key:n[3]}:s}function Mee(e,t,r,n){let{kty:o,key_ops:s,ext:a,kid:i,alg:c,use:u,crv:f}=j0(e),p=Array.isArray(s)?[...s]:s;return(a===void 0||typeof a==\"boolean\")&&(p===void 0||Array.isArray(p)&&p.every((d,m)=>typeof d==\"string\"&&p.indexOf(d)===m)&&p.includes(\"verify\"))&&t.kty.includes(o)&&(n===void 0||typeof n==\"string\"&&n===i)&&(c===void 0?o!==\"AKP\":r===c)&&(u===void 0||u===\"sig\")&&(!t.crv||f===t.crv)}async function B$(e,t,r){let n=e.get(t)||e.set(t,{}).get(t),{alg:o}=r;if(n[o]===void 0){let s=await Ng(r,{...t,alg:o,ext:!0});if(s.type!==\"public\")throw new rd(\"JSON Web Key Set members must be public keys\");n[o]=s}return n[o]}function uc(e){let t;try{t=structuredClone(e)}catch{}if(!Mg(t))throw new rd(\"JSON Web Key Set malformed\");let r=new WeakMap;return Object.defineProperty(async(o,s)=>{let{alg:a,kid:i}={...o,...s?.header},c=typeof a==\"string\"?K0[a]:void 0;if(!c||c.secret)throw new bo('Unsupported \"alg\" value for a JSON Web Key Set');let u=t.keys.filter(d=>Mee(d,c,a,i)),{0:f,length:p}=u;if(!p)throw new pf;if(p!==1){let d=new _g;throw d[Symbol.asyncIterator]=async function*(){for(let m of u)try{yield await B$(r,m,c)}catch{}},d}return B$(r,f,c)},\"jwks\",{value:()=>structuredClone(t)})}function Fee(){return typeof WebSocketPair<\"u\"||typeof navigator<\"u\"&&navigator.userAgent===\"Cloudflare-Workers\"||typeof EdgeRuntime<\"u\"&&EdgeRuntime===\"vercel\"}var Q0;(typeof navigator>\"u\"||!navigator.userAgent?.startsWith?.(\"Mozilla/5.0 \"))&&(Q0=\"jose/v6.2.10\");var z$=Symbol();async function Nee(e,t,r,n=fetch){let o=await n(e,{method:\"GET\",signal:r,redirect:\"manual\",headers:t}).catch(s=>{throw s.name===\"TimeoutError\"?new Rg:s});if(o.status!==200)throw new yr(\"Expected 200 OK from the JSON Web Key Set HTTP response\");try{return await o.json()}catch{throw new yr(\"Failed to parse the JSON Web Key Set HTTP response as JSON\")}}var q$=Symbol();function sd(e,t){return Number.isFinite(e)&&Date.now()<e+t}function j$(e,t,r){if(Number.isNaN(e))throw new TypeError(`\"${r}\" option must not be NaN`);return typeof e==\"number\"?e:t}function X0(e,t){if(!(e instanceof URL))throw new TypeError(\"url must be an instance of URL\");let r=new URL(e.href).href,n=t??{},o=n.timeoutDuration;if(typeof o==\"number\"&&(!Number.isInteger(o)||o<0))throw new TypeError('\"timeoutDuration\" option must be a non-negative integer');let s=typeof o==\"number\"?o:5e3,a=j$(n.cooldownDuration,3e4,\"cooldownDuration\"),i=j$(n.cacheMaxAge,6e5,\"cacheMaxAge\"),c=new Headers(n.headers);Q0&&!c.has(\"User-Agent\")&&c.set(\"User-Agent\",Q0),c.has(\"accept\")||c.set(\"accept\",\"application/json, application/jwk-set+json\");let u=n[z$],f=n[q$],p,d,m=0,x=0,y;if(f&&typeof f==\"object\"){let{uat:E,jwks:U}=f;sd(E,i)&&Mg(U)&&(p=E,y=uc(U))}let S=async()=>{if(d&&Fee()&&(d=void 0),!d){let E=++m,U=d=Nee(r,c,AbortSignal.timeout(s),u).then(_=>{let h=uc(_);if(E<=x)return;y=h;let b=Date.now();f&&(f.uat=b,f.jwks=_),p=b,x=E}).finally(()=>{d===U&&(d=void 0)})}await d};return Object.defineProperties(async(E,U)=>{(!y||!sd(p,i))&&await S();try{return await y(E,U)}catch(_){if(_ instanceof pf&&!sd(p,a))return await S(),y(E,U);throw _}},{coolingDown:{get:()=>sd(p,a),enumerable:!0},fresh:{get:()=>sd(p,i),enumerable:!0},reload:{value:S,enumerable:!0},reloading:{get:()=>!!d,enumerable:!0},jwks:{value:()=>y?.jwks(),enumerable:!0}})}function eC(e){let t;if(typeof e==\"string\"){let n=e.split(\".\");(n.length===3||n.length===5)&&([t]=n)}else if(typeof e==\"object\"&&e)if(\"protected\"in e)t=e.protected;else throw new TypeError(\"Token does not contain a Protected Header\");let r=\"Invalid Token or Protected Header formatting\";if(typeof t!=\"string\"||!t)throw new TypeError(r);return Fg(t,TypeError,r)}var Dee=new Set([\"HOME\",\"HOSTNAME\",\"PATH\",\"PWD\"]),Ln=N.runSync(N.gen(function*(){let e=t=>t.pipe(Mr.option);return{hostPort:yield*e(Mr.String(\"SUPABASE_INTERNAL_HOST_PORT\")),functionsRoot:yield*e(Mr.String(\"SUPABASE_INTERNAL_FUNCTIONS_ROOT\")),filesRoot:yield*e(Mr.String(\"SUPABASE_INTERNAL_FUNCTIONS_FILES_ROOT\")),jwtSecret:yield*e(Mr.String(\"SUPABASE_INTERNAL_JWT_SECRET\")),supabaseUrl:yield*e(Mr.String(\"SUPABASE_URL\")),wallclock:yield*e(Mr.String(\"SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC\")),publishableKey:yield*e(Mr.String(\"SUPABASE_INTERNAL_PUBLISHABLE_KEY\")),secretKey:yield*e(Mr.String(\"SUPABASE_INTERNAL_SECRET_KEY\")),functionsConfig:yield*e(Mr.String(\"SUPABASE_INTERNAL_FUNCTIONS_CONFIG\")),debug:yield*e(Mr.String(\"SUPABASE_INTERNAL_DEBUG\")),jwks:yield*e(Mr.String(\"SUPABASE_JWKS\"))}}).pipe(N.provideService(sf.ConfigProvider,sf.fromEnvRecord(Deno.env.toObject(),{preserveEmptyStrings:!0})))),xf=(e,t=\"\")=>xe.getOrElse(e,()=>t),H$=xf(Ln.hostPort,\"8081\"),Z$=xf(Ln.functionsRoot),Lee=xf(Ln.jwtSecret),$ee=xf(Ln.supabaseUrl,\"http://127.0.0.1:54321\"),Bee=new URL(\"/auth/v1/.well-known/jwks.json\",$ee),W$=Number.parseInt(xf(Ln.wallclock,\"400\"),10),J$=xe.getOrUndefined(Ln.publishableKey),K$=xe.getOrUndefined(Ln.secretKey),Ds={BootError:Kr.ServiceUnavailable,InvalidWorkerResponse:Kr.InternalServerError,WorkerLimit:546},jee={[Ds.BootError]:\"BOOT_ERROR\",[Ds.InvalidWorkerResponse]:\"WORKER_ERROR\",[Ds.WorkerLimit]:\"WORKER_LIMIT\"},zee={[Ds.BootError]:\"Worker failed to boot (please check logs)\",[Ds.InvalidWorkerResponse]:\"Function exited due to an error (please check logs)\",[Ds.WorkerLimit]:\"Worker failed to respond due to a resource limit (please check logs)\"},qee=new Map([[Deno.errors.InvalidWorkerCreation,Ds.BootError],[Deno.errors.InvalidWorkerResponse,Ds.InvalidWorkerResponse],[Deno.errors.WorkerRequestCancelled,Ds.WorkerLimit]]),Hee=e=>{let t=Deno.errors.WorkerAlreadyRetired;return t!==void 0&&e instanceof t},Wee=(s=>(s.MissingAuthHeader=\"UNAUTHORIZED_NO_AUTH_HEADER\",s.InvalidLegacyJWT=\"UNAUTHORIZED_JWT\",s.InvalidAsymmetricJWT=\"UNAUTHORIZED_ASYMMETRIC_JWT\",s.InvalidTokenFormat=\"UNAUTHORIZED_INVALID_JWT_FORMAT\",s.UnsupportedTokenAlgorithm=\"UNAUTHORIZED_UNSUPPORTED_TOKEN_ALGORITHM\",s))(Wee||{}),Jee=me.Struct({enabled:me.optionalKey(me.Boolean),verifyJWT:me.optionalKey(me.Boolean),verify_jwt:me.optionalKey(me.Boolean),entrypointPath:me.optionalKey(me.String),entrypoint:me.optionalKey(me.String),importMapPath:me.optionalKey(me.String),import_map:me.optionalKey(me.String),importMapRoot:me.optionalKey(me.String),import_map_root:me.optionalKey(me.String),staticFiles:me.optionalKey(me.Array(me.String)),static_files:me.optionalKey(me.Array(me.String)),env:me.optionalKey(me.Record(me.String,me.String))}),Kee=me.Record(me.String,Jee),Gee=me.declare(e=>typeof e==\"object\"&&e!==null&&\"keys\"in e&&Array.isArray(e.keys)&&e.keys.every(t=>typeof t==\"object\"&&t!==null)),Vee=()=>xe.match(Ln.functionsConfig,{onNone:()=>({}),onSome:e=>N.runSync(me.decodeEffect(me.fromJsonString(Kee))(e).pipe(N.orElseSucceed(()=>({}))))}),tC=Vee();if(xe.getOrUndefined(Ln.debug)===\"true\"){let e=Object.fromEntries(Object.entries(tC).map(([t,r])=>[t,Object.fromEntries(Object.entries(r).filter(([n])=>n!==\"env\"))]));N.runSync(ic.log(\"Functions config:\",JSON.stringify(e,null,2)))}var fc=(e,t,r={})=>{let n={...r},o=null;return e!=null&&(typeof e==\"object\"?(n[\"Content-Type\"]=\"application/json\",o=JSON.stringify(e)):(n[\"Content-Type\"]=\"text/plain\",o=typeof e==\"string\"?e:JSON.stringify(e)??null)),new Response(o,{status:t,headers:n})},G$=({code:e,message:t=\"Invalid JWT\"})=>fc({code:e,message:t,msg:t},Kr.Unauthorized,{\"sb-error-code\":e,\"Access-Control-Expose-Headers\":\"sb-error-code\"}),Zee=e=>{for(let[t,r]of qee.entries())if(t!==void 0&&e instanceof t)return fc({code:jee[r],message:zee[r]},r);return fc({code:N0[Kr.InternalServerError],message:\"Request failed due to an internal server error\"},Kr.InternalServerError)};function Yee(e){let t=e.split(\" \");return t.length===2&&t[0]===\"Bearer\"?t[1]:null}var Qee=e=>{let t=e.headers.get(\"authorization\"),r=e.headers.get(\"sb-api-key\")?.replace(\"Bearer\",\"\").trim();if(!t&&!r)return{code:\"UNAUTHORIZED_NO_AUTH_HEADER\",message:\"Missing authorization header\"};let n=Yee(t??\"\"),o=!n||n.startsWith(\"sb_\")?r:n;return o||{code:\"UNAUTHORIZED_INVALID_JWT_FORMAT\",message:\"Invalid JWT format\"}},hf=class extends Cn.TaggedError(\"BootstrapOperationError\"){},Xee=N.runSync(xe.match(Ln.jwks,{onNone:()=>N.succeed(xe.some(uc({keys:[]}))),onSome:e=>N.gen(function*(){let t=yield*me.decodeEffect(me.fromJsonString(Gee))(e);return yield*N.try({try:()=>uc(t),catch:r=>new hf({cause:r})})}).pipe(N.option)})),ete=xe.getOrElse(Xee,()=>X0(Bee)),Oa=e=>N.tryPromise({try:e,catch:t=>new hf({cause:t})}),tte=e=>N.gen(function*(){return yield*Oa(()=>Dg(e,ete)),xe.none()}).pipe(N.orElseSucceed(()=>xe.some({code:\"UNAUTHORIZED_ASYMMETRIC_JWT\"})));function rte(e,t){return N.gen(function*(){let r=yield*N.try({try:()=>eC(t).alg,catch:n=>new hf({cause:n})});return r?r===\"HS256\"?yield*Oa(()=>Dg(t,new TextEncoder().encode(e))).pipe(N.as(xe.none()),N.orElseSucceed(()=>xe.some({code:\"UNAUTHORIZED_JWT\"}))):r===\"ES256\"||r===\"RS256\"?yield*tte(t):xe.some({code:\"UNAUTHORIZED_UNSUPPORTED_TOKEN_ALGORITHM\",message:`Unsupported JWT algorithm ${r}`}):xe.some({code:\"UNAUTHORIZED_INVALID_JWT_FORMAT\",message:\"Invalid JWT format\"})}).pipe(N.orElseSucceed(()=>xe.some({code:\"UNAUTHORIZED_INVALID_JWT_FORMAT\",message:\"Invalid JWT format\"})))}var Y$={lstat:e=>Oa(()=>Deno.lstat(e)).pipe(N.mapError(t=>new uf({cause:t})),N.map(t=>({isDirectory:t.isDirectory,isFile:t.isFile,isSymbolicLink:t.isSymlink}))),realPath:e=>Oa(()=>Deno.realPath(e)).pipe(N.mapError(t=>new uf({cause:t}))),readDirectory:e=>ns.suspend(()=>ns.fromAsyncIterable(Deno.readDir(e),t=>new hf({cause:t})).pipe(ns.map(t=>t.name))).pipe(ns.runCollect,N.mapError(t=>new uf({cause:t})))},nte=e=>l$({root:Z$,filesRoot:xe.getOrUndefined(Ln.filesRoot),slug:e,overrides:tC,fs:Y$}),V$=new Set,ote=(e,t)=>t.importMapDiscoveredByRuntime||!f$(t.importMapPath)||V$.has(e)?N.void:N.sync(()=>V$.add(e)).pipe(N.andThen(ic.warn(`[functions] ${e}: ${t.importMapPath} is not the nearest Deno config of ${t.entrypointPath}, so Edge Runtime loads it as a plain import map without comments or jsr:/npm: subpath imports. Move it next to the entrypoint or into a parent directory without a closer deno.json(c).`))),ste=p$(()=>Deno.makeTempDirSync({prefix:\"supabase-worker-\"})),ate=e=>e.importMapPath?N.succeed(!1):d$({root:xf(Ln.filesRoot,Z$),config:e,fs:Y$}),Q$=e=>ns.fromEffectRepeat(Oa(()=>e.read()).pipe(N.flatMap(t=>t.done?Ft.done():N.succeed(t.value)))),ite=e=>e===void 0?N.void:ns.runDrain(Q$(e)).pipe(N.ignore);function cte(e,t){let r=new URL(e.url),n=e.headers.get(\"x-forwarded-host\");n&&(r.hostname=n);let o=new Request(r.href,{method:e.method,headers:e.headers,body:t===void 0?null:ns.toReadableStream(Q$(t)),signal:e.signal,duplex:\"half\"});return o.headers.delete(\"sb-api-key\"),EdgeRuntime.applySupabaseTag(e,o),o}Deno.serve({handler:e=>N.runPromiseExit(N.gen(function*(){let t=yield*N.acquireRelease(N.sync(()=>e.body?.getReader()),u=>N.interruptible(ite(u))),{pathname:r}=new URL(e.url);if(r===\"/_internal/health\")return fc({message:\"ok\"},Kr.OK);if(r===\"/_internal/metric\")return Response.json(yield*Oa(()=>EdgeRuntime.getRuntimeMetrics()));let n=r.split(\"/\")[1];if(!n)return fc(\"Function not found\",Kr.NotFound);let o=yield*nte(n);if(!o)return fc(\"Function not found\",Kr.NotFound);if(yield*ote(n,o),e.method!==\"OPTIONS\"&&o.verifyJWT){let u=Qee(e);if(typeof u!=\"string\")return G$(u);let f=yield*rte(Lee,u);if(xe.isSome(f))return G$(f.value)}let s={...Deno.env.toObject(),...Object.fromEntries(Object.entries(o.env??{}).filter(([u])=>!u.startsWith(\"SUPABASE_\"))),SUPABASE_FUNCTION_SLUG:n};J$&&(s.SUPABASE_PUBLISHABLE_KEYS=yield*me.encodeEffect(me.fromJsonString(me.Unknown))({default:J$})),K$&&(s.SUPABASE_SECRET_KEYS=yield*me.encodeEffect(me.fromJsonString(me.Unknown))({default:K$}));let a=Object.entries(s).filter(([u])=>!Dee.has(u)&&!u.startsWith(\"SUPABASE_INTERNAL_\")),i=!(yield*ate(o));return yield*N.gen(function*(){let u=yield*Oa(()=>EdgeRuntime.userWorkers.create({servicePath:ste(n,o),memoryLimitMb:256,workerTimeoutMs:Number.isFinite(W$)?W$*1e3:4e5,noModuleCache:!1,noNpm:i,envVars:a,forceCreate:!0,customModuleRoot:\"\",cpuTimeSoftLimitMs:1e3,cpuTimeHardLimitMs:2e3,decoratorType:\"tc39\",maybeEntrypoint:i$(o.entrypointPath).href,context:{useReadSyncFileAPI:!0,...o.importMapPath===\"\"||o.importMapDiscoveredByRuntime?{}:{importMapPath:o.importMapPath}},staticPatterns:o.staticFiles}));return yield*Oa(()=>u.fetch(cte(e,t)))}).pipe(N.retry({times:1,while:({cause:u})=>e.body===null&&Hee(u)}),N.catchTag(\"BootstrapOperationError\",({cause:u})=>ic.error(\"[functions] worker error\",u).pipe(N.andThen(N.succeed(Zee(u))))))}).pipe(N.scoped),{signal:e.signal}).then(t=>{if(ir.isSuccess(t))return t.value;if(e.signal.aborted&&Ft.hasInterruptsOnly(t.cause))return new Response(null,{status:499});throw Ft.squash(t.cause)}),onListen:()=>{let t=Object.keys(tC).slice(0,5).map(r=>` - http://127.0.0.1:${H$}/functions/v1/${r}`);N.runSync(ic.log(`Serving functions on http://127.0.0.1:${H$}/functions/v1/<function-name>${t.length?`\n${t.join(`\n`)}`:\"\"}\nUsing ${Deno.version.deno}`))},onError:()=>fc({code:N0[500],message:\"Request failed due to an internal server error\"},500)});export{Wee as RequestErrors,Yee as extractBearerToken,cte as prepareUserRequest};\n";
+export const defaultFunctionsBootstrap = "var Bq=Object.defineProperty;var An=(e,t)=>{for(var r in t)Bq(e,r,{get:t[r],enumerable:!0})};var te=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Pb={pipe(){return te(this,arguments)}},ja=(function(){function e(){}return e.prototype=Pb,e})();var l=function(e,t){if(typeof e==\"function\")return function(){return e(arguments)?t.apply(this,arguments):r=>t(r,...arguments)};switch(e){case 0:case 1:throw new RangeError(`Invalid arity ${e}`);case 2:return function(r,n){return arguments.length>=2?t(r,n):function(o){return t(o,r)}};case 3:return function(r,n,o){return arguments.length>=3?t(r,n,o):function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var D=e=>e;var gt=e=>()=>e,Cn=gt(!0),ap=gt(!1),Mb=gt(null),Vn=gt(void 0),zr=Vn;function Fb(e,...t){return te(e,t)}function gO(e,t,r,n,o,s,a,i,c){switch(arguments.length){case 1:return e;case 2:return function(){return t(e.apply(this,arguments))};case 3:return function(){return r(t(e.apply(this,arguments)))};case 4:return function(){return n(r(t(e.apply(this,arguments))))};case 5:return function(){return o(n(r(t(e.apply(this,arguments)))))};case 6:return function(){return s(o(n(r(t(e.apply(this,arguments))))))};case 7:return function(){return a(s(o(n(r(t(e.apply(this,arguments)))))))};case 8:return function(){return i(a(s(o(n(r(t(e.apply(this,arguments))))))))};case 9:return function(){return c(i(a(s(o(n(r(t(e.apply(this,arguments)))))))))}}}function on(e){let t=new WeakMap;return r=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function qs(e){let t=new WeakMap;return r=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o!==r&&t.set(o,o),o}}var er={};An(er,{AsyncFiberError:()=>dJ,AsyncFiberErrorTypeId:()=>lJ,Done:()=>o0,DoneTypeId:()=>nJ,ExceededCapacityError:()=>s0,ExceededCapacityErrorTypeId:()=>fJ,IllegalArgumentError:()=>ud,IllegalArgumentErrorTypeId:()=>iJ,InterruptorStackTrace:()=>ZI,NoSuchElementError:()=>rJ,NoSuchElementErrorTypeId:()=>tJ,ReasonTypeId:()=>$3,StackTrace:()=>VI,TimeoutError:()=>aJ,TimeoutErrorTypeId:()=>oJ,TypeId:()=>L3,UnknownError:()=>xJ,UnknownErrorTypeId:()=>mJ,annotate:()=>gJ,annotations:()=>yJ,combine:()=>z3,die:()=>Rc,done:()=>ue,empty:()=>B3,fail:()=>j3,filterInterruptors:()=>Q3,findDefect:()=>cd,findDie:()=>G3,findError:()=>q3,findErrorOption:()=>r0,findFail:()=>W3,findInterrupt:()=>Z3,fromReasons:()=>gs,hasDies:()=>J3,hasFails:()=>t0,hasInterrupts:()=>V3,hasInterruptsOnly:()=>e0,interrupt:()=>H3,interruptors:()=>Y3,isAsyncFiberError:()=>pJ,isCause:()=>id,isDieReason:()=>QI,isDone:()=>Pc,isExceededCapacityError:()=>uJ,isFailReason:()=>ai,isIllegalArgumentError:()=>cJ,isInterruptReason:()=>K3,isNoSuchElementError:()=>eJ,isReason:()=>YI,isTimeoutError:()=>sJ,isUnknownError:()=>hJ,makeDieReason:()=>Cf,makeFailReason:()=>Af,makeInterruptReason:()=>XI,map:()=>fa,pretty:()=>n0,prettyErrors:()=>X3,reasonAnnotations:()=>ng,squash:()=>rg});var ip=e=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;e instanceof Error&&t.delete(\"stack\");let r=Object.getPrototypeOf(e),n=r;for(;n!==null&&n!==Object.prototype;){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}return t.has(\"constructor\")&&typeof e.constructor==\"function\"&&r===e.constructor.prototype&&t.delete(\"constructor\"),t},Hu=new WeakSet,cp=e=>new Uint8Array(e.buffer,e.byteOffset,e.byteLength),up=e=>e instanceof ArrayBuffer||typeof SharedArrayBuffer<\"u\"&&e instanceof SharedArrayBuffer,fp=e=>{try{return new Uint8Array(e)}catch{return}};var ec=0,SO=()=>{ec++};function Wr(e){return typeof e==\"string\"}function lp(e){return typeof e==\"number\"}function Th(e){return typeof e==\"boolean\"}function bO(e){return typeof e==\"bigint\"}function Nb(e){return typeof e==\"symbol\"}function vh(e){return Wr(e)||lp(e)||Nb(e)}function qr(e){return typeof e==\"function\"}function EO(e){return e===void 0}function cs(e){return e!==void 0}function kh(e){return e!=null}function IO(e){return!1}function Ub(e){return!0}function fr(e){return typeof e==\"object\"&&e!==null&&!Array.isArray(e)}function pp(e){return typeof e==\"object\"&&e!==null||qr(e)}var A=l(2,(e,t)=>pp(e)&&t in e),Wt=l(2,(e,t)=>A(e,\"_tag\")&&e._tag===t);function wO(e){return e instanceof Error}function Js(e){return A(e,Symbol.iterator)||Wr(e)}var re=\"~effect/Hash\",V=e=>{switch(typeof e){case\"number\":return Lt(e);case\"bigint\":return Pe(e.toString(10));case\"string\":return Pe(e);case\"function\":case\"object\":{if(e===null)break;if(e instanceof Date)return Number.isNaN(e.getTime())?Pe(\"Invalid Date\"):Pe(e.toISOString());if(e instanceof RegExp)return Pe(e.toString());{if(Hu.has(e))return Db(e);let t=CO.get(e);if(t!==void 0)return t;if(Kb.has(e))return SO(),Pe(\"[Circular]\");Kb.add(e);let r=ec,n;try{if(jq(e))n=e[re]();else if(typeof e==\"function\")n=Db(e);else if(up(e)){let o=fp(e);n=o===void 0?Db(e):wo(o)}else e instanceof DataView?n=wo(cp(e)):Array.isArray(e)||ArrayBuffer.isView(e)?n=wo(e):e instanceof Map?n=Hq(e):e instanceof Set?n=zq(e):n=mp(e)}finally{Kb.delete(e)}return r===ec&&CO.set(e,n),n}}}return lr(TO(Pe(String(e))))},Db=e=>($b.has(e)||$b.set(e,lr(Math.random()*4294967296|0)),$b.get(e)),TO=e=>(e^=e>>>16,e=Math.imul(e,2246822507),e^=e>>>13,e=Math.imul(e,3266489909),e^e>>>16),Ee=l(2,(e,t)=>TO(Math.imul(e,2654435761)+Math.imul(t,2246822507))),lr=e=>e&3221225471|e>>>1&1073741824,jq=e=>A(e,re)&&typeof e[re]==\"function\",Lb=new DataView(new ArrayBuffer(8)),Lt=e=>{let t=e|0;return t===e?lr(t):(Lb.setFloat64(0,e!==e?NaN:e),lr(Ee(Lb.getInt32(0),Lb.getInt32(4))))},Pe=e=>{let t=5381,r=e.length;for(;r;)t=t*33^e.charCodeAt(--r);return lr(t)},dp=(e,t)=>{let r=12289;for(let n of t)r^=Ee(V(n),V(e[n]));return lr(r)},mp=e=>dp(e,ip(e)),vO=(e,t)=>r=>{let n=e;for(let o of r)n^=t(o);return lr(n)},wo=e=>{let t=6151;for(let r of e)t=Ee(t,V(r));return lr(t)},Hq=vO(Pe(\"Map\"),([e,t])=>Ee(V(e),V(t))),AO=Pe(\"Set\"),zq=vO(AO,e=>Ee(AO,V(e))),$b=new WeakMap,CO=new WeakMap,Kb=new WeakSet;var ne=\"~effect/Equal\";function Z(){return arguments.length===1?e=>tc(e,arguments[0]):tc(arguments[0],arguments[1])}function tc(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;return r!==typeof t?!1:r===\"number\"&&e!==e&&t!==t?!0:r!==\"object\"&&r!==\"function\"||Hu.has(e)||Hu.has(t)?!1:Wq(e,t)}function Wq(e,t){let r=Oh.length;for(let s=r;s-- >0;)if(Oh[s]===e&&jb[s]===t)return!0;if(r)return kO(e,t);let n=OO.get(e);n||OO.set(e,n=new WeakMap);let o=n.get(t);return o===void 0&&n.set(t,o=kO(e,t)),o}function kO(e,t){Oh.push(e),jb.push(t);try{return qq(e,t)}finally{Oh.pop(),jb.pop()}}var Oh=[],jb=[],OO=new WeakMap;function qq(e,t){if(V(e)!==V(t))return!1;if(e instanceof Date){if(!(t instanceof Date))return!1;let n=e.getTime(),o=t.getTime();return n===o||Number.isNaN(n)&&Number.isNaN(o)}else if(e instanceof RegExp)return t instanceof RegExp&&e.toString()===t.toString();let r=_O(e);if(r!==_O(t)||typeof e==\"function\"&&!r)return!1;if(r)return e[ne](t);if(Array.isArray(e))return!Array.isArray(t)||e.length!==t.length?!1:Jq(e,t);if(up(e)){if(!up(t)||e instanceof ArrayBuffer!=t instanceof ArrayBuffer)return!1;let n=fp(e),o=fp(t);return n!==void 0&&o!==void 0&&Bb(n,o)}else if(ArrayBuffer.isView(e)){let n=e instanceof DataView;return!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||n!==t instanceof DataView?!1:n?Bb(cp(e),cp(t)):Bb(e,t)}else{if(e instanceof Map)return!(t instanceof Map)||e.size!==t.size?!1:Hb(e,t,Vq,Zq);if(e instanceof Set)return!(t instanceof Set)||e.size!==t.size?!1:Hb(e,t,V,tc)}return Gq(e,t)}function Jq(e,t){for(let r=0;r<e.length;r++)if(!tc(e[r],t[r]))return!1;return!0}function Bb(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function Gq(e,t){let r=ip(e),n=ip(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!tc(e[o],t[o]))return!1;return!0}function Hb(e,t,r,n){let o=new Map,s=0;for(let a of t){let i=r(a),c=o.get(i);c?c.push(a):o.set(i,[a]),s++}e:for(let a of e){let i=o.get(r(a));if(i){for(let c=0;c<i.length;c++)if(n(a,i[c])){i[c]=i[i.length-1],i.pop(),s--;continue e}}return!1}return s===0}var Vq=e=>V(e[0]),Zq=(e,t)=>tc(e[0],t[0])&&tc(e[1],t[1]),Yq=()=>0;function _h(e,t){return hp((r,n)=>e(r[0],n[0])&&t(r[1],n[1]))}function hp(e){return function(r,n){return Hb(r,n,Yq,e)}}var _O=e=>A(e,ne)&&typeof e[ne]==\"function\",xp=()=>Z;var Rh=e=>(Hu.add(e),e);var Gs=Symbol.for(\"~effect/Redactable\"),Qq=e=>A(e,Gs);function Ao(e){return Qq(e)?zb(e):e}function zb(e){return e[Gs](globalThis[rc]?.context??Xq)}var rc=\"~effect/Fiber/currentFiber\",RO=new Map,Xq={\"~effect/Context\":{},base:RO,depth:0,mapUnsafe:RO,pipe(){return te(this,arguments)}};function K(e,t){let r=t?.space??0,n=new WeakSet,o=r?typeof r==\"number\"?\" \".repeat(r):r:\"\",s=f=>o.repeat(f),a=(f,p)=>{let d=f?.constructor;return d&&d!==Object.prototype.constructor&&d.name?`${d.name}(${p})`:p},i=f=>{try{return Reflect.ownKeys(f)}catch{return[\"[ownKeys threw]\"]}};function c(f,p=0){try{return u(f,p)}catch{return(typeof f==\"object\"&&f!==null||typeof f==\"function\")&&n.delete(f),\"[inspection threw]\"}}function u(f,p=0){if(typeof f==\"string\")return JSON.stringify(f);if(typeof f==\"number\"||f==null||typeof f==\"boolean\"||typeof f==\"symbol\")return String(f);if(typeof f==\"bigint\")return String(f)+\"n\";if(typeof f==\"object\"||typeof f==\"function\"){if(n.has(f))return e6;n.add(f);let d;if(Gs in f)d=c(zb(f),p);else if(Array.isArray(f))d=!o||f.length<=1?`[${f.map(m=>c(m,p)).join(\",\")}]`:`[\n${s(p+1)}${f.map(m=>c(m,p+1)).join(`,\n`+s(p+1))}\n${s(p)}]`;else if(f instanceof Date)d=qb(f);else if(!t?.ignoreToString&&A(f,\"toString\")&&typeof f.toString==\"function\"&&f.toString!==Object.prototype.toString&&f.toString!==Array.prototype.toString){let m=t6(f);d=f instanceof Error&&f.cause!==void 0?`${m} (cause: ${c(f.cause,p)})`:m}else if(Symbol.iterator in f)d=`${f.constructor.name}(${c(Array.from(f),p)})`;else{let m=i(f);if(!o||m.length<=1){let h=`{${m.map(y=>`${us(y)}:${c(PO(f,y),p)}`).join(\",\")}}`;d=a(f,h)}else{let h=`{\n${m.map(y=>`${s(p+1)}${us(y)}: ${c(PO(f,y),p+1)}`).join(`,\n`)}\n${s(p)}}`;d=a(f,h)}}return n.delete(f),d}return String(f)}return c(e,0)}var e6=\"[Circular]\";function us(e){return typeof e==\"string\"?JSON.stringify(e):String(e)}function Ph(e){return e.map(t=>`[${us(t)}]`).join(\"\")}function qb(e){try{return e.toISOString()}catch{return\"Invalid Date\"}}function t6(e){try{let t=e.toString();return typeof t==\"string\"?t:String(t)}catch{return\"[toString threw]\"}}function PO(e,t){try{return e[t]}catch{return\"[property access threw]\"}}function nc(e,t){let r=[],n=new WeakMap;return JSON.stringify(e,function(o,s){let a=Object.getOwnPropertyDescriptor(n.get(this)??this,o)?.value,i=A(a,Gs)?Ao(a):Ao(s);if(typeof i==\"bigint\")return K(i);if(typeof i!=\"object\"||i===null)return i;let c=i instanceof Error&&!A(i,\"toJSON\")?{...i,name:i.name,message:i.message}:i;for(;r.length>0&&r[r.length-1]!==this;)r.pop();if(r.includes(i))return;if(r.push(i),c!==i&&r.push(c),!r6(c)||o6(c))return c;let u=n6(c);return n.set(u,c),r.push(u),u},t?.space)??\"null\"}function r6(e){for(let t of Object.getOwnPropertyNames(e))if(Object.getOwnPropertyDescriptor(e,t)?.get!==void 0)return!0;return!1}function n6(e){let t=Array.isArray(e)?[]:{},r=Array.isArray(e)?Array.from({length:e.length},(n,o)=>String(o)):Object.keys(e);for(let n of r)Object.defineProperty(t,n,{enumerable:!0,get:()=>{let o=Reflect.get(e,n);return Object.getOwnPropertyDescriptor(e,n)?.get!==void 0?Ao(o):o}});return t}function o6(e){for(let t of[Number.prototype.valueOf,Boolean.prototype.valueOf,String.prototype.valueOf])try{return Reflect.apply(t,e,[]),!0}catch{}return!1}var Je=Symbol.for(\"nodejs.util.inspect.custom\"),qt=e=>{try{return e=Ao(e),A(e,\"toJSON\")&&qr(e.toJSON)&&e.toJSON.length===0?e.toJSON():Array.isArray(e)?e.map(qt):e}catch{return\"[toJSON threw]\"}},FO=(e,t=2)=>{if(typeof e==\"string\")return e;try{return typeof e==\"object\"?nc(e,{space:t}):K(e,{space:t})}catch{return String(e)}},$t={toJSON(){return qt(this)},[Je](){return this.toJSON()},toString(){return K(this.toJSON())}},MO=class{[Je](){return this.toJSON()}toString(){return K(this.toJSON())}};var a6=()=>{let e=Object.getOwnPropertyDescriptor(Error,\"stackTraceLimit\");return e===void 0?Object.isExtensible(Error):Object.hasOwn(e,\"writable\")?e.writable===!0:e.set!==void 0},i6=a6(),Co=()=>Error.stackTraceLimit,pr=e=>{i6&&(Error.stackTraceLimit=e)};var Ha=class{constructor(t){this.value=t,this.done=!1}next(t){return this.done?(this.value=t,this):(this.done=!0,{value:this.value,done:!1})}},c6=()=>{let e=\"~effect/Utils/internal\",t={[e]:s=>s()},r={[e]:s=>s()},n=Co();if(n===0)return r[e];pr(2);let o=t[e](()=>new Error);return pr(n),o.stack?.includes(e)===!0?t[e]:r[e]},za=c6();function B(e,t,r){t===\"__proto__\"?Object.defineProperty(e,t,{value:r,writable:!0,enumerable:!0,configurable:!0}):e[t]=r}function Mh(e,t){if(!Object.hasOwn(t,\"__proto__\")){Object.assign(e,t);return}for(let r of Reflect.ownKeys(t))Object.prototype.propertyIsEnumerable.call(t,r)&&B(e,r,t[r])}var fs=\"~effect/Effect\",oc=\"~effect/Exit\",f6={_A:D,_E:D,_R:D},Jb=`${fs}/identifier`,xe=`${fs}/args`,lt=`${fs}/evaluate`,Gt=`${fs}/successCont`,Tn=`${fs}/failureCont`,sc=`${fs}/ensureCont`,uc=Symbol.for(\"effect/Effect/Yield\"),kr={pipe(){return te(this,arguments)},toJSON(){return{...this}},toString(){return K(this.toJSON(),{ignoreToString:!0,space:2})},[Je](){return this.toJSON()}},UO={[re](){return dp(this,Object.keys(this))},[ne](e){let t=Object.keys(this),r=Object.keys(e);if(t.length!==r.length)return!1;for(let n=0;n<t.length;n++)if(t[n]!==r[n]||!Z(this[t[n]],e[t[n]]))return!1;return!0}},l6={[fs]:f6,...kr,[Symbol.iterator](){return new Ha(this)},toJSON(){return{_id:\"Effect\",op:this[Jb],...xe in this?{args:this[xe]}:void 0}}},de=e=>A(e,fs),Sp=e=>A(e,oc),gp=\"~effect/Cause\",zu=\"~effect/Cause/Reason\",qu=e=>A(e,gp),DO=e=>A(e,zu),To=class{constructor(t){this[gp]=gp,this.reasons=t}pipe(){return te(this,arguments)}toJSON(){return{_id:\"Cause\",reasons:this.reasons.map(t=>t.toJSON())}}toString(){return`Cause(${K(this.reasons)})`}[Je](){return this.toJSON()}[ne](t){return qu(t)&&this.reasons.length===t.reasons.length&&this.reasons.every((r,n)=>Z(r,t.reasons[n]))}[re](){return wo(this.reasons)}},NO=new WeakMap,Wu=class{[zu];annotations;_tag;constructor(t,r,n){if(this[zu]=zu,this._tag=t,r!==bp&&typeof n==\"object\"&&n!==null&&r.size>0){let o=NO.get(n);o&&(r=new Map([...o,...r])),NO.set(n,r)}this.annotations=r}annotate(t,r){if(t.mapUnsafe.size===0)return this;let n=new Map(this.annotations);if(t.mapUnsafe.forEach((s,a)=>{r?.overwrite!==!0&&n.has(a)||n.set(a,s)}),r?.overwrite!==!0&&n.size===this.annotations.size)return this;let o=Object.assign(Object.create(Object.getPrototypeOf(this)),this);return o.annotations=n,o}pipe(){return te(this,arguments)}toString(){return K(this)}[Je](){return this.toString()}},bp=new Map,ac=class extends Wu{constructor(t,r=bp){super(\"Fail\",r,t),this.error=t}toString(){return`Fail(${K(this.error)})`}toJSON(){return{_tag:\"Fail\",error:this.error}}[ne](t){return fc(t)&&Z(this.error,t.error)&&Z(this.annotations,t.annotations)}[re](){return Ee(Pe(this._tag))(Ee(V(this.error))(V(this.annotations)))}},ls=e=>new To(e),p6=(e,t)=>{let r=new Map,n=[];for(let o of e.concat(t)){let s=V(o),a=r.get(s);if(a===void 0)r.set(s,[o]);else{if(a.some(i=>Z(i,o)))continue;a.push(o)}n.push(o)}return n},Ep=l(2,(e,t)=>{if(e.reasons.length===0)return t;if(t.reasons.length===0)return e;let r=new To(p6(e.reasons,t.reasons));return Z(e,r)?e:r}),Gb=(e,t)=>{let r=e.reasons.slice();for(let n of t.reasons)Zs(n)&&!r.some(o=>Zs(o)&&o.fiberId===n.fiberId&&o.annotations===n.annotations)&&r.push(n);return r.length===e.reasons.length?e:new To(r)},Fh=new To([]),Ju=e=>new To([new ac(e)]),ic=class extends Wu{constructor(t,r=bp){super(\"Die\",r,t),this.defect=t}toString(){return`Die(${K(this.defect)})`}toJSON(){return{_tag:\"Die\",defect:this.defect}}[ne](t){return lc(t)&&Z(this.defect,t.defect)&&Z(this.annotations,t.annotations)}[re](){return Ee(Pe(this._tag))(Ee(V(this.defect))(V(this.annotations)))}},Vb=e=>new To([new ic(e)]),Gu=l(e=>qu(e[0]),(e,t,r)=>t.mapUnsafe.size===0?e:new To(e.reasons.map(n=>n.annotate(t,r)))),fc=e=>e._tag===\"Fail\",lc=e=>e._tag===\"Die\",Zs=e=>e._tag===\"Interrupt\";function d6(e){return Jr(\"Effect.evaluate: Not implemented\")}var vn=e=>({...l6,[Jb]:e.op,[lt]:e[lt]??d6,[Gt]:e[Gt],[Tn]:e[Tn],[sc]:e[sc]}),Zn=e=>{let t=vn(e),r=function(n){this[xe]=n};return r.prototype=t,function(n){return new r(n)}},LO=e=>{let t={[oc]:oc,_tag:e.op,get[e.prop](){return this[xe]},...vn(e),toString(){return`${e.op}(${K(this[xe])})`},toJSON(){return{_id:\"Exit\",_tag:e.op,[e.prop]:this[xe]}},[ne](n){return Sp(n)&&n._tag===this._tag&&Z(this[xe],n[xe])},[re](){return Ee(Pe(e.op),V(this[xe]))}},r=function(n){this[xe]=n};return r.prototype=t,function(n){return new r(n)}},We=LO({op:\"Success\",prop:\"value\",[lt](e){let t=e.getCont(Gt);return t?t[Gt](this[xe],e,this):e.yieldWith(this)}}),Nh={key:\"effect/Cause/StackTrace\"},Zb={key:\"effect/Cause/InterruptorStackTrace\"},Nt=LO({op:\"Failure\",prop:\"cause\",[lt](e){let t=this[xe],r=!1;e.cache.stackFrame&&(t=Gu(t,{mapUnsafe:new Map([[Nh.key,e.cache.stackFrame]])}),r=!0);let n=e.getCont(Tn),o=e._interruptedCause;if(o&&e.interruptible){let s=!1;for(;n&&e.interruptible;)s||=Jb in n,n=e.getCont(Tn);s&&(t=ls(t.reasons.filter(a=>a._tag!==\"Fail\"))),t=Gb(t,o),r=!0}return n?n[Tn](t,e,r?void 0:this):e.yieldWith(r?Nt(t):this)}}),ko=e=>Nt(Ju(e)),Jr=e=>Nt(Vb(e)),se=Zn({op:\"WithFiber\",[lt](e){return this[xe](e)}}),$O=Zn({op:\"WithFiberSucceed\",[lt](e){let t=this[xe](e),r=e.getCont(Gt);return r?r[Gt](t,e):e.yieldWith(We(t))}}),m6=(function(){class e extends globalThis.Error{}let t=vn({op:\"YieldableError\",[lt](){return ko(this)}});return delete t.toString,Object.assign(e.prototype,t),e})(),Ip=(function(){let e=Symbol.for(\"effect/Data/Error/plainArgs\");return class extends m6{constructor(r){super(r?.message,r?.cause?{cause:r.cause}:void 0),r&&(Mh(this,r),Object.defineProperty(this,e,{value:r,enumerable:!1}))}toJSON(){return{...this[e],...this}}}})(),Ys=e=>{class t extends Ip{_tag=e}return t.prototype.name=e,t},yp=\"~effect/Cause/NoSuchElementError\",Uh=e=>A(e,yp),vo=class extends Ys(\"NoSuchElementError\"){[yp]=yp;constructor(t){super({message:t})}},cc=\"~effect/Cause/Done\",Dh=e=>A(e,cc),KO={[cc]:cc,_tag:\"Done\",value:void 0},pc=e=>e===void 0?KO:{[cc]:cc,_tag:\"Done\",value:e},h6=ko(KO),BO=e=>e===void 0?h6:ko(pc(e));var Lh=e=>vn({op:e.label,[lt]:e.evaluate});var ye={};An(ye,{Do:()=>Q6,all:()=>$6,andThen:()=>M6,as:()=>n_,asVoid:()=>R6,bind:()=>Y6,bindTo:()=>V6,composeK:()=>D6,contains:()=>J6,containsWith:()=>c_,exists:()=>G6,filter:()=>hc,filterMap:()=>j6,firstSomeOf:()=>O6,flatMap:()=>dc,flatMapNullishOr:()=>F6,flatten:()=>mc,fromIterable:()=>w6,fromNullOr:()=>oE,fromNullishOr:()=>vp,fromUndefinedOr:()=>nE,gen:()=>X6,getFailure:()=>C6,getOrElse:()=>Tp,getOrNull:()=>Zh,getOrThrow:()=>sE,getOrThrowWith:()=>Yh,getOrUndefined:()=>ps,getSuccess:()=>A6,isNone:()=>ge,isOption:()=>tf,isSome:()=>Ce,let:()=>Z6,lift2:()=>W6,liftNullishOr:()=>_6,liftPredicate:()=>q6,liftThrowable:()=>Oo,makeCombinerFailFast:()=>u_,makeEquivalence:()=>H6,makeOrder:()=>z6,makeReducer:()=>e4,makeReducerFailFast:()=>t4,map:()=>Vt,match:()=>Zt,none:()=>v,orElse:()=>T6,orElseResult:()=>k6,orElseSome:()=>v6,partitionMap:()=>B6,product:()=>s_,productMany:()=>L6,reduceCompact:()=>K6,some:()=>_,tap:()=>o_,toArray:()=>i_,toRefinement:()=>I6,void:()=>P6,zipLeft:()=>U6,zipRight:()=>N6,zipWith:()=>a_});function jO(e){return{combine:e}}function Qb(e,t,r){return{combine:e,initialValue:t,combineAll:r??(n=>{let o=t;for(let s of n)o=e(o,s);return o})}}var Kt=e=>(t,r)=>t===r||e(t,r),x6=(e,t)=>e===t,Wa=()=>x6;function WO(e){return Kt((t,r)=>{if(t.length!==r.length)return!1;for(let n=0;n<t.length;n++)if(!e[n](t[n],r[n]))return!1;return!0})}function Vu(e){return Kt((t,r)=>{if(t.length!==r.length)return!1;for(let n=0;n<t.length;n++)if(!e(t[n],r[n]))return!1;return!0})}var $h=e=>l(3,(t,r,n)=>e(t,o=>({...o,[r]:n(o)}))),Kh=e=>l(2,(t,r)=>e(t,n=>({[r]:n}))),Bh=(e,t)=>l(3,(r,n,o)=>t(r,s=>e(o(s),a=>({...s,[n]:a}))));var JO=\"~effect/Option\",GO={[JO]:{_A:e=>e},...kr,[Symbol.iterator](){return new Ha(this)}},g6=Object.defineProperty(Object.assign(Object.create(GO),{_tag:\"Some\",_op:\"Some\",[ne](e){return jh(e)&&Xb(e)&&Z(this.value,e.value)},[re](){return Ee(V(this._tag))(V(this.value))},toString(){return`some(${K(this.value)})`},toJSON(){return{_id:\"Option\",_tag:this._tag,value:qt(this.value)}}}),\"valueOrUndefined\",{get(){return this.value}}),y6=V(\"None\"),S6=Object.assign(Object.create(GO),{_tag:\"None\",_op:\"None\",valueOrUndefined:void 0,[ne](e){return jh(e)&&Hh(e)},[re](){return y6},toString(){return\"none()\"},toJSON(){return{_id:\"Option\",_tag:this._tag}}}),jh=e=>A(e,JO),Hh=e=>e._tag===\"None\",Xb=e=>e._tag===\"Some\",wp=Object.create(S6),VO=function(e){this.value=e};VO.prototype=g6;var Ap=e=>new VO(e);var YO=\"~effect/Result\",QO={[YO]:{_A:e=>e,_E:e=>e},...kr,[Symbol.iterator](){return new Ha(this)}},b6=Object.assign(Object.create(QO),{_tag:\"Success\",_op:\"Success\",[ne](e){return zh(e)&&Yu(e)&&Z(this.success,e.success)},[re](){return Ee(V(this._tag))(V(this.success))},toString(){return`success(${K(this.success)})`},toJSON(){return{_id:\"Result\",_tag:this._tag,value:qt(this.success)}}}),E6=Object.assign(Object.create(QO),{_tag:\"Failure\",_op:\"Failure\",[ne](e){return zh(e)&&Zu(e)&&Z(this.failure,e.failure)},[re](){return Ee(V(this._tag))(V(this.failure))},toString(){return`failure(${K(this.failure)})`},toJSON(){return{_id:\"Result\",_tag:this._tag,failure:qt(this.failure)}}}),zh=e=>A(e,YO),Zu=e=>e._tag===\"Failure\",Yu=e=>e._tag===\"Success\",XO=function(e){this.failure=e};XO.prototype=E6;var Wh=e=>new XO(e),e_=function(e){this.success=e};e_.prototype=b6;var qh=e=>new e_(e),eE=e=>Yu(e)?wp:Ap(e.failure),tE=e=>Zu(e)?wp:Ap(e.success);function qa(e){return(t,r)=>t===r?0:e(t,r)}var r_=qa((e,t)=>e<t?-1:1),Qs=qa((e,t)=>globalThis.Number.isNaN(e)&&globalThis.Number.isNaN(t)?0:globalThis.Number.isNaN(e)?-1:globalThis.Number.isNaN(t)?1:e<t?-1:1);var Qu=qa((e,t)=>e<t?-1:1);var rE=l(2,(e,t)=>qa((r,n)=>e(t(r),t(n)))),Xu=rE(Qs,e=>e.getTime());var Jh=e=>l(2,(t,r)=>e(t,r)===-1),ef=e=>l(2,(t,r)=>e(t,r)===1),Gh=e=>l(2,(t,r)=>e(t,r)!==1),Vh=e=>l(2,(t,r)=>e(t,r)!==-1);var v=()=>wp,_=Ap,tf=jh,ge=Hh,Ce=Xb,Zt=l(2,(e,{onNone:t,onSome:r})=>ge(e)?t():r(e.value)),I6=e=>t=>Ce(e(t)),w6=e=>{for(let t of e)return _(t);return v()},A6=tE,C6=eE,Tp=l(2,(e,t)=>ge(e)?t():e.value),T6=l(2,(e,t)=>ge(e)?t():e),v6=l(2,(e,t)=>ge(e)?_(t()):e),k6=l(2,(e,t)=>ge(e)?Vt(t(),qh):Vt(e,Wh)),O6=e=>{let t=v();for(t of e)if(Ce(t))return t;return t},vp=e=>e==null?v():_(e),nE=e=>e===void 0?v():_(e),oE=e=>e===null?v():_(e),_6=e=>(...t)=>vp(e(...t)),Zh=Tp(Mb),ps=Tp(Vn),Oo=e=>(...t)=>{try{return _(e(...t))}catch{return v()}},Yh=l(2,(e,t)=>{if(Ce(e))return e.value;throw t()}),sE=Yh(()=>new Error(\"getOrThrow called on a None\")),Vt=l(2,(e,t)=>ge(e)?v():_(t(e.value))),n_=l(2,(e,t)=>Vt(e,()=>t)),R6=n_(void 0),P6=_(void 0);var dc=l(2,(e,t)=>ge(e)?v():t(e.value)),M6=l(2,(e,t)=>dc(e,r=>{let n=qr(t)?t(r):t;return tf(n)?n:_(n)})),F6=l(2,(e,t)=>ge(e)?v():vp(t(e.value))),mc=dc(D),N6=l(2,(e,t)=>dc(e,()=>t)),U6=l(2,(e,t)=>o_(e,()=>t)),D6=l(2,(e,t)=>r=>dc(e(r),t)),o_=l(2,(e,t)=>dc(e,r=>Vt(t(r),()=>r))),s_=l(2,(e,t)=>Ce(e)&&Ce(t)?_([e.value,t.value]):v()),L6=l(2,(e,t)=>{if(ge(e))return v();let r=[e.value];for(let n of t){if(ge(n))return v();r.push(n.value)}return _(r)}),$6=e=>{if(Symbol.iterator in e){let r=[];for(let n of e){if(ge(n))return v();r.push(n.value)}return _(r)}let t={};for(let r of Object.keys(e)){let n=e[r];if(ge(n))return v();B(t,r,n.value)}return _(t)},a_=l(3,(e,t,r)=>Vt(s_(e,t),([n,o])=>r(n,o))),K6=l(3,(e,t,r)=>{let n=t;for(let o of e)Ce(o)&&(n=r(n,o.value));return n}),i_=e=>ge(e)?[]:[e.value],B6=l(2,(e,t)=>{if(ge(e))return[v(),v()];let r=t(e.value);return Zu(r)?[v(),_(r.failure)]:[_(r.success),v()]}),j6=l(2,(e,t)=>{if(ge(e))return v();let r=t(e.value);return Yu(r)?_(r.success):v()}),hc=l(2,(e,t)=>ge(e)?v():t(e.value)?_(e.value):v()),H6=e=>Kt((t,r)=>ge(t)?ge(r):ge(r)?!1:e(t.value,r.value)),z6=e=>qa((t,r)=>Ce(t)?Ce(r)?e(t.value,r.value):1:-1),W6=e=>l(2,(t,r)=>a_(t,r,e)),q6=l(2,(e,t)=>t(e)?_(e):v()),c_=e=>l(2,(t,r)=>ge(t)?!1:e(t.value,r)),J6=c_(xp()),G6=l(2,(e,t)=>ge(e)?!1:t(e.value)),V6=Kh(Vt),Z6=$h(Vt);var Y6=Bh(Vt,dc),Q6=_({}),X6=(...e)=>{let r=(e.length===1?e[0]:e[1].bind(e[0]))(),n=r.next();for(;!n.done;){let o=n.value;if(ge(o))return o;n=r.next(o.value)}return _(n.value)};function e4(e){return Qb((t,r)=>ge(t)?r:ge(r)?t:_(e.combine(t.value,r.value)),v())}function u_(e){return jO((t,r)=>ge(t)||ge(r)?v():_(e.combine(t.value,r.value)))}function t4(e){let t=u_(e).combine,r=_(e.initialValue);return Qb(t,r,n=>{let o=r;for(let s of n)if(o=t(o,s),ge(o))return o;return o})}var f_=\"~effect/Context/Service\",Et=function(){function e(){}let t=e;Object.setPrototypeOf(t,r4);let r=(n,o)=>(t.key=n,o?.defaultValue&&(t[iE]=iE,t.defaultValue=o.defaultValue),o?.make&&(t.make=o.make),o?.fiberCached&&l_.add(n),t);return arguments.length>0?r(arguments[0],arguments[1]):r},r4={[f_]:f_,...Lh({label:\"Service\",evaluate(e){return We(Me(e.context,this))}}),toJSON(){return{_id:\"Service\",key:this.key}},of(e){return e},context(e){return xc(this,e)},use(e){return se(t=>e(Me(t.context,this)))},useSync(e){return se(t=>We(e(Me(t.context,this))))}},l_=new Set,iE=\"~effect/Context/Reference\",p_=\"~effect/Context\",n4=8,Qh=(e,t,r,n,o)=>{let s=Object.create(s4);return s.cacheRoot=e??s,s.base=t,s.overlay=r,s.depth=n,s._flat=void 0,s.baseHits=0,s.maxDepth=o,s},cE=(e,t)=>{t&&(cE(e,t.parent),e.set(t.key,t.value))},d_=e=>{if(e._flat)return e._flat;if(!e.overlay)return e._flat=e.base;let t=new Map(e.base);return cE(t,e.overlay),e._flat=t},o4=(e,t)=>{let r=new Map(e.mapUnsafe);return t(r),Qh(void 0,r,void 0,0,e.maxDepth)},Xh=Symbol(),uE=(e,t)=>{let r=e;for(let o=r.overlay;o;o=o.parent)if(o.key===t)return o.value;let n=r.base.get(t);return n===void 0&&!r.base.has(t)?Xh:(r.overlay&&++r.baseHits>=r.base.size&&r.baseHits>=n4&&(r.base=d_(r),r.overlay=void 0,r.depth=0),n)},Xs=(e,t)=>{let r=t?.maxDepth;return Qh(void 0,e,void 0,0,Number.isInteger(r)&&r>=0?r:8)},s4={get mapUnsafe(){return d_(this)},...kr,[p_]:{_Services:e=>e},toJSON(){return{_id:\"Context\",services:Array.from(this.mapUnsafe).map(([e,t])=>({key:e,value:t}))}},[ne](e){if(!kp(e))return!1;let t=this.mapUnsafe,r=e.mapUnsafe;if(t.size!==r.size)return!1;for(let[n,o]of t)if(!r.has(n)||!Z(o,r.get(n)))return!1;return!0},[re](){return Lt(this.mapUnsafe.size)}},m_=(e,t)=>e.cacheRoot===t.cacheRoot,kp=e=>A(e,p_);var h_=e=>!!e[iE],Pr=()=>a4,a4=Xs(new Map),xc=(e,t)=>Xs(new Map([[e.key,t]])),dr=l(3,(e,t,r)=>i4(e,t.key,r)),i4=(e,t,r)=>{let n=e,o=l_.has(t)?void 0:n.cacheRoot;if(n.depth>=n.maxDepth){let s=new Map(n._flat??n.base);return n._flat||cE(s,n.overlay),s.set(t,r),Qh(o,s,void 0,0,n.maxDepth)}return Qh(o,n.base,{key:t,value:r,parent:n.overlay},n.depth+1,n.maxDepth)};var ex=l(2,(e,t)=>Op(e,t.key)),Op=(e,t)=>{let r=uE(e,t);return r===Xh?void 0:r},ds=l(2,(e,t)=>{let r=uE(e,t.key);if(r===Xh){if(h_(t))return x_(t);throw c4(t)}return r}),Me=ds,aE=\"~effect/Context/defaultValue\",x_=e=>aE in e?e[aE]:e[aE]=e.defaultValue(),c4=e=>{let t=new Error(`Service not found${e.key?`: ${String(e.key)}`:\"\"}`);if(t.stack){let r=t.stack.split(`\n`);r.splice(1,3),t.stack=r.join(`\n`)}return t},tx=l(2,(e,t)=>{let r=uE(e,t.key);return r!==Xh?_(r):h_(t)?_(x_(t)):v()}),rx=l(2,(e,t)=>e.mapUnsafe.size===0?t:t.mapUnsafe.size===0?e:o4(e,r=>t.mapUnsafe.forEach((n,o)=>r.set(o,n)))),g_=(...e)=>{let t=new Map;for(let r=0;r<e.length;r++)e[r].mapUnsafe.forEach((n,o)=>{t.set(o,n)});return Xs(t)};var Te=Et;var fE=e=>e.length>0;var It=e=>e>0?Math.floor(e):0,Xn=e=>Math.max(1,It(e));var j=qh,q=Wh;var lE=e=>{if(qr(e))try{return j(e())}catch(t){return q(t)}else try{return j(e.try())}catch(t){return q(e.catch(t))}};var y_=zh,ae=Zu,rt=Yu;var rf=l(2,(e,t)=>ae(e)?q(t(e.failure)):e),sr=l(2,(e,t)=>rt(e)?j(t(e.success)):e),mr=l(2,(e,{onFailure:t,onSuccess:r})=>ae(e)?t(e.failure):r(e.success));var _p=l(2,(e,t)=>ae(e)?t(e.failure):e.success);var f4=l(2,(e,t)=>{if(rt(e))return e.success;throw t(e.failure)}),ms=f4(D);var Yt=l(2,(e,t)=>ae(e)?q(e.failure):t(e.success));var pE=e=>{if(Symbol.iterator in e){let r=[];for(let n of e){if(ae(n))return n;r.push(n.success)}return j(r)}let t={};for(let r of Object.keys(e)){let n=e[r];if(ae(n))return n;B(t,r,n.success)}return j(t)};var S_=WO;var l4=(e,t)=>{let r=t?.length!==void 0?Xn(t.length):1/0;return{[Symbol.iterator](){let n=0;return{next(){return n<r?{value:e(n++),done:!1}:{done:!0,value:void 0}}}}}};var p4=l(2,(e,t)=>d4(l4(()=>e,{length:t}))),E_=e=>p4(e,1/0);var I_=e=>{let r=e[Symbol.iterator]().next();if(r.done)throw new Error(\"headUnsafe: empty iterable\");return r.value};var w_=l(2,(e,t)=>{let r=0;for(let n of e){let o=t(n,r);if(Th(o)){if(o)return _(n)}else if(Ce(o))return o;r++}return v()});var d4=e=>({[Symbol.iterator](){let t=e[Symbol.iterator](),r;function n(){for(;;){if(r===void 0){let s=t.next();if(s.done)return s;r=s.value[Symbol.iterator]()}let o=r.next();if(!o.done)return o;r=void 0}}return{next:n}}});var A_=l(2,(e,t)=>({[Symbol.iterator](){let r=e[Symbol.iterator](),n=0;return{next(){let o=r.next();for(;!o.done;){if(t(o.value,n++))return{done:!1,value:o.value};o=r.next()}return{done:!0,value:void 0}}}}}));var m4=l(2,(e,t)=>Object.hasOwn(e,t));var gc=l(2,(e,t)=>{let r={...e};for(let n of C_(e))B(r,n,t(e[n],n));return r});var C_=e=>Object.keys(e);var h4=e=>l(2,(t,r)=>{for(let n of C_(t))if(!m4(r,n)||!e(t[n],r[n]))return!1;return!0});var T_=e=>{let t=h4(e);return(r,n)=>t(r,n)&&t(n,r)};var nx=globalThis.Array;var ox=l(2,(e,t)=>{let r=Xn(e),n=new nx(r);for(let o=0;o<r;o++)n[o]=t(o);return n}),dE=(e,t)=>e<=t?ox(t-e+1,r=>e+r):[e];var wt=e=>nx.isArray(e)?e:nx.from(e);var sx=l(2,(e,t)=>[...e,t]),mE=l(2,(e,t)=>wt(e).concat(wt(t)));var v_=nx.isArray;var Mr=fE,yt=fE;function nf(e){let t=Number(e);return String(t)===e&&Number.isInteger(t)&&t>=0&&t<2**32-1}function x4(e,t){return!Number.isFinite(e)||e<0||e>=t.length}var k_=l(2,(e,t)=>{let r=Math.floor(t);if(x4(r,e))throw new Error(`Index out of bounds: ${r}`);return e[r]});var ax=e=>e[e.length-1];var hE=w_;var g4=(e,t)=>{let r=V(t),n=e.get(r);if(n===void 0)return e.set(r,[t]),!0;for(let o of n)if(Z(o,t))return!1;return n.push(t),!0};var Qt=()=>[],Oe=e=>[e],kn=l(2,(e,t)=>e.map(t));var O_=e=>{let t=[];for(let r of e)Ce(r)&&t.push(r.value);return t};var ix=l(2,(e,t)=>{let r=wt(e),n=[];for(let o=0;o<r.length;o++)t(r[o],o)&&n.push(r[o]);return n}),xE=l(2,(e,t)=>{let r=[],n=[],o=0;for(let s of e){let a=t(s,o++);rt(a)?r.push(a.success):n.push(a.failure)}return[r,n]});var __=Vu;var cx=e=>{let t=wt(e);if(t.length<2)return[...t];let r=new Map,n=[];for(let o of t)g4(r,o)&&n.push(o);return n};var fx=\"~effect/Duration\",ar=BigInt(0),U_=BigInt(1),y4=BigInt(2),S4=BigInt(10),R_=BigInt(24),ux=BigInt(60),lx=BigInt(1e3),ea=BigInt(1e6),sf=BigInt(1e9),px=BigInt(6e10),dx=BigInt(36e11),mx=BigInt(864e11),D_=BigInt(6048e11),L_=e=>BigInt(Math.sign(e)*Math.round(Math.abs(e))),yE=e=>Number.isInteger(e)?BigInt(e)*ea:L_(e*1e6),P_=e=>hr(Number.isFinite(e)?L_(e):e),$_=(e,t)=>{let r=Number(e);if(Number.isFinite(r))return r/t;let n=BigInt(t);return Number(e/n)+Number(e%n)/t},gE=(e,t)=>{let r=e.indexOf(\".\");if(r===-1)return BigInt(e)*t;let n=e[0]===\"-\",o=e.slice(r+1),s=S4**BigInt(o.length),a=(BigInt(e.slice(n?1:0,r))*s+BigInt(o))*t;return b4(n?-a:a,s)},b4=(e,t)=>{let r=e<ar?-e:e,n=r/t+(r%t*y4>=t?U_:ar);return e<ar?-n:n},of=(e,t)=>{let r=Number(e)*t;if(!Number.isFinite(r))return hr(r);let n=gE(e,BigInt(t)*ea);return hr(Number.isInteger(r)&&BigInt(r)*ea===n?r:n)};var E4=/^(-?\\d+(?:\\.\\d+)?)\\s+(nanos?|micros?|millis?|seconds?|minutes?|hours?|days?|weeks?)$/,ct=e=>{switch(typeof e){case\"number\":return na(e);case\"bigint\":return On(e);case\"string\":{if(e===\"Infinity\")return ra;if(e===\"-Infinity\")return af;let t=E4.exec(e);if(!t)break;let[r,n,o]=t;if(o===\"nano\"||o===\"nanos\")return On(gE(n,U_));if(o===\"micro\"||o===\"micros\")return On(gE(n,lx));switch(o){case\"milli\":case\"millis\":return of(n,1);case\"second\":case\"seconds\":return of(n,1e3);case\"minute\":case\"minutes\":return of(n,6e4);case\"hour\":case\"hours\":return of(n,36e5);case\"day\":case\"days\":return of(n,864e5);case\"week\":case\"weeks\":return of(n,6048e5)}break}case\"object\":{if(e===null)break;if(fx in e)return e;if(Array.isArray(e)){if(e.length!==2||!e.every(lp))return F_(e);if(Number.isNaN(e[0])||Number.isNaN(e[1]))return ta;if(e[0]===-1/0||e[1]===-1/0)return af;if(e[0]===1/0||e[1]===1/0)return ra;let s=e[0]*1e9+e[1];return Number.isFinite(s)&&Number.isInteger(e[0])&&Number.isInteger(e[1])?hr(BigInt(e[0])*sf+BigInt(e[1])):P_(s)}let t=e,r=0;if(t.weeks&&(r+=t.weeks*6048e5),t.days&&(r+=t.days*864e5),t.hours&&(r+=t.hours*36e5),t.minutes&&(r+=t.minutes*6e4),t.seconds&&(r+=t.seconds*1e3),t.milliseconds&&(r+=t.milliseconds),!t.microseconds&&!t.nanoseconds){if(!Number.isFinite(r))return hr(r);let s=M_(t);return s===void 0||BigInt(r)*ea===s?hr(r):hr(s)}let n=r*1e6+(t.microseconds??0)*1e3+(t.nanoseconds??0),o=Number.isFinite(n)?M_(t):void 0;return o===void 0?P_(n):hr(o)}}return F_(e)},Ga=e=>!e||Number.isInteger(e),M_=e=>{if(!Ga(e.weeks)||!Ga(e.days)||!Ga(e.hours)||!Ga(e.minutes)||!Ga(e.seconds)||!Ga(e.milliseconds)||!Ga(e.microseconds)||!Ga(e.nanoseconds))return;let t=ar;return e.weeks&&(t+=BigInt(e.weeks)*D_),e.days&&(t+=BigInt(e.days)*mx),e.hours&&(t+=BigInt(e.hours)*dx),e.minutes&&(t+=BigInt(e.minutes)*px),e.seconds&&(t+=BigInt(e.seconds)*sf),e.milliseconds&&(t+=BigInt(e.milliseconds)*ea),e.microseconds&&(t+=BigInt(e.microseconds)*lx),e.nanoseconds&&(t+=BigInt(e.nanoseconds)),t},F_=e=>{throw new Error(`Invalid Input: ${e}`)},K_=Oo(ct),N_={_tag:\"Millis\",millis:0},I4={_tag:\"Infinity\"},w4={_tag:\"NegativeInfinity\"},A4={[fx]:fx,[re](){switch(this.value._tag){case\"Millis\":return V(yE(this.value.millis));case\"Nanos\":return V(this.value.nanos);default:return mp(this.value)}},[ne](e){return Fp(e)&&T4(this,e)},toString(){switch(this.value._tag){case\"Infinity\":return\"Infinity\";case\"NegativeInfinity\":return\"-Infinity\";case\"Nanos\":return`${this.value.nanos} nanos`;case\"Millis\":return`${this.value.millis} millis`}},toJSON(){switch(this.value._tag){case\"Millis\":return{_id:\"Duration\",_tag:\"Millis\",millis:this.value.millis};case\"Nanos\":return{_id:\"Duration\",_tag:\"Nanos\",nanos:String(this.value.nanos)};case\"Infinity\":return{_id:\"Duration\",_tag:\"Infinity\"};case\"NegativeInfinity\":return{_id:\"Duration\",_tag:\"NegativeInfinity\"}}},[Je](){return this.toJSON()},pipe(){return te(this,arguments)}},hr=e=>{let t=Object.create(A4);return typeof e==\"number\"?isNaN(e)||e===0||Object.is(e,-0)?t.value=N_:Number.isFinite(e)?Number.isInteger(e)?t.value={_tag:\"Millis\",millis:e}:t.value={_tag:\"Nanos\",nanos:yE(e)}:t.value=e>0?I4:w4:e===ar?t.value=N_:t.value={_tag:\"Nanos\",nanos:e},t},Fp=e=>A(e,fx),sn=e=>e.value._tag!==\"Infinity\"&&e.value._tag!==\"NegativeInfinity\",Sc=e=>{switch(e.value._tag){case\"Millis\":return e.value.millis===0;case\"Nanos\":return e.value.nanos===ar;case\"Infinity\":case\"NegativeInfinity\":return!1}},hx=e=>{switch(e.value._tag){case\"Millis\":return e.value.millis<0;case\"Nanos\":return e.value.nanos<ar;case\"NegativeInfinity\":return!0;case\"Infinity\":return!1}};var C4=e=>{switch(e.value._tag){case\"Infinity\":case\"NegativeInfinity\":return ra;case\"Millis\":return e.value.millis<0?hr(-e.value.millis):e;case\"Nanos\":return e.value.nanos<ar?hr(-e.value.nanos):e}};var ta=hr(0),ra=hr(1/0),af=hr(-1/0),On=e=>hr(e);var na=e=>hr(e),cf=e=>hr(e*1e3);var Nr=e=>j_(ct(e),{onMillis:D,onNanos:t=>$_(t,1e6),onInfinity:()=>1/0,onNegativeInfinity:()=>-1/0}),hs=e=>j_(ct(e),{onMillis:t=>t/1e3,onNanos:t=>$_(t,1e9),onInfinity:()=>1/0,onNegativeInfinity:()=>-1/0});var yc=e=>{let t=ct(e);switch(t.value._tag){case\"Infinity\":case\"NegativeInfinity\":throw new Error(\"Cannot convert infinite duration to nanos\");case\"Nanos\":return t.value.nanos;case\"Millis\":return yE(t.value.millis)}},B_=Oo(yc);var j_=l(2,(e,t)=>{switch(e.value._tag){case\"Millis\":return t.onMillis(e.value.millis);case\"Nanos\":return t.onNanos(e.value.nanos);case\"Infinity\":return t.onInfinity();case\"NegativeInfinity\":return(t.onNegativeInfinity??t.onInfinity)()}}),H_=l(3,(e,t,r)=>e.value._tag===\"Infinity\"||e.value._tag===\"NegativeInfinity\"||t.value._tag===\"Infinity\"||t.value._tag===\"NegativeInfinity\"?r.onInfinity(e,t):e.value._tag===\"Millis\"?t.value._tag===\"Millis\"?r.onMillis(e.value.millis,t.value.millis):r.onNanos(yc(e),t.value.nanos):r.onNanos(e.value.nanos,yc(t)));var z_=(e,t)=>H_(e,t,{onMillis:(r,n)=>r===n,onNanos:(r,n)=>r===n,onInfinity:(r,n)=>r.value._tag===n.value._tag});var W_=l(2,(e,t)=>H_(e,t,{onMillis:(r,n)=>hr(r-n),onNanos:(r,n)=>hr(r-n),onInfinity:(r,n)=>{let o=r.value._tag,s=n.value._tag;return o===\"Infinity\"?s===\"Infinity\"?ta:ra:o===\"NegativeInfinity\"?s===\"NegativeInfinity\"?ta:af:s===\"Infinity\"?af:ra}}));var T4=l(2,(e,t)=>z_(e,t)),v4=e=>{if(e.value._tag===\"Infinity\")return{days:1/0,hours:1/0,minutes:1/0,seconds:1/0,millis:1/0,nanos:1/0};if(e.value._tag===\"NegativeInfinity\")return{days:-1/0,hours:-1/0,minutes:-1/0,seconds:-1/0,millis:-1/0,nanos:-1/0};let t=yc(e),r=t<ar,n=r?-t:t,o=n/ea,s=o/lx,a=s/ux,i=a/ux,c=i/R_,u=r?-1:1;return{days:u*Number(c),hours:u*Number(i%R_),minutes:u*Number(a%ux),seconds:u*Number(s%ux),millis:u*Number(o%lx),nanos:u*Number(n%ea)}},SE=e=>{if(e.value._tag===\"Infinity\")return\"Infinity\";if(e.value._tag===\"NegativeInfinity\")return\"-Infinity\";if(Sc(e))return\"0\";if(hx(e))return\"-\"+SE(C4(e));let t=v4(e),r=[];return t.days!==0&&r.push(`${t.days}d`),t.hours!==0&&r.push(`${t.hours}h`),t.minutes!==0&&r.push(`${t.minutes}m`),t.seconds!==0&&r.push(`${t.seconds}s`),t.millis!==0&&r.push(`${t.millis}ms`),t.nanos!==0&&r.push(`${t.nanos}ns`),r.join(\" \")},q_=e=>{if(!sn(e))return v();let t=yc(e),r=t<ar?-t:t,n=r/mx,o=r%mx/dx,s=r%dx/px,a=r%px/sf,i=r%sf,c=\"\";o!==ar&&(c+=`${o}H`),s!==ar&&(c+=`${s}M`),i!==ar?c+=`${a}.${i.toString().padStart(9,\"0\").replace(/0+$/,\"\")}S`:a!==ar&&(c+=`${a}S`);let u=t<ar?\"-P\":\"P\";return n!==ar&&(u+=`${n}D`),c!==\"\"&&(u+=`T${c}`),_(u===\"P\"?\"PT0S\":u)},k4=/^([+-])?P(?!$)(?:(\\d+)W)?(?:(\\d+)D)?(?:T(?!$)(?:(\\d+)(?:[.,](\\d{1,9}))?H)?(?:(\\d+)(?:[.,](\\d{1,9}))?M)?(?:(\\d+)(?:[.,](\\d{1,9}))?S)?)?$/,Mp=(e,t,r)=>(e===void 0?ar:BigInt(e)*r)+(t===void 0?ar:BigInt(t.padEnd(9,\"0\"))*(r/sf)),J_=e=>{let t=k4.exec(e);if(t===null)return v();let[,r,n,o,s,a,i,c,u,f]=t;if(a!==void 0&&(i!==void 0||u!==void 0)||c!==void 0&&u!==void 0)return v();let p=Mp(n,void 0,D_)+Mp(o,void 0,mx)+Mp(s,a,dx)+Mp(i,c,px)+Mp(u,f,sf),d=r===\"-\"?-p:p,m=Number(d/ea);return _(d%ea===ar&&Number.isSafeInteger(m)?na(m):On(d))};var bE=l(2,(e,t)=>r=>{let n=e(r);if(ae(n))return q(r);let o=t(n.success);return ae(o)?q(r):o}),G_=e=>t=>{let r=e(t);return ae(r)?v():_(r.success)};var uf=Te(\"effect/Scheduler\",{fiberCached:!0,defaultValue:()=>new bc}),Z_=e=>{let t=!1;return Promise.resolve().then(()=>{t||e()}),()=>{t=!0}},O4=\"setImmediate\"in globalThis?e=>{let t=globalThis.setImmediate(e);return()=>globalThis.clearImmediate(t)}:e=>{let t=setTimeout(e,0);return()=>clearTimeout(t)},Y_=e=>{try{return O4(e)}catch{return Z_(e)}},EE=class{buckets=[];scheduleTask(t,r){let n=this.buckets,o=n.length,s,a=0;for(;a<o&&!(n[a][0]>r);a++)s=n[a];s&&s[0]===r?s[1].push(t):a===o?n.push([r,[t]]):n.splice(a,0,[r,[t]])}drain(){let t=this.buckets;return this.buckets=[],t}},bc=class{executionMode;setImmediate;constructor(t=\"async\",r){this.executionMode=t,this.setImmediate=r??(t===\"sync\"?Z_:Y_)}shouldYield(t){return t.currentOpCount>=t.cache.maxOpsBeforeYield}makeDispatcher(){return new IE(this.setImmediate)}},IE=class{tasks=new EE;running=void 0;setImmediate;constructor(t=Y_){this.setImmediate=t}scheduleTask(t,r){this.tasks.scheduleTask(t,r),this.running===void 0&&(this.running=this.setImmediate(this.afterScheduled))}afterScheduled=()=>{this.running=void 0,this.runTasks()};runTasks(){let t=this.tasks.drain();for(let r=0;r<t.length;r++){let n=t[r][1];for(let o=0;o<n.length;o++)n[o]()}}flush(){for(;this.tasks.buckets.length>0;)this.running!==void 0&&(this.running(),this.running=void 0),this.runTasks()}},Q_=Te(\"effect/Scheduler/MaxOpsBeforeYield\",{fiberCached:!0,defaultValue:()=>2048}),X_=Te(\"effect/Scheduler/PreventSchedulerYield\",{fiberCached:!0,defaultValue:()=>!1});var an={};An(an,{Class:()=>xx,Error:()=>Np,TaggedClass:()=>_4,TaggedError:()=>Ut,taggedEnum:()=>R4});var xx=class extends ja{constructor(e){super(),e&&Mh(this,e)}},_4=e=>class extends xx{_tag=e},R4=()=>new Proxy({},{get(e,t,r){return t===\"$is\"?Wt:t===\"$match\"?P4:n=>({...n,_tag:t})}});function P4(){if(arguments.length===1){let r=arguments[0];return function(n){return r[n._tag](n)}}let e=arguments[0];return arguments[1][e._tag](e)}var Np=Ip,Ut=Ys;var eR=\"~effect/encoding/EncodingError\",to=class extends Ut(\"EncodingError\"){[eR]=eR};var gx=e=>tR(typeof e==\"string\"?U4.encode(e):e),AE=e=>{switch(e){case 16:return F4();case 32:return N4();default:{let t=\"\";for(let r=e>>>3;r>0;r--)t+=M4();return t}}},ce=Uint8Array.from(\"0123456789abcdef\",e=>e.charCodeAt(0)),Ec=()=>Math.random()*4294967296>>>0,M4=()=>{let e=Ec();return String.fromCharCode(ce[e>>>28],ce[e>>>24&15],ce[e>>>20&15],ce[e>>>16&15],ce[e>>>12&15],ce[e>>>8&15],ce[e>>>4&15],ce[e&15])},F4=()=>{let e=Ec(),t=Ec();return String.fromCharCode(ce[e>>>28],ce[e>>>24&15],ce[e>>>20&15],ce[e>>>16&15],ce[e>>>12&15],ce[e>>>8&15],ce[e>>>4&15],ce[e&15],ce[t>>>28],ce[t>>>24&15],ce[t>>>20&15],ce[t>>>16&15],ce[t>>>12&15],ce[t>>>8&15],ce[t>>>4&15],ce[t&15])},N4=()=>{let e=Ec(),t=Ec(),r=Ec(),n=Ec();return String.fromCharCode(ce[e>>>28],ce[e>>>24&15],ce[e>>>20&15],ce[e>>>16&15],ce[e>>>12&15],ce[e>>>8&15],ce[e>>>4&15],ce[e&15],ce[t>>>28],ce[t>>>24&15],ce[t>>>20&15],ce[t>>>16&15],ce[t>>>12&15],ce[t>>>8&15],ce[t>>>4&15],ce[t&15],ce[r>>>28],ce[r>>>24&15],ce[r>>>20&15],ce[r>>>16&15],ce[r>>>12&15],ce[r>>>8&15],ce[r>>>4&15],ce[r&15],ce[n>>>28],ce[n>>>24&15],ce[n>>>20&15],ce[n>>>16&15],ce[n>>>12&15],ce[n>>>8&15],ce[n>>>4&15],ce[n&15])},CE=e=>{let t=new TextEncoder().encode(e);if(t.length%2!==0)return q(new to({module:\"Hex\",kind:\"Decode\",input:e,message:`Length must be a multiple of 2, but is ${t.length}`}));try{let r=t.length/2,n=new Uint8Array(r);for(let o=0;o<r;o++){let s=rR(t[o*2]),a=rR(t[o*2+1]);n[o]=s<<4|a}return j(n)}catch(r){return q(new to({module:\"Hex\",kind:\"Decode\",input:e,message:r instanceof Error?r.message:\"Invalid input\"}))}},nR=e=>sr(CE(e),t=>D4.decode(t)),U4=new TextEncoder,D4=new TextDecoder,L4=Array.from({length:256},(e,t)=>t.toString(16).padStart(2,\"0\")),tR=e=>{let t=\"\";for(let r=0;r<e.length;r++)t+=L4[e[r]];return t},rR=e=>{if(48<=e&&e<=57)return e-48;if(97<=e&&e<=102)return e-97+10;if(65<=e&&e<=70)return e-65+10;throw new TypeError(\"Invalid input\")};var kE=\"effect/Tracer/ParentSpan\",Ic=class extends Et()(kE,{fiberCached:!0}){},$4=e=>e;var yx=Te(\"effect/Tracer/DisablePropagation\",{defaultValue:ap}),oR=Te(\"effect/Tracer/CurrentTraceLevel\",{defaultValue:()=>\"Info\"}),sR=Te(\"effect/Tracer/MinimumTraceLevel\",{defaultValue:()=>\"All\"}),OE=\"effect/Tracer\",_E=Te(OE,{fiberCached:!0,defaultValue:()=>RE}),RE=$4({span:e=>new vE(e)}),vE=class{_tag=\"Span\";sampled;name;parent;annotations;links;startTime;kind;status;_traceId=void 0;_spanId=void 0;_attributes=void 0;_events=void 0;constructor(t){this.name=t.name,this.parent=t.parent,this.annotations=t.annotations,this.links=t.links,this.startTime=t.startTime,this.kind=t.kind,this.sampled=t.sampled,this.status={_tag:\"Started\",startTime:t.startTime}}get traceId(){return this._traceId??=ps(this.parent)?.traceId??AE(32)}get spanId(){return this._spanId??=AE(16)}get attributes(){return this._attributes??=new Map}get events(){return this._events??=[]}end(t,r){this.status._tag!==\"Ended\"&&(this.status={_tag:\"Ended\",endTime:t,exit:r,startTime:this.status.startTime})}attribute(t,r){this.status._tag!==\"Ended\"&&this.attributes.set(t,r)}event(t,r,n){this.status._tag!==\"Ended\"&&this.events.push([t,r,n??{}])}addLinks(t){this.status._tag!==\"Ended\"&&this.links.push(...t)}};var iR=\"effect/Metric/FiberRuntimeMetrics\";var cR=Te(\"effect/ErrorReporter/CurrentErrorReporters\",{defaultValue:()=>new Set}),Up=Te(\"effect/References/CurrentStackFrame\",{fiberCached:!0,defaultValue:Vn}),Sx=Te(\"effect/References/TracerEnabled\",{fiberCached:!0,defaultValue:Cn}),wc=Te(\"effect/References/TracerTimingEnabled\",{defaultValue:Cn}),Dp=Te(\"effect/References/TracerSpanAnnotations\",{defaultValue:()=>({})}),Lp=Te(\"effect/References/TracerSpanLinks\",{defaultValue:()=>[]}),oa=Te(\"effect/References/CurrentLogAnnotations\",{defaultValue:()=>({})}),PE=Te(\"effect/References/CurrentLogLevel\",{fiberCached:!0,defaultValue:()=>\"Info\"}),ME=Te(\"effect/References/MinimumLogLevel\",{fiberCached:!0,defaultValue:()=>\"Info\"}),FE=Te(\"effect/References/UnhandledLogLevel\",{defaultValue:()=>\"Error\"}),bx=Te(\"effect/References/CurrentLogSpans\",{defaultValue:()=>[]});var Va=e=>{if(e?.captureStackTrace===!1)return e;if(e?.captureStackTrace!==void 0&&typeof e.captureStackTrace!=\"boolean\")return e;let t=Co();if(t===0&&e?.captureStackTrace!==!0)return{...e,captureStackTrace:!1};pr(3);let r=new Error;return pr(t),{...e,captureStackTrace:j4(()=>r.stack)}},NE=e=>t=>{let r;return()=>{if(r!==void 0)return r;let n=t();if(!n)return;let o=n.split(`\n`);if(o[e]!==void 0)return r=o[e].trim(),r}},j4=NE(3);var Ex=class extends Wu{constructor(t,r=bp){super(\"Interrupt\",r,\"Interrupted\"),this.fiberId=t}toString(){return`Interrupt(${this.fiberId})`}toJSON(){return{_tag:\"Interrupt\",fiberId:this.fiberId}}[ne](t){return Zs(t)&&this.fiberId===t.fiberId&&this.annotations===t.annotations}[re](){return Pe(`${this._tag}:${this.fiberId}`)}},xR=e=>new Ex(e),Ya=e=>new To([new Ex(e)]),kx=e=>e.reasons.some(fc),gR=e=>{let t=e.reasons.find(fc);return t?j(t):q(e)},mf=e=>{for(let t=0;t<e.reasons.length;t++){let r=e.reasons[t];if(r._tag===\"Fail\")return j(r.error)}return q(e)},yR=G_(mf),hf=e=>e.reasons.some(lc),Ox=e=>hf(e)&&kx(e)?ls(e.reasons.map(t=>t._tag===\"Fail\"&&!Dh(t.error)?new ic(t.error,t.annotations):t)):e,cn=e=>hf(e)?q(Ox(e)):mf(e),SR=e=>{let t=e.reasons.find(lc);return t?j(t):q(e)},Gp=e=>{let t=e.reasons.find(lc);return t?j(t.defect):q(e)},_x=e=>e.reasons.some(Zs),bR=e=>{let t=e.reasons.find(Zs);return t?j(t):q(e)},Rx=e=>{let t;for(let r=0;r<e.reasons.length;r++){let n=e.reasons[r];n._tag===\"Interrupt\"&&(t??=new Set,n.fiberId!==void 0&&t.add(n.fiberId))}return t?j(t):q(e)},ER=e=>{let t=Rx(e);return ae(t)?H4:t.success},H4=new Set,Px=e=>e.reasons.length>0&&e.reasons.every(Zs),IR=e=>Xs(e.annotations),wR=e=>{let t=new Map;for(let r of e.reasons)if(r.annotations.size>0)for(let[n,o]of r.annotations)t.set(n,o);return Xs(t)},xf=l(2,(e,t)=>{let r=!1,n=e.reasons.map(o=>fc(o)?(r=!0,new ac(t(o.error),o.annotations)):o);return r?ls(n):e}),Mx=e=>{let t;for(let r of e.reasons){if(r._tag===\"Fail\")return r.error;r._tag===\"Die\"&&(t??=r)}return t!==void 0?t.defect:e.reasons.length>0?new globalThis.Error(\"All fibers interrupted without error\"):new globalThis.Error(\"Empty cause\")},qE=(e,t)=>{let r=[],n=[];if(e.reasons.length===0)return r;let o=Co();o!==0&&pr(1);try{for(let s of e.reasons){if(s._tag===\"Interrupt\"){n.push(s);continue}r.push(DE(s._tag===\"Die\"?s.defect:s.error,s.annotations,t))}if(r.length===0){let s=new Error(\"The fiber was interrupted by:\");s.name=\"InterruptCause\",s.stack=J4(s,n);let a=new globalThis.Error(\"All fibers interrupted without error\",{cause:s});a.name=\"InterruptError\",a.stack=`${a.name}: ${a.message}`,r.push(DE(a,n[0].annotations,t))}}finally{o!==0&&pr(o)}return r},DE=(e,t,r,n=new Set)=>{let o=typeof e,s;if(e&&o===\"object\"){n.add(e);let a=e.cause;if(s=new globalThis.Error(z4(e),{cause:a!==void 0&&!n.has(a)?DE(a,void 0,void 0,n):void 0}),typeof e.name==\"string\"&&(s.name=e.name),typeof e.stack==\"string\")s.stack=q4(e.stack,s,t);else{let i=`${s.name}: ${s.message}`;s.stack=t?LE(i,t):i}r?.includeCauseInStack&&(s.stack=CR(s));for(let i of Object.keys(e))i in s||(s[i]=e[i])}else{s=new globalThis.Error(e?o===\"string\"?e:nc(e):`Unknown error: ${e}`);let a=`${s.name}: ${s.message}`;s.stack=t?LE(a,t):a}return s},z4=e=>{if(typeof e.message==\"string\")return e.message;if(typeof e.toString==\"function\"&&e.toString!==Object.prototype.toString&&e.toString!==Array.prototype.toString)try{return e.toString()}catch{}return nc(e)},W4=/\\((.*)\\)/g,q4=(e,t,r)=>{let n=`${t.name}: ${t.message}`,o=(e.startsWith(n)?e.slice(n.length):e).split(`\n`),s=[n];for(let a=1;a<o.length&&!/Generator\\.next|~effect\\/(?:Effect|Utils)/.test(o[a]);a++)s.push(o[a]);return r?LE(s.join(`\n`),r):s.join(`\n`)},LE=(e,t)=>{let r=t?.get(Nh.key);return r&&(e=`${e}\n${AR(r)}`),e},J4=(e,t)=>{let r=[`${e.name}: ${e.message}`];for(let n of t){let o=n.fiberId!==void 0?`#${n.fiberId}`:\"unknown\",s=n.annotations.get(Zb.key);r.push(`    at fiber (${o})`),s&&r.push(AR(s))}return r.join(`\n`)},AR=e=>{let t=[],r=e,n=0;for(;r&&n<10;){let o=r.stack();if(o){let s=o.matchAll(W4),a=!1;for(let[,i]of s)a=!0,t.push(`    at ${r.name} (${i})`);a||t.push(`    at ${r.name} (${o.replace(/^at /,\"\")})`)}else t.push(`    at ${r.name}`);r=r.parent,n++}return t.join(`\n`)},Fx=e=>qE(e).map(CR).join(`\n`),CR=e=>e.cause?`${e.stack} {\n${TR(e.cause,\"  \")}\n}`:e.stack,TR=(e,t)=>{let r=e.stack.split(`\n`),n=`${t}[cause]: ${r[0]}`;for(let o=1,s=r.length;o<s;o++)n+=`\n${t}${r[o]}`;return e.cause&&(n+=` {\n${TR(e.cause,`${t}  `)}\n${t}}`),n},JE=\"~effect/Fiber\",G4={_A:D,_E:D},V4={id:0},uR=(()=>{try{return globalThis.process?.getBuiltinModule?.(\"node:async_hooks\")?.AsyncResource}catch{return}})(),vR=()=>uR===void 0?void 0:new uR(\"effect/Fiber\"),sa=()=>globalThis[rc],ff=class{constructor(t,r=!0){this.setContext(t),this.id=++V4.id,this.currentOpCount=0,this.interruptible=r,this._stack=[],this._observers=void 0,this._exit=void 0,this._children=void 0,this._interruptedCause=void 0,this._yielded=void 0,this._running=!1,this._deferredInterrupt=!1,this._parent=void 0,this._asyncContext=void 0,this.cache.runtimeMetrics?.recordFiberStart(this.context)}get[JE](){return G4}get currentDispatcher(){return this._dispatcher??=this.cache.scheduler.makeDispatcher()}getRef(t){return Me(this.context,t)}addObserver(t){return this._exit?(t(this._exit),zr):(this._observers===void 0?this._observers=[t]:this._observers.push(t),()=>this.removeObserver(t))}removeObserver(t){if(this._exit||this._observers===void 0)return;let r=this._observers.indexOf(t);r>=0&&this._observers.splice(r,1)}interruptUnsafe(t,r){if(this._exit)return;let n=Ya(t);this.cache.stackFrame&&(n=Gu(n,xc(Nh,this.cache.stackFrame))),r&&(n=Gu(n,r)),this._interruptedCause=this._interruptedCause?Gb(this._interruptedCause,n):n,this.interruptible&&(this._running?this._deferredInterrupt=!0:this.evaluate(Le(this._interruptedCause)))}pollUnsafe(){return this._exit}evaluate(t){if(this._exit)return;if(this._asyncContext!==void 0){let s=this._asyncContext;this._asyncContext=void 0;try{return s.runInAsyncScope(this.evaluate,this,t)}finally{s.emitDestroy()}}else if(this._yielded!==void 0){let s=this._yielded;this._yielded=void 0,s()}let r=this.runLoop(t);if(r===uc){this._asyncContext=vR();return}let n=$E.interruptChildren&&$E.interruptChildren(this);if(n!==void 0)return this.evaluate(oe(n,()=>r));if(this._exit=r,this.cache.runtimeMetrics?.recordFiberEnd(this.context,this._exit),this._parent&&(this._parent._children?.delete(this),this._parent=void 0),this._observers!==void 0){let s=this._observers;this._observers=void 0;for(let a=0;a<s.length;a++)s[a](r)}this._stack.length=0,this._children=void 0,this.context=Pr();let o=this.cache;(o.span!==void 0||o.stackFrame!==void 0)&&(this.cache={...o,span:void 0,stackFrame:void 0})}runLoop(t){let r=globalThis[rc];globalThis[rc]=this;let n=this._running;this._running=!0;let o=!1,s=t;this.currentOpCount=0;try{for(;;)try{this._deferredInterrupt&&(this._deferredInterrupt=!1,s=Le(this._interruptedCause)),this.currentOpCount++;let a=this.cache;if(!o&&!a.preventYield&&a.scheduler.shouldYield(this)){o=!0;let i=s;s=oe(yf,()=>i)}if(s=a.tracerContext?a.tracerContext(s,this):s[lt](this),s===uc){let i=this._yielded;if(oc in i)return this._deferredInterrupt=!1,this._yielded=void 0,i;if(this._deferredInterrupt){this._yielded=void 0,i();continue}return uc}}catch(a){if(!A(s,lt))return Jr(`Fiber.runLoop: Not a valid effect: ${String(s)}`);s=Jr(a)}}finally{this._running=n,globalThis[rc]=r}}getCont(t){if(this._deferredInterrupt)return this._deferredInterrupt=!1,Y4;for(;;){let r=this._stack.pop();if(!r)return;let n=r[sc];if(n!==void 0){let o=n.call(r,this);if(o)return o[t]=o,o}if(r[t])return r}}succeedWith(t){if((++this.currentOpCount&Q4-1)===0)return We(t);let r=this.getCont(Gt);return r?r[Gt](t,this):this.yieldWith(We(t))}yieldWith(t){return this._yielded=t,uc}children(){return this._children??=new Set}pipe(){return te(this,arguments)}setContext(t){let r=this.context;if(this.context=t,r!==void 0&&m_(r,t))return;let n=t.cacheRoot,o=n._fiberCache??=Z4(t);this.cache?.scheduler!==o.scheduler&&(this._dispatcher=void 0),this.cache=o}get currentSpanLocal(){let t=this.cache.span;return t?._tag===\"Span\"?t:void 0}},Z4=e=>{let t=Op(e,OE);return{scheduler:Me(e,uf),tracer:t,tracerContext:t?t.context:void 0,tracerEnabled:Me(e,Sx),span:Op(e,kE),logLevel:Me(e,PE),minimumLogLevel:Me(e,ME),stackFrame:Me(e,Up),runtimeMetrics:Op(e,iR),maxOpsBeforeYield:Me(e,Q_),preventYield:Me(e,X_)}},Y4={[Gt](e,t){return Le(t._interruptedCause)},[Tn](e,t){return Le(t._interruptedCause)}},Q4=32,$E={interruptChildren:void 0},Nx=e=>{if(!e.cache.stackFrame)return;let t=new Map;return t.set(Zb.key,e.cache.stackFrame),Xs(t)},X4=e=>{if(!(e._children===void 0||e._children.size===0))return lf(e._children)},GE=e=>{let t=e;return t._exit?z(t._exit):Dt(r=>t._exit?r(z(t._exit)):X(e.addObserver(n=>r(z(n)))))},Ux=e=>Dt(t=>{let r=e[Symbol.iterator](),n=[],o;function s(){let a=r.next();for(;!a.done;){if(a.value._exit){n.push(a.value._exit),a=r.next();continue}o=a.value.addObserver(i=>{n.push(i),s()});return}t(z(n))}return s(),X(()=>o?.())}),Ix=e=>{let t=e;return t._exit?t._exit:Dt(r=>t._exit?r(t._exit):X(e.addObserver(r)))},kR=e=>Dt(t=>{let r=Array.from(e);if(r.length===0)return t(z(Qt()));let n=new Array(r.length),o=Qt(),s=()=>{for(let c=0;c<o.length;c++)r[c].removeObserver(o[c])},a=0,i=!1;for(let c=0;c<r.length&&!i;c++){let u=f=>{if(a++,f._tag===\"Failure\")return i=!0,s(),t(f);n[c]=f.value,a===r.length&&t(z(n))};o.push(u),r[c].addObserver(u)}return X(()=>{i=!0,s()})}),Dx=e=>se(t=>OR(e,t.id)),OR=l(e=>A(e[0],JE),(e,t,r)=>se(n=>{let o=Nx(n);return o=o&&r?rx(o,r):o??r,e.interruptUnsafe(t,o),Zp(GE(e))})),lf=e=>se(t=>{let r=Nx(t),n=Qt();for(let o of e)o.interruptUnsafe(t.id,r),n.push(o);return Zp(Ux(n))});var z=We,Le=Nt,dt=ko,X=Zn({op:\"Sync\",[lt](e){let t=this[xe],r=t(),n=e.getCont(Gt);return n?n[Gt](r,e):e.yieldWith(We(r))}}),be=Zn({op:\"Suspend\",[lt](e){let t=this[xe];return t()}}),VE=l(e=>e.length>=2||tf(e[0]),(e,t)=>ge(e)?t?QE(t):dt(new vo(\"Effect.fromOption: Option.none\")):z(e.value)),gf=mr({onFailure:dt,onSuccess:z}),_R=e=>e==null?dt(new vo):z(e),ZE=Zn({op:\"Yield\",[lt](e){let t=!1;return e.currentDispatcher.scheduleTask(()=>{t||e.evaluate(Ur)},this[xe]??0),e.yieldWith(()=>{t=!0})}}),yf=ZE(0),YE=e=>z(_(e)),Tc=z(v()),RR=e=>ge(e)?Tc:Fe(e.value,_),PR=e=>be(()=>Le(e())),Qa=e=>Jr(e),QE=e=>be(()=>dt(e())),Se=z(void 0);var MR=e=>{let t=typeof e==\"function\"?e:e.try,r=typeof e==\"function\"?n=>new df(n,\"An error occurred in Effect.try\"):e.catch;return be(()=>{try{return z(t())}catch(n){return dt(r(n))}})};var XE=e=>eI(function(t,r){e(r).then(n=>t(z(n)),n=>t(Qa(n)))},e.length!==0),FR=e=>{let t=typeof e==\"function\"?e:e.try,r=typeof e==\"function\"?n=>new df(n,\"An error occurred in Effect.tryPromise\"):e.catch;return eI(function(n,o){let s=a=>be(()=>{try{return dt(za(()=>r(a)))}catch(i){return Qa(i)}});try{t(o).then(a=>n(z(a)),a=>n(s(a)))}catch(a){n(s(a))}},t.length!==0)},e3=e=>se(t=>e(t.id)),NR=se(z),UR=e3(z),eI=(function(){let e=vn({op:\"Async\",[lt](r){let n=!1,o=!1,s=this.withSignal?new AbortController:void 0,a=this.register.call(r.cache.scheduler,i=>{n||(n=!0,o?r.evaluate(i):o=i)},s?.signal);return o!==!1?o:(o=!0,r.yieldWith(()=>{n=!0}),s===void 0&&a===void 0?uc:(r._stack.push(t3(()=>(n=!0,s?.abort(),a??Ur))),uc))}}),t=function(r,n){this.register=r,this.withSignal=n};return t.prototype=e,function(r,n){return new t(r,n)}})(),t3=Zn({op:\"AsyncFinalizer\",[sc](e){e.interruptible&&(e.interruptible=!1,e._stack.push(od))},[Tn](e,t){return _x(e)?oe(jP(Nt(e),this[xe]()),()=>Le(e)):Le(e)}}),Dt=e=>eI(e,e.length>=2),Lx=Dt(zr),DR=(...e)=>{if(e.length===1){let n=e[0];return be(()=>Cc(n()))}let[t,r]=e;return be(()=>Cc(r.call(t.self)))},tI=(e,t)=>typeof e==\"function\"?e:t.shift().bind(e.self),rI=(e,...t)=>{let r=tI(e,t),n=t.length===0?function(){return be(()=>Cc(r.apply(this,arguments)))}:function(){let o=be(()=>Cc(r.apply(this,arguments)));for(let s=0;s<t.length;s++)o=t[s](o,...arguments);return o};return nI(r.length,n)},nI=(e,t)=>Object.defineProperty(t,\"length\",{value:e,configurable:!0}),fR=NE(2),LR=function(){let e=typeof arguments[0]==\"string\",t=e?arguments[0]:\"Effect.fn\",r=e?arguments[1]:void 0,n=Co(),o;return n!==0&&(pr(2),o=new globalThis.Error,pr(n)),e?(s,...a)=>lR(t,s,o,a,e,r):lR(t,arguments[0],o,Array.prototype.slice.call(arguments,1),e,r)},lR=(e,t,r,n,o,s)=>{let a=tI(t,n),i=`${e} (definition)`,c=r?fR(()=>r.stack):Vn,u=f=>p=>({name:e,stack:f?fR(()=>f.stack):Vn,parent:{name:i,stack:c,parent:p}});return nI(a.length,function(...f){let p=be(()=>{let h=a.apply(this,arguments);return de(h)?h:Cc(h)});for(let h=0;h<n.length;h++)p=n[h](p,...f);if(!de(p))return p;let d=Co(),m;return d!==0&&(pr(2),m=new globalThis.Error,pr(d)),ia(o?Kp(e,s,h=>zE(p,h)):p,Up,u(m))})},$R=(e,...t)=>{let r=tI(e,t);return nI(r.length,t.length===0?function(){return pR(()=>r.apply(this,arguments))}:function(){let n=pR(()=>r.apply(this,arguments));for(let o of t)n=o(n,...arguments);return n})},pR=e=>{try{let t=e(),r;for(;;){let n=t.next(r);if(n.done)return z(n.value);let o=n.value;if(o&&o._tag===\"Success\"){r=o.value;continue}else{if(o&&o._tag===\"Failure\")return n.value;{let s=!0;return be(()=>s?(s=!1,oe(n.value,a=>Cc(t,a))):be(()=>Cc(e())))}}}}catch(t){return Qa(t)}},Cc=(function(){let e=vn({op:\"Iterator\",[Gt](r,n){let o=this.iterator;for(;;){let s=o.next(r);if(s.done)return z(s.value);if(Ve(s.value)){if(s.value._tag===\"Failure\")return s.value}else return n._stack.push(this),s.value;r=s.value.value}},[lt](r){return this[Gt](this.initial,r)}}),t=function(r,n){this.iterator=r,this.initial=n};return t.prototype=e,function(r,n){return new t(r,n)}})(),Rn=l(2,(e,t)=>new aa(e,oI,z(t))),$x=function(e){return e._stack.push(this),this[xe]},r3=vn({op:\"OnSuccess\",[lt]:$x}),aa=function(e,t,r){this[xe]=e,this[Gt]=t,this.payload=r};aa.prototype=r3;var oI=function(){return this.payload},KR=function(e,t){return t.succeedWith(this.payload)},Kx=(()=>{let e=Co();if(e===0)return!1;let t=\"~effect/Effect/stackProbe\",r={[t]:function(){return new Error}};pr(1);let n=r[t]();return pr(e),n.stack?.includes(\"[as \"+t+\"]\")===!0})(),n3=function(e,t){let r=this.payload;return t.succeedWith(Kx?r(e):za(()=>r(e)))},BR=function(e){let t=this.payload;return t(e)},o3=function(e){let t=this.payload;return new aa(t(e),KR,e)},s3=function(e){return new aa(this.payload,KR,e)},Sf=e=>Fe(e,_),jR=e=>ed(e,{onFailure:z,onSuccess:dt}),xs=l(2,(e,t)=>new aa(e,de(t)?oI:BR,t)),Vp=l(2,(e,t)=>new aa(e,de(t)?s3:o3,t)),Zp=e=>new aa(e,oI,Ur),HR=e=>un(e,dt),sI=(e,t)=>se(r=>{let n=new Set;return oi(r,()=>n.size===0?void 0:lf(n)),Dt(o=>{let s=wt(e),a=s.length,i=0,c=!1,u=[],f=(p,d,m)=>{if(i++,p._tag===\"Failure\"){u.push(...p.cause.reasons),i>=a&&o(Le(Ox(ls(u))));return}let h=!c;c=!0,o(p),h&&t?.onWinner&&t.onWinner({fiber:d,index:m,parentFiber:r})};for(let p=0;p<a;p++){let d=_c(r,s[p],!0,!0,!1);if(n.add(d),d.addObserver(m=>{n.delete(d),f(m,d,p)}),c)break}})}),aI=(e,t)=>se(r=>{let n=new Set;return oi(r,()=>n.size===0?void 0:lf(n)),Dt(o=>{let s=!1,a=0;for(let i of e){if(s)break;let c=a++,u=_c(r,i,!0,!0,!1);n.add(u),u.addObserver(f=>{n.delete(u);let p=!s;s=!0,o(f),p&&t?.onWinner&&t.onWinner({fiber:u,index:c,parentFiber:r})})}})}),zR=l(e=>de(e[1]),(e,t,r)=>sI([e,t],r)),iI=l(e=>de(e[1]),(e,t,r)=>aI([e,t],r)),oe=l(2,(e,t)=>new aa(e,BR,t)),WR=l(2,(e,t)=>Ve(e)?e._tag===\"Success\"?t.onSuccess(e.value):t.onFailure(e.cause):_o(e,t)),Ve=e=>e[oc]!==void 0,qR=l(2,(e,t)=>Ve(e)?e._tag===\"Success\"?t(e.value):e:oe(e,t)),JR=e=>oe(e,D),Fe=l(2,(e,t)=>new aa(e,n3,t)),GR=l(2,(e,t)=>Ve(e)?lI(e,t):Fe(e,t)),VR=l(2,(e,t)=>Ve(e)?pI(e,t):EI(e,t)),ZR=l(2,(e,t)=>Ve(e)?dI(e,t):II(e,t)),YR=l(2,(e,t)=>{if(Ve(e)){if(e._tag===\"Success\")return e;let r=cn(e.cause);return ae(r)?Nt(r.failure):t(r.success)}return ti(e,t)}),bf=e=>Nt(Ya(e)),Xa=e=>e._tag===\"Success\",QR=e=>e._tag===\"Success\"?j(e):q(e),XR=e=>e._tag===\"Success\"?j(e.value):q(e),cI=e=>e._tag===\"Failure\",eP=e=>e._tag===\"Failure\"?j(e):q(e),Yp=e=>e._tag===\"Failure\"?j(e.cause):q(e),uI=bE(Yp,mf),tP=bE(Yp,Gp),fI=e=>e._tag===\"Failure\"&&_x(e.cause),rP=e=>e._tag===\"Failure\"&&hf(e.cause),nP=e=>e._tag===\"Failure\"&&kx(e.cause),Ur=We(void 0),lI=l(2,(e,t)=>e._tag===\"Success\"?We(t(e.value)):e),pI=l(2,(e,t)=>e._tag===\"Success\"?e:Nt(xf(e.cause,t))),dI=l(2,(e,t)=>e._tag===\"Success\"?We(t.onSuccess(e.value)):Nt(xf(e.cause,t.onFailure))),a3=l(2,(e,t)=>Xa(e)?We(t):e),oP=l(2,(e,t)=>Xa(e)?t:e),sP=l(2,(e,t)=>Xa(e)?t.onSuccess(e.value):t.onFailure(e.cause)),aP=a3(void 0),mI=e=>{let t=[];for(let r of e)r._tag===\"Failure\"&&t.push(...r.cause.reasons);return t.length===0?Ur:Nt(ls(t))},iP=e=>Xa(e)?_(e.value):v(),cP=e=>cI(e)?_(e.cause):v(),uP=e=>{let t=uI(e);return ae(t)?v():_(t.success)},fP=e=>e,lP=e=>se(t=>z(tx(t.context,e))),i3=e=>se(t=>VE(tx(t.context,e))),Ef=l(2,(e,t)=>se(r=>{let n=r.context,o=t(n);return n===o||(r.setContext(o),oi(r,()=>{r.setContext(n)})),e})),ia=l(3,(e,t,r)=>Ef(e,n=>{let o=ds(n,t),s=r(o);return o===s?n:dr(n,t,s)})),pP=(e,t,r)=>Oc(se(n=>{let o=ds(n.context,e),s=t(o);return n.setContext(dr(n.context,e,s)),ni(ds(n.context,ri),a=>{let i=tx(n.context,e);if(ge(i))return Se;let c=i.value,u;if(r?.reset===void 0){if(c!==s)return Se;u=o}else u=r.reset(o,s,c);return n.setContext(dr(n.context,e,u)),Se})})),hI=()=>c3,c3=se(e=>z(e.context)),ei=e=>se(t=>e(t.context)),dP=l(2,(e,t)=>Ef(e,gt(t))),Pn=l(2,(e,t)=>Ve(e)?e:Ef(e,rx(t))),Lr=function(){return arguments.length===1?l(2,(e,t)=>dR(e,arguments[0],t)):l(3,(e,t,r)=>dR(e,t,r)).apply(this,arguments)},dR=(e,t,r)=>Ef(e,dr(t,r)),Bx=l(3,(e,t,r)=>oe(r,n=>Lr(e,t,n))),mP=l(e=>de(e[1]),(e,t,r)=>xI(e,t,(n,o)=>[n,o],r)),xI=l(e=>de(e[1]),(e,t,r,n)=>n?.concurrent?Fe(sd([e,t],{concurrency:2}),([o,s])=>r(o,s)):oe(e,o=>Fe(t,s=>r(o,s)))),hP=l(e=>de(e[0]),(e,t,r)=>DI(e,t,r?n=>dt(r(n)):()=>dt(new vo))),xP=l(2,(e,t)=>oe(t,r=>r?Sf(e):Tc)),gI=l(2,(e,t)=>Array.from({length:t},()=>e)),gP=l(e=>de(e[0]),(e,t,r)=>sd(gI(e,t),r)),yP=l(e=>de(e[0]),(e,t)=>si({while:Cn,body:gt(t?.disableYield?e:oe(e,r=>yf)),step:zr})),un=l(2,(e,t)=>new SP(e,t.length!==1?r=>t(r):t)),u3=vn({op:\"OnFailure\",[lt]:$x}),SP=function(e,t){this[xe]=e,this[Tn]=t};SP.prototype=u3;var yI=l(3,(e,t,r)=>un(e,n=>t(n)?r(n):Le(n))),ca=l(3,(e,t,r)=>un(e,n=>{let o=t(n);return ae(o)?Le(o.failure):r(o.success,n)})),ti=l(2,(e,t)=>ca(e,cn,r=>t(r))),bP=e=>ed(e,{onFailure:t=>Uh(t)?Tc:dt(t),onSuccess:YE}),EP=l(2,(e,t)=>ca(e,Gp,t)),IP=l(2,(e,t)=>un(e,r=>xs(t(r),Le(r)))),wP=l(3,(e,t,r)=>yI(e,t,n=>xs(r(n),Le(n)))),jx=l(3,(e,t,r)=>un(e,n=>{let o=t(n);return ae(o)?Le(n):xs(r(o.success,n),Le(n))})),SI=l(2,(e,t)=>jx(e,mf,r=>t(r))),AP=l(3,(e,t,r)=>{let n=Array.isArray(t)?o=>A(o,\"_tag\")&&t.includes(o._tag):Wt(t);return SI(e,o=>n(o)?r(o):Se)}),CP=l(2,(e,t)=>jx(e,Gp,r=>t(r))),Qp=l(e=>de(e[0]),(e,t,r,n)=>un(e,o=>{let s=cn(o);return ae(s)?Le(s.failure):t(s.success)?r(s.success):n?n(s.success):Le(o)})),Hx=l(e=>de(e[0]),(e,t,r,n)=>un(e,o=>{let s=cn(o);if(ae(s))return Le(s.failure);let a=t(s.success);return ae(a)?n?n(a.failure):Le(o):r(a.success)})),bI=l(e=>de(e[0]),(e,t,r,n)=>{let o=Array.isArray(t)?s=>A(s,\"_tag\")&&t.includes(s._tag):Wt(t);return Qp(e,o,r,n)}),TP=l(e=>de(e[0]),(e,t,r)=>{let n;return Hx(e,o=>(n??=Object.keys(t),A(o,\"_tag\")&&Wr(o._tag)&&n.includes(o._tag)?j(o):q(o)),o=>t[o._tag](o),r)}),vP=l(e=>de(e[0]),(e,t,r,n,o)=>Qp(e,s=>Wt(s,t)&&A(s,\"reason\")&&(o!==void 0||Wt(s.reason,r)),s=>{let a=s.reason;return Wt(a,r)?n(a,s):o?o(a,s):dt(s)})),kP=l(e=>de(e[0]),(e,t,r,n)=>{let o;return Qp(e,s=>Wt(s,t)&&A(s,\"reason\")&&A(s.reason,\"_tag\")&&Wr(s.reason._tag)&&(n!==void 0||(o??=Object.keys(r)).includes(s.reason._tag)),s=>{let a=s.reason;return o??=Object.keys(r),o.includes(a._tag)?r[a._tag](a,s):n?n(a,s):dt(s)})}),OP=l(2,(e,t)=>Hx(e,r=>Wt(r,t)&&A(r,\"reason\")?j(r.reason):q(r),dt)),EI=l(2,(e,t)=>un(e,r=>Le(xf(r,t)))),II=l(2,(e,t)=>_o(e,{onFailure:r=>Le(xf(r,t.onFailure)),onSuccess:r=>X(()=>t.onSuccess(r))})),wI=e=>ti(e,Qa),_P=l(2,(e,t)=>ti(e,r=>X(()=>t(r)))),RP=e=>be(()=>{let t=e[Symbol.iterator](),r=t.next();if(r.done)return Qa(new Error(\"Received an empty collection of effects\"));function n(o){let s=t.next();return s.done?o.value:ti(o.value,a=>n(s))}return n(r)}),AI=e=>ti(e,t=>oe(yf,()=>AI(e))),Xp=e=>e===\"Unhandled\"?(...t)=>se(r=>{let n=r.getRef(FE);return n===void 0?Se:Ro(n)(...t)}):Ro(e===!0?void 0:e),PP=l(e=>de(e[0]),(e,t)=>{if(!t?.log)return ed(e,{onFailure:n=>Se,onSuccess:n=>Se});let r=Xp(t.log);return _o(e,{onFailure(n){let o=cn(n);return ae(o)?Le(o.failure):t.message===void 0?r(n):r(t.message,n)},onSuccess:n=>Se})}),zx=l(e=>de(e[0]),(e,t)=>{if(!t?.log)return _o(e,{onFailure:n=>Se,onSuccess:n=>Se});let r=Xp(t.log);return _o(e,{onFailure:n=>t.message===void 0?r(n):r(t.message,n),onSuccess:n=>Se})}),MP=e=>Wx(e,{onFailure:v,onSuccess:_}),Za=e=>td(e,{onFailure:q,onSuccess:j}),_o=l(2,(e,t)=>new FP(e,t.onSuccess.length!==1?r=>t.onSuccess(r):t.onSuccess,t.onFailure.length!==1?r=>t.onFailure(r):t.onFailure)),f3=vn({op:\"OnSuccessAndFailure\",[lt]:$x}),FP=function(e,t,r){this[xe]=e,this[Gt]=t,this[Tn]=r};FP.prototype=f3;var l3=function(e,t){let r=this.payload;return t.succeedWith(Kx?r.onSuccess(e):za(()=>r.onSuccess(e)))},NP=(e,t)=>{let r=vn({op:e,[lt]:$x,[Gt]:l3,[Tn]:t}),n=function(o,s){this[xe]=o,this.payload=s};return n.prototype=r,n},p3=NP(\"Match\",function(e,t){let r=cn(e);if(ae(r))return Le(r.failure);let n=this.payload;return t.succeedWith(Kx?n.onFailure(r.success):za(()=>n.onFailure(r.success)))}),d3=NP(\"MatchCause\",function(e,t){let r=this.payload;return t.succeedWith(Kx?r.onFailure(e):za(()=>r.onFailure(e)))}),CI=l(2,(e,t)=>new d3(e,t)),ed=l(2,(e,t)=>_o(e,{onFailure:r=>{let n=cn(r);return ae(n)?Le(n.failure):t.onFailure(n.success)},onSuccess:t.onSuccess})),Wx=l(2,(e,t)=>new p3(e,t)),td=l(2,(e,t)=>{if(Ve(e)){if(e._tag===\"Success\")return We(t.onSuccess(e.value));let r=cn(e.cause);return ae(r)?Nt(r.failure):We(t.onFailure(r.success))}return Wx(e,t)}),UP=l(2,(e,t)=>Ve(e)?e._tag===\"Success\"?We(t.onSuccess(e.value)):We(t.onFailure(e.cause)):CI(e,t)),rd=e=>Ve(e)?We(e):m3(e),m3=Zn({op:\"Exit\",[lt](e){return e._stack.push(this),this[xe]},[Gt](e,t,r){return t.succeedWith(r??We(e))},[Tn](e,t,r){return t.succeedWith(r??Nt(e))}}),DP=td({onFailure:()=>!0,onSuccess:()=>!1}),LP=td({onFailure:()=>!1,onSuccess:()=>!0}),$P=l(2,(e,t)=>xs(wf(t),e)),TI=l(2,(e,t)=>oe(vI(e,t.duration),r=>ge(r)?t.orElse():z(r.value))),h3=e=>new jp(`Operation timed out after '${SE(e)}'`),KP=l(2,(e,t)=>{let r=ct(t);return TI(e,{duration:r,orElse:()=>dt(h3(r))})}),vI=l(2,(e,t)=>iI(Sf(e),Rn(wf(t),v()))),BP=e=>Mo(t=>{let r=t.monotonicTimeNanosUnsafe();return Fe(e,n=>[On(t.monotonicTimeNanosUnsafe()-r),n])}),KE=\"~effect/Scope\",BE=\"~effect/Scope/Closeable\",ri=Et(\"effect/Scope\"),kI=(e,t)=>se(r=>(S3(r),qx(e,t)??Se)),qx=(e,t)=>{let r=e.state;if(r._tag===\"Closed\"||(e.state={_tag:\"Closed\",exit:t},e.parent!==void 0&&Ax(e.parent,e),r._tag===\"Empty\"))return;if(r.finalizer!==void 0)return wx(r.finalizer,t);let n=r.finalizers;return n.size===1?wx(n.values().next().value,t):x3(e,n,t)},wx=(e,t)=>{try{return e(t)}catch(r){return Jr(r)}},jP=(e,t)=>Xa(e)?t:un(t,r=>Le(Ox(Ep(e.cause,r)))),x3=rI(function*(e,t,r){let n=[],o=[],s=Array.from(t),a=sa();for(let i=s.length-1;i>=0;i--){let[c,u]=s[i];e.strategy===\"sequential\"?n.push(yield*rd(wx(u,r))):c!==a&&o.push(_c(a,wx(u,r),!0,!0,\"inherit\"))}return o.length>0&&(n=yield*Ux(o)),yield*mI(n)});var HP=(e,t)=>{let r=zP(t,e);return e.state._tag===\"Closed\"?(r.state=e.state,r):(If(e,r,n=>kI(r,n)),r)},ni=(e,t)=>be(()=>e.state._tag===\"Closed\"?t(e.state.exit):(If(e,{},t),Se)),Jx=(e,t)=>ni(e,gt(t)),If=(e,t,r)=>{if(e.state._tag===\"Empty\")e.state={_tag:\"Open\",finalizerKey:t,finalizer:r,finalizers:void 0};else if(e.state._tag===\"Open\"){let n=e.state;n.finalizer!==void 0&&(n.finalizers=new Map([[n.finalizerKey,n.finalizer]]),n.finalizerKey=void 0,n.finalizer=void 0),n.finalizers.set(t,r)}},Ax=(e,t)=>{if(e.state._tag!==\"Open\")return;let r=e.state;r.finalizerKey===t?e.state=jE:r.finalizers!==void 0&&(r.finalizers.delete(t),r.finalizers.size===0&&(e.state=jE))},Gx=e=>zP(e,void 0),zP=(e=\"sequential\",t)=>({[BE]:BE,[KE]:KE,strategy:e,parent:t,state:jE}),jE={_tag:\"Empty\"};var vc=ri,WP=Lr(ri),OI=e=>se(t=>{let r=t.context,n=Gx();return t.setContext(dr(t.context,ri,n)),oi(t,o=>(t.setContext(r),qx(n,o))),e});var Vx=e=>be(()=>{let t=Gx();return Mn(e(t),r=>be(()=>qx(t,r)??Se))}),kc=(e,t,r)=>ei(n=>ro(o=>oe(vc,s=>Vp(r?.interruptible?o(e):e,a=>ni(s,i=>Pn(t(a,i),n)))))),_I=e=>oe(vc,t=>ei(r=>ni(t,n=>Pn(e(n),r)))),qP=(function(){let e=vn({op:\"OnExit\",[lt](r){return r._stack.push(this),this.effect},[sc](r){r.interruptible&&this.interruptible!==!0&&(r._stack.push(od),r.interruptible=!1)},[Gt](r,n,o){o??=We(r);let s;try{s=this.onExit(o)}catch(a){s=Jr(a)}return s?oe(s,a=>o):o},[Tn](r,n,o){o??=Nt(r);let s;try{s=this.onExit(o)}catch(a){s=Jr(a)}return s?oe(jP(o,s),a=>o):o}}),t=function(r,n,o){this.effect=r,this.onExit=n,this.interruptible=o};return t.prototype=e,t})(),Po=(e,t,r)=>new qP(e,t,r),oi=(e,t)=>{e._stack.push(new qP(void 0,t,void 0))},Mn=l(2,Po),JP=l(2,(e,t)=>Mn(e,r=>t)),RI=l(3,(e,t,r)=>Mn(e,n=>t(n)?r(n):Se)),PI=l(3,(e,t,r)=>Mn(e,n=>{let o=t(n);return ae(o)?Se:r(o.success,n)})),MI=l(2,(e,t)=>PI(e,Yp,t)),GP=l(3,(e,t,r)=>RI(e,n=>n._tag!==\"Failure\"?!1:t(n.cause),n=>r(n.cause))),FI=l(3,(e,t,r)=>Mn(e,n=>{if(n._tag!==\"Failure\")return Se;let o=t(n.cause);return ae(o)?Se:r(o.success,n.cause)})),VP=l(2,(e,t)=>FI(Rx,t)(e)),nd=(e,t,r)=>ro(n=>oe(e,o=>Po(be(()=>n(t(o))),s=>r(o,s),!0))),ZP=e=>kc(e,t=>A(t,Symbol.asyncDispose)?XE(()=>t[Symbol.asyncDispose]()):X(()=>t[Symbol.dispose]())),NI=l(2,(e,t)=>X(()=>YP(e,typeof t==\"function\"?r=>Nr(ct(t(r))):gt(Nr(ct(t)))))),g3=gt(1/0),YP=(e,t)=>{let r=0,n,o,s=(a,i)=>(i.awaiters++,oi(a,()=>{if(!(--i.awaiters>0||i.done))return o===i&&(o=void 0),Dx(i.fiber)}),Ix(i.fiber));return[se(a=>{if(o!==void 0)return a===o.fiber?Ix(o.fiber):s(a,o);if(n!==void 0&&(r===1/0||a.getRef(Dr).currentTimeMillisUnsafe()<r))return n;n=void 0;let i=a.getRef(Dr),c={fiber:new ff(a.context),awaiters:0,done:!1};o=c;let u=s(a,c);return c.fiber.evaluate(Po(e,f=>{if(c.done=!0,o!==c||(o=void 0,fI(f)))return;let p=t(f);r=p===1/0?1/0:i.currentTimeMillisUnsafe()+p,n=f})),c.fiber._exit??u}),X(()=>{o=void 0,n=void 0})]},QP=l(2,(e,t)=>Fe(NI(e,t),r=>r[0])),XP=e=>X(()=>YP(e,g3)[0]),eM=se(e=>Le(Ya(e.id))),Oc=e=>se(t=>(t.interruptible&&(t.interruptible=!1,t._stack.push(od)),e)),tM=Zn({op:\"SetInterruptible\",[sc](e){if(e.interruptible=this[xe],e._interruptedCause&&e.interruptible)return()=>Le(e._interruptedCause)}}),od=tM(!0),y3=tM(!1),rM=e=>{if(e.interruptible=!0,e._stack.push(y3),e._interruptedCause)return Le(e._interruptedCause)},S3=e=>{let t=e;t.interruptible&&(t.interruptible=!1,t._stack.push(od))};var Zx=e=>se(t=>t.interruptible?e:rM(t)??e),ro=e=>se(t=>t.interruptible?(t.interruptible=!1,t._stack.push(od),e(Zx)):e(D)),nM=e=>se(t=>{if(t.interruptible)return e(D);let r=rM(t),n=e(Oc);return r??n}),oM=Fe(kc(X(()=>new AbortController),e=>X(()=>e.abort())),e=>e.signal),sd=(e,t)=>Js(e)?t?.mode===\"result\"?_n(e,Za,t):_n(e,D,t):t?.discard?t.mode===\"result\"?_n(Object.values(e),Za,t):_n(Object.values(e),D,t):be(()=>Fe(_n(Object.entries(e),([r,n])=>Fe(t?.mode===\"result\"?Za(n):n,o=>[r,o]),{concurrency:t?.concurrency}),Object.fromEntries)),UI=l(e=>Js(e[0])&&!de(e[0]),(e,t,r)=>Fe(_n(e,(n,o)=>Za(t(n,o)),r),n=>xE(n,D))),sM=l(3,(e,t,r)=>{let n=wt(e);return n.length===0?X(t):be(()=>{let o=0,s=t();return Fe(si({while:()=>o<n.length,body:()=>r(s,n[o],o),step(a){s=a,o++}}),()=>s)})}),aM=l(e=>Js(e[0])&&!de(e[0]),(e,t,r)=>oe(UI(e,t,{concurrency:r?.concurrency}),([n,o])=>Mr(o)?dt(o):r?.discard?Se:z(n))),iM=l(e=>Js(e[0])&&!de(e[0]),(e,t)=>be(()=>{let r=e[Symbol.iterator](),n=r.next();return n.done?z(v()):cM(r,0,t,n.value)})),cM=(e,t,r,n)=>oe(r(n,t),o=>{if(o)return z(_(n));let s=e.next();return s.done?z(v()):cM(e,t+1,r,s.value)}),uM=l(e=>Js(e[0])&&!de(e[0]),(e,t)=>be(()=>{let r=e[Symbol.iterator](),n=r.next();return n.done?z(v()):fM(r,0,t,n.value)})),fM=(e,t,r,n)=>oe(r(n,t),o=>{if(rt(o))return z(_(o.success));let s=e.next();return s.done?z(v()):fM(e,t+1,r,s.value)}),si=Zn({op:\"While\",[Gt](e,t){return this[xe].step(e),this[xe].while()?(t._stack.push(this),this[xe].body()):Ur},[lt](e){return this[xe].while()?(e._stack.push(this),this[xe].body()):Ur}}),_n=l(e=>typeof e[1]==\"function\",(e,t,r)=>be(()=>{let n=ad(r?.concurrency);if(n===1)return b3(e,t,r);let o=wt(e),s=o.length;if(s===0)return r?.discard?Se:z([]);let a=r?.discard?void 0:new Array(s),i=E3({f:t,out:a},o,{concurrency:n});return i?Rn(i,a):z(a)})),lM=e=>oe(e,t=>{let r=t[Symbol.iterator]().next();return r.done?dt(new vo):z(r.value)}),b3=(e,t,r)=>be(()=>{let n=r?.discard?void 0:[],o=e[Symbol.iterator](),s=o.next(),a=0;return Rn(si({while:()=>!s.done,body:()=>t(s.value,a++),step:i=>{n&&n.push(i),s=o.next()}}),n)}),ad=e=>e===\"unbounded\"?Number.POSITIVE_INFINITY:Math.max(1,e??1),Yx=()=>e=>{let t=e.onItem,r=e.step,n=(s,a,i,c,u)=>oe(rd(u),f=>r(s,a[i],f,i)??o(s,a,i+1,c)??Se),o=(s,a,i=0,c=a.length)=>{for(;i<c;i++){let u=a[i],f=t(s,u,i);if(!Ve(f))return n(s,a,i,c,f);let p=r(s,u,f,i);if(p)return p._tag===\"Failure\"?p:void 0}};return o},pM=e=>{let t=e.onItem,r=e.step;return(n,o,s)=>{let a=0,i=s.end??o.length,c=s.concurrency,u=!1,f,p,d,m,h,y=b=>{let x=Jr(b);return m=x,u=!0,p&&p.size>0?oe(Oc(lf(Array.from(p))),()=>m??x):x},S=()=>{let b=!1;for(;!m&&a<i;a++){let x=o[a],w=h??t(n,x,a);if(Ve(w)){if(m=r(n,x,w,a),m)break}else if(f){h=void 0;let I=_c(f,w,!0,!0,\"inherit\");if(I._exit){if(m=r(n,x,I._exit,a),m)break;continue}p.add(I);let T=a;if(I.addObserver(P=>{p.delete(I);try{if(m){if(P._tag===\"Failure\"){let G=P.cause.reasons.filter(he=>he._tag!==\"Interrupt\");if(G.length>0){let he=ls(G);m=Nt(m._tag===\"Failure\"?Ox(Ep(m.cause,he)):he)}}}else{let G=r(n,x,P,T);G&&(m=G,S())}if(b){let G=S();G&&d(G)}else u&&p.size===0&&d(m??Se)}catch(G){d(y(G))}}),p.size<c)continue;b=!0,a++;return}else return Dt(I=>{f=sa(),p=new Set,h=w,d=I;let T;try{T=S()}catch(P){return I(y(P))}return T?I(T):be(()=>(m??=Ur,oe(p?lf(p):Se,()=>m?._tag===\"Failure\"?m:Se)))})}if(u=!0,m){if(p&&p.size>0){let x=Nx(f);p.forEach(w=>w.interruptUnsafe(f.id,x));return}if(d||m._tag===\"Failure\")return m}else if(d)if(p)p.size===0&&d(Se);else return Ur};return S()}},Qx=()=>e=>pM(e),E3=pM({onItem(e,t,r){return e.f(t,r)},step(e,t,r,n){if(r._tag===\"Failure\")return r;e.out&&(e.out[n]=r.value)}}),DI=l(3,(e,t,r)=>oe(e,n=>t(n)?z(n):r(n))),LI=l(3,(e,t,r)=>oe(e,n=>{let o=t(n);return ae(o)?r(o.failure):z(o.success)})),dM=l(e=>de(e[0]),(e,t,r)=>LI(e,t,r?n=>dt(r(n)):()=>dt(new vo))),mM=l(e=>Js(e[0])&&!de(e[0]),(e,t,r)=>Fe(_n(e,(n,o)=>{let s=t(n,o);return typeof s==\"boolean\"?z(s?_(n):v()):Fe(s,a=>a?_(n):v())},r),O_)),hM=l(e=>Js(e[0])&&!de(e[0]),(e,t)=>be(()=>{let r=[];for(let n of e){let o=t(n);rt(o)&&r.push(o.success)}return z(r)})),xM=l(e=>Js(e[0])&&!de(e[0]),(e,t,r)=>be(()=>{let n=[];return Rn(_n(e,o=>Fe(t(o),s=>{rt(s)&&n.push(s.success)}),{discard:!0,concurrency:r?.concurrency}),n)})),gM=z({}),yM=Kh(Fe),SM=Bh(Fe,oe),bM=$h(Fe);var EM=l(e=>de(e[0]),(e,t)=>se(r=>(U3(),z(_c(r,e,t?.startImmediately,!1,t?.uninterruptible??!1))))),_c=(e,t,r=!1,n=!1,o=!1)=>{let s=e,a=o===\"inherit\"?s.interruptible:!o,i=new ff(s.context,a);return n||(s.children().add(i),i._parent=s),r?i.evaluate(t):(i._asyncContext=vR(),s.currentDispatcher.scheduleTask(()=>i.evaluate(t),0)),i},IM=l(e=>de(e[0]),(e,t)=>se(r=>z(_c(r,e,t?.startImmediately,!0,t?.uninterruptible)))),wM=e=>se(t=>{let r=t._children&&new Set(t._children),n=t.interruptible;return Po(e,o=>{let s=t._children;if(s===void 0||s.size===0)return Se;r&&(s=A_(s,i=>!r.has(i)));let a=Zp(Ux(s));return n?Zx(a):a})}),AM=e=>()=>se(t=>t===e?Se:Dx(e)),$I=l(e=>de(e[0]),(e,t,r)=>se(n=>{let o=t.state._tag===\"Closed\"?new ff(n.context):_c(n,e,r?.startImmediately,!0,r?.uninterruptible);return o._exit||(t.state._tag!==\"Closed\"?(If(t,o,AM(o)),o.addObserver(()=>Ax(t,o))):o.interruptUnsafe(n.id,Nx(n))),z(o)})),CM=l(e=>de(e[0]),(e,t)=>oe(vc,r=>$I(e,r,t))),ua=e=>(t,r)=>{let n=new ff(r?.scheduler?dr(e,uf,r.scheduler):e,r?.uninterruptible!==!0);if(n.evaluate(t),n._exit)return n;if(r?.signal)if(r.signal.aborted)n.interruptUnsafe();else{let o=()=>n.interruptUnsafe();r.signal.addEventListener(\"abort\",o,{once:!0}),n.addObserver(()=>r.signal.removeEventListener(\"abort\",o))}return r?.onFiberStart&&r.onFiberStart(n),n},TM=l(2,(e,t)=>e._exit?e:t.state._tag===\"Closed\"?(e.interruptUnsafe(e.id),e):(Ax(t,e),If(t,e,AM(e)),e.addObserver(()=>Ax(t,e)),e)),vM=ua(Pr()),KI=e=>{let t=ua(e);return(r,n)=>{let o=t(r,n);return n?.onExit&&o.addObserver(n.onExit),s=>o.interruptUnsafe(s)}},kM=KI(Pr()),Xx=e=>{let t=ua(e);return(r,n)=>{let o=t(r,n);return new Promise(s=>{o.addObserver(a=>s(a))})}},OM=Xx(Pr()),BI=e=>{let t=Xx(e);return(r,n)=>t(r,n).then(o=>{if(o._tag===\"Failure\")throw Mx(o.cause);return o.value})},_M=BI(Pr()),eg=e=>{let t=ua(e);return r=>{if(Ve(r))return r;let n=new bc(\"sync\"),o=t(r,{scheduler:n});return o._dispatcher?.flush(),o._exit??Jr(new qp(o))}},RM=eg(Pr()),jI=e=>{let t=eg(e);return r=>{let n=t(r);if(n._tag===\"Failure\")throw Mx(n.cause);return n.value}},PM=jI(Pr()),mR=z(!0),hR=z(!1),HE=class{waiters=[];scheduled=void 0;_isOpen;constructor(t){this._isOpen=t}scheduleUnsafe(t){if(this.waiters.length===0)return mR;if(this.scheduled===void 0)this.scheduled=this.waiters,t.currentDispatcher.scheduleTask(this.flushScheduled,0);else for(let r=0;r<this.waiters.length;r++)this.scheduled.push(this.waiters[r]);return this.waiters=[],mR}flushScheduled=()=>{if(this.scheduled===void 0)return;let t=this.scheduled;this.scheduled=void 0;for(let r=0;r<t.length;r++)t[r](Ur)};flushWaiters(){let t=this.waiters;this.waiters=[],this.flushScheduled();for(let r=0;r<t.length;r++)t[r](Ur)}open=se(t=>this._isOpen?hR:(this._isOpen=!0,this.scheduleUnsafe(t)));release=se(t=>this._isOpen?hR:this.scheduleUnsafe(t));openUnsafe(){return this._isOpen?!1:(this._isOpen=!0,this.flushWaiters(),!0)}await=Dt(t=>this._isOpen?t(Se):(this.waiters.push(t),X(()=>{let r=this.waiters.indexOf(t);r!==-1?this.waiters.splice(r,1):this.scheduled!==void 0&&(r=this.scheduled.indexOf(t),r!==-1&&this.scheduled.splice(r,1))})));closeUnsafe(){return this._isOpen?(this._isOpen=!1,!0):!1}close=X(()=>this.closeUnsafe());whenOpen=t=>oe(this.await,()=>t);isOpen(){return this._isOpen}},HI=e=>new HE(e??!1),MM=e=>X(()=>HI(e)),FM=se(e=>z(e.getRef(_E))),NM=l(2,(e,t)=>Lr(e,_E,t)),UM=Lr(Sx),DM=Lr(wc),Cx=BigInt(0),I3={_tag:\"Span\",spanId:\"noop\",traceId:\"noop\",sampled:!1,status:{_tag:\"Ended\",startTime:Cx,endTime:Cx,exit:Ur},attributes:new Map,links:[],kind:\"internal\",attribute(){},event(){},end(){},addLinks(){}},w3=e=>Object.assign(Object.create(I3),e),LM=e=>e?Me(e.annotations,yx)?e._tag===\"Span\"?LM(ps(e.parent)):v():_(e):v(),zI=(e,t,r)=>{let n=!e.cache.tracerEnabled||r?.annotations&&Me(r.annotations,yx),o=r?.parent!==void 0?_(r.parent):r?.root?v():LM(e.cache.span),s;if(n)s=w3({name:t,parent:o,annotations:dr(r?.annotations??Pr(),yx,!0)});else{let a=e.cache.tracer??RE,i=e.getRef(Dr),c=e.getRef(wc),u=e.getRef(Dp),f=e.getRef(Lp),p=r?.level??e.getRef(oR),d=r?.links!==void 0?[...f,...r.links]:f.length===0?[]:f.slice();s=a.span({name:t,parent:o,annotations:r?.annotations??Pr(),links:d,startTime:c?i.currentTimeNanosUnsafe():Cx,kind:r?.kind??\"internal\",root:r?.root??!1,sampled:r?.sampled??(Ce(o)&&o.value.sampled===!1?!1:!r1(e.getRef(sR),p))});for(let m in u)s.attribute(m,u[m]);if(r?.attributes!==void 0)for(let m in r.attributes)s.attribute(m,r.attributes[m])}return s},$M=(e,t)=>se(r=>z(zI(r,e,t))),$p=(e,t)=>Oc(se(r=>{let n=ds(r.context,ri),o=zI(r,e,t??{}),s=r.getRef(Dr),a=r.getRef(wc);return Rn(ni(n,i=>tg(o,i,s,a)),o)})),KM=function(){let e=typeof arguments[0]!=\"string\",t=e?arguments[1]:arguments[0],r=Va(e?arguments[2]:arguments[1]);if(e){let n=arguments[0];return oe($p(t,r),o=>pf(n,o,r))}return n=>oe($p(t,r),o=>pf(n,o,r))},A3=(e,t)=>(t=typeof t==\"function\"?t:Vn,ia(Up,r=>({name:e,stack:t,parent:r}))),BM=Dp,jM=Lp,HM=l(e=>de(e[0]),(e,t,r={})=>{let o=(Array.isArray(t)?t:[t]).map(s=>({span:s,attributes:r}));return ia(e,Lp,s=>[...s,...o])}),tg=(e,t,r,n)=>X(()=>{e.status._tag!==\"Ended\"&&e.end(n?r.currentTimeNanosUnsafe():Cx,t)}),Kp=(e,...t)=>{let r=t.length===1?void 0:t[0],n=t[t.length-1];return se(o=>{let s=zI(o,e,r),a=o.getRef(Dr),i=o.getRef(wc);return oi(o,c=>tg(s,c,a,i)),n(s)})},zE=Lr(Ic),pf=function(){let e=de(arguments[0]),t=e?arguments[1]:arguments[0],r=e?arguments[2]:arguments[1],n=D;return t._tag===\"Span\"&&(r=Va(r),n=A3(t.name,r?.captureStackTrace)),e?zE(n(arguments[0]),t):o=>zE(n(o),t)},zM=function(){let e=typeof arguments[0]!=\"string\",t=e?arguments[1]:arguments[0],r=Va(arguments[2]);if(e){let s=arguments[0];return Kp(t,arguments[2],a=>pf(s,a,r))}let n=typeof arguments[1]==\"function\"?arguments[1]:void 0,o=n?void 0:arguments[1];return(s,...a)=>Kp(t,n?n(...a):o,i=>pf(s,i,r))},WM=l(e=>de(e[0]),(e,...t)=>ia(e,Dp,r=>{let n=t.length===1?{...r,...t[0]}:{...r};return t.length===1||B(n,t[0],t[1]),n})),qM=(...e)=>se(t=>{let r=t.currentSpanLocal;if(r&&r.status._tag!==\"Ended\")if(e.length===1)for(let[n,o]of Object.entries(e[0]))r.attribute(n,o);else r.attribute(e[0],e[1]);return Se}),JM=se(e=>{let t=e.currentSpanLocal;return t?z(t):dt(new vo)}),GM=i3(Ic),Dr=Te(\"effect/Clock\",{defaultValue:()=>new WE}),UE=2**31-1,WE=class{currentTimeMillisUnsafe(){return Date.now()}currentTimeMillis=X(()=>this.currentTimeMillisUnsafe());currentTimeNanosUnsafe(){return C3()}currentTimeNanos=X(()=>this.currentTimeNanosUnsafe());monotonicTimeNanosUnsafe(){return ZM()}monotonicTimeNanos=X(()=>this.monotonicTimeNanosUnsafe());sleep(t){return this.sleepMillis(Nr(t))}sleepMillis(t){return t<=0?yf:Number.isFinite(t)?Dt(r=>{let n=t>UE?this.sleepMillis(t-UE):Se,o=setTimeout(()=>r(n),Math.min(t,UE));return X(()=>clearTimeout(o))}):Lx}},VM=BigInt(1e6),ZM=(function(){let e=globalThis.process?.hrtime;if(typeof e?.bigint==\"function\")return()=>e.bigint();if(typeof performance<\"u\"&&typeof performance.now==\"function\")return()=>BigInt(Math.round(performance.now()*1e6));let t=BigInt(0);return()=>{let r=BigInt(Date.now())*VM;return r>t&&(t=r),t}})(),C3=(function(){let e=BigInt(1e9),t;return()=>{let r=ZM(),n=BigInt(Date.now())*VM;if(t===void 0)t=n-r;else{let o=t+r;(n>o?n-o:o-n)>e&&(t=n-r)}return t+r}})(),Mo=e=>se(t=>e(t.getRef(Dr))),wf=e=>Mo(t=>t.sleep(ct(e))),WI=Mo(e=>e.currentTimeMillis);var Bp=\"~effect/Cause/TimeoutError\",YM=e=>A(e,Bp),jp=class extends Ys(\"TimeoutError\"){[Bp]=Bp;constructor(t){super({message:t})}},Hp=\"~effect/Cause/IllegalArgumentError\",QM=e=>A(e,Hp),Tx=class extends Ys(\"IllegalArgumentError\"){[Hp]=Hp;constructor(t){super({message:t})}},zp=\"~effect/Cause/ExceededCapacityError\",XM=e=>A(e,zp),vx=class extends Ys(\"ExceededCapacityError\"){[zp]=zp;constructor(t){super({message:t})}},Wp=\"~effect/Cause/AsyncFiberError\",e1=e=>A(e,Wp),qp=class extends Ys(\"AsyncFiberError\"){[Wp]=Wp;constructor(t){super({message:\"An asynchronous Effect was executed with Effect.runSync\",fiber:t})}},Jp=\"~effect/Cause/UnknownError\",t1=e=>A(e,Jp),df=class extends Ys(\"UnknownError\"){[Jp]=Jp;constructor(t,r){super({message:r,cause:t})}},qI=Te(\"effect/Console\",{defaultValue:()=>globalThis.console}),T3=e=>{switch(e){case\"All\":return Number.MIN_SAFE_INTEGER;case\"Fatal\":return 5e4;case\"Error\":return 4e4;case\"Warn\":return 3e4;case\"Info\":return 2e4;case\"Debug\":return 1e4;case\"Trace\":return 0;case\"None\":return Number.MAX_SAFE_INTEGER}},v3=rE(Qs,T3),r1=ef(v3),JI=Te(\"effect/Logger/CurrentLoggers\",{defaultValue:()=>new Set([F3,N3])}),k3=Te(\"effect/Logger/LogToStderr\",{defaultValue:ap}),n1=function(){let e=typeof arguments[0]==\"string\"?[[arguments[0],arguments[1]]]:Object.entries(arguments[0]);return Oc(se(t=>{let r=t.getRef(oa),n={...r};for(let o=0;o<e.length;o++){let[s,a]=e[o];B(n,s,a)}return t.setContext(dr(t.context,oa,n)),ni(ds(t.context,ri),o=>{let s=t.getRef(oa),a={...s};for(let i=0;i<e.length;i++){let[c,u]=e[i];s[c]!==u&&!Object.is(s[c],u)||(Object.hasOwn(r,c)?B(a,c,r[c]):delete a[c])}return t.setContext(dr(t.context,oa,a)),Se})}))},O3=\"~effect/Logger\",_3={[O3]:{_Message:D,_Output:D},pipe(){return te(this,arguments)}},o1=e=>{let t=Object.create(_3);return t.log=e,t},R3=e=>e.replace(/[\\s=\"]/g,\"_\"),P3=(e,t)=>`${R3(e[0])}=${t-e[1]}ms`;var Ro=e=>(...t)=>{let r;for(let n=0,o=t.length;n<o;n++){let s=t[n];qu(s)&&(r?t.splice(n,1):t=t.slice(0,n).concat(t.slice(n+1)),r=r?ls(r.reasons.concat(s.reasons)):s,n--)}return r===void 0&&(r=Fh),se(n=>{let o=e??n.cache.logLevel;if(r1(n.cache.minimumLogLevel,o))return Se;let s=n.getRef(Dr),a=n.getRef(JI);if(a.size>0){let i=new Date(s.currentTimeMillisUnsafe());for(let c of a)c.log({cause:r,fiber:n,date:i,logLevel:o,message:t})}return Se})};var Ac={bold:\"1\",red:\"31\",green:\"32\",yellow:\"33\",blue:\"34\",cyan:\"36\",white:\"37\",gray:\"90\",black:\"30\",bgBrightRed:\"101\"},lpe={None:[],All:[],Trace:[Ac.gray],Debug:[Ac.blue],Info:[Ac.green],Warn:[Ac.yellow],Error:[Ac.red],Fatal:[Ac.bgBrightRed,Ac.black]};var M3=e=>`${e.getHours().toString().padStart(2,\"0\")}:${e.getMinutes().toString().padStart(2,\"0\")}:${e.getSeconds().toString().padStart(2,\"0\")}.${e.getMilliseconds().toString().padStart(3,\"0\")}`;var F3=o1(({cause:e,date:t,fiber:r,logLevel:n,message:o})=>{let s=Array.isArray(o)?o.slice():[o];e.reasons.length>0&&s.push(Fx(e));let a=t.getTime(),i=r.getRef(bx),c=\"\";for(let d of i)c+=` ${P3(d,a)}`;let u=r.getRef(oa);Object.keys(u).length>0&&s.push(u);let f=r.getRef(qI);(r.getRef(k3)?f.error:f.log)(`[${M3(t)}] ${n.toUpperCase()} (#${r.id})${c}:`,...s)}),N3=o1(({cause:e,fiber:t,logLevel:r,message:n})=>{let o=t.getRef(Dr),s=t.getRef(oa),a=t.cache.span;if(a===void 0||a._tag===\"ExternalSpan\"||a.status._tag===\"Ended\")return;let i={};for(let[c,u]of Object.entries(s))B(i,c,u);i[\"effect.fiberId\"]=t.id,i[\"effect.logLevel\"]=r.toUpperCase(),e.reasons.length>0&&(i[\"effect.cause\"]=Fx(e)),a.event(FO(Array.isArray(n)&&n.length===1?n[0]:n),o.currentTimeNanosUnsafe(),i)});function U3(){$E.interruptChildren??=X4}var GI=z(void 0);var s1=l(e=>de(e[0]),(e,t)=>MI(e,r=>se(n=>(D3(n,r,t?.defectsOnly),Se)))),D3=(e,t,r)=>{let n=e.getRef(cR);if(n.size===0||r&&!hf(t))return;let o={cause:t,fiber:e,timestamp:e.getRef(Dr).currentTimeNanosUnsafe()};n.forEach(s=>s.report(o))};var L3=gp,$3=zu,id=qu,YI=DO,ai=fc,QI=lc,K3=Zs,gs=ls,B3=Fh,j3=Ju,Rc=Vb,H3=Ya,Af=e=>new ac(e),Cf=e=>new ic(e),XI=xR,e0=Px,fa=xf,z3=Ep,rg=Mx,t0=kx,W3=gR,q3=mf,r0=yR,J3=hf,G3=SR,cd=Gp,V3=_x,Z3=bR,Y3=ER,Q3=Rx,X3=qE,n0=Fx,eJ=Uh,tJ=yp,rJ=vo,Pc=Dh,nJ=cc,o0=pc,ue=BO,oJ=Bp,sJ=YM,aJ=jp,iJ=Hp,cJ=QM,ud=Tx,uJ=XM,fJ=zp,s0=vx,lJ=Wp,pJ=e1,dJ=qp,mJ=Jp,hJ=t1,xJ=df,gJ=Gu,ng=IR,yJ=wR,VI=class extends Et()(\"effect/Cause/StackTrace\"){},ZI=class extends Et()(\"effect/Cause/InterruptorStackTrace\"){};var $={};An($,{Do:()=>H5,Transaction:()=>Rf,TypeId:()=>N5,abortSignal:()=>cG,acquireDisposable:()=>Y8,acquireRelease:()=>Wc,acquireUseRelease:()=>pF,addFinalizer:()=>Q8,all:()=>Eg,andThen:()=>Zr,annotateCurrentSpan:()=>SG,annotateLogs:()=>YG,annotateLogsScoped:()=>QG,annotateSpans:()=>yG,as:()=>jt,asSome:()=>wg,asVoid:()=>pi,awaitAllChildren:()=>MG,bind:()=>q5,bindTo:()=>z5,cached:()=>nG,cachedInvalidateWithTTL:()=>sG,cachedWithTTL:()=>oG,callback:()=>Mf,catch:()=>Uo,catchCause:()=>nt,catchCauseFilter:()=>p8,catchCauseIf:()=>l8,catchDefect:()=>i8,catchEager:()=>$f,catchFilter:()=>u8,catchIf:()=>c8,catchNoSuchElement:()=>f8,catchReason:()=>o8,catchReasons:()=>s8,catchTag:()=>r8,catchTags:()=>n8,clockWith:()=>qc,context:()=>Hc,contextWith:()=>Od,currentParentSpan:()=>EG,currentSpan:()=>bG,delay:()=>j0,die:()=>yr,effectify:()=>fV,ensuring:()=>hi,eventually:()=>y8,exit:()=>so,fail:()=>F,failCause:()=>$e,failCauseSync:()=>da,failSync:()=>Ig,fiber:()=>FG,fiberId:()=>NG,filter:()=>z0,filterMap:()=>M8,filterMapEffect:()=>W0,filterMapOrElse:()=>N8,filterMapOrFail:()=>D8,filterOrElse:()=>F8,filterOrFail:()=>U8,findFirst:()=>$5,findFirstFilter:()=>K5,firstSuccessOf:()=>T8,flatMap:()=>C,flatMapEager:()=>Ct,flatten:()=>K0,flip:()=>e8,fn:()=>jG,fnUntraced:()=>_e,fnUntracedEager:()=>ew,forEach:()=>ui,forever:()=>ir,forkChild:()=>Uf,forkDetach:()=>PG,forkIn:()=>rr,forkScoped:()=>Df,fromNullishOr:()=>Y5,fromOption:()=>V5,fromResult:()=>jc,gen:()=>kt,head:()=>B5,ignore:()=>I8,ignoreCause:()=>di,interrupt:()=>io,interruptible:()=>aG,interruptibleMask:()=>iG,isEffect:()=>ws,isFailure:()=>H8,isSuccess:()=>z8,let:()=>W5,linkSpans:()=>AG,log:()=>zG,logDebug:()=>GG,logError:()=>X0,logFatal:()=>WG,logInfo:()=>JG,logTrace:()=>VG,logWarning:()=>qG,logWithLevel:()=>HG,makeSpan:()=>Z0,makeSpanScoped:()=>CG,map:()=>W,mapBoth:()=>d8,mapBothEager:()=>Sr,mapEager:()=>fn,mapError:()=>Do,mapErrorEager:()=>Lf,match:()=>q0,matchCause:()=>$8,matchCauseEager:()=>K8,matchCauseEffect:()=>As,matchCauseEffectEager:()=>B8,matchEager:()=>L8,matchEffect:()=>j8,never:()=>Bc,onError:()=>Lo,onErrorFilter:()=>eG,onErrorIf:()=>X8,onExit:()=>Dn,onExitFilter:()=>rG,onExitIf:()=>tG,onExitPrimitive:()=>_d,onInterrupt:()=>V0,option:()=>X5,orDie:()=>m8,orElseSucceed:()=>C8,partition:()=>U5,promise:()=>Pf,provide:()=>W8,provideContext:()=>ao,provideService:()=>Cs,provideServiceEffect:()=>Z8,race:()=>P8,raceAll:()=>H0,raceAllFirst:()=>R8,raceFirst:()=>Nf,reduce:()=>D5,repeat:()=>uG,repeatOrElse:()=>fG,replicate:()=>lG,replicateEffect:()=>pG,request:()=>_G,requestUnsafe:()=>RG,result:()=>Q5,retry:()=>S8,retryOrElse:()=>b8,runCallback:()=>DG,runCallbackWith:()=>UG,runFork:()=>Rd,runForkWith:()=>co,runPromise:()=>Y0,runPromiseExit:()=>kg,runPromiseExitWith:()=>LG,runPromiseWith:()=>Q0,runSync:()=>$G,runSyncExit:()=>Ts,runSyncExitWith:()=>BG,runSyncWith:()=>KG,sandbox:()=>E8,satisfiesErrorType:()=>pV,satisfiesServicesType:()=>dV,satisfiesSuccessType:()=>lV,schedule:()=>dG,scheduleFrom:()=>dF,scope:()=>zc,scoped:()=>Tg,scopedWith:()=>vg,service:()=>J0,serviceOption:()=>G0,setContext:()=>q8,sleep:()=>mi,spanAnnotations:()=>IG,spanLinks:()=>wG,succeed:()=>g,succeedNone:()=>li,succeedSome:()=>$0,suspend:()=>L,sync:()=>Y,tap:()=>Yr,tapCause:()=>fF,tapCauseFilter:()=>g8,tapCauseIf:()=>x8,tapDefect:()=>lF,tapError:()=>Ag,tapErrorTag:()=>h8,timed:()=>_8,timeout:()=>v8,timeoutOption:()=>k8,timeoutOrElse:()=>O8,tracer:()=>mG,track:()=>eV,trackDefects:()=>nV,trackDuration:()=>oV,trackErrors:()=>rV,trackSuccesses:()=>tV,transposeOption:()=>Z5,try:()=>Ff,tryPromise:()=>fi,tx:()=>sV,txRetry:()=>uV,undefined:()=>j5,uninterruptible:()=>ma,uninterruptibleMask:()=>$o,unwrapReason:()=>a8,updateContext:()=>J8,updateService:()=>G8,updateServiceScoped:()=>V8,useSpan:()=>TG,validate:()=>L5,void:()=>ie,when:()=>Cg,whileLoop:()=>No,withErrorReporting:()=>A8,withExecutionPlan:()=>w8,withFiber:()=>Un,withFiberSucceed:()=>G5,withLogSpan:()=>XG,withLogger:()=>ZG,withParentSpan:()=>OG,withSpan:()=>vG,withSpanScoped:()=>kG,withTracer:()=>hG,withTracerEnabled:()=>xG,withTracerTiming:()=>gG,yieldNow:()=>kd,yieldNowWith:()=>J5,zip:()=>B0,zipWith:()=>t8});var Or={};An(Or,{asVoid:()=>_J,asVoidAll:()=>pd,die:()=>a0,fail:()=>la,failCause:()=>Fn,filterCause:()=>AJ,filterFailure:()=>wJ,filterSuccess:()=>EJ,filterValue:()=>IJ,findDefect:()=>TJ,findError:()=>CJ,findErrorOption:()=>MJ,getCause:()=>PJ,getSuccess:()=>RJ,hasDies:()=>bJ,hasFails:()=>SJ,hasInterrupts:()=>i0,interrupt:()=>ld,isExit:()=>fd,isFailure:()=>no,isSuccess:()=>ut,map:()=>vJ,mapBoth:()=>OJ,mapError:()=>kJ,match:()=>c0,succeed:()=>Gr,void:()=>Bt});var fd=Sp,Gr=We,Fn=Nt,la=ko,a0=Jr,ld=bf,Bt=Ur;var ut=Xa,no=cI,SJ=nP,bJ=rP,i0=fI,EJ=QR,IJ=XR,wJ=eP,AJ=Yp,CJ=uI,TJ=tP,c0=sP,vJ=lI,kJ=pI,OJ=dI,_J=aP,pd=mI,RJ=iP,PJ=cP,MJ=uP;var FJ=\"~effect/Deferred\";var NJ={[FJ]:{_A:D,_E:D},pipe(){return te(this,arguments)}},a1=function(){this.resumes=void 0,this.effect=void 0};a1.prototype=NJ;var Mc=()=>new a1;var og=e=>Dt(t=>e.effect?t(e.effect):(e.resumes??=[],e.resumes.push(t),X(()=>{let r=e.resumes;if(r===void 0)return;let n=r.indexOf(t);n>=0&&r.splice(n,1)})));var UJ=l(2,(e,t)=>X(()=>ys(e,t))),DJ=UJ;var LJ=l(2,(e,t)=>DJ(e,Nt(t)));var u0=l(2,(e,t)=>LJ(e,Ya(t)));var ys=(e,t)=>{if(e.effect)return!1;if(e.effect=t,e.resumes){let r=e.resumes;e.resumes=void 0;for(let n=0;n<r.length;n++)r[n](t)}return!0};var i1=oa;var c1=bx;var u1=wc;var Vr=ri;var oo=Gx,Ss=WP,bs=ni,xr=Jx;var tr=HP,Xe=kI;var d1=\"~effect/Layer\",f1=\"~effect/Layer/MemoMap\",KJ=(e,t)=>{let r={observers:0,deferred:Mc(),scope:oo(),finalizer:n=>be(()=>--r.observers>0?Se:(e.map.delete(t),Xe(r.scope,n)))};return r},l1=(e,t)=>t.state._tag===\"Closed\"?!1:(e.observers++,If(t,{},e.finalizer),!0),m1=e=>A(e,d1),BJ={[d1]:{_ROut:D,_E:D,_RIn:D},pipe(){return te(this,arguments)}},h1=e=>{let t=Object.create(BJ);return t.build=e,t},jJ=e=>h1((t,r)=>{let n=tr(r);return Mn(e(t,n),o=>o._tag===\"Failure\"?Xe(n,o):Se)}),f0=e=>{let t=jJ((r,n)=>r.getOrElseMemoize(t,n,e));return t},ag=class{get[f1](){return f1}parent;constructor(t){this.parent=t}map=new Map;get(t,r){let n=this.map.get(t);return n?(l1(n,r),n.deferred.effect??og(n.deferred)):this.parent?.get(t,r)}getOrElseMemoize(t,r,n){return be(()=>{let o;return Po(be(()=>{let s=this.get(t,r);if(s)return s;let a=KJ(this,t);return l1(a,r)?(o=a.deferred,this.map.set(t,a),n(this,a.scope)):n(this,r)}),s=>{o&&ys(o,s)})})}},md=()=>new ag,HJ=e=>new ag(e);var dd=class e extends Et()(\"effect/Layer/CurrentMemoMap\"){static forkOrCreate(t){let r=ex(t,e);return r?HJ(r):md()}},hd=l(3,(e,t,r)=>Lr(Fe(be(()=>e.build(t,r)),dr(dd,t)),dd,t));var cg=l(2,(e,t)=>se(r=>hd(e,dd.forkOrCreate(r.context),t))),x1=function(){return arguments.length===1?e=>ig(xc(arguments[0],e)):ig(xc(arguments[0],arguments[1]))},ig=e=>h1(gt(z(e)));var pa=function(){return arguments.length===1?e=>p1(arguments[0],e):p1(arguments[0],arguments[1])},p1=(e,t)=>zJ(Fe(t,r=>xc(e,r))),zJ=e=>f0((t,r)=>Ss(e,r));var g1=(e,t,r)=>{let n=tr(r,\"parallel\");return _n(e,o=>o.build(t,tr(n,\"sequential\")),{concurrency:e.length}).pipe(Fe(o=>g_(...o)))},y1=(...e)=>f0((t,r)=>g1(e,t,r));var WJ=(e,t,r)=>f0((n,o)=>oe(Array.isArray(t)?g1(t,n,o):t.build(n,o),s=>e.build(n,o).pipe(Pn(s),Fe(a=>r(a,s))))),S1=l(2,(e,t)=>WJ(e,t,D));var Tf=Dr;var fg=\"~effect/DateTime\",lg=\"~effect/DateTime/TimeZone\",E1={[fg]:fg,pipe(){return te(this,arguments)},[Je](){return this.toString()},toJSON(){return yd(this).toJSON()}},I1={...E1,_tag:\"Utc\",[re](){return Lt(this.epochMilliseconds)},[ne](e){return kf(e)&&e._tag===\"Utc\"&&this.epochMilliseconds===e.epochMilliseconds},toString(){return`DateTime.Utc(${yd(this).toJSON()})`}},w1={...E1,_tag:\"Zoned\",[re](){return Ee(Lt(this.epochMilliseconds))(V(this.zone))},[ne](e){return kf(e)&&e._tag===\"Zoned\"&&this.epochMilliseconds===e.epochMilliseconds&&Z(this.zone,e.zone)},toString(){return`DateTime.Zoned(${A0(this)})`}},A1={[lg]:lg,[Je](){return this.toString()}},JJ={...A1,_tag:\"Named\",[re](){return Pe(`Named:${this.id}`)},[ne](e){return Nc(e)&&e._tag===\"Named\"&&this.id===e.id},toString(){return`TimeZone.Named(${this.id})`},toJSON(){return{_id:\"TimeZone\",_tag:\"Named\",id:this.id}}},GJ={...A1,_tag:\"Offset\",[re](){return Pe(`Offset:${this.offset}`)},[ne](e){return Nc(e)&&e._tag===\"Offset\"&&this.offset===e.offset},toString(){return`TimeZone.Offset(${E0(this.offset)})`},toJSON(){return{_id:\"TimeZone\",_tag:\"Offset\",offset:this.offset}}},VJ={value:void 0,enumerable:!1,writable:!0},l0=new WeakMap,ug=(e,t)=>({get(){return Object.isExtensible(this)?void 0:l0.get(this)?.[e]},set(r){if(Object.isExtensible(this)){for(let n of t)Object.defineProperty(this,n,VJ);this[e]=r}else{let n=l0.get(this);n===void 0&&(n={},l0.set(this,n)),n[e]=r}}}),p0=[\"partsUtc\",\"adjustedEpochMilliseconds\",\"partsAdjusted\"];Object.defineProperty(I1,\"partsUtc\",ug(\"partsUtc\",[\"partsUtc\"]));Object.defineProperties(w1,{partsUtc:ug(\"partsUtc\",p0),adjustedEpochMilliseconds:ug(\"adjustedEpochMilliseconds\",p0),partsAdjusted:ug(\"partsAdjusted\",p0)});var Es=(e,t,r)=>{let n=Object.create(w1);return n.epochMilliseconds=e,n.zone=t,r!==void 0&&(n.partsUtc=r),n},kf=e=>A(e,fg);var Nc=e=>A(e,lg),C1=e=>Nc(e)&&e._tag===\"Offset\",T1=e=>Nc(e)&&e._tag===\"Named\",v1=e=>e._tag===\"Utc\",h0=e=>e._tag===\"Zoned\",k1=Kt((e,t)=>e.epochMilliseconds===t.epochMilliseconds);var O1=e=>{let t=Object.create(I1);return t.epochMilliseconds=e,t},vf=e=>{let t=e.getTime();if(Number.isNaN(t))throw new ud(\"Invalid date\");return O1(t)},dg=e=>{if(kf(e))return e;if(e instanceof Date)return vf(e);if(typeof e==\"object\"){if(\"epochMilliseconds\"in e)return vf(new Date(e.epochMilliseconds));let t=new Date(0);return n5(t,e),vf(t)}else if(typeof e==\"string\"&&!ZJ(e))return vf(new Date(e+\"Z\"));return vf(new Date(e))},ZJ=e=>/Z|GMT|[+-]\\d{2}$|[+-]\\d{2}:?\\d{2}$|\\]$/.test(e)||/z$|gmt$/i.test(e),YJ=-864e13+720*60*1e3,QJ=864e13-840*60*1e3,x0=(e,t)=>{let r=t?.timeZone;if(r===void 0&&kf(e)&&h0(e))return e;let n=dg(e);if(n.epochMilliseconds<YJ||n.epochMilliseconds>QJ)throw new RangeError(`Epoch millis out of range: ${n.epochMilliseconds}`);r===void 0&&typeof e==\"object\"&&\"timeZoneId\"in e&&(r=e.timeZoneId);let o;if(r===void 0){let s=new Date(n.epochMilliseconds).getTimezoneOffset()*-60*1e3;o=gd(s)}else if(Nc(r))o=r;else if(typeof r==\"number\")o=gd(r);else{let s=S0(r);if(ge(s))throw new ud(`Invalid time zone: ${r}`);o=s.value}return t?.adjustForTimeZone!==!0?Es(n.epochMilliseconds,o,n.partsUtc):o5(n.epochMilliseconds,o,t?.disambiguation??\"compatible\")},d0=Oo(x0),_1=Oo(dg),XJ=/^(.{17,35})\\[(.+)\\]$/,R1=e=>{let t=XJ.exec(e);if(t===null){let o=w0(e);return o!==null?d0(e,{timeZone:o}):v()}let[,r,n]=t;return d0(r,{timeZone:n})};var P1=e=>O1(e.epochMilliseconds);var pg=new Map,e5={day:\"numeric\",month:\"numeric\",year:\"numeric\",era:\"short\",hour:\"numeric\",minute:\"numeric\",second:\"numeric\",timeZoneName:\"longOffset\",fractionalSecondDigits:3,hourCycle:\"h23\"},t5=e=>{let t=e.resolvedOptions().timeZone,r=pg.get(t);if(r!==void 0)return r;let n=Object.create(JJ);return n.id=t,n.format=e,pg.set(t,n),n},g0=e=>{let t=pg.get(e);if(t!==void 0)return t;try{let r=t5(new Intl.DateTimeFormat(\"en-US\",{...e5,timeZone:e}));return pg.set(e,r),r}catch{throw new ud(`Invalid time zone: ${e}`)}},gd=e=>{let t=Object.create(GJ);return t.offset=e,t},y0=Oo(g0);var r5=/^(?:GMT)?[+-]/,S0=e=>{if(r5.test(e)){let t=w0(e);return t===null?v():_(gd(t))}return y0(e)},M1=e=>e._tag===\"Offset\"?E0(e.offset):e.id;var yd=e=>new Date(e.epochMilliseconds),mg=e=>{if(e._tag===\"Utc\")return new Date(e.epochMilliseconds);if(e.zone._tag===\"Offset\")return new Date(e.epochMilliseconds+e.zone.offset);if(e.adjustedEpochMilliseconds!==void 0)return new Date(e.adjustedEpochMilliseconds);let t=!1,r=e.zone.format.formatToParts(e.epochMilliseconds).filter(s=>s.type===\"era\"?(t=s.value===\"BC\",!1):s.type!==\"literal\"),n=Number(r[2].value),o=new Date(0);return o.setUTCFullYear(t?1-n:n,Number(r[0].value)-1,Number(r[1].value)),o.setUTCHours(Number(r[3].value),Number(r[4].value),Number(r[5].value),r[6]?.type===\"fractionalSecond\"?Number(r[6].value):(e.epochMilliseconds%1e3+1e3)%1e3),e.adjustedEpochMilliseconds=o.getTime(),o},b0=e=>mg(e).getTime()-I0(e),E0=e=>{let t=Math.abs(e),r=Math.floor(t/(3600*1e3)),n=Math.round(t%(3600*1e3)/(60*1e3));return n===60&&(r+=1,n=0),`${e<0?\"-\":\"+\"}${String(r).padStart(2,\"0\")}:${String(n).padStart(2,\"0\")}`},F1=e=>E0(b0(e)),I0=e=>e.epochMilliseconds;var n5=(e,t)=>{if((t.year!==void 0||t.month!==void 0||t.day!==void 0)&&e.setUTCFullYear(t.year??e.getUTCFullYear(),t.month!==void 0?t.month-1:e.getUTCMonth(),t.day??e.getUTCDate()),t.weekDay!==void 0){let r=t.weekDay-e.getUTCDay();e.setUTCDate(e.getUTCDate()+r)}t.hour!==void 0&&e.setUTCHours(t.hour),t.minute!==void 0&&e.setUTCMinutes(t.minute),t.second!==void 0&&e.setUTCSeconds(t.second),t.millisecond!==void 0&&e.setUTCMilliseconds(t.millisecond)};var b1=1440*60*1e3,o5=(e,t,r)=>{if(t._tag===\"Offset\")return Es(e-t.offset,t);let n=xd(e-b1,e,t),o=xd(e+b1,e,t);if(n===o)return Es(e-n,t);let s=n<o,a=n-o;if(s){if(xd(e-o,e,t)===o)return Es(e-o,t);let u=Es(e-n,t),f=mg(u).getTime();if(e!==f)switch(r){case\"reject\":{let p=new Date(e).toISOString();throw new RangeError(`Gap time: ${p} does not exist in time zone ${t.id}`)}case\"earlier\":return Es(e-o,t);case\"compatible\":case\"later\":return u}return u}if(xd(e-n,e,t)===n){if(r===\"earlier\"||r===\"compatible\"||xd(e-n+a,e+a,t)===n)return Es(e-n,t);if(r===\"reject\"){let u=new Date(e).toISOString();throw new RangeError(`Ambiguous time: ${u} occurs twice in time zone ${t.id}`)}}return Es(e-o,t)},s5=/([+-])(\\d{2}):?(\\d{2})$/,w0=e=>{let t=s5.exec(e);if(t===null)return null;let[,r,n,o]=t;return(r===\"+\"?1:-1)*(Number(n)*60+Number(o))*60*1e3},xd=(e,t,r)=>{let n=r.format.formatToParts(e).find(s=>s.type===\"timeZoneName\")?.value??\"\";if(n===\"GMT\")return 0;let o=w0(n);return o===null?b0(Es(t,r)):o};var N1=e=>yd(e).toISOString();var m0=e=>{let t=mg(e);return e._tag===\"Utc\"?t.toISOString():`${t.toISOString().slice(0,-1)}${F1(e)}`},A0=e=>e.zone._tag===\"Offset\"?m0(e):`${m0(e)}[${e.zone.id}]`;var Cpe=globalThis.Number;var D1=l(2,(e,t)=>{if(!globalThis.Number.isFinite(e)||!globalThis.Number.isFinite(t)||t===0)return NaN;if(globalThis.Number.isInteger(e)&&globalThis.Number.isInteger(t))return e%t;let[r,n]=U1(e),[o,s]=U1(t),a=Math.min(n,s),i=r*BigInt(10)**BigInt(n-a),c=o*BigInt(10)**BigInt(s-a),u=i%c;if(u===BigInt(0))return e<0||Object.is(e,-0)?-0:0;let f=globalThis.Number(`${u}e${a}`);return f===0?Math.sign(e)*globalThis.Number.MIN_VALUE:f});function U1(e){if(globalThis.Number.isInteger(e))return[BigInt(e),0];let t=Math.abs(e).toExponential(),r=t.indexOf(\"e\"),n=t.slice(0,r).replace(\".\",\"\");return[BigInt(n)*(e<0?-BigInt(1):BigInt(1)),globalThis.Number(t.slice(r+1))-n.length+1]}var L1=e=>{let t=Math.pow(2,Math.ceil(Math.log2(e)));return Math.max(t<e?t*2:t,2)};var vpe=globalThis.String,hg=Wr;var $1=e=>e.toUpperCase();var K1=e=>e.trim();var c5=(e,t,r,n,o)=>{let s=e;for(let c of t)s=s.replace(c,\"$1\\0$2\");for(let c of r)s=s.replace(c,\"\\0\");let a=0,i=s.length;for(;s.charAt(a)===\"\\0\";)a++;for(;s.charAt(i-1)===\"\\0\";)i--;return a>=i?\"\":s.slice(a,i).split(\"\\0\").map(o).join(n)};var u5=[/([a-z0-9])([A-Z])/g,/([A-Z])([A-Z][a-z])/g],f5=/[^A-Z0-9]+/gi;var B1=e=>c5(e,u5,[f5],\"_\",$1);var At=l(2,(e,t)=>ca(e,l5,r=>t(r))),Is=e=>e.reasons.some(C0),C0=e=>e._tag===\"Fail\"&&Pc(e.error),Sd=e=>{let t,r=!1;for(let n of e.reasons)C0(n)?t??=n.error:n._tag!==\"Interrupt\"&&(r=!0);return t===void 0?q(e):r?q(gs(e.reasons.filter(n=>!C0(n)))):j(t)};var l5=e=>{let t=Sd(e);return ae(t)?t:j(t.success.value)},bd=e=>{let t=Sd(e);return ae(t)?Fn(t.failure):Gr(t.success.value)},Uc=l(2,(e,t)=>_o(e,{onSuccess:t.onSuccess,onFailure:r=>{let n=Sd(r);return ae(n)?t.onFailure(n.failure):t.onDone(n.success.value)}}));var j1=\"~effect/Schedule\";var gr=Te(\"effect/Schedule/CurrentMetadata\",{defaultValue:gt({input:void 0,output:void 0,duration:ta,attempt:0,start:0,now:0,elapsed:0,elapsedSincePrevious:0})}),p5={[j1]:{_Out:D,_In:D,_Env:D},pipe(){return te(this,arguments)}},T0=e=>A(e,j1),Ed=e=>{let t=Object.create(p5);return t.step=e,t},v0=()=>{let e=0,t,r;return(n,o)=>{r===void 0&&(r=n);let s=n-r,a=t===void 0?0:n-t;return t=n,{input:o,attempt:++e,start:r,now:n,elapsed:s,elapsedSincePrevious:a}}},d5=e=>Ed(Fe(e,t=>{let r=v0();return(n,o)=>t(r(n,o))})),Lc=e=>un(e.step,t=>z(()=>Le(t))),Fo=e=>Mo(t=>Fe(Lc(e),r=>{let n=v0();return o=>be(()=>{let s=t.currentTimeMillisUnsafe();return oe(r(s,o),([a,i])=>{let c=n(s,o);return c.output=a,c.duration=i,Rn(wf(i),c)})})})),Id=e=>Fe(Fo(e),t=>r=>Fe(t(r),n=>n.output));var k0=e=>Ed(Fe(Lc(e),t=>(r,n)=>Uc(t(r,n),{onSuccess:o=>z([n,o[1]]),onFailure:Le,onDone:()=>ue(n)}))),H1=e=>wd(Ad,({attempt:t})=>z(t<=e)),O0=e=>{let t=ct(e);return d5(z(r=>z([r.attempt-1,t])))};var wd=l(2,(e,t)=>Ed(Fe(Lc(e),r=>{let n=v0();return(o,s)=>oe(r(o,s),a=>{let[i,c]=a,u=t({...n(o,s),output:i,duration:c});return oe(de(u)?u:z(u),f=>f?z(a):ue(i))})})));var Ad=O0(ta);var z1=\"~effect/ExecutionPlan\";var m5={[z1]:z1,get captureRequirements(){let e=this;return ei(t=>z(h5(e.steps.map(r=>({...r,while:r.while?n=>Pn(r.while(n),t):void 0,schedule:r.schedule?Ed(Pn(Fe(Lc(r.schedule),n=>(o,s)=>Pn(n(o,s),t)),t)):void 0,provide:m1(r.provide)?S1(r.provide,ig(t)):r.provide})))))},pipe(){return te(this,arguments)}},h5=e=>{let t=Object.create(m5);return t.steps=e,t};var gg=Te(\"effect/ExecutionPlan/CurrentMetadata\",{defaultValue:gt({attempt:0,stepIndex:0})});var x5=(e,t,r)=>Vx(n=>oe(r?.local?hd(t,md(),n):cg(t,n),o=>Pn(e,o))),yg=l(e=>de(e[0]),(e,t,r)=>kp(t)?Pn(e,t):x5(e,Array.isArray(t)?y1(...t):t,r));var R0=l(3,(e,t,r)=>oe(Fo(t),n=>{let o=gr.defaultValue(),s=a=>Uc(n(a),{onSuccess(i){return o=i,oe(Lr(e,gr,o),s)},onFailure:Le,onDone:z});return ca(oe(Lr(e,gr,o),s),cn,a=>r(a,o.attempt===0?v():_(o)))})),P0=l(3,(e,t,r)=>oe(Fo(t),n=>{let o=gr.defaultValue(),s,a=ca(be(()=>Lr(e,gr,o)),cn,i=>(s=i,oe(n(i),c=>(o=c,a))));return At(a,i=>za(()=>r(s,i)))})),q1=l(2,(e,t)=>{let r=typeof t==\"function\"?t(D):T0(t)?t:Td(t);return R0(e,r,dt)}),Cd=l(2,(e,t)=>{let r=typeof t==\"function\"?t(D):T0(t)?t:Td(t);return P0(e,r,dt)}),J1=l(3,(e,t,r)=>oe(Fo(r),n=>{let o=s=>Uc(n(s),{onSuccess:a=>oe(Lr(e,gr,a),o),onFailure:Le,onDone:z});return o(t)})),g5=k0(Ad),Td=e=>{let t=e.schedule?k0(e.schedule):g5;return e.while&&(t=wd(t,({input:r})=>{let n=e.while(r);return de(n)?n:z(n)})),e.until&&(t=wd(t,({input:r})=>{let n=e.until(r);return de(n)?Fe(n,o=>!o):z(!n)})),e.times!==void 0&&(t=wd(t,({attempt:r})=>z(r<=e.times))),t};var M0=(e,t)=>{let r=-1,n=0,o=s=>zx(e(s));return{begin:Mo(s=>be(()=>{let a=t();a.stepIndex!==r&&(r=a.stepIndex,n=0),n++;let i={attempt:a.attempt,stepAttempt:n,stepIndex:a.stepIndex,startNanos:s.monotonicTimeNanosUnsafe()};return Rn(o({_tag:\"AttemptStart\",attempt:i.attempt,stepAttempt:i.stepAttempt,stepIndex:i.stepIndex}),i)})),end:(s,a)=>Mo(i=>{let c=On(i.monotonicTimeNanosUnsafe()-s.startNanos);return o(a._tag===\"Success\"?{_tag:\"AttemptSuccess\",attempt:s.attempt,stepAttempt:s.stepAttempt,stepIndex:s.stepIndex,duration:c}:{_tag:\"AttemptFailure\",attempt:s.attempt,stepAttempt:s.stepAttempt,stepIndex:s.stepIndex,duration:c,cause:a.cause})})}},V1=l(e=>de(e[0]),(e,t,r)=>be(()=>{let n=0,o={attempt:0,stepIndex:0},s=Bx(gg,X(()=>(o={attempt:o.attempt+1,stepIndex:n},o))),a=r?.onEvent===void 0?void 0:M0(r.onEvent,()=>o),i=a===void 0?D:u=>ro(f=>oe(a.begin,p=>Mn(f(u),d=>a.end(p,d)))),c;return oe(si({while:()=>n<t.steps.length&&(c===void 0||ae(c)),body(){let u=t.steps[n],f=s(i(yg(e,u.provide)));if(c){let p=!1,d=f;f=be(()=>p?d:(p=!0,gf(c))),f=Cd(f,vd(u,!1))}else{let p=vd(u,!0);f=p?Cd(f,p):f}return Za(f)},step(u){c=u,n++}}),()=>gf(c))})),vd=(e,t)=>{if(t){if(e.attempts===1||!(e.schedule||e.attempts))return}else return Td({schedule:e.schedule?e.schedule:e.attempts?void 0:y5,times:e.attempts,while:e.while});return Td({schedule:e.schedule,while:e.while,times:e.attempts?e.attempts-1:void 0})},y5=H1(1);var Y1=\"~effect/MutableHashMap\";var S5={[Y1]:Y1,[Symbol.iterator](){return this.backing[Symbol.iterator]()},toString(){return`MutableHashMap(${K(Array.from(this))})`},toJSON(){return{_id:\"MutableHashMap\",values:qt(Array.from(this))}},[Je](){return this.toJSON()},pipe(){return te(this,arguments)}},$c=()=>{let e=Object.create(S5);return e.backing=new Map,e.buckets=new Map,e};var Nn=l(2,(e,t)=>{if(e.backing.has(t))return _(e.backing.get(t));if(F0(t))return v();let r=V(t),n=e.buckets.get(r);return n===void 0?v():b5(e,n,t)}),F0=e=>typeof e!=\"object\"&&typeof e!=\"function\";var b5=(e,t,r)=>{for(let n=0,o=t.length;n<o;n++)if(Z(r,t[n])){let s=t[n];return _(e.backing.get(s))}return v()},N0=l(2,(e,t)=>Ce(Nn(e,t))),Kc=l(3,(e,t,r)=>{if(e.backing.has(t)||F0(t))return e.backing.set(t,r),e;let n=V(t),o=e.buckets.get(n);if(o===void 0)return e.buckets.set(n,[t]),e.backing.set(t,r),e;let s=E5(o,t);return s===void 0&&(o.push(t),s=t),e.backing.set(s,r),e}),E5=(e,t)=>{for(let r=0,n=e.length;r<n;r++)if(Z(t,e[r]))return e[r]};var ci=l(2,(e,t)=>{if(F0(t))return e.backing.delete(t),e;let r=V(t),n=e.buckets.get(r);if(n===void 0)return e;for(let o=0,s=n.length;o<s;o++){let a=n[o];if(a===t||Z(t,a)){e.backing.delete(a),n.splice(o,1);break}}return n.length===0&&e.buckets.delete(r),e}),Sg=e=>(e.backing.clear(),e.buckets.clear(),e),Q1=e=>e.backing.size;var I5=\"~effect/Request\",w5=Rh({_E:e=>e,_A:e=>e,_R:e=>e}),Vpe={...UO,[I5]:w5};var X1=e=>e;var eF=l(2,(e,t)=>{let r=n=>Dt(o=>{let s=rF(n,e,o,sa());return k5(n,s)});return de(t)?oe(t,r):r(t)}),tF=(e,t)=>{let r=rF(t.resolver,e,t.onExit,{context:t.context,cache:{scheduler:Me(t.context,uf)}});return()=>nF(t.resolver,r)},C5=new WeakSet,T5=e=>{if(!C5.has(e.batchKey))return new Map;let t=$c();return{get:r=>ps(Nn(t,r)),has:r=>N0(t,r),set:(r,n)=>Kc(t,r,n),delete:r=>ci(t,r)}},U0=new WeakMap,v5=(e,t,r,n)=>{let o={key:e,context:t,resolver:r,map:n,entrySet:new Set,entries:new Set,delayEffect:oe(se(s=>(o.fiber=s,o.resolver.delay)),s=>oF(o)),run:Mn(be(()=>o.resolver.runAll(Array.from(o.entries),o.key)),s=>{for(let a of o.entrySet)a.completeUnsafe(s._tag===\"Success\"?Jr(new Error(\"Effect.request: RequestResolver did not complete request\",{cause:a.request})):s);return o.entries.clear(),Se})};return o},rF=(e,t,r,n)=>{let o=U0.get(e);o||(o=T5(e),U0.set(e,o));let s,a=!1,i=X1({request:t,context:n.context,uninterruptible:!1,completeUnsafe(f){a||(a=!0,!(s&&!s.entrySet.delete(i))&&r(f))}});if(e.preCheck!==void 0&&!e.preCheck(i))return i;let c=e.batchKey(i);s=o.get(c);let u=s===void 0;if(s||(s=v5(c,n.context,e,o),o.set(c,s)),s.entrySet.add(i),s.entries.add(i),u){let f=ua(n.context)(s.delayEffect,{scheduler:n.cache.scheduler});if(a||o.get(c)!==s)return i;s.fiber=f}return s.resolver.collectWhile(s.entries)||(s.fiber.interruptUnsafe(n.id),ua(s.context)(oF(s),{scheduler:Me(s.context,uf)})),i},nF=(e,t)=>{if(t.uninterruptible)return;let r=U0.get(e);if(!r)return;let n=e.batchKey(t),o=r.get(n);if(!o||!o.entries.delete(t))return;o.entrySet.delete(t);let s;o.entries.size===0&&(r.delete(n),s=o.fiber),t.completeUnsafe(bf()),s?.interruptUnsafe()},k5=(e,t)=>X(()=>nF(e,t));function oF(e){return e.map.has(e.key)?(e.map.delete(e.key),e.run):Se}var _5=\"effect/Metric/CurrentMetricAttributes\",R5=Te(_5,{defaultValue:()=>({})}),P5=\"effect/Metric/MetricRegistry\",D0=Te(P5,{defaultValue:()=>new Map}),sF=\"~effect/Metric\",aF=class{[sF]=sF;#e;#t;#r=\"\";id;description;attributes;constructor(t,r,n){this.id=t,this.description=r,this.attributes=n}valueUnsafe(t){return this.hook(t).get(t)}modifyUnsafe(t,r){return this.hook(r).modify(t,r)}updateUnsafe(t,r){return this.hook(r).update(t,r)}hook(t){let r=this.key(t),n=Me(t,D0),o=n.get(r);return EO(o)&&(o=this.metadata(this.createHooks()),n.set(r,o)),o.hooks}removeUnsafe(t){Me(t,D0).delete(this.key(t))}registerUnsafe(t,r){let n=this.key(t),o=Me(t,D0),s=this.metadata({get:r.get,update:zr,modify:zr});return o.set(n,s),{remove(){o.get(n)===s&&o.delete(n)}}}key(t){let r=Me(t,R5);if(r!==this.#e){this.#e=r;let n=F5(this.attributes,r);this.#t=Object.keys(r).length>0?n:this.attributes,this.#r=M5(this,n)}return this.#r}metadata(t){return{id:this.id,type:this.type,description:this.description,attributes:this.#t,hooks:t}}pipe(){return te(this,arguments)}};var _f=l(2,(e,t)=>ei(r=>X(()=>e.updateUnsafe(t,r))));function M5(e,t){let r=Object.entries(t).sort((n,o)=>n[0]<o[0]?-1:n[0]>o[0]?1:0);return JSON.stringify([e.type,e.id,e.description,r])}function F5(e,t){return{...iF(e),...iF(t)}}function iF(e){return cs(e)&&Array.isArray(e)?e.reduce((t,[r,n])=>(B(t,r,n),t),{}):e}var N5=fs,ws=de,Eg=sd,U5=UI,D5=sM,L5=aM,$5=iM,K5=uM,ui=_n,B5=lM,No=si,Pf=XE,fi=FR,g=z,li=Tc,$0=YE,L=be,Y=X,ie=Se;var j5=GI;var Mf=Dt,Bc=Lx,H5=gM,z5=yM,W5=bM;var q5=SM,kt=DR,F=dt,Ig=QE,$e=Le,da=PR,yr=Qa,Ff=MR;var kd=yf,J5=ZE,Un=se,G5=$O,jc=gf,V5=VE,Z5=RR,Y5=_R,C=oe,K0=JR,Zr=xs,Yr=Vp,Q5=Za,X5=MP,so=rd,W=Fe,jt=Rn,wg=Sf,pi=Zp,e8=jR,B0=mP,t8=xI,Uo=ti;var r8=bI,n8=TP,o8=vP,s8=kP,a8=OP,nt=un,i8=EP,c8=Qp,u8=Hx,f8=bP,l8=yI,p8=ca,Do=EI,d8=II,m8=wI,Ag=SI,h8=AP,fF=IP,x8=wP,g8=jx,lF=CP,y8=AI,S8=Cd,b8=P0,E8=HR,I8=PP,di=zx,w8=V1,A8=s1,C8=_P,T8=RP,v8=KP,k8=vI,O8=TI,j0=$P,mi=wf,_8=BP,H0=sI,R8=aI,P8=zR,Nf=iI,z0=mM,M8=hM,W0=xM,F8=DI,N8=LI,U8=hP,D8=dM,Cg=xP,q0=Wx,L8=td,$8=CI,K8=UP,B8=WR,As=_o,j8=ed,H8=DP,z8=LP,Hc=hI,Od=ei,W8=yg,ao=Pn,q8=dP,J0=fP,G0=lP,J8=Ef,G8=ia,V8=pP,Cs=Lr,Z8=Bx,zc=vc,Tg=OI,vg=Vx,Wc=kc,Y8=ZP,pF=nd,Q8=_I,hi=JP,Lo=MI,X8=GP,eG=FI,_d=Po,Dn=Mn,tG=RI,rG=PI,nG=XP,oG=QP,sG=NI,io=eM,aG=Zx,V0=VP,ma=Oc,$o=ro,iG=nM,cG=oM,ir=yP,uG=q1,fG=R0,lG=gI,pG=gP,dG=l(2,(e,t)=>dF(e,void 0,t)),dF=J1,mG=FM,hG=NM,xG=UM,gG=DM,yG=WM,SG=qM,bG=JM,EG=GM,IG=BM,wG=jM,AG=HM,Z0=$M,CG=$p,TG=Kp,vG=zM,kG=KM,OG=pf,_G=eF,RG=tF,Uf=EM,rr=$I,Df=CM,PG=IM,MG=wM,FG=NR,NG=UR,Rd=vM,co=ua,UG=KI,DG=kM,Y0=_M,Q0=BI,kg=OM,LG=Xx,$G=PM,KG=jI,Ts=RM,BG=eg,_e=rI,jG=LR,qc=Mo,HG=Ro,zG=Ro(),WG=Ro(\"Fatal\"),qG=Ro(\"Warn\"),X0=Ro(\"Error\"),JG=Ro(\"Info\"),GG=Ro(\"Debug\"),VG=Ro(\"Trace\"),ZG=l(2,(e,t)=>ia(e,JI,r=>new Set([...r,t]))),YG=l(e=>ws(e[0]),(e,...t)=>ia(e,i1,r=>{let n=t.length===1?{...r,...t[0]}:{...r};return t.length===1||B(n,t[0],t[1]),n})),QG=n1,XG=l(2,(e,t)=>oe(WI,r=>ia(e,c1,n=>[[t,r],...n]))),eV=l(e=>ws(e[0]),(e,t,r)=>Dn(e,n=>{let o=r===void 0?n:r(n);return _f(t,o)})),tV=l(e=>ws(e[0]),(e,t,r)=>Yr(e,n=>{let o=r===void 0?n:r(n);return _f(t,o)})),rV=l(e=>ws(e[0]),(e,t,r)=>Ag(e,n=>{let o=r===void 0?n:r(n);return _f(t,o)})),nV=l(e=>ws(e[0]),(e,t,r)=>lF(e,n=>{let o=r===void 0?n:r(n);return _f(t,o)})),oV=l(e=>ws(e[0]),(e,t,r)=>qc(n=>{let o=n.monotonicTimeNanosUnsafe();return Dn(e,()=>{let s=n.monotonicTimeNanosUnsafe(),a=W_(ct(s),ct(o)),i=r===void 0?a:r(a);return _f(t,i)})})),Rf=class extends Et()(\"effect/Effect/Transaction\"){},sV=e=>Un(t=>{let r=ex(t.context,Rf);if(r&&!uF.has(r))return e;let n=t.getRef(Dr),o=n.currentTimeMillisUnsafe(),s={journal:new Map,retry:!1,attempt:1,retryReason:void 0,start:o,now:o,elapsed:0,elapsedSincePrevious:0},a;return $o(i=>{let c=i(e).pipe(Cs(Rf,s),fF(u=>s.retry?Px(u)?i(iV(s)):Y(()=>L0(s)):ie),so);return C(No({while:()=>!a,body:()=>(s.attempt>1&&aV(s,n.currentTimeMillisUnsafe()),c),step(u){if(s.retry||!mF(s))return s.attempt++,s.retryReason=s.retry?\"retry\":\"conflict\",L0(s);ut(u)&&cV(t,s),L0(s),uF.add(s),a=u}}),()=>a)})}),uF=new WeakSet,aV=(e,t)=>{e.elapsedSincePrevious=t-e.now,e.now=t,e.elapsed=t-e.start},mF=e=>{for(let[t,{version:r}]of e.journal)if(t.version!==r)return!1;return!0},iV=e=>Mf(t=>{if(!mF(e))return t(ie);let r={},n=Array.from(e.journal.keys()),o=()=>{for(let a of n)a.pending.delete(r)},s=()=>{o(),t(ie)};for(let a of n)a.pending.set(r,s);return Y(o)});function cV(e,t){for(let[r,{value:n,written:o}]of t.journal)if(o){Object.is(n,r.value)||(r.version=r.version+1,r.value=n);for(let s of r.pending.values())e.currentDispatcher.scheduleTask(s,0);r.pending.clear()}}function L0(e){e.retry=!1,e.journal.clear()}var uV=C(Rf,e=>{let t=e;return t.retry=!0,io}),fV=(e,t,r)=>(...n)=>Mf(o=>{let s=!0,a;try{e(...n,(i,c)=>{let u=i?t?L(()=>F(t(i,n))):F(i):g(c);s?a??=u:o(u)})}catch(i){a=r?F(r(i,n)):yr(i)}s=!1,a&&o(a)}),lV=()=>e=>e,pV=()=>e=>e,dV=()=>e=>e,fn=GR,Lf=VR,Sr=ZR,Ct=qR,$f=YR,ew=$R;var hF=GE;var xi=Ix,xF=kR,Ko=Dx;var Kf=sa,gi=TM;var br=Symbol.for(\"effect/MutableList/Empty\"),xa=()=>({head:void 0,tail:void 0,length:0}),tw=e=>{let t=e.head;t.offset>=1024&&t===e.tail&&t.mutable&&(t.array.length-t.offset)*8<=t.offset&&(e.head=e.tail={array:t.array.slice(t.offset),mutable:!0,offset:0,next:void 0})},gF=()=>({array:[],mutable:!0,offset:0,next:void 0}),Bo=(e,t)=>{e.tail?e.tail.mutable||(e.tail.next=gF(),e.tail=e.tail.next):e.head=e.tail=gF(),e.tail.array.push(t),e.length++},rw=(e,t)=>{e.head={array:[t],mutable:!0,offset:0,next:e.head},e.tail||(e.tail=e.head),e.length++};var yF=(e,t)=>Md(e,Array.from(t),!0),Md=(e,t,r=!1)=>{if(t.length===0)return 0;let n={array:t,mutable:r,offset:0,next:void 0};return e.head?e.tail=e.tail.next=n:e.head=e.tail=n,e.length+=t.length,t.length},ha=e=>{e.head=e.tail=void 0,e.length=0},Jc=(e,t)=>{if(t=It(t),t<=0||!e.head)return[];if(t=Math.min(t,e.length),t===e.length&&e.head?.offset===0&&!e.head.next){let s=e.head.array;return ha(e),s}let r=new Array(t),n=0,o=e.head;for(;o;){for(;o.offset<o.array.length;)if(r[n++]=o.array[o.offset],o.mutable&&(o.array[o.offset]=void 0),o.offset++,n===t)return e.head=o.offset===o.array.length&&o.next?o.next:o,e.length-=t,e.length===0?ha(e):tw(e),r;o=o.next}return ha(e),r},Og=(e,t)=>{if(t=It(t),t<=0||!e.head)return;if(t=Math.min(t,e.length),t===e.length&&e.head?.offset===0&&!e.head.next){ha(e);return}let r=0,n=e.head;for(;n;){let o=n.array.length-n.offset;if(r+o>t){n.offset+=t-r,e.head=n,e.length-=t,tw(e);return}r+=o,n=n.next}ha(e)},yi=e=>Jc(e,e.length),Gc=e=>{if(!e.head)return br;let t=e.head.array[e.head.offset];return e.head.mutable&&(e.head.array[e.head.offset]=void 0),e.head.offset++,e.length--,e.head.offset===e.head.array.length?e.head.next?e.head=e.head.next:ha(e):tw(e),t},SF=(e,t)=>{if(t=It(t),t<=0)return[];let r=Math.min(t,e.length),n=new Array(r),o=0,s=e.head;for(;s;){for(let a=s.offset;a<s.array.length;a++)if(n[o++]=s.array[a],o===r)return n;s=s.next}return n};var nw=(e,t)=>{let r=[],n=e.head,o=0;for(;n;){for(let s=n.offset;s<n.array.length;s++)t(n.array[s],o++)&&r.push(n.array[s]);n=n.next}if(r.length===0){ha(e);return}e.head=e.tail={array:r,mutable:!0,offset:0,next:void 0},e.length=r.length},bF=(e,t)=>nw(e,r=>r!==t);var mV=\"~effect/Queue\",hV=\"~effect/Queue/Enqueue\",xV=\"~effect/Queue/Dequeue\";var ow={_A:D,_E:D},gV={[mV]:ow,[hV]:ow,[xV]:ow,...kr,toJSON(){return{_id:\"effect/Queue\",state:this.state._tag,size:bV(this)}}},uo=e=>se(t=>{let r=Object.create(gV);return r.dispatcher=t.currentDispatcher,r.capacity=e?.capacity??Number.POSITIVE_INFINITY,r.strategy=e?.strategy??\"suspend\",r.messages=xa(),r.scheduleRunning=!1,r.state={_tag:\"Open\",takers:new Set,offers:new Set,awaiters:new Set},z(r)}),Fd=e=>uo({capacity:e});var EF=()=>uo(),Ln=l(2,(e,t)=>be(()=>Pg(e,t)?Fg:e.state._tag===\"Open\"&&e.strategy===\"suspend\"?AV(e,t):wF)),Pg=(e,t)=>e.state._tag!==\"Open\"?!1:e.messages.length>=e.capacity?e.strategy===\"sliding\"?(Gc(e.messages),Bo(e.messages,t),!0):e.capacity<=0&&e.state.takers.size>0?(Bo(e.messages,t),AF(e),!0):!1:(Bo(e.messages,t),Rg(e),!0),Vc=l(2,(e,t)=>Dt(r=>{let n=Mg(e,t);return n.length===0||e.strategy===\"dropping\"?r(We(n)):vF(e,{_tag:\"Array\",remaining:n,offset:0,resume:r})})),Mg=(e,t)=>{if(e.state._tag!==\"Open\")return wt(t);if(e.capacity===Number.POSITIVE_INFINITY||e.strategy===\"sliding\")return yF(e.messages,t),e.strategy===\"sliding\"&&Jc(e.messages,e.messages.length-e.capacity),Rg(e),[];let r=e.capacity<=0?e.state.takers.size:e.capacity-e.messages.length;if(r===0)return wt(t);let n=[],o=0;for(let s of t)o<r?Bo(e.messages,s):n.push(s),o++;return Rg(e),n};var cr=l(2,(e,t)=>X(()=>Si(e,t))),Si=(e,t)=>{if(e.state._tag!==\"Open\")return!1;let r=Nt(t),n=oP(r,EV);return e.state.offers.size===0&&e.messages.length===0?(Ng(e,n),!0):(e.state={...e.state,_tag:\"Closing\",exit:n},Rg(e),!0)},aw=e=>cr(e,Ju(pc())),Nd=e=>Si(e,Ju(pc()));var fo=e=>X(()=>yV(e)),yV=e=>{if(e.state._tag===\"Done\")return!1;ha(e.messages);let t=e.state.offers;Ng(e,e.state._tag===\"Open\"?IV:e.state.exit);for(let r of t)kF(r);return!0};var Zc=e=>IF(e,1,Number.POSITIVE_INFINITY);var IF=l(3,(e,t,r)=>(t=It(t),r=It(r),CF(()=>wV(e,t,r)??xs(TF(e,()=>iw(e,t)),IF(e,t,r))))),ga=e=>CF(()=>SV(e)??xs(TF(e,()=>iw(e,1)),ga(e)));var SV=e=>{if(e.state._tag===\"Done\")return e.state.exit;if(e.messages.length>0){let t=Gc(e.messages);return sw(e),We(t)}else if(e.capacity<=0&&e.state.offers.size>0){let t=OF(e.state.offers);return sw(e),We(t)}};var bV=e=>e.state._tag===\"Done\"?0:e.messages.length;var wF=We(!1),Fg=We(!0),EV=ko(pc()),IV=bf(),AF=e=>{if(!(e.state._tag===\"Done\"||e.state.takers.size===0)){for(let t of e.state.takers)if(t.ready()&&(e.state.takers.delete(t),t.resume(Ur),e.messages.length===0))break}},Rg=e=>{e.scheduleRunning||e.state._tag===\"Done\"||e.state.takers.size===0||(e.scheduleRunning=!0,e.dispatcher.scheduleTask(()=>{e.scheduleRunning=!1,AF(e)},0))},wV=(e,t,r)=>{if(e.state._tag===\"Done\")return e.state.exit;if(r<=0||t<=0)return We([]);if(!iw(e,t))return;let n=e.messages.length>0?Jc(e.messages,r):[OF(e.state.offers)];return sw(e),We(n)},CF=Zn({op:\"QueueTake\",[lt](e){let t=this[xe]();return Sp(t)?t[lt](e):t}}),iw=(e,t)=>e.messages.length>=(e.state._tag===\"Closing\"?1:Math.min(t,e.capacity||1))||e.capacity<=0&&e.state._tag!==\"Done\"&&e.state.offers.size>0,TF=(e,t)=>Dt(r=>{if(e.state._tag===\"Done\")return r(e.state.exit);if(t())return r(Ur);let n={ready:t,resume:r};return e.state.takers.add(n),X(()=>{e.state._tag!==\"Done\"&&e.state.takers.delete(n)})}),AV=(e,t)=>Dt(r=>Pg(e,t)?r(Fg):vF(e,{_tag:\"Single\",message:t,resume:r})),vF=(e,t)=>{if(e.state._tag!==\"Open\")return kF(t);let r=e.state.offers;return r.add(t),X(()=>{e.state._tag!==\"Done\"&&(r.delete(t),e.state._tag===\"Closing\"&&r.size===0&&e.messages.length===0&&Ng(e,e.state.exit))})},kF=e=>e._tag===\"Single\"?e.resume(wF):e.resume(We(e.remaining.slice(e.offset))),OF=e=>{let t=e.values().next().value;if(t._tag===\"Single\")return e.delete(t),t.resume(Fg),t.message;let r=t.remaining[t.offset++];return t.offset===t.remaining.length&&(e.delete(t),t.resume(We([]))),r},sw=e=>{if(e.state._tag===\"Done\")return Is(e.state.exit.cause);if(e.state.offers.size===0)return e.state._tag===\"Closing\"&&e.messages.length===0?(Ng(e,e.state.exit),Is(e.state.exit.cause)):!1;for(let t of e.state.offers){let r=e.capacity-e.messages.length;if(r<=0)break;if(t._tag===\"Single\")Bo(e.messages,t.message),e.state.offers.delete(t),t.resume(Fg);else{for(;t.offset<t.remaining.length;t.offset++){if(r===0)return!1;Bo(e.messages,t.remaining[t.offset]),r--}e.state.offers.delete(t),t.resume(We([]))}let n=e.state;if(n._tag===\"Done\")return Is(n.exit.cause)}return!1};var Ng=(e,t)=>{if(e.state._tag===\"Done\")return;let r=e.state;e.state={_tag:\"Done\",exit:t};for(let n of r.takers)n.resume(t);r.takers.clear();for(let n of r.awaiters)n(t);r.awaiters.clear()};var bi=Te(\"effect/crypto/WebCrypto\",{defaultValue:()=>globalThis.crypto});var Ei=class extends Et()(\"effect/crypto/SecureRandom\"){};var Ug=e=>new dw(e),lw=e=>{for(let t of e.waiters)if(t.permits<=e.free)return t},pw=(e,t,r,n=D)=>se(o=>{if(e.free>=t&&lw(e)===void 0)return e.taken+=t,r();let s={permits:t,resume:void 0},a=()=>{e.waiters.delete(s)&&e.releaseUnsafe(o,0)};e.waiters.add(s),oi(o,a);let i=n(Dt(u=>{lw(e)===s?u(Se):s.resume=u})),c=oe(i,()=>lw(e)!==s?c:(e.taken+=t,a(),r()));return c}),dw=class{waiters=new Set;taken=0;permits;constructor(t){this.permits=t}get free(){return this.permits-this.taken}take(t){return pw(this,t,()=>z(t))}takeScoped(t){return ro(r=>oe(vc,n=>pw(this,t,()=>Jx(n,this.release(t)),r)))}takeIfAvailable(t){return be(()=>this.free<t?z(!1):(this.taken+=t,z(!0)))}releaseUnsafe(t,r){return this.taken-=r,this.waiters.size>0&&t.currentDispatcher.scheduleTask(()=>{let n=this.free;for(let o of Array.from(this.waiters)){if(!this.waiters.has(o)||o.permits>n)continue;n-=o.permits;let s=o.resume;o.resume=void 0,s?.(Se)}},0),this.free}resize(t){return se(r=>(this.permits=t,this.free<0?Se:(this.releaseUnsafe(r,0),Se)))}release(t){return se(r=>z(this.releaseUnsafe(r,t)))}get releaseAll(){return se(t=>z(this.releaseUnsafe(t,this.taken)))}withPermits(t){return r=>ro(n=>pw(this,t,()=>Po(n(r),()=>{this.releaseUnsafe(sa(),t)},!0),n))}withPermit=this.withPermits(1);withPermitsIfAvailable(t){return r=>ro(n=>this.free<t?Tc:(this.taken+=t,Po(n(Sf(r)),()=>{this.releaseUnsafe(sa(),t)},!0)))}};var hw=1e4,hde=2*hw,RF=/^[+-]?\\d+$/,xw=\"~effect/BigDecimal\",CV={[xw]:xw,[re](){let e=yw(this);return Ee(Pe(String(e.value)),Lt(e.scale))},[ne](e){return gw(e)&&LF(this,e)===0},toString(){return`BigDecimal(${ya(this)})`},toJSON(){return{_id:\"BigDecimal\",value:String(this.value),scale:this.scale}},[Je](){return this.toJSON()},pipe(){return te(this,arguments)}},gw=e=>A(e,xw),FF=(e,t)=>{if(!Number.isSafeInteger(t))throw new RangeError(`Scale must be a safe integer, got ${t}`);let r=Object.create(CV);return r.value=e,r.scale=t,r},NF=(e,t)=>{let r=FF(e,t);return r.normalized=r,r};var lo=BigInt(0),TV=BigInt(1);var vV=BigInt(10),UF=NF(lo,0);var yw=e=>{if(e.normalized===void 0)if(e.value===lo)e.normalized=UF;else{let t=`${e.value}`,r=DF(t);e.normalized=NF(BigInt(t.slice(0,t.length-r)),e.scale-r)}return e.normalized},DF=e=>{let t=e.length;for(;e[t-1]===\"0\";)t--;return e.length-t};var kV=100,OV=[TV],mw=(e,t)=>e===t?0:e<t?-1:1,PF=(e,t)=>{let r=`${e.value<lo?-e.value:e.value}`,n=`${t.value<lo?-t.value:t.value}`,o=BigInt(r.length-n.length)-BigInt(e.scale)+BigInt(t.scale);if(o!==lo)return o<lo?-1:1;let s=Math.max(r.length,n.length);return r_(r.padEnd(s,\"0\"),n.padEnd(s,\"0\"))},LF=(e,t)=>{if(e.scale===t.scale)return mw(e.value,t.value);let r=MF(e),n=MF(t);if(r!==n)return r<n?-1:1;if(r===0)return 0;let o=e.scale-t.scale,s=Math.abs(o);if(s>kV)return r===-1?PF(t,e):PF(e,t);let a=OV[s]??=vV**BigInt(s);return o>0?mw(e.value,t.value*a):mw(e.value*a,t.value)},Bf=qa(LF);var MF=e=>e.value===lo?0:e.value<lo?-1:1;var $F=e=>{if(e===\"\")return _(UF);let t,r,n=e.search(/[eE]/);if(n!==-1){let f=e.slice(n+1);if(t=e.slice(0,n),r=Number(f),t===\"\"||!Number.isSafeInteger(r)||!RF.test(f))return v()}else t=e,r=0;let o,s,a=t.search(/\\./);if(a!==-1){let f=t.slice(0,a),p=t.slice(a+1);if(!/^\\d*$/.test(p))return v();o=`${f}${p}`,s=p.length}else o=t,s=0;if(!RF.test(o))return v();let i=s-r,c=BigInt(o),u=c===lo?i:i-DF(o);return i>hw||u<-hw?v():_(FF(c,i))};var ya=e=>{let t=yw(e);if(Math.abs(t.scale)>=16)return _V(t);let r=t.value<lo,n=`${r?-t.value:t.value}`,o=t.scale>0?n.padStart(t.scale+1,\"0\"):n.padEnd(n.length-t.scale,\"0\"),s=o.length-t.scale,a=t.scale>0?`${o.slice(0,s)}.${o.slice(s)}`:o;return r?`-${a}`:a},_V=e=>{if(RV(e))return\"0e+0\";let t=yw(e),r=`${t.value}`,n=t.value<lo?2:1,o=r.slice(0,n),s=r.slice(n),a=s.length-t.scale;return`${o}${s===\"\"?\"\":`.${s}`}e${a>=0?\"+\":\"\"}${a}`};var RV=e=>e.value===lo;var Ie={};An(Ie,{AeadKey:()=>Mv,AeadKeyFromBytes:()=>$ne,AeadKeyFromFormat:()=>Kne,Any:()=>Iee,Array:()=>Be,ArrayEnsure:()=>Mee,BigDecimal:()=>zB,BigDecimalFromString:()=>xre,BigInt:()=>Nl,BigIntFromString:()=>tre,Boolean:()=>Gm,BooleanFromBit:()=>cre,BooleanLiterals:()=>Sv,ByteSize:()=>$l,ByteSizeFromBigInt:()=>yre,ByteSizeFromNumber:()=>Sre,ByteSizeFromString:()=>gre,Cause:()=>dv,CauseReason:()=>pv,Char:()=>Kte,Chunk:()=>bre,CipherKey:()=>Fv,CipherKeyFromBytes:()=>Bne,CipherKeyFromFormat:()=>jne,Class:()=>Vj,Cookie:()=>Dj,Cookies:()=>Lj,Date:()=>Dl,DateFromMillis:()=>Gte,DateFromString:()=>Jte,DateTimeUtc:()=>Kl,DateTimeUtcFromDate:()=>Tre,DateTimeUtcFromHttpDate:()=>Ore,DateTimeUtcFromMillis:()=>_re,DateTimeUtcFromString:()=>vre,DateTimeZoned:()=>ij,DateTimeZonedFromString:()=>Fre,Defect:()=>jte,DnsARecord:()=>Ij,DnsAaaaRecord:()=>wj,DnsCaaRecord:()=>Aj,DnsCnameRecord:()=>Cj,DnsMxRecord:()=>Tj,DnsNaptrRecord:()=>vj,DnsNsRecord:()=>kj,DnsPtrRecord:()=>Oj,DnsRecord:()=>Rne,DnsRecordType:()=>_ne,DnsSoaRecord:()=>_j,DnsSrvRecord:()=>Rj,DnsTlsaRecord:()=>Pj,DnsTxtRecord:()=>Mj,DomainName:()=>Ua,DomainNameFromString:()=>gj,Duration:()=>vu,DurationFromIsoString:()=>One,DurationFromMillis:()=>kne,DurationFromNanos:()=>vne,DurationFromString:()=>Rv,Enum:()=>Eee,Error:()=>Zj,ErrorInstance:()=>Bte,Exit:()=>toe,FalseLiterals:()=>SB,File:()=>UB,Finite:()=>Ul,FiniteFromString:()=>ere,FormData:()=>DB,Graph:()=>soe,HashMap:()=>aoe,HashSet:()=>ioe,Headers:()=>poe,Host:()=>yne,HostFromString:()=>Sne,HostPort:()=>Sj,HostPortFromString:()=>bne,InetAddress:()=>hj,InetAddressFromString:()=>hne,InetAddressV4:()=>dne,InetAddressV6:()=>mne,Int:()=>en,IpAddress:()=>Wi,IpAddressFromString:()=>Tu,IpInterface:()=>lj,IpInterfaceFromString:()=>une,IpLinkLocalAddress:()=>Vre,IpLinkLocalAddressFromString:()=>Zre,IpLoopbackAddress:()=>Jre,IpLoopbackAddressFromString:()=>Gre,IpMulticastAddress:()=>Nre,IpMulticastAddressFromString:()=>Ure,IpNetwork:()=>mj,IpNetworkFromString:()=>pne,IpUnicastAddress:()=>$re,IpUnicastAddressFromString:()=>Kre,IpUnspecifiedAddress:()=>Yre,IpUnspecifiedAddressFromString:()=>Qre,Ipv4Address:()=>rh,Ipv4AddressFromString:()=>Ov,Ipv4BroadcastAddress:()=>Hre,Ipv4BroadcastAddressFromString:()=>zre,Ipv4Interface:()=>uj,Ipv4InterfaceFromString:()=>ine,Ipv4Network:()=>pj,Ipv4NetworkFromString:()=>fne,Ipv4PrivateAddress:()=>Xre,Ipv4PrivateAddressFromString:()=>ene,Ipv6Address:()=>$S,Ipv6AddressFromString:()=>cj,Ipv6Interface:()=>fj,Ipv6InterfaceFromString:()=>cne,Ipv6Network:()=>dj,Ipv6NetworkFromString:()=>lne,Ipv6UniqueLocalAddress:()=>tne,Ipv6UniqueLocalAddressFromString:()=>rne,Json:()=>BS,JsonFromUrlParamsField:()=>hoe,JsonObject:()=>qoe,KeyAgreementPrivateKey:()=>Lv,KeyAgreementPrivateKeyFromBytes:()=>Vne,KeyAgreementPrivateKeyFromFormat:()=>Zne,KeyAgreementPublicKey:()=>Dv,KeyAgreementPublicKeyFromBytes:()=>Jne,KeyAgreementPublicKeyFromFormat:()=>Gne,KeyWrapKey:()=>$v,KeyWrapKeyFromBytes:()=>Yne,KeyWrapKeyFromFormat:()=>Qne,KeyWrapPrivateKey:()=>Uj,KeyWrapPrivateKeyFromFormat:()=>eoe,KeyWrapPublicKey:()=>Nj,KeyWrapPublicKeyFromFormat:()=>Xne,Literal:()=>zt,Literals:()=>Jn,MacAddress:()=>Cu,MacAddressFromString:()=>Bl,MacBroadcastAddress:()=>Wre,MacBroadcastAddressFromString:()=>qre,MacKey:()=>Pv,MacKeyFromBytes:()=>Dne,MacKeyFromFormat:()=>Lne,MacLocallyAdministeredAddress:()=>nne,MacLocallyAdministeredAddressFromString:()=>one,MacMulticastAddress:()=>Dre,MacMulticastAddressFromString:()=>Lre,MacUnicastAddress:()=>Bre,MacUnicastAddressFromString:()=>jre,MacUniversallyAdministeredAddress:()=>sne,MacUniversallyAdministeredAddressFromString:()=>ane,MutableJson:()=>Goe,Natural:()=>ts,Never:()=>iB,NonEmptyArray:()=>FS,NonEmptyString:()=>th,Null:()=>PS,NullOr:()=>yv,NullishOr:()=>lB,Number:()=>wu,NumberFromString:()=>Xte,ObjectKeyword:()=>Cee,Opaque:()=>qee,Option:()=>ku,OptionFromNullOr:()=>coe,OptionFromNullishOr:()=>foe,OptionFromOptional:()=>yoe,OptionFromOptionalKey:()=>goe,OptionFromOptionalNullOr:()=>Soe,OptionFromUndefinedOr:()=>uoe,Port:()=>Ene,PropertyKey:()=>lv,ReadonlyMap:()=>Hte,ReadonlySet:()=>zte,Record:()=>Na,RecordFromCookies:()=>loe,RecordFromUrlParams:()=>xoe,Redacted:()=>KS,RedactedFromValue:()=>boe,RegExp:()=>Wte,Result:()=>Eoe,RetryAfter:()=>$j,RetryAfterFromString:()=>moe,SchemaError:()=>Ma,ScopedIpv6Literal:()=>_v,ScopedIpv6LiteralFromString:()=>yj,SemVer:()=>zj,SemVerFromString:()=>Ioe,SemVerRange:()=>Jj,SemVerRangeFromString:()=>woe,SignaturePrivateKey:()=>Uv,SignaturePrivateKeyFromBytes:()=>Wne,SignaturePrivateKeyFromFormat:()=>qne,SignaturePublicKey:()=>Nv,SignaturePublicKeyFromBytes:()=>Hne,SignaturePublicKeyFromFormat:()=>zne,SocketAddress:()=>gne,StandardSchemaV1FailureResult:()=>ire,String:()=>H,StringForLiteralAutocomplete:()=>wee,StringFromBase64:()=>nre,StringFromBase64Url:()=>ore,StringFromHex:()=>sre,StringFromUriComponent:()=>are,Struct:()=>ve,StructWithRest:()=>Ree,Symbol:()=>cB,TaggedClass:()=>voe,TaggedError:()=>koe,TaggedStruct:()=>Vm,TaggedUnion:()=>Wee,TemplateLiteral:()=>See,TemplateLiteralParser:()=>bee,TimeZone:()=>sj,TimeZoneFromString:()=>Mre,TimeZoneNamed:()=>nj,TimeZoneNamedFromString:()=>Pre,TimeZoneOffset:()=>Rre,Tree:()=>Woe,Trim:()=>rre,Trimmed:()=>$B,TrueLiterals:()=>yB,Tuple:()=>Ds,TupleWithRest:()=>Pee,URL:()=>LS,URLFromString:()=>qte,URLSearchParams:()=>LB,Uint8Array:()=>Ll,Uint8ArrayFromBase64:()=>ure,Uint8ArrayFromBase64Url:()=>fre,Uint8ArrayFromHex:()=>BB,Undefined:()=>xv,UndefinedOr:()=>NS,Union:()=>st,UniqueArray:()=>Fee,UniqueSymbol:()=>Tee,UnixPathAddress:()=>xj,UnixPathAddressFromString:()=>xne,Unknown:()=>Fl,UnknownFromJsonString:()=>Zte,UrlParams:()=>Kv,Void:()=>Aee,annotate:()=>qX,annotateEncoded:()=>JX,annotateKey:()=>GX,asserts:()=>XX,brand:()=>US,catchDecoding:()=>Lee,catchDecodingWithContext:()=>xB,catchEncoding:()=>$ee,catchEncodingWithContext:()=>gB,check:()=>Uee,declare:()=>je,declareConstructor:()=>yn,decode:()=>Kee,decodeEffect:()=>eee,decodeExit:()=>tee,decodeOption:()=>nee,decodePromise:()=>see,decodeResult:()=>oee,decodeSync:()=>aee,decodeTo:()=>J,decodeUnknownEffect:()=>OS,decodeUnknownExit:()=>QK,decodeUnknownOption:()=>ree,decodeUnknownPromise:()=>eB,decodeUnknownResult:()=>XK,decodeUnknownSync:()=>tB,encode:()=>Bee,encodeEffect:()=>iee,encodeExit:()=>cee,encodeKeys:()=>Oee,encodeOption:()=>fee,encodePromise:()=>pee,encodeResult:()=>lee,encodeSync:()=>dee,encodeTo:()=>bv,encodeUnknownEffect:()=>_S,encodeUnknownExit:()=>rB,encodeUnknownOption:()=>uee,encodeUnknownPromise:()=>oB,encodeUnknownResult:()=>nB,encodeUnknownSync:()=>sB,extendTo:()=>_ee,fieldsAssign:()=>vee,flip:()=>fv,fromBrand:()=>Dee,fromFormData:()=>Yte,fromJsonString:()=>vv,fromURLSearchParams:()=>Qte,instanceOf:()=>Au,is:()=>QX,isAscii:()=>ote,isBase64:()=>CB,isBase64Url:()=>ste,isBetween:()=>Ls,isBetweenBigDecimal:()=>hre,isBetweenBigInt:()=>Ote,isBetweenCodePoints:()=>Pte,isBetweenDate:()=>Cte,isBetweenLength:()=>Av,isBetweenProperties:()=>Lte,isBetweenSize:()=>Nte,isCapitalized:()=>lte,isEndingWith:()=>ite,isFinite:()=>dte,isGUID:()=>ete,isGreaterThan:()=>hte,isGreaterThanBigDecimal:()=>lre,isGreaterThanBigInt:()=>Tte,isGreaterThanDate:()=>Ete,isGreaterThanOrEqualTo:()=>TB,isGreaterThanOrEqualToBigDecimal:()=>pre,isGreaterThanOrEqualToBigInt:()=>vB,isGreaterThanOrEqualToDate:()=>Ite,isIncluding:()=>cte,isInt:()=>DS,isInt32:()=>Ste,isLessThan:()=>xte,isLessThanBigDecimal:()=>dre,isLessThanBigInt:()=>vte,isLessThanDate:()=>wte,isLessThanOrEqualTo:()=>gte,isLessThanOrEqualToBigDecimal:()=>mre,isLessThanOrEqualToBigInt:()=>kte,isLessThanOrEqualToDate:()=>Ate,isLowercased:()=>fte,isMaxCodePoints:()=>Rte,isMaxLength:()=>_B,isMaxProperties:()=>Dte,isMaxSize:()=>Fte,isMinCodePoints:()=>_te,isMinLength:()=>wv,isMinProperties:()=>Ute,isMinSize:()=>Mte,isMultipleOf:()=>yte,isNonEmpty:()=>OB,isPattern:()=>zi,isPropertyNames:()=>$te,isSchema:()=>RS,isSchemaError:()=>JK,isStartingWith:()=>ate,isStringBigInt:()=>Vee,isStringFinite:()=>Gee,isStringSymbol:()=>Zee,isTrimmed:()=>AB,isULID:()=>rte,isUUID:()=>Qee,isUint32:()=>bte,isUncapitalized:()=>pte,isUnique:()=>Tv,isUniqueKey:()=>RB,isUppercased:()=>ute,link:()=>ke,linkDecoding:()=>Hi,make:()=>Q,makeClassTrusted:()=>jv,makeFilter:()=>Ne,makeFilterGroup:()=>Jee,makeIsBetween:()=>eh,makeIsGreaterThan:()=>Zm,makeIsGreaterThanOrEqualTo:()=>Ym,makeIsLessThan:()=>Qm,makeIsLessThanOrEqualTo:()=>Xm,makeIsMultipleOf:()=>mte,middlewareDecoding:()=>mB,middlewareEncoding:()=>hB,mutable:()=>Nee,mutableKey:()=>xee,optional:()=>Pl,optionalKey:()=>rs,overrideToCodecIso:()=>Hoe,overrideToEquivalence:()=>Roe,overrideToFormatter:()=>Ooe,readonlyKey:()=>gee,refine:()=>dB,required:()=>hee,requiredKey:()=>mee,resolveAnnotations:()=>Voe,resolveAnnotationsKey:()=>Zoe,revealBottom:()=>WX,revealCodec:()=>VX,suspend:()=>pB,tag:()=>Fa,tagDefaultOmit:()=>zee,toCodecArrayFromSingle:()=>Doe,toCodecGoJson:()=>Loe,toCodecIso:()=>Uoe,toCodecJson:()=>Noe,toCodecStringTree:()=>oh,toDifferJsonPatch:()=>zoe,toEncoded:()=>Ml,toEncoderXml:()=>$oe,toEquivalence:()=>Poe,toFormatter:()=>_oe,toIso:()=>Koe,toIsoFocus:()=>joe,toIsoSource:()=>Boe,toJsonSchemaDocument:()=>Foe,toRepresentation:()=>Moe,toStandardJSONSchemaV1:()=>YX,toStandardSchemaV1:()=>ZX,toTaggedUnion:()=>wB,toType:()=>Sn,withArrayLengthConstraints:()=>MS,withConstructorDefault:()=>bB,withDecodingDefault:()=>IB,withDecodingDefaultKey:()=>Ev,withDecodingDefaultType:()=>Hee,withDecodingDefaultTypeKey:()=>jee});var BF=globalThis.BigInt;var jF=e=>e>BF(Number.MAX_SAFE_INTEGER)||e<BF(Number.MIN_SAFE_INTEGER)?v():_(Number(e));var Sw=BigInt(0),PV=BigInt(1),vs=BigInt(1e3),Ii=BigInt(1024),zF=[{symbol:\"B\",factor:PV,names:[\"B\",\"byte\",\"bytes\"]},{symbol:\"kB\",factor:vs,names:[\"kB\",\"kilobyte\",\"kilobytes\"]},{symbol:\"MB\",factor:vs**BigInt(2),names:[\"MB\",\"megabyte\",\"megabytes\"]},{symbol:\"GB\",factor:vs**BigInt(3),names:[\"GB\",\"gigabyte\",\"gigabytes\"]},{symbol:\"TB\",factor:vs**BigInt(4),names:[\"TB\",\"terabyte\",\"terabytes\"]},{symbol:\"PB\",factor:vs**BigInt(5),names:[\"PB\",\"petabyte\",\"petabytes\"]},{symbol:\"EB\",factor:vs**BigInt(6),names:[\"EB\",\"exabyte\",\"exabytes\"]},{symbol:\"ZB\",factor:vs**BigInt(7),names:[\"ZB\",\"zettabyte\",\"zettabytes\"]},{symbol:\"YB\",factor:vs**BigInt(8),names:[\"YB\",\"yottabyte\",\"yottabytes\"]},{symbol:\"RB\",factor:vs**BigInt(9),names:[\"RB\",\"ronnabyte\",\"ronnabytes\"]},{symbol:\"QB\",factor:vs**BigInt(10),names:[\"QB\",\"quettabyte\",\"quettabytes\"]}],MV=[zF[0],{symbol:\"KiB\",factor:Ii,names:[\"KiB\",\"kibibyte\",\"kibibytes\"]},{symbol:\"MiB\",factor:Ii**BigInt(2),names:[\"MiB\",\"mebibyte\",\"mebibytes\"]},{symbol:\"GiB\",factor:Ii**BigInt(3),names:[\"GiB\",\"gibibyte\",\"gibibytes\"]},{symbol:\"TiB\",factor:Ii**BigInt(4),names:[\"TiB\",\"tebibyte\",\"tebibytes\"]},{symbol:\"PiB\",factor:Ii**BigInt(5),names:[\"PiB\",\"pebibyte\",\"pebibytes\"]},{symbol:\"EiB\",factor:Ii**BigInt(6),names:[\"EiB\",\"exbibyte\",\"exbibytes\"]},{symbol:\"ZiB\",factor:Ii**BigInt(7),names:[\"ZiB\",\"zebibyte\",\"zebibytes\"]},{symbol:\"YiB\",factor:Ii**BigInt(8),names:[\"YiB\",\"yobibyte\",\"yobibytes\"]}],FV=[...zF,...MV.slice(1)],NV=new Map(FV.flatMap(e=>e.names.map(t=>[t,e])));var bw=e=>e;var jf=e=>{throw new Error(`Invalid ByteSize: ${e}`)},WF=e=>!Number.isSafeInteger(e)||e<0?jf(`expected a non-negative safe integer, received ${e}`):bw(BigInt(e)),_de=BigInt(Number.MAX_SAFE_INTEGER),UV=(e,t)=>{let r=/^(\\d+)(?:\\.(\\d+))?(?:e([+-]\\d+))?$/.exec(e);if(r===null)return;let n=r[2]??\"\",o=BigInt(r[1]+n)*t,s=Number(r[3]??0)-n.length;if(s>=0)return o*BigInt(10)**BigInt(s);let a=BigInt(10)**BigInt(-s);return o%a===Sw?o/a:void 0};var qF=e=>{let t=/^\\s*(\\d+(?:\\.\\d+)?)\\s*([A-Za-z]+)\\s*$/.exec(e);if(t===null)return jf(`unsupported syntax ${JSON.stringify(e)}`);let r=NV.get(t[2]);if(r===void 0)return jf(`unsupported unit ${JSON.stringify(t[2])}`);let n=UV(t[1],r.factor);return n===void 0?jf(`${JSON.stringify(e)} does not represent an integral number of bytes`):bw(n)},JF=Oo(qF),Dg=e=>{switch(typeof e){case\"bigint\":return e<Sw?jf(`expected a non-negative bigint, received ${e}`):bw(e);case\"number\":return WF(e);case\"string\":return qF(e)}return jf(`unsupported input ${e}`)},Ew=Oo(Dg),GF=e=>typeof e==\"bigint\"?Dg(e):WF(e);var VF=e=>typeof e==\"bigint\"&&e>=Sw;var Lg=e=>e,ZF=jF;var QF=\"~effect/Chunk\";function YF(e,t,r,n,o){for(let s=t;s<Math.min(e.length,t+o);s++)r[n+s-t]=e[s];return r}var XF=[],ww=e=>Kt((t,r)=>{if(t.length!==r.length)return!1;let n=Yc(t),o=Yc(r);for(let s=0;s<n.length;s++)if(!e(n[s],o[s]))return!1;return!0}),$V=ww(Z),KV={[QF]:{_A:e=>e},toString(){return`Chunk(${K(Yc(this))})`},toJSON(){return{_id:\"Chunk\",values:qt(Yc(this))}},[Je](){return this.toJSON()},[ne](e){return Kg(e)&&$V(this,e)},[re](){return wo(Yc(this))},[Symbol.iterator](){switch(this.backing._tag){case\"IArray\":return this.backing.array[Symbol.iterator]();case\"IEmpty\":return XF[Symbol.iterator]();default:return Yc(this)[Symbol.iterator]()}},pipe(){return te(this,arguments)}},Aw=e=>{let t=Object.create(KV);switch(t.backing=e,e._tag){case\"IEmpty\":{t.length=0,t.depth=0,t.left=t,t.right=t;break}case\"IConcat\":{t.length=e.left.length+e.right.length,t.depth=1+Math.max(e.left.depth,e.right.depth),t.left=e.left,t.right=e.right;break}case\"IArray\":{t.length=e.array.length,t.depth=0,t.left=Sa,t.right=Sa;break}case\"ISingleton\":{t.length=1,t.depth=0,t.left=Sa,t.right=Sa;break}case\"ISlice\":{t.length=e.length,t.depth=0,t.left=Sa,t.right=Sa;break}}return t},Kg=e=>A(e,QF),Sa=Aw({_tag:\"IEmpty\"}),BV=()=>Sa;var jV=e=>Aw({_tag:\"ISingleton\",a:e}),Cw=e=>Kg(e)?e:zV(wt(e)),Iw=(e,t,r)=>{switch(e.backing._tag){case\"IArray\":{YF(e.backing.array,0,t,r,e.length);break}case\"IConcat\":{Iw(e.left,t,r),Iw(e.right,t,r+e.left.length);break}case\"ISingleton\":{t[r]=e.backing.a;break}case\"ISlice\":{YF(Yc(e.backing.chunk),e.backing.offset,t,r,e.length);break}}};var HV=e=>{switch(e.backing._tag){case\"IEmpty\":return XF;case\"IArray\":return e.backing.array;default:{let t=new Array(e.length);return Iw(e,t,0),e.backing={_tag:\"IArray\",array:t},e.left=Sa,e.right=Sa,e.depth=0,t}}},Yc=HV;var zV=e=>e.length===0?BV():e.length===1?jV(e[0]):Aw({_tag:\"IArray\",array:e});var eN=e=>e.length;var qg={};An(qg,{Aead:()=>jd,aes128Gcm:()=>dZ,aes256Gcm:()=>mZ,chacha20Poly1305:()=>hZ,fromCryptoKey:()=>IZ,isKey:()=>Nw,key:()=>Uw,layerWebCrypto:()=>EZ,layerWebCryptoWith:()=>SN,toBytes:()=>Dw,xchacha20Poly1305:()=>xZ});var tN=\"~effect/crypto/CryptoError\",ks=\"~effect/crypto/CryptoError/Reason\",Qc=class extends Ut(\"InvalidArgument\"){[ks]=ks;get message(){return this.description}},ba=class extends Ut(\"InvalidKey\"){[ks]=ks;get message(){return this.description}},wi=class extends Ut(\"DecryptionFailed\"){[ks]=ks;get message(){return\"Could not decrypt the data\"}},Ai=class extends Ut(\"Unsupported\"){[ks]=ks;get message(){return this.description}},Bg=class extends Ut(\"NotExtractable\"){[ks]=ks;get message(){return this.description}},Hf=class extends Ut(\"CryptoError\"){[tN]=tN;cause=\"cause\"in this.reason?this.reason.cause:void 0;get message(){return`${this.module}.${this.method}: ${this.reason.message}`}};function rN(e){return e instanceof Uint8Array||ArrayBuffer.isView(e)&&e.constructor.name===\"Uint8Array\"&&\"BYTES_PER_ELEMENT\"in e&&e.BYTES_PER_ELEMENT===1}var jg=e=>e?`\"${e}\" `:\"\";function vw(e,t=\"\"){if(typeof e!=\"boolean\")throw new TypeError(jg(t)+\"expected boolean, got type=\"+typeof e);return e}function zf(e,t=\"\"){if(typeof e!=\"number\")throw new TypeError(jg(t)+\"expected number, got \"+typeof e);if(!Number.isSafeInteger(e)||e<0)throw new RangeError(jg(t)+\"expected integer >= 0, got \"+e);return e}function po(e,t,r=\"\"){if(rN(e)&&(t===void 0||e.length===t))return e;t!==void 0&&zf(t,\"length\");let n=rN(e),o=t!==void 0?` of length ${t}`:\"\",s=n?`length=${e.length}`:`type=${typeof e}`,a=jg(r)+\"expected Uint8Array\"+o+\", got \"+s;throw n?new RangeError(a):new TypeError(a)}var nN=(e,t)=>{if(e===null||typeof e!=\"object\"||Array.isArray(e))throw new TypeError(t===\"object\"?\"expected valid options object\":`\"${t}\" expected object, got type=${typeof e}`)};function WV(e,t){return nN(e,\"defaults\"),nN(t,\"opts\"),Object.assign(e,t)}function oN(e,t=!0){if(e.destroyed)throw new Error(\"hash was destroyed\");if(t&&e.finished)throw new Error(\"digest() was already called\")}function qV(e,t){po(e,void 0,\"output\");let r=t.outputLen;if(!(e.length>=r))throw new RangeError('\"output\" expected length >= '+r)}function Ea(e){return new Uint32Array(e.buffer,e.byteOffset,Math.floor(e.byteLength/4))}function _s(...e){for(let t=0;t<e.length;t++)e[t].fill(0)}function JV(e){return new DataView(e.buffer,e.byteOffset,e.byteLength)}var Os=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function GV(e){return e<<24&4278190080|e<<8&16711680|e>>>8&65280|e>>>24&255}function VV(e){for(let t=0;t<e.length;t++)e[t]=GV(e[t]);return e}var jo=Os?e=>e:VV;function ZV(e,t){return!e.byteLength||!t.byteLength?!1:e.buffer===t.buffer&&e.byteOffset<t.byteOffset+t.byteLength&&t.byteOffset<e.byteOffset+e.byteLength}function YV(e,t){if(ZV(e,t)&&e.byteOffset<t.byteOffset)throw new Error(\"complex overlap of input and output is not supported\")}function QV(e,t){if(e=po(e),t=po(t),e.length!==t.length)return!1;let r=0;for(let n=0;n<e.length;n++)r|=e[n]^t[n];return r===0}function kw(e,t,r=!0){if(t===void 0)return new Uint8Array(e);if(po(t,e,\"output\"),r&&!Hg(t))throw new Error(\"invalid output, must be aligned\");return t}function XV(e,t,r){zf(e),zf(t),vw(r);let n=new Uint8Array(16),o=JV(n);return o.setBigUint64(0,BigInt(t),r),o.setBigUint64(8,BigInt(e),r),n}function Hg(e){return e.byteOffset%4===0}function zg(e){return Uint8Array.from(po(e))}var cN=e=>Uint8Array.from(e.split(\"\"),t=>t.charCodeAt(0)),eZ=jo(Ea(cN(\"expand 16-byte k\"))),tZ=jo(Ea(cN(\"expand 32-byte k\")));function Ye(e,t){return e<<t|e>>>32-t}var Dd=64,rZ=16,Ow=2**32-1,sN=Uint32Array.of();function nZ(e,t,r,n,o,s,a,i){let c=o.length,u=new Uint8Array(Dd),f=Ea(u),p=Os&&Hg(o)&&Hg(s),d=p?Ea(o):sN,m=p?Ea(s):sN;if(!Os){for(let h=0;h<c;a++){if(e(t,r,n,f,a,i),jo(f),a>=Ow)throw new Error(\"arx: counter overflow\");let y=Math.min(Dd,c-h);for(let S=0,b;S<y;S++)b=h+S,s[b]=o[b]^u[S];h+=y}return}for(let h=0;h<c;a++){if(e(t,r,n,f,a,i),a>=Ow)throw new Error(\"arx: counter overflow\");let y=Math.min(Dd,c-h);if(p&&y===Dd){let S=h/4;if(h%4!==0)throw new Error(\"arx: invalid block position\");for(let b=0,x;b<rZ;b++)x=S+b,m[x]=d[x]^f[b];h+=Dd;continue}for(let S=0,b;S<y;S++)b=h+S,s[b]=o[b]^u[S];h+=y}}function uN(e,t){let{allowShortKeys:r,extendNonceFn:n,counterLength:o,counterRight:s,rounds:a}=WV({allowShortKeys:!1,counterLength:8,counterRight:!1,rounds:20},t);if(typeof e!=\"function\")throw new Error(\"core must be a function\");return zf(o),zf(a),vw(s),vw(r),(i,c,u,f,p=0)=>{po(i,void 0,\"key\"),po(c,void 0,\"nonce\"),po(u,void 0,\"data\");let d=u.length,m=f!==void 0;if(f=kw(d,f,!1),m&&YV(u,f),zf(p),p<0||p>=Ow)throw new Error(\"arx: counter overflow\");let h=[],y=i.length,S,b;if(y===32)h.push(S=zg(i)),b=tZ;else if(y===16&&r)S=new Uint8Array(32),S.set(i),S.set(i,16),b=eZ,h.push(S);else throw po(i,32,\"arx key\"),new Error(\"invalid key size\");(!Os||!Hg(c))&&h.push(c=zg(c));let x=Ea(S);if(n){if(c.length!==24)throw new Error(\"arx: extended nonce must be 24 bytes\");let T=c.subarray(0,16);if(Os)n(b,x,Ea(T),x);else{let P=jo(Uint32Array.from(b));n(P,x,Ea(T),x),_s(P),jo(x)}c=c.subarray(16)}else Os||jo(x);let w=16-o;if(w!==c.length)throw new Error(`arx: nonce must be ${w} or 16 bytes`);if(w!==12){let T=new Uint8Array(12);T.set(c,s?0:12-c.length),c=T,h.push(c)}let I=jo(Ea(c));try{return nZ(e,b,x,I,u,f,p,a),f}finally{_s(...h)}}}function _r(e,t){return e[t++]&255|(e[t++]&255)<<8}var _w=class{blockLen=16;outputLen=16;buffer=new Uint8Array(16);r=new Uint16Array(10);h=new Uint16Array(10);pad=new Uint16Array(8);pos=0;finished=!1;destroyed=!1;constructor(t){t=zg(po(t,32,\"key\"));let r=_r(t,0),n=_r(t,2),o=_r(t,4),s=_r(t,6),a=_r(t,8),i=_r(t,10),c=_r(t,12),u=_r(t,14);this.r[0]=r&8191,this.r[1]=(r>>>13|n<<3)&8191,this.r[2]=(n>>>10|o<<6)&7939,this.r[3]=(o>>>7|s<<9)&8191,this.r[4]=(s>>>4|a<<12)&255,this.r[5]=a>>>1&8190,this.r[6]=(a>>>14|i<<2)&8191,this.r[7]=(i>>>11|c<<5)&8065,this.r[8]=(c>>>8|u<<8)&8191,this.r[9]=u>>>5&127;for(let f=0;f<8;f++)this.pad[f]=_r(t,16+2*f)}process(t,r,n=!1){let o=n?0:2048,{h:s,r:a}=this,i=a[0],c=a[1],u=a[2],f=a[3],p=a[4],d=a[5],m=a[6],h=a[7],y=a[8],S=a[9],b=_r(t,r+0),x=_r(t,r+2),w=_r(t,r+4),I=_r(t,r+6),T=_r(t,r+8),P=_r(t,r+10),G=_r(t,r+12),he=_r(t,r+14),me=s[0]+(b&8191),E=s[1]+((b>>>13|x<<3)&8191),R=s[2]+((x>>>10|w<<6)&8191),N=s[3]+((w>>>7|I<<9)&8191),O=s[4]+((I>>>4|T<<12)&8191),M=s[5]+(T>>>1&8191),U=s[6]+((T>>>14|P<<2)&8191),pe=s[7]+((P>>>11|G<<5)&8191),He=s[8]+((G>>>8|he<<8)&8191),ze=s[9]+(he>>>5|o),ee=0,Qe=ee+me*i+E*(5*S)+R*(5*y)+N*(5*h)+O*(5*m);ee=Qe>>>13,Qe&=8191,Qe+=M*(5*d)+U*(5*p)+pe*(5*f)+He*(5*u)+ze*(5*c),ee+=Qe>>>13,Qe&=8191;let qe=ee+me*c+E*i+R*(5*S)+N*(5*y)+O*(5*h);ee=qe>>>13,qe&=8191,qe+=M*(5*m)+U*(5*d)+pe*(5*p)+He*(5*f)+ze*(5*u),ee+=qe>>>13,qe&=8191;let et=ee+me*u+E*c+R*i+N*(5*S)+O*(5*y);ee=et>>>13,et&=8191,et+=M*(5*h)+U*(5*m)+pe*(5*d)+He*(5*p)+ze*(5*f),ee+=et>>>13,et&=8191;let De=ee+me*f+E*u+R*c+N*i+O*(5*S);ee=De>>>13,De&=8191,De+=M*(5*y)+U*(5*h)+pe*(5*m)+He*(5*d)+ze*(5*p),ee+=De>>>13,De&=8191;let xt=ee+me*p+E*f+R*u+N*c+O*i;ee=xt>>>13,xt&=8191,xt+=M*(5*S)+U*(5*y)+pe*(5*h)+He*(5*m)+ze*(5*d),ee+=xt>>>13,xt&=8191;let vt=ee+me*d+E*p+R*f+N*u+O*c;ee=vt>>>13,vt&=8191,vt+=M*i+U*(5*S)+pe*(5*y)+He*(5*h)+ze*(5*m),ee+=vt>>>13,vt&=8191;let vr=ee+me*m+E*d+R*p+N*f+O*u;ee=vr>>>13,vr&=8191,vr+=M*c+U*i+pe*(5*S)+He*(5*y)+ze*(5*h),ee+=vr>>>13,vr&=8191;let is=ee+me*h+E*m+R*d+N*p+O*f;ee=is>>>13,is&=8191,is+=M*u+U*c+pe*i+He*(5*S)+ze*(5*y),ee+=is>>>13,is&=8191;let Ws=ee+me*y+E*h+R*m+N*d+O*p;ee=Ws>>>13,Ws&=8191,Ws+=M*f+U*u+pe*c+He*i+ze*(5*S),ee+=Ws>>>13,Ws&=8191;let ju=ee+me*S+E*y+R*h+N*m+O*d;ee=ju>>>13,ju&=8191,ju+=M*p+U*f+pe*u+He*c+ze*i,ee+=ju>>>13,ju&=8191,ee=(ee<<2)+ee|0,ee=ee+Qe|0,Qe=ee&8191,ee=ee>>>13,qe+=ee,s[0]=Qe,s[1]=qe,s[2]=et,s[3]=De,s[4]=xt,s[5]=vt,s[6]=vr,s[7]=is,s[8]=Ws,s[9]=ju}finalize(){let{h:t,pad:r}=this,n=new Uint16Array(10),o=t[1]>>>13;t[1]&=8191;for(let i=2;i<10;i++)t[i]+=o,o=t[i]>>>13,t[i]&=8191;t[0]+=o*5,o=t[0]>>>13,t[0]&=8191,t[1]+=o,o=t[1]>>>13,t[1]&=8191,t[2]+=o,n[0]=t[0]+5,o=n[0]>>>13,n[0]&=8191;for(let i=1;i<10;i++)n[i]=t[i]+o,o=n[i]>>>13,n[i]&=8191;n[9]-=8192;let s=(o^1)-1;for(let i=0;i<10;i++)n[i]&=s;s=~s;for(let i=0;i<10;i++)t[i]=t[i]&s|n[i];t[0]=(t[0]|t[1]<<13)&65535,t[1]=(t[1]>>>3|t[2]<<10)&65535,t[2]=(t[2]>>>6|t[3]<<7)&65535,t[3]=(t[3]>>>9|t[4]<<4)&65535,t[4]=(t[4]>>>12|t[5]<<1|t[6]<<14)&65535,t[5]=(t[6]>>>2|t[7]<<11)&65535,t[6]=(t[7]>>>5|t[8]<<8)&65535,t[7]=(t[8]>>>8|t[9]<<5)&65535;let a=t[0]+r[0];t[0]=a&65535;for(let i=1;i<8;i++)a=(t[i]+r[i]|0)+(a>>>16)|0,t[i]=a&65535;_s(n)}update(t){oN(this),po(t),t=zg(t);let{buffer:r,blockLen:n}=this,o=t.length;for(let s=0;s<o;){let a=Math.min(n-this.pos,o-s);if(a===n){for(;n<=o-s;s+=n)this.process(t,s);continue}r.set(t.subarray(s,s+a),this.pos),this.pos+=a,s+=a,this.pos===n&&(this.process(r,0,!1),this.pos=0)}return this}destroy(){this.destroyed=!0,_s(this.h,this.r,this.buffer,this.pad)}digestInto(t){oN(this),qV(t,this),this.finished=!0;let{buffer:r,h:n}=this,{pos:o}=this;if(o){for(r[o++]=1;o<16;o++)r[o]=0;this.process(r,0,!0)}this.finalize();let s=0;for(let a=0;a<8;a++)t[s++]=n[a]>>>0,t[s++]=n[a]>>>8}digest(){let{buffer:t,outputLen:r}=this;this.digestInto(t);let n=t.slice(0,r);return this.destroy(),n}};function Rw(e,t,r,n,o,s=20){let a=e[0],i=e[1],c=e[2],u=e[3],f=t[0],p=t[1],d=t[2],m=t[3],h=t[4],y=t[5],S=t[6],b=t[7],x=o,w=r[0],I=r[1],T=r[2],P=a,G=i,he=c,me=u,E=f,R=p,N=d,O=m,M=h,U=y,pe=S,He=b,ze=x,ee=w,Qe=I,qe=T;for(let De=0;De<s;De+=2)P=P+E|0,ze=Ye(ze^P,16),M=M+ze|0,E=Ye(E^M,12),P=P+E|0,ze=Ye(ze^P,8),M=M+ze|0,E=Ye(E^M,7),G=G+R|0,ee=Ye(ee^G,16),U=U+ee|0,R=Ye(R^U,12),G=G+R|0,ee=Ye(ee^G,8),U=U+ee|0,R=Ye(R^U,7),he=he+N|0,Qe=Ye(Qe^he,16),pe=pe+Qe|0,N=Ye(N^pe,12),he=he+N|0,Qe=Ye(Qe^he,8),pe=pe+Qe|0,N=Ye(N^pe,7),me=me+O|0,qe=Ye(qe^me,16),He=He+qe|0,O=Ye(O^He,12),me=me+O|0,qe=Ye(qe^me,8),He=He+qe|0,O=Ye(O^He,7),P=P+R|0,qe=Ye(qe^P,16),pe=pe+qe|0,R=Ye(R^pe,12),P=P+R|0,qe=Ye(qe^P,8),pe=pe+qe|0,R=Ye(R^pe,7),G=G+N|0,ze=Ye(ze^G,16),He=He+ze|0,N=Ye(N^He,12),G=G+N|0,ze=Ye(ze^G,8),He=He+ze|0,N=Ye(N^He,7),he=he+O|0,ee=Ye(ee^he,16),M=M+ee|0,O=Ye(O^M,12),he=he+O|0,ee=Ye(ee^he,8),M=M+ee|0,O=Ye(O^M,7),me=me+E|0,Qe=Ye(Qe^me,16),U=U+Qe|0,E=Ye(E^U,12),me=me+E|0,Qe=Ye(Qe^me,8),U=U+Qe|0,E=Ye(E^U,7);let et=0;n[et++]=a+P|0,n[et++]=i+G|0,n[et++]=c+he|0,n[et++]=u+me|0,n[et++]=f+E|0,n[et++]=p+R|0,n[et++]=d+N|0,n[et++]=m+O|0,n[et++]=h+M|0,n[et++]=y+U|0,n[et++]=S+pe|0,n[et++]=b+He|0,n[et++]=x+ze|0,n[et++]=w+ee|0,n[et++]=I+Qe|0,n[et++]=T+qe|0}function oZ(e,t,r,n){let o=Os?e:jo(e.slice(0,4)),s=Os?t:jo(t.slice(0,8)),a=Os?r:jo(r.slice(0,4)),i=new Uint32Array(16);Rw(o,s,a.subarray(1),i,a[0]);let c=0;n[c++]=i[0]-o[0]|0,n[c++]=i[1]-o[1]|0,n[c++]=i[2]-o[2]|0,n[c++]=i[3]-o[3]|0,n[c++]=i[12]-a[0]|0,n[c++]=i[13]-a[1]|0,n[c++]=i[14]-a[2]|0,n[c++]=i[15]-a[3]|0,jo(n),Os||_s(o,s,a),_s(i)}var sZ=uN(Rw,{counterRight:!1,counterLength:4,allowShortKeys:!1}),aZ=uN(Rw,{counterRight:!1,counterLength:8,extendNonceFn:oZ,allowShortKeys:!1}),iZ=new Uint8Array(16),aN=(e,t)=>{e.update(t);let r=t.length%16;r&&e.update(iZ.subarray(r))},cZ=new Uint8Array(32);function iN(e,t,r,n,o){o!==void 0&&po(o,void 0,\"AAD\");let s=e(t,r,cZ),a=XV(n.length,o?o.length:0,!0),i=new _w(s);o&&aN(i,o),aN(i,n),i.update(a);let c=i.digest();return _s(s,a),c}var fN=e=>(t,r,n)=>({encrypt(s,a){let i=s.length;a=kw(i+16,a,!1),a.set(s);let c=a.subarray(0,-16);e(t,r,c,c,1);let u=iN(e,t,r,c,n);return a.set(u,i),_s(u),a},decrypt(s,a){a=kw(s.length-16,a,!1);let i=s.subarray(0,-16),c=s.subarray(-16),u=iN(e,t,r,i,n);if(!QV(c,u)){_s(u);return}return a.set(s.subarray(0,-16)),e(t,r,a,a,1),_s(u),a}}),lN=fN(sZ),pN=fN(aZ);var fZ=()=>new Error(\"crypto.subtle is unavailable; browsers expose it only in secure contexts\"),Ia=(e,t,r)=>F(new Hf({module:e,method:t,reason:r})),Ci=(e,t,r)=>Ia(e,t,new ba({description:r})),$d=(e,t)=>Ia(e,t,new Bg({description:\"The CryptoKey is not extractable\"})),Pw=(e,t)=>r=>Ia(e,t,r.reason),Ld=class{reason;constructor(t){this.reason=t}};var Wf=(e,t,r,n,o)=>dN(e,t,`${e}.layerWebCrypto`,r,n,o),dN=(e,t,r,n,o,s)=>{let a=lZ(t,r,n,o,s);if(a===void 0)throw o;return new Hf({module:e,method:t,reason:a})},lZ=(e,t,r,n,o)=>{if(n instanceof Ld)return n.reason;switch(A(n,\"name\")?n.name:void 0){case\"DataError\":return new ba({description:\"Invalid key data\",cause:n});case\"InvalidAccessError\":return new ba({description:`The key cannot be used for ${e}`,cause:n});case\"NotSupportedError\":return new Ai({description:`${t} does not provide ${r}`,cause:n});case\"OperationError\":return o?.();default:return}},wa=(e,t,r,n,o,s=a=>Wf(e,t,r,a))=>L(()=>{let a=n?.subtle;return a===void 0?yr(fZ()):fi({try:()=>o(a),catch:s})}),Kd=(e,t,r,n)=>bi.use(o=>wa(e,t,r,o,n,s=>dN(e,t,\"crypto.subtle\",r,s)));var mN=Symbol(\"~effect/crypto/Key/material\"),Jf=e=>new Uint8Array(e),Ho=e=>e[mN],$r=(e,t)=>({[e]:e,toJSON(){return{_id:t,algorithm:this.algorithm.name}},toString(){return K(this.toJSON())},[Je](){return this.toJSON()}}),hN=(e,t,r)=>Rh(Object.create(e,{algorithm:{value:t,enumerable:!0},[mN]:{value:r}})),zo=(e,t,r)=>hN(e,t,{_tag:\"Bytes\",bytes:r}),Gf=e=>t=>t.length===e.keyLength?void 0:`Expected a ${e.keyLength}-byte key for ${e.name}, not ${t.length} bytes`,ln=(e,t,r,n,o,s)=>L(()=>{if(!(o instanceof Uint8Array))return Ci(e,t,\"Expected the key as a Uint8Array\");let a=s(o);return a===void 0?g(zo(r,n,Jf(o))):Ci(e,t,a)}),Bd=(e,t)=>r=>{let n=r.length;return n===t*8?void 0:`Expected a ${t*8}-bit ${e} key, not ${n} bits`},pZ=(e,t)=>{if(!A(e,\"type\")||!A(e,\"algorithm\")||!A(e,\"usages\")||!Array.isArray(e.usages))return\"Expected a CryptoKey\";if(e.algorithm.name!==t.name)return`Expected a ${t.name} key, not ${e.algorithm.name}`;if(e.type!==t.type)return`Expected a ${t.type} key, not ${e.type}`;let r=t.check?.(e.algorithm);if(r!==void 0)return r;let n=e.usages;if(t.usagePolicy===\"all\"){if(!t.usages.every(o=>n.includes(o)))return`Expected a key with the usages ${t.usages.join(\" and \")}, not ${n.join(\", \")||\"none\"}`}else if(!t.usages.some(o=>n.includes(o)))return`Expected a key with one of the usages ${t.usages.join(\", \")}`},Mw=(e,t)=>{let r=t.algorithm.modulusLength;return A(e,\"modulusLength\")&&r!==void 0&&e.modulusLength!==r?{...e,modulusLength:r}:e},Ti=(e,t,r,n,o,s)=>L(()=>{let a=pZ(o,s);return a===void 0?g(hN(r,Mw(n,o),{_tag:\"CryptoKey\",cryptoKey:o})):Ci(e,t,a)}),vi=async(e,t)=>new Uint8Array(await e.exportKey(\"raw\",t)),Rs=(e,t,r)=>L(()=>{let n=Ho(t);return n._tag===\"Bytes\"?g(Jf(n.bytes)):n.cryptoKey.extractable?Kd(e,\"toBytes\",t.algorithm.name,o=>r(o,n.cryptoKey)):$d(e,\"toBytes\")}),ki=e=>{let t=new WeakMap;return async(r,n)=>{let o=Ho(n);if(o._tag===\"CryptoKey\")return o.cryptoKey;let s=t.get(n);return s===void 0&&(s=await e(r,o.bytes,n.algorithm),t.set(n,s)),s}};var xN=\"~effect/crypto/Aead/Key\",dZ={name:\"aes128Gcm\",keyLength:16,nonceLength:12,implementation:void 0},mZ={name:\"aes256Gcm\",keyLength:32,nonceLength:12,implementation:void 0},gN=e=>({encrypt:(t,r,n,o)=>e(t,r,o).encrypt(n),decrypt:(t,r,n,o)=>e(t,r,o).decrypt(n)}),hZ={name:\"chacha20Poly1305\",keyLength:32,nonceLength:12,implementation:gN(lN)},xZ={name:\"xchacha20Poly1305\",keyLength:32,nonceLength:24,implementation:gN(pN)},Fw=$r(xN,\"Aead.Key\"),Nw=e=>A(e,xN),jd=class extends Et()(\"effect/crypto/Aead\"){},Wg=(e,t)=>Ia(\"Aead\",e,t),yN=()=>Wg(\"decrypt\",new wi),gZ=2**36-32,yZ=16,SZ=(e,t,r,n)=>{let o=t.algorithm;if(n.nonce.length!==o.nonceLength)return Wg(e,new Qc({description:`${o.name} nonces must contain exactly ${o.nonceLength} bytes`}));if(e===\"encrypt\"){if(o.implementation===void 0&&r.length>gZ)return Wg(e,new Qc({description:\"AES-GCM plaintext cannot exceed 2^36 - 32 bytes\"}))}else if(r.length<yZ)return yN()},bZ=(e,t,r,n,o)=>{let s=Ho(r);if(s._tag!==\"Bytes\")return Wg(e,new ba({description:`${r.algorithm.name} keys must hold bytes`}));let a=o.aad??new Uint8Array(0);return e===\"encrypt\"?Y(()=>t.encrypt(s.bytes,o.nonce,n,a)):L(()=>{let i=t.decrypt(s.bytes,o.nonce,n,a);return i===void 0?yN():g(i)})},SN=e=>pa(jd,kt(function*(){let t=yield*Ei,r=yield*bi,n=ki((c,u)=>c.importKey(\"raw\",u,\"AES-GCM\",!1,[\"encrypt\",\"decrypt\"])),o=e.implementations,s=c=>{let u=o?.[c.algorithm.name];return u!==void 0&&Ho(c)._tag===\"Bytes\"?u:c.algorithm.implementation},a=(c,u,f,p)=>{let d={name:\"AES-GCM\",iv:p.nonce,tagLength:128,...p.aad===void 0?{}:{additionalData:p.aad}};return wa(\"Aead\",c,u.algorithm.name,r,async m=>new Uint8Array(await m[c](d,await n(m,u),f)),m=>Wf(\"Aead\",c,u.algorithm.name,m,c===\"decrypt\"?()=>new wi:void 0))},i=c=>(u,f,p)=>L(()=>{let d=SZ(c,u,f,p);if(d!==void 0)return d;let m=s(u);return m===void 0?a(c,u,f,p):bZ(c,m,u,f,p)});return jd.of({generateKey:c=>W(t.randomBytes(c.keyLength),u=>zo(Fw,c,u)),encrypt:i(\"encrypt\"),decrypt:i(\"decrypt\")})})),EZ=SN({}),Uw=(e,t)=>ln(\"Aead\",\"key\",Fw,e,t,Gf(e)),IZ=(e,t)=>e.implementation!==void 0?Ci(\"Aead\",\"fromCryptoKey\",`${e.name} keys cannot be CryptoKeys`):Ti(\"Aead\",\"fromCryptoKey\",Fw,e,t,{type:\"secret\",name:\"AES-GCM\",usages:[\"encrypt\",\"decrypt\"],usagePolicy:\"all\",check:Bd(\"AES-GCM\",e.keyLength)}),Dw=e=>Rs(\"Aead\",e,vi);var Jg={};An(Jg,{Cipher:()=>Hd,aes128Cbc:()=>CZ,aes128Ctr:()=>wZ,aes256Cbc:()=>TZ,aes256Ctr:()=>AZ,fromCryptoKey:()=>OZ,isKey:()=>$w,key:()=>Kw,layerWebCrypto:()=>kZ,toBytes:()=>Bw});var IN=\"~effect/crypto/Cipher/Key\",wZ={name:\"aes128Ctr\",mode:\"AES-CTR\",keyLength:16},AZ={name:\"aes256Ctr\",mode:\"AES-CTR\",keyLength:32},CZ={name:\"aes128Cbc\",mode:\"AES-CBC\",keyLength:16},TZ={name:\"aes256Cbc\",mode:\"AES-CBC\",keyLength:32},Lw=$r(IN,\"Cipher.Key\"),$w=e=>A(e,IN),Hd=class extends Et()(\"effect/crypto/Cipher\"){},bN=(e,t)=>Ia(\"Cipher\",e,t),EN=16,vZ=(e,t)=>e.mode===\"AES-CTR\"?{name:\"AES-CTR\",counter:t,length:128}:{name:\"AES-CBC\",iv:t},kZ=pa(Hd,kt(function*(){let e=yield*Ei,t=yield*bi,r=ki((o,s,a)=>o.importKey(\"raw\",s,a.mode,!1,[\"encrypt\",\"decrypt\"])),n=o=>(s,a,i)=>L(()=>{if(i.iv.length!==EN)return bN(o,new Qc({description:\"IVs must contain exactly 16 bytes\"}));let c=s.algorithm.mode===\"AES-CBC\";return o===\"decrypt\"&&c&&(a.length===0||a.length%EN!==0)?bN(o,new wi):wa(\"Cipher\",o,s.algorithm.name,t,async u=>new Uint8Array(await u[o](vZ(s.algorithm,i.iv),await r(u,s),a)),u=>Wf(\"Cipher\",o,s.algorithm.name,u,o===\"decrypt\"&&c?()=>new wi:void 0))});return Hd.of({generateKey:o=>W(e.randomBytes(o.keyLength),s=>zo(Lw,o,s)),encrypt:n(\"encrypt\"),decrypt:n(\"decrypt\")})})),Kw=(e,t)=>ln(\"Cipher\",\"key\",Lw,e,t,Gf(e)),OZ=(e,t)=>Ti(\"Cipher\",\"fromCryptoKey\",Lw,e,t,{type:\"secret\",name:e.mode,usages:[\"encrypt\",\"decrypt\"],usagePolicy:\"all\",check:Bd(e.mode,e.keyLength)}),Bw=e=>Rs(\"Cipher\",e,vi);var wN=e=>Uint8Array.of(48,46,2,1,0,48,5,6,3,43,101,e,4,34,4,32),AN=wN(112),CN=wN(110),jw=32,Hw={\"P-256\":32,\"P-384\":48,\"P-521\":66},Vf=(e,t)=>r=>{if(r.length!==jw)return t===\"private\"&&r.length===64?`Expected the 32-byte ${e} seed, not the 64-byte seed\\u2016public key form: pass its first 32 bytes`:`Expected a ${jw}-byte ${e} ${t} key, not ${r.length} bytes`},Gg=e=>t=>{let r=1+2*Hw[e];return t.length!==r?`Expected a ${r}-byte uncompressed ${e} point, not ${t.length} bytes`:t[0]===4?void 0:`Expected an uncompressed ${e} point, starting with 0x04`},Vg=e=>t=>{let r=t.namedCurve;return r===e?void 0:`Expected a ${e} key, not ${r}`},Zg=e=>t=>{let r=t.hash?.name;return r===e?void 0:`Expected a key for ${e}, not ${r}`};var _Z=(e,t)=>{let r=new Uint8Array(e.length+t.length);return r.set(e),r.set(t,e.length),r},TN=(e,t,r,n)=>e.importKey(\"pkcs8\",r.seedPrefix===void 0?t:_Z(r.seedPrefix,t),r.importParams,n,r.privateUsages),vN=(e,t,r)=>e.importKey(r.publicFormat,t,r.importParams,!0,r.publicUsages),RZ=async(e,t,r)=>{let n=new Uint8Array(await e.exportKey(\"pkcs8\",t)),o=r.seedPrefix;if(o===void 0)return n;if(n.length!==o.length+jw||!o.every((s,a)=>n[a]===s))throw new Ld(new Ai({description:`${r.name} private key was exported in an unexpected PKCS#8 form`}));return n.slice(o.length)},PZ=async(e,t,r)=>new Uint8Array(await e.exportKey(r.publicFormat,t)),zw=(e,t,r,n)=>n===\"private\"?RZ(e,t,r):PZ(e,t,r),Zf=(e,t)=>Rs(e.module,t,(r,n)=>zw(r,n,e.specOf(t.algorithm),e.isPrivateKey(t)?\"private\":\"public\"));var _N=\"~effect/crypto/KeyAgreement/PrivateKey\",RN=\"~effect/crypto/KeyAgreement/PublicKey\";var PN=$r(_N,\"KeyAgreement.PrivateKey\"),MN=$r(RN,\"KeyAgreement.PublicKey\"),Ww=e=>A(e,_N),FN=e=>A(e,RN),UZ=e=>e._tag===\"X25519\"?{name:\"X25519\",importParams:{name:\"X25519\"},privateUsages:[\"deriveBits\"],publicUsages:[],seedPrefix:CN,publicFormat:\"raw\"}:{name:\"ECDH\",importParams:{name:\"ECDH\",namedCurve:e.namedCurve},privateUsages:[\"deriveBits\"],publicUsages:[],seedPrefix:void 0,publicFormat:\"raw\",check:Vg(e.namedCurve)},qw={module:\"KeyAgreement\",specOf:UZ,privateKeyProto:PN,publicKeyProto:MN,isPrivateKey:Ww};var NN=(e,t)=>ln(\"KeyAgreement\",\"privateKey\",PN,e,t,Vf(\"X25519\",\"private\")),UN=(e,t)=>ln(\"KeyAgreement\",\"publicKey\",MN,e,t,e._tag===\"Ecdh\"?Gg(e.namedCurve):Vf(\"X25519\",\"public\"));var Jw=e=>Zf(qw,e);var Ca=e=>DZ(typeof e==\"string\"?$N.encode(e):e),Xc=e=>{let t=KZ(e),r=t.length;if(r%4!==0)return q(new to({kind:\"Decode\",module:\"Base64\",input:t,message:`Length must be a multiple of 4, but is ${r}`}));let n=t.indexOf(\"=\");if(n!==-1&&(n<r-2||n===r-2&&t[r-1]!==\"=\"))return q(new to({kind:\"Decode\",module:\"Base64\",input:t,message:\"Found a '=' character, but it is not at the end\"}));try{let o=t.endsWith(\"==\")?2:t.endsWith(\"=\")?1:0,s=new Uint8Array(3*(r/4)-o);for(let a=0,i=0;a<r;a+=4,i+=3){let c=Qg(t.charCodeAt(a))<<18|Qg(t.charCodeAt(a+1))<<12|Qg(t.charCodeAt(a+2))<<6|Qg(t.charCodeAt(a+3));s[i]=c>>16,s[i+1]=c>>8&255,s[i+2]=c&255}return j(s)}catch(o){return q(new to({kind:\"Decode\",module:\"Base64\",input:t,message:o instanceof Error?o.message:\"Invalid input\"}))}},LN=e=>sr(Xc(e),t=>KN.decode(t)),DZ=e=>{let t=e.length,r=Uint8Array.prototype.toBase64;return t>=32&&typeof r==\"function\"?r.call(e):t<128?LZ(e):$Z(e)},LZ=e=>{let t=e.length,r=\"\",n;for(n=2;n<t;n+=3)r+=mo[e[n-2]>>2],r+=mo[(e[n-2]&3)<<4|e[n-1]>>4],r+=mo[(e[n-1]&15)<<2|e[n]>>6],r+=mo[e[n]&63];return n===t+1&&(r+=mo[e[n-2]>>2],r+=mo[(e[n-2]&3)<<4],r+=\"==\"),n===t&&(r+=mo[e[n-2]>>2],r+=mo[(e[n-2]&3)<<4|e[n-1]>>4],r+=mo[(e[n-1]&15)<<2],r+=\"=\"),r},$Z=e=>{let t=e.length,r=new Uint8Array(Math.ceil(t/3)*4),n,o=0;for(n=2;n<t;n+=3,o+=4)r[o]=Aa[e[n-2]>>2],r[o+1]=Aa[(e[n-2]&3)<<4|e[n-1]>>4],r[o+2]=Aa[(e[n-1]&15)<<2|e[n]>>6],r[o+3]=Aa[e[n]&63];return n===t+1&&(r[o]=Aa[e[n-2]>>2],r[o+1]=Aa[(e[n-2]&3)<<4],r[o+2]=Gw,r[o+3]=Gw),n===t&&(r[o]=Aa[e[n-2]>>2],r[o+1]=Aa[(e[n-2]&3)<<4|e[n-1]>>4],r[o+2]=Aa[(e[n-1]&15)<<2],r[o+3]=Gw),KN.decode(r)},$N=new TextEncoder,KN=new TextDecoder,KZ=e=>e.replace(/[\\n\\r]/g,\"\"),mo=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\",Aa=$N.encode(mo),Gw=61,zd=new Uint8Array(123).fill(255);for(let e=0;e<mo.length;e++)zd[mo.charCodeAt(e)]=e;zd[61]=0;var Qg=e=>{if(e>=zd.length||zd[e]===255)throw new TypeError(`Invalid character ${String.fromCharCode(e)}`);return zd[e]};var ey=e=>Ca(e).replace(/=/g,\"\").replace(/\\+/g,\"-\").replace(/\\//g,\"_\"),jN=e=>Ca(e).replace(/\\+/g,\"-\").replace(/\\//g,\"_\"),Wd=e=>{let t=e.replace(/[\\n\\r]/g,\"\"),r=t.length,n=t.endsWith(\"=\");if(n?r%4!==0:r%4===1)return q(new to({module:\"Base64Url\",kind:\"Decode\",input:t,message:n?`Padded length should be a multiple of 4, but is ${r}`:`Unpadded length should not be 1 more than a multiple of 4, but is ${r}`}));if(!/^[-_A-Z0-9]*?={0,2}$/i.test(t))return q(new to({module:\"Base64Url\",kind:\"Decode\",input:t,message:\"Invalid input\"}));let o=n?t.charCodeAt(r-2)===61?r-2:r-1:r,s=o&-4,a=new Uint8Array(Math.floor(o*3/4)),i=0;for(let c=0;c<s;c+=4){let u=_i[t.charCodeAt(c)],f=_i[t.charCodeAt(c+1)],p=_i[t.charCodeAt(c+2)],d=_i[t.charCodeAt(c+3)];a[i++]=u<<2|f>>4,a[i++]=f<<4|p>>2,a[i++]=p<<6|d}if(o>s){let c=_i[t.charCodeAt(s)],u=_i[t.charCodeAt(s+1)];a[i++]=c<<2|u>>4,o-s===3&&(a[i]=u<<4|_i[t.charCodeAt(s+2)]>>2)}return j(a)},BN=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\",_i=new Uint8Array(128);for(let e=0;e<BN.length;e++)_i[BN.charCodeAt(e)]=e;var HN=e=>sr(Wd(e),t=>BZ.decode(t)),BZ=new TextDecoder;var qd=(e,t,r=e.length)=>{if(t+2>r)return;let n=e[t],o=e[t+1],s=t+2,a=o;if(o>=128){let i=o&127;if(i===0||i>3||s+i>r)return;a=0;for(let c=0;c<i;c++)a=a*256+e[s++]}return s+a>r?void 0:{tag:n,offset:t,start:s,end:s+a}},ty=(e,t)=>{let r=qd(e,0);return r!==void 0&&r.tag===t&&r.end===e.length?r:void 0},ry=(e,t)=>{let r=[],n=t.start;for(;n<t.end;){let o=qd(e,n,t.end);if(o===void 0)return;r.push(o),n=o.end}return r},Yf=(e,t)=>e.subarray(t.offset,t.end),jZ=e=>e<128?[e]:e<256?[129,e]:e<65536?[130,e>>8,e&255]:[131,e>>16,e>>8&255,e&255],eu=(e,...t)=>{let r=t.reduce((a,i)=>a+i.length,0),n=[e,...jZ(r)],o=new Uint8Array(n.length+r);o.set(n);let s=n.length;for(let a of t)o.set(a,s),s+=a.length;return o};var Vw=(e,t)=>e.length===t.length&&e.every((r,n)=>r===t[n]);var WN={name:\"SHA-1\",outputLength:20,implementation:void 0},qN={name:\"SHA-256\",outputLength:32,implementation:void 0},JN={name:\"SHA-384\",outputLength:48,implementation:void 0},GN={name:\"SHA-512\",outputLength:64,implementation:void 0};var ny={};An(ny,{Mac:()=>Jd,fromCryptoKey:()=>QZ,hmacSha1:()=>WZ,hmacSha256:()=>qZ,hmacSha384:()=>JZ,hmacSha512:()=>GZ,isKey:()=>Yw,key:()=>Qw,layerWebCrypto:()=>YZ,layerWebCryptoWith:()=>ZN,timingSafeEqual:()=>YN,toBytes:()=>Xw});var VN=\"~effect/crypto/Mac/Key\",WZ={name:\"hmacSha1\",hash:WN},qZ={name:\"hmacSha256\",hash:qN},JZ={name:\"hmacSha384\",hash:JN},GZ={name:\"hmacSha512\",hash:GN},Zw=$r(VN,\"Mac.Key\"),Yw=e=>A(e,VN),VZ={MD5:64,\"SHA-1\":64,\"SHA-256\":64,\"SHA-384\":128,\"SHA-512\":128},Jd=class extends Et()(\"effect/crypto/Mac\"){},ZZ=e=>({name:\"HMAC\",hash:e.hash.name}),ZN=e=>pa(Jd,kt(function*(){let t=yield*Ei,r=yield*bi,n=ki((a,i,c)=>a.importKey(\"raw\",i,ZZ(c),!1,[\"sign\",\"verify\"])),o=e.hmac,s=a=>{if(o===void 0)return;let i=Ho(a);return i._tag===\"Bytes\"?c=>o(a.algorithm.hash.name,i.bytes,c):void 0};return Jd.of({generateKey:a=>W(t.randomBytes(VZ[a.hash.name]),i=>zo(Zw,a,i)),sign:(a,i)=>{let c=s(a);return c!==void 0?Y(()=>c(i)):wa(\"Mac\",\"sign\",a.algorithm.name,r,async u=>new Uint8Array(await u.sign(\"HMAC\",await n(u,a),i)))},verify:(a,i,c)=>{let u=s(a);return u!==void 0?Y(()=>YN(u(c),i)):wa(\"Mac\",\"verify\",a.algorithm.name,r,async f=>f.verify(\"HMAC\",await n(f,a),i,c))}})})),YZ=ZN({}),Qw=(e,t)=>ln(\"Mac\",\"key\",Zw,e,t,r=>r.length===0?\"An HMAC key cannot be empty\":void 0),QZ=(e,t)=>Ti(\"Mac\",\"fromCryptoKey\",Zw,e,t,{type:\"secret\",name:\"HMAC\",usages:[\"sign\",\"verify\"],usagePolicy:\"all\",check:r=>{let n=r.hash?.name;return n===e.hash.name?void 0:`Expected an HMAC key for ${e.hash.name}, not ${n}`}}),Xw=e=>Rs(\"Mac\",e,vi),YN=(e,t)=>{if(e.length!==t.length)return!1;let r=0;for(let n=0;n<e.length;n++)r|=e[n]^t[n];return r===0};var QN=\"~effect/crypto/KeyWrap/Key\",XN=\"~effect/crypto/KeyWrap/PrivateKey\",eU=\"~effect/crypto/KeyWrap/PublicKey\";var e9=$r(QN,\"KeyWrap.Key\"),t9=$r(XN,\"KeyWrap.PrivateKey\"),r9=$r(eU,\"KeyWrap.PublicKey\"),eA=e=>A(e,QN),tA=e=>A(e,XN),tU=e=>A(e,eU),n9=e=>({name:\"RSA-OAEP\",importParams:{name:\"RSA-OAEP\",hash:e.hash.name},privateUsages:[\"decrypt\"],publicUsages:[\"encrypt\"],seedPrefix:void 0,publicFormat:\"spki\",check:Zg(e.hash.name)}),rA={module:\"KeyWrap\",specOf:n9,privateKeyProto:t9,publicKeyProto:r9,isPrivateKey:tA},nA=e=>\"nonceLength\"in e?qg:\"mode\"in e?Jg:\"_tag\"in e?{key:oA,toBytes:sA}:ny;var oA=(e,t)=>ln(\"KeyWrap\",\"key\",e9,e,t,Gf(e));var sA=e=>eA(e)?Rs(\"KeyWrap\",e,vi):Zf(rA,e);var nU=\"~effect/crypto/Signature/PrivateKey\",oU=\"~effect/crypto/Signature/PublicKey\";var sU=$r(nU,\"Signature.PrivateKey\"),aU=$r(oU,\"Signature.PublicKey\"),aA=e=>A(e,nU),iU=e=>A(e,oU),o9=e=>{let t={privateUsages:[\"sign\"],publicUsages:[\"verify\"]};switch(e._tag){case\"Ed25519\":return{...t,name:\"Ed25519\",importParams:{name:\"Ed25519\"},seedPrefix:AN,publicFormat:\"raw\"};case\"Ecdsa\":return{...t,name:\"ECDSA\",importParams:{name:\"ECDSA\",namedCurve:e.namedCurve},seedPrefix:void 0,publicFormat:\"raw\",check:Vg(e.namedCurve)};case\"RsaPss\":case\"RsaPkcs1v15\":{let r=e._tag===\"RsaPss\"?\"RSA-PSS\":\"RSASSA-PKCS1-v1_5\";return{...t,name:r,importParams:{name:r,hash:e.hash.name},seedPrefix:void 0,publicFormat:\"spki\",check:Zg(e.hash.name)}}}},iA={module:\"Signature\",specOf:o9,privateKeyProto:sU,publicKeyProto:aU,isPrivateKey:aA};var cU=(e,t)=>ln(\"Signature\",\"privateKey\",sU,e,t,Vf(\"Ed25519\",\"private\")),uU=(e,t)=>ln(\"Signature\",\"publicKey\",aU,e,t,e._tag===\"Ecdsa\"?Gg(e.namedCurve):Vf(\"Ed25519\",\"public\"));var cA=e=>Zf(iA,e);var Ps=(e,t)=>Ci(\"KeyFormat\",e,t),i9=(e,t)=>Ia(\"KeyFormat\",e,new Ai({description:t})),pU=e=>{switch(\"_tag\"in e?e._tag:void 0){case\"Ed25519\":case\"Ecdsa\":case\"RsaPss\":case\"RsaPkcs1v15\":return iA;case\"X25519\":case\"Ecdh\":return qw;case\"RsaOaep\":return rA;default:return}},dU={spki:\"PUBLIC KEY\",pkcs8:\"PRIVATE KEY\",pkcs1:\"RSA PRIVATE KEY\",sec1:\"EC PRIVATE KEY\",jwk:\"\"},c9=/^-----BEGIN ([A-Z0-9 ]+)-----\\r?\\n([A-Za-z0-9+/=\\r\\n]+)-----END ([A-Z0-9 ]+)-----$/,u9=(e,t)=>{let r=c9.exec(t.trim());if(r===null||r[1]!==e||r[3]!==e)return`Expected exactly one PEM block labelled ${e}`;let n=Xc(r[2].replace(/\\r?\\n/g,\"\"));return rt(n)?n.success:`The ${e} PEM block is not valid base64`},f9=(e,t)=>{let r=Ca(t),n=[];for(let o=0;o<r.length;o+=64)n.push(r.slice(o,o+64));return`-----BEGIN ${e}-----\n${n.join(`\n`)}\n-----END ${e}-----\n`},l9=Uint8Array.of(48,13,6,9,42,134,72,134,247,13,1,1,1,5,0),p9=Uint8Array.of(6,7,42,134,72,206,61,2,1),mU={\"P-256\":Uint8Array.of(6,8,42,134,72,206,61,3,1,7),\"P-384\":Uint8Array.of(6,5,43,129,4,0,34),\"P-521\":Uint8Array.of(6,5,43,129,4,0,35)},hU=e=>eu(48,p9,mU[e]),xU=Uint8Array.of(2,1,0),gU={reason:\"Unsupported\",description:\"EC private keys must include the public point, which Safari cannot import without\"},d9=e=>ty(e,48)===void 0?{reason:\"InvalidKey\",description:\"Malformed PKCS#1 RSAPrivateKey\"}:eu(48,xU,l9,eu(4,e)),m9=(e,t)=>{let r={reason:\"InvalidKey\",description:\"Malformed SEC1 ECPrivateKey\"},n=ty(e,48),o=n===void 0?void 0:ry(e,n);if(o===void 0||o.length<2)return r;let[s,a,...i]=o;if(s.tag!==2||a.tag!==4)return r;let c=i.find(p=>p.tag===160),u=i.find(p=>p.tag===161);if(c!==void 0){let p=qd(e,c.start,c.end);if(p===void 0||p.tag!==6||p.end!==c.end)return r;if(!Vw(Yf(e,p),mU[t]))return{reason:\"InvalidKey\",description:`Expected a ${t} key`}}if(u===void 0)return gU;let f=eu(48,Yf(e,s),Yf(e,a),Yf(e,u));return eu(48,xU,hU(t),eu(4,f))},h9=(e,t)=>{let r=ty(e,48),n=r===void 0?void 0:ry(e,r);if(n===void 0||n.length<3)return;if(!Vw(Yf(e,n[1]),hU(t)))return{reason:\"InvalidKey\",description:`Expected a ${t} EC private key`};let o=n[2];if(o.tag!==4)return;let s=qd(e,o.start,o.end);if(s===void 0||s.tag!==48)return;let a=ry(e,s);if(a!==void 0)return a.some(i=>i.tag===161)?void 0:gU},lU=[\"ECDH-ES\",\"ECDH-ES+A128KW\",\"ECDH-ES+A192KW\",\"ECDH-ES+A256KW\"],oy=e=>e.name.slice(4),x9={aes128Gcm:\"A128GCM\",aes256Gcm:\"A256GCM\",chacha20Poly1305:\"C20P\",xchacha20Poly1305:\"XC20P\",aes128Ctr:\"A128CTR\",aes256Ctr:\"A256CTR\",aes128Cbc:\"A128CBC\",aes256Cbc:\"A256CBC\",hmacSha1:\"HS1\",hmacSha256:\"HS256\",hmacSha384:\"HS384\",hmacSha512:\"HS512\",aes128Kw:\"A128KW\",aes256Kw:\"A256KW\"},g9=e=>{if(!(\"_tag\"in e)||e._tag===\"AesKw\")return{kty:\"oct\",crv:void 0,algs:[x9[e.name]]};switch(e._tag){case\"Ed25519\":return{kty:\"OKP\",crv:\"Ed25519\",algs:[\"EdDSA\",\"Ed25519\"]};case\"X25519\":return{kty:\"OKP\",crv:\"X25519\",algs:lU};case\"Ecdsa\":return{kty:\"EC\",crv:e.namedCurve,algs:[`ES${oy(e.hash)}`]};case\"Ecdh\":return{kty:\"EC\",crv:e.namedCurve,algs:lU};case\"RsaPss\":return{kty:\"RSA\",crv:void 0,algs:[`PS${oy(e.hash)}`]};case\"RsaPkcs1v15\":return{kty:\"RSA\",crv:void 0,algs:[`RS${oy(e.hash)}`]};case\"RsaOaep\":return{kty:\"RSA\",crv:void 0,algs:[e.hash.name===\"SHA-1\"?\"RSA-OAEP\":`RSA-OAEP-${oy(e.hash)}`]}}},fA=[\"kty\",\"crv\",\"x\",\"y\",\"n\",\"e\"],yU=[...fA,\"d\",\"p\",\"q\",\"dp\",\"dq\",\"qi\"],uA=(e,t)=>{let r={};for(let n of t){let o=e[n];o!==void 0&&(r[n]=o)}return r},SU=(e,t,r)=>{if(!fr(e))return\"Expected a JWK object\";let n=g9(t);if(e.kty!==void 0&&e.kty!==n.kty)return`Expected a JWK with kty ${n.kty}, not ${String(e.kty)}`;if(e.crv!==void 0&&e.crv!==n.crv)return n.crv===void 0?`Expected a JWK without crv, not ${String(e.crv)}`:`Expected a JWK with crv ${n.crv}, not ${String(e.crv)}`;if(e.alg!==void 0&&!n.algs.includes(e.alg))return`Expected a JWK with alg ${n.algs.join(\" or \")}, not ${String(e.alg)}`;switch(r){case\"public\":return e.d!==void 0?\"A public JWK cannot contain d\":uA({...e,kty:n.kty},fA);case\"private\":return typeof e.d!=\"string\"?\"A private JWK must contain d\":uA({...e,kty:n.kty},yU);case\"secret\":return typeof e.k!=\"string\"?\"A secret JWK must contain k\":{kty:\"oct\",k:e.k}}},bU=(e,t,r,n,o)=>L(()=>{let s=pU(n);if(s===void 0)return Ps(e,\"Expected an asymmetric algorithm\");let a=s.specOf(n),i;if(r._tag===\"jwk\"){let c=SU(o,n,t);if(typeof c==\"string\")return Ps(e,c);i={format:\"jwk\",data:c}}else{let c;if(r.pem){if(typeof o!=\"string\")return Ps(e,\"Expected PEM text\");let f=u9(dU[r._tag],o);if(typeof f==\"string\")return Ps(e,f);c=f}else{if(!(o instanceof Uint8Array))return Ps(e,\"Expected DER bytes as a Uint8Array\");c=Jf(o)}let u=c;if(r._tag===\"pkcs1\"?u=a.publicFormat===\"spki\"?d9(c):{reason:\"InvalidKey\",description:\"PKCS#1 holds RSA private keys only\"}:r._tag===\"sec1\"?u=n._tag===\"Ecdsa\"||n._tag===\"Ecdh\"?m9(c,n.namedCurve):{reason:\"InvalidKey\",description:\"SEC1 holds EC private keys only\"}:r._tag===\"pkcs8\"&&(n._tag===\"Ecdsa\"||n._tag===\"Ecdh\")&&(u=h9(c,n.namedCurve)??c),!(u instanceof Uint8Array))return u.reason===\"Unsupported\"?i9(e,u.description):Ps(e,u.description);i={format:r._tag===\"spki\"?\"spki\":\"pkcs8\",data:u}}return Kd(\"KeyFormat\",e,n.name,async c=>{let u=t===\"private\"?a.privateUsages:a.publicUsages,f=i.format===\"jwk\"?await c.importKey(\"jwk\",i.data,a.importParams,!0,[...u]):await c.importKey(i.format,i.data,a.importParams,!0,[...u]);return zo(t===\"private\"?s.privateKeyProto:s.publicKeyProto,Mw(n,f),await zw(c,f,a,t))})}),ay=(e,t,r)=>bU(\"decodePublic\",\"public\",e,t,r),iy=(e,t,r)=>bU(\"decodePrivate\",\"private\",e,t,r),Gd=(e,t,r)=>L(()=>{if(e._tag!==\"jwk\")return Ps(\"decodeSecret\",\"Secret keys are only read from JWK\");let n=SU(r,t,\"secret\");if(typeof n==\"string\")return Ps(\"decodeSecret\",n);let o=Wd(n.k);return ae(o)?Ps(\"decodeSecret\",\"The JWK k member is not valid base64url\"):nA(t).key(t,o.success).pipe(Uo(Pw(\"KeyFormat\",\"decodeSecret\")))}),y9=(e,t,r)=>L(()=>{let n=r.specOf(t.algorithm),o=r.isPrivateKey(t)?\"private\":\"public\",s=Ho(t);if(s._tag===\"CryptoKey\"&&!s.cryptoKey.extractable)return $d(\"KeyFormat\",\"encode\");let a=e._tag===\"jwk\"?\"jwk\":e._tag===\"spki\"?\"spki\":\"pkcs8\";if(s._tag===\"Bytes\"){if(a===\"pkcs8\"&&o===\"private\"&&n.seedPrefix===void 0)return g(Jf(s.bytes));if(a===\"spki\"&&o===\"public\"&&n.publicFormat===\"spki\")return g(Jf(s.bytes))}return Kd(\"KeyFormat\",\"encode\",t.algorithm.name,async i=>{let c=s._tag===\"CryptoKey\"?s.cryptoKey:o===\"private\"?await TN(i,s.bytes,n,!0):await vN(i,s.bytes,n);return a===\"jwk\"?uA(await i.exportKey(\"jwk\",c),o===\"private\"?yU:fA):new Uint8Array(await i.exportKey(a,c))})}),EU=(e,t)=>{let r=e,n=pU(t.algorithm),o=n!==void 0?y9(r,t,n):r._tag!==\"jwk\"?Ps(\"encode\",\"Secret keys are only written as JWK\"):nA(t.algorithm).toBytes(t).pipe(Uo(Pw(\"KeyFormat\",\"encode\")),W(s=>({kty:\"oct\",k:ey(s)})));return r.pem?W(o,s=>f9(dU[r._tag],s)):o};var lA=kf,IU=Nc,wU=C1,AU=T1,CU=v1,TU=h0,pA=k1;var Vd=dg;var vU=x0;var dA=_1,kU=R1;var mA=P1;var hA=g0,xA=gd,OU=y0;var _U=S0,Zd=M1;var cy=yd;var gA=I0;var RU=N1;var yA=A0;var fy=\"~effect/HashMap\",Wo=5,Qd=1<<Wo,b9=Qd/4,PU=Qd/2,E9=Qd-1,I9=e=>(e=e-(e>>>1&1431655765),e=(e&858993459)+(e>>>2&858993459),(e+(e>>>4)&252645135)*16843009>>>24),Yd=(e,t)=>e>>>t&E9,Pi=(e,t)=>1<<Yd(e,t),uy=(e,t)=>I9(e&t-1);function MU(e,t,r,n,o,s){if(t>32)throw new Error(\"HashMap: max depth exceeded\");let a=Pi(r,t),i=Pi(o,t);if(a===i){let f=MU(e,t+Wo,r,n,o,s);return new nu(e,a,[f])}let c=a|i,u=a>>>0<i>>>0?[n,s]:[s,n];return new nu(e,c,u)}var w9=Pe(\"HashMap\"),FU=(e,t)=>Ee(V(e),V(t)),NU=e=>{let t=0;for(let r=0;r<e.length;r++){let n=e[r];n&&(t^=n.subtreeHash())}return t},tu=class{canEdit(t){return this.edit===t}subtreeHash(){let t=this._hash;if(t===void 0){let r=ec;t=this.computeHash(),r===ec&&(this._hash=t)}return t}},bA=class extends tu{_tag=\"EmptyNode\";edit=0;get size(){return 0}get(t,r,n){return v()}has(t,r,n){return!1}set(t,r,n,o,s,a){return a.value=!0,new ru(t,n,o,s)}remove(t,r,n,o,s){return this}canEdit(t){return!1}computeHash(){return 0}},ru=class e extends tu{_tag=\"LeafNode\";edit;hash;key;value;constructor(t,r,n,o){super(),this.edit=t,this.hash=r,this.key=n,this.value=o}get size(){return 1}get(t,r,n){return this.hash===r&&Z(this.key,n)?_(this.value):v()}has(t,r,n){return this.hash===r&&Z(this.key,n)}set(t,r,n,o,s,a){if(this.canEdit(t)&&(this._hash=void 0),this.hash===n&&Z(this.key,o))return Object.is(this.value,s)?this:this.canEdit(t)?(this.value=s,this):new e(t,n,o,s);if(a.value=!0,this.hash===n)return new EA(t,n,[[this.key,this.value],[o,s]]);let i=Pi(n,r),c=Pi(this.hash,r);if(i===c)return new nu(t,i,[this.set(t,r+Wo,n,o,s,a)]);let u=i|c,f=i>>>0<c>>>0?[new e(t,n,o,s),this]:[this,new e(t,n,o,s)];return new nu(t,u,f)}remove(t,r,n,o,s){if(this.hash===n&&Z(this.key,o)){s.value=!0;return}return this}computeHash(){return FU(this.key,this.value)}},EA=class e extends tu{_tag=\"CollisionNode\";edit;hash;entries;constructor(t,r,n){super(),this.edit=t,this.hash=r,this.entries=n}get size(){return this.entries.length}get(t,r,n){if(this.hash!==r)return v();for(let[o,s]of this.entries)if(Z(o,n))return _(s);return v()}has(t,r,n){if(this.hash!==r)return!1;for(let[o]of this.entries)if(Z(o,n))return!0;return!1}set(t,r,n,o,s,a){if(this.canEdit(t)&&(this._hash=void 0),this.hash!==n)return a.value=!0,MU(t,r,this.hash,this,n,new ru(t,n,o,s));for(let i=0;i<this.entries.length;i++)if(Z(this.entries[i][0],o)){if(Object.is(this.entries[i][1],s))return this;if(this.canEdit(t))return this.entries[i]=[o,s],this;let c=[...this.entries];return c[i]=[o,s],new e(t,this.hash,c)}return a.value=!0,this.canEdit(t)?(this.entries.push([o,s]),this):new e(t,this.hash,[...this.entries,[o,s]])}remove(t,r,n,o,s){if(this.canEdit(t)&&(this._hash=void 0),this.hash!==n)return this;let a=this.entries.findIndex(([c])=>Z(c,o));if(a===-1)return this;if(s.value=!0,this.entries.length===1)return;if(this.entries.length===2){let c=this.entries[a===0?1:0];return new ru(t,this.hash,c[0],c[1])}if(this.canEdit(t))return this.entries.splice(a,1),this;let i=[...this.entries];return i.splice(a,1),new e(t,this.hash,i)}computeHash(){let t=0,r=this.entries;for(let n=0;n<r.length;n++)t^=FU(r[n][0],r[n][1]);return t}},nu=class e extends tu{_tag=\"IndexedNode\";edit;_size;bitmap;children;constructor(t,r,n){super(),this.edit=t,this.bitmap=r,this.children=n}get size(){return this._size===void 0&&(this._size=this.children.reduce((t,r)=>t+r.size,0)),this._size}get(t,r,n){let o=Pi(r,t);if((this.bitmap&o)===0)return v();let s=uy(this.bitmap,o);return this.children[s].get(t+Wo,r,n)}has(t,r,n){let o=Pi(r,t);if((this.bitmap&o)===0)return!1;let s=uy(this.bitmap,o);return this.children[s].has(t+Wo,r,n)}set(t,r,n,o,s,a){this.canEdit(t)&&(this._hash=void 0);let i=Pi(n,r),c=uy(this.bitmap,i);if((this.bitmap&i)!==0){let u=this.children[c],f=u.set(t,r+Wo,n,o,s,a);if(u===f)return this;if(this.canEdit(t))return this.children[c]=f,this;let p=[...this.children];return p[c]=f,new e(t,this.bitmap,p)}else{a.value=!0;let u=new ru(t,n,o,s),f=this.bitmap|i;if(this.canEdit(t))return this.children.splice(c,0,u),this.bitmap=f,this._size=void 0,this.children.length>PU?this.expand(t,f,this.children):this;let p=[...this.children];return p.splice(c,0,u),p.length>PU?this.expand(t,f,p):new e(t,f,p)}}remove(t,r,n,o,s){this.canEdit(t)&&(this._hash=void 0);let a=Pi(n,r);if((this.bitmap&a)===0)return this;let i=uy(this.bitmap,a),c=this.children[i],u=c.remove(t,r+Wo,n,o,s);if(!s.value)return this;if(u===void 0){let p=this.bitmap^a;if(p===0)return;if(this.children.length===2){let m=this.children[i===0?1:0];if(m._tag===\"LeafNode\")return m}if(this.canEdit(t))return this.children.splice(i,1),this.bitmap=p,this._size=void 0,this;let d=[...this.children];return d.splice(i,1),new e(t,p,d)}if(c===u)return this;if(this.canEdit(t))return this.children[i]=u,this;let f=[...this.children];return f[i]=u,new e(t,this.bitmap,f)}expand(t,r,n){let o=new globalThis.Array(Qd),s=0;for(let a=0;a<Qd;a++)(r&1<<a)!==0&&(o[a]=n[s++]);return new IA(t,n.length,o)}computeHash(){return NU(this.children)}},IA=class e extends tu{_tag=\"ArrayNode\";edit;_size;count;children;constructor(t,r,n){super(),this.edit=t,this.count=r,this.children=n}get size(){return this._size===void 0&&(this._size=this.children.reduce((t,r)=>t+(r?.size??0),0)),this._size}get(t,r,n){let o=Yd(r,t),s=this.children[o];return s?s.get(t+Wo,r,n):v()}has(t,r,n){let o=Yd(r,t),s=this.children[o];return s?s.has(t+Wo,r,n):!1}set(t,r,n,o,s,a){this.canEdit(t)&&(this._hash=void 0);let i=Yd(n,r),c=this.children[i];if(c){let u=c.set(t,r+Wo,n,o,s,a);if(c===u)return this;if(this.canEdit(t))return this.children[i]=u,this;let f=[...this.children];return f[i]=u,new e(t,this.count,f)}else{a.value=!0;let u=new ru(t,n,o,s);if(this.canEdit(t))return this.children[i]=u,this.count++,this._size=void 0,this;let f=[...this.children];return f[i]=u,new e(t,this.count+1,f)}}remove(t,r,n,o,s){this.canEdit(t)&&(this._hash=void 0);let a=Yd(n,r),i=this.children[a];if(!i)return this;let c=i.remove(t,r+Wo,n,o,s);if(!s.value)return this;let u=this.count-(c?0:1);if(u<b9)return this.pack(t,a,c);if(i===c)return this;if(this.canEdit(t))return this.children[a]=c,c||(this.count=u),this._size=void 0,this;let f=[...this.children];return f[a]=c,new e(t,u,f)}pack(t,r,n){let o=[],s=0,a=1;for(let i=0;i<this.children.length;i++){let c=i===r?n:this.children[i];c&&(o.push(c),s|=a),a<<=1}return new nu(t,s,o)}computeHash(){return NU(this.children)}},ly=class{stack;project;entries=[];index=0;constructor(t,r){this.stack=[t],this.project=r}next(){for(;;){if(this.index<this.entries.length){let r=this.entries[this.index++];return{done:!1,value:this.project(r[0],r[1])}}if(this.stack.length===0)return{done:!0,value:void 0};let t=this.stack.pop();switch(t._tag){case\"LeafNode\":{let r=t;return{done:!1,value:this.project(r.key,r.value)}}case\"CollisionNode\":{this.entries=t.entries,this.index=0;break}case\"IndexedNode\":case\"ArrayNode\":{let r=t.children;for(let n=r.length-1;n>=0;n--){let o=r[n];o&&this.stack.push(o)}}}}}[Symbol.iterator](){return this}},A9=(e,t)=>[e,t];var Xd=class{[fy]=fy;_editable;_edit;_root;_size;constructor(t,r,n,o){this._editable=t,this._edit=r,this._root=n,this._size=o}get size(){return this._size}[Symbol.iterator](){return new ly(this._root,A9)}[ne](t){if(wA(t)){let r=t;if(this.size!==r.size)return!1;for(let[n,o]of this){let s=Fb(t,LU(n));if(ge(s)||!Z(o,s.value))return!1}return!0}return!1}[re](){return lr(w9^this._root.subtreeHash())}[Je](){return qt(this)}toString(){return`HashMap(${K(Array.from(this))})`}toJSON(){return{_id:\"HashMap\",values:Array.from(this).map(([t,r])=>[qt(t),qt(r)])}}pipe(){return te(this,arguments)}},UU=new bA,wA=e=>A(e,fy),AA=()=>new Xd(!1,0,UU,0);var DU=e=>{let t=UU,r=0,n={value:!1};for(let[o,s]of e){let a=V(o);n.value=!1,t=t.set(NaN,0,a,o,s,n),n.value&&r++}return new Xd(!1,0,t,r)};var LU=l(2,(e,t)=>e._root.get(0,V(t),t));var CA=l(2,(e,t)=>e._root.has(0,V(t),t));var C9=(e,t,r,n)=>{let o=e,s={value:!1},a=o._editable?o._edit:NaN,i=o._root.set(a,0,r,t,n,s);return o._editable?(o._root=i,s.value&&o._size++,e):o._root===i?e:new Xd(!1,o._edit,i,o._size+(s.value?1:0))},TA=l(3,(e,t,r)=>C9(e,t,V(t),r)),vA=e=>new ly(e._root,D);var $U=e=>e[Symbol.iterator](),py=e=>e.size;var BU=wA;var kA=DU;var k9=$U,em=e=>Array.from(k9(e)),jU=py;var tm=\"~effect/HashSet\",O9=Pe(tm),_9={[re](){return lr(Ee(O9,V(dy(this))))},[ne](e){return _A(e)&&my(this)===my(e)&&WU(this,t=>zU(e,t))},[Symbol.iterator](){return vA(dy(this))},toString(){return`HashSet(${K(Array.from(this))})`},toJSON(){return{_id:\"HashSet\",values:qt(Array.from(this))}},[Je](){return this.toJSON()},pipe(){return te(this,arguments)}},R9=e=>{let t=Object.create(_9);return t[tm]=tm,t.keyMap=e,t},_A=e=>A(e,tm),dy=e=>e.keyMap;var HU=e=>{let t=AA();for(let r of e)t=TA(t,r,!0);return R9(t)},zU=(e,t)=>CA(dy(e),t);var my=e=>py(dy(e));var WU=(e,t)=>{for(let r of e)if(!t(r))return!1;return!0};var RA=HU,qU=_A;var JU=my;var MA=\"~effect/http/Cookies\",ZU=e=>A(e,MA),FA=\"~effect/http/Cookies/Cookie\",YU=e=>A(e,FA),GU=\"~effect/http/Cookies/CookieError\",NA=class extends Np{},ou=class e extends Ut(\"CookiesError\"){static fromReason(t,r){return new e({reason:new NA({_tag:t,cause:r})})}[GU]=GU;get message(){return this.reason._tag}};var M9={[MA]:MA,...$t,toJSON(){return{_id:\"effect/Cookies\",cookies:gc(this.cookies,e=>e.toJSON())}},pipe(){return te(this,arguments)}},DA=e=>{let t=Object.create(M9);return t.cookies=e,t},LA=e=>{let t={};for(let r of e)B(t,r.name,r);return DA(t)},QU=e=>{let t=typeof e==\"string\"?[e]:e,r=[];for(let n of t){let o=F9(n.trim());o&&r.push(o)}return LA(r)};function F9(e){let t=e.split(\";\").map(i=>i.trim()).filter(i=>i!==\"\");if(t.length===0)return;let r=t[0].indexOf(\"=\");if(r===-1)return;let n=t[0].slice(0,r).replace(VU,\"\");if(!XU.test(n))return;let o=t[0].slice(r+1).replace(VU,\"\"),s=B9(o);if(t.length===1)return Object.assign(Object.create(UA),{name:n,value:s,valueEncoded:o});let a={};for(let i=1;i<t.length;i++){let c=t[i],u=c.indexOf(\"=\"),f=u===-1?c:c.slice(0,u).trim(),p=u===-1?void 0:c.slice(u+1).trim();switch(f.toLowerCase()){case\"domain\":{if(p===void 0)break;let d=p.trim().replace(/^\\./,\"\");d&&(a.domain=d);break}case\"expires\":{if(p===void 0)break;let d=new Date(p);isNaN(d.getTime())||(a.expires=d);break}case\"max-age\":{if(p===void 0||!U9.test(p))break;a.maxAge=cf(parseInt(p,10));break}case\"path\":{if(p===void 0)break;p[0]===\"/\"&&(a.path=p);break}case\"priority\":{if(p===void 0)break;switch(p.toLowerCase()){case\"low\":a.priority=\"low\";break;case\"medium\":a.priority=\"medium\";break;case\"high\":a.priority=\"high\";break}break}case\"httponly\":{a.httpOnly=!0;break}case\"secure\":{a.secure=!0;break}case\"partitioned\":{a.partitioned=!0;break}case\"samesite\":{if(p===void 0)break;switch(p.toLowerCase()){case\"lax\":a.sameSite=\"lax\";break;case\"strict\":a.sameSite=\"strict\";break;case\"none\":a.sameSite=\"none\";break}break}}}return Object.assign(Object.create(UA),{name:n,value:s,valueEncoded:o,options:Object.keys(a).length>0?a:void 0})}var N9=/^[\\u0009\\u0020-\\u007e\\u0080-\\u00ff]+$/,XU=/^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/,VU=/^[\\t ]+|[\\t ]+$/g,U9=/^-?[0-9]+$/,D9=/^[\\u0009\\u0020-\\u003a\\u003c-\\u007e\\u0080-\\u00ff]+$/,L9=/^[\\u0020-\\u003a\\u003c-\\u007e]+$/,UA={[FA]:FA,...$t,toJSON(){return{_id:\"effect/Cookies/Cookie\",name:this.name,value:this.value,options:this.options}}};function $9(e,t,r){let n=encodeURIComponent(t),o=e2(e,n,r);return o!==void 0?q(o):j(Object.assign(Object.create(UA),{name:e,value:t,valueEncoded:n,options:r}))}function e2(e,t,r){if(!XU.test(e))return ou.fromReason(\"InvalidCookieName\");if(t&&!N9.test(t))return ou.fromReason(\"InvalidCookieValue\");if(r?.domain!==void 0&&!D9.test(r.domain))return ou.fromReason(\"InvalidCookieDomain\");if(r?.path!==void 0&&!L9.test(r.path))return ou.fromReason(\"InvalidCookiePath\");if(r?.maxAge!==void 0&&!sn(ct(r.maxAge)))return ou.fromReason(\"CookieInfinityMaxAge\")}var t2=(e,t,r)=>ms($9(e,t,r));function K9(e){let t=e2(e.name,e.valueEncoded,e.options);if(t!==void 0)throw t;let r=e.name+\"=\"+e.valueEncoded;if(e.options===void 0)return r;let n=e.options;if(n.maxAge!==void 0){let o=hs(ct(n.maxAge));r+=\"; Max-Age=\"+Math.trunc(o)}if(n.domain!==void 0&&!n.hostOnly&&(r+=\"; Domain=\"+n.domain),n.path!==void 0&&(r+=\"; Path=\"+n.path),n.priority!==void 0)switch(n.priority){case\"low\":r+=\"; Priority=Low\";break;case\"medium\":r+=\"; Priority=Medium\";break;case\"high\":r+=\"; Priority=High\";break}if(n.expires!==void 0&&(r+=\"; Expires=\"+n.expires.toUTCString()),n.httpOnly&&(r+=\"; HttpOnly\"),n.secure&&(r+=\"; Secure\"),n.partitioned&&(r+=\"; Partitioned\"),n.sameSite!==void 0)switch(n.sameSite){case\"lax\":r+=\"; SameSite=Lax\";break;case\"strict\":r+=\"; SameSite=Strict\";break;case\"none\":r+=\"; SameSite=None\";break}return r}var r2=e=>{let t={},r=Object.values(e.cookies);for(let n=0;n<r.length;n++){let o=r[n];B(t,o.name,o.value)}return t},n2=e=>Object.values(e.cookies).map(K9);var B9=e=>{try{return decodeURIComponent(e)}catch{return e}};var su=new WeakMap,o2=e=>{if(su.has(e))return su.get(e);throw new Error(\"Unable to get redacted value\"+(e.label?` with label: \"${e.label}\"`:\"\"))};var s2=\"~effect/Redacted\",Qf=e=>A(e,s2),Ta=(e,t)=>{let r=Object.create(z9);return t?.label&&(r.label=t.label),su.set(r,e),r},z9={[s2]:{_A:e=>e},label:void 0,...kr,toJSON(){return this.toString()},toString(){return`<redacted${Wr(this.label)?\":\"+this.label:\"\"}>`},[re](){return V(su.get(this))},[ne](e){return Qf(e)&&Z(su.get(this),su.get(e))}},Mi=o2;var a2=e=>Kt((t,r)=>e(Mi(t),Mi(r)));var $A=Symbol.for(\"~effect/http/Headers\"),c2=e=>A(e,$A),KA=Object.defineProperties(Object.create(null),{[$A]:{value:$A},[Gs]:{value(e){return q9(this,Me(e,J9))}},toJSON:{value(){return Ao(this)}},[ne]:{value(e){return HA(this,e)}},[re]:{value(){return mp(this)}},toString:{value:$t.toString},[Je]:{value:$t[Je]}});var HA=T_(Wa()),W9=Object.create(KA),u2=e=>{if(e===void 0)return W9;if(Symbol.iterator in e){let r=Object.create(KA);for(let[n,o]of e)r[n.toLowerCase()]=o;return r}let t=Object.create(KA);for(let[r,n]of Object.entries(e))Array.isArray(n)?t[r.toLowerCase()]=n.join(\", \"):n!==void 0&&(t[r.toLowerCase()]=n);return t};var q9=l(2,(e,t)=>{let r={...e},n=o=>{if(typeof o==\"string\"){let s=o.toLowerCase();s in e&&(r[s]=Ta(e[s]))}else for(let s in e)s.search(o)!==-1&&(r[s]=Ta(e[s]))};if(Array.isArray(t))for(let o=0;o<t.length;o++)n(t[o]);else n(t);return r}),f2=(e,t)=>{let r=e.toLowerCase();for(let n=0;n<t.length;n++){let o=t[n];if(typeof o==\"string\"){if(o.toLowerCase()===r)return!0}else if(e.search(o)!==-1)return!0}return!1},J9=Te(\"effect/Headers/CurrentRedactedNames\",{defaultValue:()=>[\"authorization\",\"cookie\",\"set-cookie\",\"x-api-key\"]}),i2=\"~effect/http/Headers/HeaderParseError\",BA=class extends Np{},hy=class e extends Ut(\"HeaderParseError\"){static fromReason(t,r){return new e({reason:new BA({_tag:t,input:r})})}[i2]=i2;get message(){return`${this.reason._tag}: ${JSON.stringify(this.reason.input)}`}};var G9=[\"jan\",\"feb\",\"mar\",\"apr\",\"may\",\"jun\",\"jul\",\"aug\",\"sep\",\"oct\",\"nov\",\"dec\"],V9=[/^(?:mon|tue|wed|thu|fri|sat|sun), (?<day>\\d{2}) (?<month>[a-z]{3}) (?<year>\\d{4}) (?<hour>\\d{2}):(?<minute>\\d{2}):(?<second>\\d{2}) gmt$/i,/^(?:monday|tuesday|wednesday|thursday|friday|saturday|sunday), (?<day>\\d{2})-(?<month>[a-z]{3})-(?<year>\\d{2}) (?<hour>\\d{2}):(?<minute>\\d{2}):(?<second>\\d{2}) gmt$/i,/^(?:mon|tue|wed|thu|fri|sat|sun) (?<month>[a-z]{3}) (?<day> \\d|\\d{2}) (?<hour>\\d{2}):(?<minute>\\d{2}):(?<second>\\d{2}) (?<year>\\d{4})$/i],l2=e=>{for(let t of V9){let r=t.exec(e)?.groups;if(r===void 0)continue;let n=G9.indexOf(r.month.toLowerCase()),o=Number(r.hour),s=Number(r.minute),a=Number(r.second);if(n===-1||o>23||s>59||a>60)return;let i=Number(r.year);r.year.length===2&&(i+=i<70?2e3:1900);let c=Number(r.day),u=new Date(0);return u.setUTCFullYear(i,n,c),u.getUTCFullYear()!==i||u.getUTCMonth()!==n||u.getUTCDate()!==c?void 0:u.getTime()+((o*60+s)*60+a)*1e3}},p2=e=>{let t=l2(e.trim());return t===void 0?q(hy.fromReason(\"InvalidHttpDate\",e)):j(Vd(t))},zA=e=>cy(e).toUTCString();var Z9=e=>({_tag:\"DateTime\",dateTime:e}),Y9=/^\\d+$/,jA=BigInt(1e9),d2=e=>{let t=e.trim();if(Y9.test(t)){let n=Number(t),o=Number.isSafeInteger(n*1e3)?cf(n):On(BigInt(t)*jA);return j({_tag:\"Duration\",duration:o})}let r=l2(t);return r===void 0?q(hy.fromReason(\"InvalidRetryAfter\",e)):j(Z9(Vd(r)))},m2=e=>e._tag===\"Duration\"?String((yc(e.duration)+jA-BigInt(1))/jA):zA(e.dateTime);var nm=e=>typeof e==\"string\"?e:Mi(e);var WA=\"~effect/http/UrlParams\",qA=e=>A(e,WA),Q9={...kr,[WA]:WA,[Symbol.iterator](){return this.params[Symbol.iterator]()},[Gs](e){return{_id:\"UrlParams\",params:Object.fromEntries(t7(this,Me(e,n7)))}},toJSON(){return Ao(this)},[ne](e){return JA(this,e)},[re](){return wo(this.params.flat())}},xy=e=>{let t=Object.create(Q9);return t.params=e,t},y2=e=>{if(qA(e))return e;let t=S2(e),r=[];for(let n=0;n<t.length;n++)if(Array.isArray(t[n][0])){let[o,s]=t[n];r.push([`${o[0]}[${o.slice(1).join(\"][\")}]`,s])}else r.push(t[n]);return xy(r)},S2=e=>{let t=typeof e[Symbol.iterator]==\"function\"?wt(e):Object.entries(e),r=[];for(let[n,o]of t)if(Array.isArray(o))for(let s=0;s<o.length;s++)o[s]!==void 0&&r.push([n,g2(o[s])]);else if(o!==null&&typeof o==\"object\"&&!Qf(o)){let s=S2(o);for(let[a,i]of s)r.push([[n,...typeof a==\"string\"?[a]:a],i])}else o!==void 0&&r.push([n,g2(o)]);return r},g2=e=>Qf(e)?e:String(e),JA=Kt((e,t)=>X9(e.params,t.params)),X9=__(S_([Wa(),xp()]));var b2=l(2,(e,t)=>hE(e.params,([r])=>r===t).pipe(Vt(([,r])=>nm(r))));var e7=e=>{let t={};for(let[r,n]of e.params){let o=nm(n);if(!Object.hasOwn(t,r))B(t,r,o);else{let s=t[r];typeof s==\"string\"?B(t,r,[s,o]):s.push(o)}}return t},E2=e7,t7=l(2,(e,t)=>{let r=Array.isArray(t)?t:[t];return e.params.map(([n,o])=>[n,typeof o==\"string\"&&r7(n,r)?Ta(o):o])}),r7=f2;var n7=Te(\"effect/http/UrlParams/CurrentRedactedNames\",{defaultValue:()=>[\"X-Amz-Signature\",\"X-Amz-Credential\",\"X-Amz-Security-Token\",\"AWSAccessKeyId\",\"Signature\",\"sig\",\"X-Goog-Signature\"]});var GA=\"~effect/Graph\",VA=e=>A(e,GA),I2=e=>e;var s7=(e,t,r)=>(e===\"directed\"?t.source===r.source&&t.target===r.target:t.source===r.source&&t.target===r.target||t.source===r.target&&t.target===r.source)&&Z(t.data,r.data),a7=(e,t)=>e===\"directed\"?V(t):lr(Ee(V(t.data),i7(t.source,t.target))),i7=(e,t)=>Ee(0,V(e))+Ee(0,V(t)),c7=Pe(\"Graph\"),u7={[GA]:{_N:e=>e,_E:e=>e},[Symbol.iterator](){return this.nodes[Symbol.iterator]()},[Je](){return this.toJSON()},[ne](e){if(A(e,GA)){let t=I2(e);if(this.nodes.size!==t.nodes.size||this.edges.size!==t.edges.size||this.type!==t.type)return!1;for(let[r,n]of this.nodes)if(!t.nodes.has(r)||!Z(n,t.nodes.get(r)))return!1;for(let[r,n]of this.edges){let o=t.edges.get(r);if(o===void 0||!s7(this.type,n,o))return!1}return!0}return!1},[re](){let e=c7;e=e^Pe(this.type),e=e^Lt(this.nodes.size),e=e^Lt(this.edges.size);for(let[t,r]of this.nodes)e^=Ee(V(t),V(r));for(let[t,r]of this.edges)e^=Ee(V(t),a7(this.type,r));return lr(e)},toJSON(){return{_id:\"Graph\",nodeCount:this.nodes.size,edgeCount:this.edges.size,type:this.type}},toString(){return`Graph(${this.type}, ${this.nodes.size}, ${this.edges.size})`},pipe(){return te(this,arguments)}},f7=(e,t)=>{let r=Object.create(u7);return r.type=e,r.mutable=t,r.transforming=!1,r.nodes=new Map,r.edges=new Map,r.adjacency=new Map,r.reverseAdjacency=new Map,r.nextNodeIndex=0,r.nextEdgeIndex=0,r.acyclic=_(!0),r};var om=e=>{let t=I2(e);return{type:e.type,nodes:Array.from(t.nodes,([r,n])=>({index:r,data:n})).sort((r,n)=>r.index-n.index),edges:Array.from(t.edges,([r,n])=>({index:r,source:n.source,target:n.target,data:n.data})).sort((r,n)=>r.index-n.index)}},gy=e=>{let t=f7(e.type,!1);for(let r of e.nodes)t.nodes.set(r.index,r.data),t.adjacency.set(r.index,[]),t.reverseAdjacency.set(r.index,[]);for(let r of e.edges)t.edges.set(r.index,{source:r.source,target:r.target,data:r.data}),t.adjacency.get(r.source).push(r.index),t.reverseAdjacency.get(r.target).push(r.index),e.type===\"undirected\"&&(t.adjacency.get(r.target).push(r.index),t.reverseAdjacency.get(r.source).push(r.index));return t.nextNodeIndex=e.nodes.length===0?0:e.nodes[e.nodes.length-1].index+1,t.nextEdgeIndex=e.edges.length===0?0:e.edges[e.edges.length-1].index+1,t.acyclic=v(),t};function va(e){return e.checks?e.checks[e.checks.length-1].annotations:e.annotations}function yy(e){return t=>va(t)?.[e]}var pn=\"~structural\",au=\"~identifier\",sm=\"~sentinels\",Sy=\"~constructor\",w2=[\"title\",\"description\",\"default\",\"examples\",\"readOnly\",\"writeOnly\",\"format\",\"contentEncoding\",\"contentMediaType\",\"contentSchema\"],Xf=yy(\"identifier\"),ZA=yy(au),YA=yy(\"title\");var am=on(e=>{let t=va(e)?.identifier;return typeof t==\"string\"?t:e.getExpected(am)}),A2=new Set([sm,pn,\"representation\",\"arbitraryConstraint\",\"toJsonSchema\",\"toCode\",\"toEquivalence\",\"toFormatter\",\"toCodec\",\"toCodecJson\",\"toCodecStringTree\",\"toCodecIso\",\"toCodecArbitrary\"]);var Ae=Symbol();var Er=Gr,dn=Er(Ae),ot=Er(Ae),im=e=>e===Ae?v():_(e),QA=e=>e._tag===\"None\"?dn:Er(e.value);var lm=\"~effect/SchemaIssue/Issue\";function eC(e){return A(e,lm)&&e[lm]===lm}function p7(e){return Object.hasOwn(e,\"input\")}var $n=class{[lm]=lm;constructor(t,r){r?.reportInput===!0&&t!==Ae&&(this.input=t)}},C2=class extends $n{_tag=\"Filter\";filter;issue;constructor(e,t,r,n){super(r,n),this.filter=e,this.issue=t}},T2=class extends $n{_tag=\"Encoding\";ast;issue;constructor(e,t,r,n){super(r,n),this.ast=e,this.issue=t}},Ot=class extends $n{_tag=\"Pointer\";path;issue;constructor(e,t){super(),this.path=e,this.issue=t}},Ni=class extends $n{_tag=\"MissingKey\";annotations;constructor(e){super(),this.annotations=e}},tC=class extends $n{_tag=\"UnexpectedKey\";ast;constructor(e,t,r){super(t,r),this.ast=e}},Ht=class extends $n{_tag=\"Composite\";ast;issues;constructor(e,t,r,n){super(r,n),this.ast=e,this.issues=t}},_t=class extends $n{_tag=\"InvalidType\";ast;constructor(e,t,r){super(t,r),this.ast=e}},fe=class extends $n{_tag=\"InvalidValue\";annotations;constructor(e,t,r){super(t,r),this.annotations=e}};function mn(e,t,r,n,o){return new Ht(e,[new Ot([t],r)],n,o)}var iu=class extends $n{_tag=\"Forbidden\";annotations;constructor(e,t,r){super(t,r),this.annotations=e}},pm=class extends $n{_tag=\"AnyOf\";ast;issues;constructor(e,t,r,n){super(r,n),this.ast=e,this.issues=t}},v2=class extends $n{_tag=\"OneOf\";ast;successes;constructor(e,t,r,n){super(r,n),this.ast=e,this.successes=t}};function XA(e,t,r){if(eC(e))return e;if(typeof e==\"string\")return new fe({message:e},t,r);let n=typeof e.issue==\"string\"?new fe({message:e.issue},t,r):e.issue;return new Ot(e.path,n)}function k2(e,t,r){if(e!==void 0)return typeof e==\"boolean\"?e?void 0:new fe(void 0,t,r):XA(e,t,r)}function O2(e,t,r,n){return Array.isArray(t)?yt(t)?t.length===1?XA(t[0],r,n):new Ht(e,kn(t,o=>XA(o,r,n)),r,n):void 0:k2(t,r,n)}var _2=e=>{let t=tl(e);if(t!==void 0)return t;switch(e._tag){case\"InvalidType\":return el(am(e.ast),e);case\"InvalidValue\":{let r=M2(e);if(r!==void 0)return el(r,e);let n=by(e);return n===void 0?\"Expected a valid value\":`Invalid data ${n}`}case\"MissingKey\":return\"Missing key\";case\"UnexpectedKey\":{let r=by(e);return r===void 0?\"Expected no excess property\":`Unexpected key with value ${r}`}case\"Forbidden\":return\"Forbidden operation\";case\"OneOf\":{let r=by(e);return r===void 0?\"Expected exactly one member to match\":`Expected exactly one member to match the input ${r}`}}},R2=e=>tl(e)??tl(e.issue);function P2(e){return t=>({issues:um(t,[],e?.leafHook??_2,e?.checkHook??R2)})}function by(e){return p7(e)?K(e.input):void 0}function M2(e){let t=e.annotations?.expected;return typeof t==\"string\"?t:void 0}function el(e,t){let r=by(t);return r===void 0?`Expected ${e}`:`Expected ${e}, got ${r}`}function F2(e,t){let r=t(e);if(r!==void 0||e.issue._tag!==\"InvalidValue\")return r;let n=M2(e.issue);return n===void 0?el(N2(e.filter),e):el(n,e.issue)}function um(e,t,r,n,o){switch(e._tag){case\"Filter\":return um(e.issue,t,r,n,o??F2(e,n));case\"Encoding\":return um(e.issue,t,r,n,o);case\"Pointer\":return um(e.issue,[...t,...e.path],r,n,o);case\"Composite\":case\"AnyOf\":return e._tag===\"Composite\"||e.issues.length>0?e.issues.flatMap(s=>um(s,t,r,n,o)):[{path:t,message:o??tl(e)??el(am(e.ast),e)}];default:return[{path:t,message:o??r(e)}]}}function N2(e){let t=e.annotations?.expected;if(typeof t==\"string\")return t;switch(e._tag){case\"Filter\":return\"<filter>\";case\"FilterGroup\":return e.checks.map(r=>N2(r)).join(\" & \")}}function d7(){return e=>fm(e,\"\")}var U2=d7();function fm(e,t,r){let n;switch(e._tag){case\"Filter\":return fm(e.issue,t,r??F2(e,R2));case\"Encoding\":return fm(e.issue,t,r);case\"Pointer\":return fm(e.issue,t+Ph(e.path),r);case\"Composite\":case\"AnyOf\":{if(e._tag===\"Composite\"||e.issues.length>0)return e.issues.map(o=>fm(o,t,r)).join(`\n`);n=r??tl(e)??el(am(e.ast),e);break}default:n=r??_2(e);break}return t?`${n}\n  at ${t}`:n}function tl(e){if(e._tag===\"Pointer\"||e._tag===\"Composite\")return;if(e._tag===\"Encoding\")return tl(e.issue);let r=(e._tag===\"Filter\"?e.filter.annotations:\"annotations\"in e?e.annotations:e.ast.annotations)?.[e._tag===\"MissingKey\"?\"messageMissingKey\":e._tag===\"UnexpectedKey\"?\"messageUnexpectedKey\":\"message\"];if(typeof r==\"string\")return r}function dm(e){let t;for(let r of e.reasons){if(!ai(r)||!eC(r.error))return;t??=r.error}return t}function ho(e,t){let r=dm(e);if(r===void 0)throw new Error(t,{cause:e});return r}var L2=(e,t,r)=>{switch(e._tag){case\"Passthrough\":return g(t);case\"Transform\":return g(Vt(t,e.transform));case\"TransformOptional\":return g(e.transform(t));case\"TransformEffect\":return ge(t)?li:fn(e.transform(t.value,r),_);case\"TransformOptionalEffect\":return e.transform(t,r)}};var mm=e=>Object.assign(Object.create(Pb),e),Ey=(e,t)=>rC((r,n)=>Ct(L2(e,r,n),o=>L2(t,o,n))),Iy=l(2,(e,t)=>{if(e._tag===\"Passthrough\")return t;if(t._tag===\"Passthrough\")return e;switch(e._tag){case\"Transform\":switch(t._tag){case\"Transform\":return le(r=>t.transform(e.transform(r)));case\"TransformOptional\":return ka(r=>t.transform(Vt(r,e.transform)));case\"TransformEffect\":return Rt((r,n)=>t.transform(e.transform(r),n));case\"TransformOptionalEffect\":return Ey(e,t)}case\"TransformOptional\":switch(t._tag){case\"Transform\":return ka(r=>Vt(e.transform(r),t.transform));case\"TransformOptional\":return ka(r=>t.transform(e.transform(r)));case\"TransformEffect\":case\"TransformOptionalEffect\":return Ey(e,t)}case\"TransformEffect\":switch(t._tag){case\"Transform\":return Rt((r,n)=>fn(e.transform(r,n),t.transform));case\"TransformOptional\":case\"TransformOptionalEffect\":return Ey(e,t);case\"TransformEffect\":return Rt((r,n)=>Ct(e.transform(r,n),o=>t.transform(o,n)))}case\"TransformOptionalEffect\":return Ey(e,t)}});function m7(e){return rC((t,r)=>F(e(t,r)))}function cu(e){return m7((t,r)=>{let n={message:e(t)};return Ce(t)?new iu(n,t.value,r):new iu(n)})}var $2=cu(()=>\"Encoding is not supported\"),h7=mm({_tag:\"Passthrough\"});function hn(){return h7}function le(e){return mm({_tag:\"Transform\",transform:e})}function Rt(e){return mm({_tag:\"TransformEffect\",transform:e})}function ka(e){return mm({_tag:\"TransformOptional\",transform:e})}function rC(e){return mm({_tag:\"TransformOptionalEffect\",transform:e})}function nC(){return ka(()=>v())}function oC(e){return rC(t=>{let r=hc(t,cs);return Ce(r)?g(r):fn(e,_)})}function uu(){return le(globalThis.String)}function wy(){return le(globalThis.Number)}function K2(){return Rt((e,t)=>{try{return g(globalThis.BigInt(e))}catch{return F(new fe({expected:\"a value that can be converted to a bigint\"},e,t))}})}function sC(){return le(e=>new globalThis.Date(e))}function B2(){return le(K1)}function j2(e){return Rt((t,r)=>Ff({try:()=>JSON.parse(t,e?.reviver),catch:()=>new fe({expected:\"a valid JSON string\"},t,r)}))}function H2(e){return Rt((t,r)=>Ff({try:()=>{let n=JSON.stringify(t,e?.replacer,e?.space);if(n===void 0)throw new TypeError(\"Value cannot be represented as JSON\");return n},catch:()=>new fe({expected:\"a JSON-serializable value\"},t,r)}))}function z2(e){let t=e?.separator??\",\",r=e?.keyValueSeparator??\"=\",n=e?.trim??!1,o=e?.keepEmptyValues??!1;return le(s=>s.split(t).reduce((a,i)=>{let c,u;if(r===\"\")c=i.slice(0,1),u=i.slice(1,2);else{let f=i.indexOf(r);if(f===-1)return a;c=i.slice(0,f),u=i.slice(f+r.length)}return n&&(c=c.trim(),u=u.trim()),c===\"\"||u===\"\"&&!o||B(a,c,u),a},{}))}function W2(e){let t=e?.separator??\",\",r=e?.keyValueSeparator??\"=\";return le(n=>Object.entries(n).map(([o,s])=>`${o}${r}${s}`).join(t))}function q2(e){let t=e?.separator??\",\";return le(r=>r===\"\"?[]:r.split(t))}function aC(){return le(Ca)}function Ay(e){return le(e?.padding?jN:ey)}function Cy(){return le(gx)}function J2(){return Rt((e,t)=>Lf(jc(Xc(e)),()=>new fe({expected:\"a valid Base64 string\"},e,t)))}function G2(){return Rt((e,t)=>mr(LN(e),{onFailure:()=>F(new fe({expected:\"a valid Base64 string\"},e,t)),onSuccess:g}))}function V2(){return Rt((e,t)=>mr(Wd(e),{onFailure:()=>F(new fe({expected:\"a valid Base64Url string\"},e,t)),onSuccess:g}))}function Z2(){return Rt((e,t)=>mr(HN(e),{onFailure:()=>F(new fe({expected:\"a valid Base64Url string\"},e,t)),onSuccess:g}))}function Y2(){return Rt((e,t)=>mr(CE(e),{onFailure:()=>F(new fe({expected:\"a valid hexadecimal string\"},e,t)),onSuccess:g}))}function Q2(){return Rt((e,t)=>mr(nR(e),{onFailure:()=>F(new fe({expected:\"a valid hexadecimal string\"},e,t)),onSuccess:g}))}function X2(){return le(encodeURIComponent)}function eD(){return Rt((e,t)=>{try{return g(globalThis.decodeURIComponent(e))}catch{return F(new fe({expected:\"a valid URI component\"},e,t))}})}function tD(){return le(e=>sD(Array.from(e.entries())))}var x7=aD(e=>typeof e==\"string\"||typeof Blob<\"u\"&&e instanceof Blob);function rD(){return le(e=>{let t=new FormData;return typeof e==\"object\"&&e!==null&&x7(e).forEach(([n,o])=>{t.append(n,o)}),t})}function nD(){return le(e=>sD(Array.from(e.entries())))}var g7=aD(Wr);function oD(){return le(e=>typeof e==\"object\"&&e!==null?new URLSearchParams(g7(e)):new URLSearchParams)}function y7(e){if(e===\"\")return[\"\"];let t=e.replace(/\\[([^\\]\\r\\n\\u2028\\u2029]*)(\\])?/g,(o,s,a)=>a?`.${s}`:o),r=t.split(\".\"),n=t.startsWith(\".\")?1:0;return r.slice(n).map(o=>nf(o)?globalThis.Number(o):o)}var S7=20;function sD(e){let t={},r=new WeakSet,n=new WeakSet,o=new Map;e.forEach(([s,a])=>{let i=y7(s),c=t;for(let u=0;u<i.length;u++){let f=o.get(c),p=i[u]===\"\"&&f!==void 0?f.length:i[u];f!==void 0&&typeof p==\"number\"&&(f.length=Math.max(f.length,p+1));let d=Object.hasOwn(c,p),m=d?c[p]:void 0;if(u===i.length-1){let h=o.get(m);if(h!==void 0)B(m,h.length++,a);else if(n.has(m))m.push(a);else if(d){let y=[m,a];n.add(y),B(c,p,y)}else B(c,p,a)}else{let h=i[u+1],y=typeof h==\"number\"||h===\"\";if(r.has(m)&&o.has(m)===y)c=m;else{let S={};r.add(S),y&&o.set(S,{parent:c,key:p,length:0}),B(c,p,S),c=S}}}});for(let[s,{key:a,length:i,parent:c}]of Array.from(o).reverse())c[a]===s&&i-Object.keys(s).length<=S7&&B(c,a,Object.assign(new Array(i),s));return t}function aD(e){return t=>{let r=[];function n(o,s){if(e(s))r.push([o,s]);else if(Array.isArray(s))s.every(e)?s.forEach(i=>{r.push([o,i])}):s.forEach((i,c)=>{n(`${o}[${c}]`,i)});else if(typeof s==\"object\"&&s!==null)for(let[a,i]of Object.entries(s))n(`${o}[${a}]`,i)}for(let[o,s]of Object.entries(t))n(o,s);return r}}var iD=Symbol.for(\"~effect/Schema/content\");function cD(e,t){return Object.defineProperty(e,iD,{value:t}),e}function uD(e){return e[iD]}var Ty=class extends ja{_tag=\"Middleware\";decode;encode;constructor(e,t){super(),this.decode=e,this.encode=t}flip(){return new Ty(this.encode,this.decode)}},hm=\"~effect/SchemaTransformation/Transformation\",Ke=class extends ja{[hm]=hm;_tag=\"Transformation\";decode;encode;constructor(e,t){super(),this.decode=e,this.encode=t}flip(){return new Ke(this.encode,this.decode)}};function b7(e){return A(e,hm)&&e[hm]===hm}var vy=e=>b7(e)?e:new Ke(e.decode,e.encode);function mt(e){return new Ke(Rt(e.decode),Rt(e.encode))}function Ge(e){return new Ke(le(e.decode),le(e.encode))}function ky(e){return new Ke(ka(e.decode),ka(e.encode))}function lD(){return new Ke(B2(),hn())}function pD(e){return new Ke(z2(e),W2(e))}var E7=new Ke(hn(),hn());function nl(){return E7}var ol=new Ke(wy(),uu()),Oy=new Ke(K2(),uu()),iC=new Ke(sC(),le(qb)),dD=new Ke(sC(),le(e=>e.getTime()));var cC=mt({decode:(e,t)=>Zt(JF(e),{onNone:()=>F(new fe({expected:\"a valid ByteSize string\"},e,t)),onSome:g}),encode:e=>g(`${e} ${e===BigInt(1)?\"byte\":\"bytes\"}`)}),mD=mt({decode:(e,t)=>Zt(Ew(e),{onNone:()=>F(new fe({expected:\"a non-negative bigint byte count\"},e,t)),onSome:g}),encode:e=>g(Lg(e))}),hD=mt({decode:(e,t)=>Zt(Ew(e),{onNone:()=>F(new fe({expected:\"a non-negative safe-integer byte count\"},e,t)),onSome:g}),encode:(e,t)=>Zt(ZF(e),{onNone:()=>F(new fe({expected:\"a ByteSize representable as a safe integer\"},e,t)),onSome:g})}),I7=e=>fr(e)&&typeof e.message==\"string\",xD=e=>{let r=Object.hasOwn(e,\"cause\")?new Error(e.message,{cause:yD(e.cause)}):new Error(e.message);return typeof e.name==\"string\"&&e.name!==\"Error\"&&(r.name=e.name),typeof e.stack==\"string\"&&(r.stack=e.stack),r},w7=e=>{try{let t=nc(e);return t===void 0?K(e):JSON.parse(t)}catch{return K(e)}},A7=(e,t,r)=>{let n={name:e.name,message:typeof e.message==\"string\"?e.message:\"\"};return t?.includeStack&&typeof e.stack==\"string\"&&(n.stack=e.stack),!t?.excludeCause&&e.cause!==void 0&&(n.cause=r(e.cause)),n},gD=e=>{let t=new WeakSet,r=n=>{if(wO(n)){if(t.has(n))return\"[Circular]\";t.add(n);let o=A7(n,e,r);return t.delete(n),o}return w7(n)};return r},yD=e=>I7(e)?xD(e):e,SD=e=>Ge({decode:xD,encode:t=>gD(e)(t)}),bD=e=>Ge({decode:yD,encode:gD(e)});function ED(){return Ge({decode:oE,encode:Zh})}function ID(){return Ge({decode:nE,encode:ps})}function wD(e){return Ge({decode:vp,encode:e?.onNoneEncoding===null?Zh:ps})}function AD(){return ky({decode:_,encode:mc})}function CD(){return ky({decode:e=>e.pipe(hc(cs),_),encode:mc})}var uC=mt({decode:(e,t)=>URL.canParse(e)?g(new URL(e)):F(new fe({expected:\"a valid URL string\"},e,t)),encode:e=>g(e.href)});var fC=new Ke(J2(),aC()),TD=new Ke(G2(),aC()),vD=new Ke(Z2(),Ay()),kD=new Ke(Q2(),Cy()),OD=new Ke(eD(),X2());function _D(e){return new Ke(j2(e??{}),cD(H2(e),{mediaType:\"application/json\",preserveSchema:e?.reviver===void 0&&e?.replacer===void 0}))}var RD=new Ke(tD(),rD()),PD=new Ke(nD(),oD());function Ui(e){return t=>t._tag===e}var ul=Ui(\"Declaration\");var C7=Ui(\"Never\");var al=Ui(\"Literal\"),pC=Ui(\"UniqueSymbol\");var My=Ui(\"Arrays\"),bC=Ui(\"Objects\"),Fy=Ui(\"Union\"),gm=Ui(\"Suspend\"),Tt=class{to;transformation;constructor(e,t){this.to=e,this.transformation=t}},Ns={},Fs=class{isOptional;isMutable;constructorDefault;annotations;constructor(e,t,r=void 0,n=void 0){this.isOptional=e,this.isMutable=t,this.constructorDefault=r,this.annotations=n}},MD=\"~effect/Schema\",Pt=class{[MD]=MD;annotations;checks;encoding;context;constructor(t=void 0,r=void 0,n=void 0,o=void 0){this.annotations=t,this.checks=r,this.encoding=n,this.context=o}toString(){return`<${this._tag}>`}},fl=class extends Pt{_tag=\"Declaration\";typeParameters;run;encodingChecks;encodingRun;constructor(e,t,r,n,o,s,a,i){super(r,n,o,s),this.typeParameters=e,this.run=t,this.encodingChecks=a,this.encodingRun=i}getParser(){let e;return(t,r)=>{if(t===Ae)return dn;e??=this.run(this.typeParameters);try{return e(t,this,r)}catch(n){return yr(n)}}}_rebuild(e,t,r,n,o){let s=lu(this.typeParameters,e);return s===this.typeParameters&&t===this.checks&&r===this.encodingChecks&&n===this.run&&o===this.encodingRun?this:new fl(s,n,this.annotations,t,void 0,this.context,r,o)}recur(e){return this._rebuild(e,this.checks,this.encodingChecks,this.run,this.encodingRun)}flip(e){return this._rebuild(e,this.encodingChecks,this.checks,this.encodingRun??this.run,this.run)}getExpected(){let e=this.annotations?.expected;return typeof e==\"string\"?e:\"<Declaration>\"}},T7=class extends Pt{_tag=\"Null\";getParser(){return Ky(this,null)}getExpected(){return\"null\"}},ym=new T7;var v7=class extends Pt{_tag=\"Undefined\";getParser(){return Ky(this,void 0)}toCodecJson(){return ft(this,[BD])}getExpected(){return\"undefined\"}},BD=new Tt(ym,new Ke(le(()=>{}),le(()=>null))),EC=new v7;var k7=class extends Pt{_tag=\"Void\";getParser(){let e=Er(void 0);return t=>t===Ae?dn:e}toCodecJson(){return ft(this,[BD])}getExpected(){return\"void\"}},jD=new k7;var O7=class extends Pt{_tag=\"Never\";getParser(){return Vo(this,IO)}getExpected(){return\"never\"}},ll=new O7,_7=class extends Pt{_tag=\"Any\";getParser(){return Vo(this,Ub)}getExpected(){return\"any\"}},HD=new _7,R7=class extends Pt{_tag=\"Unknown\";getParser(){return Vo(this,Ub)}getExpected(){return\"unknown\"}},Jo=new R7,P7=class extends Pt{_tag=\"ObjectKeyword\";getParser(){return Vo(this,pp)}getExpected(){return\"object | array | function\"}},zD=new P7,WD=class extends Pt{_tag=\"Enum\";enums;constructor(e,t,r,n,o){super(t,r,n,o);for(let[,s]of e)if(typeof s==\"number\"&&!globalThis.Number.isFinite(s))throw new Error(`A numeric enum value must be finite, got ${K(s)}`);this.enums=e}getParser(){let e=new Set(this.enums.map(([,t])=>t));return Vo(this,t=>e.has(t))}toCodecStringTree(){if(this.enums.some(([e,t])=>typeof t==\"number\")){let e=Object.fromEntries(this.enums.map(([t,r])=>[globalThis.String(r),r]));return ft(this,[new Tt(new Qr(Object.keys(e).map(t=>new Kn(t))),new Ke(le(t=>e[t]),uu()))])}return this}getExpected(){return this.enums.map(([e,t])=>JSON.stringify(t)).join(\" | \")}};function lC(e){return typeof e==\"number\"?`parts[${e}]`:e}function dC(e,t,r){if(r.has(e))return!0;if(e.encoding)throw new Error(`TemplateLiteral parts cannot have an encoding at ${lC(t)}`);let n;switch(e._tag){case\"String\":case\"Number\":case\"BigInt\":n=!0;break;case\"Literal\":n=!e.checks;break;case\"TemplateLiteral\":{let o=lC(t);n=!e.checks&&e.parts.every((s,a)=>dC(s,`${o}.parts[${a}]`,r));break}case\"Union\":{let o=lC(t);n=!e.checks&&e.types.every((s,a)=>dC(s,`${o}.types[${a}]`,r));break}default:return!1}return n&&r.add(e),n}var IC=class extends Pt{_tag=\"TemplateLiteral\";parts;encodedParts;literals;suffixLengths;constructor(e,t,r,n,o){super(t,r,n,o);let s=[],a=[],i=new Set;for(let u=0;u<e.length;u++){let f=e[u];if(!dC(f,u,i))throw new Error(`Invalid TemplateLiteral part ${f._tag}`);s.push(f),a.push(f._tag===\"Literal\"?globalThis.String(f.literal):void 0)}let c=new Array(s.length+1);c[s.length]=0;for(let u=s.length-1;u>=0;u--)c[u]=c[u+1]+(a[u]?.length??0);this.parts=e,this.encodedParts=s,this.literals=a,this.suffixLengths=c}getParser(e){let t=new jn(!1,this.parts.map(LC),[]),r=e(Oa(xn,t,JD(this)));return(n,o)=>{if(n===Ae)return dn;let s=r(n,o);return s._tag===\"Success\"?ot:Sr(s,{onSuccess:()=>n,onFailure:a=>new Ht(this,[a],n,o)})}}getExpected(){return\"string\"}matchPart(e,t){return hL(this,e,t)===void 0?void 0:e}};function qD(e){let t=on(o=>{if(o._tag!==\"Union\")return o;let s=lu(o.types,t);return(o.options?.mode??\"anyOf\")===\"anyOf\"&&s===o.types?o:new Qr(s,o.options===void 0?void 0:{...o.options,mode:\"anyOf\"},o.annotations,o.checks,void 0,o.context)}),r=new IC(e.map(o=>t(gn(o)))),n=new jn(!1,e.map(LC),[]);return Oa(r,n,JD(r))}function JD(e){return new Ke(Rt((t,r)=>{let n=hL(e,t,r);return n?g(n):F(new fe({expected:\"a string matching template literal parts\"},t,r))}),le(t=>t.join(\"\")))}var GD=class extends Pt{_tag=\"UniqueSymbol\";symbol;constructor(e,t,r,n,o){super(t,r,n,o),this.symbol=e}getParser(){return Ky(this,this.symbol)}toCodecStringTree(){let e=globalThis.Symbol.keyFor(this.symbol);return ft(this,[new Tt(e===void 0?ll:new Kn(globalThis.String(this.symbol)),yL.transformation)])}getExpected(){return globalThis.String(this.symbol)}},Kn=class extends Pt{_tag=\"Literal\";literal;constructor(e,t,r,n,o){if(super(t,r,n,o),typeof e==\"number\"&&!globalThis.Number.isFinite(e))throw new Error(`A numeric literal must be finite, got ${K(e)}`);this.literal=e}getParser(){return Ky(this,this.literal)}matchPart(e,t){return e===globalThis.String(this.literal)?this.literal:void 0}toCodecJson(){return typeof this.literal==\"bigint\"?FD(this):this}toCodecStringTree(){return typeof this.literal==\"string\"?this:FD(this)}getExpected(){return typeof this.literal==\"string\"?JSON.stringify(this.literal):globalThis.String(this.literal)}};function FD(e){let t=globalThis.String(e.literal);return ft(e,[new Tt(new Kn(t),new Ke(le(()=>e.literal),le(()=>t)))])}var M7=class extends Pt{_tag=\"String\";getParser(){return Vo(this,Wr)}matchPart(e,t){let r=this.checks;return r&&!t.disableChecks&&Zo(r,e,void 0,this,t)?void 0:e}getExpected(){return\"string\"}},xn=new M7,F7=class extends Pt{_tag=\"Number\";getParser(){return Vo(this,lp)}matchKey(e,t){return this._match(Q7,e,t)}matchPart(e,t){return this._match(gC,e,t)}_match(e,t,r){if(!e.test(t))return;let n=globalThis.Number(t);return r.disableChecks||!this.checks?n:Zo(this.checks,n,void 0,this,r)?void 0:n}toCodecJson(){return this.checks&&(mC(this.checks,\"effect/schema/isFinite\")||mC(this.checks,\"effect/schema/isInt\"))?this:ft(this,[W7])}toCodecStringTree(){return this.toCodecJson()===this?ft(this,[X7]):ft(this,[eY])}getExpected(){return\"number\"}};function mC(e,t){return e.some(r=>r.annotations?.representation?.id===t||r._tag===\"FilterGroup\"&&mC(r.checks,t))}var wC=new F7,N7=class extends Pt{_tag=\"Boolean\";getParser(){return Vo(this,Th)}getExpected(){return\"boolean\"}},VD=new N7,U7=class extends Pt{_tag=\"Symbol\";getParser(){return Vo(this,Nb)}matchKey(e,t){return t.disableChecks||!this.checks?e:Zo(this.checks,e,void 0,this,t)?void 0:e}toCodecStringTree(){return ft(this,[yL])}getExpected(){return\"symbol\"}},ZD=new U7,D7=class extends Pt{_tag=\"BigInt\";getParser(){return Vo(this,bO)}matchPart(e,t){if(!yC.test(e))return;let r=globalThis.BigInt(e);return t.disableChecks||!this.checks?r:Zo(this.checks,r,void 0,this,t)?void 0:r}toCodecStringTree(){return ft(this,[rY])}getExpected(){return\"bigint\"}},YD=new D7,jn=class extends Pt{_tag=\"Arrays\";isMutable;elements;rest;encodingChecks;constructor(e,t,r,n,o,s,a,i){super(n,o,s,a),this.isMutable=e,this.elements=t,this.rest=r,this.encodingChecks=i;let c=!1;for(let u=0;u<t.length;u++)if(nr(t[u]))c=!0;else if(c)throw new Error(\"A required element cannot follow an optional element. ts(1257)\");if(c&&r.length>1)throw new Error(\"A required element cannot follow an optional element. ts(1257)\");for(let u=1;u<r.length;u++)if(nr(r[u]))throw new Error(\"An optional element cannot follow a rest element. ts(1266)\")}getParser(e,t=e){let r=this,n,o,s=r.elements.length,a=Math.max(0,r.rest.length-1);function i(f,p){return p<s?n[p]:p>=f?o[p-f+1]:o[0]}let c=f=>{let{input:p,len:d,options:m}=f;if(r.rest.length===0&&d>s)for(let h=s;h<d;h++){let y=new tC(r,p[h],m),S=new Ot([h],y);if(m.errors===\"all\")f.issues?f.issues.push(S):f.issues=[S];else return F(new Ht(r,[S],p,m))}return f.issues?F(new Ht(r,f.issues,p,m)):Er(f.output)},u=(f,p)=>{let d=f.length,m={ast:r,getParser:i,input:f,len:d,tailThreshold:Math.max(s,d-a),output:[],issues:void 0,options:p},h=r.rest.length===0?s:Math.max(d,s+a),y=p.concurrency===void 0?1:ad(p.concurrency),S=y===1?$7(m,f,0,h):K7(m,f,{concurrency:y,end:h});if(!S)return c(m);if(Ve(S))return Ct(S,()=>c(m));let b=!0;return L(()=>b?(b=!1,C(S,()=>c(m))):u(f,p))};return(f,p)=>{if(f===Ae)return dn;try{return Array.isArray(f)?(n||(n=r.elements.map(d=>({ast:d,parser:t(d)})),o=r.rest.map(d=>({ast:d,parser:t(d)}))),u(f,p)):F(new _t(r,f,p))}catch(d){return yr(d)}}}_rebuild(e,t,r){let n=lu(this.elements,e),o=lu(this.rest,e);return n===this.elements&&o===this.rest&&t===this.checks&&r===this.encodingChecks?this:new jn(this.isMutable,n,o,this.annotations,t,void 0,this.context,r)}recur(e){return this._rebuild(e,this.checks,this.encodingChecks)}flip(e){return this._rebuild(e,this.encodingChecks,this.checks)}getExpected(){return\"array\"}};function L7(e,t,r,n){if(r._tag===\"Failure\")return Ry(e,e.ast,n,r);let o=r===ot?t:r[xe];if(o!==Ae)e.output[n]=o;else{let s=e.getParser(e.tailThreshold,n);if(nr(s.ast))return;let a=new Ot([n],new Ni(s.ast.context?.annotations));if(e.options.errors===\"all\")e.issues?e.issues.push(a):e.issues=[a];else return la(new Ht(e.ast,[a],e.input,e.options))}}var QD={onItem(e,t,r){let n=r<e.len?t:Ae;return e.getParser(e.tailThreshold,r).parser(n,e.options)},step:L7},$7=Yx()(QD),K7=Qx()(QD),Ry=(e,t,r,n)=>{if(n.cause.reasons.length===0)return n;let o=dm(n.cause);if(o===void 0)return Fn(fa(n.cause,a=>new Ht(t,[new Ot([r],a)],e.input,e.options)));let s=new Ot([r],o);if(e.options.errors===\"all\")e.issues?e.issues.push(s):e.issues=[s];else return la(new Ht(t,[s],e.input,e.options))},Sm=\"[+-]?(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)(?:[Ee][+-]?\\\\d+)?\";function Ms(e,t,r=Ns){let n,o;function s(a){switch(a._tag){case\"String\":case\"TemplateLiteral\":return(n??=Object.keys(e)).filter(i=>a.matchPart(i,r)!==void 0);case\"Number\":return(n??=Object.keys(e)).filter(i=>a.matchKey(i,r)!==void 0);case\"Symbol\":return(o??=Object.getOwnPropertySymbols(e)).filter(i=>Object.prototype.propertyIsEnumerable.call(e,i)&&a.matchKey(i,r)!==void 0);case\"Union\":return[...new Set(a.types.flatMap(s))];default:return[]}}return s(DC(gn(t)))}var AC=class{name;type;constructor(e,t){this.name=e,this.type=t}};function XD(e){switch(e._tag){case\"String\":case\"Number\":case\"Symbol\":case\"TemplateLiteral\":return!0;case\"Union\":return e.types.every(XD);default:return!1}}function eL(e){let t=pu(e);switch(t._tag){case\"String\":case\"Number\":case\"Symbol\":case\"TemplateLiteral\":return!0;case\"Union\":return t.types.every(eL);default:return!1}}function B7(e){return XD(e)&&eL(e)}var CC=class{parameter;type;constructor(e,t){if(!B7(e))throw new Error(`Invalid index signature parameter ${e._tag}`);if(this.parameter=e,this.type=t,nr(t)||t.encoding!==void 0&&nr(gn(t)))throw new Error(\"Cannot use `Schema.optionalKey` or `Schema.optional` with index signatures. Index signatures already allow keys to be absent; use `Schema.UndefinedOr` to allow `undefined` values.\")}},bm=class extends Pt{_tag=\"Objects\";propertySignatures;indexSignatures;encodingChecks;constructor(e,t,r,n,o,s,a){super(r,n,o,s),this.propertySignatures=e,this.indexSignatures=t,this.encodingChecks=a}getParser(e,t=e){let r=this,n=r.propertySignatures.length,o=r.indexSignatures.length;if(!n&&!o)return Vo(r,kh);let s,a,i=()=>(s||(s=r.propertySignatures.map(p=>({parser:t(p.type),name:p.name,type:p.type})),a=o?r.indexSignatures.map(p=>({is:p,parserKey:e(DC(p.parameter)),parserValue:t(p.type)})):void 0),s),c=()=>{let p=new Set(r.propertySignatures.map(S=>typeof S.name==\"number\"?globalThis.String(S.name):S.name)),d=(S,b,x,w,I)=>{if(I._tag===\"Failure\")return Ry(S,r,b,I)??Bt;let T=I===ot?w:I[xe];if(x!==Ae&&T!==Ae){if(n&&(p.has(b)||p.has(typeof x==\"number\"?globalThis.String(x):x)))return Bt;B(S.out,x,T)}return Bt},m=(S,b,x,w)=>{if(!w){let G=x.parserKey(b,S.options);if(!Ve(G))return C(so(G),he=>m(S,b,x,he));w=G}if(w._tag===\"Failure\")return Ry(S,r,b,w)??Bt;let I=w===ot?b:w[xe],T=S.input[b],P=x.parserValue(T,S.options);return Ve(P)?d(S,b,I,T,P):C(so(P),G=>d(S,b,I,T,G))},h=(S,b,x)=>{let w=S.input[b],I=x.parserValue(w,S.options);return Ve(I)?d(S,b,b,w,I):C(so(I),T=>d(S,b,b,w,T))},y=o?Qx()({onItem:(S,[b,x])=>x.is.parameter===xn?h(S,b,x):m(S,b,x),step:(S,b,x)=>x._tag===\"Failure\"?x:void 0}):void 0;return ew(function*(S,b){if(S===Ae)return Ae;if(!(typeof S==\"object\"&&S!==null&&!Array.isArray(S)))return yield*F(new _t(r,S,b));i();let x=S,w={},I={ast:r,input:x,out:w,issues:void 0,options:b},T=b.errors===\"all\",P=b.onExcessProperty===\"error\",G=b.concurrency===void 0?1:ad(b.concurrency),he=o&&P?r.indexSignatures.map(me=>Ms(x,me.parameter,b)):void 0;if(P){let me=he?new Set(p):p;if(he)for(let R of he)for(let N of R)me.add(N);let E=Reflect.ownKeys(x);for(let R=0;R<E.length;R++){let N=E[R];if(!me.has(N)&&Object.prototype.propertyIsEnumerable.call(x,N)){let O=new tC(r,x[N],b),M=new Ot([N],O);if(T){I.issues?I.issues.push(M):I.issues=[M];continue}else return yield*F(new Ht(r,[M],S,b))}}}if(n){let me=G===1?ND(I,s):j7(I,s,{concurrency:G});me&&(yield*me)}if(o&&G===1)for(let me=0;me<o;me++){let E=a[me],R=E.is.parameter===xn?h:m,N=he?.[me]??(E.is.parameter===xn?Object.keys(x):Ms(x,E.is.parameter,b));for(let O=0;O<N.length;O++){let M=R(I,N[O],E);if(!Ve(M))yield*M;else if(M._tag===\"Failure\")return yield*M}}else if(y){let me=Qt();for(let R=0;R<o;R++){let N=a[R],O=he?.[R]??(N.is.parameter===xn?Object.keys(x):Ms(x,N.is.parameter,b));for(let M=0;M<O.length;M++)me.push([O[M],N])}let E=y(I,me,{concurrency:G});E&&(yield*E)}return I.issues?yield*F(new Ht(r,I.issues,S,b)):w})};if(o)return c();let u,f=(p,d,m)=>{let h=s[d];return C(so(m),y=>{let S={...p,out:{...p.out}},b=hC(S,h,y);if(b)return b;let x=()=>Er(S.out),w=ND(S,s.slice(d+1));return w?Ct(w,x):x()})};return(p,d)=>{if(p===Ae)return dn;if(d.errors===\"all\"||d.onExcessProperty!==void 0||d.concurrency!==void 0&&ad(d.concurrency)!==1)return(u??=c())(p,d);if(!(typeof p==\"object\"&&p!==null&&!Array.isArray(p)))return F(new _t(r,p,d));let m=i(),h=p,y={},S={ast:r,input:h,out:y,issues:void 0,options:d};try{for(let b=0;b<m.length;b++){let x=m[b],w=x.name,I=sl(h,w),T=I?h[w]:Ae,P=x.parser(T,d);if(!Ve(P))return f(S,b,P);if(P===ot){I&&B(y,w,T);continue}let G=hC(S,x,P);if(G)return G}}catch(b){return yr(b)}return Er(y)}}_rebuild(e,t,r,n){let o=lu(this.propertySignatures,a=>{let i=e(a.type);return i===a.type?a:new AC(a.name,i)}),s=lu(this.indexSignatures,a=>{let i=t(a.parameter),c=e(a.type);return i===a.parameter&&c===a.type?a:new CC(i,c)});return o===this.propertySignatures&&s===this.indexSignatures&&r===this.checks&&n===this.encodingChecks?this:new bm(o,s,this.annotations,r,void 0,this.context,n)}flip(e){return this._rebuild(e,e,this.encodingChecks,this.checks)}recur(e,t=e){return this._rebuild(e,t,this.checks,this.encodingChecks)}getExpected(){return this.propertySignatures.length===0&&this.indexSignatures.length===0?\"object | array\":\"object\"}};function hC(e,t,r){if(r._tag===\"Failure\")return Ry(e,e.ast,t.name,r);if(r===ot)return;let n=r[xe];if(n!==Ae){B(e.out,t.name,n);return}if(delete e.out[t.name],!nr(t.type)){let o=new Ot([t.name],new Ni(t.type.context?.annotations));if(e.options.errors===\"all\"){e.issues?e.issues.push(o):e.issues=[o];return}else return la(new Ht(e.ast,[o],e.input,e.options))}}var tL={onItem(e,t){if(!sl(e.input,t.name))return t.parser(Ae,e.options);let r=e.input[t.name];return B(e.out,t.name,r),t.parser(r,e.options)},step:hC},ND=Yx()(tL),j7=Qx()(tL);function TC(e,t){return e?t?[...e,...t]:e:t}function Ny(e,t,r){return new bm(Reflect.ownKeys(e).map(n=>new AC(n,e[n].ast)),[],r,t)}function Em(e){return e.ast}function vC(e,t=void 0){return new jn(!1,e.map(r=>r.ast),[],void 0,t)}function Uy(e,t,r){return new Qr(e.map(Em),t,void 0,r)}function rL(e,t){if(e.encoding||t.some(s=>s.encoding))throw new Error(\"StructWithRest does not support encodings\");let r=e.propertySignatures,n=e.indexSignatures,o=e.checks;for(let s of t){for(let a of s.propertySignatures)if(r.some(i=>i.name===a.name))throw new Error(`Duplicate identifier: ${JSON.stringify(a.name)}. ts(2300)`);r=r.concat(s.propertySignatures),n=n.concat(s.indexSignatures),o=TC(o,s.checks)}return new bm(r,n,void 0,o)}function nL(e,t){if(e.encoding)throw new Error(\"TupleWithRest does not support encodings\");return new jn(e.isMutable,e.elements,t,void 0,e.checks)}function oL(e){if(e.encoding)throw new Error(\"mutable does not support encodings\");return new jn(!0,e.elements,e.rest,e.annotations,e.checks,void 0,e.context,e.encodingChecks)}var kC=qs(e=>{for(;;){if(gm(e))return Jo;let t=e.encoding;if(!t)return e.recur?.(kC,D)??e;if(t.some(r=>r.transformation._tag===\"Middleware\"&&r.transformation.decode!==D))return Jo;e=t[t.length-1].to}});function sL(e){switch(e._tag){case\"Null\":return[\"null\"];case\"Undefined\":return[\"undefined\"];case\"String\":case\"TemplateLiteral\":return[\"string\"];case\"Number\":return[\"number\"];case\"Boolean\":return[\"boolean\"];case\"Symbol\":case\"UniqueSymbol\":return[\"symbol\"];case\"BigInt\":return[\"bigint\"];case\"Arrays\":return[\"array\"];case\"ObjectKeyword\":return[\"object\",\"array\",\"function\"];case\"Objects\":return e.propertySignatures.length||e.indexSignatures.length?[\"object\"]:[\"string\",\"number\",\"boolean\",\"symbol\",\"bigint\",\"object\",\"array\",\"function\"];case\"Enum\":return Array.from(new Set(e.enums.map(([,t])=>typeof t)));case\"Literal\":return[typeof e.literal];case\"Union\":return Array.from(new Set(e.types.flatMap(sL)));default:return[\"null\",\"undefined\",\"string\",\"number\",\"boolean\",\"symbol\",\"bigint\",\"object\",\"array\",\"function\"]}}function il(e){switch(e._tag){default:return[];case\"Declaration\":{let t=e.annotations?.[sm];return Array.isArray(t)?t:[]}case\"Objects\":return e.propertySignatures.flatMap(t=>{let r=t.type;if(!nr(r)){if(al(r))return[{key:t.name,literal:r.literal}];if(pC(r))return[{key:t.name,literal:r.symbol}]}return[]});case\"Arrays\":return e.elements.flatMap((t,r)=>{if(!nr(t)){if(al(t))return[{key:r,literal:t.literal}];if(pC(t))return[{key:r,literal:t.symbol}]}return[]});case\"Union\":{if(e.types.length===0)return[];let t=e.types.map(r=>il(kC(r)));return t[0].filter(r=>t.every(n=>n.some(o=>o.key===r.key&&o.literal===r.literal)))}case\"Suspend\":return il(e.thunk())}}var UD=new WeakMap,_y=Object.freeze([]),DD=e=>e===null?\"null\":Array.isArray(e)?\"array\":typeof e,sl=(e,t)=>t===\"__proto__\"?Object.hasOwn(e,t):t in e;function Im(e){let t=UD.get(e);if(t)return t;let r,n=0,o,s,a=!0,i=[];for(let f=0;f<e.length;f++){let p=e[f],d=kC(p);if(C7(d))continue;if(al(d)||pC(d)){s??=new Map;let h=al(d)?d.literal:d.symbol;i[f]=h;let y=s.get(h);y||s.set(h,y=[]),y.push(f)}else a=!1;let m=il(d);if(m.length){r??=new Map,n++;for(let{key:h,literal:y}of m){let S=r.get(h);S||r.set(h,S=[new Map,new Set]),S[1].add(f);let b=S[0].get(y);b||S[0].set(y,b=new Set),b.add(f)}}else{o??={};let h=sL(d);for(let y of h)(o[y]??=[]).push(f)}}let c={},u=f=>c[f]??=Object.freeze(o?.[f]??_y);if(a&&s)s.forEach(Object.freeze),t=f=>s.get(f)??_y;else if(r?.size===1&&!o){let[f,[p]]=r.entries().next().value,d=new Map;for(let[h,y]of p)d.set(h,Object.freeze(Array.from(y)));let m=Object.freeze(e.map((h,y)=>y));t=(h,y)=>{if(pp(h)){let S=sl(h,f)?h[f]:void 0;if(S!==void 0)return d.get(S)??_y;if(y)return m}return _y}}else if(r){let f;for(let p of r)(!f||p[1][0].size>f[1][0].size)&&p[1][1].size===n&&(f=p);t=(p,d)=>{let m=DD(p);if(!pp(p))return u(m);let h=new Set(o?.[m]),y;if(f){let[S,[b]]=f,x=sl(p,S),w=x?p[S]:void 0;if(x&&(!d||w!==void 0)){let I=b.get(w);if(!I)return u(m);for(let T of I)h.add(T);y=S}}if(y===void 0)for(let[S,[b,x]]of r){let w=sl(p,S),I=w?p[S]:void 0;if(w&&(!d||I!==void 0)){let T=b.get(I);if(T)for(let P of T)h.add(P)}else if(d)for(let T of x)h.add(T)}for(let[S,[b,x]]of r){if(S===y)continue;let w=sl(p,S),I=w?p[S]:void 0;if(w&&(!d||I!==void 0)){let T=b.get(I);for(let P of h)x.has(P)&&!T?.has(P)&&h.delete(P)}}return Array.from(h).sort((S,b)=>S-b)}}else t=f=>{let p=u(DD(f));return s?p.filter(d=>i[d]===void 0||i[d]===f):p};return UD.set(e,t),t}var Qr=class extends Pt{_tag=\"Union\";types;options;encodingChecks;constructor(e,t,r,n,o,s,a){super(r,n,o,s),this.types=e,this.options=t,this.encodingChecks=a}getParser(e,t){let r=this,n=t!==void 0,o=[],s=i=>o[i]??=e(r.types[i]),a;return(i,c)=>{if(i===Ae)return dn;let u=(a??=Im(r.types))(i,n);if(u.length===0)return F(new pm(r,[],i,c));if(u.length===1){let f=s(u[0])(i,c);return f._tag===\"Success\"?f:Ve(f)?aL(r,f.cause,i,c):H7(r,f,i,c)}return iL(r,s,u,i,c)}}_rebuild(e,t,r){let n=lu(this.types,e);return n===this.types&&t===this.checks&&r===this.encodingChecks?this:new Qr(n,this.options,this.annotations,t,void 0,this.context,r)}recur(e){return this._rebuild(e,this.checks,this.encodingChecks)}flip(e){return this._rebuild(e,this.encodingChecks,this.checks)}matchPart(e,t){for(let r of this.types){let n=r.matchPart(e,t);if(n!==void 0)return n}}getExpected(e){let t=this.annotations?.expected;if(typeof t==\"string\")return t;if(this.types.length===0)return\"never\";let r=this.types.map(n=>{let o=gn(n);switch(o._tag){case\"Arrays\":{let s=o.elements.filter(al);if(s.length>0)return`${$D(o.isMutable)}[ ${s.map(a=>e(a)+KD(a.context?.isOptional)).join(\", \")}, ... ]`;break}case\"Objects\":{let s=o.propertySignatures.filter(a=>al(a.type));if(s.length>0)return`{ ${s.map(a=>`${$D(a.type.context?.isMutable)}${us(a.name)}${KD(a.type.context?.isOptional)}: ${e(a.type)}`).join(\", \")}, ... }`;break}}return e(o)});return Array.from(new Set(r)).join(\" | \")}};function aL(e,t,r,n){let o=dm(t);return o?la(new pm(e,[o],r,n)):Fn(t)}function H7(e,t,r,n){return nt(t,o=>aL(e,o,r,n))}function iL(e,t,r,n,o){let s={ast:e,parser:t,input:n,out:void 0,successes:e.options?.mode===\"oneOf\"?[]:void 0,issues:void 0,options:o},a=z7(s,r);if(!a)return s.out?s.out:F(new pm(e,s.issues??[],n,o));if(Ve(a))return LD(a,s);let i=!0;return L(()=>i?(i=!1,LD(a,s)):iL(e,t,r,n,o))}function LD(e,t){return Ct(e,r=>t.out===ot?g(t.input):t.out?t.out:F(new pm(t.ast,t.issues??[],t.input,t.options)))}var z7=Yx()({onItem(e,t){return e.parser(t)(e.input,e.options)},step(e,t,r){if(r._tag===\"Failure\"){let n=dm(r.cause);if(n===void 0)return r;e.issues?e.issues.push(n):e.issues=[n]}else{if(e.out&&e.successes)return e.successes.push(e.ast.types[t]),la(new v2(e.ast,e.successes,e.input,e.options));if(e.out=r,e.successes)e.successes.push(e.ast.types[t]);else return Bt}}}),cL=new Qr([new Kn(\"Infinity\"),new Kn(\"-Infinity\"),new Kn(\"NaN\")]);function $D(e){return e?\"\":\"readonly \"}function KD(e){return e?\"?\":\"\"}var OC=class extends Pt{_tag=\"Suspend\";thunk;constructor(e,t,r,n,o){if(r)throw new Error(\"Cannot add checks to Suspend\");super(t,void 0,n,o);let s;this.thunk=()=>s??=e()}getParser(e){let t;return(r,n)=>(t??=e(this.thunk()))(r,n)}recur(e){return new OC(()=>e(this.thunk()),this.annotations,void 0,void 0,this.context)}getExpected(e){return e(this.thunk())}},Py=class extends ja{_tag=\"Filter\";run;annotations;aborted;constructor(e,t=void 0,r=!1){super(),this.run=e,this.annotations=t,this.aborted=r}annotate(e){return new Py(this.run,{...this.annotations,...e},this.aborted)}abort(){return new Py(this.run,this.annotations,!0)}and(e,t){return new fu([this,e],t)}},fu=class extends ja{_tag=\"FilterGroup\";checks;annotations;constructor(e,t=void 0){super(),this.checks=e,this.annotations=t}annotate(e){return new fu(this.checks,{...this.annotations,...e})}and(e,t){return new fu([this,e],t)}};function Dy(e,t,r=!1){return new Py((n,o,s)=>O2(o,e(n,o,s),n,s),t,r)}function Ly(e,t){return new Py((r,n,o)=>e(r)?void 0:new fe(void 0,r,o),t,!0)}function _C(e){return Dy(t=>globalThis.Number.isFinite(t),{expected:\"a finite number\",representation:{id:\"effect/schema/isFinite\",payload:null},toJsonSchema:()=>({type:\"number\"}),toCode:()=>({runtime:\"Schema.isFinite()\"}),arbitraryConstraint:{number:\"finite\"},...e})}var RC=Us(wC,[_C()]),W7=new Tt(new Qr([RC,cL]),new Ke(wy(),le(e=>globalThis.Number.isFinite(e)?e:globalThis.String(e))));function wm(e,t){let r=new globalThis.RegExp(e),n={source:r.source,flags:r.flags};return Dy(o=>(r.lastIndex=0,r.test(o)),{expected:`a string matching the RegExp ${n.source}`,representation:{id:\"effect/schema/isPattern\",payload:n},toJsonSchema:()=>[{},!0],arbitraryConstraint:{patterns:[n]},...t})}var xC=new WeakMap;function Am(e,t){let r=Object.assign(Object.create(Object.getPrototypeOf(e)),e,t);return Reflect.ownKeys(t).every(n=>n===\"context\"||n===\"encoding\")&&xC.set(r,Di(e)),r}function Di(e){let t=xC.get(e);if(t!==void 0)return t;if(e.encoding===void 0)return e;let r=Object.assign(Object.create(Object.getPrototypeOf(e)),e,{encoding:void 0});return xC.set(e,r),r}function ft(e,t){return e.encoding===t?e:Am(e,{encoding:t})}function Hn(e,t){if(e.context===t)return e;let r=Di(e);return r.context===t&&r.encoding===e.encoding?r:Am(e,{context:t})}function pu(e){return e.encoding?pu(e.encoding[e.encoding.length-1].to):e}function Go(e,t){if(e.checks){let r=e.checks[e.checks.length-1];return Cm(e,sx(e.checks.slice(0,-1),r.annotate(t)))}return Am(e,{annotations:{...e.annotations,...t}})}function Cm(e,t){if(e._tag===\"Suspend\"&&t)throw new Error(\"Cannot add checks to Suspend\");return e.checks===t?e:Am(e,{checks:t})}function Us(e,t){return Cm(e,TC(e.checks,t))}function pl(e,t){let r=t(e.to);return r===e.to?e:new Tt(r,e.transformation)}function PC(e,t){let r=e,n=r[r.length-1],o=pl(n,t);return o===n?e:sx(e.slice(0,e.length-1),o)}function MC(e){return t=>t.encoding?ft(t,PC(t.encoding,e)):t}function FC(e,t){return MC(r=>Hn(r,t))(e)}function dl(e){function t(r){return r.encoding?ft(r,PC(r.encoding,t)):e(r)}return on(t)}function du(e,t){function r(n){if(n.encoding){let o=n.encoding[n.encoding.length-1];return t?.stopAt?.(o)?n:ft(n,PC(n.encoding,r))}return e(n)}return qs(r)}function uL(e,t){return NC(e,t,Mt(e))}function fL(e,t){return NC(gn(e),t,e)}function NC(e,t,r){let n=new Tt(e,t);return ft(r,r.encoding?[...r.encoding,n]:[n])}function lu(e,t){let r;for(let n=0;n<e.length;n++){let o=e[n],s=t(o);if(r)r[n]=s;else if(s!==o){r=new Array(e.length);for(let a=0;a<n;a++)r[a]=e[a];r[n]=s}}return r??e}function Tm(e,t){let r=e.context?new Fs(e.context.isOptional,e.context.isMutable,e.context.constructorDefault,{...e.context.annotations,...t}):new Fs(!1,!1,void 0,t);return Hn(e,r)}var mu=qs(e=>{let t=e.context?e.context.isOptional===!1?new Fs(!0,e.context.isMutable,e.context.constructorDefault,e.context.annotations):e.context:new Fs(!0,!1);return q7(Hn(e,t))}),q7=MC(mu),lL=on(e=>mu(new Qr([e,EC]))),UC=qs(e=>{let t=e.context?e.context.isMutable===!1?new Fs(e.context.isOptional,!0,e.context.constructorDefault,e.context.annotations):e.context:new Fs(!1,!0);return J7(Hn(e,t))}),J7=MC(UC);function pL(e,t){let r=e.context?new Fs(e.context.isOptional,e.context.isMutable,t,e.context.annotations):new Fs(!1,!1,t);return Hn(e,r)}function Oa(e,t,r){return NC(e,r,t)}function G7(e){let t=[],r=[];function n(s){t.includes(s)||t.push(s)}function o(s){switch(s._tag){case\"Literal\":vh(s.literal)&&n(s.literal);return;case\"UniqueSymbol\":n(s.symbol);return;case\"Enum\":for(let[,a]of s.enums)n(a);return;case\"Never\":return;case\"Union\":for(let a=0;a<s.types.length;a++)o(s.types[a]);return;default:r.push(s)}}return o(e),{literals:t,parameters:r}}function $y(e,t){let{literals:r,parameters:n}=G7(e);return new bm(r.map(o=>new AC(o,t)),n.map(o=>new CC(o,t)))}function nr(e){return e.context?.isOptional??!1}function dL(e){return e.context?.isMutable??!1}function mL(e){return e.annotations?.[pn]===!0||e._tag===\"FilterGroup\"&&e.checks.every(mL)}function V7(e){function t(n){return mL(n)?[n]:n._tag===\"FilterGroup\"?n.checks.flatMap(t):[]}let r=e.flatMap(t);return Mr(r)?r:void 0}function Z7(e){let t=!0;function r(n){return t=t&&!n.encoding&&!gm(n),t&&\"recur\"in n&&n.recur(r),n}return\"recur\"in e&&e.recur(r),t}var Mt=qs(e=>{let t=Di(e);if(t!==e){let n=Mt(t);return n===t&&e.encoding===void 0?e:Hn(n,e.context)}let r=\"recur\"in e?e.recur(Mt):e;if(\"encodingChecks\"in r&&r.encodingChecks){let n=Z7(e)?r.encodingChecks:My(r)||bC(r)||ul(r)&&r.typeParameters.length>0?V7(r.encodingChecks):void 0;return Am(r,{encodingChecks:void 0,checks:TC(r.checks,n)})}return r}),gn=qs(e=>Mt(Bn(e)));function Y7(e,t){let r=t,n=r.length,o=r[n-1],s=[new Tt(Bn(ft(e,void 0)),r[0].transformation.flip())];for(let i=1;i<n;i++)s.unshift(new Tt(Bn(r[i-1].to),r[i].transformation.flip()));let a=Bn(o.to);return a.encoding?ft(a,[...a.encoding,...s]):ft(a,s)}var Bn=on(e=>{if(e.encoding)return Y7(e,e.encoding);let t=Di(e);if(t!==e){let r=Bn(t);return r===t?e:Hn(r,e.context)}return\"flip\"in e?e.flip(Bn):\"recur\"in e?e.recur(Bn):e});function Ky(e,t){let r=t===0?ot:Er(t);return(n,o)=>n===Ae?dn:n===t?r:F(new _t(e,n,o))}function Vo(e,t){return(r,n)=>r===Ae?dn:t(r)?ot:F(new _t(e,r,n))}function hL(e,t,r){let n=e.encodedParts,o=e.literals,s=t.length;for(let u=0;u<o.length;u++){let f=o[u];if(f&&!t.includes(f))return}if(e.suffixLengths[0]>s)return;let a=new Array(n.length),i;function c(u,f){if(u===n.length)return f===s;if(i?.has(u*(s+1)+f))return!1;let p=n[u];if(u===n.length-1){let d=t.slice(f);if(p.matchPart(d,r)!==void 0)return a[u]=d,!0}else if(p._tag===\"Literal\"){let d=o[u];if(t.startsWith(d,f)&&c(u+1,f+d.length))return a[u]=d,!0}else{let d=s-e.suffixLengths[u+1],m=o[u+1],h=m===void 0?d:t.lastIndexOf(m,d);for(;h>=f;){let y=t.slice(f,h);if(p.matchPart(y,r)!==void 0&&c(u+1,h))return a[u]=y,!0;if(h===0)break;h=m===void 0?h-1:t.lastIndexOf(m,h-1)}}return i??=new Set,i.add(u*(s+1)+f),!1}return c(0,0)?a:void 0}var DC=du(e=>{switch(e._tag){default:return e;case\"Number\":return e.toCodecStringTree();case\"Union\":return e.recur(DC)}}),By=du(e=>{switch(e._tag){default:return e;case\"Symbol\":case\"UniqueSymbol\":return e.toCodecStringTree();case\"Union\":return e.recur(By)}}),LC=du(e=>{switch(e._tag){default:return e;case\"Number\":case\"Literal\":case\"BigInt\":return e.toCodecStringTree();case\"Union\":return e.recur(LC)}}),xL=\"[\\\\s\\\\S]*?\",gC=new globalThis.RegExp(`^${Sm}$`),Q7=new globalThis.RegExp(`^(?:${Sm}|Infinity|-Infinity|NaN)$`);function $C(e){return wm(gC,{expected:\"a string representing a finite number\",representation:{id:\"effect/schema/isStringFinite\",payload:null},toJsonSchema:()=>({pattern:gC.source}),...e})}var gL=Us(xn,[$C()]),X7=new Tt(gL,ol),eY=new Tt(new Qr([gL,cL]),ol),tY=\"-?\\\\d+\",yC=new globalThis.RegExp(`^${tY}$`);function KC(e){return wm(yC,{expected:\"a string representing a bigint\",representation:{id:\"effect/schema/isStringBigInt\",payload:null},toJsonSchema:()=>({pattern:yC.source}),...e})}var BC=Us(xn,[KC({expected:\"a string representing a bigint\"})]),rY=new Tt(BC,Oy),nY=\"Symbol\\\\(([\\\\s\\\\S]*)\\\\)\",SC=new globalThis.RegExp(`^${nY}$`),oY=Us(xn,[jC()]),yL=new Tt(oY,new Ke(le(e=>globalThis.Symbol.for(SC.exec(e)[1])),Rt((e,t)=>globalThis.Symbol.keyFor(e)!==void 0?g(globalThis.String(e)):F(new iu({message:\"cannot serialize to string, Symbol is not registered\"},e,t)))));function jC(e){return wm(SC,{expected:\"a string representing a symbol\",representation:{id:\"effect/schema/isStringSymbol\",payload:null},toJsonSchema:()=>({pattern:SC.source}),...e})}function Zo(e,t,r,n,o){for(let s=0;s<e.length;s++){let a=e[s];if(a._tag===\"FilterGroup\"){if(r=Zo(a.checks,t,r,n,o),r&&(o.errors!==\"all\"||r[r.length-1].filter.aborted))return r}else{let i=a.run(t,n,o);if(i){let c=new C2(a,i,t,o);if(r?r.push(c):r=[c],o.errors!==\"all\"||a.aborted)return r}}}return r}function SL(e,t){let r=Zo(e,t,void 0,Jo,{errors:\"all\"});if(r){let n=new Ht(Jo,r);return q(n)}return j(t)}function jy(e){if(!ul(e))return;let t=e.annotations?.[Sy];return qr(t)?t(e.typeParameters):void 0}function sY(e){return e===null||typeof e==\"string\"||typeof e==\"boolean\"||typeof e==\"number\"&&globalThis.Number.isFinite(e)}function aY(e){return e===void 0||typeof e==\"string\"}function bL(e,t){let r=new WeakMap,n=[];e:for(;;){if(typeof e!=\"object\"||e===null){if(!t(e))return!1}else{let o=e,s=r.get(o);if(s===!1)return!1;if(s===void 0){let a=Array.isArray(o);if(!a){let i=Object.getPrototypeOf(o);if(i!==null&&i!==Object.prototype&&Object.getPrototypeOf(i)!==null)return!1}r.set(o,!1),n.push({value:o,keys:a?o.length:Object.keys(o),index:0})}}for(;n.length>0;){let o=n[n.length-1],s=o.keys;if(typeof s==\"number\"){if(o.index<s){e=o.value[o.index++];continue e}}else if(o.index<s.length){e=o.value[s[o.index++]];continue e}r.set(o.value,!0),n.pop()}return!0}}function ml(e){return bL(e,sY)}var cl=new fl([],()=>(e,t,r)=>ml(e)?ot:F(new _t(t,e,r)),{representation:{id:\"effect/schema/Json\",payload:null},expected:\"JSON value\",toCodecJson:()=>{},toCodecStringTree:()=>zC}),EL=Go(cl,{representation:{id:\"effect/schema/MutableJson\",payload:null}}),HC=new Tt(cl,nl()),IL=new Tt(new Qr([new jn(!1,[],[cl]),new bm([],[new CC(xn,cl)])]),nl());function iY(e){return bL(e,aY)}var cY=new fl([],()=>(e,t,r)=>iY(e)?ot:F(new _t(t,e,r)),{expected:\"StringTree\",toCodecStringTree:()=>{}}),zC=new Tt(cY,nl());var Hy=(e,t,r)=>e===ot?r(t):Ct(e,r);function AL(e){let t=uY(e);return(r,n,o)=>{try{return t(r,n,o)}catch(s){return yr(s)}}}function uY(e){if(e._tag===\"Middleware\")return(r,n,o)=>{let s=r===ot?e.decode(Er(im(n)),o):e.decode(fn(r,im),o);return wL(s)};let t=e.decode;switch(t._tag){case\"Passthrough\":return(r,n)=>r===ot?Er(n):r;case\"Transform\":{let r=n=>n===Ae?dn:Er(t.transform(n));return(n,o)=>Hy(n,o,r)}case\"TransformOptional\":{let r=n=>QA(t.transform(im(n)));return(n,o)=>Hy(n,o,r)}case\"TransformEffect\":return(r,n,o)=>Hy(r,n,s=>s===Ae?dn:t.transform(s,o));case\"TransformOptionalEffect\":return(r,n,o)=>Hy(r,n,s=>wL(t.transform(im(s),o)))}}var wL=e=>Ct(e,QA),CL=(e,t,r,n)=>nt(n,o=>da(()=>fa(o,s=>new T2(e,s,t,r))));function fY(e,t){let r=AL(e.link.transformation),n;return(o,s)=>{if(o===Ae)return dn;if(e.isConstructed(o))return ot;let a=(n??=t(e.link.to))(o,s);return r(a,o,s)}}function lY(e,t){let r=e.context.constructorDefault;return(n,o)=>{if(n!==Ae&&n!==void 0)return t(n,o);let s=r;if(Ve(s)&&s._tag===\"Success\"){let a=t(s[xe],o);return a===ot?s:a}return Ct(CL(e,n,o,s),a=>{let i=t(a,o);return i===ot?Er(a):i})}}function WC(e,t){let r=t(e);return e.context?.constructorDefault===void 0?r:lY(e,r)}function vm(e,t,r,n,o){if(e._tag===\"Declaration\")for(let h of e.typeParameters)t(h);let s=r?jy(e):void 0,a=s?fY(s,t):n??e.getParser(t,r),i=e.checks,c=e.encoding,u=c?.map(h=>AL(h.transformation)),f=e.encodingChecks;if(!c&&!i&&!f)return a;let p,d=(h,y)=>{let S=a(h,y);try{if(f&&!y.disableChecks)if(Ve(S)){if(S._tag===\"Success\"){let b=S===ot?h:S[xe];if(h!==Ae&&b!==Ae){let x=Zo(f,h,void 0,e,y);x&&(S=F(new Ht(e,x,h,y)))}}}else S=C(S,b=>{if(h!==Ae&&b!==Ae){let x=Zo(f,h,void 0,e,y);if(x)return F(new Ht(e,x,h,y))}return g(b)});if(i&&!y.disableChecks)if(Ve(S)){if(S._tag===\"Success\"){let b=S===ot?h:S[xe];if(b===Ae)return S;let x=Zo(i,b,void 0,e,y);x&&(S=F(new Ht(e,x,b,y)))}}else S=C(S,b=>{if(b!==Ae){let x=Zo(i,b,void 0,e,y);if(x)return F(new Ht(e,x,b,y))}return g(b)});return S}catch(b){return yr(b)}},m=o===void 0?d:o(d);return c?(h,y)=>{let S=p??=c.map(w=>t(w.to)),b=h,x=S[S.length-1](h,y);for(let w=c.length-1;w>=0;w--)if(x=u[w](x,b,y),w!==0){let I=S[w-1];x._tag===\"Success\"?(b=x[xe],x=I(b,y)):x=Ct(x,T=>{let P=I(T,y);return P===ot?Er(T):P})}if(x._tag===\"Success\"){let w=x[xe],I=m(w,y);return I===ot?x:I}return x=CL(e,h,y,x),Ct(x,w=>{let I=m(w,y);return I===ot?Er(w):I})}:m}var qy=Symbol(),TL=new WeakMap,vL,hl=!1;var dY=e=>hl?Wy(Xr,e,\"parser\"):Xr(e).parser,kL=e=>hl?Wy(Xr,e,\"makeEffect\"):Xr(e).makeEffect,mY=e=>WC(e,kL),zy=class{ast;constructor(t){this.ast=t}get decodeEffect(){return this.cachedDecodeEffect??=vm(this.ast,dY)}get parser(){return this.decodeEffect}get makeEffect(){return this.cachedMakeEffect??=vm(this.ast,kL,mY)}},qC=class extends zy{compiled;resolve;constructor(t,r,n){super(t),this.compiled=r,this.resolve=n}save(t,r){return Object.defineProperty(this,t,{value:r}),r}operation(t){let r=this.compiled;return typeof r==\"function\"?r(this.ast,this.resolve,t):r?.[t]}get is(){return this.save(\"is\",this.operation(\"is\"))}get decode(){return this.save(\"decode\",this.operation(\"decode\"))}get make(){return this.save(\"make\",this.operation(\"make\"))}get compiledMakeEffect(){return this.save(\"compiledMakeEffect\",this.operation(\"makeEffect\"))}get decodeEffect(){return this.save(\"decodeEffect\",this.operation(\"decodeEffect\")??vm(this.ast,t=>Wy(this.resolve,t,\"parser\")))}get parser(){let t=this.decode;return t===void 0?this.decodeEffect:this.save(\"parser\",hY(t,()=>this.decodeEffect))}get makeEffect(){let t=this.compiledMakeEffect;if(t!==void 0)return this.save(\"makeEffect\",t);let r=n=>Wy(this.resolve,n,\"makeEffect\");return this.save(\"makeEffect\",vm(this.ast,r,n=>WC(n,r)))}};function hY(e,t){let r;return(n,o)=>{if(n!==Ae)try{let s=e(n,o);if(s!==qy)return s===n?ot:Er(s)}catch(s){return yr(s)}return(r??=t())(n,o)}}function Wy(e,t,r){let n=e(t);if(n.compiled===void 0||Object.hasOwn(n,r))return n[r];let o;return(s,a)=>(o??=n[r])(s,a)}function Xr(e){let t=TL.get(e);if(t!==void 0)return t;let r=vL===void 0?new zy(e):new qC(e,vL(e,Xr),Xr);return TL.set(e,r),r}function VC(e){let t=e.ast,r;return(n,o)=>(r??=tT(AY,Mt(t)))(n,o?.disableChecks?o?.parseOptions?{...o.parseOptions,disableChecks:!0}:{disableChecks:!0}:o?.parseOptions)}function Gy(e){let t=VC(e);return(r,n)=>{let o=Ts(t(r,n));return ut(o)?_(o.value):(ho(o.cause,\"Option adapter can only return none for schema issues\"),v())}}function OL(e){return IY(Mt(e.ast))}function km(e){return Om(e.ast)}function gY(e){if(!hl){let o=xl(Yy(e));return s=>{let a=o(s,Ns);return ut(a)?!0:(ho(a.cause,\"Type guard adapter can only return false for schema issues\"),!1)}}let t=Xr(e),r=t.is;if(r!==void 0)return o=>{try{return r(o,Ns)}catch(s){return ho(Rc(s),\"Type guard adapter can only return false for schema issues\"),!1}};let n=t.parser;return o=>{let s=Ts(eT(n(o,Ns),o));return ut(s)?!0:(ho(s.cause,\"Type guard adapter can only return false for schema issues\"),!1)}}function Om(e){let t=Mt(e),r=n=>(r=gY(t),r(n));return n=>r(n)}function _L(e){let t=Yy(e);return(r,n)=>{let o=Ts(t(r,n));if(!ut(o))return ho(o.cause,\"Issue adapter can only return schema issues\")}}function RL(e,t){let r=Mt(e.ast),n=Xr(r).parser(t,Ns),o=Ts(eT(n,t));if(no(o)){let s=ho(o.cause,\"Assertion adapter can only throw schema issues\");throw new Error(\"Schema validation failed\",{cause:s})}}function St(e,t){let r=Yy(e.ast);return t===void 0?r:(n,o)=>r(n,XC(t,o))}var ZC=St;function PL(e,t){return xl(St(e,t))}function YC(e,t){return $L(St(e,t))}var ML=YC;function FL(e,t){return KL(St(e,t))}function yY(e,t){return hl?BL(e.ast,t):rT(St(e,t))}var Vy=yY;function hu(e,t){let r=Yy(Bn(e.ast));return t===void 0?r:(n,o)=>r(n,XC(t,o))}var NL=hu;function UL(e,t){return xl(hu(e,t))}function QC(e,t){return $L(hu(e,t))}var DL=QC;function LL(e,t){return KL(hu(e,t))}function SY(e,t){return hl?BL(Bn(e.ast),t):rT(hu(e,t))}var Zy=SY,XC=(e,t)=>t?{...e,...t}:e,Jy=e=>e===Ae?F(new fe):g(e);function Yy(e){return tT(wY,e)}function eT(e,t){return e===ot?g(t):Ve(e)?e[xe]===Ae?Jy(Ae):e:Ct(e,Jy)}function tT(e,t){let r;return(n,o)=>{let s=(r??=e(t))(n,o??Ns);return s===ot?g(n):Ve(s)?s[xe]===Ae?Jy(Ae):s:Ct(s,Jy)}}function xl(e){return(t,r)=>Ts(e(t,r))}function $L(e){let t=xl(e);return(r,n)=>{let o=t(r,n);return ut(o)?_(o.value):(ho(o.cause,\"Option adapter can only return none for schema issues\"),v())}}function KL(e){let t=xl(e);return(r,n)=>{let o=t(r,n);return ut(o)?j(o.value):q(ho(o.cause,\"Result adapter can only return schema issues\"))}}function BL(e,t){let r;return(n,o)=>(r??=bY(Xr(e),t))(n,o)}function bY(e,t){let r=e.decode,n,o=r===void 0?(s,a=Ns)=>(n??=JC(e))(s,a):(s,a=Ns)=>{if(s===Ae)return(n??=JC(e))(s,a);let i;try{i=r(s,a)}catch(c){throw ho(Rc(c),\"Sync adapter can only throw schema issues\"),c}return i!==qy?i:(n??=JC(e))(s,a)};return t===void 0?o:(s,a)=>o(s,XC(t,a))}function JC(e){return rT(tT(()=>e.decodeEffect,e.ast))}function rT(e){let t=xl(e);return(r,n)=>{let o=t(r,n);if(ut(o))return o.value;let s=ho(o.cause,\"Sync adapter can only throw schema issues\");throw new Error(\"Schema validation failed\",{cause:s})}}function EY(e,t){let r=Ts(e);if(ut(r))return r.value;let n=ho(r.cause,t);throw new Error(\"Schema validation failed\",{cause:n})}var jL=\"Constructor adapter can only throw schema issues\";function HL(e){throw new Error(jL,{cause:Rc(e)})}function IY(e){let t;return(r,n)=>GC(t??=Xr(e),r,n)}function GC(e,t,r){let n=r?.disableChecks?r.parseOptions?{...r.parseOptions,disableChecks:!0}:{disableChecks:!0}:r?.parseOptions??Ns,o=e.make;if(o!==void 0&&t!==Ae){let s;try{s=o(t,n)}catch(a){HL(a)}if(s!==qy&&s!==Ae)return s}return EY(eT(e.makeEffect(t,n),t),jL)}function zL(e,t,r,n){let o=Xr(e),s=jy(e);if(s===void 0||o.make!==void 0||o.compiledMakeEffect!==void 0)return GC(o,t,r);if(s.isConstructed(t))return t;let a=GC((o.resolve??Xr)(s.link.to),t,r);try{return n(a)}catch(i){HL(i)}}var wY=e=>Xr(e).parser,AY=e=>Xr(e).makeEffect;var Qy=\"~effect/Schema/Schema\",WL=Symbol(),CY={[Qy]:Qy,get make(){let e=OL(this);return Object.defineProperty(this,\"make\",{value:e,enumerable:!0}),e},get makeEffect(){let e=VC(this);return Object.defineProperty(this,\"makeEffect\",{value:e,enumerable:!0}),e},get makeOption(){let e=Gy(this);return Object.defineProperty(this,\"makeOption\",{value:e,enumerable:!0}),e},pipe(){return te(this,arguments)},annotate(e){return this.rebuild(Go(this.ast,e))},annotateKey(e){return this.rebuild(Tm(this.ast,e))},check(...e){return this.rebuild(Us(this.ast,e))},rebuild(e){return Wn(e,this[WL])}};function Wn(e,t){function r(){}let n=Object.setPrototypeOf(r,CY);return t&&(Object.hasOwn(t,\"name\")||Object.hasOwn(t,\"length\")||Object.hasOwn(t,\"__proto__\"))?Object.defineProperties(n,Object.getOwnPropertyDescriptors({...t})):Object.assign(n,t),n[WL]=t,n.ast=e,n}function JL(e){switch(e){case\"$defs\":case\"properties\":case\"patternProperties\":case\"dependentSchemas\":return\"map\";case\"allOf\":case\"anyOf\":case\"oneOf\":case\"prefixItems\":return\"array\";case\"not\":case\"additionalProperties\":case\"propertyNames\":case\"unevaluatedProperties\":case\"items\":case\"contains\":case\"unevaluatedItems\":case\"if\":case\"then\":case\"else\":case\"contentSchema\":return\"schema\"}}function nT(e){return e.replace(/~/g,\"~0\").replace(/\\//g,\"~1\")}function _m(e){return e.replace(/~1/g,\"/\").replace(/~0/g,\"~\")}function oT(e){return encodeURI(nT(e)).replace(/#/g,\"%23\")}function sT(e){if(e.length===0||e===\"#\")return\"\";if(!e.startsWith(\"#\"))return;let t=e.slice(1);try{if(encodeURI(t).replace(/%25/g,\"%\").replace(/#/g,\"%23\")!==t)return;let r=decodeURIComponent(t);return r.startsWith(\"/\")&&!/~(?:[^01]|$)/.test(r)?r:void 0}catch{return}}function GL(e){let t=sT(e);return t===void 0?void 0:t.length===0?[]:t.slice(1).split(\"/\").map(_m)}function VL(e){return e.reduce((t,r)=>`${t}/${oT(r)}`,\"#\")}var iT=\"http://json-schema.org/draft-07/schema#\",Xy=\"https://json-schema.org/draft/2020-12/schema\";function ZL(e,t){return e===t||e===(t.endsWith(\"#\")?t.slice(0,-1):`${t}#`)}function XL(e){return kY(e)}function kY(e,t){return{dialect:\"draft-07\",...MY(e,HY,void 0,t)}}function OY(e,t){return r(e,!1,!0);function r(n,o,s=!1){if(!fr(n))return n;let a=o||!s&&r$(n.$id),i={};for(let c of Object.keys(n)){let u=n[c],f=u;switch(JL(c)){case\"map\":f=cT(u,p=>r(p,a))??u;break;case\"array\":f=Array.isArray(u)?u.map(p=>r(p,a)):u;break;case\"schema\":f=r(u,a)}B(i,c,f)}return t(i,a),i}}function e$(e,t){return OY(e,r=>{_Y(r,t)})}function _Y(e,t){typeof e.$ref==\"string\"&&B(e,\"$ref\",t(e.$ref,\"$ref\")),typeof e.$dynamicRef==\"string\"&&B(e,\"$dynamicRef\",t(e.$dynamicRef,\"$dynamicRef\"))}function cT(e,t){if(!fr(e))return;let r={};for(let n of Object.keys(e))B(r,n,t(e[n],n));return r}function RY(e,t,r){let n=new Map,o=[],s=aT;function a(d,m=[],h=[]){if(m.length===0&&t?.trackIds){let y=fr(d)?f(d):void 0;s=YL(y,aT)??aT}return u(d,m,h,{sourceRoot:[],targetRoot:[],uri:s})}function i(){for(let[d,m,h]of o){let y=m,S=t$(m,h);if(S!==void 0){let b=GL(S.hash);if(S.hash=\"\",b!==void 0){let x=n.get(QL(S.href,b));x!==void 0&&(y=PY(m,x))}}B(d,\"$ref\",y)}}let c=r(a);return i(),c;function u(d,m,h,y){if(typeof d==\"boolean\")return p(m,h,y),t?.booleanAdapter?.(d)??d;if(!fr(d))return d;let S=y,b=f(d);if(m.length>0&&t?.trackIds&&r$(b)){let I=YL(b,y.uri);I!==void 0&&(S={parent:y,sourceRoot:m,targetRoot:h,uri:I})}p(m,h,S);let x=S.uri,w={isDocumentRoot:m.length===0,schema(I,T,P=T){return u(I,[...m,T],[...h,P],S)},schemaAt(I,T,P){return u(I,[...m,...T],[...h,...P],S)},schemaArray(I,T,P=T){return Array.isArray(I)?I.map((G,he)=>u(G,[...m,T,String(he)],[...h,P,String(he)],S)):I},schemaMap(I,T,P=T){return fr(I)?cT(I,(G,he)=>u(G,[...m,T,he],[...h,P,he],S)):I},reference(I,T){typeof T==\"string\"?o.push([I,T,x]):B(I,\"$ref\",T)}};return e(d,w)}function f(d){return t?.ignoreRefSiblings===!0&&typeof d.$ref==\"string\"?void 0:d.$id}function p(d,m,h){h.parent!==void 0&&p(d,m,h.parent),n.set(QL(h.uri,d.slice(h.sourceRoot.length)),m.slice(h.targetRoot.length))}}var aT=\"https://effect.invalid/.json-schema/\";function t$(e,t){return URL.canParse(e,t)?new URL(e,t):void 0}function YL(e,t){if(typeof e!=\"string\")return;let r=t$(e,t);if(r!==void 0)return r.hash=\"\",r.href}function PY(e,t){let r=e.indexOf(\"#\");return r===-1&&t.length===0?e:`${r===-1?e:e.slice(0,r)}${VL(t)}`}function QL(e,t){return`${e}\\0${JSON.stringify(t)}`}function r$(e){return typeof e==\"string\"&&e.length>0&&e[0]!==\"#\"}function MY(e,t,r,n){return RY(t,{...r,trackIds:!0},o=>({schema:o(e.schema),definitions:cT(e.definitions,(s,a)=>o(s,[...n??[\"$defs\"],a],[...n??[\"definitions\"],a]))}))}var FY=new Set([\"properties\",\"patternProperties\"]),NY=new Set([\"allOf\",\"anyOf\",\"oneOf\"]),UY=new Set([\"not\",\"additionalProperties\",\"propertyNames\",\"contains\",\"if\",\"then\",\"else\",\"contentSchema\"]);function DY(e,t,r,n,o,s=FY){let a;if(s.has(t))a=n.schemaMap(r,t);else if(NY.has(t))a=n.schemaArray(r,t);else if(o.has(t))a=n.schema(r,t);else return!1;return B(e,t,a),!0}var n$=[\"$anchor\",\"$defs\",\"$dynamicAnchor\",\"$dynamicRef\",\"$vocabulary\",\"contentSchema\",\"dependentRequired\",\"dependentSchemas\",\"maxContains\",\"minContains\",\"prefixItems\",\"unevaluatedItems\",\"unevaluatedProperties\"],yge=[...n$,\"deprecated\"],Sge=[...n$,\"$comment\",\"$id\",\"$schema\",\"const\",\"contains\",\"contentEncoding\",\"contentMediaType\",\"else\",\"examples\",\"if\",\"patternProperties\",\"propertyNames\",\"then\"],LY=/^[A-Za-z_][-A-Za-z0-9._]*$/,$Y=/^[A-Za-z][-A-Za-z0-9._:]*$/;function xu(e,t,r){throw new Error(`Cannot convert JSON Schema keyword \"${e}\" to ${t}: ${r}`)}function KY(e,t,r,n){for(let o of t)Object.hasOwn(e,o)&&xu(o,r,`it is not active in ${n} but would become active in the target`)}var BY=[\"additionalItems\",\"definitions\",\"dependencies\"];function jY(e,t,r,n,o){r.isDocumentRoot?B(e,\"$schema\",ZL(t,Xy)?n:t):ZL(t,Xy)||xu(\"$schema\",o,\"an embedded resource cannot declare a different dialect\")}function HY(e,t){KY(e,BY,\"Draft-07\",\"Draft 2020-12\");let r={},n,o,s;for(let a of Object.keys(e)){let i=e[a];if(!DY(r,a,i,t,UY))switch(a){case\"$ref\":n=i;break;case\"$schema\":jY(r,i,t,iT,\"Draft-07\");break;case\"$id\":case\"$anchor\":break;case\"$defs\":B(r,\"definitions\",t.schemaMap(i,a,\"definitions\"));break;case\"prefixItems\":o=i;break;case\"items\":s=i;break;case\"dependentRequired\":case\"dependentSchemas\":case\"minContains\":case\"maxContains\":break;case\"$dynamicRef\":case\"$dynamicAnchor\":case\"$vocabulary\":case\"unevaluatedProperties\":case\"unevaluatedItems\":xu(a,\"Draft-07\",\"the target dialect has no equivalent\");case\"required\":case\"enum\":if(Array.isArray(i)&&i.length===0)break;B(r,a,i);break;default:B(r,a,i)}}if(zY(r,o,s,t),Object.hasOwn(e,\"contains\")){let a=e.minContains,i=e.maxContains;(a!==void 0&&a!==1||i!==void 0)&&xu(\"minContains/maxContains\",\"Draft-07\",\"contains cardinality cannot be represented\"),Object.hasOwn(e,\"minContains\")&&B(r,\"minContains\",a)}else Object.hasOwn(e,\"minContains\")&&B(r,\"minContains\",e.minContains),Object.hasOwn(e,\"maxContains\")&&B(r,\"maxContains\",e.maxContains);return qY(e,r,t,\"draft-07\"),JY(e,r,\"$id\",\"Draft-07\"),Array.isArray(e.enum)&&e.enum.length===0&&o$(r,{not:{}}),WY(r,n,t),r}function zY(e,t,r,n){if(t===void 0){r!==void 0&&B(e,\"items\",n.schema(r,\"items\"));return}B(e,\"items\",n.schemaArray(t,\"prefixItems\",\"items\")),r!==void 0&&B(e,\"additionalItems\",n.schema(r,\"items\",\"additionalItems\"))}function WY(e,t,r){if(t!==void 0)if(typeof t==\"string\"&&Object.keys(e).length>0){let n={};r.reference(n,t),o$(e,n)}else r.reference(e,t)}function qY(e,t,r,n){let o=fr(e.dependentRequired)?e.dependentRequired:void 0,s=fr(e.dependentSchemas)?e.dependentSchemas:void 0;if(o===void 0&&s===void 0)return;let a={},i=new Set([...Object.keys(o??{}),...Object.keys(s??{})]);for(let c of i){let u=o?.[c],f=s?.[c],p=n===\"draft-04\"&&Array.isArray(u)&&u.length===0;f===void 0?p||B(a,c,u):u===void 0||p?B(a,c,r.schemaAt(f,[\"dependentSchemas\",c],[\"dependencies\",c])):B(a,c,{allOf:[r.schemaAt(f,[\"dependentSchemas\",c],[\"dependencies\",c,\"allOf\",\"0\"]),{required:u}]})}Object.keys(a).length>0&&B(t,\"dependencies\",a)}function o$(e,t){Array.isArray(e.allOf)?e.allOf.push(t):B(e,\"allOf\",[t])}function JY(e,t,r,n){let o=e.$id,s=e.$anchor;if(s===void 0){o!==void 0&&B(t,r,o);return}(typeof s!=\"string\"||!LY.test(s))&&xu(\"$anchor\",n,\"the anchor is not valid\"),$Y.test(s)||xu(\"$anchor\",n,\"the anchor cannot be represented as a plain-name fragment identifier\"),o===void 0?B(t,r,`#${s}`):xu(\"$anchor\",n,\"it cannot be combined with the schema $id\")}function tS(e){return Wn(gl(e.ast),{schema:e})}var gl=i$(VY);function i$(e,t){let r=on(o=>{let s=Hn(o,void 0),a=e(s,n);return a===s?null:a}),n=du(o=>{let s=r(Di(o));if(s===null)return o;let a=Hn(s,o.context);return o.context===void 0?a:FC(a,c$(o.context))},t);return n}function c$(e){return e.constructorDefault===void 0?e:new Fs(e.isOptional,e.isMutable,void 0,e.annotations)}function u$(e){if(e.propertySignatures.some(t=>typeof t.name!=\"string\"))throw new globalThis.Error(\"Objects property names must be strings\",{cause:e})}function f$(e){return t=>{let r=[...t].sort((o,s)=>e(gn(o))-e(gn(s)));return r.some((o,s)=>o!==t[s])?r:t}}var GY=f$(e=>{switch(e._tag){case\"BigInt\":case\"Symbol\":case\"UniqueSymbol\":return 0;default:return 1}});function VY(e,t){switch(e._tag){case\"Declaration\":{let r=e.annotations?.toCodecJson??e.annotations?.toCodec;if(!qr(r))return ft(e,[HC]);let n=e.typeParameters.map(s=>Wn(gn(s))),o=r(n);return o===void 0?e:ft(e,[pl(o,t)])}case\"Unknown\":return ft(e,[HC]);case\"ObjectKeyword\":return ft(e,[IL]);case\"Undefined\":case\"Void\":case\"Literal\":case\"Number\":return e.toCodecJson();case\"UniqueSymbol\":case\"Symbol\":case\"BigInt\":return e.toCodecStringTree();case\"Objects\":return u$(e),e.recur(t,By);case\"Union\":{let r=GY(e.types);return r!==e.types?new Qr(r,e.options,e.annotations,e.checks,e.encoding,e.context,e.encodingChecks).recur(t):e.recur(t)}case\"Arrays\":case\"Suspend\":return e.recur(t)}return e}function rS(e){return Wn(l$(Mt(e.ast)))}var l$=on(e=>{let t=ZY(e,l$);return t!==e&&e.context!==void 0?FC(t,c$(e.context)):t});function ZY(e,t){switch(e._tag){case\"Declaration\":{let r=e.annotations?.toCodecIso??e.annotations?.toCodec;if(qr(r)){let n=r(e.typeParameters.map(o=>Wn(o)));return ft(e,[pl(n,t)])}return e}case\"Arrays\":case\"Objects\":case\"Union\":case\"Suspend\":return e.recur(t)}return e}function nS(e){return Wn(tQ(e.ast),{schema:e})}function p$(e){return Wn(h$(e.ast))}var YY=f$(e=>{switch(e._tag){case\"Null\":case\"Boolean\":case\"Number\":case\"BigInt\":case\"Symbol\":case\"UniqueSymbol\":return 0;default:return 1}});function QY(e,t,r){switch(e._tag){case\"Declaration\":{let n=e.typeParameters.map(u=>Wn(t(gn(u)))),o=e.annotations?.toCodecStringTree;if(qr(o)){let u=o(n);return u===void 0?e:ft(e,[pl(u,t)])}let s=e.annotations?.toCodecJson,a=qr(s)?s(n):void 0,i=a===void 0?e.annotations?.toCodec:void 0,c=a??(qr(i)?i(n):void 0);return c===void 0?r(e):ft(e,[pl(c,t)])}case\"Null\":return ft(e,[XY]);case\"Boolean\":return ft(e,[eQ]);case\"Unknown\":case\"ObjectKeyword\":return ft(e,[zC]);case\"Enum\":case\"Number\":case\"Literal\":case\"UniqueSymbol\":case\"Symbol\":case\"BigInt\":return e.toCodecStringTree();case\"Objects\":return u$(e),e.recur(t,By);case\"Union\":{let n=YY(e.types);return n!==e.types?new Qr(n,e.options,e.annotations,e.checks,e.encoding,e.context,e.encodingChecks).recur(t):e.recur(t)}case\"Arrays\":case\"Suspend\":return e.recur(t)}return e}var XY=new Tt(new Kn(\"null\"),new Ke(le(()=>null),le(()=>\"null\"))),eQ=new Tt(new Qr([new Kn(\"true\"),new Kn(\"false\")]),new Ke(le(e=>e===\"true\"),uu())),d$=new Ke(le(e=>typeof e==\"string\"?[e]:e),hn()),m$=e=>e.transformation===d$,tQ=i$((e,t)=>QY(e,t,r=>{throw new globalThis.Error(\"Missing structural codec for StringTree\",{cause:r})}),{stopAt:m$}),a$=e=>nr(e)?mu(Jo):Jo,h$=du(e=>{let t=iQ(e);if(My(t)){let r=Oa(new Qr([new jn(t.isMutable,t.elements.map(a$),t.rest.map(a$)),xn],{mode:\"anyOf\"}),t,d$);return nr(e)?mu(r):r}return t},{stopAt:m$});function x$(e){return Wn(rQ(e.ast),{schema:e})}var rQ=qs(e=>oS(eS(gl(e)))),eS=du(e=>{switch(e._tag){case\"Objects\":return e.recur(t=>nQ(eS(t)),D);case\"Arrays\":return e.recur(t=>oS(eS(t)));case\"Declaration\":case\"Union\":case\"Suspend\":return e.recur(eS)}return e}),nQ=dl(e=>nr(e)?g$(e):oS(e)),g$=dl(e=>gm(e)?e.recur(g$):aQ(e)||y$(e)?e:uT(e,fT(ll,S$))),oS=dl(e=>gm(e)?e.recur(oS):My(e)&&e.elements.length===0&&e.rest.length===1?uT(e,fT(Cm(oQ,e.checks),b$)):bC(e)&&e.propertySignatures.length===0&&e.indexSignatures.length>0?uT(e,fT(Cm(sQ,e.checks),E$)):e);function y$(e){let t=pu(e);switch(t._tag){case\"Union\":return t.checks===void 0&&t.types.some(y$);case\"Null\":case\"Unknown\":case\"Any\":case\"Declaration\":return km(Wn(Hn(t,void 0)))(null)}return!1}function uT(e,t){return Hn(new Qr([Hn(e,void 0),t]),e.context)}var lT=e=>new Ke(e,cu(()=>\"Go nil values are never encoded\")),S$=lT(ka(()=>v())),b$=lT(le(()=>[])),E$=lT(le(()=>({}))),oQ=new jn(!1,[],[]),sQ=$y(xn,ll);function fT(e,t){return Oa(ym,e,t)}function aQ(e){if(!Fy(e))return!1;let t=e.types[e.types.length-1].encoding?.[0].transformation;return t===S$||t===b$||t===E$}function iQ(e){return e._tag===\"Declaration\"||e._tag===\"Arrays\"||e._tag===\"Objects\"||e._tag===\"Union\"||e._tag===\"Suspend\"?e.recur(h$):e}var Ege=globalThis.RegExp;var _a=e=>e.replace(/[/\\\\^$*+?.()|[\\]{}]/g,\"\\\\$&\");function gu(e,t){return t.length>0&&(e+=`\n  at ${Ph(t)}`),new Error(e)}function I$(e){return`#/$defs/${oT(e)}`}var cQ=new Set([...A2,au,...w2]);function sS(e,t){if(e===void 0)return;let r={};for(let i of[\"title\",\"description\",\"format\",\"contentEncoding\",\"contentMediaType\"]){let c=e[i];typeof c==\"string\"&&(r[i]=c)}for(let i of[\"readOnly\",\"writeOnly\"]){let c=e[i];typeof c==\"boolean\"&&(r[i]=c)}let n=e.expected;r.description===void 0&&t?.generateDescriptions===!0&&typeof n==\"string\"&&(r.description=n);let o=e.default;ml(o)&&(r.default=o);let s=e.examples;Array.isArray(s)&&ml(s)&&(r.examples=s);let a=e.contentSchema;if(ml(a)&&(r.contentSchema=a),t?.includeAnnotationKey!==void 0)for(let[i,c]of Object.entries(e))cQ.has(i)||!t.includeAnnotationKey(i)||ml(c)&&B(r,i,c);return Object.keys(r).length===0?void 0:r}function w$(e){let t=e.type===\"number\"||e.type===\"integer\"?e.type:void 0,r=e;if(t!==void 0&&(r={...e},delete r.type),Array.isArray(r.allOf)){let n=[],o=!1;for(let s of r.allOf){let a=w$(s);a.type!==void 0&&(o=!0,(t===void 0||a.type===\"integer\")&&(t=a.type)),Object.keys(a.schema).length>0&&n.push(a.schema)}if(o){let{allOf:s,...a}=r;r=n.length===0?a:{...a,allOf:n}}}return{type:t,schema:r}}function uQ(e){if(!Array.isArray(e.anyOf)||e.anyOf.length!==2||e.anyOf[0]?.type!==\"number\")return!1;let t=e.anyOf[1];return t?.type===\"string\"&&Array.isArray(t.enum)&&t.enum.length===3&&t.enum.includes(\"NaN\")&&t.enum.includes(\"Infinity\")&&t.enum.includes(\"-Infinity\")}var A$=\"|type|format|pattern|multipleOf|minimum|maximum|exclusiveMinimum|exclusiveMaximum|minLength|maxLength|minItems|maxItems|uniqueItems|minProperties|maxProperties|propertyNames|\";function aS(e,t){return Object.keys(e).every(r=>t.includes(`|${r}|`))}function fQ(e,t){return typeof e.$ref!=\"string\"&&t.every(r=>!Object.hasOwn(e,r))}var lQ=\"|minimum|exclusiveMinimum|minLength|minItems|minProperties|\",pQ=\"|maximum|exclusiveMaximum|maxLength|maxItems|maxProperties|\";function dQ(e,t,r){if(typeof e.$ref==\"string\")return;let n={...e,...t};for(let o of r){if(!Object.hasOwn(e,o))continue;let s=e[o],a=t[o];if(typeof s!=\"number\"||typeof a!=\"number\")return;if(lQ.includes(`|${o}|`))n[o]=Math.max(s,a);else if(pQ.includes(`|${o}|`))n[o]=Math.min(s,a);else return}return typeof n.minimum==\"number\"&&typeof n.exclusiveMinimum==\"number\"&&delete n[n.exclusiveMinimum>=n.minimum?\"minimum\":\"exclusiveMinimum\"],typeof n.maximum==\"number\"&&typeof n.exclusiveMaximum==\"number\"&&delete n[n.exclusiveMaximum<=n.maximum?\"maximum\":\"exclusiveMaximum\"],n}var mT=\"|title|description|default|examples|readOnly|writeOnly|\",mQ=A$+mT;function iS(e,t,r){if(Object.keys(e).length===0)return t;let n=Object.keys(t);if(n.length===0)return e;let o=e.type===\"number\"||e.type===\"integer\"?e.type:void 0,s=uQ(e);if(o!==void 0||s){let i=w$(t);if(i.type!==void 0){let c=o===\"integer\"||i.type===\"integer\"?\"integer\":\"number\",u={...e,type:c};s&&delete u.anyOf;let f=Object.keys(i.schema);return f.length===0?u:aS(i.schema,mT)&&fQ(u,f)?{...u,...i.schema}:iS(u,i.schema,r)}}if(r){let i=dQ(e,t,n);if(i!==void 0)return i}let a=Array.isArray(t.allOf)&&n.length===1?t.allOf:[t];return Array.isArray(e.allOf)?{...e,allOf:[...e.allOf,...a]}:typeof e.$ref==\"string\"?{allOf:[e,...a]}:{...e,allOf:a}}function dT(e,t=new Set){return typeof e==\"boolean\"?e:t.has(e)?!0:(t.add(e),e.every(r=>dT(r,t)))}function hQ(e){return Array.isArray(e)}function xQ(e,t,r,n){let o=`^(?:${Sm}|Infinity|-Infinity|NaN)$`,s=new Map,a=new Map,i=new WeakMap,c=new Map,u=new Map,f=Object.keys(r);for(let E of f)S(E,[\"references\",E]);let p=kn(e,(E,R)=>I(E,t[R],[]));for(let{branches:E,schemas:R}of c.values())if(!dT(E))for(let N of R)Array.isArray(N.oneOf)&&(N.anyOf=N.oneOf,delete N.oneOf);for(let E of f){let R=r[E],N=x(R);if(N===void 0)continue;let O=s.get(E).schema,M=u.get(N),U=M?.find(pe=>Z(s.get(pe).schema,O));U===void 0?M===void 0?u.set(N,[E]):M.push(E):a.set(E,U)}let d=kn(p,b),m={};for(let E of f)a.has(E)||B(m,E,b(s.get(E).schema));return{dialect:\"draft-2020-12\",schemas:d,definitions:m};function h(E){return Array.isArray(E.oneOf)&&c.get(E.oneOf)?.schemas.push(E),E}function y(E,R,N){let O=I(E.type,[...R,\"type\"],N),M=sS(E.annotations,n);return M===void 0?O:h(iS(O,M))}function S(E,R){if(!Object.hasOwn(r,E))throw gu(`Invalid reference ${E}`,[...R,\"$ref\"]);let N=s.get(E);if(N!==void 0)return N;let O={schema:{},dependencies:[]};return s.set(E,O),O.schema=I(r[E],[\"references\",E],O.dependencies),O}function b(E){return e$(E,R=>{let N=sT(R);if(N===void 0){if(/^#(?:\\/|%2f)/i.test(R))throw new Error(`Invalid JSON Pointer URI fragment ${JSON.stringify(R)}`);return R}if(!N.startsWith(\"/$defs/\"))return R;let O=N.indexOf(\"/\",7),M=a.get(_m(N.slice(7,O<0?void 0:O)));return M===void 0?R:R.replace(/^#(?:\\/|%2f).*?(?:\\/|%2f).*?(?=\\/|%2f|$)/i,I$(M))})}function x(E){if(E._tag===\"Reference\")return;let R=E.checks.length===0?E.annotations:E.checks[E.checks.length-1].annotations;return typeof R?.identifier!=\"string\"&&typeof R?.[au]==\"string\"?R[au]:void 0}function w(E,R,N,O){let M=E.annotations,U=M?.toJsonSchema;if(U!==void 0){let ee=E.representation?.schemas?.map((vr,is)=>I(vr,[...N,\"representation\",\"schemas\",is],O))??[],Qe=U({type:R,schemas:ee}),qe=hQ(Qe);qe&&O.push(!1);let et=qe?Qe[0]:Qe,De=sS(M,n),xt=De===void 0?et:{...et,...De},vt=De===void 0?A$:mQ;return[xt,E._tag===\"Filter\"&&aS(xt,vt)&&(De===void 0||aS(De,mT))?!0:void 0]}if(E._tag===\"Filter\"){O.push(!1);return}let pe=E.checks.flatMap((ee,Qe)=>{let qe=w(ee,R,[...N,\"checks\",Qe],O);return qe===void 0?[]:[qe[0]]});if(pe.length===0)return;let He=sS(M,n),ze={allOf:pe};return[He===void 0?ze:{...ze,...He}]}function I(E,R,N){if(E._tag===\"Reference\")return N.push(S(E.$ref,R).dependencies),{$ref:I$(E.$ref)};let O=i.get(E);if(O!==void 0)return N.push(O.dependencies),O.schema;let M=[];N.push(M);let U={...T(E,R,M),...sS(E.annotations,n)};if(E._tag===\"String\"&&E.content!==void 0){let pe=E.content;U.contentMediaType=pe.mediaType,delete U.contentSchema,pe.schema!==void 0&&(U.contentSchema=I(pe.schema,[...R,\"content\",\"schema\"],[]))}for(let pe=0;pe<E.checks.length;pe++){let He=typeof U.type==\"string\"&&gQ(U.type)?U.type:void 0,ze=w(E.checks[pe],He,[...R,\"checks\",pe],M);ze!==void 0&&(U=iS(U,...ze))}return i.set(E,{schema:U,dependencies:M}),h(U)}function T(E,R,N){switch(E._tag){case\"Any\":case\"Unknown\":return{};case\"ObjectKeyword\":return{anyOf:[{type:\"object\"},{type:\"array\"}]};case\"Void\":case\"Undefined\":case\"Null\":return{type:\"null\"};case\"BigInt\":return{type:\"string\",allOf:[{pattern:\"^-?\\\\d+$\"}]};case\"Symbol\":return{type:\"string\",allOf:[{pattern:\"^Symbol\\\\(([\\\\s\\\\S]*)\\\\)$\"}]};case\"UniqueSymbol\":return globalThis.Symbol.keyFor(E.symbol)===void 0?{not:{}}:{type:\"string\",enum:[globalThis.String(E.symbol)]};case\"Declaration\":return N.push(!1),{};case\"Suspend\":return I(E.thunk,[...R,\"thunk\"],N);case\"Never\":return{not:{}};case\"String\":return{type:\"string\"};case\"Number\":return{anyOf:[{type:\"number\"},{type:\"string\",enum:[\"NaN\",\"Infinity\",\"-Infinity\"]}]};case\"Boolean\":return{type:\"boolean\"};case\"Literal\":{let O=E.literal;return typeof O==\"bigint\"?{type:\"string\",enum:[globalThis.String(O)]}:{type:typeof O,enum:[O]}}case\"Enum\":{let O=E.enums.map(([M,U])=>({type:typeof U,enum:[U],title:M}));return O.length===0?{not:{}}:{anyOf:O}}case\"TemplateLiteral\":{let{exact:O,pattern:M}=me(E.parts);return O||N.push(!1),{type:\"string\",pattern:M}}case\"Arrays\":{let O={type:\"array\"},M=E.elements.length,U=E.elements.map((pe,He)=>(pe.isOptional&&M--,y(pe,[...R,\"elements\",He],N)));if(U.length>0?(O.prefixItems=U,O.maxItems=E.elements.length,M>0&&(O.minItems=M)):O.items=!1,E.rest.length===1){delete O.maxItems;let pe=I(E.rest[0],[...R,\"rest\",0],N);Object.keys(pe).length>0?O.items=pe:delete O.items}else E.rest.length>1&&(delete O.maxItems,delete O.items,O.minItems=M+E.rest.length-1,N.push(!1));return O}case\"Objects\":return P(E,R,N);case\"Union\":{let O=[],M=E.types.map((U,pe)=>I(U,[...R,\"types\",pe],O));if(N.push(O),M.length===0)return{not:{}};if(E.options?.mode===\"oneOf\")return c.set(M,{branches:O,schemas:[]}),{oneOf:M};if(M.length>1){let U=yQ(M);if(U!==void 0)return U}return{anyOf:M.flatMap(U=>Array.isArray(U.anyOf)&&Object.keys(U).length===1?U.anyOf:[U])}}}}function P(E,R,N){let{indexSignatures:O,propertySignatures:M}=E;if(M.length===0&&O.length===0)return{not:{type:\"null\"}};let U={type:\"object\"},pe={},He=[];for(let[De,xt]of M.entries()){let vt=[...R,\"propertySignatures\",De];if(typeof xt.name!=\"string\")throw gu(\"Objects property names must be strings\",[...vt,\"name\"]);B(pe,xt.name,y(xt,vt,N)),xt.isOptional||He.push(xt.name)}M.length>0&&(U.properties=pe),He.length>0&&(U.required=He);let ze=O.map((De,xt)=>{let vt=[...R,\"indexSignatures\",xt],vr=I(De.type,[...vt,\"type\"],N),is=Z(vr,{not:{}})?!1:vr,Ws=he(De.parameter,[...vt,\"parameter\"],new Set);return Ws===void 0&&N.push(!1),{type:is,patterns:Ws}}),ee={};for(let{patterns:De,type:xt}of ze)for(let vt of De??[]){let vr=ee[vt];B(ee,vt,vr===void 0?xt:vr===!1||xt===!1?!1:h(iS(vr,xt)))}let Qe=Object.keys(ee).length>0;Qe&&(U.patternProperties=ee);let qe=ze.filter(({patterns:De})=>De?.length===0).map(({type:De})=>De),et=ze.some(({patterns:De})=>De===void 0);if(et&&n?.onExcessProperty===\"error\"){let De=[];M.length>0&&De.push({enum:Object.keys(pe)});for(let[vt,vr]of O.entries())De.push(G(vr.parameter,[...R,\"indexSignatures\",vt,\"parameter\"],N,new Set));U.propertyNames=De.length===1?De[0]:{anyOf:De};let xt=ze.map(({type:vt})=>vt);U.additionalProperties=xt.length===1?xt[0]:{anyOf:xt},qe.length>0&&(U.allOf=qe.map(vt=>({type:\"object\",additionalProperties:vt})))}else qe.length===0?U.additionalProperties=et||n?.onExcessProperty!==\"error\":qe.length===1&&M.length===0&&!Qe?U.additionalProperties=qe[0]:U.allOf=qe.map(De=>({type:\"object\",additionalProperties:De}));return typeof U.additionalProperties==\"object\"&&U.additionalProperties!==null&&Object.keys(U.additionalProperties).length===0&&delete U.additionalProperties,U}function G(E,R,N,O){switch(E._tag){case\"Number\":return{type:\"string\",pattern:o};case\"Reference\":return O.has(E.$ref)?{type:\"string\"}:G(r[E.$ref],[\"references\",E.$ref],N,new Set(O).add(E.$ref));case\"Union\":return{anyOf:E.types.map(M=>G(M,R,N,O))};default:return I(E,R,N)}}function he(E,R,N){switch(E._tag){case\"Reference\":{if(S(E.$ref,R),N.has(E.$ref))return;let O=new Set(N).add(E.$ref);return he(r[E.$ref],[\"references\",E.$ref],O)}case\"String\":{if(E.checks.length===0)return[];if(E.checks.length!==1||E.checks[0]._tag!==\"Filter\"||E.checks[0].annotations?.toJsonSchema===void 0)return;let O=[],M=I(E,R,O);return dT(O)&&M.type===\"string\"&&typeof M.pattern==\"string\"&&aS(M,\"|type|pattern|title|description|default|examples|readOnly|writeOnly|\")?[M.pattern]:void 0}case\"TemplateLiteral\":{if(E.checks.length>0)return;let{exact:O,pattern:M}=me(E.parts);return O?[M]:void 0}case\"Union\":{if(E.types.length===0||E.checks.length>0||E.options?.mode===\"oneOf\")return;let O=[];for(let M=0;M<E.types.length;M++){let U=he(E.types[M],[...R,\"types\",M],N);if(U===void 0)return;if(U.length===0)return[];O.push(...U)}return O}case\"Number\":return E.checks.length===0?[o]:void 0;default:throw gu(`Invalid index signature parameter ${E._tag}`,R)}}function me(E){let R=new Set,N=!0;return{pattern:`^${E.map(M).join(\"\")}$`,exact:N};function M(U){switch(U._tag!==\"Reference\"&&U.checks.length>0&&(N=!1),U._tag){case\"Reference\":{if(!Object.hasOwn(r,U.$ref))throw gu(`Invalid reference ${U.$ref}`,[]);if(R.has(U.$ref))throw gu(`Invalid recursive TemplateLiteral part ${U.$ref}`,[]);R.add(U.$ref);let pe=M(r[U.$ref]);return R.delete(U.$ref),pe}case\"Literal\":return _a(globalThis.String(U.literal));case\"String\":return xL;case\"Number\":return Sm;case\"BigInt\":return\"-?\\\\d+\";case\"TemplateLiteral\":return U.parts.map(M).join(\"\");case\"Union\":return U.types.length===0?\"(?!)\":(U.options?.mode===\"oneOf\"&&(N=!1),`(?:${U.types.map(M).join(\"|\")})`);default:throw gu(`Invalid TemplateLiteral part ${U._tag}`,[])}}}}function gQ(e){return e===\"string\"||e===\"number\"||e===\"boolean\"||e===\"array\"||e===\"object\"||e===\"null\"||e===\"integer\"}function yQ(e){let t,r=[];for(let n of e){if(Object.keys(n).length!==2||n.type===void 0||!Array.isArray(n.enum)||n.enum.length===0)return;if(t===void 0)t=n.type;else if(n.type!==t)return;for(let s of n.enum){if(r.includes(s))return;r.push(s)}}return{type:t,enum:r}}function cS(e,t){let r=xQ([e.representation],[[\"representation\"]],e.references,t);return{dialect:r.dialect,schema:r.schemas[0],definitions:r.definitions}}var SQ=({identifier:e})=>e;function hT(e){return e===void 0?void 0:{annotations:e}}function Pm(e,t){let{references:r,representations:n}=bQ([e],t);return{representation:n[0],references:r}}function bQ(e,t){let r={},n=new Set,o=new Map;for(let x of e)f(x);let s=t?.referencePolicy??SQ;for(let x of o.values())for(let w of x){let I=s({ast:w.ast,occurrences:w.occurrences,identifier:w.identifier});if(I!==void 0){let T=I===w.identifier||!I.endsWith(\"_\")?\"_\":\"\";w.reference=i(I,T)}else w.isRecursive&&(w.reference=i(`${w.ast._tag}_`,\"\"))}return{representations:kn(e,m),references:r};function i(x,w){let I=x,T=0;for(;n.has(I);)I=`${x}${w}${++T}`;return n.add(I),I}function c(x,w,I){let T=w.fallback;return T!==void 0?ZA(x)===T?x:Go(x,{[au]:T}):I===w.identifier?x:Go(x,{identifier:I})}function u(x,w=x.encoding?.length??0){let I=x,T;for(;I.encoding!==void 0&&w>0;){let R=I.encoding[w-1];if(R.to.encoding===void 0&&R.to._tag===\"String\"){let N=uD(R.transformation.encode);N!==void 0&&(T={mediaType:N.mediaType,schema:N.preserveSchema?u(I,w-1):void 0})}I=R.to,w=I.encoding?.length??0}let P=Di(I),G=Xf(I),he=G===void 0?(I!==x?Xf(x):void 0)??ZA(I):void 0;he!==void 0&&(G=`${he}Encoded`);let me=o.get(P);me===void 0&&(me=[],o.set(P,me));let E=me.find(R=>R.identifier===G&&R.content?.mediaType===T?.mediaType&&R.content?.schema===T?.schema);return E===void 0&&(E={ast:P,identifier:G,fallback:he,content:T,occurrences:0},me.push(E)),E}function f(x){return p(u(x)),x}function p(x){let w=x.ast;if(x.occurrences++,x.visiting){x.isRecursive=!0;return}if(!(x.occurrences>1)){switch(x.visiting=!0,x.content?.schema!==void 0&&p(x.content.schema),d(w.checks),w._tag){default:\"recur\"in w&&w.recur(f);break;case\"TemplateLiteral\":w.parts.forEach(f);break;case\"Suspend\":f(w.thunk());break}x.visiting=!1}}function d(x){x?.forEach(w=>{w.annotations?.representation?.schemas?.forEach(I=>f(Mt(I))),w._tag===\"FilterGroup\"&&d(w.checks)})}function m(x){return h(u(x))}function h(x){let w=x.ast,I=x.reference;if(I!==void 0){if(!x.emitted){x.emitted=!0;let T=x.identifier===void 0?w:c(w,x,I),P=y(T,x.content);B(r,I,P)}return{_tag:\"Reference\",$ref:I}}return y(w,x.content)}function y(x,w){let I={checks:x.checks?.map(S)??[],...x._tag===\"Declaration\"?b(x.annotations):hT(x.annotations)};switch(x._tag){case\"Declaration\":return{_tag:x._tag,typeParameters:x.typeParameters.map(m),...I};default:return{_tag:x._tag,...w===void 0?void 0:{content:{mediaType:w.mediaType,...w.schema===void 0?void 0:{schema:h(w.schema)}}},...I};case\"Literal\":return{_tag:x._tag,literal:x.literal,...I};case\"UniqueSymbol\":return{_tag:x._tag,symbol:x.symbol,...I};case\"Enum\":return{_tag:x._tag,enums:x.enums,...I};case\"TemplateLiteral\":return{_tag:x._tag,parts:x.parts.map(m),...I};case\"Arrays\":return{_tag:x._tag,elements:x.elements.map(T=>{let P=pu(T),G=P.context?.annotations;return{isOptional:nr(P),type:m(T),...hT(G)}}),rest:x.rest.map(m),...I};case\"Objects\":return{_tag:x._tag,propertySignatures:x.propertySignatures.map(T=>{let P=pu(T.type),G=P.context?.annotations;return{name:T.name,type:m(T.type),isOptional:nr(P),isMutable:dL(P),...hT(G)}}),indexSignatures:x.indexSignatures.map(T=>({parameter:m(T.parameter),type:m(T.type)})),...I};case\"Union\":return{_tag:x._tag,types:x.types.map(m),...x.options===void 0?{}:{options:x.options},...I};case\"Suspend\":return{_tag:x._tag,...I,checks:[],thunk:m(x.thunk())}}}function S(x){return{...x._tag===\"Filter\"?{_tag:x._tag,aborted:x.aborted}:{_tag:x._tag,checks:kn(x.checks,S)},...b(x.annotations,!0)}}function b(x,w=!1){if(x===void 0)return;let{representation:I,...T}=x,P=w&&I?.schemas!==void 0?{...I,schemas:I.schemas.map(G=>m(Mt(G)))}:I;return{...P===void 0?void 0:{representation:P},...Object.keys(T).length===0?void 0:{annotations:T}}}}function v$(e){return ut(e)?e.value:{issues:[{message:n0(e.cause)}]}}function O$(e,t){let r=St(e),n={errors:\"all\",...t?.parseOptions},o=P2(t);return _$(e,{validate:a=>{let i=new bc(\"sync\"),c=Rd(q0(r(a,n),{onFailure:o,onSuccess:f=>({value:f})}),{scheduler:i});c.currentDispatcher?.flush();let u=c.pollUnsafe();return u?v$(u):new Promise(f=>{c.addObserver(p=>{f(v$(p))})})}})}function _$(e,t){let r={version:1,vendor:\"effect\",...Object.hasOwn(e,\"~standard\")?e[\"~standard\"]:void 0,...t},n=typeof e==\"function\"?Function.prototype.bind.call(e,void 0):Object.create(Object.getPrototypeOf(e));return Object.defineProperties(n,{...Object.getOwnPropertyDescriptors(e),ast:{value:e.ast,enumerable:!0,configurable:!0},\"~standard\":{value:r,writable:!0,enumerable:!0,configurable:!0}})}function EQ(e){let t=Pm(gl(e));return cS(t)}function k$(e,t){let r=EQ(e);if(t===\"draft-2020-12\"){let n={$schema:Xy,...r.schema};return Object.keys(r.definitions).length>0&&(n.$defs=r.definitions),n}else if(t===\"draft-07\"){let n=XL(r),o={$schema:iT,...n.schema};return Object.keys(n.definitions).length>0&&(o.definitions=n.definitions),o}throw new globalThis.Error(`Unsupported target: ${t}`)}function R$(e){return _$(e,{jsonSchema:{input(t){return k$(e.ast,t.target)},output(t){return k$(Mt(e.ast),t.target)}}})}function M$(e,t){let r=[];return xT(e,t,\"\",r),r}function xT(e,t,r,n){if(!Object.is(e,t)){if(Array.isArray(e)&&Array.isArray(t)){let o=e.length,s=t.length,a=Math.min(o,s);for(let i=0;i<a;i++)xT(e[i],t[i],`${r}/${i}`,n);for(let i=o-1;i>=s;i--)n.push({op:\"remove\",path:`${r}/${i}`});for(let i=o;i<s;i++)n.push({op:\"add\",path:`${r}/${i}`,value:t[i]});return}if(uS(e)&&uS(t)){let o=Object.keys(e),s=Object.keys(t),a=Array.from(new Set([...o,...s])).sort();for(let i of a){let c=`${r}/${nT(i)}`,u=Object.hasOwn(e,i),f=Object.hasOwn(t,i);u&&f?xT(e[i],t[i],c,n):!u&&f?n.push({op:\"add\",path:c,value:t[i]}):n.push({op:\"remove\",path:c})}return}n.push({op:\"replace\",path:r,value:t})}}function F$(e,t){let r=t;for(let n of e)r=AQ(r,n);return r}function uS(e){return typeof e==\"object\"&&e!==null&&!Array.isArray(e)}function wQ(e){if(e===\"\")return[];if(e.charCodeAt(0)!==47)throw new Error(`Invalid JSON Pointer, it must start with \"/\": ${JSON.stringify(e)}`);if(/~(?![01])/.test(e))throw new Error(`Invalid JSON Pointer escape: ${JSON.stringify(e)}`);return e.split(\"/\").slice(1).map(_m)}function N$(e){if(!/^(0|[1-9]\\d*)$/.test(e))throw new Error(`Invalid array index: \"${e}\"`);return Number(e)}function AQ(e,t){if(t.path===\"\"){if(t.op===\"remove\")throw new Error(\"Unsupported operation at the root\");return t.value}let r=CQ(e,t.path);if(r===null)throw new Error(`Cannot ${t.op} at \"${t.path}\" (parent not found or not a container).`);let{lastToken:n,parent:o,stack:s}=r;if(Array.isArray(o)){if(n===\"-\"&&t.op!==\"add\")throw new Error(`\"-\" is not valid for ${t.op} at \"${t.path}\".`);let a=n===\"-\"?o.length:N$(n),i=t.op===\"add\"?o.length:o.length-1;if(a>i)throw new Error(`Array index out of bounds at \"${t.path}\".`);let c=o.slice();return t.op===\"add\"?c.splice(a,0,t.value):t.op===\"remove\"?c.splice(a,1):c[a]=t.value,P$(s,c)}if(uS(o)){if(t.op!==\"add\"&&!Object.hasOwn(o,n))throw new Error(`Property \"${n}\" does not exist at \"${t.path}\".`);let a={...o};return t.op===\"remove\"?delete a[n]:B(a,n,t.value),P$(s,a)}throw new Error(`Cannot ${t.op} at \"${t.path}\" (parent not found or not a container).`)}function CQ(e,t){let r=wQ(t);if(r.length===0)return null;let n=r[r.length-1],o=[],s=e;for(let a=0;a<r.length-1;a++){let i=r[a];if(Array.isArray(s)){let c=N$(i);if(c>=s.length)return null;o.push({container:s,token:c}),s=s[c];continue}if(uS(s)){if(!Object.hasOwn(s,i))return null;o.push({container:s,token:i}),s=s[i];continue}return null}return{stack:o,parent:s,lastToken:n}}function P$(e,t){let r=t;for(let n=e.length-1;n>=0;n--){let{container:o,token:s}=e[n];if(Array.isArray(o)){let a=o.slice();a[s]=r,r=a}else{let a={...o};B(a,s,r),r=a}}return r}function D$(e){let t=tS(e),r=Zy(t),n=Vy(t);return{empty:[],diff:(o,s)=>M$(r(o),r(s)),combine:(o,s)=>[...o,...s],patch:(o,s)=>{let a=r(o),i=F$(s,a);return Object.is(i,a)?o:n(i)}}}function L$(e,t){let r=Xf(e.ast)??YA(e.ast),n=NL(nS(e));return o=>n(o).pipe(W(s=>vQ(s,{rootName:r,...t})))}function vQ(e,t){let r=t.rootName??\"root\",n=t.arrayItemName??\"item\",o=t.pretty??!0,s=t.indent??\"  \",a=t.sortKeys??!0,i=new Set,c=[];return f(r,e,0),c.join(o?`\n`:\"\");function u(p,d){c.push(o?s.repeat(p)+d:d)}function f(p,d,m,h){let{attrs:y,safe:S}=yl.tagInfo(p,h);if(d===void 0)u(m,`<${S}${y}/>`);else if(typeof d==\"string\")u(m,`<${S}${y}>${yl.escapeText(d)}</${S}>`);else if(typeof d!=\"object\"||d===null)u(m,`<${S}${y}>${yl.escapeText(K(d))}</${S}>`);else{if(i.has(d))throw new globalThis.Error(\"Cycle detected while serializing to XML.\",{cause:d});i.add(d);try{if(globalThis.Array.isArray(d)){if(d.length===0){u(m,`<${S}${y}/>`);return}u(m,`<${S}${y}>`);for(let w of d)f(n,w,m+1);u(m,`</${S}>`);return}let b=d,x=Object.keys(b);if(a&&x.sort(),x.length===0){u(m,`<${S}${y}/>`);return}u(m,`<${S}${y}>`);for(let w of x)f(yl.parseTagName(w).safe,b[w],m+1,w);u(m,`</${S}>`)}finally{i.delete(d)}}}}var yl={escapeText(e){return e.replace(/&/g,\"&amp;\").replace(/</g,\"&lt;\").replace(/>/g,\"&gt;\")},escapeAttribute(e){return e.replace(/&/g,\"&amp;\").replace(/\"/g,\"&quot;\").replace(/</g,\"&lt;\").replace(/>/g,\"&gt;\")},parseTagName(e){let t=e,r=e;return/^[A-Za-z_]/.test(r)||(r=\"_\"+r),r=r.replace(/[^A-Za-z0-9._-]/g,\"_\"),/^xml/i.test(r)&&(r=\"_\"+r),{safe:r,changed:r!==t}},tagInfo(e,t){let{changed:r,safe:n}=yl.parseTagName(e),s=r||t&&t!==e?` data-name=\"${yl.escapeAttribute(t??e)}\"`:\"\";return{safe:n,attrs:s}}};var gT=on(e=>Li(e));function Li(e){let t=va(e)?.toEquivalence;if(t)return t(ul(e)?e.typeParameters.map(Li):[]);switch(e._tag){case\"Never\":return Wa();case\"Declaration\":return OQ(e);case\"Null\":case\"Undefined\":case\"Void\":case\"Unknown\":case\"Any\":case\"String\":case\"Number\":case\"Boolean\":case\"BigInt\":case\"Symbol\":case\"Literal\":case\"UniqueSymbol\":case\"ObjectKeyword\":case\"Enum\":case\"TemplateLiteral\":return Z;case\"Arrays\":{let r=e.elements.map(Li),n=e.rest.map(Li),[o,...s]=n,a=s.length;return Kt((i,c)=>{if(!Array.isArray(i)||!Array.isArray(c))return!1;let u=i.length;if(u!==c.length)return!1;let f=0;for(;f<Math.min(u,e.elements.length);f++)if(!r[f](i[f],c[f]))return!1;if(n.length>0){for(;f<u-a;f++)if(!o(i[f],c[f]))return!1;for(let p=0;p<a;p++)if(!s[p](i[f+p],c[f+p]))return!1}return!0})}case\"Objects\":{if(e.propertySignatures.length===0&&e.indexSignatures.length===0)return Z;let r=e.propertySignatures.map(o=>Li(o.type)),n=e.indexSignatures.map(o=>Li(o.type));return Kt((o,s)=>{if(!fr(o)||!fr(s))return!1;for(let a=0;a<r.length;a++){let i=e.propertySignatures[a],c=i.name,u=Object.hasOwn(o,c),f=Object.hasOwn(s,c);if(nr(i.type)&&u!==f||u&&f&&!r[a](o[c],s[c]))return!1}for(let a=0;a<n.length;a++){let i=e.indexSignatures[a],c=Ms(o,i.parameter),u=Ms(s,i.parameter);if(c.length!==u.length)return!1;for(let f=0;f<c.length;f++){let p=c[f];if(!Object.hasOwn(s,p)||!n[a](o[p],s[p]))return!1}}return!0})}case\"Union\":{let r=Mt(e).types,n=Im(r),o=r.map((s,a)=>[Om(s),Li(e.types[a])]);return Kt((s,a)=>{let i=n(s,!1);for(let c=0;c<i.length;c++){let[u,f]=o[i[c]];if(u(s)&&u(a))return f(s,a)}return!1})}case\"Suspend\":{let r;return Kt((n,o)=>(r??=gT(e.thunk()))(n,o))}}}function OQ(e){let t=e.annotations?.representation;if(t===void 0)return Z;switch(t.id){case\"effect/schema/Option\":{let[r]=yu(e);return(n,o)=>n._tag===o._tag&&(n._tag===\"None\"||r(n.value,o.value))}case\"effect/schema/Result\":{let[r,n]=yu(e);return(o,s)=>o._tag===s._tag&&(o._tag===\"Success\"?r(o.success,s.success):n(o.failure,s.failure))}case\"effect/schema/CauseReason\":{let[r,n]=yu(e);return K$(r,n)}case\"effect/schema/Cause\":{let[r,n]=yu(e);return $$(r,n)}case\"effect/schema/Exit\":{let[r,n,o]=yu(e),s=$$(n,o);return(a,i)=>a._tag===i._tag&&(a._tag===\"Success\"?r(a.value,i.value):s(a.cause,i.cause))}case\"effect/schema/ReadonlyMap\":{let[r,n]=yu(e);return _h(r,n)}case\"effect/schema/ReadonlySet\":return hp(yu(e)[0]);case\"effect/schema/RegExp\":return(r,n)=>r.source===n.source&&r.flags===n.flags;case\"effect/schema/URL\":return(r,n)=>r.toString()===n.toString();default:return Z}}function yu(e){return e.typeParameters.map(Li)}function K$(e,t){return(r,n)=>{if(r._tag!==n._tag)return!1;switch(r._tag){case\"Fail\":return e(r.error,n.error);case\"Die\":return t(r.defect,n.defect);case\"Interrupt\":return r.fiberId===n.fiberId}}}function $$(e,t){let r=Vu(K$(e,t));return(n,o)=>r(n.reasons,o.reasons)}function j$(e,t){return r=>{switch(r._tag){case\"Fail\":return`Fail(${e(r.error)})`;case\"Die\":return`Die(${t(r.defect)})`;case\"Interrupt\":return\"Interrupt\"}}}function B$(e,t){let r=j$(e,t);return n=>`Cause([${n.reasons.map(r).join(\", \")}])`}function H$(e,t){let r=new Map;return n(e);function n(a){let i=r.get(a);return i===void 0&&(i=o(a),r.set(a,i)),i}function o(a){let i=va(a)?.toFormatter;if(typeof i==\"function\")return i(ul(a)?a.typeParameters.map(n):[]);if(t?.onBefore){let c=t.onBefore(a,n);if(c!==void 0)return c}return s(a)}function s(a){switch(a._tag){default:return K;case\"Never\":return()=>\"never\";case\"Void\":return()=>\"void\";case\"Declaration\":{let i=a.annotations?.representation;if(i===void 0)return K;let c=a.typeParameters.map(n);switch(i.id){case\"effect/schema/Option\":{let[u]=c;return Zt({onNone:()=>\"none()\",onSome:f=>`some(${u(f)})`})}case\"effect/schema/Result\":{let[u,f]=c;return mr({onSuccess:p=>`success(${u(p)})`,onFailure:p=>`failure(${f(p)})`})}case\"effect/schema/CauseReason\":return j$(c[0],c[1]);case\"effect/schema/Cause\":return B$(c[0],c[1]);case\"effect/schema/Exit\":{let[u,f,p]=c,d=B$(f,p);return m=>{switch(m._tag){case\"Success\":return`Exit.Success(${u(m.value)})`;case\"Failure\":return`Exit.Failure(${d(m.cause)})`}}}case\"effect/schema/ReadonlyMap\":{let[u,f]=c;return p=>{let d=p.size;if(d===0)return\"ReadonlyMap(0) {}\";let m=globalThis.Array.from(p.entries()).map(([h,y])=>`${u(h)} => ${f(y)}`).sort();return`ReadonlyMap(${d}) { ${m.join(\", \")} }`}}case\"effect/schema/HashMap\":{let[u,f]=c;return p=>{let d=jU(p);if(d===0)return\"HashMap(0) {}\";let m=em(p).map(([h,y])=>`${u(h)} => ${f(y)}`).sort();return`HashMap(${d}) { ${m.join(\", \")} }`}}case\"effect/schema/ReadonlySet\":{let[u]=c;return f=>{let p=f.size;if(p===0)return\"ReadonlySet(0) {}\";let d=globalThis.Array.from(f.values()).map(m=>`${u(m)}`).sort();return`ReadonlySet(${p}) { ${d.join(\", \")} }`}}case\"effect/schema/HashSet\":{let[u]=c;return f=>{let p=JU(f);if(p===0)return\"HashSet(0) {}\";let d=globalThis.Array.from(f).map(m=>`${u(m)}`).sort();return`HashSet(${p}) { ${d.join(\", \")} }`}}case\"effect/schema/Chunk\":{let[u]=c;return f=>{let p=eN(f);if(p===0)return\"Chunk(0) {}\";let d=globalThis.Array.from(f).map(m=>`${u(m)}`);return`Chunk(${p}) { ${d.join(\", \")} }`}}default:return K}}case\"Arrays\":{let i=a.elements.map(d=>n(d)),c=a.rest.map(n),[u,...f]=c,p=f.length;return d=>{let m=[],h=0;for(;h<i.length;h++)if(d.length<h+1){if(nr(a.elements[h]))continue}else m.push(i[h](d[h]));if(c.length>0){for(;h<d.length-p;h++)m.push(u(d[h]));for(let y=0;y<p;y++)m.push(f[y](d[h+y]))}return\"[\"+m.join(\", \")+\"]\"}}case\"Objects\":{let i=a.propertySignatures.map(u=>n(u.type)),c=a.indexSignatures.map(u=>n(u.type));return a.propertySignatures.length===0&&a.indexSignatures.length===0?K:u=>{let f=[],p=new Set;for(let d=0;d<i.length;d++){let m=a.propertySignatures[d],h=m.name;p.add(h),!(nr(m.type)&&!Object.hasOwn(u,h))&&f.push(`${us(h)}: ${i[d](u[h])}`)}for(let d=0;d<c.length;d++){let m=Ms(u,a.indexSignatures[d].parameter);for(let h of m)p.has(h)||(p.add(h),f.push(`${us(h)}: ${c[d](u[h])}`))}return f.length>0?\"{ \"+f.join(\", \")+\" }\":\"{}\"}}case\"Union\":{let i=Mt(a).types,c=Im(i),u=i.map((f,p)=>[Om(f),n(a.types[p])]);return f=>{let p=c(f,!1);for(let d=0;d<p.length;d++){let[m,h]=u[p[d]];if(m(f))return h(f)}return K(f)}}case\"Suspend\":{let i;return c=>(i??=n(a.thunk()))(c)}}}}var yT=l(2,(e,t)=>ET(e,(r,n)=>W$(t,r)?[r,n]:void 0)),ST=l(2,(e,t)=>ET(e,(r,n)=>W$(t,r)?void 0:[r,n])),z$=l(2,(e,t)=>({...e,...t}));var bT=l(2,(e,t)=>ET(e,(r,n)=>[Object.hasOwn(t,r)?t[r]:r,n]));var Kr=e=>e;function W$(e,t){return e.some(r=>r===t||typeof r==\"number\"&&String(r)===t)}function ET(e,t){let r={};for(let n of Reflect.ownKeys(e)){if(!Object.prototype.propertyIsEnumerable.call(e,n))continue;let o=t(n,e[n]);if(o){let[s,a]=o;B(r,s,a)}}return r}function G$(e,t){return Qo(Sl(\"Iso\",e,t))}function q$(e,t){return Qo(Sl(\"Lens\",e,t))}function Sl(e,t,r){return[{_tag:\"PrimitiveNode\",kind:e,get:t,set:r}]}var PQ={kind:\"Iso\",get:D,set:D},fS=class{_tag=\"PathNode\";kind=\"Lens\";path;get;set;constructor(t){this.path=t,this.get=r=>{let n=r;for(let o=0;o<t.length;o++)n=n[t[o]];return n},this.set=(r,n)=>{let o=lS(n),s=o,a=0;for(;a<t.length-1;a++){let i=t[a];B(s,i,lS(s[i])),s=s[i]}return B(s,t[a],r),o}}},Mm=class{_tag=\"CheckNode\";kind=\"Prism\";checks;get;set=D;constructor(t){this.checks=t,this.get=r=>SL(t,r)}};function Su(e,t){if(e.length===0)return t;if(t.length===0)return e;let r=e.slice();for(let n=0;n<t.length;n++){let o=t[n],s=r[r.length-1];s._tag===\"PathNode\"&&o._tag===\"PathNode\"?r[r.length-1]=new fS([...s.path,...o.path]):s._tag===\"CheckNode\"&&o._tag===\"CheckNode\"?r[r.length-1]=new Mm([...s.checks,...o.checks]):r.push(o)}return r}function MQ(e,t){return Qo(Sl(\"Optional\",e,t))}var bl=class{node;getResult;replaceResult;constructor(t,r,n){this.node=t,this.getResult=r,this.replaceResult=n}replace(t,r){return _p(this.replaceResult(t,r),()=>r)}modify(t){return r=>_p(Yt(this.getResult(r),n=>this.replaceResult(t(n),r)),()=>r)}compose(t){return Qo(Su(this.node,t.node))}key(t){return Qo(Su(this.node,[new fS([t])]))}optionalKey(t){return Qo(Su(this.node,Sl(\"Lens\",r=>r[t],(r,n)=>{let o=lS(n);return r===void 0?Array.isArray(o)&&(typeof t==\"number\"||typeof t==\"string\"&&nf(t))?o.splice(Number(t),1):delete o[t]:B(o,t,r),o})))}check(...t){return Qo(Su(this.node,[new Mm(t)]))}refine(t,r){return Qo(Su(this.node,[new Mm([Ly(t,r)])]))}tag(t){let r=q(new fe({expected:`${JSON.stringify(t)} tag`}));return Qo(Su(this.node,Sl(\"Prism\",n=>n._tag===t?j(n):r,D)))}at(t,...r){let n=q(new Ot([t],new Ni(void 0)));return Qo(Su(this.node,Sl(\"Optional\",o=>Object.hasOwn(o,t)?j(o[t]):n,(o,s)=>{if(Object.hasOwn(s,t)){let a=lS(s);return B(a,t,o),j(a)}else return n})))}pick(t){return this.compose(q$(yT(t),(r,n)=>({...ST(n,t),...r})))}omit(t){return this.compose(q$(ST(t),(r,n)=>({...yT(n,t),...r})))}notUndefined(){return this.refine(cs,{expected:\"a value other than `undefined`\"})}forEach(t){let r=t(pS());return MQ(n=>sr(this.getResult(n),o=>{let s=[];for(let a=0;a<o.length;a++){let i=r.getResult(o[a]);rt(i)&&s.push(i.success)}return s}),(n,o)=>Yt(this.getResult(o),s=>{let a=[];for(let c=0;c<s.length;c++)rt(r.getResult(s[c]))&&a.push(c);if(n.length!==a.length)return q(new fe({message:`each: replacement length mismatch: ${n.length} !== ${a.length}`}));let i=s.slice();for(let c=0;c<a.length;c++){let u=a[c],f=r.replaceResult(n[c],s[u]);if(ae(f))return q(new Ot([u],f.failure));i[u]=f.success}return this.replaceResult(i,o)}))}modifyAll(t){return r=>_p(Yt(this.getResult(r),n=>this.replaceResult(n.map(t),r)),()=>r)}},wT=class extends bl{get;set;constructor(t,r,n){super(t,o=>j(r(o)),o=>j(n(o))),this.get=r,this.set=n}replace(t,r){return this.set(t)}modify(t){return r=>this.set(t(this.get(r)))}},AT=class extends bl{get;constructor(t,r,n){super(t,o=>j(r(o)),(o,s)=>j(n(o,s))),this.get=r,this.replace=n}modify(t){return r=>this.replace(t(this.get(r)),r)}},CT=class extends bl{set;constructor(t,r,n){super(t,r,(o,s)=>j(n(o))),this.set=n}replace(t,r){return this.set(t)}modify(t){return r=>_p(sr(this.getResult(r),n=>this.set(t(n))),()=>r)}};function Qo(e){let t=e[0]??PQ;if(e.length>1){let r=e.reduce((n,o)=>UQ(n,o.kind),\"Iso\");t={kind:r,get:FQ(e,r),set:NQ(e,r)}}switch(t.kind){case\"Iso\":return new wT(e,t.get,t.set);case\"Lens\":return new AT(e,t.get,t.set);case\"Prism\":return new CT(e,t.get,t.set);case\"Optional\":return new bl(e,t.get,t.set)}}function lS(e){if(Array.isArray(e))return e.slice();if(typeof e==\"object\"&&e!==null){let t=Object.getPrototypeOf(e);if(t!==Object.prototype&&t!==null)throw new Error(\"Cannot clone object with non-Object constructor or null prototype\");return{...e}}return e}function FQ(e,t){return r=>{for(let n=0;n<e.length;n++){let o=e[n],s=o.get(r);if(TT(o.kind)){if(ae(s))return s;r=s.success}else r=s}return TT(t)?j(r):r}}function NQ(e,t){return J$(t)?r=>{for(let n=e.length-1;n>=0;n--)r=e[n].set(r);return r}:(r,n)=>{let o=e.length,s=new Array(o);for(let a=0;a<o;a++){s[a]=n;let i=e[a];if(TT(i.kind)){let c=i.get(n);if(ae(c))return c;n=c.success}else n=i.get(n)}for(let a=o-1;a>=0;a--){let i=e[a];if(J$(i.kind))r=i.set(r);else if(i.kind===\"Lens\")r=i.set(r,s[a]);else{let c=i.set(r,s[a]);if(ae(c))return c;r=c.success}}return t===\"Optional\"?j(r):r}}function TT(e){return e===\"Prism\"||e===\"Optional\"}function J$(e){return e===\"Iso\"||e===\"Prism\"}function UQ(e,t){return e===\"Iso\"?t:t===\"Iso\"||e===t?e:\"Optional\"}var DQ=Qo([]);function pS(){return DQ}function Z$(e){let t=rS(e);return G$(Zy(t),Vy(t))}function Y$(e){return pS()}function Q$(e){return pS()}var El=\"~effect/Schema/SchemaError\";function X$(e){return A(e,El)&&e[El]===El}var eK=Kt((e,t)=>{if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0});var qn=\"~effect/net/NetAddress\";var Xo=e=>e.value,es=e=>e,Ra=e=>e.bytes,xo=class extends Ut(\"NetAddressError\"){},Il=e=>A(e,qn),Ir=e=>Il(e)&&e._tag===\"Ipv4Address\",go=e=>Il(e)&&e._tag===\"Ipv6Address\",vT=e=>Ir(e)||go(e),wl=e=>Ir(e)?32:128;var Al=e=>Il(e)&&e._tag===\"MacAddress\",Nm=e=>Il(e)&&e._tag===\"InetAddressV4\",Um=e=>Il(e)&&e._tag===\"InetAddressV6\",kT=e=>Nm(e)||Um(e),dS=e=>Il(e)&&e._tag===\"UnixPathAddress\",rK=e=>kT(e)||dS(e),$Q={...$t,_tag:\"Ipv4Address\",[qn]:qn,[ne](e){return Ir(e)&&Xo(this)===Xo(e)},[re](){return lr(Ee(jQ,Xo(this)|0))},toString(){return wr(this)},toJSON(){return this.toString()}},KQ={...$t,_tag:\"Ipv6Address\",[qn]:qn,[ne](e){if(!go(e))return!1;let t=es(this),r=es(e);return t.w0===r.w0&&t.w1===r.w1&&t.w2===r.w2&&t.w3===r.w3},[re](){let e=es(this),t=Ee(HQ,e.w0|0);return t=Ee(t,e.w1|0),t=Ee(t,e.w2|0),lr(Ee(t,e.w3|0))},toString(){return wr(this)},toJSON(){return this.toString()}},BQ={...$t,_tag:\"MacAddress\",[qn]:qn,[ne](e){return Al(e)&&eK(Ra(this),Ra(e))},[re](){return Ee(zQ,wo(Ra(this)))},toString(){return RT(this)},toJSON(){return this.toString()}},jQ=Pe(\"Ipv4Address\"),HQ=Pe(\"Ipv6Address\"),zQ=Pe(\"MacAddress\"),WQ=e=>{let t=Object.create($Q);return t.value=e>>>0,Object.freeze(t)},qQ=(e,t,r,n)=>{let o=Object.create(KQ);return o.w0=e>>>0,o.w1=t>>>0,o.w2=r>>>0,o.w3=n>>>0,Object.freeze(o)},JQ=(e,t,r,n)=>(e<<24|t<<16|r<<8|n)>>>0;var Fm=e=>[e>>>24,e>>>16&255,e>>>8&255,e&255],GQ=e=>{let t=Object.assign(Object.create(BQ),{bytes:new Uint8Array(e)});return Object.freeze(t)};var bt=(e,t)=>q(new xo({input:e,message:t})),nK=(e,t)=>{for(let r=0;r<e.length;r++){let n=e[r];if(!Number.isInteger(n)||n<0||n>t)return!1}return!0},VQ=e=>nK(e,255)?j(WQ(JQ(e[0],e[1],e[2],e[3]))):bt(e,\"octets must be integers from 0 through 255\"),ZQ=e=>nK(e,65535)?j(qQ(e[0]*65536+e[1],e[2]*65536+e[3],e[4]*65536+e[5],e[6]*65536+e[7])):bt(e,\"segments must be integers from 0 through 65535\");var oK=e=>/^(?:[0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$/.test(e)?j(GQ(new Uint8Array(e.split(\":\").map(t=>Number.parseInt(t,16))))):bt(e,\"expected six two-digit hexadecimal octets separated by colons\");var bu=e=>{let t=e.split(\".\");if(t.length!==4||t.some(n=>!/^\\d{1,3}$/.test(n)))return bt(e,\"expected exactly four decimal octets\");if(t.some(n=>n.length>1&&n[0]===\"0\"))return bt(e,\"leading zeroes are not allowed\");let r=t.map(Number);return r.some(n=>n>255)?bt(e,\"octets must be at most 255\"):VQ([r[0],r[1],r[2],r[3]])},YQ=e=>{if(e.includes(\"[\")||e.includes(\"]\")||e.includes(\"%\"))return bt(e,\"brackets and zone identifiers are not valid in a bare IPv6 address\");let t=e.split(\"::\");if(t.length>2)return bt(e,\"only one compression marker is allowed\");let r=t[0]===\"\"?[]:t[0].split(\":\"),n=t.length===2&&t[1]!==\"\"?t[1].split(\":\"):[];if(r.some(f=>f===\"\")||n.some(f=>f===\"\"))return bt(e,\"empty segments are only valid in the compression marker\");let o=n.length>0?n[n.length-1]:r.length>0?r[r.length-1]:\"\",s;if(o.includes(\".\")){if(t.length===2&&n.length===0)return bt(e,\"embedded IPv4 syntax must be trailing\");let f=sr(bu(o),p=>{let d=Xo(p);return[d>>>16,d&65535]});if(ae(f))return f;s=f.success,n.length>0?n.pop():r.pop()}let a=r.length+n.length+(s?2:0);if(t.length===1?a!==8:a>=8)return bt(e,t.length===1?\"expected eight segments\":\"compression must replace at least one segment\");let i=f=>/^[0-9a-fA-F]{1,4}$/.test(f)?Number.parseInt(f,16):void 0,c=r.map(i),u=n.map(i);return c.some(f=>f===void 0)||u.some(f=>f===void 0)?bt(e,\"segments must contain one through four hexadecimal digits\"):j([...c,...Array(8-a).fill(0),...u,...s??[]])},Eu=e=>Yt(YQ(e),t=>ZQ(t)),$i=e=>e.includes(\":\")?Eu(e):bu(e);var OT=e=>{if(typeof e!=\"string\"||!e.includes(\"%\"))return!1;let t=Dm(e);return rt(t)&&t.success===e},Dm=e=>{let t=e.indexOf(\"%\");if(t===-1)return bt(e,\"expected an IPv6 zone\");let r=e.slice(t+1);if(r.length===0||/[%[\\]/\\s\\p{Cc}]/u.test(r))return bt(e,\"invalid IPv6 scope identifier\");if(/^\\d+$/.test(r)){let n=Number(r);if(n>4294967295)return bt(e,\"scope identifier must be an unsigned 32-bit integer\");r=String(n)}return sr(Eu(e.slice(0,t)),n=>`${wr(n)}%${r}`)};var mS=e=>Fm(Xo(e)),QQ=e=>{let{w0:t,w1:r,w2:n,w3:o}=es(e);return[t>>>16,t&65535,r>>>16,r&65535,n>>>16,n&65535,o>>>16,o&65535]},_T=e=>{let{w0:t,w1:r,w2:n,w3:o}=es(e);return[...Fm(t),...Fm(r),...Fm(n),...Fm(o)]};var RT=e=>Array.from(Ra(e),t=>t.toString(16).padStart(2,\"0\")).join(\":\"),hS=e=>Ra(e).every(t=>t===255),XQ=e=>(Ra(e)[0]&1)!==0,xS=e=>(Ra(e)[0]&1)===0,PT=e=>(Ra(e)[0]&2)!==0,MT=e=>(Ra(e)[0]&2)===0;var wr=e=>{if(Ir(e))return mS(e).join(\".\");let t=QQ(e);if(eX(e))return`::ffff:${t[6]>>8}.${t[6]&255}.${t[7]>>8}.${t[7]&255}`;let r=-1,n=0,o=-1;for(let i=0;i<=8;i++)i<8&&t[i]===0?o===-1&&(o=i):o!==-1&&(i-o>n&&(r=o,n=i-o),o=-1);if(n<2)return t.map(i=>i.toString(16)).join(\":\");let s=t.slice(0,r).map(i=>i.toString(16)).join(\":\"),a=t.slice(r+n).map(i=>i.toString(16)).join(\":\");return`${s}::${a}`},gS=e=>{if(Ir(e))return Xo(e)===0;let{w0:t,w1:r,w2:n,w3:o}=es(e);return t===0&&r===0&&n===0&&o===0},FT=e=>{if(Ir(e))return Xo(e)>>>24===127;let{w0:t,w1:r,w2:n,w3:o}=es(e);return t===0&&r===0&&n===0&&o===1},Cl=e=>Al(e)?XQ(e):Ir(e)?Xo(e)>>>28===14:es(e).w0>>>24===255,yS=e=>Al(e)?hS(e):Xo(e)===4294967295,NT=e=>Al(e)?xS(e):!Cl(e)&&!gS(e)&&(!Ir(e)||!yS(e)),UT=e=>Ir(e)?Xo(e)>>>16===43518:(es(e).w0>>>16&65472)===65152,DT=e=>{let t=Xo(e);return t>>>24===10||(t>>>16&65520)===44048||t>>>16===49320},LT=e=>(es(e).w0>>>24&254)===252,eX=e=>{let{w0:t,w1:r,w2:n}=es(e);return t===0&&r===0&&n===65535};var tX={...$t,_tag:\"InetAddressV4\",[qn]:qn,[ne](e){return Nm(e)&&this.port===e.port&&Z(this.address,e.address)},[re](){return Ee(V(this.address),Lt(this.port))},toString(){return SS(this)},toJSON(){return this.toString()}},rX={...$t,_tag:\"InetAddressV6\",[qn]:qn,[ne](e){return Um(e)&&this.port===e.port&&this.scopeId===e.scopeId&&Z(this.address,e.address)},[re](){return Ee(Ee(V(this.address),Lt(this.port)),Lt(this.scopeId))},toString(){return SS(this)},toJSON(){return this.toString()}},sK=e=>Number.isInteger(e)&&e>=0&&e<=65535,nX=(e,t)=>{if(!sK(t))return bt(e,\"port must be an integer from 0 through 65535\");let r=Object.create(tX);return r.address=e,r.port=t,j(Object.freeze(r))},oX=(e,t,r)=>{if(!sK(t))return bt(e,\"port must be an integer from 0 through 65535\");let n=r?.scopeId??0;if(!Number.isInteger(n)||n<0||n>4294967295)return bt(e,\"scopeId must be an unsigned 32-bit integer\");let o=Object.create(rX);return o.address=e,o.port=t,o.scopeId=n,j(Object.freeze(o))};var $T=e=>{let t,r,n=0,o=e.startsWith(\"[\");if(o){let s=e.indexOf(\"]\");if(s<0||e[s+1]!==\":\"||e.indexOf(\"]\",s+1)!==-1)return bt(e,\"expected [IPv6]:port\");t=e.slice(1,s),r=e.slice(s+2);let a=t.indexOf(\"%\");if(a!==-1){let i=t.slice(a+1);if(t.indexOf(\"%\",a+1)!==-1||!/^\\d+$/.test(i))return bt(e,\"scope identifier must be decimal\");if(n=Number(i),!Number.isInteger(n)||n>4294967295)return bt(e,\"scope identifier must be an unsigned 32-bit integer\");t=t.slice(0,a)}}else{let s=e.lastIndexOf(\":\");if(s<0)return bt(e,\"expected host:port or [IPv6]:port\");if(e.indexOf(\":\")!==s)return bt(e,\"IPv6 addresses must be bracketed\");t=e.slice(0,s),r=e.slice(s+1)}return/^(0|[1-9]\\d*)$/.test(r)?Yt($i(t),s=>o!==go(s)?bt(e,\"only IPv6 addresses use brackets\"):go(s)?oX(s,Number(r),{scopeId:n}):nX(s,Number(r))):bt(e,\"port must be an unpadded decimal integer\")};var sX=e=>wr(e.address)+(Um(e)&&e.scopeId!==0?`%${e.scopeId}`:\"\");var SS=e=>{let t=sX(e);return Nm(e)?`${t}:${e.port}`:`[${t}]:${e.port}`};var aX={...$t,_tag:\"UnixPathAddress\",[qn]:qn,[ne](e){return dS(e)&&this.path===e.path},[re](){return Ee(Pe(\"UnixPathAddress\"),Pe(this.path))},toString(){return this.path},toJSON(){return this.toString()}},aK=e=>{let t=Object.create(aX);return t.path=e,Object.freeze(t)};var KT=\"~effect/net/Host\",Ki=(e,t)=>q(new xo({input:e,message:t})),iK=/^[a-z0-9_.-]*$/i,iX=/[\\u0080-\\uffff]/g,cX=/^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/,uX=/^(?:\\d+|0x[0-9a-f]*)$/,cK=e=>{if(e===\".\")return;let t=e.endsWith(\".\")?e.slice(0,-1):e;if(t.length===0)return\"domain name must not be empty\";if(t.length>253)return\"domain name must be at most 253 characters\";let r=t.split(\".\");for(let n of r){if(n.length===0)return\"domain name labels must not be empty\";if(n.length>63)return\"domain name labels must be at most 63 characters\";if(!cX.test(n))return\"domain name labels must contain only letters, digits, hyphens, or underscores and must not start or end with a hyphen\"}if(uX.test(r[r.length-1]))return\"the last domain name label must not be numeric\"},fX=e=>{if(iK.test(e))return e.toLowerCase();if(iK.test(e.normalize(\"NFC\").replace(iX,\"\")))try{return new URL(`http://${e}`).hostname}catch{return}},Pa=e=>typeof e==\"string\"&&/^[a-z0-9_.-]+$/.test(e)&&cK(e)===void 0;var jT=e=>A(e,KT),bS=e=>{let t=fX(e);if(t===void 0)return Ki(e,\"invalid domain name\");let r=cK(t);return r===void 0?j(t):Ki(e,r)};var lX=e=>{if(e.includes(\"%\"))return Dm(e);if(e.includes(\":\"))return $i(e);if(/^[\\d.]+$/.test(e)){let t=$i(e);if(rt(t))return t}return bS(e)};var pX=e=>typeof e==\"string\"?e:wr(e);var dX={...$t,_tag:\"HostPort\",[KT]:KT,[ne](e){return jT(e)&&this.port===e.port&&Z(this.host,e.host)},[re](){return Ee(V(this.host),Lt(this.port))},toString(){return HT(this)},toJSON(){return this.toString()}},mX=e=>Number.isInteger(e)&&e>=0&&e<=65535,hX=(e,t)=>{let r=Object.create(dX);return r.host=e,r.port=t,Object.freeze(r)};var uK=e=>{let t,r;if(e.startsWith(\"[\")){let o=e.indexOf(\"]\");if(o===-1||e[o+1]!==\":\")return Ki(e,\"expected [IPv6]:port\");if(t=e.slice(1,o),r=e.slice(o+2),!t.includes(\":\"))return Ki(e,\"only IPv6 addresses use brackets\")}else{let o=e.lastIndexOf(\":\");if(o===-1)return Ki(e,\"expected host:port\");if(e.indexOf(\":\")!==o)return Ki(e,\"IPv6 addresses must be bracketed\");t=e.slice(0,o),r=e.slice(o+1)}if(!/^(0|[1-9]\\d*)$/.test(r))return Ki(e,\"port must be an unpadded decimal integer\");let n=Number(r);return mX(n)?sr(lX(t),o=>hX(o,n)):Ki(e,\"port must be an integer from 0 through 65535\")};var HT=e=>{let t=pX(e.host);return t.includes(\":\")?`[${t}]:${e.port}`:`${t}:${e.port}`};var WT=\"~effect/net/Dns/DnsRecord\",zT=e=>Number.isInteger(e)&&e>=0&&e<=255,Tl=e=>Number.isInteger(e)&&e>=0&&e<=65535,pK=e=>Number.isInteger(e)&&e>=0&&e<=4294967295,Bi=e=>typeof e==\"string\",ES=e=>Fp(e)&&sn(e)&&pK(hs(e)),dK={A:{address:Ir},AAAA:{address:go},CAA:{critical:e=>typeof e==\"boolean\",tag:e=>Bi(e)&&/^[a-z0-9]+$/i.test(e),value:Bi},CNAME:{target:Pa},MX:{exchange:Pa,priority:Tl},NAPTR:{order:Tl,preference:Tl,flags:Bi,service:Bi,regexp:Bi,replacement:Pa},NS:{host:Pa},PTR:{host:e=>Bi(e)&&e.length>0},SOA:{primary:Pa,admin:e=>Bi(e)&&e.length>0,serial:pK,refresh:ES,retry:ES,expire:ES,minimum:ES},SRV:{target:Pa,port:Tl,priority:Tl,weight:Tl},TLSA:{certUsage:zT,selector:zT,matchingType:zT,data:e=>e instanceof Uint8Array&&e.length>0},TXT:{chunks:e=>Array.isArray(e)&&e.length>0&&e.every(Bi)}},qT=Object.keys(dK),xX=e=>qT.includes(e),JT=e=>A(e,WT),gX={...$t,[WT]:WT,[ne](e){return JT(e)&&e._tag===this._tag&&Object.keys(this).every(t=>Z(this[t],e[t]))},[re](){return dp(this,Object.keys(this))},toString(){return SX(this)},toJSON(){return{...this}}},mK=(e,t)=>{if(!xX(e))return q(new xo({input:e,message:\"unknown DNS record type\"}));let r=typeof t==\"object\"&&t!==null?t:{},n=Object.create(gX);n._tag=e;for(let[o,s]of Object.entries(dK[e])){let a=r[o];if(!s(a))return q(new xo({input:t,message:`invalid ${e} record ${o}`}));n[o]=Array.isArray(a)?Object.freeze([...a]):a instanceof Uint8Array?new Uint8Array(a):a}return j(Object.freeze(n))};var hK=new TextEncoder,xK=e=>`\\\\${e.toString().padStart(3,\"0\")}`,$m=e=>{let t='\"';for(let r of hK.encode(e))t+=r===34||r===92?`\\\\${String.fromCharCode(r)}`:r<32||r>126?xK(r):String.fromCharCode(r);return t+'\"'},yX=[34,36,40,41,59,64],lK=e=>{let t=hK.encode(e),r=\"\";for(let n=0;n<t.length;n++){let o=t[n];if(o===92){let s=t[n+1];s===46||s===92?(r+=`\\\\${String.fromCharCode(s)}`,n++):r+=\"\\\\\\\\\"}else o<=32||o>126?r+=xK(o):r+=yX.includes(o)?`\\\\${String.fromCharCode(o)}`:String.fromCharCode(o)}return r},SX=e=>{switch(e._tag){case\"A\":case\"AAAA\":return`${e._tag} ${wr(e.address)}`;case\"CAA\":return`CAA ${e.critical?128:0} ${e.tag} ${$m(e.value)}`;case\"CNAME\":return`CNAME ${e.target}`;case\"MX\":return`MX ${e.priority} ${e.exchange}`;case\"NAPTR\":return`NAPTR ${e.order} ${e.preference} ${$m(e.flags)} ${$m(e.service)} ${$m(e.regexp)} ${e.replacement}`;case\"NS\":return`NS ${e.host}`;case\"PTR\":return`PTR ${lK(e.host)}`;case\"SOA\":return`SOA ${e.primary} ${lK(e.admin)} ${e.serial} ${hs(e.refresh)} ${hs(e.retry)} ${hs(e.expire)} ${hs(e.minimum)}`;case\"SRV\":return`SRV ${e.priority} ${e.weight} ${e.port} ${e.target}`;case\"TLSA\":return`TLSA ${e.certUsage} ${e.selector} ${e.matchingType} ${gx(e.data).toUpperCase()}`;case\"TXT\":return`TXT ${e.chunks.map($m).join(\" \")}`}};var GT=\"~effect/net/IpInterface\",gK=e=>Km(e)&&Ir(e.address),yK=e=>Km(e)&&go(e.address),Km=e=>A(e,GT),wX={...$t,_tag:\"IpInterface\",[GT]:GT,[ne](e){return Km(e)&&this.prefixLength===e.prefixLength&&Z(this.address,e.address)},[re](){return Ee(V(this.address),Lt(this.prefixLength))},toString(){return jm(this)},toJSON(){return this.toString()}},VT=(e,t)=>q(new xo({input:e,message:t})),Bm=(e,t)=>{let r=wl(e);if(!Number.isInteger(t)||t<0||t>r)return VT(e,`prefix length must be an integer from 0 through ${r}`);let n=Object.assign(Object.create(wX),{address:e,prefixLength:t});return j(Object.freeze(n))},ZT=(e,t)=>{let r=e.indexOf(\"/\");if(r===-1&&t?.prefix!==\"required\")return j({address:e,prefixLength:void 0});if(r<=0||r!==e.lastIndexOf(\"/\")||r===e.length-1)return VT(e,\"expected an address and prefix length separated by one slash\");let n=e.slice(r+1);return/^(0|[1-9][0-9]*)$/.test(n)?j({address:e.slice(0,r),prefixLength:Number(n)}):VT(e,\"prefix length must be an unpadded ASCII decimal integer\")},IS=(e,t)=>Yt(ZT(e,t),r=>Yt(bu(r.address),n=>Bm(n,r.prefixLength??wl(n)))),wS=(e,t)=>Yt(ZT(e,t),r=>Yt(Eu(r.address),n=>Bm(n,r.prefixLength??wl(n)))),AS=(e,t)=>Yt(ZT(e,t),r=>Yt($i(r.address),n=>Bm(n,r.prefixLength??wl(n))));var jm=e=>`${wr(e.address)}/${e.prefixLength}`;var YT=\"~effect/net/IpNetwork\",bK=e=>Hm(e)&&Ir(e.address),EK=e=>Hm(e)&&go(e.address),Hm=e=>A(e,YT),AX={...$t,_tag:\"IpNetwork\",[YT]:YT,[ne](e){return Hm(e)&&this.prefixLength===e.prefixLength&&Z(this.address,e.address)},[re](){return Ee(V(this.address),Lt(this.prefixLength))},toString(){return zm(this)},toJSON(){return this.toString()}},CX=e=>{let t=Object.assign(Object.create(AX),{address:e.address,prefixLength:e.prefixLength});return Object.freeze(t)},TX=e=>Ir(e)?mS(e):_T(e);var vX=(e,t)=>{let r=Math.floor(t/8),n=t%8;return e.map((o,s)=>s<r?o:s===r&&n!==0?o&(255<<8-n&255):0)},QT=(e,t)=>Yt(Bm(e,t),r=>{let n=TX(e),o=vX(n,t);return n.some((s,a)=>s!==o[a])?q(new xo({input:e,message:\"address has non-zero host bits\"})):j(CX(r))});var IK=e=>Yt(IS(e,{prefix:\"required\"}),t=>QT(t.address,t.prefixLength)),wK=e=>Yt(wS(e,{prefix:\"required\"}),t=>QT(t.address,t.prefixLength)),AK=e=>Yt(AS(e,{prefix:\"required\"}),t=>QT(t.address,t.prefixLength));var zm=e=>`${wr(e.address)}/${e.prefixLength}`;var XT=\"~effect/SemVer\",ev=\"~effect/SemVer/SemVerError\",CS=class extends Ut(\"SemVerError\"){[ev]=ev},OX=e=>A(e,ev),yo=e=>{throw new CS({message:e})},_X=e=>lE({try:e,catch:t=>{if(!OX(t))throw t;return t}}),tv=(e,t,r)=>rf(_X(()=>r(t)),n=>new CS({message:`Invalid ${e} ${JSON.stringify(t)}: ${n.message}`,input:t})),RX=/^(?:0|[1-9]\\d*)$/,PX=/^\\d+$/,TK=/^[0-9A-Za-z-]+$/,Wm=(e,t)=>!Number.isSafeInteger(e)||e<0?yo(`${t} must be a non-negative safe integer, received ${e}`):e,vl=(e,t)=>RX.test(e)?Wm(Number(e),t):yo(`${t} must be a non-negative integer without leading zeros, received ${JSON.stringify(e)}`),TS=e=>typeof e==\"number\"?Wm(e,\"numeric pre-release identifier\"):TK.test(e)?PX.test(e)?vl(e,\"numeric pre-release identifier\"):e:yo(`pre-release identifier must be non-empty [0-9A-Za-z-], received ${JSON.stringify(e)}`),vK=e=>TK.test(e)?e:yo(`build identifier must be non-empty [0-9A-Za-z-], received ${JSON.stringify(e)}`);var MX={[XT]:XT,[ne](e){return rv(e)&&NX(this,e)},[re](){return Pe(Iu(this))},toString(){return`SemVer(${Iu(this)})`},toJSON(){return{_id:\"SemVer\",value:Iu(this)}},[Je](){return this.toJSON()},pipe(){return te(this,arguments)}},kK=(e,t,r,n,o)=>{let s=Object.create(MX);return s.major=e,s.minor=t,s.patch=r,s.prerelease=n,s.build=o,s};var rv=e=>A(e,XT),nv=e=>kK(Wm(e.major,\"major\"),Wm(e.minor,\"minor\"),Wm(e.patch,\"patch\"),e.prerelease?.map(TS)??[],e.build?.map(vK)??[]),FX=e=>{let t=e,r=[],n=t.indexOf(\"+\");n!==-1&&(r=t.slice(n+1).split(\".\").map(vK),t=t.slice(0,n));let o=[],s=t.indexOf(\"-\");s!==-1&&(o=t.slice(s+1).split(\".\").map(TS),t=t.slice(0,s));let a=t.split(\".\");return a.length!==3?yo(\"expected MAJOR.MINOR.PATCH\"):kK(vl(a[0],\"major\"),vl(a[1],\"minor\"),vl(a[2],\"patch\"),o,r)},OK=e=>tv(\"SemVer\",e,FX);var Iu=e=>{let t=`${e.major}.${e.minor}.${e.patch}`;return e.prerelease.length>0&&(t+=`-${e.prerelease.join(\".\")}`),e.build.length>0&&(t+=`+${e.build.join(\".\")}`),t};var CK=Vu(Wa()),NX=Kt((e,t)=>e.major===t.major&&e.minor===t.minor&&e.patch===t.patch&&CK(e.prerelease,t.prerelease)&&CK(e.build,t.build));var av=\"~effect/SemVerRange\",UX={[av]:av,[ne](e){return iv(e)&&ji(this)===ji(e)},[re](){return Pe(ji(this))},toString(){return`SemVerRange(${ji(this)})`},toJSON(){return{_id:\"SemVerRange\",value:ji(this)}},[Je](){return this.toJSON()},pipe(){return te(this,arguments)}},iv=e=>A(e,av);var DX={components:[],prerelease:[]},LX=/^(<=|>=|<|>|=|~|\\^)?(.*)$/,$X=e=>e===\"x\"||e===\"X\"||e===\"*\",KX=[\"major\",\"minor\",\"patch\"],ov=e=>{if(e.length===0)return yo(\"expected a version after the operator\");if(e.includes(\"+\"))return yo(`build metadata is not allowed in ranges, received ${JSON.stringify(e)}`);let t=e.indexOf(\"-\"),r=(t===-1?e:e.slice(0,t)).split(\".\");if(r.length>3)return yo(`expected at most MAJOR.MINOR.PATCH, received ${JSON.stringify(e)}`);let n=[];for(let o=0;o<r.length;o++)if(!$X(r[o])){if(n.length<o)return yo(`a version component cannot follow a wildcard, received ${JSON.stringify(e)}`);n.push(vl(r[o],KX[o]))}return t===-1?{components:n,prerelease:[]}:n.length<3?yo(`a pre-release requires MAJOR.MINOR.PATCH, received ${JSON.stringify(e)}`):{components:n,prerelease:e.slice(t+1).split(\".\").map(TS)}},BX=e=>{let t=e.split(/\\s+/).filter(n=>n.length>0);if(t.length===0)return yo(\"expected a comparator\");if(t.length===3&&t[1]===\"-\")return[{_tag:\"Hyphen\",from:ov(t[0]),to:ov(t[2])}];let r=[];for(let n=0;n<t.length;n++){let[,o,s]=LX.exec(t[n]),a=s.length===0&&o!==void 0&&n+1<t.length?t[++n]:s;r.push({_tag:\"Comparator\",operator:o??\"=\",version:ov(a)})}return r},RK=e=>{let t=Object.create(UX);return t.sets=e,t},jX=e=>e.trim().length===0?HX:RK(e.split(\"||\").map(BX)),cv=e=>tv(\"SemVer range\",e,jX),PK=e=>ms(cv(e));var HX=RK([[{_tag:\"Comparator\",operator:\"=\",version:DX}]]);var sv=e=>{if(e.components.length===0)return\"*\";let t=e.components.join(\".\");return e.prerelease.length===0?t:`${t}-${e.prerelease.join(\".\")}`},zX=e=>e._tag===\"Hyphen\"?`${sv(e.from)} - ${sv(e.to)}`:`${e.operator===\"=\"?\"\":e.operator}${sv(e.version)}`,ji=e=>e.sets.map(t=>t.map(zX).join(\" \")).join(\" || \");var qm=Qy;function yn(){return(e,t,r)=>Q(new fl(e.map(Em),n=>t(n.map(o=>Q(o))),r))}function je(e,t){return yn()([],()=>(r,n,o)=>e(r)?g(r):F(new _t(n,r,o)),t)}function WX(e){return e}function qX(e){return t=>t.annotate(e)}function JX(e){return t=>fv(fv(t).annotate(e))}function GX(e){return t=>t.rebuild(Tm(t.ast,e))}function VX(e){return e}var Ma=class extends Ut(\"SchemaError\"){[El]=El;constructor(t){let r=Co();pr(0);try{super({issue:t})}finally{pr(r)}}get message(){return U2(this.issue)}toJSON(){return{_tag:this._tag,message:this.message}}[Je](){return this.toJSON()}toString(){return`SchemaError(${this.message})`}};function JK(e){return X$(e)}function GK(e){return Ve(e)?hv(e):nt(e,t=>da(()=>fa(t,r=>new Ma(r))))}function hv(e){return ut(e)?e:Fn(fa(e.cause,t=>new Ma(t)))}function VK(e,t){let r;for(let n of e.reasons){if(!ai(n)||!JK(n.error))throw new globalThis.Error(t,{cause:e});r??=n.error}if(r===void 0)throw new globalThis.Error(t,{cause:e});return r}function ZK(e){return kg(e).then(t=>{if(ut(t))return t.value;throw VK(t.cause,\"Promise adapter can only reject schema errors\")})}function YK(e){let t=Ts(e);if(ut(t))return t.value;throw VK(t.cause,\"Sync adapter can only throw schema errors\")}function ZX(e,t){return O$(e,t)}function YX(e){return R$(e)}var QX=km,XX=RL;function OS(e,t){let r=St(e,t);return(n,o)=>GK(r(n,o))}var eee=OS;function QK(e,t){let r=PL(e,t);return(n,o)=>hv(r(n,o))}var tee=QK,ree=YC,nee=ML;function XK(e,t){let r=FL(e,t);return(n,o)=>rf(r(n,o),s=>new Ma(s))}var oee=XK;function eB(e,t){let r=OS(e,t);return(n,o)=>ZK(r(n,o))}var see=eB;function tB(e,t){let r=OS(e,t);return(n,o)=>YK(r(n,o))}var aee=tB;function _S(e,t){let r=hu(e,t);return(n,o)=>GK(r(n,o))}var iee=_S;function rB(e,t){let r=UL(e,t);return(n,o)=>hv(r(n,o))}var cee=rB,uee=QC,fee=DL;function nB(e,t){let r=LL(e,t);return(n,o)=>rf(r(n,o),s=>new Ma(s))}var lee=nB;function oB(e,t){let r=_S(e,t);return(n,o)=>ZK(r(n,o))}var pee=oB;function sB(e,t){let r=_S(e,t);return(n,o)=>YK(r(n,o))}var dee=sB,Q=Wn;function RS(e){return A(e,qm)&&e[qm]===qm}var rs=Kr(e=>Q(mu(e.ast),{schema:e})),mee=Kr(e=>e.schema),Pl=Kr(e=>{let t=NS(e);return Q(lL(e.ast),{schema:t})}),hee=Kr(e=>e.schema.members[0]),xee=Kr(e=>Q(UC(e.ast),{schema:e})),gee=Kr(e=>e.schema),Sn=Kr(e=>Q(Mt(e.ast),{schema:e})),Ml=Kr(e=>Q(gn(e.ast),{schema:e})),Jm=\"~effect/Schema/flip\";function yee(e){return A(e,Jm)&&e[Jm]===Jm}function fv(e){return yee(e)?e.schema.rebuild(Bn(e.ast)):Q(Bn(e.ast),{[Jm]:Jm,schema:e})}function zt(e){let t=Q(new Kn(e),{literal:e,transform(r){return t.pipe(J(zt(r),{decode:le(()=>r),encode:le(()=>e)}))}});return t}function aB(e){return e.map(t=>RS(t)?t.ast:new Kn(t))}function See(e){return Q(new IC(aB(e)),{parts:e})}function bee(e){return Q(qD(aB(e)),{parts:e})}function Eee(e){return Q(new WD(Object.keys(e).filter(t=>typeof e[e[t]]!=\"number\").map(t=>[t,e[t]])),{enums:e})}var iB=Q(ll),Iee=Q(HD),Fl=Q(Jo),PS=Q(ym),xv=Q(EC),H=Q(xn),wee=H,wu=Q(wC),Gm=Q(VD),cB=Q(ZD),Nl=Q(YD),Aee=Q(jD),Cee=Q(zD);function Tee(e){return Q(new GD(e))}function gv(e,t){return Q(e,{fields:t,mapFields(r,n){let o=r(this.fields);return gv(Ny(o,n?.unsafePreserveChecks?this.ast.checks:void 0),o)}})}function ve(e){return gv(Ny(e,void 0),e)}function vee(e){return Kr(t=>t.mapFields(z$(e)))}var kee=e=>typeof e==\"symbol\"?e:globalThis.String(e);function Oee(e){return function(t){let r={},n=Object.create(null),o=Object.create(null),s=new Set;for(let a of Reflect.ownKeys(t.fields)){let i=Ml(t.fields[a]),c=Object.hasOwn(e,a),u=c?e[a]:a,f=kee(u);if(s.has(f))throw new globalThis.Error(`Duplicate encoded keys: ${us(u)}`);s.add(f),B(r,u,i),c&&(n[a]=u,o[u]=a)}return ve(r).pipe(J(t,Ge({decode:bT(o),encode:bT(n)})))}}function _ee(e,t){return r=>{let n=gc(r.fields,Sn),o=ve({...n,...e});return r.pipe(J(o,Ge({decode:s=>{let a={...s};for(let i in e){let c=t[i],u=c(s);Ce(u)&&B(a,i,u.value)}return a},encode:s=>{let a={...s};for(let i in e)delete a[i];return a}})))}}function Na(e,t){return Q($y(e.ast,t.ast),{key:e,value:t})}function Ree(e,t){return Q(rL(e.ast,t.map(Em)),{schema:e,records:t})}function uB(e,t){return Q(e,{elements:t,mapElements(r,n){let o=r(this.elements);return uB(vC(o,n?.unsafePreserveChecks?this.ast.checks:void 0),o)}})}function Ds(e){return uB(vC(e),e)}function Pee(e,t){return Q(nL(e.ast,t.map(Em)),{schema:e,rest:t})}var Be=Kr(e=>Q(new jn(!1,[],[e.ast]),{value:e}));function MS(e,t,r){return t!==void 0&&r!==void 0?e.check(Av(t,r)):t!==void 0?e.check(wv(t)):r!==void 0?e.check(_B(r)):e}var FS=Kr(e=>Q(new jn(!1,[e.ast],[e.ast]),{value:e}));function Mee(e){let t=Be(e),r=Be(Sn(e)),n=J(Ds([Fl]),Ge({decode:o=>[o],encode:([o])=>o}))(e);return Q(st([n,t]).pipe(J(r)).ast,{from:st([e,t]),to:r})}function Fee(e){return Be(e).check(Tv())}var Nee=Kr(e=>Q(oL(e.ast),{schema:e}));function fB(e,t){return Q(e,{members:t,mapMembers(r,n){let o=r(this.members);return fB(Uy(o,this.ast.options,n?.unsafePreserveChecks?this.ast.checks:void 0),o)}})}function st(e,t){return fB(Uy(e,t,void 0),e)}function Jn(e){let t=e.map(zt);return Q(Uy(t,void 0,void 0),{literals:e,members:t,mapMembers(r){return st(r(this.members))},pick(r){return Jn(r)},transform(r){return st(t.map((n,o)=>n.transform(r[o])))}})}var yv=Kr(e=>st([e,PS])),NS=Kr(e=>st([e,xv])),lB=Kr(e=>st([e,PS,xv]));function pB(e){return Q(new OC(()=>e().ast))}function Uee(...e){return t=>t.check(...e)}function dB(e,t){return r=>Q(Us(r.ast,[Ly(e,t)]),{schema:r})}function US(e){return t=>Q(t.ast,{schema:t,identifier:e})}function Dee(e,t){return r=>(t.checks?r.check(...t.checks):r).pipe(US(e))}function mB(e){return t=>Q(uL(t.ast,new Ty(e,D)),{schema:t})}function hB(e){return t=>Q(fL(t.ast,new Ty(D,e)),{schema:t})}function Lee(e){return xB(e)}function xB(e){return t=>mB($f(e))(t)}function $ee(e){return gB(e)}function gB(e){return t=>hB($f(e))(t)}function J(e,t){return r=>Q(Oa(r.ast,e.ast,t?vy(t):nl()),{from:r,to:e})}function Hi(){return(e,t)=>ke()(e,{decode:t,encode:$2})}var yB=Jn([\"true\",\"yes\",\"on\",\"1\",\"y\"]),SB=Jn([\"false\",\"no\",\"off\",\"0\",\"n\"]),Sv=Jn([...yB.literals,...SB.literals]).pipe(J(Gm,Ge({decode:e=>e===\"true\"||e===\"yes\"||e===\"on\"||e===\"1\"||e===\"y\",encode:e=>e?\"true\":\"false\"})));function Kee(e){return t=>J(Sn(t),e)(t)}function bv(e,t){return r=>t?J(r,t)(e):J(r)(e)}function Bee(e){return t=>J(t,e)(Ml(t))}function bB(e){return t=>Q(pL(t.ast,e),{schema:t})}function EB(e){return Ve(e)&&e._tag===\"Success\"?e:nt(e,t=>da(()=>fa(t,r=>r.issue)))}function Ev(e,t){let r=t?.encodingStrategy===\"omit\"?nC():hn();return n=>rs(Ml(n)).pipe(J(n,{decode:oC(EB(e)),encode:r}))}function jee(e,t){return r=>Sn(r).pipe(Ev(e,t),bv(rs(r)))}function IB(e,t){let r=t?.encodingStrategy===\"omit\"?nC():hn();return n=>Pl(Ml(n)).pipe(J(n,{decode:oC(EB(e)),encode:r}))}function Hee(e,t){return r=>Sn(r).pipe(IB(e,t),bv(Pl(r)))}function Fa(e){return zt(e).pipe(bB(g(e)))}function zee(e){return Fa(e).pipe(Ev(g(e),{encodingStrategy:\"omit\"}))}function Vm(e,t){return ve({_tag:Fa(e),...t})}function wB(e){return t=>{let r={},n=[],o=new Set,s={},a=f=>p=>f.includes(p[e]);return i(t),Object.assign(t,{tag:e,cases:r,discriminants:n,isAnyOf:a,guards:s,match:c,matchOrElse:u});function i(f){let p=f.ast;if(Fy(p)&&\"members\"in f&&globalThis.Array.isArray(f.members)&&f.members.every(RS))return f.members.forEach(i);let d=il(p);if(d.length>0){let m=d.find(h=>h.key===e)?.literal;if(vh(m)){let h=typeof m==\"number\"?globalThis.String(m):m;if(o.has(h))throw new globalThis.Error(`Duplicate discriminant: ${globalThis.String(m)}`);o.add(h),n.push(m),B(r,m,f),B(s,m,km(Sn(f)));return}}throw new globalThis.Error(\"No literal or unique symbol found\")}function c(){if(arguments.length===1){let h=arguments[0];return function(y){let S=y[e];return(Object.hasOwn(h,S)?h[S]:void 0)(y)}}let f=arguments[0],p=arguments[1],d=f[e];return(Object.hasOwn(p,d)?p[d]:void 0)(f)}function u(){if(arguments.length===2){let y=arguments[0],S=arguments[1];return function(b){let x=b[e];return(Object.hasOwn(y,x)?y[x]??S:S)(b)}}let f=arguments[0],p=arguments[1],d=arguments[2],m=f[e];return(Object.hasOwn(p,m)?p[m]??d:d)(f)}}}function Wee(e){let t={},r=[];for(let u of Object.keys(e)){let f=Vm(u,e[u]);B(t,u,f),r.push(f)}let n=st(r),{tag:o,guards:s,isAnyOf:a,match:i,matchOrElse:c}=wB(\"_tag\")(n);return Q(n.ast,{tag:o,cases:t,isAnyOf:a,guards:s,match:i,matchOrElse:c})}function qee(){return e=>e}function Au(e,t){return je(r=>r instanceof e,t)}function ke(){return(e,t)=>new Tt(e.ast,vy(t))}var Ne=Dy;function Jee(e,t=void 0){return new fu(e,t)}var FK=\"^\\\\S[\\\\s\\\\S]*\\\\S$|^\\\\S$|^$\";function AB(e){let t=new globalThis.RegExp(FK);return Ne(r=>r.trim()===r,{expected:\"a string with no leading or trailing whitespace\",representation:{id:\"effect/schema/isTrimmed\",payload:null},toJsonSchema:()=>({pattern:t.source}),toCode:()=>({runtime:\"Schema.isTrimmed()\"}),arbitraryConstraint:{patterns:[{source:FK,flags:\"\"}]},...e})}function zi(e,t){let r=e.source,n=e.flags,o=/^[dg]*uy?$/.test(n),s=n===\"\"?`new globalThis.RegExp(${K(r)})`:`new globalThis.RegExp(${K(r)}, ${K(n)})`;return wm(e,{toJsonSchema:()=>o?{pattern:n.endsWith(\"y\")?`^(?:${r})`:r}:[{},!0],toCode:()=>({runtime:`Schema.isPattern(${s})`}),...t})}function Gee(e){return $C({toCode:()=>({runtime:\"Schema.isStringFinite()\"}),...e})}function Vee(e){return KC({toCode:()=>({runtime:\"Schema.isStringBigInt()\"}),...e})}function Zee(e){return jC({toCode:()=>({runtime:\"Schema.isStringSymbol()\"}),...e})}var Yee=e=>e?new globalThis.RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${e}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`):/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|[fF]{8}-[fF]{4}-[fF]{4}-[fF]{4}-[fF]{12})$/;function Qee(e,t){let r=Yee(e);return zi(r,{expected:e?`a UUID v${e}`:\"a UUID\",representation:{id:\"effect/schema/isUUID\",payload:{version:e??null}},toJsonSchema:()=>({pattern:r.source,format:\"uuid\"}),toCode:()=>({runtime:e===void 0?\"Schema.isUUID()\":`Schema.isUUID(${e})`}),...t})}var Xee=/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/u;function ete(e){return zi(Xee,{expected:\"a GUID\",representation:{id:\"effect/schema/isGUID\",payload:null},toCode:()=>({runtime:\"Schema.isGUID()\"}),...e})}var tte=/^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/u;function rte(e){return zi(tte,{representation:{id:\"effect/schema/isULID\",payload:null},toCode:()=>({runtime:\"Schema.isULID()\"}),...e})}var nte=/^[\\x00-\\x7F]*$/u;function ote(e){return zi(nte,{expected:\"an ASCII string\",representation:{id:\"effect/schema/isAscii\",payload:null},toCode:()=>({runtime:\"Schema.isAscii()\"}),...e})}function CB(e){let t=\"^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$\",r=/^[0-9a-zA-Z+/]*={0,2}$/;return Ne(n=>n.length%4===0&&r.test(n),{expected:\"a base64 encoded string\",representation:{id:\"effect/schema/isBase64\",payload:null},toJsonSchema:()=>({pattern:t}),arbitraryConstraint:{patterns:[{source:t,flags:\"\"}]},toCode:()=>({runtime:\"Schema.isBase64()\"}),...e})}function ste(e){let t=\"^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$\",r=/^[0-9a-zA-Z-_]*={0,2}$/;return Ne(n=>r.test(n)&&(n.endsWith(\"=\")?n.length%4===0:n.length%4!==1),{expected:\"a base64url encoded string\",representation:{id:\"effect/schema/isBase64Url\",payload:null},toJsonSchema:()=>({pattern:t}),arbitraryConstraint:{patterns:[{source:t,flags:\"\"}]},toCode:()=>({runtime:\"Schema.isBase64Url()\"}),...e})}function Iv(e,t,r){if(e.length===0)return t.length===0?{}:[{},!0];let n={pattern:new globalThis.RegExp(r).source};return e===t?n:[n,!0]}function ate(e,t){let r=JSON.stringify(e),n=new globalThis.RegExp(`^${_a(e)}`),o=e.replace(/[\\uD800-\\uDBFF]$/,\"\");return Ne(s=>s.startsWith(e),{expected:`a string starting with ${r}`,representation:{id:\"effect/schema/isStartingWith\",payload:{startsWith:e}},toJsonSchema:()=>Iv(o,e,`^${_a(o)}`),toCode:()=>({runtime:`Schema.isStartingWith(${K(e)})`}),arbitraryConstraint:{patterns:[{source:n.source,flags:n.flags}]},...t})}function ite(e,t){let r=JSON.stringify(e),n=new globalThis.RegExp(`${_a(e)}$`),o=e.replace(/^[\\uDC00-\\uDFFF]/,\"\");return Ne(s=>s.endsWith(e),{expected:`a string ending with ${r}`,representation:{id:\"effect/schema/isEndingWith\",payload:{endsWith:e}},toJsonSchema:()=>Iv(o,e,`${_a(o)}$`),toCode:()=>({runtime:`Schema.isEndingWith(${K(e)})`}),arbitraryConstraint:{patterns:[{source:n.source,flags:n.flags}]},...t})}function cte(e,t){let r=JSON.stringify(e),n=new globalThis.RegExp(_a(e)),o=e.replace(/^[\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF]$/g,\"\");return Ne(s=>s.includes(e),{expected:`a string including ${r}`,representation:{id:\"effect/schema/isIncluding\",payload:{includes:e}},toJsonSchema:()=>Iv(o,e,_a(o)),toCode:()=>({runtime:`Schema.isIncluding(${K(e)})`}),arbitraryConstraint:{patterns:[{source:n.source,flags:n.flags}]},...t})}var NK=\"^[^a-z]*$\";function ute(e){let t=new globalThis.RegExp(NK);return Ne(r=>r.toUpperCase()===r,{expected:\"a string with all characters in uppercase\",representation:{id:\"effect/schema/isUppercased\",payload:null},toJsonSchema:()=>[{pattern:t.source},!0],toCode:()=>({runtime:\"Schema.isUppercased()\"}),arbitraryConstraint:{patterns:[{source:NK,flags:\"\"}]},...e})}var UK=\"^[^A-Z]*$\";function fte(e){let t=new globalThis.RegExp(UK);return Ne(r=>r.toLowerCase()===r,{expected:\"a string with all characters in lowercase\",representation:{id:\"effect/schema/isLowercased\",payload:null},toJsonSchema:()=>[{pattern:t.source},!0],toCode:()=>({runtime:\"Schema.isLowercased()\"}),arbitraryConstraint:{patterns:[{source:UK,flags:\"\"}]},...e})}var DK=\"^(?:[^a-z][\\\\s\\\\S]*)?$\";function lte(e){return Ne(t=>{let[r=\"\"]=t;return r.toUpperCase()===r},{expected:\"a string with the first character in uppercase\",representation:{id:\"effect/schema/isCapitalized\",payload:null},toJsonSchema:()=>[{pattern:DK},!0],toCode:()=>({runtime:\"Schema.isCapitalized()\"}),arbitraryConstraint:{patterns:[{source:DK,flags:\"\"}]},...e})}var LK=\"^(?:[^A-Z][\\\\s\\\\S]*)?$\";function pte(e){return Ne(t=>{let[r=\"\"]=t;return r.toLowerCase()===r},{expected:\"a string with the first character in lowercase\",representation:{id:\"effect/schema/isUncapitalized\",payload:null},toJsonSchema:()=>[{pattern:LK},!0],toCode:()=>({runtime:\"Schema.isUncapitalized()\"}),arbitraryConstraint:{patterns:[{source:LK,flags:\"\"}]},...e})}var Ul=Q(RC),dte=_C;function Zm(e){let t=ef(e.order),r=e.formatter??K;return(n,o)=>Ne(s=>t(s,n),{expected:`a value greater than ${r(n)}`,arbitraryConstraint:{order:e.order,minimum:n,exclusiveMinimum:!0},...e.annotate?.(n),...o})}function Ym(e){let t=Vh(e.order),r=e.formatter??K;return(n,o)=>Ne(s=>t(s,n),{expected:`a value greater than or equal to ${r(n)}`,arbitraryConstraint:{order:e.order,minimum:n},...e.annotate?.(n),...o})}function Qm(e){let t=Jh(e.order),r=e.formatter??K;return(n,o)=>Ne(s=>t(s,n),{expected:`a value less than ${r(n)}`,arbitraryConstraint:{order:e.order,maximum:n,exclusiveMaximum:!0},...e.annotate?.(n),...o})}function Xm(e){let t=Gh(e.order),r=e.formatter??K;return(n,o)=>Ne(s=>t(s,n),{expected:`a value less than or equal to ${r(n)}`,arbitraryConstraint:{order:e.order,maximum:n},...e.annotate?.(n),...o})}function eh(e){let t=Vh(e.order),r=ef(e.order),n=Gh(e.order),o=Jh(e.order),s=e.formatter??K;return(a,i)=>{let c=a.exclusiveMinimum?r:t,u=a.exclusiveMaximum?o:n;return Ne(f=>c(f,a.minimum)&&u(f,a.maximum),{expected:`a value between ${s(a.minimum)}${a.exclusiveMinimum?\" (excluded)\":\"\"} and ${s(a.maximum)}${a.exclusiveMaximum?\" (excluded)\":\"\"}`,arbitraryConstraint:{order:e.order,minimum:a.minimum,maximum:a.maximum,...a.exclusiveMinimum&&{exclusiveMinimum:!0},...a.exclusiveMaximum&&{exclusiveMaximum:!0}},...e.annotate?.(a),...i})}}function mte(e){return(t,r)=>{let n=e.formatter??K;return Ne(o=>e.remainder(o,t)===e.zero,{expected:`a value that is a multiple of ${n(t)}`,...e.annotate?.(t),...r})}}function Ol(e){if(!globalThis.Number.isFinite(e))throw new globalThis.RangeError(`Expected a finite number, got ${K(e)}`);return e}var hte=Zm({order:Qs,annotate:e=>({representation:{id:\"effect/schema/isGreaterThan\",payload:{exclusiveMinimum:Ol(e)}},toJsonSchema:()=>({exclusiveMinimum:e}),toCode:()=>({runtime:`Schema.isGreaterThan(${K(e)})`})})}),TB=Ym({order:Qs,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanOrEqualTo\",payload:{minimum:Ol(e)}},toJsonSchema:()=>({minimum:e}),toCode:()=>({runtime:`Schema.isGreaterThanOrEqualTo(${K(e)})`})})}),xte=Qm({order:Qs,annotate:e=>({representation:{id:\"effect/schema/isLessThan\",payload:{exclusiveMaximum:Ol(e)}},toJsonSchema:()=>({exclusiveMaximum:e}),toCode:()=>({runtime:`Schema.isLessThan(${K(e)})`})})}),gte=Xm({order:Qs,annotate:e=>({representation:{id:\"effect/schema/isLessThanOrEqualTo\",payload:{maximum:Ol(e)}},toJsonSchema:()=>({maximum:e}),toCode:()=>({runtime:`Schema.isLessThanOrEqualTo(${K(e)})`})})}),Ls=eh({order:Qs,annotate:e=>{let t=e.exclusiveMinimum?!0:void 0,r=e.exclusiveMaximum?!0:void 0;return{representation:{id:\"effect/schema/isBetween\",payload:{minimum:Ol(e.minimum),maximum:Ol(e.maximum),...t&&{exclusiveMinimum:t},...r&&{exclusiveMaximum:r}}},toJsonSchema:()=>({[t?\"exclusiveMinimum\":\"minimum\"]:e.minimum,[r?\"exclusiveMaximum\":\"maximum\"]:e.maximum}),toCode:()=>({runtime:`Schema.isBetween({ minimum: ${K(e.minimum)}, maximum: ${K(e.maximum)}, exclusiveMinimum: ${K(t)}, exclusiveMaximum: ${K(r)} })`})}}});function yte(e,t){if(!globalThis.Number.isFinite(e)||e===0)throw new globalThis.RangeError(`Expected a finite non-zero number, got ${globalThis.String(e)}`);return e=globalThis.Math.abs(e),Ne(r=>D1(r,e)===0,{expected:`a value that is a multiple of ${e}`,representation:{id:\"effect/schema/isMultipleOf\",payload:{divisor:e}},toJsonSchema:()=>({multipleOf:e}),toCode:()=>({runtime:`Schema.isMultipleOf(${K(e)})`}),...t})}function DS(e){return Ne(t=>globalThis.Number.isSafeInteger(t),{expected:\"an integer\",representation:{id:\"effect/schema/isInt\",payload:null},toJsonSchema:()=>({type:\"integer\",minimum:globalThis.Number.MIN_SAFE_INTEGER,maximum:globalThis.Number.MAX_SAFE_INTEGER}),toCode:()=>({runtime:\"Schema.isInt()\"}),arbitraryConstraint:{number:\"integer\"},...e})}var en=wu.check(DS()),ts=en.check(TB(0));function Ste(e){return new fu([DS(),Ls({minimum:-2147483648,maximum:2147483647})],{expected:\"a 32-bit integer\",...e})}function bte(e){return new fu([DS(),Ls({minimum:0,maximum:4294967295})],{expected:\"a 32-bit unsigned integer\",...e})}function _l(e){if(globalThis.Number.isNaN(e.getTime()))throw new globalThis.RangeError(`Expected a valid Date, got ${K(e)}`);return e.toISOString()}function Rl(e){return`new globalThis.Date(${K(e.getTime())})`}var Ete=Zm({order:Xu,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanDate\",payload:{exclusiveMinimum:_l(e)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isGreaterThanDate(${Rl(e)})`})})}),Ite=Ym({order:Xu,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanOrEqualToDate\",payload:{minimum:_l(e)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isGreaterThanOrEqualToDate(${Rl(e)})`})})}),wte=Qm({order:Xu,annotate:e=>({representation:{id:\"effect/schema/isLessThanDate\",payload:{exclusiveMaximum:_l(e)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isLessThanDate(${Rl(e)})`})})}),Ate=Xm({order:Xu,annotate:e=>({representation:{id:\"effect/schema/isLessThanOrEqualToDate\",payload:{maximum:_l(e)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isLessThanOrEqualToDate(${Rl(e)})`})})}),Cte=eh({order:Xu,annotate:e=>{let t=e.exclusiveMinimum?!0:void 0,r=e.exclusiveMaximum?!0:void 0;return{representation:{id:\"effect/schema/isBetweenDate\",payload:{minimum:_l(e.minimum),maximum:_l(e.maximum),...t&&{exclusiveMinimum:t},...r&&{exclusiveMaximum:r}}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isBetweenDate({ minimum: ${Rl(e.minimum)}, maximum: ${Rl(e.maximum)}, exclusiveMinimum: ${K(t)}, exclusiveMaximum: ${K(r)} })`})}}}),Tte=Zm({order:Qu,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanBigInt\",payload:{exclusiveMinimum:e.toString(10)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isGreaterThanBigInt(${K(e)})`})})}),vB=Ym({order:Qu,annotate:e=>({representation:{id:\"effect/schema/isGreaterThanOrEqualToBigInt\",payload:{minimum:e.toString(10)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isGreaterThanOrEqualToBigInt(${K(e)})`})})}),vte=Qm({order:Qu,annotate:e=>({representation:{id:\"effect/schema/isLessThanBigInt\",payload:{exclusiveMaximum:e.toString(10)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isLessThanBigInt(${K(e)})`})})}),kte=Xm({order:Qu,annotate:e=>({representation:{id:\"effect/schema/isLessThanOrEqualToBigInt\",payload:{maximum:e.toString(10)}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isLessThanOrEqualToBigInt(${K(e)})`})})}),Ote=eh({order:Qu,annotate:e=>{let t=e.exclusiveMinimum?!0:void 0,r=e.exclusiveMaximum?!0:void 0;return{representation:{id:\"effect/schema/isBetweenBigInt\",payload:{minimum:e.minimum.toString(10),maximum:e.maximum.toString(10),...t&&{exclusiveMinimum:t},...r&&{exclusiveMaximum:r}}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isBetweenBigInt({ minimum: ${K(e.minimum)}, maximum: ${K(e.maximum)}, exclusiveMinimum: ${K(t)}, exclusiveMaximum: ${K(r)} })`})}}});function wv(e,t){return e=Br(e),kB(e,Math.ceil(e/2),t)}function kB(e,t,r){return Ne(n=>n.length>=e,{expected:`a value with a length of at least ${e}`,representation:{id:\"effect/schema/isMinLength\",payload:{minLength:e}},toJsonSchema:({type:n})=>n===\"string\"?e<=1?{minLength:t}:[{minLength:t},!0]:n===\"array\"?{minItems:e}:n===void 0?[{minLength:t,minItems:e},!0]:[{},!0],toCode:()=>({runtime:`Schema.isMinLength(${e})`}),[pn]:!0,arbitraryConstraint:{minLength:e},...r})}function OB(e){return kB(1,1,e)}function _B(e,t){return e=Br(e),Ne(r=>r.length<=e,{expected:`a value with a length of at most ${e}`,representation:{id:\"effect/schema/isMaxLength\",payload:{maxLength:e}},toJsonSchema:({type:r})=>r===\"string\"?e===0?{maxLength:e}:[{maxLength:e},!0]:r===\"array\"?{maxItems:e}:r===void 0?[{maxLength:e,maxItems:e},!0]:[{},!0],toCode:()=>({runtime:`Schema.isMaxLength(${e})`}),[pn]:!0,arbitraryConstraint:{maxLength:e},...t})}function Av(e,t,r){return e=Br(e),t=Br(t),Ne(n=>n.length>=e&&n.length<=t,{expected:e===t?`a value with a length of ${e}`:`a value with a length between ${e} and ${t}`,representation:{id:\"effect/schema/isBetweenLength\",payload:{minimum:e,maximum:t}},toJsonSchema:({type:n})=>n===\"string\"?t===0||Math.ceil(e/2)>t?{minLength:Math.ceil(e/2),maxLength:t}:[{minLength:Math.ceil(e/2),maxLength:t},!0]:n===\"array\"?{minItems:e,maxItems:t}:n===void 0?[{minLength:Math.ceil(e/2),maxLength:t,minItems:e,maxItems:t},!0]:[{},!0],toCode:()=>({runtime:`Schema.isBetweenLength(${e}, ${t})`}),[pn]:!0,arbitraryConstraint:{minLength:e,maxLength:t},...r})}function _te(e,t){return e=Br(e),Ne(r=>Cv(r,e)>=e,{expected:`a string with at least ${e} code points`,representation:{id:\"effect/schema/isMinCodePoints\",payload:{minCodePoints:e}},toJsonSchema:()=>({minLength:e}),toCode:()=>({runtime:`Schema.isMinCodePoints(${e})`}),arbitraryConstraint:{minCodePoints:e},...t})}function Rte(e,t){return e=Br(e),Ne(r=>Cv(r,e+1)<=e,{expected:`a string with at most ${e} code points`,representation:{id:\"effect/schema/isMaxCodePoints\",payload:{maxCodePoints:e}},toJsonSchema:()=>({maxLength:e}),toCode:()=>({runtime:`Schema.isMaxCodePoints(${e})`}),arbitraryConstraint:{maxCodePoints:e},...t})}function Pte(e,t,r){return e=Br(e),t=Br(t),Ne(n=>{let o=Cv(n,t+1);return o>=e&&o<=t},{expected:e===t?`a string with ${e} code points`:`a string with between ${e} and ${t} code points`,representation:{id:\"effect/schema/isBetweenCodePoints\",payload:{minimum:e,maximum:t}},toJsonSchema:()=>({allOf:[{minLength:e},{maxLength:t}]}),toCode:()=>({runtime:`Schema.isBetweenCodePoints(${e}, ${t})`}),arbitraryConstraint:{minCodePoints:e,maxCodePoints:t},...r})}function Cv(e,t){if(t===0)return 0;let r=0;for(let n of e)if(++r>=t)break;return r}function Br(e){if(!globalThis.Number.isFinite(e))throw new globalThis.RangeError(`Expected a finite number, got ${e}`);return Math.max(0,Math.floor(e))}function Mte(e,t){return e=Br(e),Ne(r=>r.size>=e,{expected:`a value with a size of at least ${e}`,representation:{id:\"effect/schema/isMinSize\",payload:{minSize:e}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isMinSize(${e})`}),[pn]:!0,arbitraryConstraint:{minSize:e},...t})}function Fte(e,t){return e=Br(e),Ne(r=>r.size<=e,{expected:`a value with a size of at most ${e}`,representation:{id:\"effect/schema/isMaxSize\",payload:{maxSize:e}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isMaxSize(${e})`}),[pn]:!0,arbitraryConstraint:{maxSize:e},...t})}function Nte(e,t,r){return e=Br(e),t=Br(t),Ne(n=>n.size>=e&&n.size<=t,{expected:e===t?`a value with a size of ${e}`:`a value with a size between ${e} and ${t}`,representation:{id:\"effect/schema/isBetweenSize\",payload:{minimum:e,maximum:t}},toJsonSchema:()=>[{},!0],toCode:()=>({runtime:`Schema.isBetweenSize(${e}, ${t})`}),[pn]:!0,arbitraryConstraint:{minSize:e,maxSize:t},...r})}function Ute(e,t){return e=Br(e),Ne(r=>Reflect.ownKeys(r).length>=e,{expected:`a value with at least ${e===1?\"1 entry\":`${e} entries`}`,representation:{id:\"effect/schema/isMinProperties\",payload:{minProperties:e}},toJsonSchema:({type:r})=>r===\"object\"?{minProperties:e}:[{minProperties:e},!0],toCode:()=>({runtime:`Schema.isMinProperties(${e})`}),[pn]:!0,arbitraryConstraint:{minProperties:e},...t})}function Dte(e,t){return e=Br(e),Ne(r=>Reflect.ownKeys(r).length<=e,{expected:`a value with at most ${e===1?\"1 entry\":`${e} entries`}`,representation:{id:\"effect/schema/isMaxProperties\",payload:{maxProperties:e}},toJsonSchema:({type:r})=>r===\"object\"?{maxProperties:e}:[{maxProperties:e},!0],toCode:()=>({runtime:`Schema.isMaxProperties(${e})`}),[pn]:!0,arbitraryConstraint:{maxProperties:e},...t})}function Lte(e,t,r){return e=Br(e),t=Br(t),Ne(n=>Reflect.ownKeys(n).length>=e&&Reflect.ownKeys(n).length<=t,{expected:e===t?`a value with exactly ${e===1?\"1 entry\":`${e} entries`}`:`a value with between ${e} and ${t} entries`,representation:{id:\"effect/schema/isBetweenProperties\",payload:{minimum:e,maximum:t}},toJsonSchema:({type:n})=>n===\"object\"?{minProperties:e,maxProperties:t}:[{minProperties:e,maxProperties:t},!0],toCode:()=>({runtime:`Schema.isBetweenProperties(${e}, ${t})`}),[pn]:!0,arbitraryConstraint:{minProperties:e,maxProperties:t},...r})}function $te(e,t){let r=Ml(e),n=_L(r.ast);return Ne((o,s,a)=>{let i=Reflect.ownKeys(o),c=[];for(let u of i){let f=n(u,a);if(f!==void 0&&(c.push(new Ot([u],f)),a.errors===\"first\"))break}return Mr(c)?new Ht(s,c,o,a):!0},{expected:\"an object with property names matching the schema\",representation:{id:\"effect/schema/isPropertyNames\",payload:null,schemas:[r.ast]},toJsonSchema:({schemas:o,type:s})=>s===\"object\"?{propertyNames:o[0]}:[{propertyNames:o[0]},!0],toCode:({schemas:o})=>({runtime:`Schema.isPropertyNames(${o[0].runtime})`}),[pn]:!0,...t})}function Tv(e){return Ne(t=>cx(t).length===t.length,{expected:\"an array with unique items\",representation:{id:\"effect/schema/isUnique\",payload:null},toJsonSchema:()=>({uniqueItems:!0}),toCode:()=>({runtime:\"Schema.isUnique()\"}),arbitraryConstraint:{uniqueBy:D},...e})}function RB(e){return Ne(t=>cx(t.map(([r])=>r)).length===t.length,{expected:\"an array with unique keys\",representation:{id:\"effect/schema/isUniqueKey\",payload:null},toCode:()=>({runtime:\"Schema.isUniqueKey()\"}),arbitraryConstraint:{uniqueBy:t=>t[0]},...e})}var th=H.check(OB()),Kte=H.check(Av(1,1)),PB=e=>(e?.includeStack===!0?1:0)|(e?.excludeCause===!0?2:0),MB=e=>{switch(e){case 0:return;case 1:return{includeStack:!0};case 2:return{excludeCause:!0};case 3:return{includeStack:!0,excludeCause:!0}}},$K=[];function Bte(e){let t=PB(e),r=$K[t];if(r!==void 0)return r;let n=MB(t),o=Au(globalThis.Error,{representation:{id:\"effect/schema/Error\",payload:n??null},toCode:()=>({runtime:n!==void 0?`Schema.ErrorInstance(${K(n)})`:\"Schema.ErrorInstance()\",Type:\"globalThis.Error\"}),expected:\"Error\",toCodecJson:()=>ke()(Joe,SD(n))});return $K[t]=o,o}var KK=[];function jte(e){let t=PB(e),r=KK[t];if(r!==void 0)return r;let n=BS.pipe(J(Fl,bD(MB(t))));return KK[t]=n,n}function Hte(e,t){let r=yn()([e,t],([n,o])=>{let s=Be(Ds([n,o]));return(a,i,c)=>a instanceof globalThis.Map?Sr(St(s)([...a],c),{onSuccess:u=>new globalThis.Map(u),onFailure:u=>mn(i,\"entries\",u,a,c)}):F(new _t(i,a,c))},{representation:{id:\"effect/schema/ReadonlyMap\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.ReadonlyMap(${n[0].runtime}, ${n[1].runtime})`,Type:`globalThis.ReadonlyMap<${n[0].Type}, ${n[1].Type}>`}),expected:\"ReadonlyMap\",toCodec:([n,o])=>ke()(Be(Ds([n,o])),Ge({decode:s=>new globalThis.Map(s),encode:s=>[...s.entries()]}))});return Q(r.ast,{key:e,value:t})}function zte(e){let t=yn()([e],([r])=>{let n=Be(r);return(o,s,a)=>o instanceof globalThis.Set?Sr(St(n)([...o],a),{onSuccess:i=>new globalThis.Set(i),onFailure:i=>mn(s,\"values\",i,o,a)}):F(new _t(s,o,a))},{representation:{id:\"effect/schema/ReadonlySet\",payload:null},toCode:({typeParameters:r})=>({runtime:`Schema.ReadonlySet(${r[0].runtime})`,Type:`globalThis.ReadonlySet<${r[0].Type}>`}),expected:\"ReadonlySet\",toCodec:([r])=>ke()(Be(r),Ge({decode:n=>new globalThis.Set(n),encode:n=>[...n.values()]}))});return Q(t.ast,{value:e})}var Wte=Au(globalThis.RegExp,{representation:{id:\"effect/schema/RegExp\",payload:null},toCode:()=>({runtime:\"Schema.RegExp\",Type:\"globalThis.RegExp\"}),expected:\"RegExp\",toCodecJson:()=>ke()(ve({source:H,flags:H}),mt({decode:(e,t)=>Ff({try:()=>new globalThis.RegExp(e.source,e.flags),catch:()=>new fe({expected:\"valid RegExp source and flags\"},e,t)}),encode:e=>g({source:e.source,flags:e.flags})}))}),FB=H.annotate({expected:\"a string that will be decoded as a URL\"}),LS=Au(globalThis.URL,{representation:{id:\"effect/schema/URL\",payload:null},toCode:()=>({runtime:\"Schema.URL\",Type:\"globalThis.URL\"}),expected:\"URL\",toCodecJson:()=>ke()(FB,uC)}),qte=FB.pipe(J(LS,uC)),NB=H.annotate({expected:\"a string that will be decoded as a Date\"}),Dl=je(e=>e instanceof globalThis.Date&&!globalThis.Number.isNaN(e.getTime()),{representation:{id:\"effect/schema/Date\",payload:null},toCode:()=>({runtime:\"Schema.Date\",Type:\"globalThis.Date\"}),expected:\"a valid Date\",toCodecJson:()=>ke()(NB,iC)}),Jte=NB.pipe(J(Dl,iC)),Gte=en.pipe(J(Dl,dD)),Vte=H.annotate({expected:\"a string that will be decoded as JSON\"});function vv(e,t){return Vte.pipe(J(e,_D(t)))}var Zte=vv(Fl),UB=Au(globalThis.File,{representation:{id:\"effect/schema/File\",payload:null},toCode:()=>({runtime:\"Schema.File\",Type:\"globalThis.File\"}),expected:\"File\",toCodecJson:()=>ke()(ve({data:H.check(CB()),type:H,name:H,lastModified:en}),mt({decode:(e,t)=>mr(Xc(e.data),{onFailure:()=>F(new fe({expected:\"a valid Base64 string\"},e.data,t)),onSuccess:r=>{let n=new globalThis.Uint8Array(r);return g(new globalThis.File([n],e.name,{type:e.type,lastModified:e.lastModified}))}}),encode:(e,t)=>fi({try:async()=>{let r=new globalThis.Uint8Array(await e.arrayBuffer());return{data:Ca(r),type:e.type,name:e.name,lastModified:e.lastModified}},catch:()=>new fe({expected:\"a readable File\"},e,t)})}))}),DB=je(e=>e instanceof globalThis.FormData,{representation:{id:\"effect/schema/FormData\",payload:null},toCode:()=>({runtime:\"Schema.FormData\",Type:\"globalThis.FormData\"}),expected:\"FormData\",toCodecJson:()=>ke()(Be(Ds([H,st([ve({_tag:Fa(\"String\"),value:H}),ve({_tag:Fa(\"File\"),value:UB})])])),mt({decode:e=>{let t=new globalThis.FormData;for(let[r,n]of e)t.append(r,n.value);return g(t)},encode:e=>g(globalThis.Array.from(e.entries()).map(([t,r])=>typeof r==\"string\"?[t,{_tag:\"String\",value:r}]:[t,{_tag:\"File\",value:r}]))}))});function Yte(e){return DB.pipe(J(e,RD))}var LB=Au(globalThis.URLSearchParams,{representation:{id:\"effect/schema/URLSearchParams\",payload:null},toCode:()=>({runtime:\"Schema.URLSearchParams\",Type:\"globalThis.URLSearchParams\"}),expected:\"URLSearchParams\",toCodecJson:()=>ke()(H.annotate({expected:\"a query string that will be decoded as URLSearchParams\"}),Ge({decode:e=>new globalThis.URLSearchParams(e),encode:e=>e.toString()}))});function Qte(e){return LB.pipe(J(e,PD))}var Xte=H.annotate({expected:\"a string that will be decoded as a number\"}).pipe(J(wu,ol)),ere=H.annotate({expected:\"a string that will be decoded as a finite number\"}).pipe(J(Ul,ol)),tre=Q(BC).pipe(J(Nl,Oy)),$B=H.check(AB()),rre=H.annotate({expected:\"a string that will be decoded as a trimmed string\"}).pipe(J($B,lD())),nre=H.annotate({expected:\"a base64 encoded string that will be decoded as a UTF-8 string\"}).pipe(J(H,TD)),ore=H.annotate({expected:\"a base64 (URL) encoded string that will be decoded as a UTF-8 string\"}).pipe(J(H,vD)),sre=H.annotate({expected:\"a hex encoded string that will be decoded as a UTF-8 string\"}).pipe(J(H,kD)),are=H.annotate({expected:\"a URI component encoded string that will be decoded as a UTF-8 string\"}).pipe(J(H,OD)),lv=st([Ul,cB,H]),ire=ve({issues:Be(ve({message:H,path:Pl(Be(st([lv,ve({key:lv})])))}))}),cre=Jn([0,1]).pipe(J(Gm,Ge({decode:e=>e===1,encode:e=>e?1:0}))),KB=H.annotate({expected:\"a base64 encoded string that will be decoded as Uint8Array\",format:\"byte\",contentEncoding:\"base64\"}),Ll=Au(globalThis.Uint8Array,{representation:{id:\"effect/schema/Uint8Array\",payload:null},toCode:()=>({runtime:\"Schema.Uint8Array\",Type:\"globalThis.Uint8Array\"}),expected:\"Uint8Array\",toCodecJson:()=>ke()(KB,fC)}),ure=KB.pipe(J(Ll,fC)),fre=H.annotate({expected:\"a base64 (URL) encoded string that will be decoded as a Uint8Array\"}).pipe(J(Ll,{decode:V2(),encode:Ay()})),BB=H.annotate({expected:\"a hex encoded string that will be decoded as a Uint8Array\"}).pipe(J(Ll,{decode:Y2(),encode:Cy()})),jB=mt({decode:(e,t)=>{let r=$F(e);return ge(r)?F(new fe({expected:\"a valid BigDecimal string\"},e,t)):g(r.value)},encode:e=>g(ya(e))}),lre=Zm({order:Bf,formatter:e=>ya(e)}),pre=Ym({order:Bf,formatter:e=>ya(e)}),dre=Qm({order:Bf,formatter:e=>ya(e)}),mre=Xm({order:Bf,formatter:e=>ya(e)}),hre=eh({order:Bf,formatter:e=>ya(e)}),HB=H.annotate({expected:\"a string that will be decoded as a BigDecimal\"}),zB=je(gw,{representation:{id:\"effect/schema/BigDecimal\",payload:null},toCode:()=>({runtime:\"Schema.BigDecimal\",Type:\"BigDecimal.BigDecimal\",importDeclarations:['import * as BigDecimal from \"effect/BigDecimal\"']}),expected:\"BigDecimal\",toCodecJson:()=>ke()(HB,jB),toFormatter:()=>e=>ya(e)}),xre=HB.pipe(J(zB,jB)),$l=je(VF,{representation:{id:\"effect/schema/ByteSize\",payload:null},toCode:()=>({runtime:\"Schema.ByteSize\",Type:\"ByteSize.ByteSize\",importDeclarations:['import * as ByteSize from \"effect/ByteSize\"']}),expected:\"ByteSize\",toCodecJson:()=>ke()(Nl.check(vB(globalThis.BigInt(0))),Ge({decode:GF,encode:Lg})),toCodecStringTree:()=>ke()(WB,cC)}),WB=H.annotate({expected:\"a string that will be decoded as a ByteSize\"}),gre=WB.pipe(J($l,cC)),yre=Nl.pipe(J($l,mD)),Sre=wu.pipe(J($l,hD));function pv(e,t){let r=yn()([e,t],([n,o])=>(s,a,i)=>{if(!YI(s))return F(new _t(a,s,i));switch(s._tag){case\"Fail\":return Sr(St(n)(s.error,i),{onSuccess:Af,onFailure:c=>mn(a,\"error\",c,s,i)});case\"Die\":return Sr(St(o)(s.defect,i),{onSuccess:Cf,onFailure:c=>mn(a,\"defect\",c,s,i)});case\"Interrupt\":return g(s)}},{representation:{id:\"effect/schema/CauseReason\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.CauseReason(${n[0].runtime}, ${n[1].runtime})`,Type:`Cause.Failure<${n[0].Type}, ${n[1].Type}>`,importDeclarations:['import * as Cause from \"effect/Cause\"']}),expected:\"Cause.Failure\",toCodec:([n,o])=>ke()(st([ve({_tag:zt(\"Fail\"),error:n}),ve({_tag:zt(\"Die\"),defect:o}),ve({_tag:zt(\"Interrupt\"),fiberId:NS(Ul)})]),Ge({decode:s=>{switch(s._tag){case\"Fail\":return Af(s.error);case\"Die\":return Cf(s.defect);case\"Interrupt\":return XI(s.fiberId)}},encode:s=>{switch(s._tag){case\"Fail\":return{_tag:\"Fail\",error:s.error};case\"Die\":return{_tag:\"Die\",defect:s.defect};case\"Interrupt\":return{_tag:\"Interrupt\",fiberId:s.fiberId}}}}))});return Q(r.ast,{error:e,defect:t})}function dv(e,t){let r=yn()([e,t],([n,o])=>{let s=Be(pv(n,o));return(a,i,c)=>id(a)?Sr(St(s)(a.reasons,c),{onSuccess:gs,onFailure:u=>mn(i,\"reasons\",u,a,c)}):F(new _t(i,a,c))},{representation:{id:\"effect/schema/Cause\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.Cause(${n[0].runtime}, ${n[1].runtime})`,Type:`Cause.Cause<${n[0].Type}, ${n[1].Type}>`,importDeclarations:['import * as Cause from \"effect/Cause\"']}),expected:\"Cause\",toCodec:([n,o])=>ke()(Be(pv(n,o)),Ge({decode:gs,encode:({reasons:s})=>s}))});return Q(r.ast,{error:e,defect:t})}function BK(e){return ke()(e,Ge({decode:Cw,encode:wt}))}function bre(e){let t=yn()([e],([r])=>{let n=Be(r);return(o,s,a)=>Kg(o)?Sr(St(n)(wt(o),a),{onSuccess:Cw,onFailure:i=>mn(s,\"values\",i,o,a)}):F(new _t(s,o,a))},{representation:{id:\"effect/schema/Chunk\",payload:null},toCode:({typeParameters:r})=>({runtime:`Schema.Chunk(${r[0].runtime})`,Type:`Chunk.Chunk<${r[0].Type}>`}),expected:\"Chunk\",toCodec:([r])=>BK(Be(r)),toCodecArbitrary:({constraint:r,typeParameters:[n]})=>BK(MS(Be(n),r?.minLength,r?.maxLength)),toEquivalence:([r])=>ww(r)});return Q(t.ast,{value:e})}function qB(){return Rt((e,t)=>Zt(dA(e),{onNone:()=>F(new fe({message:\"Invalid DateTime input\"},e,t)),onSome:r=>g(mA(r))}))}var Ere=Ge({decode:e=>xA(e),encode:e=>e.offset}),JB=mt({decode:(e,t)=>Zt(OU(e),{onNone:()=>F(new fe({expected:\"a valid IANA time zone\"},e,t)),onSome:g}),encode:e=>g(e.id)}),GB=mt({decode:(e,t)=>Zt(_U(e),{onNone:()=>F(new fe({expected:\"a valid time zone\"},e,t)),onSome:g}),encode:e=>g(Zd(e))}),VB=mt({decode:(e,t)=>Zt(dA(e),{onNone:()=>F(new fe({expected:\"a valid UTC DateTime string\"},e,t)),onSome:r=>g(mA(r))}),encode:e=>g(RU(e))}),ZB=mt({decode:(e,t)=>Zt(kU(e),{onNone:()=>F(new fe({expected:\"a valid Zoned DateTime string\"},e,t)),onSome:g}),encode:e=>g(yA(e))}),YB=-864e13,QB=864e13,Ire=YB+840*60*1e3,wre=QB-840*60*1e3,Are=-720*60*1e3,Cre=840*60*1e3,XB=[\"UTC\",\"Europe/London\",\"America/New_York\",\"Asia/Tokyo\",\"Australia/Sydney\"];function ej(e,t,r){let n=Math.max(t,e?.minimum===void 0?t:e.minimum.epochMilliseconds+(e.exclusiveMinimum===!0?1:0)),o=Math.min(r,e?.maximum===void 0?r:e.maximum.epochMilliseconds-(e.exclusiveMaximum===!0?1:0));return n<=o?[n,o]:[t,r]}function kv(e,t){return en.check(Ls({minimum:e,maximum:t}))}function tj(){return st([kv(Are,Cre),Jn(XB)])}var Kl=je(e=>lA(e)&&CU(e),{representation:{id:\"effect/schema/DateTimeUtc\",payload:null},toCode:()=>({runtime:\"Schema.DateTimeUtc\",Type:\"DateTime.Utc\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.Utc\",toCodecArbitrary:({constraint:e})=>{let[t,r]=ej(e,YB,QB);return Hi()(kv(t,r),le(Vd))},toCodecJson:()=>ke()(H,VB),toFormatter:()=>e=>e.toString()}),Tre=Dl.pipe(J(Kl,{decode:qB(),encode:le(cy)})),vre=H.annotate({expected:\"a string that will be decoded as a DateTime.Utc\"}).pipe(J(Kl,VB)),kre=mt({decode:(e,t)=>mr(p2(e),{onFailure:()=>F(new fe({expected:\"an HTTP date (RFC 9110 \\xA75.6.7)\"},e,t)),onSuccess:g}),encode:e=>g(zA(e))}),Ore=H.annotate({expected:\"an HTTP date string\"}).pipe(J(Kl,kre)),_re=en.pipe(J(Kl,{decode:qB(),encode:le(gA)})),Rre=je(wU,{representation:{id:\"effect/schema/TimeZoneOffset\",payload:null},toCode:()=>({runtime:\"Schema.TimeZoneOffset\",Type:\"DateTime.TimeZone.Offset\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.TimeZone.Offset\",toCodecJson:()=>ke()(en,Ere),toFormatter:()=>e=>Zd(e)}),rj=H.annotate({expected:\"an IANA time zone identifier\"}),nj=je(AU,{representation:{id:\"effect/schema/TimeZoneNamed\",payload:null},toCode:()=>({runtime:\"Schema.TimeZoneNamed\",Type:\"DateTime.TimeZone.Named\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.TimeZone.Named\",toCodecArbitrary:()=>Hi()(Jn(XB),le(hA)),toCodecJson:()=>ke()(rj,JB),toFormatter:()=>e=>Zd(e)}),Pre=rj.pipe(J(nj,JB)),oj=H.annotate({expected:\"a time zone string (IANA identifier or offset like +03:00)\"}),sj=je(IU,{representation:{id:\"effect/schema/TimeZone\",payload:null},toCode:()=>({runtime:\"Schema.TimeZone\",Type:\"DateTime.TimeZone\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.TimeZone\",toCodecArbitrary:()=>Hi()(tj(),le(e=>typeof e==\"number\"?xA(e):hA(e))),toCodecJson:()=>ke()(oj,GB),toFormatter:()=>e=>Zd(e)}),Mre=oj.pipe(J(sj,GB)),aj=H.annotate({expected:\"a zoned DateTime string (e.g. 2024-01-01T00:00:00.000+00:00[Europe/London])\"}),ij=je(e=>lA(e)&&TU(e),{representation:{id:\"effect/schema/DateTimeZoned\",payload:null},toCode:()=>({runtime:\"Schema.DateTimeZoned\",Type:\"DateTime.Zoned\",importDeclarations:['import * as DateTime from \"effect/DateTime\"']}),expected:\"DateTime.Zoned\",toCodecArbitrary:({constraint:e})=>{let[t,r]=ej(e,Ire,wre);return Hi()(ve({epochMilliseconds:kv(t,r),timeZone:tj()}),le(({epochMilliseconds:n,timeZone:o})=>vU(n,{timeZone:o})))},toCodecJson:()=>ke()(aj,ZB),toFormatter:()=>e=>yA(e),toEquivalence:()=>pA}),Fre=aj.pipe(J(ij,ZB)),bn=(e,t,r,n)=>H.pipe(J(e,mt({decode:(o,s)=>{let a=t(o);return rt(a)?g(a.success):F(new fe({message:a.failure.message},o,s))},encode:o=>g(r(o))}))).annotate({identifier:n}),Cu=je(Al,{identifier:\"MacAddress\"}),Bl=bn(Cu,oK,RT,\"MacAddressFromString\"),rh=je(Ir,{identifier:\"Ipv4Address\"}),Ov=bn(rh,bu,wr,\"Ipv4AddressFromString\"),$S=je(go,{identifier:\"Ipv6Address\"}),cj=bn($S,Eu,wr,\"Ipv6AddressFromString\"),Wi=je(vT,{identifier:\"IpAddress\"}),Tu=bn(Wi,$i,wr,\"IpAddressFromString\"),ht=(e,t,r,n)=>dB(t,{expected:r})(e).annotate({identifier:n}),Nre=ht(Wi,Cl,\"a multicast address\",\"IpMulticastAddress\"),Ure=ht(Tu,Cl,\"a multicast address\",\"IpMulticastAddressFromString\"),Dre=ht(Cu,Cl,\"a multicast address\",\"MacMulticastAddress\"),Lre=ht(Bl,Cl,\"a multicast address\",\"MacMulticastAddressFromString\"),$re=ht(Wi,NT,\"a unicast address\",\"IpUnicastAddress\"),Kre=ht(Tu,NT,\"a unicast address\",\"IpUnicastAddressFromString\"),Bre=ht(Cu,xS,\"a unicast address\",\"MacUnicastAddress\"),jre=ht(Bl,xS,\"a unicast address\",\"MacUnicastAddressFromString\"),Hre=ht(rh,yS,\"a broadcast address\",\"Ipv4BroadcastAddress\"),zre=ht(Ov,yS,\"a broadcast address\",\"Ipv4BroadcastAddressFromString\"),Wre=ht(Cu,hS,\"a broadcast address\",\"MacBroadcastAddress\"),qre=ht(Bl,hS,\"a broadcast address\",\"MacBroadcastAddressFromString\"),Jre=ht(Wi,FT,\"a loopback address\",\"IpLoopbackAddress\"),Gre=ht(Tu,FT,\"a loopback address\",\"IpLoopbackAddressFromString\"),Vre=ht(Wi,UT,\"a link-local address\",\"IpLinkLocalAddress\"),Zre=ht(Tu,UT,\"a link-local address\",\"IpLinkLocalAddressFromString\"),Yre=ht(Wi,gS,\"an unspecified address\",\"IpUnspecifiedAddress\"),Qre=ht(Tu,gS,\"an unspecified address\",\"IpUnspecifiedAddressFromString\"),Xre=ht(rh,DT,\"a private address\",\"Ipv4PrivateAddress\"),ene=ht(Ov,DT,\"a private address\",\"Ipv4PrivateAddressFromString\"),tne=ht($S,LT,\"a unique-local address\",\"Ipv6UniqueLocalAddress\"),rne=ht(cj,LT,\"a unique-local address\",\"Ipv6UniqueLocalAddressFromString\"),nne=ht(Cu,PT,\"a locally administered address\",\"MacLocallyAdministeredAddress\"),one=ht(Bl,PT,\"a locally administered address\",\"MacLocallyAdministeredAddressFromString\"),sne=ht(Cu,MT,\"a universally administered address\",\"MacUniversallyAdministeredAddress\"),ane=ht(Bl,MT,\"a universally administered address\",\"MacUniversallyAdministeredAddressFromString\"),uj=je(gK,{identifier:\"Ipv4Interface\"}),ine=bn(uj,IS,jm,\"Ipv4InterfaceFromString\"),fj=je(yK,{identifier:\"Ipv6Interface\"}),cne=bn(fj,wS,jm,\"Ipv6InterfaceFromString\"),lj=je(Km,{identifier:\"IpInterface\"}),une=bn(lj,AS,jm,\"IpInterfaceFromString\"),pj=je(bK,{identifier:\"Ipv4Network\"}),fne=bn(pj,IK,zm,\"Ipv4NetworkFromString\"),dj=je(EK,{identifier:\"Ipv6Network\"}),lne=bn(dj,wK,zm,\"Ipv6NetworkFromString\"),mj=je(Hm,{identifier:\"IpNetwork\"}),pne=bn(mj,AK,zm,\"IpNetworkFromString\"),dne=je(Nm,{identifier:\"InetAddressV4\"}),mne=je(Um,{identifier:\"InetAddressV6\"}),hj=je(kT,{identifier:\"InetAddress\"}),hne=bn(hj,$T,SS,\"InetAddressFromString\"),xj=je(dS,{identifier:\"UnixPathAddress\"}),xne=H.pipe(J(xj,Ge({decode:aK,encode:e=>e.path}))).annotate({identifier:\"UnixPathAddressFromString\"}),gne=je(rK,{identifier:\"SocketAddress\"}),Ua=H.check(Ne(Pa,{expected:\"a normalized domain name\"})).pipe(US(\"~effect/net/Host/DomainName\")).annotate({identifier:\"DomainName\"}),gj=bn(Ua,bS,e=>e,\"DomainNameFromString\"),_v=H.check(Ne(OT,{expected:\"a canonical scoped IPv6 literal\"})).pipe(US(\"~effect/net/NetAddress/ScopedIpv6Literal\")).annotate({identifier:\"ScopedIpv6Literal\"}),yj=bn(_v,Dm,e=>e,\"ScopedIpv6LiteralFromString\"),yne=st([Wi,_v,Ua]).annotate({identifier:\"Host\"}),Sne=st([Tu,yj,gj]).annotate({identifier:\"HostFromString\"}),Sj=je(jT,{identifier:\"HostPort\"}),bne=bn(Sj,uK,HT,\"HostPortFromString\"),Ene=en.check(Ls({minimum:0,maximum:65535},{expected:\"a port number\"})),Ine=mt({decode:(e,t)=>Zt(K_(e),{onNone:()=>F(new fe({expected:\"a valid Duration string\"},e,t)),onSome:g}),encode:e=>g(globalThis.String(e))}),wne=mt({decode:e=>g(On(e)),encode:(e,t)=>Zt(B_(e),{onNone:()=>F(new fe({expected:\"a Duration representable as a bigint\"},e,t)),onSome:r=>g(r)})}),Ane=Ge({decode:e=>na(e),encode:e=>Nr(e)}),Cne=mt({decode:(e,t)=>Zt(J_(e),{onNone:()=>F(new fe({expected:\"an ISO 8601 duration without years or months\"},e,t)),onSome:g}),encode:(e,t)=>Zt(q_(e),{onNone:()=>F(new fe({expected:\"a finite Duration\"},e,t)),onSome:g})}),vu=je(Fp,{representation:{id:\"effect/schema/Duration\",payload:null},toCode:()=>({runtime:\"Schema.Duration\",Type:\"Duration.Duration\",importDeclarations:['import * as Duration from \"effect/Duration\"']}),expected:\"Duration\",toCodecJson:()=>ke()(st([ve({_tag:zt(\"Infinity\")}),ve({_tag:zt(\"NegativeInfinity\")}),ve({_tag:zt(\"Nanos\"),value:Nl}),ve({_tag:zt(\"Millis\"),value:en})]),Ge({decode:e=>{switch(e._tag){case\"Infinity\":return ra;case\"NegativeInfinity\":return af;case\"Nanos\":return On(e.value);case\"Millis\":return na(e.value)}},encode:e=>{switch(e.value._tag){case\"Infinity\":return{_tag:\"Infinity\"};case\"NegativeInfinity\":return{_tag:\"NegativeInfinity\"};case\"Nanos\":return{_tag:\"Nanos\",value:e.value.nanos};case\"Millis\":return{_tag:\"Millis\",value:e.value.millis}}}}))}),Tne=H.annotate({expected:\"a string that will be decoded as a Duration\"}),Rv=Tne.pipe(J(vu,Ine)),vne=Nl.pipe(J(vu,wne)),kne=wu.pipe(J(vu,Ane)),One=H.annotate({expected:\"an ISO 8601 duration string that will be decoded as a Duration\"}).pipe(J(vu,Cne)),_ne=Jn(qT),bj=(e,t)=>H.pipe(J(e,mt({decode:(r,n)=>{let o=t(r);return ae(o)?F(new fe({message:o.failure.message},r,n)):wr(o.success)===r?g(o.success):F(new fe({message:\"expected a canonical address\"},r,n))},encode:r=>g(wr(r))}))),uv=en.check(Ls({minimum:0,maximum:255})),kl=en.check(Ls({minimum:0,maximum:65535})),Ej=en.check(Ls({minimum:0,maximum:4294967295})),vS=Ej.pipe(J(vu,Ge({decode:cf,encode:hs}))),So=(e,t)=>je(r=>JT(r)&&r._tag===e,{identifier:`Dns${e.charAt(0)}${e.slice(1).toLowerCase()}Record`,toCodecJson:()=>{let r=Vm(e,t);return ke()(r,mt({decode:(n,o)=>{let{_tag:s,...a}=n,i=mK(e,a);return rt(i)?g(i.success):F(new fe({message:i.failure.message},n,o))},encode:n=>g({...n})}))}}),Ij=So(\"A\",{address:bj(rh,bu)}),wj=So(\"AAAA\",{address:bj($S,Eu)}),Aj=So(\"CAA\",{critical:Gm,tag:H.check(zi(/^[a-z0-9]+$/i)),value:H}),Cj=So(\"CNAME\",{target:Ua}),Tj=So(\"MX\",{exchange:Ua,priority:kl}),vj=So(\"NAPTR\",{order:kl,preference:kl,flags:H,service:H,regexp:H,replacement:Ua}),kj=So(\"NS\",{host:Ua}),Oj=So(\"PTR\",{host:th}),_j=So(\"SOA\",{primary:Ua,admin:th,serial:Ej,refresh:vS,retry:vS,expire:vS,minimum:vS}),Rj=So(\"SRV\",{target:Ua,port:kl,priority:kl,weight:kl}),Pj=So(\"TLSA\",{certUsage:uv,selector:uv,matchingType:uv,data:BB}),Mj=So(\"TXT\",{chunks:FS(H)}),Rne=st([Ij,wj,Aj,Cj,Tj,vj,kj,Oj,_j,Rj,Pj,Mj]).annotate({identifier:\"DnsRecord\"}),Pne=(e,t)=>e===t||e.name===t.name&&e.hash?.name===t.hash?.name&&e.saltLength===t.saltLength,jK=e=>`Digest.${e.name.toLowerCase().replace(\"-\",\"\")}`,Mne=(e,t)=>{if(t.modulusLength===void 0||t.hash===void 0||t._tag===void 0){let o=`${e}.${t.name}`;return t.hash===void 0?o:`{ ...${o}, hash: ${jK(t.hash)} }`}let r=t._tag.charAt(0).toLowerCase()+t._tag.slice(1),n=t.saltLength===void 0?\"\":`, saltLength: ${t.saltLength}`;return`${e}.${r}({ hash: ${jK(t.hash)}, modulusLength: ${t.modulusLength}${n} })`},Fne=e=>{let t={name:e.name};return e.hash!==void 0&&(t.hash=e.hash.name),e.modulusLength!==void 0&&(t.modulusLength=e.modulusLength),e.saltLength!==void 0&&(t.saltLength=e.saltLength),t},$s=(e,t,r,n,o)=>{let s=Mne(t,o),a=cu(()=>`Cannot serialize ${t}.${r} values as JSON, use Schema.${e}FromFormat to read and write keys`);return je(i=>n(i)&&Pne(i.algorithm,o),{expected:`${t}.${r} for ${o.name}`,representation:{id:`effect/crypto/${e}`,payload:Fne(o)},toCode:()=>({runtime:`Schema.${e}(${s})`,Type:`${t}.${r}`,importDeclarations:[`import * as ${t} from \"effect/crypto/${t}\"`,...s.includes(\"Digest.\")?['import * as Digest from \"effect/crypto/Digest\"']:[]]}),toCodecJson:()=>ke()(Fl,{decode:a,encode:a}),toCodecArbitrary:()=>ke()(iB,{decode:a,encode:a}),toFormatter:()=>i=>globalThis.String(i),toEquivalence:()=>(i,c)=>i===c})},kS=(e,t,r)=>new fe({message:e.message,cause:e},t,r),Fj=(e,t,r)=>F(new iu({message:`Schema.${e} only decodes, pass { allowEncode: true } to encode the key`},t,r)),qi=(e,t,r,n)=>Ll.pipe(J(t,mt({decode:(o,s)=>Do(r(o),a=>kS(a,o,s)),encode:(o,s)=>n===void 0?Fj(e,o,s):Do(n(o),a=>kS(a,o,s))}))),Ar=rs(H),Nne=ve({kty:Ar,crv:Ar,alg:Ar,use:Ar,key_ops:rs(Be(H)),ext:rs(Gm),k:Ar,x:Ar,y:Ar,d:Ar,n:Ar,e:Ar,p:Ar,q:Ar,dp:Ar,dq:Ar,qi:Ar,oth:rs(Be(ve({r:Ar,d:Ar,t:Ar})))}),Une=e=>e._tag===\"jwk\"?Nne:e.pem?H:Ll,Ks=(e,t,r,n,o)=>{let s=o&&r._tag!==\"pkcs1\"&&r._tag!==\"sec1\";return Une(r).pipe(J(t,mt({decode:(a,i)=>C(Pf(()=>Promise.resolve()),()=>Do(n(a),c=>kS(c,a,i))),encode:(a,i)=>s?Do(EU(r,a),c=>kS(c,a,i)):Fj(e,a,i)})))},Pv=e=>$s(\"MacKey\",\"Mac\",\"Key\",Yw,e),Dne=(e,t)=>qi(\"MacKeyFromBytes\",Pv(e),r=>Qw(e,r),t?.allowEncode===!0?Xw:void 0),Lne=(e,t,r)=>Ks(\"MacKeyFromFormat\",Pv(t),e,n=>Gd(e,t,n),r?.allowEncode===!0),Mv=e=>$s(\"AeadKey\",\"Aead\",\"Key\",Nw,e),$ne=(e,t)=>qi(\"AeadKeyFromBytes\",Mv(e),r=>Uw(e,r),t?.allowEncode===!0?Dw:void 0),Kne=(e,t,r)=>Ks(\"AeadKeyFromFormat\",Mv(t),e,n=>Gd(e,t,n),r?.allowEncode===!0),Fv=e=>$s(\"CipherKey\",\"Cipher\",\"Key\",$w,e),Bne=(e,t)=>qi(\"CipherKeyFromBytes\",Fv(e),r=>Kw(e,r),t?.allowEncode===!0?Bw:void 0),jne=(e,t,r)=>Ks(\"CipherKeyFromFormat\",Fv(t),e,n=>Gd(e,t,n),r?.allowEncode===!0),Nv=e=>$s(\"SignaturePublicKey\",\"Signature\",\"PublicKey\",iU,e),Hne=e=>qi(\"SignaturePublicKeyFromBytes\",Nv(e),t=>uU(e,t),cA),zne=(e,t)=>Ks(\"SignaturePublicKeyFromFormat\",Nv(t),e,r=>ay(e,t,r),!0),Uv=e=>$s(\"SignaturePrivateKey\",\"Signature\",\"PrivateKey\",aA,e),Wne=(e,t)=>qi(\"SignaturePrivateKeyFromBytes\",Uv(e),r=>cU(e,r),t?.allowEncode===!0?cA:void 0),qne=(e,t,r)=>Ks(\"SignaturePrivateKeyFromFormat\",Uv(t),e,n=>iy(e,t,n),r?.allowEncode===!0),Dv=e=>$s(\"KeyAgreementPublicKey\",\"KeyAgreement\",\"PublicKey\",FN,e),Jne=e=>qi(\"KeyAgreementPublicKeyFromBytes\",Dv(e),t=>UN(e,t),Jw),Gne=(e,t)=>Ks(\"KeyAgreementPublicKeyFromFormat\",Dv(t),e,r=>ay(e,t,r),!0),Lv=e=>$s(\"KeyAgreementPrivateKey\",\"KeyAgreement\",\"PrivateKey\",Ww,e),Vne=(e,t)=>qi(\"KeyAgreementPrivateKeyFromBytes\",Lv(e),r=>NN(e,r),t?.allowEncode===!0?Jw:void 0),Zne=(e,t,r)=>Ks(\"KeyAgreementPrivateKeyFromFormat\",Lv(t),e,n=>iy(e,t,n),r?.allowEncode===!0),$v=e=>$s(\"KeyWrapKey\",\"KeyWrap\",\"Key\",eA,e),Yne=(e,t)=>qi(\"KeyWrapKeyFromBytes\",$v(e),r=>oA(e,r),t?.allowEncode===!0?sA:void 0),Qne=(e,t,r)=>Ks(\"KeyWrapKeyFromFormat\",$v(t),e,n=>Gd(e,t,n),r?.allowEncode===!0),Nj=e=>$s(\"KeyWrapPublicKey\",\"KeyWrap\",\"PublicKey\",tU,e),Xne=(e,t)=>Ks(\"KeyWrapPublicKeyFromFormat\",Nj(t),e,r=>ay(e,t,r),!0),Uj=e=>$s(\"KeyWrapPrivateKey\",\"KeyWrap\",\"PrivateKey\",tA,e),eoe=(e,t,r)=>Ks(\"KeyWrapPrivateKeyFromFormat\",Uj(t),e,n=>iy(e,t,n),r?.allowEncode===!0);function toe(e,t,r){let n=yn()([e,t,r],([o,s,a])=>{let i=dv(s,a);return(c,u,f)=>{if(!fd(c))return F(new _t(u,c,f));switch(c._tag){case\"Success\":return Sr(St(o)(c.value,f),{onSuccess:Gr,onFailure:p=>mn(u,\"value\",p,c,f)});case\"Failure\":return Sr(St(i)(c.cause,f),{onSuccess:Fn,onFailure:p=>mn(u,\"cause\",p,c,f)})}}},{representation:{id:\"effect/schema/Exit\",payload:null},toCode:({typeParameters:o})=>({runtime:`Schema.Exit(${o[0].runtime}, ${o[1].runtime}, ${o[2].runtime})`,Type:`Exit.Exit<${o[0].Type}, ${o[1].Type}, ${o[2].Type}>`,importDeclarations:['import * as Exit from \"effect/Exit\"']}),expected:\"Exit\",toCodec:([o,s,a])=>ke()(st([ve({_tag:zt(\"Success\"),value:o}),ve({_tag:zt(\"Failure\"),cause:dv(s,a)})]),Ge({decode:i=>i._tag===\"Success\"?Gr(i.value):Fn(i.cause),encode:i=>ut(i)?{_tag:\"Success\",value:i.value}:{_tag:\"Failure\",cause:i.cause}}))});return Q(n.ast,{value:e,error:t,defect:r})}function HK(e,t,r){return ve({type:zt(e),nodes:Be(ve({index:ts,data:t})),edges:Be(ve({index:ts,source:ts,target:ts,data:r}))})}function zK(e,t){let r=-1,n=new Set;for(let o=0;o<e.nodes.length;o++){let s=e.nodes[o].index;if(s<=r)return F(new Ot([\"nodes\",o,\"index\"],new fe({expected:\"a strictly increasing node index\"},s,t)));r=s,n.add(s)}r=-1;for(let o=0;o<e.edges.length;o++){let s=e.edges[o];if(s.index<=r)return F(new Ot([\"edges\",o,\"index\"],new fe({expected:\"a strictly increasing edge index\"},s.index,t)));if(r=s.index,!n.has(s.source))return F(new Ot([\"edges\",o,\"source\"],new fe({expected:\"an encoded node index\"},s.source,t)));if(!n.has(s.target))return F(new Ot([\"edges\",o,\"target\"],new fe({expected:\"an encoded node index\"},s.target,t)))}return g(gy(e))}function roe(e,t,r){return!VA(e)||e.mutable||e.type!==t?F(new fe({expected:`an immutable ${t} Graph`},e,r)):g(om(e))}function noe(e,t){return(r,n)=>{let o=om(r),s=om(n);if(o.type!==s.type||o.nodes.length!==s.nodes.length||o.edges.length!==s.edges.length)return!1;for(let a=0;a<o.nodes.length;a++)if(o.nodes[a].index!==s.nodes[a].index||!e(o.nodes[a].data,s.nodes[a].data))return!1;for(let a=0;a<o.edges.length;a++){let i=o.edges[a],c=s.edges[a],u=o.type===\"directed\"?i.source===c.source&&i.target===c.target:i.source===c.source&&i.target===c.target||i.source===c.target&&i.target===c.source;if(i.index!==c.index||!u||!t(i.data,c.data))return!1}return!0}}function ooe(e,t,r){return Hi()(st([PS,ve({nodes:FS(t),edges:Be(Ds([ts,ts,r]))})]),le(n=>{if(n===null)return gy({type:e,nodes:[],edges:[]});let o=n.nodes.map((s,a)=>({index:a,data:s}));return gy({type:e,nodes:o,edges:n.edges.map(([s,a,i],c)=>({index:c,source:s%o.length,target:a%o.length,data:i}))})}))}function soe(e,t,r){let n=yn()([t,r],([o,s])=>{let a=HK(e,o,s);return(i,c,u)=>!VA(i)||i.mutable||i.type!==e?F(new _t(c,i,u)):C(St(a)(om(i),u),f=>zK(f,u))},{representation:{id:\"effect/schema/Graph\",payload:e},toCode:({typeParameters:o})=>({runtime:`Schema.Graph(${K(e)}, ${o[0].runtime}, ${o[1].runtime})`,Type:`Graph.Graph<${o[0].Type}, ${o[1].Type}, ${K(e)}>`,importDeclarations:['import * as Graph from \"effect/Graph\"']}),expected:`an immutable ${e} Graph`,toCodec:([o,s])=>ke()(HK(e,o,s),mt({decode:zK,encode:(a,i)=>roe(a,e,i)})),toCodecArbitrary:({typeParameters:[o,s]})=>ooe(e,o,s),toEquivalence:([o,s])=>noe(o,s)});return Q(n.ast,{type:e,node:t,edge:r})}function WK(e){return ke()(e,Ge({decode:kA,encode:em}))}function aoe(e,t){let r=yn()([e,t],([n,o])=>{let s=Be(Ds([n,o]));return(a,i,c)=>BU(a)?Sr(St(s)(em(a),c),{onSuccess:kA,onFailure:u=>mn(i,\"entries\",u,a,c)}):F(new _t(i,a,c))},{representation:{id:\"effect/schema/HashMap\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.HashMap(${n[0].runtime}, ${n[1].runtime})`,Type:`HashMap.HashMap<${n[0].Type}, ${n[1].Type}>`,importDeclarations:['import * as HashMap from \"effect/HashMap\"']}),expected:\"HashMap\",toCodec:([n,o])=>WK(Be(Ds([n,o]))),toCodecArbitrary:({constraint:n,typeParameters:[o,s]})=>WK(MS(Be(Ds([o,s])).check(RB()),n?.minSize,n?.maxSize)),toEquivalence:([n,o])=>_h(n,o)});return Q(r.ast,{key:e,value:t})}function qK(e){return ke()(e,Ge({decode:RA,encode:wt}))}function ioe(e){let t=yn()([e],([r])=>{let n=Be(r);return(o,s,a)=>qU(o)?Sr(St(n)(wt(o),a),{onSuccess:RA,onFailure:i=>mn(s,\"values\",i,o,a)}):F(new _t(s,o,a))},{representation:{id:\"effect/schema/HashSet\",payload:null},toCode:({typeParameters:r})=>({runtime:`Schema.HashSet(${r[0].runtime})`,Type:`HashSet.HashSet<${r[0].Type}>`}),expected:\"HashSet\",toCodec:([r])=>qK(Be(r)),toCodecArbitrary:({constraint:r,typeParameters:[n]})=>qK(MS(Be(n).check(Tv()),r?.minSize,r?.maxSize)),toEquivalence:([r])=>hp(r)});return Q(t.ast,{value:e})}function ku(e){let t=yn()([e],([r])=>(n,o,s)=>tf(n)?ge(n)?li:Sr(St(r)(n.value,s),{onSuccess:_,onFailure:a=>mn(o,\"value\",a,n,s)}):F(new _t(o,n,s)),{representation:{id:\"effect/schema/Option\",payload:null},toCode:({typeParameters:r})=>({runtime:`Schema.Option(${r[0].runtime})`,Type:`Option.Option<${r[0].Type}>`,importDeclarations:['import * as Option from \"effect/Option\"']}),expected:\"Option\",toCodec:([r])=>ke()(st([ve({_tag:zt(\"Some\"),value:r}),ve({_tag:zt(\"None\")})]),Ge({decode:n=>n._tag===\"None\"?v():_(n.value),encode:n=>Ce(n)?{_tag:\"Some\",value:n.value}:{_tag:\"None\"}}))});return Q(t.ast,{value:e})}function coe(e){return yv(e).pipe(J(ku(Sn(e)),ED()))}function uoe(e){return NS(e).pipe(J(ku(Sn(e)),ID()))}function foe(e,t){return lB(e).pipe(J(ku(Sn(e)),wD(t)))}var Dj=je(YU,{representation:{id:\"effect/http/Cookie\",payload:null},toCode:()=>({runtime:\"Schema.Cookie\",Type:\"Cookies.Cookie\",importDeclarations:['import * as Cookies from \"effect/http/Cookies\"']}),expected:\"Cookie\"}),Lj=je(ZU,{representation:{id:\"effect/http/Cookies\",payload:null},toCode:()=>({runtime:\"Schema.Cookies\",Type:\"Cookies.Cookies\",importDeclarations:['import * as Cookies from \"effect/http/Cookies\"']}),expected:\"Cookies\",toCodecJson:()=>ke()(Be(H),Ge({decode:QU,encode:n2})),toCodecIso:()=>ke()(Na(H,Dj),Ge({decode:DA,encode:e=>e.cookies}))}),loe=Lj.pipe(J(Na(H,H),Ge({decode:r2,encode:e=>LA(globalThis.Object.entries(e).map(([t,r])=>t2(t,r)))}))),poe=je(c2,{representation:{id:\"effect/http/Headers\",payload:null},toCode:()=>({runtime:\"Schema.Headers\",Type:\"Headers.Headers\",importDeclarations:['import * as Headers from \"effect/http/Headers\"']}),expected:\"Headers\",toEquivalence:()=>HA,toCodec:()=>ke()(Na(H,H),Ge({decode:u2,encode:e=>({...e})}))}),$j=st([ve({_tag:Fa(\"Duration\"),duration:vu.check(Ne(e=>sn(e)&&!hx(e),{expected:\"a finite, non-negative duration\"}))}),ve({_tag:Fa(\"DateTime\"),dateTime:Kl})]),doe=mt({decode:(e,t)=>mr(d2(e),{onFailure:()=>F(new fe({expected:\"whole non-negative seconds or an HTTP date (RFC 9110 \\xA710.2.3)\"},e,t)),onSuccess:g}),encode:e=>g(m2(e))}),moe=H.annotate({expected:\"a Retry-After header value\"}).pipe(J($j,doe)),Kv=je(qA,{representation:{id:\"effect/http/UrlParams\",payload:null},toCode:()=>({runtime:\"Schema.UrlParams\",Type:\"UrlParams.UrlParams\",importDeclarations:['import * as UrlParams from \"effect/http/UrlParams\"']}),expected:\"UrlParams\",toEquivalence:()=>JA,toCodec:()=>ke()(Be(Ds([H,H])),Ge({decode:xy,encode:e=>e.params.map(([t,r])=>[t,nm(r)])}))}),hoe=(e,t)=>Kv.pipe(J(vv(Fl,t),mt({decode:r=>Zt(b2(r,e),{onNone:()=>F(new Ot([e],new Ni(void 0))),onSome:g}),encode:r=>g(xy([[e,r]]))}))),xoe=Kv.pipe(J(Na(H,st([H,FS(H)])),Ge({decode:E2,encode:y2})));function goe(e){return rs(e).pipe(J(ku(Sn(e)),AD()))}function yoe(e){return Pl(e).pipe(J(ku(Sn(e)),CD()))}function Soe(e,t){let r=t===void 0?\"omit\":t.onNoneEncoding,n=r===null?null:void 0;return Pl(yv(e)).pipe(J(ku(Sn(e)),ky({decode:o=>o.pipe(hc(kh),_),encode:r===\"omit\"?mc:o=>_(Tp(mc(o),()=>n))})))}function KS(e,t){let r=typeof t?.label==\"string\"?t.label:void 0,n=t?.disallowJsonEncode===!0,o=r!==void 0?n?{label:r,disallowJsonEncode:!0}:{label:r}:n?{disallowJsonEncode:!0}:void 0,s=r!==void 0?St(zt(r)):void 0,a=yn()([e],([i])=>(c,u,f)=>{if(Qf(c)){let p=s!==void 0?Lf(s(c.label,f),d=>new Ot([\"label\"],d)):ie;return Ct(p,()=>Sr(St(i)(Mi(c),f),{onSuccess:d=>Ta(d,{label:c.label}),onFailure:()=>new Ht(u,[new Ot([\"value\"],new fe(void 0,c,f))],c,f)}))}return F(new _t(u,c,f))},{representation:{id:\"effect/schema/Redacted\",payload:o??null},toCode:({typeParameters:i})=>({runtime:o!==void 0?`Schema.Redacted(${i[0].runtime}, ${K(o)})`:`Schema.Redacted(${i[0].runtime})`,Type:`Redacted.Redacted<${i[0].Type}>`,importDeclarations:['import * as Redacted from \"effect/Redacted\"']}),expected:\"Redacted\",toCodecJson:([i])=>ke()(i,{decode:le(c=>Ta(c,{label:r})),encode:n?cu(c=>\"Cannot serialize Redacted\"+(Ce(c)&&typeof c.value.label==\"string\"?` with label: \"${c.value.label}\"`:\"\")):le(Mi)}),toEquivalence:([i])=>a2(i)});return Q(a.ast,{value:e})}function boe(e,t){return J(KS(Sn(e),{label:t?.label,disallowJsonEncode:t?.disallowEncode}),{decode:le(r=>Ta(r,{label:t?.label})),encode:t?.disallowEncode?cu(r=>\"Cannot encode Redacted\"+(Ce(r)&&typeof r.value.label==\"string\"?` with label: \"${r.value.label}\"`:\"\")):le(Mi)})(e)}function Eoe(e,t){let r=yn()([e,t],([n,o])=>(s,a,i)=>{if(!y_(s))return F(new _t(a,s,i));switch(s._tag){case\"Success\":return Sr(ZC(n)(s.success,i),{onSuccess:j,onFailure:c=>mn(a,\"success\",c,s,i)});case\"Failure\":return Sr(ZC(o)(s.failure,i),{onSuccess:q,onFailure:c=>mn(a,\"failure\",c,s,i)})}},{representation:{id:\"effect/schema/Result\",payload:null},toCode:({typeParameters:n})=>({runtime:`Schema.Result(${n[0].runtime}, ${n[1].runtime})`,Type:`Result.Result<${n[0].Type}, ${n[1].Type}>`,importDeclarations:['import * as Result from \"effect/Result\"']}),expected:\"Result\",toCodec:([n,o])=>ke()(st([ve({_tag:zt(\"Success\"),success:n}),ve({_tag:zt(\"Failure\"),failure:o})]),Ge({decode:s=>s._tag===\"Success\"?j(s.success):q(s.failure),encode:s=>rt(s)?{_tag:\"Success\",success:s.success}:{_tag:\"Failure\",failure:s.failure}}))});return Q(r.ast,{success:e,failure:t})}var Kj=(e,t)=>mt({decode:(r,n)=>Lf(jc(e(r)),o=>new fe({message:o.message},r,n)),encode:r=>g(t(r))}),Bj=ve({major:ts,minor:ts,patch:ts,prerelease:Be(st([ts,H.check(zi(/^[0-9]*[A-Za-z-][0-9A-Za-z-]*$/))]))}),jj=Kj(OK,Iu),Hj=H.annotate({expected:\"a string that will be decoded as a SemVer\"}),zj=je(rv,{representation:{id:\"effect/schema/SemVer\",payload:null},toCode:()=>({runtime:\"Schema.SemVer\",Type:\"SemVer.SemVer\",importDeclarations:['import * as SemVer from \"effect/SemVer\"']}),expected:\"SemVer\",toCodecArbitrary:()=>Hi()(ve({...Bj.fields,build:Be(H.check(zi(/^[0-9A-Za-z-]+$/)))}),le(nv)),toCodecJson:()=>ke()(Hj,jj),toFormatter:()=>Iu}),Ioe=Hj.pipe(J(zj,jj)),Wj=Kj(cv,ji),qj=H.annotate({expected:\"a string that will be decoded as a SemVer range\"}),Jj=je(iv,{representation:{id:\"effect/schema/SemVerRange\",payload:null},toCode:()=>({runtime:\"Schema.SemVerRange\",Type:\"SemVerRange.SemVerRange\",importDeclarations:['import * as SemVerRange from \"effect/SemVerRange\"']}),expected:\"SemVerRange\",toCodecArbitrary:()=>Hi()(Be(Be(ve({operator:Jn([\"\",\"=\",\"<\",\"<=\",\">\",\">=\",\"~\",\"^\"]),version:Bj})).check(wv(1))),le(e=>PK(e.map(t=>t.map(({operator:r,version:n})=>`${r}${Iu(nv(n))}`).join(\" \")).join(\" || \")))),toCodecJson:()=>ke()(qj,Wj),toFormatter:()=>ji}),woe=qj.pipe(J(Jj,Wj)),Aoe=globalThis.Symbol.for(\"immer-draftable\"),mv={};function Bv(e,t,r,n,o){let s=Toe(r,t,n),a=Gj(t),i=class extends e{constructor(...[c,u]){let p=u?.[\"~payload\"],d=p?.token===mv?p.value:r.make(c??{},u);super(d,{...u,disableChecks:!0,\"~payload\":{token:mv,value:d}})}static[qm]=qm;get[a](){return a}static[Aoe]=!0;static identifier=t;static fields=r.fields;static get ast(){return s(this).ast}static pipe(){return te(this,arguments)}static rebuild(c){return s(this).rebuild(c)}static make(c,u){return zL(Mt(s(this).ast),c??{},u,f=>jv(this,f))}static makeOption(c,u){return Gy(s(this))(c??{},u)}static makeEffect(c,u){return s(this).makeEffect(c??{},u)}static annotate(c){return this.rebuild(Go(this.ast,c))}static annotateKey(c){return this.rebuild(Tm(this.ast,c))}static check(...c){return this.rebuild(Us(this.ast,c))}static extend(c){return(u,f)=>{let p=nh(u)?u:ve(u),d={...r.fields,...p.fields},m=Ny(d,r.ast.checks,{identifier:c});return Bv(this,c,gv(Us(m,p.ast.checks),d),f,o)}}static mapFields(c,u){return r.mapFields(c,u)}};return o!==void 0&&Object.assign(i.prototype,o(t)),i}function jv(e,t){return new e(t,{\"~payload\":{token:mv,value:t}})}function Coe(e){return new Ke(le(t=>jv(e,t)),hn())}function Gj(e){return`~effect/Schema/Class/${e}`}function Toe(e,t,r){let n;return o=>{if(n!==void 0)return n;let s=Gj(t),a=u=>u instanceof o||A(u,s),i=Coe(o),c=Q(new fl([e.ast],()=>(u,f,p)=>a(u)?g(u):F(new _t(f,u,p)),{identifier:t,[Sy]:([u])=>({isConstructed:a,link:new Tt(u,i)}),toCodec:([u])=>new Tt(u.ast,i),toEquivalence:([u])=>u,toFormatter:([u])=>f=>`${o.identifier}(${u(f)})`,[sm]:il(e.ast),...r}));return n=J(c,i)(e)}}function nh(e){return RS(e)}var Vj=e=>(t,r)=>{let n=nh(t)?t:ve(t);return Bv(xx,e,n,r,o=>({toString(){return`${o}(${K({...this})})`}}))},voe=e=>(t,r,n)=>{let o=nh(r)?r.mapFields(s=>({_tag:Fa(t),...s}),{unsafePreserveChecks:!0}):Vm(t,r);return Vj(e??t)(o,n)},Zj=e=>(t,r)=>{let n=nh(t)?t:ve(t);return Bv(Ip,e,n,r,s=>({name:s}))},koe=e=>(t,r,n)=>{let o=nh(r)?r.mapFields(s=>({_tag:Fa(t),...s}),{unsafePreserveChecks:!0}):Vm(t,r);return Zj(e??t)(o,n)};function Ooe(e){return t=>t.annotate({toFormatter:e})}function _oe(e,t){return H$(e.ast,t)}function Roe(e){return t=>t.annotate({toEquivalence:e})}function Poe(e){return gT(e.ast)}function Moe(e,t){return Pm(e.ast,t)}function Foe(e,t){let r=Pm(gl(e.ast),t);return cS(r,t)}var Noe=tS,Uoe=rS,oh=nS,Doe=p$,Loe=x$;function $oe(e,t){return L$(e,t)}function Koe(e){return Z$(e)}function Boe(e){return Y$(e)}function joe(e){return Q$(e)}function Hoe(e,t){return r=>Q(Go(r.ast,{toCodecIso:()=>new Tt(e.ast,vy(t))}),{schema:r})}function zoe(e){return D$(e)}function Woe(e){let t=pB(()=>r),r=st([e,Be(t),Na(H,t)]);return r}var BS=Q(Go(cl,{toCode:()=>({runtime:\"Schema.Json\",Type:\"Schema.Json\"})})),qoe=Na(H,BS),Joe=ve({message:H,name:rs(H),stack:rs(H),cause:rs(BS)}),Goe=Q(Go(EL,{toCode:()=>({runtime:\"Schema.MutableJson\",Type:\"Schema.MutableJson\"})}));function Voe(e){return va(e.ast)}function Zoe(e){return e.ast.context?.annotations}var tn=HI,Yj=MM;var Qj=\"~effect/MutableRef\",Yoe={[Qj]:Qj,...kr,toJSON(){return{_id:\"MutableRef\",current:qt(this.current)}}},jl=e=>{let t=Object.create(Yoe);return t.current=e,t};var Xj=e=>e.current;var HS=l(2,(e,t)=>(e.current=t,e));var Qoe=\"~effect/PubSub\";var Xoe=\"~effect/PubSub/Subscription\",JS=e=>Y(()=>sse(e.atomicPubSub(),new Map,oo(),tn(!1),jl(!1),e.strategy(),jl(v()))),GS=e=>JS({atomicPubSub:()=>tk(e),strategy:()=>new zS}),VS=e=>JS({atomicPubSub:()=>tk(e),strategy:()=>new WS}),ZS=e=>JS({atomicPubSub:()=>tk(e),strategy:()=>new ek}),YS=e=>JS({atomicPubSub:()=>eH(e),strategy:()=>new WS}),tk=e=>{let t=typeof e==\"number\"?{capacity:e}:e;if(ase(t.capacity),t.capacity===1/0)return eH(t);let r=t.replay&&t.replay>0?new qS(Math.ceil(t.replay)):void 0;return t.capacity===1?new Gv(r):L1(t.capacity)===t.capacity?new qv(t.capacity,r):new zv(t.capacity,r)},eH=e=>{let t=e?.replay;return new Zv(t&&t>0?new qS(Math.ceil(t)):void 0)};var sh=e=>ma(Un(t=>(HS(e.shutdownFlag,!0),Xe(e.scope,ld(t.id)).pipe(Zr(e.strategy.shutdown),Cg(e.shutdownHook.open),pi)))),QS=l(2,(e,t)=>Y(()=>ese(e,t))),ese=l(2,(e,t)=>{if(e.shutdownFlag.current||Ce(e.ended.current))return!1;if(HS(e.ended,_(t)),e.strategy instanceof zS)for(let[n,o,s]of yi(e.strategy.publishers))s&&ys(o,Gr(!1));let r=Gr(t);for(let n of e.subscribers.values())for(let o of n){let s;for(;(s=Gc(o))!==br;)ys(s,r)}return e.subscribers.clear(),!0});var XS=l(2,(e,t)=>L(()=>e.shutdownFlag.current||Ce(e.ended.current)?g(!1):e.pubsub.publish(t)?(e.strategy.completeSubscribersUnsafe(e.pubsub,e.subscribers),g(!0)):e.strategy.handleSurplus(e.pubsub,e.subscribers,[t],e.shutdownFlag,e.ended)));var tH=l(2,(e,t)=>L(()=>{if(e.shutdownFlag.current||Ce(e.ended.current))return g(!1);let r=e.pubsub.publishAll(t);return e.strategy.completeSubscribersUnsafe(e.pubsub,e.subscribers),r.length===0?g(!0):e.strategy.handleSurplus(e.pubsub,e.subscribers,r,e.shutdownFlag,e.ended)})),ah=e=>ma(Od(t=>{let r=Me(t,Vr),n=tr(e.scope),o=ose(e.pubsub,e.subscribers,e.strategy,e.ended);return xr(n,tse(o)).pipe(Zr(bs(r,s=>Xe(n,s))),jt(o))})),tse=e=>ma(Un(t=>(HS(e.shutdownFlag,!0),ui(yi(e.pollers),r=>u0(r,t.id),{discard:!0,concurrency:\"unbounded\"}).pipe(Yr(()=>Y(()=>{e.subscribers.delete(e.subscription),e.subscription.unsubscribe(),e.replayWindow.close(),e.strategy.onPubSubEmptySpaceUnsafe(e.pubsub,e.subscribers)})),Cg(e.shutdownHook.open),pi)))),eb=e=>L(()=>{if(e.shutdownFlag.current)return io;if(e.replayWindow.remaining>0){let r=e.replayWindow.take();return g(r)}let t=e.pollers.length===0?e.subscription.poll():br;return t===br?nH(e):(e.strategy.onPubSubEmptySpaceUnsafe(e.pubsub,e.subscribers),g(t))}),rH=e=>L(function t(r){if(e.shutdownFlag.current)return io;let n=e.pollers.length===0?e.subscription.pollUpTo(Number.POSITIVE_INFINITY):[];return r&&(n=r.concat(n)),e.strategy.onPubSubEmptySpaceUnsafe(e.pubsub,e.subscribers),e.replayWindow.remaining>0?g(e.replayWindow.takeAll().concat(n)):Mr(n)?g(n):C(nH(e),o=>t([o]))}),nH=e=>Mf(t=>{if(e.shutdownFlag.current)return t(io);if(Ce(e.ended.current)){let o=e.pollers.length===0?e.subscription.poll():br;return o!==br?(e.strategy.onPubSubEmptySpaceUnsafe(e.pubsub,e.subscribers),t(g(o))):t(g(e.ended.current.value))}let r=Mc(),n=e.subscribers.get(e.subscription);return n||(n=new Set,e.subscribers.set(e.subscription,n)),n.add(e.pollers),Bo(e.pollers,r),e.strategy.completePollersUnsafe(e.pubsub,e.subscribers,e.subscription,e.pollers),r.effect?t(r.effect):(r.resumes=[t],Y(()=>bF(e.pollers,r)))});var Ft=Symbol.for(\"effect/PubSub/AbsentValue\"),rse=(e,t,r)=>{e.has(t)||e.set(t,new Set),e.get(t).add(r)},nse=(e,t,r)=>{if(!e.has(t))return;let n=e.get(t);n.delete(r),n.size===0&&e.delete(t)},ose=(e,t,r,n)=>new Qv(e,t,e.subscribe(),xa(),tn(!1),jl(!1),r,e.replayWindow(),n),zv=class{array;replayIndices;publisherIndex=0;subscribers;subscriberCount=0;subscribersIndex=0;capacity;replayBuffer;constructor(t,r){this.capacity=t,this.replayBuffer=r,this.array=Array.from({length:t}),this.replayIndices=r?Array.from({length:t}):[],this.subscribers=Array.from({length:t})}replayWindow(){return this.replayBuffer?new Hl(this.replayBuffer):tb}isEmpty(){return this.publisherIndex===this.subscribersIndex}isFull(){return this.publisherIndex===this.subscribersIndex+this.capacity}size(){return this.publisherIndex-this.subscribersIndex}publish(t){if(this.isFull())return!1;let r=this.replayBuffer?.offer(t);if(this.subscriberCount!==0){let n=this.publisherIndex%this.capacity;this.array[n]=t,r!==void 0&&(this.replayIndices[n]=r),this.subscribers[n]=this.subscriberCount,this.publisherIndex+=1}return!0}publishAll(t){if(this.subscriberCount===0)return this.replayBuffer&&this.replayBuffer.offerAll(t),[];let r=wt(t),n=r.length,o=this.publisherIndex-this.subscribersIndex,s=this.capacity-o,a=Math.min(n,s);if(a===0)return r;let i=0,c=this.publisherIndex+a;for(;this.publisherIndex!==c;){let u=r[i++],f=this.publisherIndex%this.capacity;this.array[f]=u;let p=this.replayBuffer?.offer(u);p!==void 0&&(this.replayIndices[f]=p),this.subscribers[f]=this.subscriberCount,this.publisherIndex+=1}return r.slice(i)}slide(){if(this.subscribersIndex!==this.publisherIndex){let t=this.subscribersIndex%this.capacity,r=this.array[t];this.array[t]=Ft,this.subscribers[t]=0,this.subscribersIndex+=1,this.replayBuffer?.slide(r,this.replayIndices[t])}}subscribe(){return this.subscriberCount+=1,new Wv(this,this.publisherIndex,!1)}},Wv=class{self;subscriberIndex;unsubscribed;constructor(t,r,n){this.self=t,this.subscriberIndex=r,this.unsubscribed=n}isEmpty(){return this.unsubscribed||this.self.publisherIndex===this.subscriberIndex||this.self.publisherIndex===this.self.subscribersIndex}size(){return this.unsubscribed?0:this.self.publisherIndex-Math.max(this.subscriberIndex,this.self.subscribersIndex)}poll(){if(this.unsubscribed)return br;if(this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex),this.subscriberIndex!==this.self.publisherIndex){let t=this.subscriberIndex%this.self.capacity,r=this.self.array[t];return this.self.subscribers[t]-=1,this.self.subscribers[t]===0&&(this.self.array[t]=Ft,this.self.subscribersIndex+=1),this.subscriberIndex+=1,r}return br}pollUpTo(t){if(t=It(t),this.unsubscribed)return[];this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex);let r=this.self.publisherIndex-this.subscriberIndex,n=Math.min(t,r);if(n<=0)return[];let o=[],s=this.subscriberIndex+n;for(;this.subscriberIndex!==s;){let a=this.subscriberIndex%this.self.capacity,i=this.self.array[a];this.self.subscribers[a]-=1,this.self.subscribers[a]===0&&(this.self.array[a]=Ft,this.self.subscribersIndex+=1),o.push(i),this.subscriberIndex+=1}return o}unsubscribe(){if(!this.unsubscribed)for(this.unsubscribed=!0,this.self.subscriberCount-=1,this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex);this.subscriberIndex!==this.self.publisherIndex;){let t=this.subscriberIndex%this.self.capacity;this.self.subscribers[t]-=1,this.self.subscribers[t]===0&&(this.self.array[t]=Ft,this.self.subscribersIndex+=1),this.subscriberIndex+=1}}},qv=class{array;replayIndices;mask;publisherIndex=0;subscribers;subscriberCount=0;subscribersIndex=0;capacity;replayBuffer;constructor(t,r){this.capacity=t,this.replayBuffer=r,this.array=Array.from({length:t}),this.replayIndices=r?Array.from({length:t}):[],this.mask=t-1,this.subscribers=Array.from({length:t})}replayWindow(){return this.replayBuffer?new Hl(this.replayBuffer):tb}isEmpty(){return this.publisherIndex===this.subscribersIndex}isFull(){return this.publisherIndex===this.subscribersIndex+this.capacity}size(){return this.publisherIndex-this.subscribersIndex}publish(t){if(this.isFull())return!1;let r=this.replayBuffer?.offer(t);if(this.subscriberCount!==0){let n=this.publisherIndex&this.mask;this.array[n]=t,r!==void 0&&(this.replayIndices[n]=r),this.subscribers[n]=this.subscriberCount,this.publisherIndex+=1}return!0}publishAll(t){if(this.subscriberCount===0)return this.replayBuffer&&this.replayBuffer.offerAll(t),[];let r=wt(t),n=r.length,o=this.publisherIndex-this.subscribersIndex,s=this.capacity-o,a=Math.min(n,s);if(a===0)return r;let i=0,c=this.publisherIndex+a;for(;this.publisherIndex!==c;){let u=r[i++],f=this.publisherIndex&this.mask;this.array[f]=u;let p=this.replayBuffer?.offer(u);p!==void 0&&(this.replayIndices[f]=p),this.subscribers[f]=this.subscriberCount,this.publisherIndex+=1}return r.slice(i)}slide(){if(this.subscribersIndex!==this.publisherIndex){let t=this.subscribersIndex&this.mask,r=this.array[t];this.array[t]=Ft,this.subscribers[t]=0,this.subscribersIndex+=1,this.replayBuffer?.slide(r,this.replayIndices[t])}}subscribe(){return this.subscriberCount+=1,new Jv(this,this.publisherIndex,!1)}},Jv=class{self;subscriberIndex;unsubscribed;constructor(t,r,n){this.self=t,this.subscriberIndex=r,this.unsubscribed=n}isEmpty(){return this.unsubscribed||this.self.publisherIndex===this.subscriberIndex||this.self.publisherIndex===this.self.subscribersIndex}size(){return this.unsubscribed?0:this.self.publisherIndex-Math.max(this.subscriberIndex,this.self.subscribersIndex)}poll(){if(this.unsubscribed)return br;if(this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex),this.subscriberIndex!==this.self.publisherIndex){let t=this.subscriberIndex&this.self.mask,r=this.self.array[t];return this.self.subscribers[t]-=1,this.self.subscribers[t]===0&&(this.self.array[t]=Ft,this.self.subscribersIndex+=1),this.subscriberIndex+=1,r}return br}pollUpTo(t){if(t=It(t),this.unsubscribed)return[];this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex);let r=this.self.publisherIndex-this.subscriberIndex,n=Math.min(t,r);if(n<=0)return[];let o=[],s=this.subscriberIndex+n;for(;this.subscriberIndex!==s;){let a=this.subscriberIndex&this.self.mask,i=this.self.array[a];this.self.subscribers[a]-=1,this.self.subscribers[a]===0&&(this.self.array[a]=Ft,this.self.subscribersIndex+=1),o.push(i),this.subscriberIndex+=1}return o}unsubscribe(){if(!this.unsubscribed)for(this.unsubscribed=!0,this.self.subscriberCount-=1,this.subscriberIndex=Math.max(this.subscriberIndex,this.self.subscribersIndex);this.subscriberIndex!==this.self.publisherIndex;){let t=this.subscriberIndex&this.self.mask;this.self.subscribers[t]-=1,this.self.subscribers[t]===0&&(this.self.array[t]=Ft,this.self.subscribersIndex+=1),this.subscriberIndex+=1}}},Gv=class{publisherIndex=0;subscriberCount=0;subscribers=0;value=Ft;replayIndex=0;capacity=1;replayBuffer;constructor(t){this.replayBuffer=t}replayWindow(){return this.replayBuffer?new Hl(this.replayBuffer):tb}pipe(){return te(this,arguments)}isEmpty(){return this.subscribers===0}isFull(){return!this.isEmpty()}size(){return this.isEmpty()?0:1}publish(t){if(this.isFull())return!1;let r=this.replayBuffer?.offer(t);return this.subscriberCount!==0&&(this.value=t,r!==void 0&&(this.replayIndex=r),this.subscribers=this.subscriberCount,this.publisherIndex+=1),!0}publishAll(t){if(this.subscriberCount===0)return this.replayBuffer&&this.replayBuffer.offerAll(t),[];let r=wt(t);return r.length===0?r:this.publish(r[0])?r.slice(1):r}slide(){if(this.isFull()){let t=this.value;this.subscribers=0,this.value=Ft,this.replayBuffer?.slide(t,this.replayIndex)}}subscribe(){return this.subscriberCount+=1,new Vv(this,this.publisherIndex,!1)}},Vv=class{self;subscriberIndex;unsubscribed;constructor(t,r,n){this.self=t,this.subscriberIndex=r,this.unsubscribed=n}isEmpty(){return this.unsubscribed||this.self.subscribers===0||this.subscriberIndex===this.self.publisherIndex}size(){return this.isEmpty()?0:1}poll(){if(this.isEmpty())return br;let t=this.self.value;return this.self.subscribers-=1,this.self.subscribers===0&&(this.self.value=Ft),this.subscriberIndex=this.self.publisherIndex,t}pollUpTo(t){return It(t)<1||this.isEmpty()?[]:[this.poll()]}unsubscribe(){this.unsubscribed||(this.unsubscribed=!0,this.self.subscriberCount-=1,this.self.subscribers!==0&&this.subscriberIndex!==this.self.publisherIndex&&(this.self.subscribers-=1,this.self.subscribers===0&&(this.self.value=Ft)))}},Zv=class{publisherHead={value:Ft,replayIndex:void 0,subscribers:0,next:null};publisherTail=this.publisherHead;publisherIndex=0;subscribersIndex=0;capacity=Number.MAX_SAFE_INTEGER;replayBuffer;constructor(t){this.replayBuffer=t}replayWindow(){return this.replayBuffer?new Hl(this.replayBuffer):tb}isEmpty(){return this.publisherHead===this.publisherTail}isFull(){return!1}size(){return this.publisherIndex-this.subscribersIndex}publish(t){let r=this.replayBuffer?.offer(t),n=this.publisherTail.subscribers;if(n!==0){let o={value:t,replayIndex:r,subscribers:n,next:null};this.publisherTail.next=o,this.publisherTail=this.publisherTail.next,this.publisherIndex+=1}return!0}publishAll(t){if(this.publisherTail.subscribers!==0)for(let r of t)this.publish(r);else this.replayBuffer&&this.replayBuffer.offerAll(t);return[]}slide(){if(this.publisherHead!==this.publisherTail){let t=this.publisherHead.next,r=t.value;this.publisherHead=this.publisherHead.next,this.publisherHead.value=Ft,this.subscribersIndex+=1,this.replayBuffer?.slide(r,t.replayIndex)}}subscribe(){return this.publisherTail.subscribers+=1,new Yv(this,this.publisherTail,this.publisherIndex,!1)}},Yv=class{self;subscriberHead;subscriberIndex;unsubscribed;constructor(t,r,n,o){this.self=t,this.subscriberHead=r,this.subscriberIndex=n,this.unsubscribed=o}isEmpty(){if(this.unsubscribed)return!0;let t=!0,r=!0;for(;r;)this.subscriberHead===this.self.publisherTail?r=!1:this.subscriberHead.next.value!==Ft?(t=!1,r=!1):(this.subscriberHead=this.subscriberHead.next,this.subscriberIndex+=1);return t}size(){return this.unsubscribed?0:this.self.publisherIndex-Math.max(this.subscriberIndex,this.self.subscribersIndex)}poll(){if(this.unsubscribed)return br;let t=!0,r=br;for(;t;)if(this.subscriberHead===this.self.publisherTail)t=!1;else{let n=this.subscriberHead.next.value;n!==Ft&&(r=n,this.subscriberHead.subscribers-=1,this.subscriberHead.subscribers===0&&(this.self.publisherHead=this.self.publisherHead.next,this.self.publisherHead.value=Ft,this.self.subscribersIndex+=1),t=!1),this.subscriberHead=this.subscriberHead.next,this.subscriberIndex+=1}return r}pollUpTo(t){t=It(t);let r=[],n=0;for(;n!==t;){let o=this.poll();o===br?n=t:(r.push(o),n+=1)}return r}unsubscribe(){if(!this.unsubscribed)for(this.unsubscribed=!0,this.self.publisherTail.subscribers-=1;this.subscriberHead!==this.self.publisherTail;)this.subscriberHead.next.value!==Ft&&(this.subscriberHead.subscribers-=1,this.subscriberHead.subscribers===0&&(this.self.publisherHead=this.self.publisherHead.next,this.self.publisherHead.value=Ft,this.self.subscribersIndex+=1)),this.subscriberHead=this.subscriberHead.next}},Qv=class{[Xoe]={_A:D};pubsub;subscribers;subscription;pollers;shutdownHook;shutdownFlag;strategy;replayWindow;ended;constructor(t,r,n,o,s,a,i,c,u){this.pubsub=t,this.subscribers=r,this.subscription=n,this.pollers=o,this.shutdownHook=s,this.shutdownFlag=a,this.strategy=i,this.replayWindow=c,this.ended=u}pipe(){return te(this,arguments)}},Xv=class{[Qoe]={_A:D};pubsub;subscribers;scope;shutdownHook;shutdownFlag;strategy;ended;constructor(t,r,n,o,s,a,i){this.pubsub=t,this.subscribers=r,this.scope=n,this.shutdownHook=o,this.shutdownFlag=s,this.strategy=a,this.ended=i}pipe(){return te(this,arguments)}},sse=(e,t,r,n,o,s,a)=>new Xv(e,t,r,n,o,s,a),ase=e=>{if(e<=0||e!==1/0&&!Number.isInteger(e))throw new Error(`Cannot construct PubSub with capacity of ${e}`)},zS=class{publishers=xa();get shutdown(){return Un(t=>ui(yi(this.publishers),([r,n,o])=>o?u0(n,t.id):ie,{concurrency:\"unbounded\",discard:!0}))}handleSurplus(t,r,n,o,s){return Mf(a=>{if(Ce(s.current))return a(g(!1));let i=Mc();return this.offerUnsafe(n,i),this.onPubSubEmptySpaceUnsafe(t,r),this.completeSubscribersUnsafe(t,r),Xj(o)?(this.removeUnsafe(i),a(io)):i.effect?a(i.effect):(i.resumes=[a],Y(()=>this.removeUnsafe(i)))})}onPubSubEmptySpaceUnsafe(t,r){let n=!0;for(;n&&!t.isFull();){let o=Gc(this.publishers);if(o===br)n=!1;else{let[s,a,i]=o,c=t.publish(s);c||rw(this.publishers,o),this.completeSubscribersUnsafe(t,r),c&&i&&ys(a,Gr(!0))}}}completePollersUnsafe(t,r,n,o){return rk(this,t,r,n,o)}completeSubscribersUnsafe(t,r){return nk(this,t,r)}offerUnsafe(t,r){let n=t[Symbol.iterator](),o=n.next();if(!o.done)for(;;){let s=o.value;if(o=n.next(),o.done){Bo(this.publishers,[s,r,!0]);break}Bo(this.publishers,[s,r,!1])}}removeUnsafe(t){nw(this.publishers,([r,n])=>n!==t)}},WS=class{get shutdown(){return ie}handleSurplus(t,r,n,o){return g(!1)}onPubSubEmptySpaceUnsafe(t,r){}completePollersUnsafe(t,r,n,o){return rk(this,t,r,n,o)}completeSubscribersUnsafe(t,r){return nk(this,t,r)}},ek=class{get shutdown(){return ie}handleSurplus(t,r,n,o,s){return Y(()=>Ce(s.current)?!1:(this.slidingPublishUnsafe(t,n),this.completeSubscribersUnsafe(t,r),!0))}onPubSubEmptySpaceUnsafe(t,r){}completePollersUnsafe(t,r,n,o){return rk(this,t,r,n,o)}completeSubscribersUnsafe(t,r){return nk(this,t,r)}slidingPublishUnsafe(t,r){let n=r[Symbol.iterator](),o=n.next();if(!o.done&&t.capacity>0){let s=o.value,a=!0;for(;a;){t.slide();let i=t.publish(s);i&&(o=n.next())&&!o.done?s=o.value:i&&(a=!1)}}}},rk=(e,t,r,n,o)=>{let s=!0;for(;s&&!n.isEmpty();){let a=Gc(o);if(a===br)nse(r,n,o),o.length===0?s=!1:rse(r,n,o);else{let i=n.poll();i===br?rw(o,a):(ys(a,Gr(i)),e.onPubSubEmptySpaceUnsafe(t,r))}}},nk=(e,t,r)=>{for(let[n,o]of r)for(let s of o)e.completePollersUnsafe(t,r,n,s)},qS=class{capacity;head={value:Ft,index:0,next:null};tail=this.head;slideValues=[];size=0;index=0;publisherIndex=0;constructor(t){this.capacity=t}slide(t,r){this.slideValues[this.index%this.capacity]={value:t,index:r},this.index++}offer(t){let r=this.publisherIndex++;if(this.tail.value=t,this.tail.index=r,this.tail.next={value:Ft,index:0,next:null},this.tail=this.tail.next,this.size===this.capacity){let n=this.head;this.head=n.next,n.next=null,n.value=Ft}else this.size+=1;return r}offerAll(t){for(let r of t)this.offer(r)}},Hl=class{buffer;values;index=0;remaining;slideIndex;newestIndex=-1;constructor(t){this.buffer=t,this.remaining=t.size,this.slideIndex=t.index,this.values=new Array(this.remaining);let r=t.head;for(let n=0;n<this.remaining;n++)this.values[n]=r.value,this.newestIndex=r.index,r=r.next}close(){this.values.length=0,this.remaining=0}sync(){let t=this.buffer.index-this.slideIndex;if(t===0||this.remaining===0)return;let r=Math.min(t,this.buffer.capacity),n=this.buffer.index-r;for(let o=0;o<r;o++){let s=this.buffer.slideValues[(n+o)%this.buffer.capacity];s.index>this.newestIndex&&(this.index=(this.index+1)%this.values.length,this.values[(this.index+this.remaining-1)%this.values.length]=s.value,this.newestIndex=s.index)}this.slideIndex=this.buffer.index}take(){if(this.remaining===0)return;this.sync();let t=this.values[this.index];return this.values[this.index]=Ft,this.index=(this.index+1)%this.values.length,this.remaining--,this.remaining===0&&this.close(),t}takeN(t){t=It(t);let r=Math.min(t,this.remaining),n=new Array(r);for(let o=0;o<r;o++)n[o]=this.take();return n}takeAll(){return this.takeN(this.remaining)}},tb={remaining:0,take:()=>{},takeN:()=>[],takeAll:()=>[],close:()=>{}};var sk=e=>fd(e)?ut(e)?ue(e.value):e:g(e);var iH=\"~effect/Channel\",Rr=e=>A(e,iH),ise={[iH]:{_Env:D,_InErr:D,_InElem:D,_OutErr:D,_OutElem:D},pipe(){return te(this,arguments)}},Ue=e=>{let t=Object.create(ise);return t.transform=(r,n)=>nt(e(r,n),o=>g($e(o))),t},rn=(e,t)=>Ue((r,n)=>C(we(e)(r,n),o=>t(o,n))),Cr=e=>Ue((t,r)=>e),ns=e=>Ue(_e(function*(t,r){let n=tr(r),o=a=>Xe(n,bd(a)),s=yield*Lo(e(t,r,n),o);return Lo(s,o)})),we=e=>e.transform,ih=4096,cse=(e,t,r)=>uo({capacity:r?.bufferSize,strategy:r?.strategy}).pipe(Yr(n=>xr(e,fo(n))),Yr(n=>Ss(t(n),e).pipe(nt(o=>cr(n,o)),rr(e,{startImmediately:!0}))));var cH=(e,t)=>Ue((r,n)=>W(cse(n,e,t),Zc)),rb=e=>Ue((t,r)=>L(()=>we(e())(t,r))),use=(e,t,r)=>ns(_e(function*(n,o,s){let a=v();yield*bs(s,c=>Ce(a)?r(a.value,c):ie);let i=yield*ma(W(e,c=>(a=_(c),c)));return yield*we(t(i))(n,o)}));var uH=e=>Cr(Y(()=>{let t=e();return L(()=>{let r=t.next();return r.done?ue(r.value):g(r.value)})})),ak=e=>Cr(Y(()=>{let t=0;return L(()=>t>=e.length?ue():g(e[t++]))}));var ik=(e,t=ih)=>{let r=Xn(t);return Cr(Y(()=>{let n=e(),o=v();return L(()=>{if(o._tag===\"Some\")return ue(o.value);let s=[];for(;s.length<r;){let a=n.next();if(a.done){if(s.length===0)return ue(a.value);o=_(a.value);break}s.push(a.value)}return g(s)})}))};var fH=(e,t=ih)=>ik(()=>e[Symbol.iterator](),t),nb=e=>ob(g(e));var lH=e=>ob(Y(e)),Ou=Cr(g(ue())),pH=Cr(g(Bc)),Ji=e=>Cr(g(F(e))),dH=e=>Cr(Ig(e)),ch=e=>Cr($e(e)),mH=e=>Cr(da(e)),ck=e=>ch(Rc(e)),ob=e=>Cr(Y(()=>{let t=!1;return L(()=>t?ue():(t=!0,e))}));var hH=e=>Cr(C(e,()=>ue())),uk=e=>Cr(g(C(e,sk)));var xH=e=>Cr(g(Zc(e)));var fk=e=>Cr(g(V0(rH(e),()=>ue())));var gH=e=>_u(W(ah(e),fk)),yH=e=>_u(W(ah(e),t=>uk(eb(t))));var SH=e=>Ue((t,r)=>fse({scope:r,readable:e.evaluate(),onError:e.onError,releaseLockOnEnd:e.releaseLockOnEnd}));var fse=e=>{let t=e.readable.getReader(),r=e.exit??jl(void 0),n=L(()=>r.current?r.current:As(fi({try:()=>t.read(),catch:e.onError}),{onFailure:o=>r.current??$e(o),onSuccess:({done:o,value:s})=>r.current?r.current:o?ue():g(Oe(s))}));return jt(xr(e.scope,e.releaseLockOnEnd?Y(()=>t.releaseLock()):Pf(()=>t.cancel().catch(o=>t.closed.then(()=>Promise.reject(o),zr))).pipe(hi(Y(()=>t.releaseLock())))),n)},lse=(e,t)=>Ue(_e(function*(r,n){let o=e[Symbol.asyncIterator](),s=!1;return o.return&&(yield*xr(n,L(()=>s?Y(()=>{o.return().catch(zr)}):Pf(()=>o.return())))),C(fi({try:()=>{let a=o.next();return s=!0,a.finally(()=>{s=!1})},catch:t}),a=>a.done?ue(a.value):g(a.value))})),bH=(e,t)=>os(lse(e,t),Oe),os=l(2,(e,t)=>rn(e,r=>Y(()=>{let n=0;return W(r,o=>t(o,n++))})));var EH=l(2,(e,t)=>rn(e,r=>g(At(r,n=>C(t(n),ue))))),IH=e=>e===void 0||e!==\"unbounded\"&&e<=1,sb=l(e=>Rr(e[0]),(e,t,r)=>IH(r?.concurrency)?wH(e,t):pse(e,t,r)),wH=(e,t)=>Ue((r,n)=>{let o=0;return W(we(e)(r,n),C(s=>t(s,o++)))}),pse=(e,t,r)=>ns(_e(function*(n,o,s){let a=0,i=yield*we(e)(n,o),c=r.concurrency===\"unbounded\"?Number.MAX_SAFE_INTEGER:Math.min(r.concurrency,Number.MAX_SAFE_INTEGER),u=yield*Fd(0);yield*xr(s,fo(u));let f=co(yield*Hc()),p=gi(s);if(r.unordered){let d=Ug(c),m=gt(d.release(1)),h=As({onFailure:y=>C(cr(u,y),m),onSuccess:y=>C(Ln(u,y),m)});yield*d.take(1).pipe(C(()=>i),C(y=>{let S=a++;return p(f(h(L(()=>t(y,S))))),ie}),ir({disableYield:!0}),nt(y=>d.withPermits(c-1)(cr(u,y))),rr(s))}else{let d=yield*Fd(c-2);yield*xr(s,fo(d)),yield*ga(d).pipe(K0,C(y=>Ln(u,y)),ir({disableYield:!0}),nt(y=>cr(u,y)),rr(s));let m,h=y=>{y._tag!==\"Success\"&&(m=y.cause,Si(u,y.cause))};yield*i.pipe(C(y=>{if(m)return $e(m);let S=a++,b=f(L(()=>t(y,S)));return p(b),b.addObserver(h),Ln(d,xi(b))}),ir({disableYield:!0}),nt(y=>Ln(d,Fn(y)).pipe(Zr(cr(d,y)))),rr(s))}return ga(u)}));var lk=l(e=>Rr(e[0]),(e,t,r)=>IH(r?.concurrency)?dse(e,t):mse(e,t,r)),dse=(e,t)=>Ue((r,n)=>W(we(e)(r,n),o=>{let s,a,i=C(o,u=>(a??=tr(n),Ct(we(t(u))(r,a),f=>(s=c(f),s)))),c=At(u=>{if(s=void 0,a.state._tag===\"Empty\")return i;let f=Xe(a,Bt);return a=void 0,C(f,()=>i)});return L(()=>s??i)})),mse=(e,t,r)=>e.pipe(os(t),cb(r)),AH=l(2,(e,t)=>Ue((r,n)=>Y(()=>{let o,s=tr(n),a=C(we(e)(r,s),i=>(o=At(i,c=>Xe(s,Bt).pipe(C(()=>we(t(c))(r,n)),C(u=>(o=u,u)))),o));return L(()=>o??a)})));var pk=l(4,(e,t,r,n)=>Ue(_e(function*(o,s){let a=yield*we(e)(o,s),i=yield*we(t)(o,s),c=r();return L(()=>{let u=n(c,a,i);return W(u,([f,p])=>(c=p,f))})}))),CH=l(2,(e,t)=>Ue((r,n)=>Y(()=>{let o,s=tr(n),a=C(we(e)(r,s),i=>{let c=i.pipe(Yr(()=>(o=i,ie)),At(u=>Xe(s,Gr(u)).pipe(Zr(we(t(u))(r,n)),C(f=>(o=f,f)))));return o=c,c});return L(()=>o??a)}))),TH=e=>lk(e,D),jr=e=>rn(e,t=>{let r,n=0,o=L(function s(){if(r===void 0)return C(t,i=>{switch(i.length){case 0:return s();case 1:return g(i[0]);default:return r=i,g(i[n++])}});let a=r[n++];return n>=r.length&&(r=void 0,n=0),g(a)});return g(o)}),vH=e=>wH(e,sk),kH=e=>rn(e,t=>g(ir(t,{disableYield:!0}))),OH=l(2,(e,t)=>Fo(typeof t==\"function\"?t(D):t).pipe(W(r=>{let n=gr.defaultValue();return dk(db(e,gr,Y(()=>n)),o=>no(o)?$e(o.cause):r(o.value).pipe(W(s=>{n=s}),At(()=>ue(o.value))))}),_u)),dk=(e,t)=>Ue((r,n)=>Y(()=>{let o,s=()=>{let a=tr(n);return C(we(e)(r,a),i=>(o=nt(i,c=>{let u=bd(c);return Xe(a,u).pipe(C(()=>t(u,n)),C(s))}),o))};return L(()=>o??s())})),_H=e=>dk(e,t=>no(t)?$e(t.cause):ie),RH=l(2,(e,t)=>rn(e,(r,n)=>W(Id(t),o=>Yr(r,o)))),PH=l(2,(e,t)=>Ue((r,n)=>W(we(e)(r,n),o=>C(o,function s(a){return t(a)?g(a):C(o,s)}))));var MH=l(2,(e,t)=>rn(e,r=>g(C(r,function n(o){let s=[];for(let a=0;a<o.length;a++)t(o[a])&&s.push(o[a]);return yt(s)?g(s):C(r,n)})))),FH=l(2,(e,t)=>rn(e,r=>g(C(r,function n(o){let s=[];for(let a=0;a<o.length;a++){let i=t(o[a]);rt(i)&&s.push(i.success)}return yt(s)?g(s):C(r,n)})))),NH=l(2,(e,t)=>rn(e,r=>{let n=C(r,o=>z0(o,t));return g(C(n,function o(s){return yt(s)?g(s):C(n,o)}))})),UH=l(2,(e,t)=>rn(e,r=>g(C(r,function n(o){return C(W0(o,t),s=>yt(s)?g(s):C(r,n))})))),zl=l(e=>Rr(e[0]),(e,t,r,n)=>Ue((o,s)=>W(we(e)(o,s),a=>{let i=t(),c,u=0,f,p=As(a,{onFailure(m){f=m;let h=n?.onHalt&&n.onHalt(i);return h&&h.length>0?g([i,h]):$e(m)},onSuccess(m){let h=r(i,m);return v_(h)?g(h):h}});return L(function m(){if(c===void 0)return f?$e(f):C(p,([y,S])=>(i=y,S.length===0?m():S.length===1?g(S[0]):(c=S,m())));let h=c[u++];return u>=c.length&&(c=void 0,u=0),g(h)})})));var DH=l(3,(e,t,r)=>Ue((n,o)=>W(we(e)(n,o),s=>{let a=t,i=!0;return L(()=>i?(i=!1,g(a)):W(C(s,c=>r(a,c)),c=>(a=c,a)))}))),Wl=l(2,(e,t)=>Ue((r,n)=>{let o=tr(n);return W(we(e)(r,o),s=>{let a=s.pipe(nt(i=>{if(Is(i))return $e(i);let c=o;return o=tr(n),Xe(c,Fn(i)).pipe(Zr(we(t(i))(r,o)),C(u=>(a=u,u)))}));return L(()=>a)})})),LH=l(2,(e,t)=>ib(e,cd,t)),ab=l(2,(e,t)=>Wl(e,r=>hH(C(t(r),n=>$e(r))))),$H=l(3,(e,t,r)=>Wl(e,n=>t(n)?r(n):ch(n))),ib=l(3,(e,t,r)=>Wl(e,n=>{let o=t(n);return ae(o)?ch(o.failure):r(o.success,n)})),Da=l(2,(e,t)=>ib(e,cn,r=>t(r)));var KH=l(2,(e,t)=>rn(e,r=>g(Ag(r,n=>Pc(n)?ie:pi(t(n)))))),BH=l(e=>Rr(e[0]),(e,t,r,n)=>Da(e,o=>t(o)?r(o):n?n(o):Ji(o))),jH=l(e=>Rr(e[0]),(e,t,r,n)=>Da(e,o=>{let s=t(o);return ae(s)?n?n(s.failure):Ji(s.failure):r(s.success)}));var HH=l(e=>Rr(e[0]),(e,t,r,n,o)=>Da(e,s=>{if(Wt(s,t)&&A(s,\"reason\")){let a=s.reason;return Wt(a,r)?n(a,s):o?o(a,s):Ji(s)}return Ji(s)})),zH=l(e=>Rr(e[0]),(e,t,r,n)=>{let o;return Da(e,s=>{if(Wt(s,t)&&A(s,\"reason\")&&A(s.reason,\"_tag\")&&hg(s.reason._tag)){let a=s.reason;return o??=new Set(Object.keys(r)),o.has(a._tag)?r[a._tag](a,s):n?n(a,s):Ji(s)}return Ji(s)})});var WH=l(2,(e,t)=>rn(e,r=>g(Do(r,n=>Pc(n)?n:t(n))))),qH=e=>Da(e,ck),JH=l(e=>Rr(e[0]),(e,t)=>{if(!t?.log)return Da(e,()=>Ou);let r=Xp(t.log);return Da(ab(e,n=>t0(n)?r(n):ie),()=>Ou)}),sH=e=>Wl(e,()=>Ou),GH=l(e=>Rr(e[0]),(e,t)=>{if(!t?.log)return sH(e);let r=Xp(t.log);return sH(ab(e,n=>r(n)))}),VH=l(2,(e,t)=>rb(()=>{let r,n=gr.defaultValue(),o=db(e,gr,Y(()=>n)),s=yk(o,()=>(r=void 0,ie)),a=typeof t==\"function\"?t(D):t;return dk(s,(i,c)=>{if(ut(i))return ue(i.value);let u=cn(i.cause);return ae(u)?$e(u.failure):kt(function*(){r||(r=yield*Fo(a)),n=yield*r(u.success)}).pipe(At(()=>F(u.success)),Ss(c))})})),ZH=l(e=>Rr(e[0]),(e,t,r)=>e.pipe(os(t),cb({...r,concurrency:r?.concurrency??1,switch:!0}))),cb=l(2,(e,{bufferSize:t=16,concurrency:r,switch:n=!1})=>ns(_e(function*(o,s,a){let i=r===\"unbounded\"?Number.MAX_SAFE_INTEGER:Math.max(1,r),c=n?void 0:Ug(i),u=yield*Yj(!0),f=new Map,p=yield*Fd(t);yield*xr(a,fo(p));let d=yield*we(e)(o,s);return yield*kt(function*(){for(;;){let m;c&&(f.size<i?yield*c.take(1):(m=yield*Uf(d),yield*Nf(c.take(1),Zr(xi(m),Bc))));let h=m===void 0?yield*d:yield*xi(m),y=tr(a),S=yield*we(h)(o,y);for(;f.size>=i;){let[x,w]=I_(f);f.delete(x),f.size===0&&(yield*u.open),yield*Ko(x),yield*di(Xe(w,ld()))}let b=yield*S.pipe(Yr(()=>kd),C(x=>Ln(p,x)),ir({disableYield:!0}),Lo(_e(function*(x){let w=bd(x),I=yield*so(Xe(y,w));if(!f.has(b))return;let T=pd([w,I]);no(T)&&(yield*cr(p,T.cause)),f.delete(b),c&&(yield*c.release(1)),f.size===0&&(yield*u.open)})),Uf);u.closeUnsafe(),f.set(b,y)}}).pipe(nt(m=>{let h=Sd(m);return rt(h)?u.whenOpen(cr(p,m)):cr(p,m)}),rr(a)),ga(p)}))),ub=l(e=>Rr(e[0])&&Rr(e[1]),(e,t,r)=>ns(_e(function*(n,o,s){let a=r?.haltStrategy??\"both\",i=yield*Fd(0);yield*xr(s,fo(i));let c=0;function u(p,d){if(c++,!Is(d))return cr(i,d);switch(a){case\"both\":return c===2?cr(i,d):ie;case\"left\":case\"right\":return p===a?cr(i,d):ie;case\"either\":return cr(i,d)}}let f=(p,d,m)=>we(d)(n,m).pipe(C(h=>h.pipe(C(y=>Ln(i,y)),ir)),Lo(h=>_d(bd(h),y=>Xe(m,y)).pipe(As({onFailure:y=>u(p,y),onSuccess:()=>u(p,h)}))),rr(s));return yield*f(\"left\",e,tr(s)),yield*f(\"right\",t,tr(s)),ga(i)}))),YH=l(2,(e,t)=>ub(e,hH(t),{haltStrategy:\"left\"})),QH=()=>Ue((e,t)=>Y(()=>{let r=\"\",n=!1,o=v();function s(c){let u=[];function f(p){r.length===0?u.push(p):(u.push(r+p),r=\"\")}for(let p=0;p<c.length;p++){let d=c[p];if(d.length!==0){let m=0,h=d.indexOf(\"\\r\"),y=d.indexOf(`\n`);for(n&&(y===0&&(m=1,y=d.indexOf(`\n`,m)),n=!1);h!==-1||y!==-1;)h===-1||y!==-1&&y<h?(f(d.substring(m,y)),m=y+1,y=d.indexOf(`\n`,m)):(f(d.substring(m,h)),d.length===h+1?(n=!0,m=d.length,h=-1):(m=h+(y===h+1?2:1),h=d.indexOf(\"\\r\",m),y=d.indexOf(`\n`,m)));r=r+d.substring(m)}}return yt(u)?u:null}let a=L(()=>o._tag===\"Some\"?ue(o.value):Uc(e,{onSuccess:i,onFailure:$e,onDone:c=>{if(o=_(c),r.length>0){let u=r;return r=\"\",n=!1,g([u])}return ue(c)}}));function i(c){let u=s(c);return u!==null?g(u):a}return a})),XH=(e,t)=>Ue((r,n)=>Y(()=>{let o=new TextDecoder(e,t),s={stream:!0},a=r.pipe(W(kn(i=>o.decode(i,s))),At(i=>{a=ue(i);let c=o.decode();return c.length>0?g(Oe(c)):a}));return L(()=>a)}));var fb=l(2,(e,t)=>Ue((r,n)=>C(we(e)(r,n),o=>we(t)(o,n)))),mk=l(2,(e,t)=>Ue((r,n)=>C(we(e)(r,n),o=>W(we(t)(hk(o),n),xk)))),ez=e=>e._tag===\"Die\"&&Pc(e.defect)&&id(e.defect.value),tz=e=>e.reasons.some(ez),hk=e=>nt(e,t=>Is(t)?$e(t):yr(o0(t))),hse=e=>tz(e)?gs(e.reasons.flatMap(t=>ez(t)?t.defect.value.reasons:[t])):e,xk=e=>$o(t=>nt(t(e),r=>$e(hse(r)))),_u=e=>Ue((t,r)=>{let n;return g(L(()=>n||e.pipe(Ss(r),C(o=>we(o)(t,r)),C(o=>n=o))))}),rz=e=>ns((t,r,n)=>W(Ss(we(e)(t,r),n),Ss(n)));var nz=l(2,(e,t)=>Ue(_e(function*(r,n){let o=yield*we(e)(r,n),s=yield*uo({capacity:t.capacity===\"unbounded\"?void 0:t.capacity,strategy:t.capacity===\"unbounded\"?void 0:t.strategy});return yield*xr(n,fo(s)),yield*o.pipe(C(a=>Ln(s,a)),ir({disableYield:!0}),Lo(a=>cr(s,a)),rr(n)),ga(s)}))),oz=l(2,(e,t)=>Ue(_e(function*(r,n){let o=yield*we(e)(r,n),s=yield*uo({capacity:t.capacity===\"unbounded\"?void 0:t.capacity,strategy:t.capacity===\"unbounded\"?void 0:t.strategy});return yield*xr(n,fo(s)),yield*o.pipe(C(a=>Vc(s,a)),ir({disableYield:!0}),Lo(a=>cr(s,a)),rr(n)),Zc(s)}))),gk=l(2,(e,t)=>ub(e,Cr(g(C(t,ue))),{haltStrategy:\"either\"})),sz=l(2,(e,t)=>ns(_e(function*(r,n,o){let s=yield*we(e)(r,n),a=yield*rr(t,o,{startImmediately:!0});return L(()=>{let i=a.pollUnsafe();return i===void 0?s:c0(i,{onFailure:$e,onSuccess:ue})})}))),az=l(2,(e,t)=>uh(e,r=>no(r)?t(r.cause):ie)),uh=l(2,(e,t)=>ns((r,n,o)=>bs(o,t).pipe(Zr(we(e)(r,n))))),iz=l(2,(e,t)=>_u(jt(t,e))),yk=l(2,(e,t)=>rn(e,r=>Y(()=>{let n=!0,o=Yr(r,s=>(n=!1,t(s)));return L(()=>n?o:r)}))),cz=l(2,(e,t)=>rn(e,r=>g(At(r,n=>C(t,()=>ue(n)))))),uz=l(2,(e,t)=>uh(e,r=>t)),Ru=(e,t,r)=>L(()=>{let n=oo(),o=we(e)(ue(),n);return At(C(o,t),r||g).pipe(Dn(s=>Xe(n,s)))});var lb=l(2,(e,t)=>Ue((r,n)=>W(ao(we(e)(r,n),t),ao(t)))),pb=l(3,(e,t,r)=>Ue((n,o)=>W(Cs(we(e)(n,o),t,r),Cs(t,r)))),db=l(3,(e,t,r)=>Ue((n,o)=>C(r,s=>we(pb(e,t,s))(n,o)))),fz=l(e=>Rr(e[0]),(e,t,r)=>kp(t)?lb(e,t):Ue((n,o)=>C(r?.local?hd(t,md(),o):cg(t,o),s=>W(ao(we(e)(n,o),s),ao(s))))),lz=l(2,(e,t)=>Ue((r,n)=>Od(o=>{let s=t(o);return we(lb(e,s))(r,n)})));var Sk=function(){let e=Rr(arguments[0]),t=e?arguments[1]:arguments[0],r=Va(e?arguments[2]:arguments[1]);if(e){let n=arguments[0];return aH(n,t,r)}return n=>aH(n,t,r)},aH=(e,t,r)=>use(Z0(t,r),n=>pb(e,Ic,n),(n,o)=>Un(s=>{let a=s.getRef(Dr),i=s.getRef(u1);return tg(n,o,a,i)}));var pz=e=>Ru(e,t=>ir(t,{disableYield:!0})),Gi=l(2,(e,t)=>Ru(e,r=>ir(C(r,t),{disableYield:!0}))),dz=l(2,(e,t)=>Ru(e,r=>r.pipe(C(t),C(n=>n?ie:ue()),ir({disableYield:!0})))),bk=e=>W(Pu(e,()=>({bytes:0,arrays:[]}),(t,r)=>{for(let n=0;n<r.length;n++)t.bytes+=r[n].length,t.arrays.push(r[n]);return t}),({arrays:t,bytes:r})=>{let n=new Uint8Array(r),o=0;for(let s=0;s<t.length;s++){let a=t[s];n.set(a,o),o+=a.length}return n});var mz=e=>L(()=>{let t=v();return Ru(e,r=>r.pipe(wg,C(n=>(t=n,ue()))),()=>g(t))}),hz=e=>L(()=>{let t=Symbol(),r=t;return Ru(e,n=>ir(C(n,o=>(r=o,ie)),{disableYield:!0}),()=>r===t?li:$0(r))}),Pu=l(3,(e,t,r)=>L(()=>{let n=t();return Ru(e,o=>No({while:Cn,body:()=>o,step:s=>{n=r(n,s)}}),()=>g(n))})),xz=l(3,(e,t,r)=>L(()=>{let n=t();return Ru(e,o=>No({while:Cn,body:gt(o.pipe(C(s=>r(n,s)),W(s=>{n=s}))),step:zr}),()=>g(n))})),Ek=_e(function*(e){let t=Ug(1),r=yield*Hc(),n=Me(r,Vr);return(yield*we(e)(ue(),n)).pipe(ao(r),t.withPermits(1))},nt(e=>g($e(e)))),Bs=(e,t)=>we(e)(ue(),t);var Ik=l(e=>Rr(e[0]),(e,t)=>$o(r=>Gi(e,n=>Vc(t,n)).pipe(r,so,C(n=>(ut(n)?Nd(t):Si(t,n.cause),ie)))));var gz=l(e=>Rr(e[0]),_e(function*(e,t){let r=yield*zc,n=yield*uo({capacity:typeof t.capacity==\"number\"?t.capacity:void 0,strategy:typeof t.capacity==\"number\"?t.strategy:void 0});return yield*xr(r,fo(n)),yield*rr(Ik(e,n),r),n}));var yz=e=>Wc(e.capacity===\"unbounded\"?YS(e):e.strategy===\"dropping\"?VS(e):e.strategy===\"sliding\"?ZS(e):GS(e),sh),Sz=l(2,_e(function*(e,t){let r=yield*yz(t);return yield*Df(wk(e,r,{shutdownOnEnd:t.shutdownOnEnd!==!1})),r})),wk=l(e=>Rr(e[0]),(e,t,r)=>Gi(e,n=>tH(t,n)).pipe(r?.shutdownOnEnd===!0?hi(sh(t)):D)),bz=l(2,_e(function*(e,t){let r=yield*yz(t);return yield*Gi(e,n=>XS(r,n)).pipe(Dn(n=>QS(r,n)),Df),r}));var nn={};An(nn,{Array:()=>Sue,Boolean:()=>Eue,ByteSize:()=>wue,ConfigError:()=>Vl,Date:()=>kue,Duration:()=>Iue,Finite:()=>hue,Int:()=>xue,Literal:()=>gue,Literals:()=>yue,LogLevel:()=>Cue,NonEmptyString:()=>due,Number:()=>mue,Port:()=>Aue,Record:()=>bue,Redacted:()=>Tue,String:()=>pue,URL:()=>vue,all:()=>BW,fail:()=>fue,flatMap:()=>tue,isConfig:()=>$W,map:()=>KW,mapEffect:()=>rue,nested:()=>Oue,option:()=>oue,orElse:()=>nue,schema:()=>Tr,succeed:()=>lue,unwrap:()=>HW,withDefault:()=>jW});var Gl={};An(Gl,{ConfigProvider:()=>Du,SourceError:()=>gb,constantCase:()=>$ce,fromDir:()=>Xce,fromDotEnv:()=>Qce,fromDotEnvContents:()=>NW,fromEnv:()=>FW,fromEnvRecord:()=>qk,fromUnknown:()=>Hce,layer:()=>Bce,layerAdd:()=>jce,make:()=>Sb,makeArray:()=>zk,makeRecord:()=>yb,makeValue:()=>gh,mapInput:()=>Wk,nested:()=>Kce,orElse:()=>jk});var xse=\"~effect/Stream\",gse={_R:D,_E:D,_A:D},Ez=function(e){this.channel=e};Ez.prototype={[xse]:gse,pipe(){return te(this,arguments)}};var Iz=e=>new Ez(e);var Sse=\"~effect/Sink\";var bse={_A:D,_In:D,_L:D,_E:D,_R:D},Ese={[Sse]:bse,pipe(){return te(this,arguments)}};var Ise=e=>{let t=Object.create(Ese);return t.transform=e,t},wz=e=>Ue((t,r)=>g(C(e.transform(t,r),ue)));var Az=e=>{let t=It(e);return Ise(r=>{let n=[];if(t===0)return g([n]);let o;return r.pipe(C(s=>{if(n.length+s.length<=t){for(let a=0;a<s.length;a++)n.push(s[a]);return n.length===t?ue():ie}for(let a=0;a<s.length;a++)if(n.push(s[a]),n.length===t)return a+1<s.length&&(o=s.slice(a+1)),ue();return ie}),ir({disableYield:!0}),At(()=>g([n,o])))})};var Hs={};An(Hs,{DefaultChunkSize:()=>Lz,Do:()=>fce,TypeId:()=>Dz,accumulate:()=>Jie,aggregate:()=>$ie,aggregateWithin:()=>Nk,as:()=>rae,bind:()=>pce,bindEffect:()=>dce,bindTo:()=>mce,broadcast:()=>hW,broadcastN:()=>Kie,buffer:()=>qae,bufferArray:()=>Jae,callback:()=>Bz,catch:()=>xh,catchCause:()=>tW,catchCauseFilter:()=>nie,catchCauseIf:()=>rie,catchDefect:()=>Gae,catchFilter:()=>Mk,catchIf:()=>nW,catchReason:()=>Xae,catchReasons:()=>eie,catchTag:()=>Yae,catchTags:()=>Qae,changes:()=>Gie,changesWith:()=>xW,changesWithEffect:()=>Vie,chunks:()=>fW,collect:()=>qie,combine:()=>Iie,combineArray:()=>wie,concat:()=>Fu,cross:()=>Tae,crossWith:()=>Qz,debounce:()=>Oie,decodeText:()=>Zie,die:()=>zz,drain:()=>lae,drainFork:()=>pae,drop:()=>Fk,dropRight:()=>Sie,dropUntil:()=>xie,dropUntilEffect:()=>gie,dropWhile:()=>cW,dropWhileEffect:()=>uW,dropWhileFilter:()=>yie,empty:()=>$a,encodeText:()=>Yie,ensuring:()=>sce,fail:()=>ql,failCause:()=>Hz,failCauseSync:()=>Lse,failSync:()=>Dse,filter:()=>Lae,filterEffect:()=>Kae,filterMap:()=>$ae,filterMapEffect:()=>Bae,flatMap:()=>Jl,flatten:()=>Vz,flattenArray:()=>fae,flattenEffect:()=>oae,flattenIterable:()=>yae,flattenTake:()=>Sae,forever:()=>gae,fromArray:()=>dh,fromArrayEffect:()=>jse,fromArrays:()=>Hse,fromAsyncIterable:()=>Jse,fromChannel:()=>k,fromEffect:()=>mb,fromEffectDrain:()=>$z,fromEffectRepeat:()=>Kz,fromEffectSchedule:()=>Mse,fromEventListener:()=>Zse,fromIterable:()=>Nu,fromIterableEffect:()=>Kse,fromIterableEffectRepeat:()=>Bse,fromIteratorSucceed:()=>$se,fromPubSub:()=>Wse,fromPubSubTake:()=>Wz,fromPull:()=>js,fromQueue:()=>zse,fromReadableStream:()=>qse,fromSchedule:()=>Gse,fromSubscription:()=>Vse,groupAdjacentBy:()=>Die,groupBy:()=>Nie,groupByKey:()=>Uie,grouped:()=>Mie,groupedWithin:()=>Fie,haltWhen:()=>rce,ignore:()=>iie,ignoreCause:()=>cie,interleave:()=>ece,interleaveWith:()=>yW,interruptWhen:()=>tce,intersperse:()=>gW,intersperseAffixes:()=>Xie,isStream:()=>Re,iterate:()=>Qse,let:()=>lce,limitBytes:()=>pie,make:()=>Nse,map:()=>Gn,mapAccum:()=>Aie,mapAccumArray:()=>Uu,mapAccumArrayEffect:()=>Tie,mapAccumEffect:()=>Cie,mapArray:()=>Jz,mapArrayEffect:()=>sae,mapBoth:()=>nae,mapEffect:()=>mh,mapError:()=>oW,merge:()=>Ok,mergeAll:()=>Cae,mergeEffect:()=>hb,mergeLeft:()=>wae,mergeResult:()=>Iae,mergeRight:()=>Aae,mkArrayBuffer:()=>vce,mkString:()=>Tce,mkUint8Array:()=>kce,never:()=>eae,onEnd:()=>oce,onError:()=>nce,onExit:()=>SW,onFirst:()=>EW,onStart:()=>bW,orDie:()=>aie,orElseIfEmpty:()=>oie,orElseSucceed:()=>sie,paginate:()=>Yse,partition:()=>Hae,partitionEffect:()=>jae,partitionQueue:()=>Rk,peel:()=>Wae,pipeThrough:()=>Wie,pipeThroughChannel:()=>Hie,pipeThroughChannelOrFail:()=>zie,prepend:()=>Eae,provide:()=>IW,provideContext:()=>ace,provideService:()=>ice,provideServiceEffect:()=>Uk,race:()=>Dae,raceAll:()=>eW,range:()=>Xse,rechunk:()=>lW,repeat:()=>dae,repeatElements:()=>xae,result:()=>aae,retry:()=>uie,run:()=>hce,runCollect:()=>AW,runCount:()=>xce,runDrain:()=>xb,runFold:()=>yce,runFoldEffect:()=>Sce,runForEach:()=>Ice,runForEachArray:()=>Ace,runForEachWhile:()=>wce,runHead:()=>bce,runIntoPubSub:()=>Mce,runIntoQueue:()=>Uce,runLast:()=>Ece,runSum:()=>gce,scan:()=>vie,scanEffect:()=>kie,schedule:()=>mae,scoped:()=>tae,service:()=>Rse,serviceOption:()=>Pse,share:()=>jie,sliding:()=>bie,slidingSize:()=>pW,split:()=>Eie,splitLines:()=>Qie,succeed:()=>Mu,suspend:()=>En,switchMap:()=>uae,sync:()=>Use,take:()=>lie,takeRight:()=>die,takeUntil:()=>sW,takeUntilEffect:()=>aW,takeWhile:()=>iW,takeWhileEffect:()=>hie,takeWhileFilter:()=>mie,tap:()=>Gz,tapBoth:()=>iae,tapCause:()=>rW,tapDefect:()=>Zae,tapError:()=>Pk,tapErrorTag:()=>Vae,tapSink:()=>cae,throttle:()=>Pie,throttleEffect:()=>dW,tick:()=>Fse,timeout:()=>hae,timeoutOrElse:()=>Zz,toAsyncIterable:()=>Pce,toAsyncIterableEffect:()=>Rce,toAsyncIterableWith:()=>$k,toChannel:()=>bo,toPubSub:()=>Fce,toPubSubTake:()=>CW,toPull:()=>Cce,toQueue:()=>Nce,toReadableStream:()=>Oce,toReadableStreamEffect:()=>_ce,toReadableStreamWith:()=>Lk,transduce:()=>Lie,transformPull:()=>or,transformPullBracket:()=>kk,unfold:()=>qz,unwrap:()=>Vi,unwrapReason:()=>tie,updateContext:()=>wW,updateService:()=>cce,when:()=>zae,withExecutionPlan:()=>fie,withSpan:()=>uce,zip:()=>vae,zipFlatten:()=>_ae,zipLatest:()=>Nae,zipLatestAll:()=>_k,zipLatestWith:()=>Uae,zipLeft:()=>kae,zipRight:()=>Oae,zipWith:()=>hh,zipWithArray:()=>Xz,zipWithIndex:()=>Rae,zipWithNext:()=>Pae,zipWithPrevious:()=>Mae,zipWithPreviousAndNext:()=>Fae});var Tz=\"~effect/RcMap\",wse=e=>({[Tz]:Tz,lookup:e.lookup,context:e.context,scope:e.scope,idleTimeToLive:e.idleTimeToLive,capacity:e.capacity,state:{_tag:\"Open\",map:$c()},pipe(){return te(this,arguments)}}),vz=e=>Un(t=>{let r=t.context,n=Me(r,Vr),o=wse({lookup:e.lookup,context:r,scope:n,idleTimeToLive:typeof e.idleTimeToLive==\"function\"?gO(e.idleTimeToLive,ct):gt(ct(e.idleTimeToLive??ta)),capacity:Math.max(e.capacity??Number.POSITIVE_INFINITY,0)});return jt(bs(n,()=>{if(o.state._tag===\"Closed\")return ie;let s=o.state.map;return o.state={_tag:\"Closed\"},ui(s,([,a])=>so(fh(a))).pipe(Yr(()=>Y(()=>{Sg(s)})),C(pd))}),o)}),Ck=l(2,(e,t)=>$o(r=>{if(e.state._tag===\"Closed\")return io;let n=e.state,o=Kf(),s=Nn(n.map,t),a;if(s._tag===\"Some\")a=s.value,a.refCount++;else{if(Number.isFinite(e.capacity)&&Q1(e.state.map)>=e.capacity)return F(new s0(`RcMap attempted to exceed capacity of ${e.capacity}`));{a={deferred:Mc(),scope:oo(),idleTimeToLive:e.idleTimeToLive(t),finalizer:void 0,fiber:void 0,expiresAt:0,refCount:1},a.finalizer=Cse(e,t,a),Kc(n.map,t,a);let c=new Map(e.context.mapUnsafe);o.context.mapUnsafe.forEach((f,p)=>{c.set(p,f)}),c.set(Vr.key,a.scope);let u=Xs(c);L(()=>e.lookup(t)).pipe(co(u),gi(a.scope)).addObserver(f=>{i0(f)&&Ase(e,t,a,u),ys(a.deferred,f)})}}let i=ds(o.context,Vr);return xr(i,a.finalizer).pipe(Zr(r(og(a.deferred))))}));var Ase=(e,t,r,n)=>{if(e.state._tag===\"Closed\")return;let o=Nn(e.state.map,t);o._tag===\"None\"||o.value!==r||(ci(e.state.map,t),!(r.refCount>0)&&fh(r).pipe(di({log:\"Unhandled\",message:\"Unhandled error in RcMap finalizer\"}),co(n),gi(e.scope)))},fh=e=>e.fiber?Ko(e.fiber).pipe(Zr(Xe(e.scope,Bt))):Xe(e.scope,Bt),Cse=(e,t,r)=>Un(n=>{if(r.refCount--,r.refCount>0)return ie;if(e.state._tag===\"Closed\")return fh(r);let o=Nn(e.state.map,t);if(o._tag===\"None\"||o.value!==r)return fh(r);if(Sc(r.idleTimeToLive))return ci(e.state.map,t),fh(r);if(!sn(r.idleTimeToLive))return ie;let s=n.getRef(Tf);return r.expiresAt=s.currentTimeMillisUnsafe()+Nr(r.idleTimeToLive),r.fiber?ie:(r.fiber=$o(function a(i){let c=s.currentTimeMillisUnsafe(),u=r.expiresAt-c;if(u<=0){if(e.state._tag===\"Closed\"||r.refCount>0)return ie;let f=Nn(e.state.map,t);return f._tag===\"None\"||f.value!==r?ie:(ci(e.state.map,t),di(Xe(r.scope,Bt),{log:\"Unhandled\",message:\"Unhandled error in RcMap finalizer\"}))}return C(i(s.sleep(na(u))),()=>a(i))}).pipe(hi(Y(()=>{r.fiber=void 0})),co(n.context),gi(e.scope)),ie)});var Tk=l(2,(e,t)=>qc(r=>{if(e.state._tag===\"Closed\")return ie;let n=Nn(e.state.map,t);if(n._tag===\"None\"||Sc(n.value.idleTimeToLive))return ie;let o=n.value;return o.expiresAt=r.currentTimeMillisUnsafe()+Nr(o.idleTimeToLive),ie}));var Tse=\"~effect/RcRef\",lh={_tag:\"Empty\"},vse={_tag:\"Closed\"},kse={_A:D,_E:D},vk=class{[Tse]=kse;pipe(){return te(this,arguments)}state=lh;acquire;context;scope;idleTimeToLive;constructor(t,r,n,o){this.acquire=t,this.context=r,this.scope=n,this.idleTimeToLive=o}},_z=e=>Un(t=>{let r=t.context,n=Me(r,Vr),o=new vk(e.acquire,r,n,e.idleTimeToLive!==void 0?ct(e.idleTimeToLive):void 0);return jt(bs(n,()=>{let s=o.state;return o.state=vse,s._tag===\"Acquired\"?Xe(s.scope,Bt):s._tag===\"Acquiring\"?Ko(s.fiber):ie}),o)}),Ose=(e,t)=>{switch(e.state._tag){case\"Closed\":return io;case\"Acquired\":{let r=e.state;return r.refCount++,r.fiber?jt(Ko(r.fiber),r):g(r)}case\"Acquiring\":{let r=e.state;return r.awaiters++,Oz(e,r,t)}case\"Empty\":{let r={_tag:\"Acquiring\",fiber:void 0,awaiters:1,acquired:void 0};e.state=r;let n=oo(),o=ao(e.acquire,dr(e.context,Vr,n)).pipe(C(s=>{if(e.state!==r)return io;let a={_tag:\"Acquired\",value:s,scope:n,fiber:void 0,refCount:r.awaiters,invalidated:!1};return e.state=a,r.acquired=a,g(a)}),Dn(s=>ut(s)?ie:(e.state===r&&(e.state=lh),Xe(n,s))));return r.fiber=co(Kf().context)(o),Oz(e,r,t)}}},Oz=(e,t,r)=>Dn(r(xi(t.fiber)),n=>{let o=t.acquired;return o!==void 0?no(n)?Pz(e,o):ie:--t.awaiters>0||e.state!==t?ie:(e.state=lh,Ko(t.fiber))}),Rz=e=>{let t=e;return $o(r=>C(zc,n=>C(Ose(t,r),o=>jt(bs(n,()=>Pz(t,o)),o.value))))},Pz=(e,t)=>{if(t.refCount--,t.refCount>0)return ie;let r=e.idleTimeToLive;return r===void 0||t.invalidated?(e.state===t&&(e.state=lh),Xe(t.scope,Bt)):sn(r)?(t.fiber=$o(n=>C(n(mi(r)),()=>e.state===t&&t.refCount===0?(e.state=lh,di(Xe(t.scope,Bt),{log:\"Unhandled\",message:\"Unhandled error in RcRef finalizer\"})):ie)).pipe(hi(Y(()=>{t.fiber=void 0})),co(e.context),gi(e.scope)),ie):ie};var Mz=_z,Fz=Rz;var Dz=\"~effect/Stream\",Re=e=>A(e,Dz),Lz=ih,k=Iz,mb=e=>k(ob(W(e,Oe))),Rse=e=>mb(J0(e)),Pse=e=>mb(G0(e)),$z=e=>js(g(C(e,()=>ue()))),Kz=e=>js(g(W(e,Oe))),Mse=(e,t)=>js(kt(function*(){let r=yield*Fo(t),n=yield*Cs(e,gr,gr.defaultValue()),o=!0,s=L(()=>r(n)).pipe(C(a=>Cs(e,gr,a)),W(a=>(n=a,Oe(a))));return L(()=>o?(o=!1,g(Oe(n))):s)})),Fse=e=>js(Y(()=>{let t=!0,r=g(Oe(void 0)),n=j0(r,e);return L(()=>t?(t=!1,r):n)})),js=e=>k(Cr(e)),or=(e,t)=>k(Ue((r,n)=>C(Bs(e.channel,n),o=>t(o,n)))),kk=(e,t)=>k(ns((r,n,o)=>C(Bs(e.channel,n),s=>t(s,n,o)))),bo=e=>e.channel,Bz=(e,t)=>k(cH(e,t)),$a=k(Ou),Mu=e=>k(nb(Oe(e))),Nse=(...e)=>dh(e),Use=e=>k(lH(()=>Oe(e()))),En=e=>{let t=k(rb(()=>e().channel));return jz.set(t,e),t},jz=new WeakMap,ql=e=>k(Ji(e)),Dse=e=>k(dH(e)),Hz=e=>k(ch(e)),zz=e=>k(ck(e)),Lse=e=>k(mH(e)),$se=(e,t)=>k(ik(()=>e,t)),Nu=(e,t)=>Array.isArray(e)&&t?.chunkSize===void 0?dh(e):k(fH(e,t?.chunkSize)),Kse=e=>Vi(W(e,Nu)),Bse=e=>Jl(Kz(e),Nu),dh=e=>yt(e)?k(nb(e)):$a,jse=e=>Vi(W(e,dh)),Hse=(...e)=>k(ak(ix(e,yt))),zse=e=>k(xH(e)),Wse=e=>k(gH(e)),Wz=e=>k(yH(e)),qse=e=>k(SH(e)),Jse=(e,t)=>k(bH(e,t)),Gse=e=>js(W(Id(e),t=>At(W(t(void 0),Oe),()=>ue()))),Vse=e=>k(fk(e)),Zse=(e,t,r)=>Bz(n=>{let o=typeof r==\"object\"&&r.once;function s(a){Pg(n,a),o&&Nd(n)}return Wc(Y(()=>e.addEventListener(t,s,r)),()=>Y(()=>e.removeEventListener(t,s,r)))},{bufferSize:typeof r==\"object\"?r.bufferSize:void 0}),qz=(e,t)=>js(Y(()=>{let r=e;return C(L(()=>t(r)),n=>n===void 0?ue():(r=n[1],g(Oe(n[0]))))})),Yse=(e,t)=>js(Y(()=>{let r=e,n=!1;return L(function o(){return n?ue():C(t(r),([s,a])=>(ge(a)?n=!0:r=a.value,yt(s)?g(s):o()))})})),Qse=(e,t)=>qz(e,r=>g([r,t(r)])),Xse=(e,t,r=ih)=>e>t?$a:js(Y(()=>{let n=Xn(r),o=e,s=!1;return L(()=>{if(s)return ue();let a=t-o+1;if(a>n){let c=dE(o,o+n-1);return o+=n,g(c)}let i=dE(o,o+a-1);return s=!0,g(i)})})),eae=k(pH),Vi=e=>k(_u(W(e,bo))),tae=e=>k(rz(e.channel)),Gn=l(2,(e,t)=>En(()=>{let r=0;return k(os(e.channel,kn(n=>t(n,r++))))})),rae=l(2,(e,t)=>Gn(e,()=>t)),nae=l(2,(e,t)=>e.pipe(Gn(t.onElement),oW(t.onError))),Jz=l(2,(e,t)=>k(os(e.channel,t))),mh=l(e=>Re(e[0]),(e,t,r)=>e.channel.pipe(jr,sb(t,r),os(Oe),k)),oae=l(e=>Re(e[0]),(e,t)=>mh(e,D,t)),sae=l(2,(e,t)=>k(sb(e.channel,t))),aae=e=>e.pipe(Gn(j),xh(t=>Mu(q(t)))),Gz=l(e=>Re(e[0]),(e,t,r)=>mh(e,n=>jt(t(n),n),r)),iae=l(2,(e,t)=>e.pipe(Pk(t.onError),Gz(t.onElement,{concurrency:t.concurrency}))),cae=l(2,(e,t)=>kk(e,_e(function*(r,n,o){let s=tn(),a=tn(),i,c,u=!1,f=!1,p=s.whenOpen(L(()=>{if(i){let m=i;return i=void 0,f||s.closeUnsafe(),jt(a.open,m)}return ue()}));yield*L(()=>t.transform(p,o)).pipe(m=>_d(m,h=>(u=!0,no(h)&&(c=h.cause),a.open),!0),rr(o));let d=r.pipe(C(m=>c?$e(c):u?g(m):(i=m,a.closeUnsafe(),s.openUnsafe(),jt(a.await,m))),At(()=>c?$e(c):u?ue():(f=!0,a.closeUnsafe(),s.openUnsafe(),C(a.await,()=>c?$e(c):ue()))));return L(()=>c?$e(c):u?r:d)}))),Jl=l(e=>Re(e[0]),(e,t,r)=>e.channel.pipe(jr,lk(n=>t(n).channel,r),k)),uae=l(e=>Re(e[0]),(e,t,r)=>e.channel.pipe(jr,ZH(n=>t(n).channel,r),k)),Vz=l(e=>Re(e[0]),(e,t)=>Jl(e,D,t)),fae=e=>k(jr(e.channel)),lae=e=>k(kH(e.channel)),pae=l(2,(e,t)=>hb(e,xb(t))),dae=l(2,(e,t)=>k(OH(e.channel,t))),mae=l(2,(e,t)=>e.channel.pipe(jr,RH(t),os(Oe),k)),hae=l(2,(e,t)=>Zz(e,{duration:t,orElse:()=>$a})),Zz=l(2,(e,t)=>{let r=ct(t.duration);if(!sn(r))return e;if(Sc(r))return En(t.orElse);let n=Symbol();return tW(En(()=>{let s=Kf().getRef(Tf),a=Nr(r),i,c=tn(!1);return Ok(or(e,(u,f)=>L(()=>(i=s.currentTimeMillisUnsafe()+a,c.openUnsafe(),u)).pipe(W(p=>(c.closeUnsafe(),i=void 0,p)),g)),$z(kt(function*(){for(;;)if(yield*c.await,!(i===void 0||(yield*mi(i-s.currentTimeMillisUnsafe()),i===void 0)||i-s.currentTimeMillisUnsafe()>0))return yield*yr(n)})),{haltStrategy:\"left\"})}),o=>o.reasons.find(a=>a._tag===\"Die\"&&a.defect===n)?t.orElse():Hz(o))}),xae=l(2,(e,t)=>k(Ue((r,n)=>W(we(jr(e.channel))(r,n),o=>{let s,a=kt(function*(){let i=yield*o,c=Oe(i);return s=(yield*Id(t))(i).pipe(jt(c),At(f=>(s=void 0,a))),c});return L(()=>s??a)})))),gae=e=>k(_H(e.channel)),yae=e=>Jl(e,Nu),Sae=e=>e.channel.pipe(jr,vH,k),Fu=l(2,(e,t)=>{let r=k(TH(uH(()=>bae(e,t))));return Yz.set(r,[e,t]),r}),Yz=new WeakMap;function*bae(e,t){let r=[t,e];for(;r.length>0;){let n=r.pop(),o=Yz.get(n);if(o!==void 0){r.push(o[1],o[0]);continue}let s=jz.get(n);if(s===void 0){yield n.channel;continue}try{r.push(s())}catch(a){r.push(zz(a))}yield Ou}}var Eae=l(2,(e,t)=>Fu(Nu(t),e)),Ok=l(e=>Re(e[0])&&Re(e[1]),(e,t,r)=>k(ub(bo(e),bo(t),r))),hb=l(2,(e,t)=>e.channel.pipe(YH(t),k)),Iae=l(2,(e,t)=>Ok(Gn(e,j),Gn(t,q))),wae=l(2,(e,t)=>hb(e,xb(t))),Aae=l(2,(e,t)=>hb(t,xb(e))),Cae=l(2,(e,t)=>Vz(Nu(e),t)),Tae=l(2,(e,t)=>Qz(e,t,(r,n)=>[r,n])),Qz=l(3,(e,t,r)=>Jl(e,n=>Gn(t,o=>r(n,o)))),hh=l(3,(e,t,r)=>En(()=>{let n=0,o=0;return Xz(e,t,(s,a)=>{let i=Math.min(s.length-n,a.length-o),c=ox(i,p=>r(s[n+p],a[o+p]));n+=i,o+=i;let u=n===s.length,f=o===a.length;return u&&(n=0),f&&(o=0),[c,u?[]:s,f?[]:a]})})),Xz=l(3,(e,t,r)=>k(ns(_e(function*(n,o){let s=yield*Bs(e.channel,o),a=yield*Bs(t.channel,o),i=kt(function*(){let p=yield*rr(s,o),d=yield*rr(a,o);return yield*xF([p,d])}),c,u;return kt(function*(){let[p,d]=c?[c,u??(yield*a)]:u?[yield*s,u]:yield*i,[m,h,y]=r(p,d);return c=yt(h)?h:void 0,u=yt(y)?y:void 0,m})})))),vae=l(2,(e,t)=>hh(e,t,(r,n)=>[r,n])),kae=l(2,(e,t)=>hh(e,t,r=>r)),Oae=l(2,(e,t)=>hh(e,t,(r,n)=>n)),_ae=l(2,(e,t)=>hh(e,t,(r,n)=>[...r,n])),Rae=e=>Gn(e,(t,r)=>[t,r]),Pae=e=>Uu(e,v,(t,r)=>{let n=0;t._tag===\"None\"&&(n=1,t=_(r[0]));let o=Qt();for(;n<r.length;n++){let s=t.value;t=_(r[n]),o.push([s,t])}return[t,o]},{onHalt(t){return t._tag===\"Some\"?[[t.value,v()]]:[]}}),Mae=e=>Uu(e,v,(t,r)=>{let n=Qt();for(let o=0;o<r.length;o++){let s=r[o];n.push([t,s]),t=_(r[o])}return[t,n]}),Fae=e=>Uu(e,()=>({prev:v(),current:v()}),(t,r)=>{let n=0,o;t.current._tag===\"None\"?(n=1,o=r[0],t.current=_(o)):o=t.current.value;let s=Qt();for(;n<r.length;n++){let a=r[n];t.current=_(a),s.push([t.prev,o,t.current]),t.prev=_(o),o=a}return[t,s]},{onHalt(t){return t.current._tag===\"Some\"?[[t.prev,t.current.value,v()]]:[]}}),_k=(...e)=>k(rb(()=>{let t=[],r=new Set,n=tn(),o=tn();return cb(ak(e.map((s,a)=>s.channel.pipe(jr,sb(i=>(t[a]=i,r.has(a)?g(Oe(t.slice())):(r.add(a),r.size<e.length?n.await:jt(n.open,Oe(t.slice()))))),PH(cs),EH(()=>r.has(a)?ie:o.open)))),{concurrency:\"unbounded\",bufferSize:0}).pipe(gk(o.await))})),Nae=l(2,(e,t)=>_k(e,t)),Uae=l(3,(e,t,r)=>Gn(_k(e,t),([n,o])=>r(n,o))),eW=(...e)=>k(Ue((t,r)=>Y(()=>{let n,o=H0(e.map(s=>{let a=tr(r);return Bs(s.channel,a).pipe(C(i=>B0(g(i),i)),Dn(i=>i._tag===\"Success\"?n?Xe(a,i):(n=i.value[0],ie):Xe(a,i)),W(([,i])=>i))}));return L(()=>n??o)}))),Dae=l(2,(e,t)=>eW(e,t)),Lae=l(2,(e,t)=>k(MH(bo(e),t))),$ae=l(2,(e,t)=>k(FH(bo(e),t))),Kae=l(2,(e,t)=>k(NH(bo(e),t))),Bae=l(2,(e,t)=>k(UH(bo(e),t))),Rk=l(e=>Re(e[0]),_e(function*(e,t,r){let n=yield*zc,o=yield*Bs(e.channel,n),s=r?.capacity===\"unbounded\"?void 0:r?.capacity??Lz,a=yield*uo({capacity:s}),i=yield*uo({capacity:s});return yield*kt(function*(){for(;;){let c=yield*o,u=[],f=[];for(let d=0;d<c.length;d++){let m=t(c[d]);ae(m)?u.push(m.failure):f.push(m.success)}let p;if(f.length>0){let d=Mg(a,f);d.length>0&&(p=yield*Uf(Vc(a,d)))}if(u.length>0){let d=Mg(i,u);d.length>0&&(yield*Vc(i,d))}p&&(yield*xi(p))}}).pipe(Lo(c=>(Si(a,c),Si(i,c),ie)),rr(n)),[a,i]})),ph=e=>k(Ue((t,r)=>jt(xr(r,fo(e)),Zc(e)))),jae=l(e=>Re(e[0]),(e,t,r)=>W(Rk(mh(e,n=>t(n),r),n=>n,r),([n,o])=>[ph(n),ph(o)])),Hae=l(e=>Re(e[0]),(e,t,r)=>W(Rk(e,t,{capacity:r?.capacity??16}),([n,o])=>[ph(n),ph(o)])),zae=l(2,(e,t)=>t.pipe(W(r=>r?e:$a),Vi)),Wae=l(2,_e(function*(e,t){let r,n=yield*Ek(e.channel),o=nt(n,c=>(r=c,$e(c))),[s,a]=yield*vg(c=>Dk(t,o,c)),i=r?$a:js(g(n));return a&&(i=Fu(dh(a),i)),[s,i]})),qae=l(2,(e,t)=>k(oz(e.channel,t))),Jae=l(2,(e,t)=>k(nz(e.channel,t))),tW=l(2,(e,t)=>e.channel.pipe(Wl(r=>t(r).channel),k)),Gae=l(2,(e,t)=>e.channel.pipe(LH(r=>t(r).channel),k)),rW=l(2,(e,t)=>e.channel.pipe(ab(t),k)),xh=l(2,(e,t)=>k(Da(e.channel,r=>t(r).channel)));var Pk=l(2,(e,t)=>e.channel.pipe(KH(t),k)),Vae=l(3,(e,t,r)=>{let n=Array.isArray(t)?o=>A(o,\"_tag\")&&t.includes(o._tag):Wt(t);return Pk(e,o=>n(o)?r(o):ie)}),Zae=l(2,(e,t)=>rW(e,r=>{let n=cd(r);return rt(n)?t(n.success):ie})),nW=l(e=>Re(e[0]),(e,t,r,n)=>k(BH(bo(e),t,o=>r(o).channel,n&&(o=>n(o).channel)))),Mk=l(e=>Re(e[0]),(e,t,r,n)=>k(jH(bo(e),t,o=>r(o).channel,n&&(o=>n(o).channel)))),Yae=l(e=>Re(e[0]),(e,t,r,n)=>{let o=Array.isArray(t)?s=>A(s,\"_tag\")&&t.includes(s._tag):Wt(t);return nW(e,o,r,n)}),Qae=l(e=>Re(e[0]),(e,t,r)=>{let n;return Mk(e,o=>(n??=Object.keys(t),A(o,\"_tag\")&&hg(o._tag)&&n.includes(o._tag)?j(o):q(o)),o=>t[o._tag](o),r)}),Xae=l(e=>Re(e[0]),(e,t,r,n,o)=>k(HH(bo(e),t,r,(s,a)=>n(s,a).channel,o&&((s,a)=>o(s,a).channel)))),eie=l(e=>Re(e[0]),(e,t,r,n)=>{let o=Object.create(null);for(let a of Object.keys(r)){let i=r[a];o[a]=(c,u)=>i(c,u).channel}let s=n&&((a,i)=>n(a,i).channel);return k(zH(e.channel,t,o,s))}),tie=l(2,(e,t)=>Mk(e,r=>Wt(r,t)&&A(r,\"reason\")?j(r.reason):q(r),ql)),oW=l(2,(e,t)=>k(WH(e.channel,t))),rie=l(3,(e,t,r)=>k($H(e.channel,t,n=>r(n).channel))),nie=l(3,(e,t,r)=>k(ib(e.channel,t,(n,o)=>r(n,o).channel))),oie=l(2,(e,t)=>k(CH(e.channel,r=>bo(t())))),sie=l(2,(e,t)=>xh(e,r=>Mu(t(r)))),aie=e=>k(qH(e.channel)),iie=l(e=>Re(e[0]),(e,t)=>k(JH(e.channel,t))),cie=l(e=>Re(e[0]),(e,t)=>k(GH(e.channel,t))),uie=l(2,(e,t)=>k(VH(e.channel,t))),Uz=(e,t)=>Vi(W(Fo(t),r=>{let n=gr.defaultValue(),o=()=>xh(Uk(e,gr,Y(()=>n)),s=>Vi(At(W(r(s),a=>(n=a,Vi(jt(kd,o())))),()=>g(ql(s)))));return o()})),fie=l(e=>Re(e[0]),(e,t,r)=>En(()=>{let n=r?.preventFallbackOnPartialStream??!1,o=0,s={attempt:0,stepIndex:0},a=Uk(gg,Y(()=>(s={attempt:s.attempt+1,stepIndex:o},s))),i=r?.onEvent===void 0?void 0:M0(r.onEvent,()=>s),c,u=i===void 0?D:d=>SW(bW(d,W(i.begin,m=>{c=m})),m=>L(()=>{if(c===void 0)return ie;let h=c;return c=void 0,i.end(h,m)})),f=v(),p=En(()=>{let d=t.steps[o];if(!d)return ql(sE(f));let m=a(u(IW(e,d.provide))),h=!1;if(Ce(f)){let y=f.value,S=!1,b=m;m=En(()=>S?b:(S=!0,ql(y))),m=Uz(m,vd(d,!1))}else{let y=vd(d,!0);m=y?Uz(m,y):m}return xh(n?EW(m,y=>(h=!0,ie)):m,y=>(o++,n&&h?ql(y):(f=_(y),p)))});return p})),lie=l(2,(e,t)=>{let r=It(t);return r===0?$a:sW(e,(n,o)=>o===r-1)}),pie=l(3,(e,t,r)=>En(()=>{let n=Dg(t),o=BigInt(0),s=!1;return Fu(iW(e,a=>{let i=o+BigInt(a.length);return i>n?(s=!0,!1):(o=i,!0)}),En(()=>s?r():$a))})),die=l(2,(e,t)=>{let r=It(t);return r===0?$a:Uu(e,xa,(n,o)=>(Md(n,o),n.length>r&&Og(n,n.length-r),[n,La]),{onHalt(n){return yi(n)}})}),sW=l(e=>Re(e[0]),(e,t,r)=>or(e,(n,o)=>Y(()=>{let s=0,a=!1;return C(L(()=>a?ue():n),c=>{let u=c.findIndex(f=>t(f,s++));if(u>=0){a=!0;let f=c.slice(0,r?.excludeLast?u:u+1);return yt(f)?g(f):ue()}return g(c)})}))),aW=l(e=>Re(e[0]),(e,t,r)=>or(e,(n,o)=>Y(()=>{let s=0,a=!1;return kt(function*(){if(a)return yield*ue();let i=yield*n;for(let c=0;c<i.length;c++)if(yield*t(i[c],s++)){a=!0;let u=i.slice(0,r?.excludeLast?c:c+1);return yt(u)?u:yield*ue()}return i})}))),iW=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o=0,s=!1,a=C(L(()=>s?ue():r),i=>{let c=[];for(let u=0;u<i.length;u++){if(!t(i[u],o++)){s=!0;break}c.push(i[u])}return yt(c)?g(c):s?ue():a});return a}))),mie=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o=!1,s=C(L(()=>o?ue():r),a=>{let i=[];for(let c=0;c<a.length;c++){let u=t(a[c]);if(ae(u)){o=!0;break}i.push(u.success)}return yt(i)?g(i):o?ue():s});return s}))),hie=l(2,(e,t)=>aW(e,(r,n)=>W(t(r,n),o=>!o),{excludeLast:!0})),Fk=l(2,(e,t)=>{let r=It(t);return r===0?e:or(e,(n,o)=>Y(()=>{let s=0,a=n.pipe(C(i=>s>=r?g(i):(s+=i.length,s<=r?a:g(i.slice(r-s)))));return a}))}),xie=l(2,(e,t)=>Fk(cW(e,(r,n)=>!t(r,n)),1)),gie=l(2,(e,t)=>Fk(uW(e,(r,n)=>W(t(r,n),o=>!o)),1)),cW=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o=!0,s=0,a=C(r,i=>{let c=i.findIndex(u=>!t(u,s++));return c===-1?a:(o=!1,g(i.slice(c)))});return L(()=>o?a:r)}))),yie=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o=!0,s=C(r,a=>{let i=a.findIndex(c=>ae(t(c)));return i===-1?s:(o=!1,g(a.slice(i)))});return L(()=>o?s:r)}))),uW=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o=!0,s=0,a=kt(function*(){for(;;){let i=yield*r;for(let c=0;c<i.length;c++)if(!(yield*t(i[c],s++)))return o=!1,i.slice(c)}});return L(()=>o?a:r)}))),Sie=l(2,(e,t)=>{let r=It(t);return r===0?e:or(e,(n,o)=>Y(()=>{let s=xa(),a=C(n,i=>{Md(s,i);let c=s.length-r,u=Jc(s,c);return Mr(u)?g(u):a});return a}))}),fW=e=>e.channel.pipe(os(Oe),k),lW=l(2,(e,t)=>(t=Xn(t),or(e,(r,n)=>Y(()=>{let o=Qt(),s=0,a,i;return L(function c(){if(i)return $e(i);if(a===void 0)return C(r,u=>{if(o.length===0&&u.length===t)return g(u);if(o.length+u.length<t){for(let f=0;f<u.length;f++)o.push(u[f]);return c()}return a=u,c()});for(;s<a.length;)if(o.push(a[s++]),o.length===t){let u=o;return o=[],g(u)}return s=0,a=void 0,c()}).pipe(nt(c=>{if(o.length===0)return $e(c);let u=o;return i=c,o=[],g(u)}))})))),bie=l(2,(e,t)=>pW(e,t,1)),pW=l(3,(e,t,r)=>{let n=Xn(t),o=Xn(r);return or(e,(s,a)=>Y(()=>{let i=null,c=xa(),u=!1,f=0,p=As(s,{onSuccess(d){if(Md(c,d),f>0){let h=c.length;Og(c,f),f=Math.max(0,f-h)}if(c.length<n)return p;u=!0;let m=[];for(;c.length>=n;)if(n===o)m.push(Jc(c,n));else{m.push(SF(c,n));let h=c.length;Og(c,o),f=Math.max(0,o-h)}return g(m)},onFailure(d){return c.length===0||u&&c.length<=n-o?$e(d):(i=d,g(Oe(yi(c))))}});return L(()=>i?$e(i):p)}))}),Eie=l(2,(e,t)=>Uu(e,Qt,(r,n)=>{let o=Qt();for(let s=0;s<n.length;s++)t(n[s])?Mr(r)&&(o.push(r),r=[]):r.push(n[s]);return[r,o]},{onHalt(r){return Mr(r)?Oe(r):La}})),Iie=l(4,(e,t,r,n)=>pk(jr(e.channel),jr(t.channel),r,n).pipe(os(Oe),k)),wie=l(4,(e,t,r,n)=>k(pk(e.channel,t.channel,r,n))),Aie=l(e=>Re(e[0]),(e,t,r,n)=>k(zl(e.channel,t,(o,s)=>{let a=Qt();for(let i=0;i<s.length;i++){let[c,u]=r(o,s[i]);o=c;for(let f=0;f<u.length;f++)a.push(u[f])}return[o,Mr(a)?Oe(a):La]},n?.onHalt?{onHalt(o){let s=n.onHalt(o);return yt(s)?Oe(s):La}}:void 0))),Uu=l(e=>Re(e[0]),(e,t,r,n)=>k(zl(e.channel,t,(o,s)=>{let[a,i]=r(o,s);return o=a,[o,yt(i)?Oe(i):La]},n?.onHalt?{onHalt(o){let s=n.onHalt(o);return yt(s)?Oe(s):La}}:void 0))),La=Qt(),Cie=l(e=>Re(e[0]),(e,t,r,n)=>e.channel.pipe(jr,zl(t,(o,s)=>W(r(o,s),([a,i])=>[a,yt(i)?Oe(i):Qt()]),n?.onHalt?{onHalt(o){let s=n.onHalt(o);return yt(s)?Oe(s):La}}:void 0),k)),Tie=l(e=>Re(e[0]),(e,t,r,n)=>e.channel.pipe(zl(t,(o,s)=>W(r(o,s),([a,i])=>[a,yt(i)?Oe(i):La]),n?.onHalt?{onHalt(o){let s=n.onHalt(o);return yt(s)?Oe(s):La}}:void 0),k)),vie=l(3,(e,t,r)=>En(()=>{let n=t();return Fu(Mu(n),k(zl(e.channel,()=>n,(o,s)=>{let a=Qt();for(let i=0;i<s.length;i++)o=r(o,s[i]),a.push(o);return[o,Oe(a)]})))})),kie=l(3,(e,t,r)=>En(()=>e.channel.pipe(jr,DH(t(),r),os(Oe),k))),Oie=l(2,(e,t)=>or(e,_e(function*(r,n){let o=yield*Tf,s=Nr(ct(t)),a,i,c=1/0,u=tn(),f=tn(),p=tn();yield*r.pipe(u.whenOpen,C(m=>(f.openUnsafe(),a=m,c=o.currentTimeMillisUnsafe()+s,ie)),ir({disableYield:!0}),Lo(m=>(i=m,c=o.currentTimeMillisUnsafe(),f.openUnsafe(),p.openUnsafe(),ie)),rr(n));let d=L(function m(){let h=o.currentTimeMillisUnsafe(),y=c<h?s:Math.min(s,c-h);return C(Nf(mi(y),p.await),()=>{if(o.currentTimeMillisUnsafe()<c)return m();if(a){f.closeUnsafe(),u.closeUnsafe();let b=g(Oe(ax(a)));return a=void 0,b}else if(i)return $e(i);return m()})});return L(()=>{if(i){if(a){let m=g(Oe(ax(a)));return a=void 0,m}return $e(i)}return u.openUnsafe(),f.whenOpen(d)})}))),dW=l(2,(e,t)=>{let r=t.burst??0;return t.strategy===\"enforce\"?_ie(e,t.cost,t.units,t.duration,r):Rie(e,t.cost,t.units,t.duration,r)}),_ie=(e,t,r,n,o)=>or(e,s=>qc(a=>{let i=Nr(ct(n)),c=r+o<0?Number.POSITIVE_INFINITY:r+o,u=r,f=a.currentTimeMillisUnsafe();return g(C(s,function p(d){return C(t(d),m=>{let h=a.currentTimeMillisUnsafe(),S=(h-f)/i,b=u+S*r,x=b<0?c:Math.min(b,c);return m<=x?(u=x-m,f=h,g(d)):C(s,p)})}))})),Rie=(e,t,r,n,o)=>or(e,s=>qc(a=>{let i=Nr(ct(n)),c=r+o<0?Number.POSITIVE_INFINITY:r+o,u=r,f=a.monotonicTimeNanosUnsafe();return g(C(s,p=>C(t(p),d=>{let m=a.monotonicTimeNanosUnsafe(),y=Number(m-f)/1e6/i,S=u+y*r,x=Math.min(S,c)-d;if(x>=0)return u=x,f=m,g(p);let w=-x/r,I=Math.max(0,w*i);return I>0?C(mi(I),()=>(u=x,f=m,g(p))):(u=x,f=m,g(p))})))})),Pie=l(2,(e,t)=>dW(e,{...t,cost:r=>g(t.cost(r))})),Mie=l(2,(e,t)=>fW(lW(e,t))),Fie=l(3,(e,t,r)=>Nk(e,Az(Xn(t)),O0(r))),Nie=l(e=>Re(e[0]),(e,t,r)=>mW(e,_e(function*(n,o,s){for(let a=0;a<n.length;a++){let[i,c]=yield*t(n[a]),u=Nn(s,i),f=Ce(u)?u.value:yield*Tg(Ck(o,i));yield*Tk(o,i),yield*Ln(f,c)}}),r)),Uie=l(e=>Re(e[0]),(e,t,r)=>En(()=>{let n=$c();return mW(e,_e(function*(o,s,a){for(let i=0;i<o.length;i++){let c=t(o[i]),u=Nn(n,c);ge(u)?Kc(n,c,[o[i]]):u.value.push(o[i])}for(let[i,c]of n){let u=Nn(a,i),f=Ce(u)?u.value:yield*Tg(Ck(s,i));yield*Tk(s,i),yield*Vc(f,c)}Sg(n)}),r)})),mW=(e,t,r)=>kk(e,_e(function*(n,o,s){let a=yield*EF();yield*xr(o,fo(a));let i=$c(),c=yield*vz({lookup:u=>Wc(uo({capacity:r?.bufferSize??4096}).pipe(Yr(f=>(Kc(i,u,f),Ln(a,[u,ph(f)])))),f=>(ci(i,u),aw(f))),idleTimeToLive:r?.idleTimeToLive??ra}).pipe(Ss(s));return yield*No({while:Cn,body:gt(C(n,u=>t(u,c,i))),step:zr}).pipe(nt(u=>{for(let[,f]of i)Nd(f);return cr(a,u)}),rr(o)),Zc(a)})),Die=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o,s,a=Qt(),i=r.pipe(C(u=>{for(let f=0;f<u.length;f++){let p=u[f],d=t(p);if(s===void 0){o=d,s=[p];continue}else if(Z(d,o)){s.push(p);continue}a.push([o,s]),o=d,s=[p]}if(Mr(a)){let f=a;return a=[],g(f)}return i})),c;return nt(L(()=>c?$e(c):i),u=>{if(c=u,s===void 0)return $e(u);let f=Oe([o,s]);return s=void 0,g(f)})}))),Lie=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o,s,a=L(()=>{if(s!==void 0){let c=s;return s=void 0,g(c)}return r}).pipe(Uo(c=>(o=la(c),ue()))),i=W(L(()=>t.transform(a,n)),([c,u])=>(s=u,Oe(c)));return L(()=>o||i)}))),$ie=l(2,(e,t)=>Nk(e,t,Ad)),Nk=l(3,(e,t,r)=>k(ns(_e(function*(n,o,s){let a=yield*Bs(e.channel,o),i=tn(!1),c=Symbol(),u=yield*uo({capacity:0});yield*a.pipe(i.whenOpen,C(T=>(i.closeUnsafe(),Ln(u,T))),ir,nt(T=>cr(u,T)),rr(s));let f=yield*Tf,p=yield*Lc(r),d=tn(!1),m=f.currentTimeMillisUnsafe(),h=0,y=v(),S,b=T=>(d.openUnsafe()&&(h=f.currentTimeMillisUnsafe()),g(T)),x=d.await.pipe(C(()=>p(m,y)),C(([,T])=>mi(T)),C(()=>Ln(u,c)),At(()=>aw(u)),C(()=>Bc)),w=L(()=>{if(S!==void 0){let T=S;return S=void 0,b(T)}return u.state._tag===\"Open\"&&i.openUnsafe(),C(ga(u),T=>T===c?ue():b(T))}),I=C(([T,P])=>{if(d.isOpen())m+=f.currentTimeMillisUnsafe()-h;else if(u.state._tag===\"Done\")return ue();return y=_(T),S=P,g(Oe(T))});return L(()=>{if(u.state._tag===\"Done\"&&S===void 0)return u.state.exit;d.closeUnsafe();let T=I(L(()=>Dk(t,w,s)));return u.state._tag===\"Open\"?Nf(T,x):T})})))),Kie=l(2,_e(function*(e,t){let r=It(t.n),n=yield*Bie(t),o=new Array(r),s=yield*Vr;for(let a=0;a<r;a++){let i=tr(s),c=yield*ah(n).pipe(Cs(Vr,i));o[a]=uk(eb(c)).pipe(uh(u=>Xe(i,u)),k)}return yield*Gi(e.channel,a=>XS(n,a)).pipe(Dn(a=>QS(n,a)),Df),o})),Bie=e=>Wc(e.capacity===\"unbounded\"?YS(e):e.strategy===\"dropping\"?VS(e):e.strategy===\"sliding\"?ZS(e):GS(e),sh),hW=l(2,(e,t)=>W(CW(e,t),Wz)),jie=l(2,(e,t)=>W(Mz({acquire:hW(e,t),idleTimeToLive:t.idleTimeToLive}),r=>Vi(Fz(r)))),Hie=l(2,(e,t)=>k(fb(e.channel,t))),zie=l(2,(e,t)=>k(mk(e.channel,t))),Wie=l(2,(e,t)=>e.channel.pipe(mk(wz(t)),AH(([r,n])=>n?nb(n):Ou),k)),qie=e=>mb(AW(e)),Jie=e=>Uu(e,Qt,(t,r)=>{let n=mE(t,r);return[n,[n]]}),Gie=e=>xW(e,Z),xW=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o=!0,s;return C(r,function a(i){let c=[],u=0;for(o&&(o=!1,s=i[0],u=1,c.push(s));u<i.length;u++){let f=i[u];t(f,s)||(s=f,c.push(f))}return Mr(c)?g(c):C(r,a)})}))),Vie=l(2,(e,t)=>or(e,(r,n)=>Y(()=>{let o=!0,s;return C(r,_e(function*a(i){let c=[],u=0;for(o&&(o=!1,s=i[0],u=1,c.push(s));u<i.length;u++){let f=i[u];(yield*t(f,s))||(s=f,c.push(f))}return Mr(c)?c:yield*C(r,_e(a))}))}))),Zie=l(e=>Re(e[0]),(e,t)=>e.channel.pipe(fb(XH(t?.encoding)),k)),Yie=e=>En(()=>{let t=new TextEncoder;return Gn(e,r=>t.encode(r))}),Qie=e=>e.channel.pipe(fb(QH()),k),gW=l(2,(e,t)=>Jz(e,(r,n)=>{let o=n===0?[]:[t],s=r.length-1;for(let a=0;a<r.length;a++)a===s?o.push(r[a]):o.push(r[a],t);return o})),Xie=l(2,(e,t)=>Mu(t.start).pipe(Fu(gW(e,t.middle)),Fu(Mu(t.end)))),ece=l(2,(e,t)=>yW(e,t,Nu(E_([!0,!1])))),yW=l(3,(e,t,r)=>k(Ue(_e(function*(n,o){let s=yield*we(jr(r.channel))(n,o),a=Symbol(),i=!1,c=!1,u=(yield*we(jr(e.channel))(n,o)).pipe(At(()=>(i=!0,g(a)))),f=(yield*we(jr(t.channel))(n,o)).pipe(At(()=>(c=!0,g(a))));return kt(function*(){for(;;){if(i&&c)return yield*ue();let p=yield*s;if(p&&i||!p&&c)continue;let d=yield*p?u:f;if(d!==a)return Oe(d)}})})))),tce=l(2,(e,t)=>k(gk(e.channel,t))),rce=l(2,(e,t)=>k(sz(e.channel,t))),SW=l(2,(e,t)=>k(uh(e.channel,t))),nce=l(2,(e,t)=>k(az(e.channel,t))),bW=l(2,(e,t)=>k(iz(e.channel,t))),EW=l(2,(e,t)=>k(yk(e.channel,r=>t(r[0])))),oce=l(2,(e,t)=>k(cz(e.channel,t))),sce=l(2,(e,t)=>k(uz(e.channel,t))),IW=l(e=>Re(e[0]),(e,t,r)=>k(fz(e.channel,t,r))),ace=l(2,(e,t)=>k(lb(e.channel,t))),ice=l(3,(e,t,r)=>k(pb(e.channel,t,r))),Uk=l(3,(e,t,r)=>k(db(e.channel,t,r))),wW=l(2,(e,t)=>k(lz(e.channel,t))),cce=l(3,(e,t,r)=>wW(e,n=>dr(n,t,r(Me(n,t))))),uce=function(){let e=Re(arguments[0]),t=e?arguments[1]:arguments[0],r=Va(e?arguments[2]:arguments[1]);if(e){let n=arguments[0];return k(Sk(n.channel,t,r))}return n=>k(Sk(n.channel,t,r))},fce=Mu({}),lce=l(3,(e,t,r)=>Gn(e,n=>({...n,[t]:r(n)})));var pce=l(e=>Re(e[0]),(e,t,r,n)=>Jl(e,o=>Gn(r(o),s=>({...o,[t]:s})),n)),dce=l(e=>Re(e[0]),(e,t,r,n)=>mh(e,o=>W(r(o),s=>({...o,[t]:s})),n)),mce=l(2,(e,t)=>Gn(e,r=>({[t]:r}))),hce=l(2,(e,t)=>vg(r=>Bs(e.channel,r).pipe(C(n=>Dk(t,n,r)),W(([n])=>n)))),Dk=(e,t,r)=>xk(e.transform(hk(t),r)),AW=e=>Pu(e.channel,()=>[],(t,r)=>{for(let n=0;n<r.length;n++)t.push(r[n]);return t}),xce=e=>Pu(e.channel,()=>0,(t,r)=>t+r.length),gce=e=>Pu(e.channel,()=>0,(t,r)=>{for(let n=0;n<r.length;n++)t+=r[n];return t}),yce=l(3,(e,t,r)=>Pu(e.channel,t,(n,o)=>{for(let s=0;s<o.length;s++)n=r(n,o[s]);return n})),Sce=l(3,(e,t,r)=>xz(e.channel,t,(n,o)=>{let s=0,a=n;return W(No({while:()=>s<o.length,body:()=>r(a,o[s]),step(i){a=i,s++}}),()=>a)})),bce=e=>W(mz(e.channel),Vt(k_(0))),Ece=e=>W(hz(e.channel),Vt(ax)),Ice=l(2,(e,t)=>Gi(e.channel,r=>{let n=0;return No({while:()=>n<r.length,body:()=>t(r[n++]),step:zr})})),wce=l(2,(e,t)=>dz(e.channel,r=>{let n=!1,o=0;return W(No({while:()=>!n&&o<r.length,body:()=>t(r[o]),step(s){o++,s||(n=!0)}}),()=>!n)})),Ace=l(2,(e,t)=>Gi(e.channel,t)),xb=e=>pz(e.channel),Cce=e=>Ek(e.channel),Tce=e=>Pu(e.channel,()=>\"\",(t,r)=>t+r.join(\"\")),vce=e=>W(bk(e.channel),t=>t.buffer),kce=e=>bk(e.channel),Lk=l(e=>Re(e[0]),(e,t,r)=>{let n,o,s=!1,a=tn(!1),i=r?.signal,c=()=>o.interruptUnsafe();return new ReadableStream({start(u){o=Rd(ao(Gi(rn(e.channel,f=>g(a.whenOpen(f))),f=>Y(()=>{a.closeUnsafe();for(let p=0;p<f.length;p++)u.enqueue(f[p]);n(),n=void 0})),t)),o.addObserver(f=>{i?.removeEventListener(\"abort\",c),!s&&(f._tag===\"Failure\"&&i?.aborted!==!0?u.error(rg(f.cause)):u.close())}),i!==void 0&&o.pollUnsafe()===void 0&&(i.aborted?c():i.addEventListener(\"abort\",c,{once:!0}))},pull(){return new Promise(u=>{n=u,a.openUnsafe()})},cancel(){if(o)return s=!0,Y0(pi(Ko(o)))}},r?.strategy)}),Oce=l(e=>Re(e[0]),(e,t)=>Lk(e,Pr(),t)),_ce=l(e=>Re(e[0]),(e,t)=>W(Hc(),r=>Lk(e,r,t))),$k=l(2,(e,t)=>({[Symbol.asyncIterator](){let r=Q0(t),n=co(t),o=oo(),s,a,i,c,u=p=>{if(c)return c;let d=i;return c=r(jt(Zr(d?Ko(d):ie,Xe(o,p)),{done:!0,value:void 0})),c},f=async p=>{try{await u(p)}catch(d){await r(X0(\"Suppressed error while closing Stream async iterator\",d))}};return{async next(){if(c)return c;if(a){let m=a.next();if(!m.done)return m;a=void 0}let p=n(s??C(Bs(e.channel,o),m=>(s=m,m)));i=p;let d=await r(hF(p));if(i===p&&(i=void 0),ut(d))return a=d.value[Symbol.iterator](),a.next();if(Is(d.cause))return u(Bt);if(c&&e0(d.cause))return c;throw await f(d),rg(d.cause)},return(){return u(Bt)},async throw(p){throw await f(a0(p)),p}}}})),Rce=e=>W(Hc(),t=>$k(e,t)),Pce=e=>$k(e,Pr()),Mce=l(e=>Re(e[0]),(e,t,r)=>wk(e.channel,t,r)),Fce=l(2,(e,t)=>Sz(e.channel,t)),CW=l(2,(e,t)=>bz(e.channel,t)),Nce=l(2,(e,t)=>gz(e.channel,t)),Uce=l(2,(e,t)=>Ik(e.channel,t));var Kk=Et(\"effect/FileSystem\");var vW=Et(\"effect/Path\");function gh(e){return{_tag:\"Value\",value:e}}function yb(e,t){return{_tag:\"Record\",keys:e,value:t}}function zk(e,t){return{_tag:\"Array\",length:e,value:t}}var gb=class extends Ut(\"SourceError\"){},Du=Te(\"effect/ConfigProvider\",{defaultValue:()=>FW()}),Dce={...kr,toJSON(){return{_id:\"ConfigProvider\"}}},Lce=e=>e;function OW(e,t){let r=Object.create(Dce);return r.load=e,r.mapInput=t,r}function _W(e,t){return OW(r=>e(t(r)),r=>_W(e,n=>r(t(n))))}function RW(e,t){return OW(r=>C(e.load(r),n=>n!==void 0?g(n):t.load(r)),r=>RW(e.mapInput(r),t.mapInput(r)))}function Sb(e){return _W(e,Lce)}var jk=l(2,(e,t)=>RW(e,t)),Wk=l(2,(e,t)=>e.mapInput(t)),$ce=Wk(e=>e.map(t=>typeof t==\"number\"?t:B1(t))),Kce=l(2,(e,t)=>{let r=typeof t==\"string\"?[t]:t;return Wk(e,n=>[...r,...n])}),Bce=e=>ws(e)?pa(Du)(e):x1(Du)(e),jce=(e,t)=>pa(Du)(kt(function*(){let r=yield*Du,n=ws(e)?yield*e:e;return t?.asPrimary?jk(n,r):jk(r,n)}));function Hce(e,t){let r=t?.preserveEmptyStrings===!0;return Sb(n=>g(zce(e,n,r)))}function zce(e,t,r){let n=e;for(let o of t){if(n==null)return;if(Array.isArray(n)){if(typeof o!=\"number\"||!Number.isInteger(o)||o<0||o>=n.length)return;n=n[o];continue}if(fr(n)){if(typeof o!=\"string\"||!Object.hasOwn(n,o))return;n=n[o];continue}return}return Wce(n,r)}function Wce(e,t){if(e!=null)return typeof e==\"string\"?PW(e,t):typeof e==\"number\"||typeof e==\"boolean\"||typeof e==\"bigint\"?gh(String(e)):Array.isArray(e)?zk(e.length):fr(e)?yb(new Set(Object.keys(e))):gh(K(e))}function PW(e,t){let r=MW(e,t);return r===void 0?void 0:gh(r)}function MW(e,t){return e===\"\"&&!t?void 0:e}function qk(e,t){let r=t?.preserveEmptyStrings===!0,n=qce(e);return Sb(o=>g(Jce(n,e,o,r)))}function FW(e){let t=e?.env??{...globalThis.process?.env,...import.meta?.env};return qk(t,{preserveEmptyStrings:e?.preserveEmptyStrings})}function qce(e){let t={};for(let[r,n]of Object.entries(e)){if(n===void 0)continue;let o=r.split(\"_\"),s=t;for(let a of o){let i=s.children??=Object.create(null);s=i[a]??={}}}return t}function Jce(e,t,r,n){let o=r.map(String).join(\"_\"),s=MW(Object.hasOwn(t,o)?t[o]:void 0,n),a=Gce(e,r),i=a?.children?Object.keys(a.children):[];if(i.length===0)return s===void 0?void 0:gh(s);if(i.every(nf)){let u=Math.max(...i.map(f=>parseInt(f,10)))+1;return zk(u,s)}return yb(new Set(i),s)}function Gce(e,t){if(t.length===0)return e;let r=e;for(let n of t)if(r=r?.children?.[String(n)],!r)return;return r}function NW(e,t){let r=Zce(e);return t?.expandVariables&&(r=Yce(r)),qk(r,{preserveEmptyStrings:t?.preserveEmptyStrings})}var Vce=/(?:^|^)\\s*(?:export\\s+)?([\\w.-]+)(?:\\s*=\\s*?|:\\s+?)(\\s*'(?:\\\\'|[^'])*'|\\s*\"(?:\\\\\"|[^\"])*\"|\\s*`(?:\\\\`|[^`])*`|[^#\\r\\n]+)?\\s*(?:#.*)?(?:$|$)/mg;function Zce(e){let t=Object.create(null);e=e.replace(/\\r\\n?/gm,`\n`);let r;for(;(r=Vce.exec(e))!=null;){let n=r[1],o=r[2]||\"\";o=o.trim();let s=o[0];o=o.replace(/^(['\"`])([\\s\\S]*)\\1$/gm,\"$2\"),s==='\"'&&(o=o.replace(/\\\\n/g,`\n`),o=o.replace(/\\\\r/g,\"\\r\")),t[n]=o}return t}function Yce(e){let t=Object.create(null);for(let r of Object.keys(e))t[r]=Hk(e[r],e,new Set([r])).replace(/\\\\\\$/g,\"$\");return t}function Hk(e,t,r){let n=/\\${?(\\w+)/g,o=\"\",s=0,a;for(;(a=n.exec(e))!=null;){if(a.index>0&&e[a.index-1]===\"\\\\\")continue;let[,i]=a,c=n.lastIndex,u=\"\";if(e.startsWith(\":-\",c)){c+=2;let p=c,d=0;for(;c<e.length;c++)if(e.startsWith(\"${\",c))d++,c++;else if(e[c]===\"}\"){if(d===0)break;d--}u=e.slice(p,c)}e[c]===\"}\"&&c++;let f=Object.hasOwn(t,i)&&!r.has(i)?Hk(t[i],t,new Set([...r,i])):\"\";o+=e.slice(s,a.index)+(f||Hk(u,t,r)),s=c,n.lastIndex=c}return o+e.slice(s)}var Qce=_e(function*(e){let r=yield*(yield*Kk).readFileString(e?.path??\".env\");return NW(r,e)}),Xce=_e(function*(e){let t=yield*vW,r=yield*Kk,n=e?.rootPath??\"/\",o=e?.preserveEmptyStrings===!0;return Sb(s=>{let a=t.join(n,...s.map(String)),i=r.readFileString(a).pipe(W(u=>PW(u.trim(),o))),c=r.readDirectory(a).pipe(W(u=>yb(new Set(u.map(f=>t.basename(f))))));return i.pipe(Uo(u=>c.pipe(Uo(f=>Bk(u)&&Bk(f)?g(void 0):F(Bk(u)?f:u)))),Do(u=>new gb({message:`Failed to read file at ${t.join(n,...s.map(String))}`,cause:u})))})}),Bk=e=>e.reason._tag===\"NotFound\";var UW=[\"All\",\"Fatal\",\"Error\",\"Warn\",\"Info\",\"Debug\",\"Trace\",\"None\"];var Gk=\"~effect/Config\",$W=e=>A(e,Gk),Vl=class{_tag=\"ConfigError\";name=\"ConfigError\";cause;constructor(t){this.cause=t}get message(){return this.cause.toString()}toString(){return`ConfigError(${this.message})`}},eue={...Lh({label:\"Config\",evaluate(e){return this.parse(e.getRef(Du))}}),[Gk]:Gk,toJSON(){return{_id:\"Config\"}}};function zs(e){let t=Object.create(eue);return t.evaluator=e,t.parse=r=>Ct(e(r,[]),jc),t}var ss=(e,t,r)=>e.evaluator(t,r),KW=l(2,(e,t)=>zs((r,n)=>W(ss(e,r,n),sr(t)))),tue=l(2,(e,t)=>zs((r,n)=>C(ss(e,r,n),mr({onSuccess:o=>ss(t(o),r,n),onFailure:o=>g(q(o))})))),rue=l(2,(e,t)=>zs((r,n)=>C(ss(e,r,n),o=>rt(o)?fn(t(o.success),j):g(q(o.failure))))),nue=l(2,(e,t)=>zs((r,n)=>As(ss(e,r,n),{onFailure:o=>{let s=r0(o);return Ce(s)&&o.reasons.every(ai)?ss(t(s.value),r,n):$e(o)},onSuccess:o=>ae(o)?ss(t(o.failure),r,n):g(o)})));function BW(e){let t=globalThis.Array.isArray(e)?e:Symbol.iterator in e?[...e]:e;return zs((r,n)=>globalThis.Array.isArray(t)?fn(Eg(t.map(o=>ss(o,r,n))),pE):fn(Eg(gc(t,o=>ss(o,r,n))),pE))}var jW=l(2,(e,t)=>zs((r,n)=>fn(ss(e,r,n),o=>ae(o)?j(t):o))),oue=e=>e.pipe(KW(_),jW(v())),HW=e=>$W(e)?e:BW(gc(e,t=>HW(t))),sue=e=>Wt(e,\"SourceError\"),aue=()=>\"<configuration>\",zW=e=>t=>nt(t,r=>$e(gs(r.reasons.map(e)))),WW=(e,t)=>e.load(t).pipe(zW(r=>ai(r)?Cf(r.error).annotate(ng(r)):r),fn(r=>({provider:e,path:t,node:r,toString:aue}))),LW=(e,t)=>WW(e.provider,[...e.path,t]),Jk=(e,t)=>Oa(Jo,e,new Ke(Rt(r=>t(r)),hn())),qW=e=>{switch(e._tag){case\"Union\":return e.types.every(qW);case\"Objects\":case\"Arrays\":case\"Suspend\":return!1;default:return!0}},Vk=(e,t)=>{switch(e._tag){case\"Objects\":return t?._tag===\"Record\";case\"Arrays\":return t?._tag===\"Array\";case\"Union\":return e.types.some(r=>Vk(r,t));case\"Suspend\":return Vk(e.thunk(),t);default:return t?.value!==void 0}},iue=on(e=>{let t=new WeakSet,r=dl(n=>{switch(t.add(n),n._tag){case\"Objects\":{let o=_e(function*(s){if(s.node?._tag!==\"Record\")return;let a=s.node,i=new Set;for(let u of n.propertySignatures)typeof u.name==\"string\"&&i.add(u.name);if(n.indexSignatures.length>0){let u={};for(let f of a.keys)B(u,f,void 0);for(let f of n.indexSignatures)for(let p of Ms(u,f.parameter))typeof p==\"string\"&&i.add(p)}let c={};for(let u of i){let f=yield*LW(s,u);f.node!==void 0&&B(c,u,f)}return c});return Jk(n.recur(r,s=>s),o)}case\"Arrays\":{let o=_e(function*(s){if(s.node?._tag!==\"Array\")return;let a=[];for(let i=0;i<s.node.length;i++)a.push(yield*LW(s,i));return a});return Jk(n.recur(r),o)}case\"Union\":for(let o of n.types)r(o);if(!qW(n))return n.recur(r);break;case\"Suspend\":{let o=n.thunk();return t.has(o)||r(o),n.recur(r)}case\"Declaration\":case\"Any\":throw new globalThis.Error(\"Config.schema does not support opaque StringTree encodings\",{cause:n})}return Jk(n,o=>g(o.node?.value))});return r(e)});function Tr(e,t){let r=oh(e),n=gn(r.ast),o=St(Q(iue(r.ast))),s=typeof t==\"string\"?[t]:t??[];return zs((a,i)=>{let c=[...i,...s];return WW(a,c).pipe(Ct(u=>o(u).pipe(fn(j),$f(f=>{let p=new Vl(new Ma(c.length>0?new Ot(c,f):f));return Vk(n,u.node)?F(p):g(q(p))}))),zW(u=>QI(u)&&sue(u.defect)?Af(new Vl(u.defect)).annotate(ng(u)):u))})}var cue=en.check(Ls({minimum:1,maximum:65535})),uue=Jn(UW),JW=e=>Wr(e)||globalThis.Array.isArray(e);function fue(e){return zs(()=>F(new Vl(e)))}function lue(e){return zs(()=>g(j(e)))}function pue(e){return Tr(H,e)}function due(e){return Tr(th,e)}function mue(e){return Tr(wu,e)}function hue(e){return Tr(Ul,e)}function xue(e){return Tr(en,e)}function gue(e,t){return Tr(zt(e),t)}function yue(e,t){return Tr(Jn(e),t)}function Sue(e,t,r){let n=JW(t),o=n?r:t,s=Be(e),a=o?.separator??\",\",i=H.pipe(J(oh(s),{decode:q2(o),encode:Iy(hn({strict:!1}),le(c=>c.join(a)))}));return Tr(st([i,s]),n?t:void 0)}function bue(e,t,r,n){let o=JW(r),s=Na(e,t),a=pD(o?n:r),i=H.pipe(J(oh(s),{decode:a.decode,encode:Iy(hn({strict:!1}),a.encode)}));return Tr(st([s,i]),o?r:void 0)}function Eue(e){return Tr(Sv,e)}function Iue(e){return Tr(Rv,e)}function wue(e){return Tr($l,e)}function Aue(e){return Tr(cue,e)}function Cue(e){return Tr(uue,e)}function Tue(e){return Tr(KS(H),e)}function vue(e){return Tr(LS,e)}function kue(e){return Tr(Dl,e)}var Oue=l(2,(e,t)=>zs((r,n)=>ss(e,r,[...n,t])));var Lu={};An(Lu,{Console:()=>GW,assert:()=>_ue,clear:()=>Rue,consoleWith:()=>ur,count:()=>Pue,countReset:()=>Mue,debug:()=>Fue,dir:()=>Nue,dirxml:()=>Uue,error:()=>Due,group:()=>Lue,info:()=>$ue,log:()=>Kue,table:()=>Bue,time:()=>jue,timeLog:()=>Hue,trace:()=>zue,warn:()=>Wue,withGroup:()=>que,withTime:()=>Jue});var GW=qI,ur=e=>se(t=>e(t.getRef(GW))),_ue=(e,...t)=>ur(r=>X(()=>{r.assert(e,...t)})),Rue=ur(e=>X(()=>{e.clear()})),Pue=e=>ur(t=>X(()=>{t.count(e)})),Mue=e=>ur(t=>X(()=>{t.countReset(e)})),Fue=(...e)=>ur(t=>X(()=>{t.debug(...e)})),Nue=(e,t)=>ur(r=>X(()=>{r.dir(e,t)})),Uue=(...e)=>ur(t=>X(()=>{t.dirxml(...e)})),Due=(...e)=>ur(t=>X(()=>{t.error(...e)})),Lue=e=>ur(t=>kc(X(()=>{e?.collapsed?t.groupCollapsed(e.label):t.group(e?.label)}),()=>X(()=>{t.groupEnd()}))),$ue=(...e)=>ur(t=>X(()=>{t.info(...e)})),Kue=(...e)=>ur(t=>X(()=>{t.log(...e)})),Bue=(e,t)=>ur(r=>X(()=>{r.table(e,t)})),jue=e=>ur(t=>kc(X(()=>{t.time(e)}),()=>X(()=>{t.timeEnd(e)}))),Hue=(e,...t)=>ur(r=>X(()=>{r.timeLog(e,...t)})),zue=(...e)=>ur(t=>X(()=>{t.trace(...e)})),Wue=(...e)=>ur(t=>X(()=>{t.warn(...e)})),que=l(e=>de(e[0]),(e,t)=>ur(r=>nd(X(()=>{t?.collapsed?r.groupCollapsed(t.label):r.group(t?.label)}),()=>e,()=>X(()=>{r.groupEnd()})))),Jue=l(e=>de(e[0]),(e,t)=>ur(r=>nd(X(()=>{r.time(t)}),()=>e,()=>X(()=>{r.timeEnd(t)}))));var In={OK:200,Unauthorized:401,NotFound:404,InternalServerError:500,ServiceUnavailable:503},Zk={[In.OK]:\"OK\",[In.Unauthorized]:\"Unauthorized\",[In.NotFound]:\"Not Found\",[In.InternalServerError]:\"Internal Server Error\",[In.ServiceUnavailable]:\"Service Unavailable\"},Gue=e=>{let t=e.startsWith(\"/\"),r=[];for(let o of e.split(\"/\"))if(!(o===\"\"||o===\".\")){if(o===\"..\"){r.length>0&&r.at(-1)!==\"..\"?r.pop():t||r.push(\"..\");continue}r.push(o)}let n=r.join(\"/\");return t?`/${n}`:n||\".\"},Zi=(...e)=>Gue(e.filter(Boolean).join(\"/\")),Zl=e=>{if(e.length===0)return\".\";let t=e.length;for(;t>1&&e[t-1]===\"/\";)t-=1;let r=e.slice(0,t),n=r.lastIndexOf(\"/\");return n<0?\".\":n===0?\"/\":r.slice(0,n)},VW=e=>{if(!e.startsWith(\"/\"))throw new TypeError(\"Path must be absolute\");let t=new URL(\"file:///\");return t.pathname=e.replace(/%/g,\"%25\").replace(/\\\\/g,\"%5C\"),t};var Vue=/^[A-Za-z0-9_-]+$/u,ZW=/[*?[{]/u,bb=(e,t)=>t===e||t.startsWith(`${e.replace(/\\/+$/u,\"\")}/`),Yl=class extends an.TaggedError(\"FunctionFileSystemError\"){},Eo=(e,t)=>e.lstat(t).pipe($.catch(()=>$.undefined)),$u=(e,t,r)=>$.all([e.realPath(t),e.realPath(r)],{concurrency:2}).pipe($.map(([n,o])=>bb(n,o)),$.orElseSucceed(()=>!1)),YW=(e,t,r)=>$.gen(function*(){let n=yield*Eo(e,r);if(n===void 0)return!0;if(n.isSymbolicLink||!(yield*$u(e,t,r)))return!1;if(!n.isDirectory)return!0;let o=yield*e.readDirectory(r).pipe($.catch(()=>$.undefined));if(o===void 0)return!1;for(let s of o)if(!(yield*YW(e,t,Zi(r,s))))return!1;return!0}),yh=(e,t)=>t.length===0?\"\":t.startsWith(\"/\")?t:Zi(e,t),Yk=[\"deno.json\",\"deno.jsonc\"],QW=e=>Yk.includes(e.slice(e.lastIndexOf(\"/\")+1)),Zue=(e,t,r)=>$.gen(function*(){let n=Zl(Zi(r));for(;bb(t,n);){for(let s of Yk){let a=Zi(n,s),i=yield*Eo(e,a);if(i!==void 0)return i.isFile&&!i.isSymbolicLink?a:void 0}let o=Zl(n);if(o===n)break;n=o}}),Yue=(e,t,r)=>$.all([e.realPath(t),e.realPath(r)],{concurrency:2}).pipe($.map(([n,o])=>n===o),$.orElseSucceed(()=>!1)),XW=$.fn(\"Functions.resolveFunctionConfig\")(function*(e){let{root:t,slug:r,overrides:n,fs:o}=e;if(!t.startsWith(\"/\")||!Vue.test(r)||r===\"_shared\"||(yield*Eo(o,t))===void 0)return;let a=yield*o.realPath(t).pipe($.orElseSucceed(()=>\"\"));if(!a.startsWith(\"/\"))return;let i=yield*Eo(o,a);if(i===void 0||!i.isDirectory)return;let c=e.filesRoot===void 0?a:yield*o.realPath(e.filesRoot).pipe($.orElseSucceed(()=>\"\"));if(!c.startsWith(\"/\")||!bb(c,a))return;let u=n.$default,f=n[r],p={...u,...f};if(p.enabled===!1)return;let d=Zi(a,r),m=p?.entrypointPath&&p.entrypointPath.length>0?p.entrypointPath:p.entrypoint&&p.entrypoint.length>0?p.entrypoint:\"index.ts\";if(!m.startsWith(\"/\")){let P=yield*Eo(o,d);if(P===void 0||!P.isDirectory||!(yield*$u(o,a,d)))return}let h=yh(d,m);if(!(yield*$u(o,c,h)))return;let y=yield*Eo(o,h);if(y===void 0||!y.isFile||y.isSymbolicLink)return;let S=f?.importMapPath??f?.import_map,b=u?.importMapRoot??u?.import_map_root,x=S!==void 0?yh(d,S):b!==void 0?yh(a,b):yh(d,\"\");if(x.length>0){if(!(yield*$u(o,c,x)))return;let P=yield*Eo(o,x);if(P===void 0||!P.isFile||P.isSymbolicLink)return}else for(let P of Yk){let G=Zi(d,P),he=yield*Eo(o,G);if(he!==void 0){if(!he.isFile||he.isSymbolicLink||!(yield*$u(o,c,G)))return;x=G;break}}let w=x.length===0?void 0:yield*Zue(o,c,h),I=w!==void 0&&(yield*Yue(o,w,x)),T=(p.staticFiles??p.static_files??[]).map(P=>yh(d,P));for(let P of T){if(!bb(c,P))return;let G=P.search(ZW),he=G<0?P:P.slice(0,G),me=G<0?Zl(P):he.slice(0,Math.max(0,he.lastIndexOf(\"/\")))||a;if(!(yield*YW(o,c,me)))return;if(!ZW.test(P)){let E=yield*Eo(o,P);if(E!==void 0&&(!(yield*$u(o,c,P))||E.isSymbolicLink))return}}return{entrypointPath:h,importMapPath:x,importMapDiscoveredByRuntime:I,staticFiles:T,verifyJWT:p.verifyJWT??p.verify_jwt??!0,env:{...u?.env,...f?.env}}}),Que=e=>Zi(Zl(e.entrypointPath),\"package.json\"),eq=e=>{let t=new Map,r=new Map;return(n,o)=>{let s=r.get(n);if(s!==void 0)return s;let a=Zl(o.entrypointPath),i=t.get(a),c=i===void 0||i===n?a:e();return i===void 0&&t.set(a,n),r.set(n,c),c}},tq=$.fn(\"Functions.packageJsonContainedFor\")(function*(e){if(!e.root.startsWith(\"/\"))return!1;let t=yield*Eo(e.fs,e.root);if(t===void 0||!t.isDirectory&&!t.isSymbolicLink)return!1;let r=yield*e.fs.realPath(e.root).pipe($.orElseSucceed(()=>\"\"));if(!r.startsWith(\"/\"))return!1;let n=yield*Eo(e.fs,r);if(n===void 0||!n.isDirectory)return!1;let o=Que(e.config),s=yield*Eo(e.fs,o);return s===void 0||!s.isFile||s.isSymbolicLink?!1:yield*$u(e.fs,r,o)});var Qk=new TextEncoder,Sh=new TextDecoder,Eb=new TextDecoder(\"utf-8\",{fatal:!0}),rbe=2**32;function rq(...e){let t=e.reduce((o,{length:s})=>o+s,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function Ql(e){let t=new Uint8Array(e.length);for(let r=0;r<e.length;r++){let n=e.charCodeAt(r);if(n>127)throw new TypeError(\"non-ASCII string encountered in encode()\");t[r]=n}return t}var Ib=(e,t=\"algorithm.name\")=>new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function Xue(e,t){if(t&&!e.usages.includes(t))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function nq(e,t){let{modulusLength:r}=t.algorithm;if(typeof r!=\"number\"||r<2048)throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function oq(e,t,r){let n=e.algorithm;if(n.name!==t.name)throw Ib(t.name);if(t.hash&&n.hash?.name!==t.hash)throw Ib(t.hash,\"algorithm.hash\");if(t.namedCurve&&n.namedCurve!==t.namedCurve)throw Ib(t.namedCurve,\"algorithm.namedCurve\");if(t.length!==void 0&&n.length!==t.length)throw Ib(t.length,\"algorithm.length\");Xue(e,r)}function efe(e,t,...r){if(r.length>2){let n=r.pop();e+=`one of type ${r.join(\", \")}, or ${n}.`}else r.length===2?e+=`one of type ${r[0]} or ${r[1]}.`:e+=`of type ${r[0]}.`;return t==null?e+=` Received ${t}`:typeof t==\"function\"&&t.name?e+=` Received function ${t.name}`:typeof t==\"object\"&&t!=null&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var bh=(e,t,...r)=>efe(`Key for the ${e} algorithm must be `,t,...r);var Hr=class extends Error{static code=\"ERR_JOSE_GENERIC\";code=\"ERR_JOSE_GENERIC\";constructor(t,r){super(t,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},Ka=class extends Hr{static code=\"ERR_JWT_CLAIM_VALIDATION_FAILED\";code=\"ERR_JWT_CLAIM_VALIDATION_FAILED\";claim;reason;payload;constructor(t,r,n=\"unspecified\",o=\"unspecified\"){super(t,{cause:{claim:n,reason:o,payload:r}}),this.claim=n,this.reason=o,this.payload=r}},Eh=class extends Hr{static code=\"ERR_JWT_EXPIRED\";code=\"ERR_JWT_EXPIRED\";claim;reason;payload;constructor(t,r,n=\"unspecified\",o=\"unspecified\"){super(t,{cause:{claim:n,reason:o,payload:r}}),this.claim=n,this.reason=o,this.payload=r}},wb=class extends Hr{static code=\"ERR_JOSE_ALG_NOT_ALLOWED\";code=\"ERR_JOSE_ALG_NOT_ALLOWED\"},as=class extends Hr{static code=\"ERR_JOSE_NOT_SUPPORTED\";code=\"ERR_JOSE_NOT_SUPPORTED\"};var wn=class extends Hr{static code=\"ERR_JWS_INVALID\";code=\"ERR_JWS_INVALID\"},Xl=class extends Hr{static code=\"ERR_JWT_INVALID\";code=\"ERR_JWT_INVALID\"};var Ih=class extends Hr{static code=\"ERR_JWKS_INVALID\";code=\"ERR_JWKS_INVALID\"},ep=class extends Hr{static code=\"ERR_JWKS_NO_MATCHING_KEY\";code=\"ERR_JWKS_NO_MATCHING_KEY\";constructor(t=\"no applicable key found in the JSON Web Key Set\",r){super(t,r)}},Ab=class extends Hr{[Symbol.asyncIterator]=async function*(){};static code=\"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";code=\"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";constructor(t=\"multiple matching keys found in the JSON Web Key Set\",r){super(t,r)}},Cb=class extends Hr{static code=\"ERR_JWKS_TIMEOUT\";code=\"ERR_JWKS_TIMEOUT\";constructor(t=\"request timed out\",r){super(t,r)}},Tb=class extends Hr{static code=\"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";code=\"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";constructor(t=\"signature verification failed\",r){super(t,r)}};var Xk=e=>{if(e?.[Symbol.toStringTag]===\"CryptoKey\")return!0;try{return e instanceof CryptoKey}catch{return!1}},tfe=e=>e?.[Symbol.toStringTag]===\"KeyObject\",sq=e=>Xk(e)||tfe(e);function aq(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}var eO=\"The input to be decoded is not correctly encoded.\";function wh(e){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof e==\"string\"?e:Sh.decode(e),{alphabet:\"base64url\"})}catch(r){throw new TypeError(eO,{cause:r})}let t=e;if(t instanceof Uint8Array&&(t=Sh.decode(t)),t.includes(\"+\")||t.includes(\"/\"))throw new TypeError(eO);t=t.replace(/-/g,\"+\").replace(/_/g,\"/\");try{return aq(t)}catch{throw new TypeError(eO)}}function Yi(e){if(typeof e!=\"object\"||e===null||Object.prototype.toString.call(e)!==\"[object Object]\")return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function vb(e){return Yi(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(Yi)}function tO(e,t,r){try{return wh(e)}catch{throw new r(`Failed to base64url decode the ${t}`)}}function iq(e,t,r){try{return Ql(e)}catch{throw new r(`The ${t} is not a valid base64url string`)}}function kb(e,t,r){let n;try{n=JSON.parse(Eb.decode(wh(e)))}catch{throw new t(r)}if(!Yi(n))throw new t(r);return n}async function Ob(e,t){if(t.kty===\"RSA\"&&\"oth\"in t&&t.oth!==void 0)throw new as('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');if(!e.kty.includes(t.kty))throw new as('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,n=!!(t.d||t.priv),o={...t};return o.kty!==\"AKP\"&&delete o.alg,delete o.use,crypto.subtle.importKey(\"jwk\",o,r,t.ext??!n,t.key_ops??e.usages[n?1:0])}function rO(e){return{__proto__:null,...e}}function cq(e){let t=rO(e);if(t.ext!==void 0&&typeof t.ext!=\"boolean\")throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');if(t.key_ops!==void 0){let r=t.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some(o=>typeof o!=\"string\")||new Set(n).size!==n.length)throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');t.key_ops=n}return t}var nO=e=>e[Symbol.toStringTag],rfe=(e,t,r)=>{let{alg:n}=e;if(t.use!==void 0){let o=r===\"sign\"||r===\"verify\"?\"sig\":\"enc\";if(t.use!==o)throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${o}\" when present`)}if(t.alg!==void 0&&t.alg!==n)throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${n}\" when present`);if(Array.isArray(t.key_ops)){let o=r===\"encrypt\"||r===\"decrypt\"?e.ops?.[r===\"encrypt\"?0:1]:r;if(o&&!t.key_ops.includes(o))throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${o}\" when present`)}};function nfe(e,t,r){let{alg:n,secret:o}=e,s=r===\"decrypt\"||r===\"sign\";if(o&&t instanceof Uint8Array)return[fq,t];if(Yi(t)){let a=cq(t);if(typeof a.kty!=\"string\")throw new TypeError(o?bh(n,t,\"CryptoKey\",\"KeyObject\",\"JSON Web Key\",\"Uint8Array\"):bh(n,t,\"CryptoKey\",\"KeyObject\",\"JSON Web Key\"));if(!(o?a.kty===\"oct\"&&typeof a.k==\"string\":a.kty!==\"oct\"&&(s?a.kty===\"AKP\"&&typeof a.priv==\"string\"||typeof a.d==\"string\":a.d===void 0&&a.priv===void 0)))throw new TypeError(o?'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present':`JSON Web Key for this operation must be a ${s?\"private\":\"public\"} JWK`);return rfe(e,a,r),[dq,t,a]}if(!sq(t))throw new TypeError(o?bh(n,t,\"CryptoKey\",\"KeyObject\",\"JSON Web Key\",\"Uint8Array\"):bh(n,t,\"CryptoKey\",\"KeyObject\",\"JSON Web Key\"));if(o){if(t.type!==\"secret\")throw new TypeError(`${nO(t)} instances for symmetric algorithms must be of type \"secret\"`)}else{if(t.type===\"secret\")throw new TypeError(`${nO(t)} instances for asymmetric algorithms must not be of type \"secret\"`);let a=s?\"private\":\"public\";if((t.type===\"public\"||t.type===\"private\")&&t.type!==a){let i=r===\"sign\"?\"signing\":r===\"verify\"?\"verifying\":`${r.slice(0,-1)}tion`;throw new TypeError(`${nO(t)} instances for asymmetric algorithm ${i} must be of type \"${a}\"`)}}return Xk(t)?[lq,t]:[pq,t]}var fq=0,lq=1,pq=2,dq=3,oO,ofe={__proto__:null,prime256v1:\"P-256\",secp384r1:\"P-384\",secp521r1:\"P-521\"};function _b(e,t,r){oO||=new WeakMap;let n=oO.get(e);return r&&(n?n[t]=r:oO.set(e,{[t]:r})),r??n?.[t]}var uq=async(e,t,r)=>_b(e,r.alg)??_b(e,r.alg,await Ob(r,{...t,alg:r.alg})),sfe=(e,t)=>{let r=_b(e,t.alg);if(r)return r;let n=e.type===\"public\",o=t.usages[n?0:1],{asymmetricKeyType:s}=e,a=ofe[e.asymmetricKeyDetails?.namedCurve],i=t.resolve?.({crv:a,asymmetricKeyType:s})??t.subtle;return _b(e,t.alg,e.toCryptoKey(i,n,o))};async function mq(e,t,r){let n=nfe(e,t,r);switch(n[0]){case fq:case lq:return n[1];case dq:{let o=n[1],s=n[2];if(s.kty===\"oct\")return wh(s.k);if(!Object.isFrozen(o)){let{key_ops:a}=o;Array.isArray(a)&&Object.freeze(a),Object.freeze(o)}return uq(o,s,e)}case pq:{let o=n[1];return o.type===\"secret\"?o.export():\"toCryptoKey\"in o&&typeof o.toCryptoKey==\"function\"?sfe(o,e):uq(o,o.export({format:\"jwk\"}),e)}}}function hq(e){let t={__proto__:null};for(let r in e)t[r]={...e[r],alg:r};return t}var xq={__proto__:null,b64:!0};function gq(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some(r=>typeof r!=\"string\")))throw new TypeError(`\"${e}\" option must be an array of strings`);if(t)return new Set(t)}function yq(e,t,r,n,o){if(o.crit!==void 0&&n?.crit===void 0)throw new e('\"crit\" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(a=>typeof a!=\"string\"||a.length===0))throw new e('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s=r===void 0?t:{__proto__:null,...r,...t};for(let a of n.crit){if(!(a in s))throw new as(`Extension Header Parameter \"${a}\" is not recognized`);if(!Object.hasOwn(o,a)||o[a]===void 0)throw new e(`Extension Header Parameter \"${a}\" is missing`);if(s[a]&&(!Object.hasOwn(n,a)||n[a]===void 0))throw new e(`Extension Header Parameter \"${a}\" MUST be integrity protected`)}return n.crit}function Sq(e,t){if(t.includes(\"b64\")){let r=e.b64;if(typeof r!=\"boolean\")throw new wn('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}async function afe(e,t,r){return t instanceof Uint8Array?crypto.subtle.importKey(\"raw\",t,e.subtle,!1,[r]):(oq(t,e.subtle,r),e.minRsaBits&&nq(e.alg,t),t)}async function bq(e,t,r,n){let o=await afe(e,t,\"verify\");try{return await crypto.subtle.verify(e.signing,o,r,n)}catch{return!1}}var Ah=[[\"verify\"],[\"sign\"]];function sO(e){let t={name:\"HMAC\",hash:`SHA-${e}`};return{kty:[\"oct\"],secret:!0,subtle:t,signing:t,usages:Ah}}function tp(e,t){let n={name:t?\"RSA-PSS\":\"RSASSA-PKCS1-v1_5\",hash:`SHA-${e}`};return{kty:[\"RSA\"],subtle:n,signing:t?{...n,saltLength:t}:n,usages:Ah,minRsaBits:2048}}function aO(e,t){return{kty:[\"EC\"],crv:e,subtle:{name:\"ECDSA\",namedCurve:e},signing:{name:\"ECDSA\",hash:`SHA-${t}`},usages:Ah}}function Eq(){let e={name:\"Ed25519\"};return{kty:[\"OKP\"],crv:\"Ed25519\",subtle:e,signing:e,usages:Ah}}function iO(e){let r={name:`ML-DSA-${e}`};return{kty:[\"AKP\"],subtle:r,signing:r,usages:Ah}}var cO=hq({HS256:sO(256),HS384:sO(384),HS512:sO(512),RS256:tp(256),RS384:tp(384),RS512:tp(512),PS256:tp(256,32),PS384:tp(384,48),PS512:tp(512,64),ES256:aO(\"P-256\",256),ES384:aO(\"P-384\",384),ES512:aO(\"P-521\",512),EdDSA:Eq(),Ed25519:Eq(),\"ML-DSA-44\":iO(44),\"ML-DSA-65\":iO(65),\"ML-DSA-87\":iO(87)});function Iq(e){let t=typeof e==\"string\"?cO[e]:void 0;if(!t)throw new as(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}function wq(e){return[e&&gq(\"algorithms\",e.algorithms),e?.crit]}function ife(e,t=e===void 0?{}:kb(e,wn,\"JWS Protected Header is invalid\")){return t}function cfe(e,t,r){let n=Sq(e,yq(wn,xq,r[1],e,t)),o=t.alg;if(typeof o!=\"string\"||!o)throw new wn('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');if(r[0]&&!r[0].has(o))throw new wb('\"alg\" (Algorithm) Header Parameter value not allowed');return[n,o]}function ufe(e){try{return Ql(e)}catch{throw new wn(\"JWS Compact Serialization payload must use only ASCII characters\")}}async function ffe(e,t,r,n,o,s,a){let i=!1;typeof r==\"function\"&&(r=await r(o,e),i=!0);let c=typeof a==\"string\",u=Iq(s),f=rq(n!==void 0?Ql(n):new Uint8Array,Ql(\".\"),c?t[2]??=iq(a,\"payload\",wn):a),p=tO(e.signature,\"signature\",wn),d=await mq(u,r,\"verify\");if(!await bq(u,d,p,f))throw new Tb;return[c?tO(a,\"payload\",wn):a,o,c,d,i]}async function Aq(e,t,r){if(e instanceof Uint8Array&&(e=Sh.decode(e)),typeof e!=\"string\")throw new wn(\"Compact JWS must be a string or Uint8Array\");let{0:n,1:o,2:s,length:a}=e.split(\".\");if(a!==3)throw new wn(\"Invalid Compact JWS\");let i={payload:o,protected:n,signature:s},c=ife(n),[u,f]=cfe(c,c,t),p=u?o:ufe(o);return ffe(i,t,r,n,c,f,p)}var lfe=e=>Math.floor(e.getTime()/1e3),pfe={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},dfe=/^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,rp=\"check_failed\";function uO(){throw new TypeError(\"Invalid time period format\")}function Cq(e){typeof e!=\"string\"&&uO();let t=dfe.exec(e);(!t||t[4]&&t[1])&&uO();let r=parseFloat(t[2]),n=Math.round(r*pfe[t[3][0].toLowerCase()]);return Number.isFinite(n)||uO(),t[1]===\"-\"||t[4]===\"ago\"?-n:n}function fO(e,t){if(!Number.isFinite(t))throw new TypeError(`Invalid ${e} input`);return t}var Tq=e=>{let t=e.toLowerCase();return e.includes(\"/\")?t:`application/${t}`},mfe=(e,t)=>typeof e==\"string\"?t.includes(e):Array.isArray(e)?t.some(r=>e.includes(r)):!1;function lO(e,t,r=!1){let n=e[t];if(!(n===void 0&&!r)){if(typeof n!=\"number\")throw new Ka(`\"${t}\" claim must be a number`,e,t,\"invalid\");return n}}function pO(e,t){throw new Ka(`unexpected \"${t}\" claim value`,e,t,rp)}function vq(e,t,r={}){let n;try{n=JSON.parse(Eb.decode(t))}catch{}if(!Yi(n))throw new Xl(\"JWT Claims Set must be a top-level JSON object\");let{typ:o}=r;if(o!==void 0&&(typeof e.typ!=\"string\"||Tq(e.typ)!==Tq(o)))throw new Ka('unexpected \"typ\" JWT header value',n,\"typ\",rp);let{requiredClaims:s=[],issuer:a,subject:i,audience:c,maxTokenAge:u}=r,f=[...s];u!==void 0&&f.push(\"iat\"),c!==void 0&&f.push(\"aud\"),i!==void 0&&f.push(\"sub\"),a!==void 0&&f.push(\"iss\");for(let x of new Set(f.reverse()))if(!Object.hasOwn(n,x))throw new Ka(`missing required \"${x}\" claim`,n,x,\"missing\");a!==void 0&&!(Array.isArray(a)?a:[a]).includes(n.iss)&&pO(n,\"iss\"),i!==void 0&&n.sub!==i&&pO(n,\"sub\"),c!==void 0&&!mfe(n.aud,typeof c==\"string\"?[c]:c)&&pO(n,\"aud\");let{clockTolerance:p}=r,d=0;if(typeof p==\"string\")d=Cq(p);else if(p!==void 0){if(typeof p!=\"number\")throw new TypeError(\"Invalid clockTolerance option type\");d=p}fO(\"clockTolerance option\",d);let{currentDate:m}=r,h=fO(\"currentDate option\",lfe(m===void 0?new Date:m)),y=lO(n,\"iat\",u!==void 0),S=lO(n,\"nbf\");if(S!==void 0&&S>h+d)throw new Ka('\"nbf\" claim timestamp check failed',n,\"nbf\",rp);let b=lO(n,\"exp\");if(b!==void 0&&b<=h-d)throw new Eh('\"exp\" claim timestamp check failed',n,\"exp\",rp);if(u!==void 0){let x=h-y,w=fO(\"maxTokenAge option\",typeof u==\"number\"?u:Cq(u));if(x-d>w)throw new Eh('\"iat\" claim timestamp check failed (too far in the past)',n,\"iat\",rp);if(x<-d)throw new Ka('\"iat\" claim timestamp check failed (it should be in the past)',n,\"iat\",rp)}return n}async function Rb(e,t,r){let n=await Aq(e,wq(r),t);if(!n[2])throw new Xl(\"JWTs MUST NOT use unencoded payload\");let s={payload:vq(n[1],n[0],r),protectedHeader:n[1]};return typeof t==\"function\"?{...s,key:n[3]}:s}function hfe(e,t,r,n){let{kty:o,key_ops:s,ext:a,kid:i,alg:c,use:u,crv:f}=rO(e),p=Array.isArray(s)?[...s]:s;return(a===void 0||typeof a==\"boolean\")&&(p===void 0||Array.isArray(p)&&p.every((d,m)=>typeof d==\"string\"&&p.indexOf(d)===m)&&p.includes(\"verify\"))&&t.kty.includes(o)&&(n===void 0||typeof n==\"string\"&&n===i)&&(c===void 0?o!==\"AKP\":r===c)&&(u===void 0||u===\"sig\")&&(!t.crv||f===t.crv)}async function kq(e,t,r){let n=e.get(t)||e.set(t,{}).get(t),{alg:o}=r;if(n[o]===void 0){let s=await Ob(r,{...t,alg:o,ext:!0});if(s.type!==\"public\")throw new Ih(\"JSON Web Key Set members must be public keys\");n[o]=s}return n[o]}function Ku(e){let t;try{t=structuredClone(e)}catch{}if(!vb(t))throw new Ih(\"JSON Web Key Set malformed\");let r=new WeakMap;return Object.defineProperty(async(o,s)=>{let{alg:a,kid:i}={...o,...s?.header},c=typeof a==\"string\"?cO[a]:void 0;if(!c||c.secret)throw new as('Unsupported \"alg\" value for a JSON Web Key Set');let u=t.keys.filter(d=>hfe(d,c,a,i)),{0:f,length:p}=u;if(!p)throw new ep;if(p!==1){let d=new Ab;throw d[Symbol.asyncIterator]=async function*(){for(let m of u)try{yield await kq(r,m,c)}catch{}},d}return kq(r,f,c)},\"jwks\",{value:()=>structuredClone(t)})}function xfe(){return typeof WebSocketPair<\"u\"||typeof navigator<\"u\"&&navigator.userAgent===\"Cloudflare-Workers\"||typeof EdgeRuntime<\"u\"&&EdgeRuntime===\"vercel\"}var dO;(typeof navigator>\"u\"||!navigator.userAgent?.startsWith?.(\"Mozilla/5.0 \"))&&(dO=\"jose/v6.2.10\");var _q=Symbol();async function gfe(e,t,r,n=fetch){let o=await n(e,{method:\"GET\",signal:r,redirect:\"manual\",headers:t}).catch(s=>{throw s.name===\"TimeoutError\"?new Cb:s});if(o.status!==200)throw new Hr(\"Expected 200 OK from the JSON Web Key Set HTTP response\");try{return await o.json()}catch{throw new Hr(\"Failed to parse the JSON Web Key Set HTTP response as JSON\")}}var Rq=Symbol();function Ch(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Oq(e,t,r){if(Number.isNaN(e))throw new TypeError(`\"${r}\" option must not be NaN`);return typeof e==\"number\"?e:t}function mO(e,t){if(!(e instanceof URL))throw new TypeError(\"url must be an instance of URL\");let r=new URL(e.href).href,n=t??{},o=n.timeoutDuration;if(typeof o==\"number\"&&(!Number.isInteger(o)||o<0))throw new TypeError('\"timeoutDuration\" option must be a non-negative integer');let s=typeof o==\"number\"?o:5e3,a=Oq(n.cooldownDuration,3e4,\"cooldownDuration\"),i=Oq(n.cacheMaxAge,6e5,\"cacheMaxAge\"),c=new Headers(n.headers);dO&&!c.has(\"User-Agent\")&&c.set(\"User-Agent\",dO),c.has(\"accept\")||c.set(\"accept\",\"application/json, application/jwk-set+json\");let u=n[_q],f=n[Rq],p,d,m=0,h=0,y;if(f&&typeof f==\"object\"){let{uat:x,jwks:w}=f;Ch(x,i)&&vb(w)&&(p=x,y=Ku(w))}let S=async()=>{if(d&&xfe()&&(d=void 0),!d){let x=++m,w=d=gfe(r,c,AbortSignal.timeout(s),u).then(I=>{let T=Ku(I);if(x<=h)return;y=T;let P=Date.now();f&&(f.uat=P,f.jwks=I),p=P,h=x}).finally(()=>{d===w&&(d=void 0)})}await d};return Object.defineProperties(async(x,w)=>{(!y||!Ch(p,i))&&await S();try{return await y(x,w)}catch(I){if(I instanceof ep&&!Ch(p,a))return await S(),y(x,w);throw I}},{coolingDown:{get:()=>Ch(p,a),enumerable:!0},fresh:{get:()=>Ch(p,i),enumerable:!0},reload:{value:S,enumerable:!0},reloading:{get:()=>!!d,enumerable:!0},jwks:{value:()=>y?.jwks(),enumerable:!0}})}function hO(e){let t;if(typeof e==\"string\"){let n=e.split(\".\");(n.length===3||n.length===5)&&([t]=n)}else if(typeof e==\"object\"&&e)if(\"protected\"in e)t=e.protected;else throw new TypeError(\"Token does not contain a Protected Header\");let r=\"Invalid Token or Protected Header formatting\";if(typeof t!=\"string\"||!t)throw new TypeError(r);return kb(t,TypeError,r)}var Sfe=new Set([\"HOME\",\"HOSTNAME\",\"PATH\",\"PWD\"]),Io=$.runSync($.gen(function*(){let e=t=>t.pipe(nn.option);return{hostPort:yield*e(nn.String(\"SUPABASE_INTERNAL_HOST_PORT\")),functionsRoot:yield*e(nn.String(\"SUPABASE_INTERNAL_FUNCTIONS_ROOT\")),filesRoot:yield*e(nn.String(\"SUPABASE_INTERNAL_FUNCTIONS_FILES_ROOT\")),jwtSecret:yield*e(nn.String(\"SUPABASE_INTERNAL_JWT_SECRET\")),supabaseUrl:yield*e(nn.String(\"SUPABASE_URL\")),wallclock:yield*e(nn.String(\"SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC\")),publishableKey:yield*e(nn.String(\"SUPABASE_INTERNAL_PUBLISHABLE_KEY\")),secretKey:yield*e(nn.String(\"SUPABASE_INTERNAL_SECRET_KEY\")),functionsConfig:yield*e(nn.String(\"SUPABASE_INTERNAL_FUNCTIONS_CONFIG\")),debug:yield*e(nn.String(\"SUPABASE_INTERNAL_DEBUG\")),jwks:yield*e(nn.String(\"SUPABASE_JWKS\"))}}).pipe($.provideService(Gl.ConfigProvider,Gl.fromEnvRecord(Deno.env.toObject(),{preserveEmptyStrings:!0})))),sp=(e,t=\"\")=>ye.getOrElse(e,()=>t),Pq=sp(Io.hostPort,\"8081\"),Lq=sp(Io.functionsRoot),bfe=sp(Io.jwtSecret),Efe=sp(Io.supabaseUrl,\"http://127.0.0.1:54321\"),Ife=new URL(\"/auth/v1/.well-known/jwks.json\",Efe),Mq=Number.parseInt(sp(Io.wallclock,\"400\"),10),Fq=ye.getOrUndefined(Io.publishableKey),Nq=ye.getOrUndefined(Io.secretKey),Ba={BootError:In.ServiceUnavailable,InvalidWorkerResponse:In.InternalServerError,WorkerLimit:546},wfe={[Ba.BootError]:\"BOOT_ERROR\",[Ba.InvalidWorkerResponse]:\"WORKER_ERROR\",[Ba.WorkerLimit]:\"WORKER_LIMIT\"},Afe={[Ba.BootError]:\"Worker failed to boot (please check logs)\",[Ba.InvalidWorkerResponse]:\"Function exited due to an error (please check logs)\",[Ba.WorkerLimit]:\"Worker failed to respond due to a resource limit (please check logs)\"},Cfe=new Map([[Deno.errors.InvalidWorkerCreation,Ba.BootError],[Deno.errors.InvalidWorkerResponse,Ba.InvalidWorkerResponse],[Deno.errors.WorkerRequestCancelled,Ba.WorkerLimit]]),Tfe=e=>{let t=Deno.errors.WorkerAlreadyRetired;return t!==void 0&&e instanceof t},vfe=(s=>(s.MissingAuthHeader=\"UNAUTHORIZED_NO_AUTH_HEADER\",s.InvalidLegacyJWT=\"UNAUTHORIZED_JWT\",s.InvalidAsymmetricJWT=\"UNAUTHORIZED_ASYMMETRIC_JWT\",s.InvalidTokenFormat=\"UNAUTHORIZED_INVALID_JWT_FORMAT\",s.UnsupportedTokenAlgorithm=\"UNAUTHORIZED_UNSUPPORTED_TOKEN_ALGORITHM\",s))(vfe||{}),kfe=Ie.Struct({enabled:Ie.optionalKey(Ie.Boolean),verifyJWT:Ie.optionalKey(Ie.Boolean),verify_jwt:Ie.optionalKey(Ie.Boolean),entrypointPath:Ie.optionalKey(Ie.String),entrypoint:Ie.optionalKey(Ie.String),importMapPath:Ie.optionalKey(Ie.String),import_map:Ie.optionalKey(Ie.String),importMapRoot:Ie.optionalKey(Ie.String),import_map_root:Ie.optionalKey(Ie.String),staticFiles:Ie.optionalKey(Ie.Array(Ie.String)),static_files:Ie.optionalKey(Ie.Array(Ie.String)),env:Ie.optionalKey(Ie.Record(Ie.String,Ie.String))}),Ofe=Ie.Record(Ie.String,kfe),_fe=Ie.declare(e=>typeof e==\"object\"&&e!==null&&\"keys\"in e&&Array.isArray(e.keys)&&e.keys.every(t=>typeof t==\"object\"&&t!==null)),Rfe=()=>ye.match(Io.functionsConfig,{onNone:()=>({}),onSome:e=>$.runSync(Ie.decodeEffect(Ie.fromJsonString(Ofe))(e).pipe($.orElseSucceed(()=>({}))))}),xO=Rfe();if(ye.getOrUndefined(Io.debug)===\"true\"){let e=Object.fromEntries(Object.entries(xO).map(([t,r])=>[t,Object.fromEntries(Object.entries(r).filter(([n])=>n!==\"env\"))]));$.runSync(Lu.log(\"Functions config:\",JSON.stringify(e,null,2)))}var Bu=(e,t,r={})=>{let n={...r},o=null;return e!=null&&(typeof e==\"object\"?(n[\"Content-Type\"]=\"application/json\",o=JSON.stringify(e)):(n[\"Content-Type\"]=\"text/plain\",o=typeof e==\"string\"?e:JSON.stringify(e)??null)),new Response(o,{status:t,headers:n})},np={\"Access-Control-Allow-Origin\":\"*\",\"Access-Control-Allow-Headers\":\"authorization, x-client-info, apikey\",\"Access-Control-Expose-Headers\":\"sb-error-code\"},Uq=({code:e,message:t=\"Invalid JWT\"})=>Bu({code:e,message:t,msg:t},In.Unauthorized,{...np,\"sb-error-code\":e}),Pfe=e=>{for(let[t,r]of Cfe.entries())if(t!==void 0&&e instanceof t)return Bu({code:wfe[r],message:Afe[r]},r,np);return Bu({code:Zk[In.InternalServerError],message:\"Request failed due to an internal server error\"},In.InternalServerError,np)};function Mfe(e){let t=e.split(\" \");return t.length===2&&t[0]===\"Bearer\"?t[1]:null}var Ffe=e=>{let t=e.headers.get(\"authorization\"),r=e.headers.get(\"sb-api-key\")?.replace(\"Bearer\",\"\").trim();if(!t&&!r)return{code:\"UNAUTHORIZED_NO_AUTH_HEADER\",message:\"Missing authorization header\"};let n=Mfe(t??\"\"),o=!n||n.startsWith(\"sb_\")?r:n;return o||{code:\"UNAUTHORIZED_INVALID_JWT_FORMAT\",message:\"Invalid JWT format\"}},op=class extends an.TaggedError(\"BootstrapOperationError\"){},Nfe=$.runSync(ye.match(Io.jwks,{onNone:()=>$.succeed(ye.some(Ku({keys:[]}))),onSome:e=>$.gen(function*(){let t=yield*Ie.decodeEffect(Ie.fromJsonString(_fe))(e);return yield*$.try({try:()=>Ku(t),catch:r=>new op({cause:r})})}).pipe($.option)})),Ufe=ye.getOrElse(Nfe,()=>mO(Ife)),Qi=e=>$.tryPromise({try:e,catch:t=>new op({cause:t})}),Dfe=e=>$.gen(function*(){return yield*Qi(()=>Rb(e,Ufe)),ye.none()}).pipe($.orElseSucceed(()=>ye.some({code:\"UNAUTHORIZED_ASYMMETRIC_JWT\"})));function Lfe(e,t){return $.gen(function*(){let r=yield*$.try({try:()=>hO(t).alg,catch:n=>new op({cause:n})});return r?r===\"HS256\"?yield*Qi(()=>Rb(t,new TextEncoder().encode(e))).pipe($.as(ye.none()),$.orElseSucceed(()=>ye.some({code:\"UNAUTHORIZED_JWT\"}))):r===\"ES256\"||r===\"RS256\"?yield*Dfe(t):ye.some({code:\"UNAUTHORIZED_UNSUPPORTED_TOKEN_ALGORITHM\",message:`Unsupported JWT algorithm ${r}`}):ye.some({code:\"UNAUTHORIZED_INVALID_JWT_FORMAT\",message:\"Invalid JWT format\"})}).pipe($.orElseSucceed(()=>ye.some({code:\"UNAUTHORIZED_INVALID_JWT_FORMAT\",message:\"Invalid JWT format\"})))}var $q={lstat:e=>Qi(()=>Deno.lstat(e)).pipe($.mapError(t=>new Yl({cause:t})),$.map(t=>({isDirectory:t.isDirectory,isFile:t.isFile,isSymbolicLink:t.isSymlink}))),realPath:e=>Qi(()=>Deno.realPath(e)).pipe($.mapError(t=>new Yl({cause:t}))),readDirectory:e=>Hs.suspend(()=>Hs.fromAsyncIterable(Deno.readDir(e),t=>new op({cause:t})).pipe(Hs.map(t=>t.name))).pipe(Hs.runCollect,$.mapError(t=>new Yl({cause:t})))},$fe=e=>XW({root:Lq,filesRoot:ye.getOrUndefined(Io.filesRoot),slug:e,overrides:xO,fs:$q}),Dq=new Set,Kfe=(e,t)=>t.importMapDiscoveredByRuntime||!QW(t.importMapPath)||Dq.has(e)?$.void:$.sync(()=>Dq.add(e)).pipe($.andThen(Lu.warn(`[functions] ${e}: ${t.importMapPath} is not the nearest Deno config of ${t.entrypointPath}, so Edge Runtime loads it as a plain import map without comments or jsr:/npm: subpath imports. Move it next to the entrypoint or into a parent directory without a closer deno.json(c).`))),Bfe=eq(()=>Deno.makeTempDirSync({prefix:\"supabase-worker-\"})),jfe=e=>e.importMapPath?$.succeed(!1):tq({root:sp(Io.filesRoot,Lq),config:e,fs:$q}),Kq=e=>Hs.fromEffectRepeat(Qi(()=>e.read()).pipe($.flatMap(t=>t.done?er.done():$.succeed(t.value)))),Hfe=e=>e===void 0?$.void:Hs.runDrain(Kq(e)).pipe($.ignore);function zfe(e,t){let r=new URL(e.url),n=e.headers.get(\"x-forwarded-host\");n&&(r.hostname=n);let o=new Request(r.href,{method:e.method,headers:e.headers,body:t===void 0?null:Hs.toReadableStream(Kq(t)),signal:e.signal,duplex:\"half\"});return o.headers.delete(\"sb-api-key\"),EdgeRuntime.applySupabaseTag(e,o),o}Deno.serve({handler:e=>$.runPromiseExit($.gen(function*(){let t=yield*$.acquireRelease($.sync(()=>e.body?.getReader()),u=>$.interruptible(Hfe(u))),{pathname:r}=new URL(e.url);if(r===\"/_internal/health\")return Bu({message:\"ok\"},In.OK);if(r===\"/_internal/metric\")return Response.json(yield*Qi(()=>EdgeRuntime.getRuntimeMetrics()));let n=r.split(\"/\")[1];if(!n)return Bu(\"Function not found\",In.NotFound,np);let o=yield*$fe(n);if(!o)return Bu(\"Function not found\",In.NotFound,np);if(yield*Kfe(n,o),e.method!==\"OPTIONS\"&&o.verifyJWT){let u=Ffe(e);if(typeof u!=\"string\")return Uq(u);let f=yield*Lfe(bfe,u);if(ye.isSome(f))return Uq(f.value)}let s={...Deno.env.toObject(),...Object.fromEntries(Object.entries(o.env??{}).filter(([u])=>!u.startsWith(\"SUPABASE_\"))),SUPABASE_FUNCTION_SLUG:n};Fq&&(s.SUPABASE_PUBLISHABLE_KEYS=yield*Ie.encodeEffect(Ie.fromJsonString(Ie.Unknown))({default:Fq})),Nq&&(s.SUPABASE_SECRET_KEYS=yield*Ie.encodeEffect(Ie.fromJsonString(Ie.Unknown))({default:Nq}));let a=Object.entries(s).filter(([u])=>!Sfe.has(u)&&!u.startsWith(\"SUPABASE_INTERNAL_\")),i=!(yield*jfe(o));return yield*$.gen(function*(){let u=yield*Qi(()=>EdgeRuntime.userWorkers.create({servicePath:Bfe(n,o),memoryLimitMb:256,workerTimeoutMs:Number.isFinite(Mq)?Mq*1e3:4e5,noModuleCache:!1,noNpm:i,envVars:a,forceCreate:!0,customModuleRoot:\"\",cpuTimeSoftLimitMs:1e3,cpuTimeHardLimitMs:2e3,decoratorType:\"tc39\",maybeEntrypoint:VW(o.entrypointPath).href,context:{useReadSyncFileAPI:!0,...o.importMapPath===\"\"||o.importMapDiscoveredByRuntime?{}:{importMapPath:o.importMapPath}},staticPatterns:o.staticFiles}));return yield*Qi(()=>u.fetch(zfe(e,t)))}).pipe($.retry({times:1,while:({cause:u})=>e.body===null&&Tfe(u)}),$.catchTag(\"BootstrapOperationError\",({cause:u})=>Lu.error(\"[functions] worker error\",u).pipe($.andThen($.succeed(Pfe(u))))))}).pipe($.scoped),{signal:e.signal}).then(t=>{if(Or.isSuccess(t))return t.value;if(e.signal.aborted&&er.hasInterruptsOnly(t.cause))return new Response(null,{status:499});throw er.squash(t.cause)}),onListen:()=>{let t=Object.keys(xO).slice(0,5).map(r=>` - http://127.0.0.1:${Pq}/functions/v1/${r}`);$.runSync(Lu.log(`Serving functions on http://127.0.0.1:${Pq}/functions/v1/<function-name>${t.length?`\n${t.join(`\n`)}`:\"\"}\nUsing ${Deno.version.deno}`))},onError:()=>Bu({code:Zk[500],message:\"Request failed due to an internal server error\"},500,np)});export{vfe as RequestErrors,Mfe as extractBearerToken,zfe as prepareUserRequest};\n";
diff --git a/packages/stack/src/functions/serve-main-bundler.integration.test.ts b/packages/stack/src/functions/serve-main-bundler.integration.test.ts
index 5aac0dd30d..ed163e43cf 100644
--- a/packages/stack/src/functions/serve-main-bundler.integration.test.ts
+++ b/packages/stack/src/functions/serve-main-bundler.integration.test.ts
@@ -8,6 +8,7 @@ import { defaultFunctionsBootstrap } from "./generated/serve-main-bundle.ts";
 type ServeOptions = {
   readonly handler: (request: Request) => Promise<Response>;
   readonly onListen: () => void;
+  readonly onError: (error: unknown) => Response;
 };
 
 class MissingFixture extends Data.TaggedError("MissingFixture") {}
@@ -263,6 +264,8 @@ describe("stack-owned functions bootstrap", () => {
       );
       const invalidSignature = yield* invoke(wrongToken);
       expect(invalidSignature.status).toBe(401);
+      expect(invalidSignature.headers.get("access-control-allow-origin")).toBe("*");
+      expect(invalidSignature.headers.get("access-control-expose-headers")).toBe("sb-error-code");
       expect(yield* Effect.tryPromise(() => invalidSignature.json())).toMatchObject({
         code: "UNAUTHORIZED_JWT",
       });
@@ -356,6 +359,10 @@ describe("stack-owned functions bootstrap", () => {
         registered.handler(new Request("http://127.0.0.1/missing")),
       );
       expect(missing.status).toBe(404);
+      expect(missing.headers.get("access-control-allow-origin")).toBe("*");
+      const crashed = registered.onError(new Error("boom"));
+      expect(crashed.status).toBe(500);
+      expect(crashed.headers.get("access-control-allow-origin")).toBe("*");
       expect(yield* Effect.tryPromise(() => missing.text())).toBe("Function not found");
     }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
   );
@@ -519,6 +526,7 @@ describe("stack-owned functions bootstrap", () => {
           handler(new Request("http://127.0.0.1/hello")),
         );
         expect(response.status).toBe(500);
+        expect(response.headers.get("access-control-allow-origin")).toBe("*");
         expect(yield* Effect.tryPromise(() => response.json())).toMatchObject({
           code: "WORKER_ERROR",
         });
diff --git a/packages/stack/src/functions/serve-main-resolver.integration.test.ts b/packages/stack/src/functions/serve-main-resolver.integration.test.ts
index 41f4e47798..061b845cb4 100644
--- a/packages/stack/src/functions/serve-main-resolver.integration.test.ts
+++ b/packages/stack/src/functions/serve-main-resolver.integration.test.ts
@@ -174,6 +174,28 @@ describe("Edge Runtime request-time function resolver", () => {
       expect(explicit?.entrypointPath).toBe(path.join(canonicalRoot, "hello", "custom.ts"));
     }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
   );
+  it.live("merges the global default env beneath each function's own env", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const nodeFileSystem = makeNodeFileSystem(fs);
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-functions-resolver-env-" });
+      for (const slug of ["hello", "plain"]) {
+        yield* fs.makeDirectory(path.join(root, slug), { recursive: true });
+        yield* fs.writeFileString(path.join(root, slug, "index.ts"), "export default 1");
+      }
+      const overrides = {
+        $default: { env: { SHARED: "first\nsecond", LOCAL: "global" } },
+        hello: { env: { LOCAL: "function" } },
+      };
+      const env = (slug: string) =>
+        resolveFunctionConfig({ root, slug, overrides, fs: nodeFileSystem }).pipe(
+          Effect.map((config) => config?.env),
+        );
+      expect(yield* env("hello")).toEqual({ SHARED: "first\nsecond", LOCAL: "function" });
+      expect(yield* env("plain")).toEqual({ SHARED: "first\nsecond", LOCAL: "global" });
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
   it.live("accepts an absolute entrypoint inside the functions root without a slug directory", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/packages/stack/src/functions/serve-main-resolver.ts b/packages/stack/src/functions/serve-main-resolver.ts
index 6715be1ead..f6ba56c7e9 100644
--- a/packages/stack/src/functions/serve-main-resolver.ts
+++ b/packages/stack/src/functions/serve-main-resolver.ts
@@ -247,7 +247,7 @@ export const resolveFunctionConfig = Effect.fn("Functions.resolveFunctionConfig"
       importMapDiscoveredByRuntime,
       staticFiles,
       verifyJWT: override.verifyJWT ?? override.verify_jwt ?? true,
-      env: override.env,
+      env: { ...globalDefaults?.env, ...functionOverride?.env },
     };
   },
 );
diff --git a/packages/stack/src/functions/serve.main.ts b/packages/stack/src/functions/serve.main.ts
index a107e35a7d..1082e4c9ad 100644
--- a/packages/stack/src/functions/serve.main.ts
+++ b/packages/stack/src/functions/serve.main.ts
@@ -208,10 +208,17 @@ const getResponse = (
   return new Response(body, { status, headers });
 };
 
+/** Lets browsers read router errors on requests that skip the preflight; preflights still fail. */
+const ERROR_CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Headers": "authorization, x-client-info, apikey",
+  "Access-Control-Expose-Headers": "sb-error-code",
+};
+
 const getAuthErrorResponse = ({ code, message = "Invalid JWT" }: AuthFailure) =>
   getResponse({ code, message, msg: message }, STATUS_CODE.Unauthorized, {
+    ...ERROR_CORS_HEADERS,
     "sb-error-code": code,
-    "Access-Control-Expose-Headers": "sb-error-code",
   });
 
 const getWorkerErrorResponse = (error: unknown) => {
@@ -223,6 +230,7 @@ const getWorkerErrorResponse = (error: unknown) => {
           message: SB_SPECIFIC_ERROR_REASON[sbCode],
         },
         sbCode,
+        ERROR_CORS_HEADERS,
       );
     }
   }
@@ -232,6 +240,7 @@ const getWorkerErrorResponse = (error: unknown) => {
       message: "Request failed due to an internal server error",
     },
     STATUS_CODE.InternalServerError,
+    ERROR_CORS_HEADERS,
   );
 };
 
@@ -423,9 +432,11 @@ Deno.serve({
         if (pathname === "/_internal/metric")
           return Response.json(yield* foreign(() => EdgeRuntime.getRuntimeMetrics()));
         const functionName = pathname.split("/")[1];
-        if (!functionName) return getResponse("Function not found", STATUS_CODE.NotFound);
+        if (!functionName)
+          return getResponse("Function not found", STATUS_CODE.NotFound, ERROR_CORS_HEADERS);
         const config = yield* functionConfig(functionName);
-        if (!config) return getResponse("Function not found", STATUS_CODE.NotFound);
+        if (!config)
+          return getResponse("Function not found", STATUS_CODE.NotFound, ERROR_CORS_HEADERS);
         yield* warnPlainDenoConfig(functionName, config);
         if (request.method !== "OPTIONS" && config.verifyJWT) {
           const token = getAuthToken(request);
@@ -521,5 +532,6 @@ Deno.serve({
         message: "Request failed due to an internal server error",
       },
       500,
+      ERROR_CORS_HEADERS,
     ),
 });
diff --git a/packages/stack/src/host/CommandRunner.initialization.integration.test.ts b/packages/stack/src/host/CommandRunner.initialization.integration.test.ts
index 78ee7ea3c4..f502b6984f 100644
--- a/packages/stack/src/host/CommandRunner.initialization.integration.test.ts
+++ b/packages/stack/src/host/CommandRunner.initialization.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Context, Deferred, Effect, Fiber, FileSystem, Layer, Path, Ref } from "effect";
 import { TestClock } from "effect/testing";
@@ -129,7 +129,11 @@ it.live.skipIf(target === undefined || process.platform === "win32")(
         expect(error.message).toContain(`jwt=${credentials.jwtSecret}`);
         expect(error.message).toContain(`keys=${credentials.gotrueJwtKeys}`);
         expect(error.message.length).toBeLessThan(45_000);
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
 );
 
@@ -172,7 +176,11 @@ it.live.skipIf(target === undefined || process.platform === "win32")(
 
         expect(result.exitCode).toBe(0);
         expect(output.join("")).toContain("selected pin ran");
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
 );
 
@@ -228,7 +236,11 @@ it.live.skipIf(target === undefined || process.platform === "win32")(
         expect((yield* run(newer)).exitCode).toBe(0);
 
         expect(output.join("")).toBe("ran newer\nran newer\n");
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
 );
 
@@ -287,7 +299,11 @@ it.live.skipIf(target === undefined || process.platform === "win32")(
         const jobs = yield* fs.readDirectory(path.join(root, "jobs"));
         expect(childStillRunning).toBe(false);
         expect(jobs).toHaveLength(0);
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
 );
 
@@ -347,6 +363,10 @@ it.effect.skipIf(target === undefined || process.platform === "win32")(
           }
         });
         expect(childStillRunning).toBe(false);
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
 );
diff --git a/packages/stack/src/host/CommandRunner.native-cleanup.integration.test.ts b/packages/stack/src/host/CommandRunner.native-cleanup.integration.test.ts
index 69742ce820..944d31890b 100644
--- a/packages/stack/src/host/CommandRunner.native-cleanup.integration.test.ts
+++ b/packages/stack/src/host/CommandRunner.native-cleanup.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Context, Effect, FileSystem, Layer, Path, Stream } from "effect";
 import { systemError } from "effect/PlatformError";
@@ -84,7 +84,9 @@ it.live.skipIf(target === undefined || process.platform === "win32")(
             const child = yield* delegate.spawn(command);
             if (
               !ChildProcess.isStandardCommand(command) ||
-              !command.args.some((argument) => argument.includes("native-launcher"))
+              !command.args.some(
+                (argument) => typeof argument === "string" && argument.includes("native-launcher"),
+              )
             )
               return child;
             return ChildProcessSpawner.makeHandle({
@@ -142,6 +144,10 @@ it.live.skipIf(target === undefined || process.platform === "win32")(
         expect(isRunningCalls).toBe(3);
         yield* runner.cleanup;
         expect(isRunningCalls).toBe(4);
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
 );
diff --git a/packages/stack/src/host/CommandRunner.ts b/packages/stack/src/host/CommandRunner.ts
index 99cdd36f06..8c70a0b296 100644
--- a/packages/stack/src/host/CommandRunner.ts
+++ b/packages/stack/src/host/CommandRunner.ts
@@ -1,16 +1,5 @@
-import {
-  Context,
-  Crypto,
-  Data,
-  Effect,
-  Exit,
-  FileSystem,
-  Layer,
-  Path,
-  Sink,
-  Stream,
-  Ref,
-} from "effect";
+import { Context, Data, Effect, Exit, FileSystem, Layer, Path, Sink, Stream, Ref } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 // oxlint-disable-next-line effecttsgo/node-builtin-import -- FileSystem has no non-recursive directory removal operation.
 import { rmdir } from "node:fs/promises";
 import { ChildProcessSpawner } from "effect/process";
@@ -82,7 +71,8 @@ const makeCommandRunner = (options: {
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
+    const digest = yield* Digest.Digest;
     const http = yield* HttpClient.HttpClient;
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     if (!isSafeId(options.stackId)) return yield* failure("Invalid stack identity");
@@ -146,7 +136,7 @@ const makeCommandRunner = (options: {
       yield* fs
         .makeDirectory(jobsRoot, { recursive: true, mode: 0o700 })
         .pipe(Effect.mapError(failure));
-      const jobId = yield* crypto.randomUUIDv4.pipe(Effect.mapError(failure));
+      const jobId = yield* crypto.uuidV4();
       return yield* Effect.scoped(
         Effect.gen(function* () {
           const command = input.command;
@@ -202,7 +192,8 @@ const makeCommandRunner = (options: {
               ).pipe(
                 Effect.provideService(FileSystem.FileSystem, fs),
                 Effect.provideService(Path.Path, path),
-                Effect.provideService(Crypto.Crypto, crypto),
+                Effect.provideService(SecureRandom.SecureRandom, crypto),
+                Effect.provideService(Digest.Digest, digest),
                 Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
                 Effect.provideService(HttpClient.HttpClient, http),
               );
diff --git a/packages/stack/src/host/Endpoints.ts b/packages/stack/src/host/Endpoints.ts
index 535ca9ba5d..4778908b84 100644
--- a/packages/stack/src/host/Endpoints.ts
+++ b/packages/stack/src/host/Endpoints.ts
@@ -2,8 +2,11 @@ import { allowedEndpointNames, type ServiceCreation } from "../services/Catalog.
 import type { ServiceEndpoint } from "../services/Recipe.ts";
 import { apiPath as storageApiPath } from "../services/Storage.ts";
 import type { NetworkEndpoint } from "../Network.ts";
+import type { HttpFileRoute, HttpRoute } from "../HttpProxy.ts";
 import type { BackendAddress } from "../Proxy.ts";
+import { readContainedFile } from "../StackNamespace.ts";
 import { Data, Effect, Redacted } from "effect";
+import { timingSafeEqual } from "node:crypto";
 
 export class EndpointError extends Data.TaggedError("EndpointError")<{
   readonly message: string;
@@ -55,7 +58,53 @@ export const apiRoute = (service: string): string | undefined => {
 export const sharesApiEndpoint = (creation: EndpointIntents): boolean =>
   apiRoute(creation.service) !== undefined && endpointNames(creation).includes("http");
 
-type RouteKeys = NonNullable<NonNullable<NetworkEndpoint["shared"]>[number]["keyRewrite"]>["keys"];
+type RouteKeys = NonNullable<HttpRoute["keyRewrite"]>["keys"];
+type RouteFile = HttpFileRoute["file"];
+
+/* Compares in constant time once the lengths agree, so a guess learns nothing from timing. */
+const tokenMatches = (given: string | null, expected: string | undefined) => {
+  if (given === null || expected === undefined) return false;
+  const left = Buffer.from(given);
+  const right = Buffer.from(expected);
+  return left.length === right.length && timingSafeEqual(left, right);
+};
+
+/**
+ * Reads the Auth email template at `/email/<id>?token=<token>` in the live creation, so
+ * a configuration change applies on the next start; anything else is `undefined`.
+ */
+export const emailTemplateFile = (creation: Effect.Effect<ServiceCreation>): RouteFile => {
+  /* The last failure warned per template path, so Auth's reload polling logs it once. */
+  const warned = new Map<string, string>();
+  return (url) =>
+    creation.pipe(
+      Effect.flatMap((current) => {
+        const [pathname, query] = url.split("?", 2);
+        const template =
+          current.service === "auth" &&
+          tokenMatches(new URLSearchParams(query).get("token"), current.config.templateToken)
+            ? current.config.templates?.find(({ id }) => `/email/${id}` === pathname)
+            : undefined;
+        if (template === undefined) return Effect.undefined;
+        return readContainedFile(template.path, template.root).pipe(
+          Effect.tap(() => Effect.sync(() => warned.delete(template.path))),
+          Effect.catch((cause) =>
+            warned.get(template.path) === cause.message
+              ? Effect.undefined
+              : Effect.sync(() => warned.set(template.path, cause.message)).pipe(
+                  Effect.andThen(
+                    Effect.logWarning(
+                      `Auth email template ${template.id} at ${template.path} was not served`,
+                      cause,
+                    ),
+                  ),
+                  Effect.as(undefined),
+                ),
+          ),
+        );
+      }),
+    );
+};
 
 /**
  * Routes a service's HTTP endpoint on the shared API listener, or `undefined` for a dedicated one.
@@ -66,6 +115,7 @@ export const sharedRoutes = (
   name: string,
   keys: RouteKeys,
   backend: (endpoint: string) => NetworkEndpoint["backend"],
+  emailTemplate: RouteFile,
 ): NetworkEndpoint["shared"] => {
   const route = name === "http" ? apiRoute(creation.service) : undefined;
   if (route === undefined) return undefined;
@@ -117,9 +167,17 @@ export const sharedRoutes = (
           forwardedPrefix: "/.well-known/oauth-authorization-server",
         },
         { prefix: route, upstreamPrefix: "/", keyRewrite: { policy: "bearer", keys } },
+        { prefix: "/email", file: emailTemplate },
       ];
     case "functions":
-      return [{ prefix: route, upstreamPrefix: "/", keyRewrite: { policy: "sb-api-key", keys } }];
+      return [
+        {
+          prefix: route,
+          upstreamPrefix: "/",
+          keyRewrite: { policy: "sb-api-key", keys },
+          upstreamCors: true,
+        },
+      ];
     default:
       return [{ prefix: route, upstreamPrefix: "/" }];
   }
diff --git a/packages/stack/src/host/LogForwarder.integration.test.ts b/packages/stack/src/host/LogForwarder.integration.test.ts
index 7d356a5d9f..9723f290b2 100644
--- a/packages/stack/src/host/LogForwarder.integration.test.ts
+++ b/packages/stack/src/host/LogForwarder.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Clock,
@@ -219,7 +219,7 @@ const ids = (post: Received) => post.events.map((event) => event.id);
 const storedMessages = (logflare: FakeLogflare) =>
   logflare.stored.pipe(Effect.map((events) => events.map((event) => event.event_message)));
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 
 describe("LogForwarder", () => {
   it.live(
diff --git a/packages/stack/src/host/LogForwarder.ts b/packages/stack/src/host/LogForwarder.ts
index 2548c02146..1ab86e7eb1 100644
--- a/packages/stack/src/host/LogForwarder.ts
+++ b/packages/stack/src/host/LogForwarder.ts
@@ -1,7 +1,6 @@
 import {
   Cause,
   Clock,
-  Crypto,
   Data,
   Duration,
   Effect,
@@ -18,6 +17,7 @@ import {
   Stream,
   SubscriptionRef,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { HttpClient, HttpClientError, HttpClientRequest } from "effect/http";
 import type { CompositionConfig } from "../Orchestrator.ts";
 import type { ServiceCreation } from "../services/Catalog.ts";
@@ -326,7 +326,8 @@ const retryWarningOnce =
 export const make = Effect.fn("LogForwarder.make")(function* (options: LogForwarderOptions) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
+  const hasher = yield* Digest.Digest;
   const client = (yield* HttpClient.HttpClient).pipe(HttpClient.filterStatusOk);
   const forwarderScope = yield* Effect.scope;
   const candidates = yield* Ref.make<ReadonlyMap<string, Candidate>>(new Map());
@@ -338,7 +339,7 @@ export const make = Effect.fn("LogForwarder.make")(function* (options: LogForwar
   >(undefined);
   const epochs = yield* Ref.make(0);
   const rebinding = yield* Semaphore.make(1);
-  const run = yield* crypto.randomUUIDv4;
+  const run = yield* crypto.uuidV4();
   const launchPrefix = `${run}:`;
   const launchOf = (candidate: Candidate) =>
     `${launchPrefix}${candidate.instance.id}:${candidate.launchId ?? "unknown"}`;
@@ -460,8 +461,8 @@ export const make = Effect.fn("LogForwarder.make")(function* (options: LogForwar
     );
 
   const eventId = Effect.fnUntraced(function* (instanceId: string, position: LogPosition) {
-    const digest = yield* crypto.digest(
-      "SHA-256",
+    const digest = yield* hasher.digest(
+      Digest.sha256,
       encoder.encode(`${instanceId}\0${position.generation}\0${position.byteOffset}`),
     );
     const hex = Array.from(digest.slice(0, 16), (byte) => byte.toString(16).padStart(2, "0"));
diff --git a/packages/stack/src/host/LogStore.snapshot.integration.test.ts b/packages/stack/src/host/LogStore.snapshot.integration.test.ts
new file mode 100644
index 0000000000..886f99e0e0
--- /dev/null
+++ b/packages/stack/src/host/LogStore.snapshot.integration.test.ts
@@ -0,0 +1,168 @@
+import { NodeServices } from "@effect/platform-node";
+import { expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Path, Stream } from "effect";
+import { encodeEntry, segmentName } from "./LogRecord.ts";
+import { streamStackLogs } from "./LogStore.ts";
+
+const line = (text: string, timestamp = 0) =>
+  encodeEntry({ kind: "stdout", timestamp, launchId: 1, text, truncated: false });
+
+it.effect(
+  "pins segment lengths and generations before reading and resumes completed partial records",
+  () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "logs-snapshot-" });
+      const directory = path.join(root, "auth", "one");
+      const file = path.join(directory, segmentName(1));
+      yield* fs.makeDirectory(directory, { recursive: true });
+      const partial = line("partial").slice(0, -1);
+      yield* fs.writeFileString(file, line("first") + line("second") + partial);
+      let changed = false;
+      const changingFs: FileSystem.FileSystem = {
+        ...fs,
+        open: (target, options) =>
+          Effect.gen(function* () {
+            if (target === file && !changed) {
+              changed = true;
+              yield* fs.writeFileString(file, "\n" + line("later"), { flag: "a" });
+              yield* fs.writeFileString(path.join(directory, segmentName(2)), line("rotated"));
+            }
+            return yield* fs.open(target, options);
+          }),
+      };
+      const first = yield* streamStackLogs({ root }).pipe(
+        Stream.runCollect,
+        Effect.provideService(FileSystem.FileSystem, changingFs),
+      );
+      expect(changed).toBe(true);
+      expect(first.map(({ text }) => text)).toEqual(["first", "second"]);
+      const position = first[1]?.position;
+      expect(position?.byteOffset).toBeGreaterThan(0);
+      const resumed = yield* streamStackLogs({
+        root,
+        from: position === undefined ? new Map() : new Map([["one", position]]),
+      }).pipe(Stream.runCollect);
+      expect(resumed.map(({ text }) => text)).toEqual(["second", "partial", "later", "rotated"]);
+    }).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.effect("captures every selected instance before consumption begins", () =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const root = yield* fs.makeTempDirectoryScoped({ prefix: "logs-snapshot-instances-" });
+    for (const id of ["one", "two"]) {
+      const directory = path.join(root, "auth", id);
+      yield* fs.makeDirectory(directory, { recursive: true });
+      yield* fs.writeFileString(path.join(directory, segmentName(1)), line(id));
+    }
+    let appended = false;
+    const rows = yield* streamStackLogs({ root }).pipe(
+      Stream.tap(() =>
+        Effect.gen(function* () {
+          if (appended) return;
+          appended = true;
+          for (const id of ["one", "two"])
+            yield* fs.writeFileString(path.join(root, "auth", id, segmentName(1)), line("new"), {
+              flag: "a",
+            });
+        }),
+      ),
+      Stream.runCollect,
+    );
+    expect(
+      rows.map(({ text }) => text).toSorted((a, b) => (a ?? "").localeCompare(b ?? "")),
+    ).toEqual(["one", "two"]);
+    expect((yield* streamStackLogs({ root }).pipe(Stream.runCollect)).length).toBe(4);
+  }).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.effect("reports a lost marker when the resume generation has been removed", () =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const root = yield* fs.makeTempDirectoryScoped({ prefix: "logs-snapshot-gap-" });
+    const directory = path.join(root, "auth", "one");
+    yield* fs.makeDirectory(directory, { recursive: true });
+    yield* fs.writeFileString(path.join(directory, segmentName(1)), line("old"));
+    yield* fs.writeFileString(path.join(directory, segmentName(3)), line("retained"));
+    const rows = yield* streamStackLogs({
+      root,
+      from: new Map([["one", { generation: 2, byteOffset: 10 }]]),
+    }).pipe(Stream.runCollect);
+    expect(rows.map(({ kind }) => kind)).toEqual(["lost", "stdout"]);
+    expect(rows[0]?.resumeAt).toEqual({ generation: 3, byteOffset: 0 });
+    expect(rows[1]?.text).toBe("retained");
+  }).pipe(Effect.provide(NodeServices.layer)),
+);
+
+for (const scenario of [
+  {
+    name: "timestamps a deleted middle segment at the next retained record",
+    count: 3,
+    deleted: [2],
+    retained: 3,
+  },
+  {
+    name: "timestamps consecutive deleted segments at the next retained record",
+    count: 4,
+    deleted: [2, 3],
+    retained: 4,
+  },
+  {
+    name: "finishes when the final captured segments disappear",
+    count: 3,
+    deleted: [2, 3],
+    retained: undefined,
+  },
+])
+  it.effect(scenario.name, () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "logs-snapshot-deleted-" });
+      const directory = path.join(root, "auth", "one");
+      yield* fs.makeDirectory(directory, { recursive: true });
+      for (let generation = 1; generation <= scenario.count; generation++)
+        yield* fs.writeFileString(
+          path.join(directory, segmentName(generation)),
+          line(generation === 1 ? "first" : "retained", generation * 1000),
+        );
+      let deleted = false;
+      const deletingFs: FileSystem.FileSystem = {
+        ...fs,
+        open: (target, options) =>
+          Effect.gen(function* () {
+            if (target === path.join(directory, segmentName(1)) && !deleted) {
+              deleted = true;
+              for (const generation of scenario.deleted)
+                yield* fs.remove(path.join(directory, segmentName(generation)));
+            }
+            return yield* fs.open(target, options);
+          }),
+      };
+      const rows = yield* streamStackLogs({ root }).pipe(
+        Stream.runCollect,
+        Effect.provideService(FileSystem.FileSystem, deletingFs),
+      );
+      expect(deleted).toBe(true);
+      const expected = [{ kind: "stdout", text: "first", timestamp: "1970-01-01T00:00:01.000Z" }];
+      if (scenario.retained !== undefined) {
+        const timestamp =
+          scenario.retained === 3 ? "1970-01-01T00:00:03.000Z" : "1970-01-01T00:00:04.000Z";
+        expect(
+          rows.slice(1).map(({ kind, text, timestamp }) => ({ kind, text, timestamp })),
+        ).toEqual([
+          { kind: "lost", text: undefined, timestamp },
+          { kind: "stdout", text: "retained", timestamp },
+        ]);
+        expect(rows[1]?.resumeAt).toEqual({ generation: scenario.retained, byteOffset: 0 });
+      }
+      expect(
+        rows.slice(0, 1).map(({ kind, text, timestamp }) => ({ kind, text, timestamp })),
+      ).toEqual(expected);
+      expect(rows).toHaveLength(scenario.retained === undefined ? 1 : 3);
+    }).pipe(Effect.provide(NodeServices.layer)),
+  );
diff --git a/packages/stack/src/host/LogStore.ts b/packages/stack/src/host/LogStore.ts
index ef1e61d84a..fc60399486 100644
--- a/packages/stack/src/host/LogStore.ts
+++ b/packages/stack/src/host/LogStore.ts
@@ -247,11 +247,17 @@ const makeReader = (fs: FileSystem.FileSystem, path: Path.Path) => {
       Effect.map((listed) => listed.flat()),
     );
 
-  const readChunk = (file: string, offset: number) =>
+  const readChunk = (file: string, offset: number, end?: number) =>
     Effect.scoped(
       fs.open(file, { flag: "r" }).pipe(
         Effect.tap((handle) => handle.seek(BigInt(offset), "start")),
-        Effect.flatMap((handle) => handle.readAlloc(readChunkBytes)),
+        Effect.flatMap((handle) =>
+          handle.readAlloc(
+            end === undefined
+              ? readChunkBytes
+              : Math.min(readChunkBytes, Math.max(0, end - offset)),
+          ),
+        ),
         Effect.map(Option.getOrElse(() => new Uint8Array(0))),
         Effect.map(Option.some),
       ),
@@ -302,10 +308,10 @@ const makeReader = (fs: FileSystem.FileSystem, path: Path.Path) => {
     live === undefined ? effect : live.passes.withPermits(1)(effect);
 
   /** Reads the complete records of one chunk at `position`; `none` when the segment is gone. */
-  const readAt = (directory: string, position: LogPosition, live: Live | undefined) =>
+  const readAt = (directory: string, position: LogPosition, live: Live | undefined, end?: number) =>
     guarded(
       live,
-      readChunk(path.join(directory, segmentName(position.generation)), position.byteOffset),
+      readChunk(path.join(directory, segmentName(position.generation)), position.byteOffset, end),
     ).pipe(
       Effect.map(
         Option.map((bytes): Chunk => {
@@ -354,9 +360,14 @@ const makeReader = (fs: FileSystem.FileSystem, path: Path.Path) => {
     cursor: LogPosition,
     cached: ReadonlyArray<number> | undefined,
     live: Live | undefined,
+    ends?: ReadonlyMap<number, number>,
   ) {
     const fresh = cached === undefined;
-    const listed = cached ?? (yield* generations(directory));
+    const listed =
+      cached ??
+      (yield* generations(directory)).filter(
+        (generation) => ends === undefined || ends.has(generation),
+      );
     const relist = (partial: boolean): Step => ({
       records: [],
       cursor,
@@ -385,7 +396,7 @@ const makeReader = (fs: FileSystem.FileSystem, path: Path.Path) => {
           atEnd: false,
           partial: false,
         } satisfies Step;
-      const next = yield* readAt(directory, resumeAt, live).pipe(
+      const next = yield* readAt(directory, resumeAt, live, ends?.get(generation)).pipe(
         Effect.map((chunk) => Option.getOrUndefined(chunk)?.records[0]?.timestamp),
         Effect.orElseSucceed(() => undefined),
       );
@@ -407,7 +418,7 @@ const makeReader = (fs: FileSystem.FileSystem, path: Path.Path) => {
     });
     if (!listed.includes(cursor.generation))
       return newer !== undefined ? yield* gap(newer) : fresh ? atEnd(false) : relist(false);
-    const chunk = yield* readAt(directory, cursor, live);
+    const chunk = yield* readAt(directory, cursor, live, ends?.get(cursor.generation));
     if (Option.isNone(chunk)) return relist(false);
     if (chunk.value.progressed)
       return {
@@ -495,10 +506,11 @@ const makeReader = (fs: FileSystem.FileSystem, path: Path.Path) => {
     options: Pick<ReadOptions, "since" | "follow">,
     live: Live | undefined,
     wake: PubSub.Subscription<void> | undefined,
+    ends?: ReadonlyMap<number, number>,
   ): Stream.Stream<LogRecord, LogStoreError> =>
     Stream.paginate(start, (current) =>
       Effect.gen(function* () {
-        const next: Step = yield* step(directory, current.cursor, current.listed, live);
+        const next: Step = yield* step(directory, current.cursor, current.listed, live, ends);
         const resume = Option.some({ cursor: next.cursor, listed: next.listed });
         if (!next.atEnd) return page(next.records, resume);
         if (!options.follow || live === undefined || wake === undefined)
@@ -554,14 +566,19 @@ const makeReader = (fs: FileSystem.FileSystem, path: Path.Path) => {
     );
   });
 
-  /** Streams a directory's records in file order without an owner. */
-  const records = (directory: string, options: Pick<ReadOptions, "since">) =>
+  const records = (
+    directory: string,
+    options: Pick<ReadOptions, "since">,
+    ends: ReadonlyMap<number, number>,
+    from?: LogPosition,
+  ) =>
     follow(
       directory,
-      { cursor: { generation: 0, byteOffset: 0 }, listed: undefined },
+      { cursor: from ?? { generation: 0, byteOffset: 0 }, listed: undefined },
       { ...options, follow: false },
       undefined,
       undefined,
+      ends,
     );
 
   return { read, history, records, segments, generations, latestLaunchId };
@@ -1129,6 +1146,7 @@ export const streamStackLogs = (options: {
   readonly root: string;
   readonly instances?: ReadonlyArray<string>;
   readonly since?: number;
+  readonly from?: ReadonlyMap<string, LogPosition>;
 }): Stream.Stream<StackLogRecord, LogStoreError, FileSystem.FileSystem | Path.Path> =>
   Stream.unwrap(
     Effect.gen(function* () {
@@ -1136,10 +1154,22 @@ export const streamStackLogs = (options: {
       const path = yield* Path.Path;
       const reader = makeReader(fs, path);
       const selected = yield* persistedInstances(fs, path, options.root, options.instances);
-      return Stream.fromIterable(selected).pipe(
-        Stream.flatMap(({ service, instanceId }) =>
+      const captured = yield* Effect.forEach(selected, ({ service, instanceId }) =>
+        Effect.gen(function* () {
+          const directory = path.join(options.root, service, instanceId);
+          const segments = yield* reader.segments(directory);
+          return { service, instanceId, directory, segments };
+        }),
+      );
+      return Stream.fromIterable(captured).pipe(
+        Stream.flatMap(({ service, instanceId, directory, segments }) =>
           reader
-            .records(path.join(options.root, service, instanceId), options)
+            .records(
+              directory,
+              options,
+              new Map(segments.map(({ generation, size }) => [generation, size])),
+              options.from?.get(instanceId),
+            )
             .pipe(Stream.map((record): StackLogRecord => ({ ...record, service, instanceId }))),
         ),
       );
diff --git a/packages/stack/src/host/LogflareEvents.ts b/packages/stack/src/host/LogflareEvents.ts
index b2e74a80d2..89db878c17 100644
--- a/packages/stack/src/host/LogflareEvents.ts
+++ b/packages/stack/src/host/LogflareEvents.ts
@@ -111,12 +111,19 @@ const logValue = (value: string | undefined) =>
 
 const withoutProject = ({ project: _project, ...event }: LogflareEvent): LogflareEvent => event;
 
+/* Auth logs a template's URL when fetching or parsing it fails. */
+const templateToken = /(\/email\/[^?\s"]*\?token=)[^\s":&\\]+/gu;
+
 const remaps: Record<ShippedService, (event: LogflareEvent) => LogflareEvent> = {
   auth: (event) => {
-    const parsed = parseJsonObject(event.event_message);
+    const redacted = {
+      ...event,
+      event_message: event.event_message.replace(templateToken, "$1redacted"),
+    };
+    const parsed = parseJsonObject(redacted.event_message);
     return parsed === undefined
-      ? event
-      : { ...event, metadata: { ...event.metadata, timestamp: parsed.time, ...parsed } };
+      ? redacted
+      : { ...redacted, metadata: { ...redacted.metadata, timestamp: parsed.time, ...parsed } };
   },
   rest: (event) => {
     const request = postgrestRequest.exec(event.event_message);
diff --git a/packages/stack/src/host/LogflareEvents.unit.test.ts b/packages/stack/src/host/LogflareEvents.unit.test.ts
index e129a2e525..6b9544be4c 100644
--- a/packages/stack/src/host/LogflareEvents.unit.test.ts
+++ b/packages/stack/src/host/LogflareEvents.unit.test.ts
@@ -22,6 +22,36 @@ it("merges structured Auth lines into metadata and keeps the raw message", () =>
   });
 });
 
+it("masks a template token in Auth's message and metadata", () => {
+  const line = JSON.stringify({
+    level: "error",
+    msg: 'template: http://host.supabase.internal:54321/email/recovery?token=secret-uuid:1: unexpected "<" in operand',
+    error:
+      "http: GET http://host.supabase.internal:54321/email/recovery?token=secret-uuid: status code 404",
+    time: "2026-09-28T09:59:59Z",
+  });
+  const event = logflareEvent("auth", received, line);
+  expect(JSON.stringify(event)).not.toContain("secret-uuid");
+  expect(event.event_message).toContain("/email/recovery?token=redacted:1:");
+  expect(event.metadata).toMatchObject({
+    error: expect.stringContaining("/email/recovery?token=redacted: status code 404"),
+  });
+});
+
+it("keeps Auth metadata when a masked template URL is quoted", () => {
+  const line = JSON.stringify({
+    level: "error",
+    msg: 'Get "http://host.supabase.internal:54321/email/invite?token=secret-uuid": connection refused',
+    time: "2026-09-28T09:59:59Z",
+  });
+  const event = logflareEvent("auth", received, line);
+  expect(JSON.stringify(event)).not.toContain("secret-uuid");
+  expect(event.metadata).toMatchObject({
+    level: "error",
+    msg: expect.stringContaining('/email/invite?token=redacted": connection refused'),
+  });
+});
+
 it("ships an Auth JSON line nested too deep for metadata as its raw message", () => {
   const depth = 16_000;
   const line = `{"msg":"deep","detail":${"[".repeat(depth)}${"]".repeat(depth)}}`;
diff --git a/packages/stack/src/host/LogflareStorage.integration.test.ts b/packages/stack/src/host/LogflareStorage.integration.test.ts
index 3ac06f363c..24233c2260 100644
--- a/packages/stack/src/host/LogflareStorage.integration.test.ts
+++ b/packages/stack/src/host/LogflareStorage.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { PgClient } from "@effect/sql-pg";
 import { describe, expect, it } from "@effect/vitest";
 import { Context, Effect, Exit, FileSystem, Layer, Redacted, Ref, Scope } from "effect";
@@ -106,7 +106,7 @@ const socketRelay = (path: string) =>
     (relay) => Effect.sync(relay.close),
   );
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 
 describe("LogflareStorage", { timeout: 180_000 }, () => {
   it.live(
diff --git a/packages/stack/src/identity/Identity.ts b/packages/stack/src/identity/Identity.ts
index 379d04a2a4..1c413f505d 100644
--- a/packages/stack/src/identity/Identity.ts
+++ b/packages/stack/src/identity/Identity.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect, FileSystem, Path, Schema } from "effect";
+import { Effect, FileSystem, Path, Schema } from "effect";
+import { Digest } from "effect/crypto";
 import type { PlatformError } from "effect/PlatformError";
 import { InvalidProjectRootError, InvalidStackIdentityError } from "./Errors.ts";
 import { StackIdSchema } from "./StackId.ts";
@@ -41,28 +42,18 @@ const encodeTuple = (identity: StackIdentity): Uint8Array => {
 export const deriveStackId = Effect.fn("Identity.deriveStackId")(function* (
   identity: StackIdentity,
 ) {
-  return yield* Effect.gen(function* () {
-    const crypto = yield* Crypto.Crypto;
-    const digest = yield* crypto.digest("SHA-256", encodeTuple(identity));
-    let hexadecimal = "";
-    for (const byte of digest) {
-      hexadecimal += byte.toString(16).padStart(2, "0");
-    }
-    return yield* Schema.decodeEffect(StackIdSchema)(hexadecimal).pipe(
-      Effect.mapError(
-        (error) =>
-          new InvalidStackIdentityError({
-            message: `SHA-256 digest did not produce a valid StackId: ${String(error)}`,
-          }),
-      ),
-    );
-  }).pipe(
-    Effect.catchTag("PlatformError", (error: PlatformError) =>
-      Effect.fail(
+  const crypto = yield* Digest.Digest;
+  const digest = yield* crypto.digest(Digest.sha256, encodeTuple(identity));
+  let hexadecimal = "";
+  for (const byte of digest) {
+    hexadecimal += byte.toString(16).padStart(2, "0");
+  }
+  return yield* Schema.decodeEffect(StackIdSchema)(hexadecimal).pipe(
+    Effect.mapError(
+      (error) =>
         new InvalidStackIdentityError({
-          message: `Unable to derive StackId: ${error.message}`,
+          message: `SHA-256 digest did not produce a valid StackId: ${String(error)}`,
         }),
-      ),
     ),
   );
 });
diff --git a/packages/stack/src/identity/identity.integration.test.ts b/packages/stack/src/identity/identity.integration.test.ts
index 61248ca5d6..4a136426c2 100644
--- a/packages/stack/src/identity/identity.integration.test.ts
+++ b/packages/stack/src/identity/identity.integration.test.ts
@@ -1,12 +1,13 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
-import { Crypto, Effect, Exit, FileSystem, Path } from "effect";
+import { Effect, Exit, FileSystem, Layer, Path } from "effect";
+import { Digest } from "effect/crypto";
 import { InvalidStackIdentityError } from "./Errors.ts";
 import type { StackId } from "./StackId.ts";
 import { GitSetupError, runGit } from "../../tests/helpers/git.ts";
 import { deriveStackId, resolveStackIdentity, type StackIdentity } from "./Identity.ts";
 
-const platformLayer = NodeServices.layer;
+const platformLayer = Layer.merge(NodeServices.layer, NodeCrypto.layer);
 
 const makeGitWorkspace = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
@@ -25,7 +26,7 @@ const makeGitWorkspace = Effect.gen(function* () {
 
 const stackId = (
   identity: StackIdentity,
-): Effect.Effect<StackId, InvalidStackIdentityError, Crypto.Crypto> => deriveStackId(identity);
+): Effect.Effect<StackId, InvalidStackIdentityError, Digest.Digest> => deriveStackId(identity);
 
 const withScope = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   Effect.scoped(effect).pipe(Effect.provide(platformLayer));
diff --git a/packages/stack/src/internal/content-digest.ts b/packages/stack/src/internal/content-digest.ts
index 5be27d5e65..0c57f51e19 100644
--- a/packages/stack/src/internal/content-digest.ts
+++ b/packages/stack/src/internal/content-digest.ts
@@ -1,13 +1,14 @@
-import { Effect, type Crypto, type PlatformError } from "effect";
+import { Effect } from "effect";
+import { Digest } from "effect/crypto";
 
 const hex = (bytes: Uint8Array): string =>
   Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 
 /** A 16-character hex SHA-256 prefix, used to name content-addressed files and directories. */
 export const contentDigestHex = (
-  crypto: Crypto.Crypto,
+  digest: Digest.Digest["Service"],
   content: string,
-): Effect.Effect<string, PlatformError.PlatformError> =>
-  crypto
-    .digest("SHA-256", new TextEncoder().encode(content))
-    .pipe(Effect.map((digest) => hex(digest).slice(0, 16)));
+): Effect.Effect<string> =>
+  digest
+    .digest(Digest.sha256, new TextEncoder().encode(content))
+    .pipe(Effect.map((bytes) => hex(bytes).slice(0, 16)));
diff --git a/packages/stack/src/internal/database-reuse.ts b/packages/stack/src/internal/database-reuse.ts
index e5590eeef9..9a04645c2f 100644
--- a/packages/stack/src/internal/database-reuse.ts
+++ b/packages/stack/src/internal/database-reuse.ts
@@ -8,7 +8,7 @@ export const recreateStackAdvice = (stackId: string): string =>
 
 /** Recovery that keeps data created at `version` by pinning it again, before the destructive recreate. */
 export const keepOrRecreateAdvice = (stackId: string, service: string, version: string): string =>
-  `keep this data by pinning \`[local.services.${service}] version = "${version}"\` in supabase/config.toml, or ${recreateStackAdvice(stackId)}`;
+  `keep this data by pinning \`local.services.${service}.version\` to \`"${version}"\` in your config file, or ${recreateStackAdvice(stackId)}`;
 
 /** The runtimes a database runs under. */
 export const DatabaseRuntime = Schema.Literals(["native", "docker", "podman"]);
@@ -50,7 +50,7 @@ export class DatabaseIdentityMismatch extends Schema.TaggedError<DatabaseIdentit
 ) {}
 
 /**
- * How to keep data `recorded` created: pin its build, which selects its line, plus the `[db]` edits
+ * How to keep data `recorded` created: pin its build, which selects its line, plus the `db` edits
  * that keep the pin valid whichever setting selected the requested build.
  */
 const keepDatabaseAdvice = (
@@ -61,15 +61,15 @@ const keepDatabaseAdvice = (
   const edits = [
     ...(recorded.major === requested.major
       ? []
-      : [`setting \`[db] major_version = ${recorded.major}\``]),
-    ...(requested.line === "orioledb" ? ["removing any `[db] orioledb_version`"] : []),
+      : [`setting \`db.major_version\` to \`${recorded.major}\``]),
+    ...(requested.line === "orioledb" ? ["removing any `db.orioledb_version`"] : []),
   ];
   if (edits.length === 0) return keepOrRecreateAdvice(stackId, "database", recorded.build);
   const clauses = new Intl.ListFormat("en", { type: "conjunction" }).format([
-    `pinning \`[local.services.database] version = "${recorded.build}"\``,
+    `pinning \`local.services.database.version\` to \`"${recorded.build}"\``,
     ...edits,
   ]);
-  return `keep this data by ${clauses} in supabase/config.toml, or ${recreateStackAdvice(stackId)}`;
+  return `keep this data by ${clauses} in your config file, or ${recreateStackAdvice(stackId)}`;
 };
 
 /**
diff --git a/packages/stack/src/internal/database-reuse.unit.test.ts b/packages/stack/src/internal/database-reuse.unit.test.ts
index ee83aa23ab..50bc9695ec 100644
--- a/packages/stack/src/internal/database-reuse.unit.test.ts
+++ b/packages/stack/src/internal/database-reuse.unit.test.ts
@@ -24,40 +24,40 @@ const messageFor = (recorded: string | undefined, requested: string) =>
 
 it("offers to keep data by pinning its build when the major and line are unchanged", () => {
   expect(messageFor(STOCK_17, STOCK_17_NEWER)).toBe(
-    `PostgreSQL data was initialized by stock PostgreSQL build ${STOCK_17}, but stock PostgreSQL build ${STOCK_17_NEWER} was requested; keep this data by pinning \`[local.services.database] version = "${STOCK_17}"\` in supabase/config.toml, or ${destroy}`,
+    `PostgreSQL data was initialized by stock PostgreSQL build ${STOCK_17}, but stock PostgreSQL build ${STOCK_17_NEWER} was requested; keep this data by pinning \`local.services.database.version\` to \`"${STOCK_17}"\` in your config file, or ${destroy}`,
   );
 });
 
 it("offers to restore the recorded major beside the pin when the major differs", () => {
   expect(messageFor(STOCK_15, STOCK_17)).toBe(
-    `PostgreSQL data was initialized by stock PostgreSQL build ${STOCK_15}, but stock PostgreSQL build ${STOCK_17} was requested; keep this data by pinning \`[local.services.database] version = "${STOCK_15}"\` and setting \`[db] major_version = 15\` in supabase/config.toml, or ${destroy}`,
+    `PostgreSQL data was initialized by stock PostgreSQL build ${STOCK_15}, but stock PostgreSQL build ${STOCK_17} was requested; keep this data by pinning \`local.services.database.version\` to \`"${STOCK_15}"\` and setting \`db.major_version\` to \`15\` in your config file, or ${destroy}`,
   );
 });
 
 it("offers to remove any orioledb_version when stock data is asked for an OrioleDB build of the same major", () => {
   expect(messageFor(STOCK_17, ORIOLEDB_17)).toBe(
-    `PostgreSQL data was initialized by stock PostgreSQL build ${STOCK_17}, but OrioleDB build ${ORIOLEDB_17} was requested; keep this data by pinning \`[local.services.database] version = "${STOCK_17}"\` and removing any \`[db] orioledb_version\` in supabase/config.toml, or ${destroy}`,
+    `PostgreSQL data was initialized by stock PostgreSQL build ${STOCK_17}, but OrioleDB build ${ORIOLEDB_17} was requested; keep this data by pinning \`local.services.database.version\` to \`"${STOCK_17}"\` and removing any \`db.orioledb_version\` in your config file, or ${destroy}`,
   );
 });
 
 it("offers only the pin when OrioleDB data is asked for a stock build of the same major", () => {
   expect(messageFor(ORIOLEDB_17, STOCK_17)).toBe(
-    `PostgreSQL data was initialized by OrioleDB build ${ORIOLEDB_17}, but stock PostgreSQL build ${STOCK_17} was requested; keep this data by pinning \`[local.services.database] version = "${ORIOLEDB_17}"\` in supabase/config.toml, or ${destroy}`,
+    `PostgreSQL data was initialized by OrioleDB build ${ORIOLEDB_17}, but stock PostgreSQL build ${STOCK_17} was requested; keep this data by pinning \`local.services.database.version\` to \`"${ORIOLEDB_17}"\` in your config file, or ${destroy}`,
   );
 });
 
 it("offers to remove any orioledb_version when OrioleDB data is asked for another OrioleDB build", () => {
   expect(messageFor(ORIOLEDB_17, ORIOLEDB_17_NEWER)).toBe(
-    `PostgreSQL data was initialized by OrioleDB build ${ORIOLEDB_17}, but OrioleDB build ${ORIOLEDB_17_NEWER} was requested; keep this data by pinning \`[local.services.database] version = "${ORIOLEDB_17}"\` and removing any \`[db] orioledb_version\` in supabase/config.toml, or ${destroy}`,
+    `PostgreSQL data was initialized by OrioleDB build ${ORIOLEDB_17}, but OrioleDB build ${ORIOLEDB_17_NEWER} was requested; keep this data by pinning \`local.services.database.version\` to \`"${ORIOLEDB_17}"\` and removing any \`db.orioledb_version\` in your config file, or ${destroy}`,
   );
 });
 
 it("offers each edit that applies when both the major and the line differ", () => {
   expect(messageFor(STOCK_15, ORIOLEDB_17)).toContain(
-    `keep this data by pinning \`[local.services.database] version = "${STOCK_15}"\`, setting \`[db] major_version = 15\`, and removing any \`[db] orioledb_version\` in supabase/config.toml`,
+    `keep this data by pinning \`local.services.database.version\` to \`"${STOCK_15}"\`, setting \`db.major_version\` to \`15\`, and removing any \`db.orioledb_version\` in your config file`,
   );
   expect(messageFor(ORIOLEDB_17, STOCK_15)).toContain(
-    `keep this data by pinning \`[local.services.database] version = "${ORIOLEDB_17}"\` and setting \`[db] major_version = 17\` in supabase/config.toml`,
+    `keep this data by pinning \`local.services.database.version\` to \`"${ORIOLEDB_17}"\` and setting \`db.major_version\` to \`17\` in your config file`,
   );
 });
 
diff --git a/packages/stack/src/internal/release.integration.test.ts b/packages/stack/src/internal/release.integration.test.ts
index 4ab004acbb..b89e968747 100644
--- a/packages/stack/src/internal/release.integration.test.ts
+++ b/packages/stack/src/internal/release.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Path } from "effect";
 import { sourceDigest } from "./release.ts";
@@ -18,5 +18,5 @@ it.live("digests only regular module files, ignoring dangling editor lock links"
     expect(yield* sourceDigest(root)).toBe(clean);
     yield* fs.writeFileString(path.join(root, "nested", "Module.ts"), "export const a = 2;\n");
     expect(yield* sourceDigest(root)).not.toBe(clean);
-  }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  }).pipe(Effect.scoped, Effect.provide([NodeServices.layer, NodeCrypto.layer])),
 );
diff --git a/packages/stack/src/internal/release.ts b/packages/stack/src/internal/release.ts
index 9539d4d243..c0b86d5631 100644
--- a/packages/stack/src/internal/release.ts
+++ b/packages/stack/src/internal/release.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect, FileSystem, Path } from "effect";
+import { Effect, FileSystem, Path } from "effect";
+import { Digest } from "effect/crypto";
 import effectPackage from "effect/package.json" with { type: "json" };
 import { fileURLToPath } from "node:url";
 
@@ -9,7 +10,7 @@ const hex = (bytes: Uint8Array) =>
 export const sourceDigest = Effect.fn("Release.sourceDigest")(function* (sourceRoot: string) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* Digest.Digest;
   const regularFile = (file: string) =>
     fs.readLink(path.join(sourceRoot, file)).pipe(
       Effect.as(false),
@@ -37,7 +38,7 @@ export const sourceDigest = Effect.fn("Release.sourceDigest")(function* (sourceR
     content.set(part, offset);
     offset += part.length;
   }
-  return hex(yield* crypto.digest("SHA-256", content)).slice(0, 16);
+  return hex(yield* crypto.digest(Digest.sha256, content)).slice(0, 16);
 });
 
 /**
diff --git a/packages/stack/src/internal/schema-writers.unit.test.ts b/packages/stack/src/internal/schema-writers.unit.test.ts
index 92db6fc811..bfba978cc1 100644
--- a/packages/stack/src/internal/schema-writers.unit.test.ts
+++ b/packages/stack/src/internal/schema-writers.unit.test.ts
@@ -30,7 +30,7 @@ it("treats versions that differ only by suffix or a v prefix as the same", () =>
 
 it("offers to keep the data by pinning the recorded version before recreating the stack", () => {
   expect(schemaWriterDowngrade("stack-a", { auth: "v2.197.0" }, "auth", "v2.196.1")?.message).toBe(
-    'auth v2.196.1 is older than v2.197.0, which already migrated this database; downgrading does not restore the old schema, so keep this data by pinning `[local.services.auth] version = "v2.197.0"` in supabase/config.toml, or run `supabase stack destroy --stack-id stack-a` to recreate the stack — this permanently deletes its local database data',
+    'auth v2.196.1 is older than v2.197.0, which already migrated this database; downgrading does not restore the old schema, so keep this data by pinning `local.services.auth.version` to `"v2.197.0"` in your config file, or run `supabase stack destroy --stack-id stack-a` to recreate the stack — this permanently deletes its local database data',
   );
 });
 
diff --git a/packages/stack/src/lifetime.integration.test.ts b/packages/stack/src/lifetime.integration.test.ts
index d08ac58a10..df40317da2 100644
--- a/packages/stack/src/lifetime.integration.test.ts
+++ b/packages/stack/src/lifetime.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Context, Data, Effect, Fiber, FileSystem, Layer, Option, Schema, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
@@ -20,7 +20,7 @@ class LifetimeTestError extends Data.TaggedError("LifetimeTestError")<{
   readonly message: string;
 }> {}
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 const cacheRoot = testArtifactCacheRoot;
 const sessionFixture = fileURLToPath(
   new URL("../tests/session-client-fixture.ts", import.meta.url),
diff --git a/packages/stack/src/namespace/Namespace.e2e.test.ts b/packages/stack/src/namespace/Namespace.e2e.test.ts
index 35359f90ae..b8e6a6c63d 100644
--- a/packages/stack/src/namespace/Namespace.e2e.test.ts
+++ b/packages/stack/src/namespace/Namespace.e2e.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import {
   Context,
@@ -48,7 +48,11 @@ const lockFixture = fileURLToPath(
   new URL("../../tests/namespace-lock-fixture.ts", import.meta.url),
 );
 
-const testLayer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const testLayer = Layer.mergeAll(
+  NodeServices.layer,
+  NodeCrypto.layer,
+  NodeHttpClient.layerNodeHttp,
+);
 
 const savedStack = (root: string, id: string): StackNamespace.SavedStack => ({
   id,
diff --git a/packages/stack/src/namespace/Namespace.integration.test.ts b/packages/stack/src/namespace/Namespace.integration.test.ts
index 04a22f6fd3..b175bb589b 100644
--- a/packages/stack/src/namespace/Namespace.integration.test.ts
+++ b/packages/stack/src/namespace/Namespace.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { TestClock } from "effect/testing";
 import {
@@ -47,7 +47,11 @@ const initial: StackNamespace.SavedStack = {
 const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   Effect.scoped(effect).pipe(Effect.provide(NodeServices.layer));
 
-const stackLayer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const stackLayer = Layer.mergeAll(
+  NodeServices.layer,
+  NodeCrypto.layer,
+  NodeHttpClient.layerNodeHttp,
+);
 
 describe("durable registry", () => {
   it.live("reopens saved state and serializes concurrent read-modify-write operations", () =>
diff --git a/packages/stack/src/namespace/PortReservations.integration.test.ts b/packages/stack/src/namespace/PortReservations.integration.test.ts
new file mode 100644
index 0000000000..94741482c1
--- /dev/null
+++ b/packages/stack/src/namespace/PortReservations.integration.test.ts
@@ -0,0 +1,31 @@
+import { NodeServices } from "@effect/platform-node";
+import { expect, it } from "@effect/vitest";
+import { Context, Effect, FileSystem, Layer, Path } from "effect";
+import * as PortReservations from "./PortReservations.ts";
+import { openDatabase } from "./drivers/Sqlite.ts";
+
+const openRegistry = (directory: string) =>
+  Layer.build(PortReservations.layerAt(directory)).pipe(
+    Effect.map((context) => Context.get(context, PortReservations.Service)),
+  );
+
+it.live("opens and reads the registry while a peer connection holds its write lock", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const directory = yield* fs.makeTempDirectoryScoped({ prefix: "port-reservations-" });
+      const registryFile = path.join(directory, "ports.sqlite");
+      const first = yield* openRegistry(directory);
+      yield* first.reserve("/peer", "peer", "api", 54321);
+
+      yield* openDatabase(registryFile, (peer) => {
+        peer.exec("PRAGMA busy_timeout = 2000");
+        peer.exec("BEGIN EXCLUSIVE");
+      });
+      const second = yield* openRegistry(directory);
+
+      expect(yield* second.find("/peer", "peer", "api")).toBe(54321);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
diff --git a/packages/stack/src/namespace/PortReservations.ts b/packages/stack/src/namespace/PortReservations.ts
index 3dff821b7d..93726d3e90 100644
--- a/packages/stack/src/namespace/PortReservations.ts
+++ b/packages/stack/src/namespace/PortReservations.ts
@@ -1,11 +1,20 @@
 import { userInfo } from "node:os";
-import type { DatabaseSync } from "node:sqlite";
 import { NodeServices } from "@effect/platform-node";
-import { Context, Effect, FileSystem, Layer, Path, Predicate, Scope, Stream } from "effect";
+import {
+  Context,
+  Effect,
+  FileSystem,
+  Layer,
+  Path,
+  Predicate,
+  Schedule,
+  Scope,
+  Stream,
+} from "effect";
 import { ChildProcess } from "effect/process";
 import { namespaceError, type NamespaceError } from "./Capabilities.ts";
 import { restrictDirectoryToOwner } from "../runtime/postgres-user.ts";
-import { errcode, openDatabase } from "./drivers/Sqlite.ts";
+import { errcode, isBusy, openDatabase } from "./drivers/Sqlite.ts";
 import { lstatPath } from "./drivers/FileSystem.ts";
 
 /** Identifies the stack that owns a port reservation. */
@@ -87,15 +96,39 @@ const isHolderRow = (value: unknown): value is HolderRow =>
   Predicate.hasProperty(value, "stack_id") &&
   typeof value.stack_id === "string";
 
-const connectionFor = (file: string): Effect.Effect<DatabaseSync, NamespaceError, Scope.Scope> =>
-  openDatabase(file, (connection) => {
-    // Short and bounded: real contention between two of this user's processes is brief, and
-    // a blocking wait here is simpler than an async retry loop for a database this small. Set
-    // before the schema statement, so even first-time table creation waits out a racing peer
-    // instead of surfacing a spurious busy error.
-    connection.exec("PRAGMA busy_timeout = 2000");
-    connection.exec(schema);
+const connectionFor = Effect.fn("PortReservations.connectionFor")(function* (file: string) {
+  // Short and bounded: real contention between two of this user's processes is brief, and
+  // a blocking wait here is simpler than an async retry loop for a database this small. Set
+  // before the schema statement, so even first-time table creation waits out a racing peer
+  // instead of surfacing a spurious busy error.
+  const connection = yield* openDatabase(file, (connection) =>
+    connection.exec("PRAGMA busy_timeout = 2000"),
+  );
+  // WAL lets reads and opens proceed while a peer commits; under the rollback journal a peer
+  // that commits back to back can lock new readers out past the busy timeout. SQLite skips the
+  // busy timeout while a peer switches the file into WAL, so that one statement waits here.
+  let attempts = 0;
+  yield* Effect.try({
+    try: () => {
+      attempts++;
+      connection.exec("PRAGMA journal_mode = WAL");
+    },
+    catch: (cause) => namespaceError("open", cause),
+  }).pipe(
+    Effect.retry({
+      schedule: Schedule.spaced("10 millis").pipe(Schedule.upTo({ duration: "2 seconds" })),
+      while: isBusy,
+    }),
+    Effect.ensuring(
+      Effect.suspend(() => Effect.annotateCurrentSpan("sqlite.journal_mode.attempts", attempts)),
+    ),
+  );
+  yield* Effect.try({
+    try: () => connection.exec(schema),
+    catch: (cause) => namespaceError("open", cause),
   });
+  return connection;
+});
 
 /**
  * Confirms `directory` (created 0700 if missing) is a real directory this uid owns, with the
@@ -200,18 +233,11 @@ const resolvedHome: Effect.Effect<string, NamespaceError> = Effect.runSync(
   Effect.cached(resolvePasswdHome().pipe(Effect.provide(NodeServices.layer))),
 );
 
-/**
- * One SQLite database per OS user at `<passwd home>/.supabase/ports.sqlite`, the only authority on
- * which stack owns a public port across every state root on this machine.
- */
-const make = Effect.fn("PortReservations.make")(function* (): Effect.fn.Return<
-  Interface,
-  NamespaceError,
-  FileSystem.FileSystem | Path.Path | Scope.Scope
-> {
+const make = Effect.fn("PortReservations.make")(function* (
+  directory: string,
+): Effect.fn.Return<Interface, NamespaceError, FileSystem.FileSystem | Path.Path | Scope.Scope> {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const directory = path.join(yield* resolvedHome, ".supabase");
   yield* securePrivateDirectory(fs, directory);
   const connection = yield* connectionFor(path.join(directory, "ports.sqlite"));
 
@@ -358,4 +384,18 @@ const make = Effect.fn("PortReservations.make")(function* (): Effect.fn.Return<
   return { find, reserve, reclaim, release, releaseStack };
 });
 
-export const layer = Layer.effect(Service, make().pipe(Effect.map(Service.of)));
+/**
+ * One SQLite database per OS user at `<passwd home>/.supabase/ports.sqlite`, the only authority on
+ * which stack owns a public port across every state root on this machine.
+ */
+export const layer = Layer.effect(
+  Service,
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    return Service.of(yield* make(path.join(yield* resolvedHome, ".supabase")));
+  }),
+);
+
+/** Opens the registry in `directory` instead of the account's home, for isolated tests. */
+export const layerAt = (directory: string) =>
+  Layer.effect(Service, make(directory).pipe(Effect.map(Service.of)));
diff --git a/packages/stack/src/namespace/drivers/FileSystem.ts b/packages/stack/src/namespace/drivers/FileSystem.ts
index 962c0185e9..5846f0b364 100644
--- a/packages/stack/src/namespace/drivers/FileSystem.ts
+++ b/packages/stack/src/namespace/drivers/FileSystem.ts
@@ -1,7 +1,7 @@
 import { Effect, FileSystem, Predicate } from "effect";
 import { systemError, type PlatformError } from "effect/PlatformError";
-// oxlint-disable-next-line effecttsgo/node-builtin-import -- FileSystem has neither a no-follow stat nor a non-recursive directory removal.
-import { lstat, rmdir } from "node:fs/promises";
+// oxlint-disable-next-line effecttsgo/node-builtin-import -- FileSystem has no no-follow stat or open, and no non-recursive directory removal.
+import { constants, lstat, open, realpath, rmdir } from "node:fs/promises";
 import { namespaceError, type NamespaceError } from "../Capabilities.ts";
 
 export interface LstatInfo {
@@ -46,6 +46,203 @@ export const lstatPath = (path: string): Effect.Effect<LstatInfo | undefined, Pl
     ),
   );
 
+const fileError = (
+  path: string,
+  tag: "Unknown" | "BadResource",
+  detail: { readonly cause?: unknown; readonly description?: string },
+): PlatformError =>
+  systemError({
+    _tag: tag,
+    module: "FileSystem",
+    method: "readContainedFile",
+    pathOrDescriptor: path,
+    ...detail,
+  });
+
+const notRegularFile = (path: string) =>
+  fileError(path, "BadResource", { description: "Not a regular file at this path" });
+
+/** A path's form for comparison: Windows names are case-insensitive, so they compare folded. */
+const comparable = (path: string, windows: boolean) => (windows ? path.toLowerCase() : path);
+
+/**
+ * Whether canonical `path` is `root` or below it, the containment rule `content_path` follows
+ * in the CLI; both come from `realpath`, so neither holds a `..` segment.
+ */
+export const containedIn = (root: string, path: string, windows: boolean): boolean => {
+  const sep = windows ? "\\" : "/";
+  const base = comparable(root.endsWith(sep) ? root : `${root}${sep}`, windows);
+  const candidate = comparable(path, windows);
+  return candidate === comparable(root, windows) || candidate.startsWith(base);
+};
+
+/**
+ * The DOS path `GetFinalPathNameByHandleW` reports, without its `\\?\` prefix, so it reads like
+ * `realpath`: `\\?\C:\x` is `C:\x` and `\\?\UNC\server\share` is `\\server\share`.
+ */
+export const windowsFinalPath = (reported: string): string =>
+  reported.startsWith("\\\\?\\UNC\\")
+    ? `\\\\${reported.slice(8)}`
+    : reported.startsWith("\\\\?\\")
+      ? reported.slice(4)
+      : reported;
+
+const GENERIC_READ = 0x8000_0000;
+const FILE_SHARE_ALL = 0x7;
+const OPEN_EXISTING = 3;
+const FILE_ATTRIBUTE_DIRECTORY = 0x10;
+const WINDOWS_PATH_CHARS = 32_768;
+
+/**
+ * Windows: opens `resolved` the normal way, so OneDrive placeholders and deduplicated files read,
+ * and reads it only when the handle's final path is still `resolved` and names a file, so a link
+ * swapped in anywhere on the path is refused. Node has no handle-path API there.
+ */
+const readWindowsHandle = Effect.fnUntraced(function* (resolved: string) {
+  const sync = <A>(operation: () => A) =>
+    Effect.try({ try: operation, catch: (cause) => fileError(resolved, "Unknown", { cause }) });
+  const { dlopen, FFIType } = yield* Effect.tryPromise({
+    try: () => import("bun:ffi"),
+    catch: (cause) => fileError(resolved, "Unknown", { cause }),
+  });
+  const { symbols } = yield* Effect.acquireRelease(
+    sync(() =>
+      dlopen("kernel32.dll", {
+        CreateFileW: {
+          args: [
+            FFIType.ptr,
+            FFIType.u32,
+            FFIType.u32,
+            FFIType.ptr,
+            FFIType.u32,
+            FFIType.u32,
+            FFIType.ptr,
+          ],
+          returns: FFIType.i64,
+        },
+        GetFinalPathNameByHandleW: {
+          args: [FFIType.i64, FFIType.ptr, FFIType.u32, FFIType.u32],
+          returns: FFIType.u32,
+        },
+        GetFileInformationByHandle: { args: [FFIType.i64, FFIType.ptr], returns: FFIType.i32 },
+        ReadFile: {
+          args: [FFIType.i64, FFIType.ptr, FFIType.u32, FFIType.ptr, FFIType.ptr],
+          returns: FFIType.i32,
+        },
+        CloseHandle: { args: [FFIType.i64], returns: FFIType.i32 },
+      }),
+    ),
+    (library) => Effect.sync(() => library.close()),
+  );
+  const handle = yield* Effect.acquireRelease(
+    sync(() =>
+      symbols.CreateFileW(
+        Buffer.from(`${resolved}\0`, "utf16le"),
+        GENERIC_READ,
+        FILE_SHARE_ALL,
+        null,
+        OPEN_EXISTING,
+        0,
+        null,
+      ),
+    ),
+    (opened) =>
+      Number(opened) === -1 ? Effect.void : Effect.sync(() => symbols.CloseHandle(opened)),
+  );
+  if (Number(handle) === -1)
+    return yield* fileError(resolved, "Unknown", { description: "Could not open the file" });
+  const unreadable = fileError(resolved, "Unknown", { description: "Could not read the file" });
+  const info = new Uint32Array(13);
+  if ((yield* sync(() => symbols.GetFileInformationByHandle(handle, info))) === 0)
+    return yield* unreadable;
+  if (((info[0] ?? FILE_ATTRIBUTE_DIRECTORY) & FILE_ATTRIBUTE_DIRECTORY) !== 0)
+    return yield* notRegularFile(resolved);
+  const name = new Uint16Array(WINDOWS_PATH_CHARS);
+  const length = yield* sync(() =>
+    symbols.GetFinalPathNameByHandleW(handle, name, WINDOWS_PATH_CHARS, 0),
+  );
+  if (length === 0 || length >= WINDOWS_PATH_CHARS) return yield* unreadable;
+  const final = windowsFinalPath(Buffer.from(name.buffer, 0, length * 2).toString("utf16le"));
+  if (comparable(final, true) !== comparable(resolved, true))
+    return yield* notRegularFile(resolved);
+  const size = (info[8] ?? 0) * 2 ** 32 + (info[9] ?? 0);
+  const bytes = yield* sync(() => new Uint8Array(size));
+  const read = new Uint32Array(1);
+  let offset = 0;
+  while (offset < size) {
+    const at = offset;
+    const ok = yield* sync(() =>
+      symbols.ReadFile(handle, bytes.subarray(at), size - at, read, null),
+    );
+    if (ok === 0 || read[0] === undefined || read[0] === 0) return yield* unreadable;
+    offset += read[0];
+  }
+  return bytes;
+}, Effect.scoped);
+
+/** Reads the file `path` resolves to while it stays inside `root`, like `content_path` in the CLI. */
+export const readContainedFile = (
+  path: string,
+  root: string,
+): Effect.Effect<Uint8Array, PlatformError> => {
+  const attempt = <A>(operation: () => Promise<A>) =>
+    Effect.tryPromise({
+      try: operation,
+      catch: (cause) => fileError(path, "Unknown", { cause }),
+    });
+  const windows = process.platform === "win32";
+  const read = Effect.gen(function* () {
+    const resolved = yield* attempt(() => realpath(path));
+    if (!containedIn(yield* attempt(() => realpath(root)), resolved, windows))
+      return yield* fileError(path, "BadResource", {
+        description: "Resolves outside the template root",
+      });
+    return yield* readResolvedFile(resolved, windows);
+  });
+  /* A retry reopens a file replaced mid-check. */
+  return read.pipe(
+    Effect.retry({ times: 2 }),
+    Effect.tap((bytes) => Effect.annotateCurrentSpan({ "template.bytes": bytes.length })),
+    Effect.tapError((error) =>
+      Effect.annotateCurrentSpan({
+        "template.refusal": error.reason.description ?? "unreadable",
+      }),
+    ),
+    Effect.withSpan("FileSystem.readContainedFile"),
+  );
+};
+
+/**
+ * Reads canonical `resolved` only through a handle that still names `resolved` and a regular file
+ * (`/dev/fd` on macOS and Linux, opened without following a link or blocking on a FIFO; the final
+ * handle path on Windows), so a swap after `realpath` is refused rather than read.
+ */
+export const readResolvedFile = (
+  resolved: string,
+  windows: boolean,
+): Effect.Effect<Uint8Array, PlatformError> => {
+  const attempt = <A>(operation: (signal: AbortSignal) => Promise<A>) =>
+    Effect.tryPromise({
+      try: operation,
+      catch: (cause) => fileError(resolved, "Unknown", { cause }),
+    });
+  if (windows) return readWindowsHandle(resolved);
+  return Effect.acquireUseRelease(
+    attempt(() => open(resolved, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)),
+    (handle) =>
+      Effect.gen(function* () {
+        const stats = yield* attempt(() => handle.stat());
+        /* On macOS, Bun resolves /dev/fd/N to the file; libc realpath doesn't, which refuses. */
+        const opened = stats.isFile()
+          ? yield* attempt(() => realpath(`/dev/fd/${handle.fd}`))
+          : undefined;
+        if (opened !== resolved) return yield* notRegularFile(resolved);
+        return yield* attempt((signal) => handle.readFile({ signal }));
+      }),
+    (handle) => attempt(() => handle.close()).pipe(Effect.ignore),
+  );
+};
+
 /** Removes a directory only if it is already empty; any other failure propagates. */
 export const removeEmptyDirectory = (directory: string): Effect.Effect<void, NamespaceError> =>
   Effect.tryPromise({
diff --git a/packages/stack/src/namespace/drivers/FileSystem.unit.test.ts b/packages/stack/src/namespace/drivers/FileSystem.unit.test.ts
new file mode 100644
index 0000000000..f73f1c3de1
--- /dev/null
+++ b/packages/stack/src/namespace/drivers/FileSystem.unit.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, it } from "@effect/vitest";
+import { containedIn, windowsFinalPath } from "./FileSystem.ts";
+
+describe("template containment", () => {
+  it("holds a resolved path at or below the root, never a sibling sharing its prefix", () => {
+    for (const path of ["/project", "/project/invite.html", "/project/a/b.html"])
+      expect(containedIn("/project", path, false), path).toBe(true);
+    for (const path of ["/projects/invite.html", "/project-other/x", "/", "/etc/passwd"])
+      expect(containedIn("/project", path, false), path).toBe(false);
+    expect(containedIn("/", "/etc/passwd", false)).toBe(true);
+  });
+
+  it("compares Windows paths case-insensitively with backslash separators", () => {
+    expect(containedIn("C:\\Project", "c:\\project\\invite.html", true)).toBe(true);
+    expect(containedIn("C:\\Project", "C:\\Projects\\invite.html", true)).toBe(false);
+    expect(containedIn("\\\\server\\share", "\\\\server\\share\\a.html", true)).toBe(true);
+  });
+});
+
+describe("Windows final handle path", () => {
+  it("drops the long-path prefix so it reads like realpath", () => {
+    expect(windowsFinalPath("\\\\?\\C:\\Project\\invite.html")).toBe("C:\\Project\\invite.html");
+    expect(windowsFinalPath("\\\\?\\UNC\\server\\share\\a.html")).toBe("\\\\server\\share\\a.html");
+    expect(windowsFinalPath("C:\\Project\\invite.html")).toBe("C:\\Project\\invite.html");
+  });
+});
diff --git a/packages/stack/src/port-reservation.e2e.test.ts b/packages/stack/src/port-reservation.e2e.test.ts
index 0b8fea5836..10f3881b8a 100644
--- a/packages/stack/src/port-reservation.e2e.test.ts
+++ b/packages/stack/src/port-reservation.e2e.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Cause, Context, Effect, Exit, FileSystem, Layer, Option } from "effect";
 import * as Net from "node:net";
@@ -17,7 +17,11 @@ import { selection } from "../tests/pins.ts";
  * or fails with a structured `PortConflict`, and destroy (but never stop or a kill) releases them.
  */
 
-const servicesLayer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const servicesLayer = Layer.mergeAll(
+  NodeServices.layer,
+  NodeCrypto.layer,
+  NodeHttpClient.layerNodeHttp,
+);
 const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   Effect.scoped(effect).pipe(Effect.provide(servicesLayer));
 
diff --git a/packages/stack/src/preparation/ArtifactStore.ts b/packages/stack/src/preparation/ArtifactStore.ts
index 9d62e9bcce..43502ebf51 100644
--- a/packages/stack/src/preparation/ArtifactStore.ts
+++ b/packages/stack/src/preparation/ArtifactStore.ts
@@ -1,14 +1,5 @@
-import {
-  Clock,
-  Crypto,
-  Effect,
-  FileSystem,
-  Option,
-  Path,
-  PlatformError,
-  Predicate,
-  Scope,
-} from "effect";
+import { Clock, Effect, FileSystem, Option, Path, PlatformError, Predicate, Scope } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
 import { ArtifactIntegrityError, PreparationError } from "./Errors.ts";
@@ -53,7 +44,8 @@ export interface ArtifactSource {
     PreparationError | ArtifactIntegrityError,
     | FileSystem.FileSystem
     | Path.Path
-    | Crypto.Crypto
+    | SecureRandom.SecureRandom
+    | Digest.Digest
     | ChildProcessSpawner.ChildProcessSpawner
     | HttpClient.HttpClient
   >;
@@ -646,7 +638,7 @@ const walkCache = (
 const retireGeneration = Effect.fn("ArtifactStore.retireGeneration")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
-  crypto: Crypto.Crypto,
+  crypto: SecureRandom.SecureRandom["Service"],
   keyRoot: string,
   digest: string,
 ): Effect.fn.Return<boolean, never> {
@@ -667,7 +659,7 @@ const retireGeneration = Effect.fn("ArtifactStore.retireGeneration")(function* (
             return undefined;
           if (yield* isSymlink(fs, stagingRoot)) return undefined;
           yield* fs.makeDirectory(stagingRoot, { recursive: true, mode: 0o700 });
-          const token = yield* crypto.randomUUIDv4;
+          const token = yield* crypto.uuidV4();
           const slotLockPath = stagingLockFor(path, stagingRoot, token);
           const slotDir = stagingDirFor(path, stagingRoot, token);
           const slotConnection = yield* acquireLock(slotLockPath, "create").pipe(
@@ -703,7 +695,7 @@ const retireGeneration = Effect.fn("ArtifactStore.retireGeneration")(function* (
 const sweepCache = Effect.fn("ArtifactStore.sweep")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
-  crypto: Crypto.Crypto,
+  crypto: SecureRandom.SecureRandom["Service"],
   cacheRoot: string,
 ): Effect.fn.Return<number, never> {
   const { generations, stagingRoots } = yield* walkCache(fs, path, cacheRoot);
@@ -776,7 +768,8 @@ const isPublishTargetTaken = (cause: unknown): boolean =>
 const publishGeneration = Effect.fn("ArtifactStore.publish")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
-  crypto: Crypto.Crypto,
+  crypto: SecureRandom.SecureRandom["Service"],
+  digest: Digest.Digest["Service"],
   childProcessSpawner: ChildProcessSpawner.ChildProcessSpawner["Service"],
   cacheRoot: string,
   source: ArtifactSource,
@@ -789,14 +782,7 @@ const publishGeneration = Effect.fn("ArtifactStore.publish")(function* (
     "create artifact staging root",
     fs.makeDirectory(resolved.stagingRoot, { recursive: true, mode: 0o700 }),
   );
-  const token = yield* crypto.randomUUIDv4.pipe(
-    Effect.mapError((cause) =>
-      artifactError(`Unable to allocate artifact staging name: ${cause.message}`, {
-        key: request.key,
-        cause,
-      }),
-    ),
-  );
+  const token = yield* crypto.uuidV4();
   const stagingDir = stagingDirFor(path, resolved.stagingRoot, token);
   const stagingLockPath = stagingLockFor(path, resolved.stagingRoot, token);
   const content = path.join(stagingDir, STAGING_CONTENT_NAME);
@@ -823,7 +809,8 @@ const publishGeneration = Effect.fn("ArtifactStore.publish")(function* (
       yield* source.materialize(request, content, resolved.expectedSha256, onProgress).pipe(
         Effect.provideService(FileSystem.FileSystem, fs),
         Effect.provideService(Path.Path, path),
-        Effect.provideService(Crypto.Crypto, crypto),
+        Effect.provideService(SecureRandom.SecureRandom, crypto),
+        Effect.provideService(Digest.Digest, digest),
         // The source owns the exact tar process boundary; the store only supplies the
         // already-owned process service captured by its constructor.
         Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, childProcessSpawner),
@@ -905,7 +892,8 @@ const publishGeneration = Effect.fn("ArtifactStore.publish")(function* (
 const prepareOrResolve = Effect.fn("ArtifactStore.prepareOrResolve")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
-  crypto: Crypto.Crypto,
+  crypto: SecureRandom.SecureRandom["Service"],
+  digest: Digest.Digest["Service"],
   childProcessSpawner: ChildProcessSpawner.ChildProcessSpawner["Service"],
   cacheRoot: string,
   source: ArtifactSource,
@@ -920,6 +908,7 @@ const prepareOrResolve = Effect.fn("ArtifactStore.prepareOrResolve")(function* (
     fs,
     path,
     crypto,
+    digest,
     childProcessSpawner,
     cacheRoot,
     source,
@@ -936,7 +925,8 @@ export const makeArtifactStore = Effect.fn("ArtifactStore.makeStore")(function*
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
+  const digest = yield* Digest.Digest;
   const childProcessSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   if (options.cacheRoot.trim().length === 0)
     return yield* artifactError("Artifact cache root must not be blank");
@@ -991,6 +981,7 @@ export const makeArtifactStore = Effect.fn("ArtifactStore.makeStore")(function*
             fs,
             path,
             crypto,
+            digest,
             childProcessSpawner,
             cacheRoot,
             options.source,
@@ -1034,6 +1025,7 @@ export const makeArtifactStore = Effect.fn("ArtifactStore.makeStore")(function*
       fs,
       path,
       crypto,
+      digest,
       childProcessSpawner,
       cacheRoot,
       options.source,
diff --git a/packages/stack/src/preparation/Integrity.ts b/packages/stack/src/preparation/Integrity.ts
index a376dc6618..c7ef36862d 100644
--- a/packages/stack/src/preparation/Integrity.ts
+++ b/packages/stack/src/preparation/Integrity.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect } from "effect";
+import { Effect } from "effect";
+import { Digest } from "effect/crypto";
 import { ArtifactIntegrityError, PreparationError } from "./Errors.ts";
 
 const SHA256 = /^[0-9a-f]{64}$/i;
@@ -25,14 +26,8 @@ export const verifySha256 = Effect.fn("Integrity.verifySha256")(function* (
 ) {
   yield* Effect.gen(function* () {
     const canonical = yield* validateSha256(expected);
-    const crypto = yield* Crypto.Crypto;
-    const digest = yield* crypto
-      .digest("SHA-256", bytes)
-      .pipe(
-        Effect.mapError((cause) =>
-          integrityError("Unable to compute artifact SHA-256", { expected: canonical, cause }),
-        ),
-      );
+    const crypto = yield* Digest.Digest;
+    const digest = yield* crypto.digest(Digest.sha256, bytes);
     const actual = digestHex(digest);
     if (actual !== canonical)
       return yield* integrityError(`expected ${canonical}, got ${actual}`, {
diff --git a/packages/stack/src/preparation/PrepareSelection.ts b/packages/stack/src/preparation/PrepareSelection.ts
index 126036bf5d..e0e69afa3e 100644
--- a/packages/stack/src/preparation/PrepareSelection.ts
+++ b/packages/stack/src/preparation/PrepareSelection.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect, FileSystem, Path } from "effect";
+import { Effect, FileSystem, Path } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import type { HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
 import {
@@ -36,7 +37,8 @@ type Preparer = (
   ArtifactError | ContainerError,
   | FileSystem.FileSystem
   | Path.Path
-  | Crypto.Crypto
+  | SecureRandom.SecureRandom
+  | Digest.Digest
   | HttpClient.HttpClient
   | ChildProcessSpawner.ChildProcessSpawner
 >;
diff --git a/packages/stack/src/preparation/ReleaseResolver.integration.test.ts b/packages/stack/src/preparation/ReleaseResolver.integration.test.ts
index d587c76d3c..b550814b32 100644
--- a/packages/stack/src/preparation/ReleaseResolver.integration.test.ts
+++ b/packages/stack/src/preparation/ReleaseResolver.integration.test.ts
@@ -1,6 +1,7 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
-import { ConfigProvider, Crypto, Effect, Layer, Schema } from "effect";
+import { ConfigProvider, Effect, Layer, Schema } from "effect";
+import { Digest } from "effect/crypto";
 // oxlint-disable-next-line effecttsgo/node-builtin-import -- the fixture owns a local native listener.
 import { createServer, type Server } from "node:http";
 // oxlint-disable-next-line effecttsgo/node-builtin-import -- the fixture owns a local native listener.
@@ -93,8 +94,8 @@ const startResettingListener = Effect.acquireRelease(
 ).pipe(Effect.map(({ origin }) => origin));
 
 const sha256Of = Effect.fn(function* (text: string) {
-  const crypto = yield* Crypto.Crypto;
-  return digestHex(yield* crypto.digest("SHA-256", new TextEncoder().encode(text)));
+  const crypto = yield* Digest.Digest;
+  return digestHex(yield* crypto.digest(Digest.sha256, new TextEncoder().encode(text)));
 });
 
 interface Publication {
@@ -215,7 +216,7 @@ describe("release resolver", () => {
         const manifestRequest = fixture.requests.find(({ path }) => path.includes("/manifests/"));
         expect(manifestRequest?.authorization).toBe("Bearer anon");
         expect(manifestRequest?.accept).toContain("application/vnd.oci.image.index.v1+json");
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -239,7 +240,7 @@ describe("release resolver", () => {
         expect(pin.natives).toEqual(first.natives);
         expect(pin.image).toBe(`ghcr.io/supabase/cli/auth:v2.1.0-r0@${first.digest}`);
         expect(sumsRequests(fixture)).toEqual(["/releases/auth-v2.1.0-r0/SHA256SUMS"]);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -257,7 +258,7 @@ describe("release resolver", () => {
         const pin = yield* against(fixture, resolvePin({ service: "mail", upstream: "v1.31.0" }));
 
         expect(pin.upstreamImage).toBe("axllent/mailpit:v1.31.0");
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -288,7 +289,7 @@ describe("release resolver", () => {
           revision: 3,
           url: `${fixture.origin}/releases/storage-v1.0.0-r3/SHA256SUMS`,
         });
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -319,7 +320,7 @@ describe("release resolver", () => {
           status: row.status,
           url: expect.stringContaining(row.path),
         });
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -337,7 +338,7 @@ describe("release resolver", () => {
           _tag: "ReleaseTransient",
           url: expect.stringContaining(resetting),
         });
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -354,7 +355,7 @@ describe("release resolver", () => {
         const pin = yield* against(fixture, resolvePin({ service: "pgmeta", upstream: "v1.0.0" }));
 
         expect(pin.revision).toBe(row.expected);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -456,7 +457,7 @@ describe("release resolver", () => {
           expect(error).toMatchObject({ expected: expect.stringMatching(/^[0-9a-f]{64}$/u) });
         if (row.digests === "registry-header")
           expect(error).toMatchObject({ expected: `sha256:${"c".repeat(64)}` });
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 });
diff --git a/packages/stack/src/preparation/ReleaseResolver.ts b/packages/stack/src/preparation/ReleaseResolver.ts
index bd0fe87592..586fea4dee 100644
--- a/packages/stack/src/preparation/ReleaseResolver.ts
+++ b/packages/stack/src/preparation/ReleaseResolver.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect, Option, Record, Schema } from "effect";
+import { Effect, Option, Record, Schema } from "effect";
+import { Digest } from "effect/crypto";
 import { Headers, HttpClient, HttpClientRequest } from "effect/http";
 import {
   artifactSourceService,
@@ -154,17 +155,9 @@ const unexpectedStatus = (subject: Subject, url: string, status: number) =>
     status,
   });
 
-const sha256Hex = Effect.fnUntraced(function* (subject: Subject, url: string, bytes: Uint8Array) {
-  const crypto = yield* Crypto.Crypto;
-  return digestHex(
-    yield* crypto
-      .digest("SHA-256", bytes)
-      .pipe(
-        Effect.mapError((cause) =>
-          integrity(subject, url, `Unable to compute SHA-256: ${String(cause)}`),
-        ),
-      ),
-  );
+const sha256Hex = Effect.fnUntraced(function* (bytes: Uint8Array) {
+  const crypto = yield* Digest.Digest;
+  return digestHex(yield* crypto.digest(Digest.sha256, bytes));
 });
 
 const decodeJson = <S extends Schema.Decoder<unknown>>(
@@ -290,7 +283,7 @@ const verifyTarget = Effect.fnUntraced(function* (
   if (fetched.status === 404)
     return yield* integrity(subject, url, `Published release has no ${stem}.manifest.json`);
   if (!isOk(fetched.status)) return yield* unexpectedStatus(subject, url, fetched.status);
-  const actual = yield* sha256Hex(subject, url, fetched.bytes);
+  const actual = yield* sha256Hex(fetched.bytes);
   if (actual !== manifest)
     return yield* integrity(subject, url, "Manifest does not match SHA256SUMS", {
       expected: manifest,
@@ -327,7 +320,7 @@ const resolveUpstreamImage = Effect.fn("ReleaseResolver.resolveUpstreamImage")(f
     if (fetched.status === 404)
       return yield* integrity(subject, url, "Published release has no oci-provenance file");
     if (!isOk(fetched.status)) return yield* unexpectedStatus(subject, url, fetched.status);
-    const actual = yield* sha256Hex(subject, url, fetched.bytes);
+    const actual = yield* sha256Hex(fetched.bytes);
     if (actual !== expected)
       return yield* integrity(subject, url, "oci-provenance does not match SHA256SUMS", {
         expected,
@@ -385,7 +378,7 @@ const imageDigest = Effect.fn("ReleaseResolver.imageDigest")(function* (
   if (fetched.status === 404)
     return yield* integrity(subject, url, `Published release has no image ${repository}:${tag}`);
   if (!isOk(fetched.status)) return yield* unexpectedStatus(subject, url, fetched.status);
-  const actual = `sha256:${yield* sha256Hex(subject, url, fetched.bytes)}`;
+  const actual = `sha256:${yield* sha256Hex(fetched.bytes)}`;
   if (fetched.digestHeader !== undefined && fetched.digestHeader !== actual)
     return yield* integrity(subject, url, "Registry digest does not match the manifest body", {
       expected: fetched.digestHeader,
diff --git a/packages/stack/src/preparation/artifacts.integration.test.ts b/packages/stack/src/preparation/artifacts.integration.test.ts
index f389d016b3..eb1f8219f2 100644
--- a/packages/stack/src/preparation/artifacts.integration.test.ts
+++ b/packages/stack/src/preparation/artifacts.integration.test.ts
@@ -1,8 +1,7 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
-  Crypto,
   Data,
   DateTime,
   Deferred,
@@ -18,6 +17,7 @@ import {
   Scope,
   Stream,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
@@ -28,7 +28,7 @@ import { ArtifactIntegrityError, PreparationError } from "./Errors.ts";
 import { makeArtifactStore, type ArtifactRequest, type ArtifactSource } from "./ArtifactStore.ts";
 import { verifySha256 } from "./Integrity.ts";
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 const archive = new TextEncoder().encode("archive");
 const archiveSha256 = "0eb3e36bfb24dcd9bb1d1bece1531216b59539a8fde17ee80224af0653c92aa3";
 const request: ArtifactRequest = {
@@ -64,8 +64,7 @@ const sourceWriting = (bytes: Uint8Array = archive): ArtifactSource => ({
       yield* fs.makeDirectory(`${destination}/etc`, { recursive: true });
       yield* fs.writeFileString(`${destination}/bin/postgres`, "native postgres", { mode: 0o755 });
       yield* fs.writeFileString(`${destination}/etc/postgres.conf`, "config", { mode: 0o644 });
-      const crypto = yield* Crypto.Crypto;
-      yield* verifySha256(bytes, expectedSha256).pipe(Effect.provideService(Crypto.Crypto, crypto));
+      yield* verifySha256(bytes, expectedSha256);
     }).pipe(mapMaterializeError),
 });
 
@@ -83,18 +82,15 @@ const sourceWritingAlt = (): ArtifactSource => ({
         mode: 0o755,
       });
       yield* fs.writeFileString(`${destination}/etc/postgres.conf`, "config alt", { mode: 0o644 });
-      const crypto = yield* Crypto.Crypto;
-      yield* verifySha256(archiveAlt, expectedSha256).pipe(
-        Effect.provideService(Crypto.Crypto, crypto),
-      );
+      yield* verifySha256(archiveAlt, expectedSha256);
     }).pipe(mapMaterializeError),
 });
 
 /** A cache miss under a fresh key: the only event that triggers a retirement sweep. */
 const triggerSweep = (root: string) =>
   Effect.gen(function* () {
-    const crypto = yield* Crypto.Crypto;
-    const key = `database/postgres-sweep-${yield* crypto.randomUUIDv4}`;
+    const crypto = yield* SecureRandom.SecureRandom;
+    const key = `database/postgres-sweep-${yield* crypto.uuidV4()}`;
     const store = yield* makeArtifactStore({ cacheRoot: root, source: sourceWritingAlt() });
     return yield* store.prepare({ ...request, key });
   });
@@ -564,10 +560,7 @@ describe("a required path missing from the archive", () => {
         yield* fs.writeFileString(`${destination}/bin/postgres`, "native postgres", {
           mode: 0o755,
         });
-        const crypto = yield* Crypto.Crypto;
-        yield* verifySha256(archive, expectedSha256).pipe(
-          Effect.provideService(Crypto.Crypto, crypto),
-        );
+        yield* verifySha256(archive, expectedSha256);
       }).pipe(mapMaterializeError),
   });
 
diff --git a/packages/stack/src/preparation/slim-services.integration.test.ts b/packages/stack/src/preparation/slim-services.integration.test.ts
index 26f28c3464..899551e961 100644
--- a/packages/stack/src/preparation/slim-services.integration.test.ts
+++ b/packages/stack/src/preparation/slim-services.integration.test.ts
@@ -1,9 +1,8 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
   ConfigProvider,
-  Crypto,
   Deferred,
   Duration,
   Effect,
@@ -14,6 +13,7 @@ import {
   Option,
   Schedule,
 } from "effect";
+import { Digest } from "effect/crypto";
 // oxlint-disable-next-line effecttsgo/node-builtin-import -- the redirect test owns a local native listener.
 import { createServer, type Server } from "node:http";
 import { zstdCompress } from "node:zlib";
@@ -80,8 +80,8 @@ const bucketMirror = {
 };
 
 const sha256Of = Effect.fn(function* (bytes: Uint8Array) {
-  const crypto = yield* Crypto.Crypto;
-  return digestHex(yield* crypto.digest("SHA-256", bytes));
+  const crypto = yield* Digest.Digest;
+  return digestHex(yield* crypto.digest(Digest.sha256, bytes));
 });
 
 /** Pins `base` to the digests of the given archive and manifest bytes. */
@@ -275,7 +275,11 @@ describe("slim-services artifact source", () => {
           redirected.sha256,
         );
         expect(yield* fs.readFileString(`${destination}/bin/demo`)).toBe("demo");
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
   );
 
@@ -302,7 +306,7 @@ describe("slim-services artifact source", () => {
         const cached = yield* withFetch(fetcher, store.prepare(request));
         expect(cached.outcome).toBe("cached");
         expect(requested).toHaveLength(2);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -341,7 +345,7 @@ describe("slim-services artifact source", () => {
         expect(yield* fs.readFileString(`${destination}/bin/demo`)).toBe("demo");
         expect(attempts.get(demo.mirrors[0].manifestUrl)).toBe(2);
         expect(attempts.get(demo.mirrors[0].downloadUrl)).toBe(2);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -384,7 +388,7 @@ describe("slim-services artifact source", () => {
         );
         expect(errorOf(failed)).toBeInstanceOf(PreparationError);
         expect(missing).toBe(1);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -412,7 +416,7 @@ describe("slim-services artifact source", () => {
           bucketMirror.manifestUrl,
           bucketMirror.downloadUrl,
         ]);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -446,7 +450,7 @@ describe("slim-services artifact source", () => {
           bucketMirror.manifestUrl,
           bucketMirror.downloadUrl,
         ]);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -480,7 +484,7 @@ describe("slim-services artifact source", () => {
           bucketMirror.manifestUrl,
           bucketMirror.downloadUrl,
         ]);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -514,7 +518,7 @@ describe("slim-services artifact source", () => {
             `expected ${mirrored.manifestSha256}, got ${yield* sha256Of(tamperedManifest)})`,
         );
         expect(yield* fs.exists(`${destination}/bin/demo`)).toBe(false);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -541,7 +545,7 @@ describe("slim-services artifact source", () => {
           "Slim-services manifest does not match the catalog artifact",
         );
         expect(requested).toEqual([demo.mirrors[0].manifestUrl]);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -560,7 +564,7 @@ describe("slim-services artifact source", () => {
         );
         expect(errorOf(failed)).toBeInstanceOf(PreparationError);
         expect(yield* fs.exists(`${destination}/outside`)).toBe(false);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -591,7 +595,7 @@ describe("slim-services artifact source", () => {
             .pipe(Effect.exit),
         );
         expect(errorOf(failed)).toBeInstanceOf(PreparationError);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -617,7 +621,7 @@ describe("slim-services artifact source", () => {
         );
         expect(errorOf(failed)).toBeInstanceOf(PreparationError);
         expect(yield* fs.exists(`${destination}/outside`)).toBe(false);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -649,7 +653,7 @@ describe("slim-services artifact source", () => {
         yield* Fiber.interrupt(fiber);
         expect(signal?.aborted).toBe(true);
         expect(yield* fs.readDirectory(destination)).toEqual([]);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -677,7 +681,7 @@ describe("slim-services artifact source", () => {
         current = demo;
         const prepared = yield* withFetch(fetcher, store.prepare(request));
         expect(yield* fs.readFileString(`${prepared.path}/bin/demo`)).toBe("demo");
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -726,7 +730,7 @@ describe("slim-services artifact source", () => {
         expect(signal?.aborted).toBe(true);
         expect(canceled).toBe(true);
         expect(yield* fs.readDirectory(destination)).toEqual([]);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -763,7 +767,7 @@ describe("slim-services artifact source", () => {
         yield* Fiber.interrupt(fiber);
         expect(destroyed).toBe(true);
         expect(yield* fs.readDirectory(destination)).toEqual([]);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -780,7 +784,7 @@ describe("slim-services artifact source", () => {
           makeSlimServicesSource(() => demo).materialize(request, destination, demo.sha256),
         );
         expect(yield* fs.exists(`${destination}/${longName}`)).toBe(true);
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 });
@@ -829,7 +833,7 @@ describe("native artifact catalog", () => {
           expect(message).toContain(
             `${bucket}/${asset}.tar.zst (Slim-services manifest does not match its pin`,
           );
-        }).pipe(Effect.provide(NodeServices.layer)),
+        }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
       ),
   );
 
@@ -861,7 +865,7 @@ describe("native artifact catalog", () => {
         expect(requested[0]).toBe(
           `https://releases.fixture.test/base/postgrest-${releaseVersion}/${asset}.manifest.json`,
         );
-      }).pipe(Effect.provide(NodeServices.layer)),
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     ),
   );
 
@@ -897,7 +901,7 @@ describe("native artifact catalog", () => {
           expect(prepared.root).toBe(seeded.path);
           expect(yield* fs.readFileString(prepared.executable)).toBe("pinned");
           expect(requested).toEqual([]);
-        }).pipe(Effect.provide(NodeServices.layer)),
+        }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
       ),
   );
 
diff --git a/packages/stack/src/public.e2e.test.ts b/packages/stack/src/public.e2e.test.ts
index 553c4db161..641ac9ba3d 100644
--- a/packages/stack/src/public.e2e.test.ts
+++ b/packages/stack/src/public.e2e.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, expectTypeOf, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Path, Redacted, Schema, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
@@ -371,7 +371,9 @@ it.live(
       );
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 180_000 },
 );
@@ -435,7 +437,9 @@ it.live(
       );
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 60_000 },
 );
diff --git a/packages/stack/src/runtime/Container.integration.test.ts b/packages/stack/src/runtime/Container.integration.test.ts
index 3cd82ba7b4..c431ac9791 100644
--- a/packages/stack/src/runtime/Container.integration.test.ts
+++ b/packages/stack/src/runtime/Container.integration.test.ts
@@ -1,10 +1,9 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
   ConfigProvider,
   Context,
-  Crypto,
   Data,
   Deferred,
   Effect,
@@ -21,6 +20,7 @@ import {
   Sink,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { TestClock } from "effect/testing";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import type { ChildProcessSpawner as ChildProcessSpawnerService } from "effect/process/ChildProcessSpawner";
@@ -90,7 +90,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
       );
       expect(ensured).toEqual({ image: pinnedImage, pulled: false });
       expect(yield* Ref.get(pullAttempted)).toBe(false);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   for (const [engine, stderr] of [
@@ -108,7 +108,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
       () =>
         Effect.gen(function* () {
           const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-          const token = yield* (yield* Crypto.Crypto).randomUUIDv4;
+          const token = yield* (yield* SecureRandom.SecureRandom).uuidV4();
           const spawner = makePullFailureSpawner(delegate, yield* Ref.make(false), stderr);
           const result = yield* makeContainerRuntime({ target: containerTarget, root: "." }).pipe(
             Effect.flatMap((runtime) =>
@@ -118,14 +118,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           );
           if (Exit.isSuccess(result)) return yield* Effect.die("pull unexpectedly succeeded");
           expect(failureKind(result.cause)).toBe("engine-unavailable");
-        }).pipe(Effect.provide(NodeServices.layer)),
+        }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
   it.live("keeps missing image pull failures observable", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const pullAttempted = yield* Ref.make(false);
       const spawner = makePullFailureSpawner(delegate, pullAttempted);
       const result = yield* makeContainerRuntime({
@@ -143,7 +143,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(Cause.pretty(result.cause)).toContain("pull rejected");
         expect(failureKind(result.cause)).toBe("image-pull");
       }
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("prepares, launches, streams, waits, and removes one exact container", () =>
@@ -181,7 +181,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
       );
       expect(yield* exists(id)).toBe(false);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("streams tool input and output and preserves a nonzero exit", () =>
@@ -222,7 +222,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
       );
       expect(yield* exists(id)).toBe(false);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("maps the stack host alias to an explicit IPv4 host gateway only", () =>
@@ -257,7 +257,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           `${DOCKER_HOST_ALIAS}:${addresses[0]}`,
         );
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("probes the host gateway once for concurrent launches across runtimes", () =>
@@ -300,7 +300,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           expect(aliases[0]?.slice(DOCKER_HOST_ALIAS.length + 1)).toMatch(ipv4);
         }
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("launches without awaiting a background probe that later launches share", () =>
@@ -345,7 +345,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(aliases[0]?.slice(DOCKER_HOST_ALIAS.length + 1)).toMatch(ipv4);
         expect(yield* Ref.get(probes)).toBe(1);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("maps the host alias to the IPv4 gateway listed after an IPv6 one", () =>
@@ -380,7 +380,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           `${DOCKER_HOST_ALIAS}:192.168.65.254`,
         );
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("falls back to host-gateway without reprobing when the gateway has no IPv4 address", () =>
@@ -418,7 +418,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }
         expect(yield* Ref.get(probes)).toBe(1);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("retries a probe whose image lacks cat before launching", () =>
@@ -457,7 +457,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(aliases[0]?.slice(DOCKER_HOST_ALIAS.length + 1)).toMatch(ipv4);
         expect(yield* Ref.get(probes)).toBe(2);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("maps the host alias to the engine's own host address when it rejects host-gateway", () =>
@@ -489,7 +489,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(yield* inspectExtraHosts(process.id)).toContain(`${DOCKER_HOST_ALIAS}:10.88.0.1`);
         expect(yield* Ref.get(probes)).toBe(2);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("retries the engine host probe after it fails transiently", () =>
@@ -525,7 +525,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(yield* inspectExtraHosts(process.id)).toContain(`${DOCKER_HOST_ALIAS}:10.88.0.1`);
         expect(yield* Ref.get(probes)).toBe(4);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("fails launches actionably when an engine rejecting host-gateway maps no IPv4 host", () =>
@@ -563,7 +563,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         );
       }
       expect(yield* Ref.get(probes)).toBe(2);
-    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.scoped, Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("recreates an unawaited launch the engine rejects for host-gateway", () =>
@@ -598,7 +598,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(yield* inspectExtraHosts(process.id)).toContain(`${DOCKER_HOST_ALIAS}:10.88.0.1`);
         expect(yield* Ref.get(probes)).toBe(2);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("names and labels a service container for compose-style grouping", () =>
@@ -626,7 +626,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(labels["com.docker.compose.service"]).toBe("auth");
         expect(labels["com.docker.compose.oneoff"]).toBeUndefined();
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("marks a one-shot container's name and compose labels as a task", () =>
@@ -653,7 +653,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(labels["com.docker.compose.service"]).toBe("auth");
         expect(labels["com.docker.compose.oneoff"]).toBe("True");
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("labels a created container with the configured test run", () =>
@@ -665,8 +665,8 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           hostGateway: sharedHostGateway,
         });
         yield* runtime.prepare(image);
-        const crypto = yield* Crypto.Crypto;
-        const testRunId = `container-test-run-${(yield* crypto.randomUUIDv4).slice(0, 8)}`;
+        const crypto = yield* SecureRandom.SecureRandom;
+        const testRunId = `container-test-run-${(yield* crypto.uuidV4()).slice(0, 8)}`;
         const process = yield* runtime
           .launch({
             image,
@@ -685,7 +685,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         const labels = yield* inspectLabels(process.id);
         expect(labels["com.supabase.stack-test-run"]).toBe(testRunId);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live(
@@ -728,7 +728,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           yield* Fiber.interrupt(firstReady);
           yield* Fiber.interrupt(secondReady);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("stops a container with its configured stop signal", () =>
@@ -758,7 +758,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
 
       yield* process.remove;
       yield* Fiber.interrupt(logs);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("waits until a discarded container stops before returning", () =>
@@ -788,7 +788,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
       yield* process.remove;
       expect(yield* exists(process.id)).toBe(false);
       yield* Fiber.interrupt(logs);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("returns cleanup authority when container start fails", () =>
@@ -820,7 +820,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         yield* failure.value.process.remove;
         expect(yield* exists(id)).toBe(false);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live(
@@ -872,7 +872,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           yield* failure.process.remove;
           expect(yield* exists(started[2]!)).toBe(false);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live(
@@ -920,7 +920,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           expect(yield* fs.exists(envFiles[0]!)).toBe(false);
           expect(yield* fs.exists(envFiles[1]!)).toBe(true);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("keeps exit observation shared after a caller cancels its wait", () =>
@@ -950,7 +950,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(yield* process.exitCode).toBe(23);
         yield* Fiber.interrupt(logs);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("releases a log follower that exits while its container keeps running", () =>
@@ -991,7 +991,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(yield* running(process.id)).toBe(true);
         yield* process.discard;
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("releases a still running log follower when its launch scope closes", () =>
@@ -1023,13 +1023,13 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
       );
       expect(yield* Deferred.isDone(released)).toBe(true);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("treats an externally removed container as already stopped", () =>
     Effect.gen(function* () {
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `externally-removed-${token}`;
       yield* Effect.ensuring(
         Effect.scoped(
@@ -1055,14 +1055,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         ),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("confirms absence after the remove client loses its result", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `lost-remove-result-${token}`;
       const lostResult = yield* Ref.make(false);
       const spawner = makeLostRemoveResultSpawner(delegate, lostResult);
@@ -1096,14 +1096,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("retains a remove failure for a still-present non-removing container", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `failed-remove-${token}`;
       const failed = yield* Ref.make(false);
       const spawner = makeRemoveFailureSpawner(delegate, failed);
@@ -1141,14 +1141,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("retains both remove and reconciliation failures", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `failed-reconciliation-${token}`;
       const failed = yield* Ref.make(false);
       const failProbe = yield* Ref.make(true);
@@ -1189,14 +1189,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("waits for a real removal observed as removing", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `pending-remove-${token}`;
       const pendingProbes = yield* Ref.make(2);
       const lostResult = yield* Ref.make(false);
@@ -1232,14 +1232,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("retains the remove failure when removing never reaches absence", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `stalled-remove-${token}`;
       const pendingProbes = yield* Ref.make(Number.POSITIVE_INFINITY);
       const lostResult = yield* Ref.make(false);
@@ -1283,14 +1283,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("preserves caller interruption and reconciles during scope close", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `interrupted-remove-${token}`;
       const completed = yield* Deferred.make<void>();
       const consumed = yield* Ref.make(false);
@@ -1331,7 +1331,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("reports a scope failure when stop fails and leaves cleanup authority", () =>
@@ -1340,8 +1340,8 @@ describe("container process adapter", { timeout: 120_000 }, () => {
       const failStop = yield* Ref.make(true);
       const processRef = yield* Ref.make<Option.Option<ContainerProcess>>(Option.none());
       const spawner = makeStopFailureSpawner(delegate, failStop);
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `failed-stop-${token}`;
       yield* Effect.ensuring(
         Effect.gen(function* () {
@@ -1390,14 +1390,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("retains cleanup authority when create reports failure after creating a container", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `failed-create-after-commit-${token}`;
       const created = yield* Ref.make(false);
       const spawner = makeCreateFailureSpawner(delegate, created, true);
@@ -1434,14 +1434,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         ).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner)),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("retains cleanup authority when create fails without creating a container", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `failed-create-empty-${token}`;
       const created = yield* Ref.make(false);
       const spawner = makeCreateFailureSpawner(delegate, created, false);
@@ -1478,14 +1478,14 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         }),
         removeByInstance(instanceId).pipe(Effect.orDie),
       );
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("retains cleanup authority when create is cancelled before its result is exposed", () =>
     Effect.gen(function* () {
       const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const crypto = yield* Crypto.Crypto;
-      const token = yield* crypto.randomUUIDv4;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const token = yield* crypto.uuidV4();
       const instanceId = `pending-create-${token}`;
       const started = yield* Deferred.make<void>();
       const release = yield* Deferred.make<void>();
@@ -1520,7 +1520,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
       ).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner));
       expect(Exit.isFailure(result)).toBe(true);
       expect(yield* Ref.get(present)).toBe(false);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.effect("bounds a hung docker create and removes the container it may still create", () =>
@@ -1546,7 +1546,35 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         failure instanceof ContainerLaunchError ? failure.failure.message : undefined,
       ).toContain("did not respond");
       expect(engine.commands).toContainEqual(["rm", "--force", engine.createdName()]);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
+  );
+
+  it.effect(
+    "names the stalled engine subcommand and its stderr when an engine command times out",
+    () =>
+      Effect.gen(function* () {
+        const engine = yield* makeStalledStartSpawner("Error: waiting for network sandbox");
+        const runtime = yield* makeContainerRuntime({
+          target: containerTarget,
+          root: ".",
+          hostGateway: sharedHostGateway,
+        }).pipe(Effect.provide(engine.layer));
+        const launch = yield* Effect.scoped(
+          runtime.launch({ image, stackId: "s".repeat(64), instanceId: "stalled-start", env: {} }),
+        ).pipe(Effect.provide(engine.layer), Effect.exit, Effect.forkChild);
+        yield* Deferred.await(engine.stderrRead);
+        yield* TestClock.adjust("30 seconds");
+        const result = yield* Fiber.join(launch);
+
+        const failure = Exit.isFailure(result)
+          ? Option.getOrUndefined(Cause.findErrorOption(result.cause))
+          : undefined;
+        expect(failure instanceof ContainerLaunchError).toBe(true);
+        expect(failureKind(failure)).toBe("engine-timeout");
+        expect(failure instanceof ContainerLaunchError ? failure.failure.message : undefined).toBe(
+          "Engine command 'start' did not finish within 30s; stderr: Error: waiting for network sandbox",
+        );
+      }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.effect("removes the container a hung docker create may still create when interrupted", () =>
@@ -1565,7 +1593,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
       expect(Exit.hasInterrupts(yield* Fiber.await(launch))).toBe(true);
       expect(engine.createdName()).toMatch(/^supabase-/u);
       expect(engine.commands).toContainEqual(["rm", "--force", engine.createdName()]);
-    }).pipe(Effect.provide(NodeServices.layer)),
+    }).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live(
@@ -1591,17 +1619,18 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         const spawner = ChildProcessSpawner.make((command) => {
           if (!ChildProcess.isStandardCommand(command) || command.command !== "docker")
             return Effect.die("Unexpected command");
-          if (command.args[0] === "context" && command.args[1] === "show") {
-            contextCalls.push(command.args);
+          const args = command.args.map(String);
+          if (args[0] === "context" && args[1] === "show") {
+            contextCalls.push(args);
             return Effect.succeed(handle(0, `${activeContext}\n`));
           }
           // Identity is resolved through the same pinned context, so "info" arrives prefixed with
           // the `--context <name>` pin this very call resolved, by name, not by endpoint: pinning
           // by name (rather than an inspected endpoint) is what keeps a TLS context's own
           // certificate material intact for this and every later invocation.
-          if (command.args[0] === "--context" && command.args[2] === "info")
-            return Effect.succeed(handle(0, `daemon-at-${command.args[1]}`));
-          return Effect.die(`Unexpected docker command: ${command.args.join(" ")}`);
+          if (args[0] === "--context" && args[2] === "info")
+            return Effect.succeed(handle(0, `daemon-at-${args[1]}`));
+          return Effect.die(`Unexpected docker command: ${args.join(" ")}`);
         });
         const target = yield* resolveEngineTarget(spawner, "docker");
         // Simulates `docker context use beta` run elsewhere, after this target was resolved.
@@ -1622,7 +1651,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "engine-target-pin-" });
         const commands: Array<ReadonlyArray<string>> = [];
         let activeContext = "alpha";
@@ -1648,11 +1677,11 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         const spawner = ChildProcessSpawner.make((command) => {
           if (!ChildProcess.isStandardCommand(command) || command.command !== "docker")
             return Effect.die("Unexpected command");
-          commands.push(command.args);
+          commands.push(command.args.map(String));
           if (command.args[0] === "context" && command.args[1] === "show")
             return Effect.succeed(handle(0, `${activeContext}\n`));
           // Every other call carries the `--context <name>` pin this test's resolution produced.
-          const unpinned = command.args.slice(2);
+          const unpinned = command.args.slice(2).map(String);
           if (unpinned[0] === "info") return Effect.succeed(handle(0, "fake-daemon-id"));
           if (unpinned[0] === "version") return Effect.succeed(handle(0, "27.0.0|27.0.0"));
           if (unpinned[0] === "inspect")
@@ -1709,6 +1738,7 @@ describe("container process adapter", { timeout: 120_000 }, () => {
           fs,
           path,
           crypto,
+          digest: yield* Digest.Digest,
           container,
           spawner,
         });
@@ -1754,7 +1784,11 @@ describe("container process adapter", { timeout: 120_000 }, () => {
         expect(commands.some((args) => args.includes("rm") && args.includes(orphanId))).toBe(true);
       }).pipe(
         Effect.provide(
-          Layer.merge(NodeServices.layer, ConfigProvider.layer(ConfigProvider.fromEnvRecord({}))),
+          Layer.mergeAll(
+            NodeServices.layer,
+            NodeCrypto.layer,
+            ConfigProvider.layer(ConfigProvider.fromEnvRecord({})),
+          ),
         ),
       ),
   );
@@ -1833,7 +1867,7 @@ const makeFailingStartSpawner = (
   const spawner = ChildProcessSpawner.make((command) => {
     if (ChildProcess.isStandardCommand(command) && command.command === testEngine) {
       const envFile = command.args[command.args.indexOf("--env-file") + 1];
-      if (command.args[0] === "create" && envFile !== undefined) envFiles.push(envFile);
+      if (command.args[0] === "create" && typeof envFile === "string") envFiles.push(envFile);
     }
     if (
       !ChildProcess.isStandardCommand(command) ||
@@ -1841,7 +1875,7 @@ const makeFailingStartSpawner = (
       command.args[0] !== "start"
     )
       return delegate.spawn(command);
-    started.push(String(command.args.at(-1)));
+    started.push(String(command.args.map(String).at(-1)));
     return started.length > failures
       ? delegate.spawn(command)
       : delegate.spawn(
@@ -1994,7 +2028,7 @@ const makeRemoveFailureSpawner = (
       command.args[0] === "ps" &&
       // Excludes the host-gateway probe's own throwaway "-task-" container, created and awaited
       // absent during `launch`, before this test's own instance container ever reaches `remove`.
-      command.args.some((arg) => arg.startsWith("name=^/?") && !arg.includes("-task-"))
+      command.args.map(String).some((arg) => arg.startsWith("name=^/?") && !arg.includes("-task-"))
     ) {
       return Effect.gen(function* () {
         if (!(yield* Ref.get(failProbe))) return yield* delegate.spawn(command);
@@ -2040,7 +2074,7 @@ const makePendingRemoveSpawner = (
       command.args[0] === "ps" &&
       // Excludes the host-gateway probe's own throwaway "-task-" container, created and awaited
       // absent during `launch`, before this test's own instance container ever reaches `remove`.
-      command.args.some((arg) => arg.startsWith("name=^/?") && !arg.includes("-task-"))
+      command.args.map(String).some((arg) => arg.startsWith("name=^/?") && !arg.includes("-task-"))
     ) {
       return Effect.gen(function* () {
         const remaining = yield* Ref.get(pendingProbes);
@@ -2202,12 +2236,45 @@ const successfulHandle = (stdout = "") =>
     unref: Effect.succeed(Effect.void),
   });
 
+/** Answers every engine command except `start`, which writes `stderr` and never exits. */
+const makeStalledStartSpawner = Effect.fn("ContainerTest.stalledStartSpawner")(function* (
+  stderr: string,
+) {
+  const stderrRead = yield* Deferred.make<void>();
+  const spawner = ChildProcessSpawner.make((command) => {
+    if (!ChildProcess.isStandardCommand(command)) return Effect.die("unexpected piped command");
+    if (command.args[0] === "info") return Effect.succeed(successfulHandle("fake-daemon-id"));
+    if (command.args[0] !== "start") return Effect.succeed(successfulHandle());
+    // The second pull only happens once the reader has consumed the stderr line.
+    const stalledStderr = Stream.succeed(new TextEncoder().encode(stderr)).pipe(
+      Stream.concat(Stream.fromEffectDrain(Deferred.succeed(stderrRead, undefined))),
+      Stream.concat(Stream.never),
+    );
+    return Effect.succeed(
+      ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(0),
+        exitCode: Effect.never,
+        isRunning: Effect.succeed(true),
+        kill: () => Effect.void,
+        stdin: Sink.drain,
+        stdout: Stream.empty,
+        stderr: stalledStderr,
+        all: Stream.empty,
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+        unref: Effect.succeed(Effect.void),
+      }),
+    );
+  });
+  return { stderrRead, layer: Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner) };
+});
+
 const makeHangingCreateSpawner = Effect.fn("ContainerTest.hangingCreateSpawner")(function* () {
   const commands: string[][] = [];
   const createStarted = yield* Deferred.make<void>();
   const spawner = ChildProcessSpawner.make((command) => {
     if (!ChildProcess.isStandardCommand(command)) return Effect.die("unexpected piped command");
-    commands.push([...command.args]);
+    commands.push(command.args.map(String));
     if (command.args[0] === "info") return Effect.succeed(successfulHandle("fake-daemon-id"));
     if (command.args[0] !== "create") return Effect.succeed(successfulHandle());
     // The engine never answers create; the real daemon may or may not have committed it.
diff --git a/packages/stack/src/runtime/Container.ts b/packages/stack/src/runtime/Container.ts
index 7e64d2ae34..57842c385e 100644
--- a/packages/stack/src/runtime/Container.ts
+++ b/packages/stack/src/runtime/Container.ts
@@ -2,10 +2,9 @@ import { withAttemptCount } from "../internal/attempts.ts";
 import {
   Cause,
   Config,
-  Crypto,
   Data,
   Deferred,
-  type Duration,
+  Duration,
   Effect,
   Exit,
   FileSystem,
@@ -20,6 +19,7 @@ import {
   Sink,
   Stream,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import type { StackFailureKind } from "../FailureKind.ts";
 import { testRunLabelArgs as readTestRunLabelArgs } from "../internal/test-run-label.ts";
@@ -134,6 +134,18 @@ const engineKind = (
           ? "port-allocation"
           : undefined;
 
+/** Names the stalled engine subcommand and its latest stderr, never the full argv. */
+const commandTimedOut = (
+  args: ReadonlyArray<string>,
+  timeout: Duration.Input,
+  stderr: string,
+): Cause.TimeoutError => {
+  const tail = stderr.trim().slice(-2000);
+  return new Cause.TimeoutError(
+    `Engine command '${args[0] ?? "command"}' did not finish within ${Duration.format(Duration.fromInputUnsafe(timeout))}${tail.length > 0 ? `; stderr: ${tail}` : ""}`,
+  );
+};
+
 const errorFor = (operation: string, cause: unknown): ContainerError => {
   const message = cause instanceof Error ? cause.message : String(cause);
   const kind = engineKind(operation, cause, message);
@@ -403,20 +415,23 @@ export const makeHostGateway: Effect.Effect<HostGateway, never, Scope.Scope> = E
             state === undefined ? [undefined, fresh] : [state, state],
           );
           if (current !== undefined) return current;
-          // Starting immediately installs `onExit` before a closed scope can interrupt the fiber.
-          yield* probe.pipe(
-            Effect.onExit((exit) => {
-              const failure = Exit.isFailure(exit)
-                ? Cause.findErrorOption(exit.cause)
-                : Option.none();
-              if (Option.isSome(failure)) return Deferred.fail(fresh, failure.value);
-              const probed = Exit.isSuccess(exit) ? exit.value : undefined;
-              return (probed === undefined ? Ref.set(target, undefined) : Effect.void).pipe(
-                Effect.andThen(Deferred.succeed(fresh, probed)),
-              );
-            }),
+          const settle = (exit: Exit.Exit<string | undefined, ContainerError>) => {
+            const failure = Exit.isFailure(exit)
+              ? Cause.findErrorOption(exit.cause)
+              : Option.none();
+            if (Option.isSome(failure)) return Deferred.fail(fresh, failure.value);
+            const probed = Exit.isSuccess(exit) ? exit.value : undefined;
+            return (probed === undefined ? Ref.set(target, undefined) : Effect.void).pipe(
+              Effect.andThen(Deferred.succeed(fresh, probed)),
+            );
+          };
+          const fiber = yield* probe.pipe(
+            Effect.onExit(settle),
             Effect.forkIn(scope, { startImmediately: true }),
           );
+          // A closed scope interrupts the fiber before it starts, so its `onExit` never runs.
+          const exited = fiber.pollUnsafe();
+          if (exited !== undefined && !(yield* Deferred.isDone(fresh))) yield* settle(exited);
           return fresh;
         }),
       );
@@ -493,14 +508,14 @@ export const makeContainerRuntime = (options: {
   | ChildProcessSpawner.ChildProcessSpawner
   | FileSystem.FileSystem
   | Path.Path
-  | Crypto.Crypto
+  | SecureRandom.SecureRandom
   | Scope.Scope
 > =>
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
     const stackRoot = path.resolve(options.root);
     // An owned directory for per-launch environment files, never the real system temp directory.
     const containerEnvRoot = path.join(stackRoot, CONTAINER_ENV_DIRNAME);
@@ -527,19 +542,25 @@ export const makeContainerRuntime = (options: {
         "process.arg_count": args.length,
         "container.command": args[0] ?? "",
       });
+      const stderrSoFar = yield* Ref.make("");
       return yield* Effect.scoped(
         Effect.gen(function* () {
           const child = yield* spawner.spawn(command(args));
-          const tail = (stream: typeof child.stdout) =>
+          const tail = (stream: typeof child.stdout, progress?: Ref.Ref<string>) =>
             stream.pipe(
               Stream.decodeText,
-              Stream.runFold(
+              Stream.runFoldEffect(
                 () => "",
-                (text, chunk) => (text + chunk).slice(-65536),
+                (text, chunk) => {
+                  const next = (text + chunk).slice(-65536);
+                  return progress === undefined
+                    ? Effect.succeed(next)
+                    : Ref.set(progress, next).pipe(Effect.as(next));
+                },
               ),
             );
           const [stdout, stderr, code] = yield* Effect.all(
-            [tail(child.stdout), tail(child.stderr), child.exitCode],
+            [tail(child.stdout), tail(child.stderr, stderrSoFar), child.exitCode],
             { concurrency: "unbounded" },
           );
           yield* Effect.annotateCurrentSpan("process.exit_code", Number(code));
@@ -551,10 +572,22 @@ export const makeContainerRuntime = (options: {
           return stdout.trim();
         }),
       ).pipe(
-        (effect) =>
-          commandOptions.timeout === undefined
+        (effect) => {
+          const timeout = commandOptions.timeout;
+          return timeout === undefined
             ? effect
-            : effect.pipe(Effect.timeout(commandOptions.timeout)),
+            : effect.pipe(
+                Effect.timeoutOrElse({
+                  duration: timeout,
+                  orElse: () =>
+                    Ref.get(stderrSoFar).pipe(
+                      Effect.flatMap((stderr) =>
+                        Effect.fail(commandTimedOut(args, timeout, stderr)),
+                      ),
+                    ),
+                }),
+              );
+        },
         Effect.mapError((cause) => errorFor(args[0] ?? "command", cause)),
       );
     });
@@ -657,9 +690,7 @@ export const makeContainerRuntime = (options: {
     const readProbeHosts = (image: string, spec: ContainerSpec, addHost: ReadonlyArray<string>) =>
       Effect.gen(function* () {
         const testRunLabel = yield* testRunLabelArgs;
-        const token = yield* crypto.randomUUIDv4.pipe(
-          Effect.mapError((cause) => errorFor("token", cause)),
-        );
+        const token = yield* crypto.uuidV4();
         // Not an instance container: no instance label, so it is never mistaken for one.
         const { name } = identifyContainer(spec, token, true);
         const hosts = yield* run(
@@ -777,9 +808,7 @@ export const makeContainerRuntime = (options: {
           { mode: 0o600 },
         )
         .pipe(Effect.mapError((cause) => errorFor("environment", cause)));
-      const token = yield* crypto.randomUUIDv4.pipe(
-        Effect.mapError((cause) => errorFor("token", cause)),
-      );
+      const token = yield* crypto.uuidV4();
       const { name, composeProject, composeService } = identifyContainer(spec, token, oneOff);
       const hostAlias = yield* hostAliasTarget(image, spec);
       const testRunLabel = yield* testRunLabelArgs;
diff --git a/packages/stack/src/runtime/container-image-mirror.integration.test.ts b/packages/stack/src/runtime/container-image-mirror.integration.test.ts
index 5b1b4a36c8..16686ae031 100644
--- a/packages/stack/src/runtime/container-image-mirror.integration.test.ts
+++ b/packages/stack/src/runtime/container-image-mirror.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, Fiber, Layer, Option, Sink, Stream } from "effect";
 import { TestClock } from "effect/testing";
@@ -44,7 +44,7 @@ const fakeEngine = (options: {
     });
   const spawner = ChildProcessSpawner.make((command) => {
     if (!ChildProcess.isStandardCommand(command)) return Effect.die("unexpected piped command");
-    const args = [...command.args];
+    const args = command.args.map(String);
     commands.push(args);
     const ref = args.at(-1) ?? "";
     // Resolved once before any container is created; this stand-in always reports one so launch
@@ -95,7 +95,7 @@ describe("container image mirror", () => {
         ["pull", mirror],
       ]);
       expect(engine.commands.find((args) => args[0] === "create")?.at(-1)).toBe(mirror);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.live("tries each mirror in order until one pull succeeds", () => {
@@ -114,7 +114,7 @@ describe("container image mirror", () => {
         ["pull", secondMirror],
       ]);
       expect(engine.commands.find((args) => args[0] === "create")?.at(-1)).toBe(secondMirror);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.live("launches the primary again once it pulls after an earlier mirror rescue", () => {
@@ -131,7 +131,7 @@ describe("container image mirror", () => {
       yield* runtime.prepare(primary);
       yield* launchImage(runtime);
       expect(engine.commands.find((args) => args[0] === "create")?.at(-1)).toBe(primary);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.live("launches the primary again once it is present after an earlier mirror rescue", () => {
@@ -148,7 +148,7 @@ describe("container image mirror", () => {
       yield* runtime.prepare(primary);
       yield* launchImage(runtime);
       expect(engine.commands.find((args) => args[0] === "create")?.at(-1)).toBe(primary);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.live("reports the primary pull failure when the mirror also fails", () => {
@@ -166,7 +166,7 @@ describe("container image mirror", () => {
       expect(error?.message).toContain(`denied: ${primary}`);
       yield* launchImage(runtime);
       expect(engine.commands.find((args) => args[0] === "create")?.at(-1)).toBe(primary);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.live("never contacts the mirror when the primary pull succeeds", () => {
@@ -180,7 +180,7 @@ describe("container image mirror", () => {
       yield* runtime.prepare(primary);
       yield* launchImage(runtime);
       expect(engine.commands.flat()).not.toContain(mirror);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.effect("retries a rate-limited pull with backoff until the registry accepts it", () => {
@@ -195,7 +195,7 @@ describe("container image mirror", () => {
       yield* Fiber.join(prepared);
       expect(engine.commands.filter((args) => args[0] === "pull")).toHaveLength(3);
       expect(engine.local.has(primary)).toBe(true);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.effect("retries a pull after a transient registry transport failure", () => {
@@ -215,7 +215,7 @@ describe("container image mirror", () => {
       yield* Fiber.join(prepared);
       expect(engine.commands.filter((args) => args[0] === "pull")).toHaveLength(2);
       expect(engine.local.has(primary)).toBe(true);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   const permanentPullFailures = [
@@ -241,7 +241,7 @@ describe("container image mirror", () => {
           : undefined;
         expect(error?.message).toContain(message);
         expect(engine.commands.filter((args) => args[0] === "pull")).toHaveLength(1);
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+      }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
     });
   }
 
@@ -260,7 +260,7 @@ describe("container image mirror", () => {
         : undefined;
       expect(error?.message).toContain("toomanyrequests");
       expect(engine.commands.filter((args) => args[0] === "pull")).toHaveLength(5);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.effect("stops pulling once a concurrent prepare lands the image during backoff", () => {
@@ -276,7 +276,7 @@ describe("container image mirror", () => {
       yield* TestClock.adjust("1 minute");
       yield* Fiber.join(throttled);
       expect(engine.commands.filter((args) => args[0] === "pull")).toHaveLength(2);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 
   it.effect("falls back to a mirror before backing off on a rate-limited primary", () => {
@@ -292,6 +292,6 @@ describe("container image mirror", () => {
         ["pull", primary],
         ["pull", mirror],
       ]);
-    }).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+    }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
   });
 });
diff --git a/packages/stack/src/runtime/native-process.integration.test.ts b/packages/stack/src/runtime/native-process.integration.test.ts
index 3e7e031e74..c83dd4aa65 100644
--- a/packages/stack/src/runtime/native-process.integration.test.ts
+++ b/packages/stack/src/runtime/native-process.integration.test.ts
@@ -951,7 +951,10 @@ describe("native process group cleanup", () => {
               const child = yield* delegate.spawn(command);
               if (
                 !ChildProcess.isStandardCommand(command) ||
-                !command.args.some((argument) => argument.includes("native-launcher"))
+                !command.args.some(
+                  (argument) =>
+                    typeof argument === "string" && argument.includes("native-launcher"),
+                )
               )
                 return child;
               yield* child.stdout.pipe(
diff --git a/packages/stack/src/runtime/postgres-user.integration.test.ts b/packages/stack/src/runtime/postgres-user.integration.test.ts
index bc6d75689c..6c62e468cd 100644
--- a/packages/stack/src/runtime/postgres-user.integration.test.ts
+++ b/packages/stack/src/runtime/postgres-user.integration.test.ts
@@ -1,6 +1,7 @@
 import { NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, FileSystem, Layer, Path } from "effect";
+import { Effect, Exit, FileSystem, Layer, Option, Path } from "effect";
+import { systemError } from "effect/PlatformError";
 // oxlint-disable-next-line effecttsgo/node-builtin-import -- the current process's own uid/gid make the chown calls below harmless no-ops.
 import { userInfo } from "node:os";
 import {
@@ -9,6 +10,7 @@ import {
   NativeRuntimeRootBase,
   nativeRuntimeRootPath,
   type PasswdEntry,
+  restrictDirectoryToOwner,
 } from "./postgres-user.ts";
 
 /**
@@ -141,3 +143,52 @@ describe("acquireNativeRuntimeRoot", () => {
     ).pipe(Effect.provide(NodeServices.layer)),
   );
 });
+
+// Windows has no POSIX mode bits.
+describe.skipIf(process.platform === "win32")("restrictDirectoryToOwner", () => {
+  it.live("keeps a traverse grant another process adds after the mode was read", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const directory = yield* fs.makeTempDirectoryScoped({ prefix: "restrict-owner-race-" });
+        yield* fs.chmod(directory, 0o700);
+        const grantAfterStat: FileSystem.FileSystem = {
+          ...fs,
+          stat: (target) => fs.stat(target).pipe(Effect.tap(() => fs.chmod(directory, 0o701))),
+        };
+
+        yield* restrictDirectoryToOwner(grantAfterStat, directory);
+
+        expect((yield* fs.stat(directory)).mode & 0o777).toBe(0o701);
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  );
+
+  it.live("still rejects a restricted directory another user owns", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const directory = yield* fs.makeTempDirectoryScoped({ prefix: "restrict-owner-foreign-" });
+        yield* fs.chmod(directory, 0o701);
+        const ownedByAnotherUser: FileSystem.FileSystem = {
+          ...fs,
+          stat: (target) =>
+            fs.stat(target).pipe(Effect.map((info) => ({ ...info, uid: Option.some(-1) }))),
+          chmod: () =>
+            Effect.fail(
+              systemError({
+                _tag: "PermissionDenied",
+                module: "FileSystem",
+                method: "chmod",
+                description: "not the owner",
+              }),
+            ),
+        };
+
+        const exit = yield* Effect.exit(restrictDirectoryToOwner(ownedByAnotherUser, directory));
+
+        expect(Exit.isFailure(exit)).toBe(true);
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
diff --git a/packages/stack/src/runtime/postgres-user.ts b/packages/stack/src/runtime/postgres-user.ts
index ef8388dab5..b99a98bacc 100644
--- a/packages/stack/src/runtime/postgres-user.ts
+++ b/packages/stack/src/runtime/postgres-user.ts
@@ -1,4 +1,5 @@
-import { Config, Context, Crypto, Effect, FileSystem, Option, Path } from "effect";
+import { Config, Context, Effect, FileSystem, Option, Path } from "effect";
+import { Digest } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import type { PlatformError } from "effect/PlatformError";
 import { contentDigestHex } from "../internal/content-digest.ts";
@@ -238,13 +239,13 @@ const resolveNativeRuntimeRootForRecovery = Effect.fn(
  * (this directory plus `/.s.PGSQL.5432`) to 103 bytes, which bounds the runtime root base.
  */
 export const nativeSocketDirectoryPath = (
-  crypto: Crypto.Crypto,
+  digest: Digest.Digest["Service"],
   path: Path.Path,
   runtimeRoot: string,
   dataRoot: string,
   instanceId: string,
 ) =>
-  contentDigestHex(crypto, `${dataRoot}\0${instanceId}`).pipe(
+  contentDigestHex(digest, `${dataRoot}\0${instanceId}`).pipe(
     Effect.map((digest) => path.join(runtimeRoot, `pg-${digest}`)),
   );
 
@@ -257,7 +258,7 @@ export const removeNativeSocketDirectory = Effect.fn("NativePostgresUser.removeS
   function* (dataRoot: string, instanceId: string) {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const digest = yield* Digest.Digest;
     const runtimeRoot = yield* resolveNativeRuntimeRootForRecovery().pipe(Effect.option);
     if (Option.isNone(runtimeRoot)) {
       const base = yield* NativeRuntimeRootBase;
@@ -269,7 +270,7 @@ export const removeNativeSocketDirectory = Effect.fn("NativePostgresUser.removeS
       return;
     }
     yield* fs.remove(
-      yield* nativeSocketDirectoryPath(crypto, path, runtimeRoot.value, dataRoot, instanceId),
+      yield* nativeSocketDirectoryPath(digest, path, runtimeRoot.value, dataRoot, instanceId),
       { recursive: true, force: true },
     );
   },
@@ -278,11 +279,20 @@ export const removeNativeSocketDirectory = Effect.fn("NativePostgresUser.removeS
 /**
  * Restricts a directory to its owner but keeps an existing traverse-only grant, because a
  * stepped-down PostgreSQL resolves bundle and data paths through the cache and state roots while it runs.
+ * An already-restricted directory is left unchanged, so a concurrent stat-then-chmod cannot write
+ * back a mode that predates another process's traverse grant.
  */
 export const restrictDirectoryToOwner = (fs: FileSystem.FileSystem, directory: string) =>
-  fs
-    .stat(directory)
-    .pipe(Effect.flatMap(({ mode }) => fs.chmod(directory, 0o700 | (mode & 0o001))));
+  fs.stat(directory).pipe(
+    Effect.flatMap(({ mode, uid }) => {
+      const restricted = 0o700 | (mode & 0o001);
+      // chmod fails on another user's directory, so only an owned directory may skip it.
+      const owned = Option.getOrUndefined(uid) === process.getuid?.();
+      return owned && (mode & 0o7777) === restricted
+        ? Effect.void
+        : fs.chmod(directory, restricted);
+    }),
+  );
 
 const allowTraverse = Effect.fn("NativePostgresUser.allowTraverse")(function* (
   user: PasswdEntry,
diff --git a/packages/stack/src/schema-writers.integration.test.ts b/packages/stack/src/schema-writers.integration.test.ts
index b508745311..22847b4079 100644
--- a/packages/stack/src/schema-writers.integration.test.ts
+++ b/packages/stack/src/schema-writers.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import {
   Data,
@@ -23,7 +23,7 @@ import { testArtifactCacheRoot } from "../tests/artifact-cache.ts";
 import { selection } from "../tests/pins.ts";
 import { destroyTestStack } from "../tests/stack-cleanup.ts";
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 const jwtSecret = "schema-writers-jwt-secret-with-at-least-32-chars";
 const database = {
   service: "database",
diff --git a/packages/stack/src/services/Analytics.ts b/packages/stack/src/services/Analytics.ts
index 6a82f853c0..59b2e8cd02 100644
--- a/packages/stack/src/services/Analytics.ts
+++ b/packages/stack/src/services/Analytics.ts
@@ -1,4 +1,5 @@
 import { Effect, Schema } from "effect";
+import { DEFAULT_ERL_MAX_PORTS } from "../Defaults.ts";
 import { ServiceError } from "../Service.ts";
 import { EndpointIntent, serviceCreation } from "./Recipe.ts";
 import { databaseConnection, requiredInput } from "./ServiceConfig.ts";
@@ -94,6 +95,7 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
         // Logflare waits this period after SIGTERM before stopping (a load-balancer drain delay),
         // longer than the stack's stop grace.
         ERL_AFLAGS: "-eval application:set_env(logflare,sigterm_shutdown_grace_period_ms,0).",
+        ERL_MAX_PORTS: DEFAULT_ERL_MAX_PORTS,
       };
     }),
   args: () => Effect.succeed(["start"]),
diff --git a/packages/stack/src/services/Analytics.unit.test.ts b/packages/stack/src/services/Analytics.unit.test.ts
index 2379d7cc08..ff331b63cb 100644
--- a/packages/stack/src/services/Analytics.unit.test.ts
+++ b/packages/stack/src/services/Analytics.unit.test.ts
@@ -44,3 +44,15 @@ it.effect("gives Logflare's sources and events the default credentials a URL lea
     });
   }),
 );
+
+it.effect("caps Logflare's BEAM port table", () =>
+  Effect.gen(function* () {
+    const env = yield* makeSpec().env(
+      creation("postgresql://db.internal/_supabase"),
+      new Map(),
+      true,
+    );
+
+    expect(env).toMatchObject({ ERL_MAX_PORTS: "65536" });
+  }),
+);
diff --git a/packages/stack/src/services/AnalyticsImgproxy.integration.test.ts b/packages/stack/src/services/AnalyticsImgproxy.integration.test.ts
index d872ef2ce2..ae1cf45ece 100644
--- a/packages/stack/src/services/AnalyticsImgproxy.integration.test.ts
+++ b/packages/stack/src/services/AnalyticsImgproxy.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer, Redacted } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
@@ -107,7 +107,11 @@ describe("service catalog", () => {
           yield* analytics.stop;
           yield* database.stop;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 });
diff --git a/packages/stack/src/services/Auth.ts b/packages/stack/src/services/Auth.ts
index 0d7167c12f..2785e51cab 100644
--- a/packages/stack/src/services/Auth.ts
+++ b/packages/stack/src/services/Auth.ts
@@ -16,6 +16,13 @@ const Smtp = Schema.Struct({
   senderName: Schema.optionalKey(Schema.String),
 });
 
+const Template = Schema.Struct({
+  id: Schema.String,
+  path: Schema.String,
+  /* `path` is served only while it resolves inside this directory, like `content_path`. */
+  root: Schema.String,
+});
+
 export const Config = Schema.Struct({
   databaseUrl: Schema.optionalKey(Schema.String),
   siteUrl: Schema.optionalKey(Schema.String),
@@ -31,6 +38,9 @@ export const Config = Schema.Struct({
   smtpSenderName: Schema.optionalKey(Schema.String),
   settings: Schema.optionalKey(Settings),
   smtp: Schema.optionalKey(Smtp),
+  templates: Schema.optionalKey(Schema.Array(Template)),
+  templateBaseUrl: Schema.optionalKey(Schema.String),
+  templateToken: Schema.optionalKey(Schema.String),
 });
 
 export interface Config extends Schema.Schema.Type<typeof Config> {}
@@ -84,6 +94,12 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
               creation.config.siteUrl ??
               "http://localhost:3000");
       const jwtIssuer = creation.config.settings?.jwtIssuer || authExternalUrl;
+      const templates = creation.config.templates ?? [];
+      const { templateBaseUrl, templateToken } = creation.config;
+      if (templates.length > 0) {
+        yield* requiredInput("auth", "templateBaseUrl", templateBaseUrl);
+        yield* requiredInput("auth", "templateToken", templateToken);
+      }
       const base = {
         GOTRUE_API_HOST: container ? "0.0.0.0" : "127.0.0.1",
         GOTRUE_DB_DATABASE_URL: databaseUrl,
@@ -115,6 +131,13 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
           ? {}
           : { GOTRUE_JWT_EXP: String(creation.config.jwtExpiry) }),
         ...settingsEnvironment(creation.config.settings, jwtIssuer),
+        ...(templates.length === 0 ? {} : { GOTRUE_MAILER_TEMPLATE_RELOADING_ENABLED: "true" }),
+        ...Object.fromEntries(
+          templates.map(({ id }) => [
+            `GOTRUE_MAILER_TEMPLATES_${id.toUpperCase()}`,
+            `${templateBaseUrl}/email/${id}?token=${templateToken}`,
+          ]),
+        ),
       };
       const smtp = creation.config.smtp;
       if (smtp !== undefined) {
diff --git a/packages/stack/src/services/AuthSettings.ts b/packages/stack/src/services/AuthSettings.ts
index 9bf72c2e0d..2f0a5b3f78 100644
--- a/packages/stack/src/services/AuthSettings.ts
+++ b/packages/stack/src/services/AuthSettings.ts
@@ -1,4 +1,4 @@
-import { Schema } from "effect";
+import { Effect, Schema } from "effect";
 
 const Hook = Schema.Struct({
   enabled: Schema.Boolean,
@@ -62,6 +62,10 @@ const Email = Schema.Struct({
   double_confirm_changes: Schema.Boolean,
   enable_confirmations: Schema.Boolean,
   secure_password_change: Schema.Boolean,
+  /* Stacks saved before this key omit it. */
+  require_current_password: Schema.Boolean.pipe(
+    Schema.withDecodingDefaultKey(Effect.succeed(false)),
+  ),
   max_frequency: Schema.String,
   otp_length: Schema.Finite,
   otp_expiry: Schema.Finite,
@@ -193,6 +197,7 @@ export const settingsEnvironment = (
     put("GOTRUE_MAILER_SECURE_EMAIL_CHANGE_ENABLED", email.double_confirm_changes);
     put("GOTRUE_MAILER_AUTOCONFIRM", !email.enable_confirmations);
     put("GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_REAUTHENTICATION", email.secure_password_change);
+    put("GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD", email.require_current_password);
     put("GOTRUE_MAILER_OTP_LENGTH", email.otp_length);
     put("GOTRUE_MAILER_OTP_EXP", email.otp_expiry);
     put("GOTRUE_SMTP_MAX_FREQUENCY", email.max_frequency);
diff --git a/packages/stack/src/services/AuthSettings.unit.test.ts b/packages/stack/src/services/AuthSettings.unit.test.ts
index 66caf0f533..072133da40 100644
--- a/packages/stack/src/services/AuthSettings.unit.test.ts
+++ b/packages/stack/src/services/AuthSettings.unit.test.ts
@@ -22,6 +22,65 @@ describe("Auth settings environment", () => {
     expect(env.GOTRUE_MAILER_URLPATHS_INVITE).toBe("https://login.example/auth/v1/verify");
     expect(env.GOTRUE_JWT_VALIDMETHODS).toBe("HS256,RS256,ES256");
     expect(env.GOTRUE_JWT_VALID_METHODS).toBe("HS256,RS256,ES256");
+    expect(env).not.toHaveProperty("GOTRUE_MAILER_TEMPLATE_RELOADING_ENABLED");
+  });
+
+  it("points Auth at each template on the API runtime address beside its subject", () => {
+    const creation = Schema.decodeSync(Creation)({
+      service: "auth",
+      pin: selection.auth,
+      config: {
+        databaseUrl: "postgresql://localhost/postgres",
+        templateBaseUrl: "http://host.supabase.internal:54321",
+        templateToken: "token",
+        templates: [
+          { id: "invite", path: "/project/invite.html", root: "/project" },
+          { id: "password_changed_notification", path: "/project/changed", root: "/project" },
+        ],
+        settings: {
+          email: {
+            enable_signup: true,
+            double_confirm_changes: true,
+            enable_confirmations: false,
+            secure_password_change: false,
+            max_frequency: "1m0s",
+            otp_length: 6,
+            otp_expiry: 3600,
+            template: { invite: { subject: "Join us" } },
+            notification: { password_changed: { enabled: true, subject: "Changed" } },
+          },
+        },
+      },
+    });
+    const env = Effect.runSync(makeSpec().env(creation, new Map(), true));
+
+    expect(env).toMatchObject({
+      GOTRUE_MAILER_TEMPLATE_RELOADING_ENABLED: "true",
+      GOTRUE_MAILER_TEMPLATES_INVITE:
+        "http://host.supabase.internal:54321/email/invite?token=token",
+      GOTRUE_MAILER_TEMPLATES_PASSWORD_CHANGED_NOTIFICATION:
+        "http://host.supabase.internal:54321/email/password_changed_notification?token=token",
+      GOTRUE_MAILER_SUBJECTS_INVITE: "Join us",
+      GOTRUE_MAILER_SUBJECTS_PASSWORD_CHANGED_NOTIFICATION: "Changed",
+    });
+  });
+
+  it("refuses to launch Auth with templates and no address or token", () => {
+    const run = (config: Record<string, unknown>) => {
+      const creation = Schema.decodeSync(Creation)({
+        service: "auth",
+        pin: selection.auth,
+        config: {
+          databaseUrl: "postgresql://localhost/postgres",
+          templates: [{ id: "invite", path: "/project/invite.html", root: "/project" }],
+          ...config,
+        },
+      });
+      return () => Effect.runSync(makeSpec().env(creation, new Map(), false));
+    };
+
+    expect(run({ templateToken: "token" })).toThrow("templateBaseUrl");
+    expect(run({ templateBaseUrl: "http://127.0.0.1:54321" })).toThrow("templateToken");
   });
 
   it("uses the default email rate limit without SMTP and configured limit with custom SMTP", () => {
@@ -95,6 +154,7 @@ describe("Auth settings environment", () => {
     expect(env["GOTRUE_EXTERNAL_CUSTOM_REDIRECT_URI"]).toBe("https://issuer.example/callback");
     expect(env["GOTRUE_EXTERNAL_CUSTOM_SECRET"]).toBe("");
     expect(env["GOTRUE_PASSKEY_ENABLED"]).toBe("true");
+    expect(env["GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD"]).toBe("false");
     expect(env["GOTRUE_WEBAUTHN_RP_ORIGINS"]).toBe("https://example.test,https://app.example.test");
     expect(env["GOTRUE_MAILER_NOTIFICATIONS_EMAIL_CHANGED_ENABLED"]).toBe("true");
     expect(env["GOTRUE_MAILER_SUBJECTS_EMAIL_CHANGED_NOTIFICATION"]).toBe("changed");
diff --git a/packages/stack/src/services/AuthStorage.integration.test.ts b/packages/stack/src/services/AuthStorage.integration.test.ts
index 611564657d..84e9c64940 100644
--- a/packages/stack/src/services/AuthStorage.integration.test.ts
+++ b/packages/stack/src/services/AuthStorage.integration.test.ts
@@ -1,5 +1,5 @@
 import { PgClient } from "@effect/sql-pg";
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Context, Effect, FileSystem, Layer, Redacted, Schema } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
@@ -192,16 +192,21 @@ describe("service catalog", () => {
             ).pipe(
               HttpClientRequest.setHeader("Authorization", `Bearer ${serviceToken}`),
               HttpClientRequest.setHeader("apikey", serviceToken),
+              HttpClientRequest.setHeader("accept", "image/webp,*/*"),
             ),
           );
           expect(transformedImage.status).toBe(200);
-          expect(transformedImage.headers["content-type"]).toContain("image/");
+          expect(transformedImage.headers["content-type"]).toBe("image/webp");
           yield* imgproxy.stop;
           yield* storage.stop;
           yield* auth.stop;
           yield* database.stop;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 
@@ -292,7 +297,11 @@ describe("service catalog", () => {
           yield* auth.stop;
           yield* database.stop;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 });
diff --git a/packages/stack/src/services/Catalog.integration.test.ts b/packages/stack/src/services/Catalog.integration.test.ts
index 580be245eb..1b966ef589 100644
--- a/packages/stack/src/services/Catalog.integration.test.ts
+++ b/packages/stack/src/services/Catalog.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, Exit, FileSystem, Layer, Redacted } from "effect";
 import { selection } from "../../tests/pins.ts";
@@ -42,7 +42,11 @@ describe("service catalog", () => {
         ).pipe(Effect.exit);
         expect(Exit.isFailure(unpinnedDatabase)).toBe(true);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live("rejects Storage creation without a file path", () =>
@@ -63,6 +67,10 @@ describe("service catalog", () => {
         expect(error.operation).toBe("config");
         expect(error.message).toContain("Invalid service creation");
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 });
diff --git a/packages/stack/src/services/Catalog.ts b/packages/stack/src/services/Catalog.ts
index fdd8393767..d061b1dbd9 100644
--- a/packages/stack/src/services/Catalog.ts
+++ b/packages/stack/src/services/Catalog.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect, FileSystem, Path, Ref, Schema, Tuple } from "effect";
+import { Effect, FileSystem, Path, Ref, Schema, Tuple } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { ChildProcessSpawner } from "effect/process";
 import { HttpClient } from "effect/http";
 import { makeContainerRuntime } from "../runtime/Container.ts";
@@ -317,7 +318,8 @@ export const makeServiceRecipe = Effect.fn("Catalog.makeServiceRecipe")(
       );
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
-      const crypto = yield* Crypto.Crypto;
+      const crypto = yield* SecureRandom.SecureRandom;
+      const digest = yield* Digest.Digest;
       const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
       const client = yield* HttpClient.HttpClient;
       if (creation.service === "database") {
@@ -362,6 +364,7 @@ export const makeServiceRecipe = Effect.fn("Catalog.makeServiceRecipe")(
         fs,
         path,
         crypto,
+        digest,
         client,
         spawner,
         container,
diff --git a/packages/stack/src/services/Database.integration.test.ts b/packages/stack/src/services/Database.integration.test.ts
index 4bea5eebe2..f66d48bf3f 100644
--- a/packages/stack/src/services/Database.integration.test.ts
+++ b/packages/stack/src/services/Database.integration.test.ts
@@ -1,5 +1,5 @@
 import { PgClient } from "@effect/sql-pg";
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Clock,
@@ -23,6 +23,7 @@ import {
 import { HttpClient } from "effect/http";
 import { createHash } from "node:crypto";
 import { createServer } from "node:http"; // oxlint-disable-line effecttsgo/node-builtin-import -- raw release fixture server.
+import { SLIM_NATIVE_SUPABASE_S3_MIRROR } from "../Artifacts.ts";
 import { DEFAULT_POSTGRES_ROOT_KEY } from "../Defaults.ts";
 import { makeStandaloneService } from "../../tests/standalone-service.ts";
 import { databaseIdentity, recordDatabaseIdentity } from "../internal/database-reuse.ts";
@@ -175,7 +176,11 @@ describe("database component", { timeout: 180_000 }, () => {
             }
             yield* service.destroy;
           }),
-        ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+        ).pipe(
+          Effect.provide(
+            Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+          ),
+        ),
     );
 
   it.live("refuses initialized data with no or another identity before preparing an artifact", () =>
@@ -214,7 +219,7 @@ describe("database component", { timeout: 180_000 }, () => {
           '{"runtime":"native","profile":"supabase"}',
         );
         expect((yield* Effect.flip(prepare(orioledbConfig))).message).toContain(
-          `PostgreSQL data was initialized by stock PostgreSQL build ${selection.database.upstreamVersion}, but OrioleDB build ${orioledb.upstreamVersion} was requested; keep this data by pinning \`[local.services.database] version = "${selection.database.upstreamVersion}"\` and removing any \`[db] orioledb_version\` in supabase/config.toml, or ${recreate}`,
+          `PostgreSQL data was initialized by stock PostgreSQL build ${selection.database.upstreamVersion}, but OrioleDB build ${orioledb.upstreamVersion} was requested; keep this data by pinning \`local.services.database.version\` to \`"${selection.database.upstreamVersion}"\` and removing any \`db.orioledb_version\` in your config file, or ${recreate}`,
         );
         expect(
           (yield* Effect.flip(
@@ -224,7 +229,7 @@ describe("database component", { timeout: 180_000 }, () => {
             }),
           )).message,
         ).toContain(
-          `stock PostgreSQL build 17.99.0.001 was requested; keep this data by pinning \`[local.services.database] version = "${selection.database.upstreamVersion}"\``,
+          `stock PostgreSQL build 17.99.0.001 was requested; keep this data by pinning \`local.services.database.version\` to \`"${selection.database.upstreamVersion}"\``,
         );
 
         yield* fs.writeFileString(
@@ -235,7 +240,11 @@ describe("database component", { timeout: 180_000 }, () => {
           `Initialized database data is for the docker runtime, but the native runtime was requested; ${recreate}`,
         );
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live("keeps a reset from forgetting the record of a writer that is still migrating", () =>
@@ -284,7 +293,9 @@ describe("database component", { timeout: 180_000 }, () => {
         expect(yield* fs.exists(path.join(instanceRoot, name)), name).toBe(true);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   );
 
@@ -342,7 +353,11 @@ describe("database component", { timeout: 180_000 }, () => {
         );
         yield* service.destroy;
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live(
@@ -360,14 +375,23 @@ describe("database component", { timeout: 180_000 }, () => {
           // The next revision is the published archive under a manifest that names the new revision.
           const targets = ["darwin-arm64", "linux-amd64", "linux-arm64"] as const;
           const manifestJson = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown));
-          const client = HttpClient.followRedirects(yield* HttpClient.HttpClient);
+          const client = HttpClient.filterStatusOk(
+            HttpClient.followRedirects(yield* HttpClient.HttpClient),
+          );
           const manifests = new Map<string, string>();
           const manifestPins = new Map<string, string>();
           for (const target of targets) {
-            const upstream = yield* client.get(
-              `${upstreamReleases}${assetPath(published.revision, target, "manifest.json")}`,
+            const publishedVersion = releaseVersion(published.revision);
+            const body = yield* Effect.firstSuccessOf(
+              [
+                `${upstreamReleases}${assetPath(published.revision, target, "manifest.json")}`,
+                `${SLIM_NATIVE_SUPABASE_S3_MIRROR}/postgres/${publishedVersion}/postgres-${publishedVersion}-${target}.manifest.json`,
+              ].map((url) => client.get(url).pipe(Effect.flatMap((response) => response.text))),
             );
-            const manifest = yield* Schema.decodeEffect(manifestJson)(yield* upstream.text);
+            expect(createHash("sha256").update(body).digest("hex")).toBe(
+              published.natives[target].manifest,
+            );
+            const manifest = yield* Schema.decodeEffect(manifestJson)(body);
             const text = yield* Schema.encodeEffect(manifestJson)({
               ...manifest,
               version: releaseVersion(nextRevision),
@@ -463,7 +487,11 @@ describe("database component", { timeout: 180_000 }, () => {
             yield* service.destroy;
           }).pipe(withReleases);
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 300_000 },
   );
 
@@ -523,7 +551,11 @@ describe("database component", { timeout: 180_000 }, () => {
         ).toEqual([{ ok: 1 }]);
         yield* service.destroy;
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live("native PostgreSQL verifies outbound HTTPS against the configured CA bundle", () =>
@@ -614,7 +646,11 @@ describe("database component", { timeout: 180_000 }, () => {
         });
         yield* service.destroy;
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live(
@@ -669,7 +705,11 @@ describe("database component", { timeout: 180_000 }, () => {
           });
           yield* service.destroy;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
   );
 
   for (const [version, pin] of [
@@ -775,7 +815,11 @@ describe("database component", { timeout: 180_000 }, () => {
           expect(yield* settings).toMatchObject([{ workers: "32", cron: "on" }]);
           yield* service.destroy;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     );
 
   it.live("bounds the native configuration probe before first boot", () =>
@@ -798,7 +842,11 @@ describe("database component", { timeout: 180_000 }, () => {
         expect(String(failure)).toContain("PostgreSQL configuration probe timed out");
         expect(yield* fs.readDirectory(`${root}/probe/data`)).toEqual([]);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live(
@@ -842,7 +890,11 @@ describe("database component", { timeout: 180_000 }, () => {
           expect(yield* fs.exists(socketDirectory)).toBe(false);
           yield* service.destroy;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
   );
 
   it.live(
@@ -1009,7 +1061,11 @@ describe("database component", { timeout: 180_000 }, () => {
           yield* secondService.destroy;
           expect(yield* fs.exists(path.join(root, "first"))).toBe(false);
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
   );
 
   for (const [version, pin] of [
@@ -1108,7 +1164,11 @@ describe("database component", { timeout: 180_000 }, () => {
           ).toEqual([{ value: "docker" }]);
           yield* reopenedService.destroy;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     );
 
   // The storage helper joins the compose project only with the Docker volume backend.
@@ -1155,7 +1215,11 @@ describe("database component", { timeout: 180_000 }, () => {
           );
           yield* service.destroy;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     );
   });
 
@@ -1236,6 +1300,10 @@ describe("database component", { timeout: 180_000 }, () => {
         ).toEqual(cleanStopEvents);
         yield* service.destroy;
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 });
diff --git a/packages/stack/src/services/Database.ts b/packages/stack/src/services/Database.ts
index 677d746c63..150d5e19ec 100644
--- a/packages/stack/src/services/Database.ts
+++ b/packages/stack/src/services/Database.ts
@@ -3,7 +3,6 @@ import { PgClient } from "@effect/sql-pg";
 import {
   Config,
   Context,
-  Crypto,
   Data,
   Effect,
   FileSystem,
@@ -18,6 +17,7 @@ import {
   Scope,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import type { ChildProcessSpawner as ChildProcessSpawnerService } from "effect/process/ChildProcessSpawner";
 import { HttpClient } from "effect/http";
@@ -566,7 +566,8 @@ export const makeDatabase = (
   DatabaseError,
   | FileSystem.FileSystem
   | Path.Path
-  | Crypto.Crypto
+  | SecureRandom.SecureRandom
+  | Digest.Digest
   | ChildProcessSpawner.ChildProcessSpawner
   | HttpClient.HttpClient
   | Scope.Scope
@@ -574,7 +575,8 @@ export const makeDatabase = (
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
+    const digest = yield* Digest.Digest;
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     const client = yield* HttpClient.HttpClient;
     const logs = yield* PubSub.sliding<LaunchOutput>(256);
@@ -614,6 +616,7 @@ export const makeDatabase = (
             fs,
             path,
             crypto,
+            digest,
             container,
             spawner,
             ...(options.helpers === undefined ? {} : { helpers: options.helpers }),
@@ -628,7 +631,8 @@ export const makeDatabase = (
       }).pipe(
         Effect.provideService(FileSystem.FileSystem, fs),
         Effect.provideService(Path.Path, path),
-        Effect.provideService(Crypto.Crypto, crypto),
+        Effect.provideService(SecureRandom.SecureRandom, crypto),
+        Effect.provideService(Digest.Digest, digest),
         Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
         Effect.mapError((cause) => errorFor("snapshot", cause)),
       );
@@ -730,7 +734,8 @@ export const makeDatabase = (
         return prepareNativeArtifact({ service: "database", pin }, options.cacheRoot).pipe(
           Effect.provideService(FileSystem.FileSystem, fs),
           Effect.provideService(Path.Path, path),
-          Effect.provideService(Crypto.Crypto, crypto),
+          Effect.provideService(SecureRandom.SecureRandom, crypto),
+          Effect.provideService(Digest.Digest, digest),
           Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
           Effect.provideService(HttpClient.HttpClient, client),
           Effect.asVoid,
@@ -944,7 +949,7 @@ export const makeDatabase = (
             // replacing it, and its derived name lets recovery find a leftover without a journal.
             const runtimeRoot = yield* asRoot(acquireNativeRuntimeRoot());
             const socketPath = yield* nativeSocketDirectoryPath(
-              crypto,
+              digest,
               path,
               runtimeRoot,
               options.root,
@@ -998,7 +1003,8 @@ export const makeDatabase = (
               Scope.provide(launchScope),
               Effect.provideService(FileSystem.FileSystem, fs),
               Effect.provideService(Path.Path, path),
-              Effect.provideService(Crypto.Crypto, crypto),
+              Effect.provideService(SecureRandom.SecureRandom, crypto),
+              Effect.provideService(Digest.Digest, digest),
               Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
               Effect.provideService(HttpClient.HttpClient, client),
               Effect.mapError((cause) => errorFor("launch", cause)),
@@ -1111,7 +1117,7 @@ export const makeDatabase = (
         ? removeNativeSocketDirectory(options.root, options.instanceId).pipe(
             Effect.provideService(FileSystem.FileSystem, fs),
             Effect.provideService(Path.Path, path),
-            Effect.provideService(Crypto.Crypto, crypto),
+            Effect.provideService(Digest.Digest, digest),
             Effect.mapError((cause) => errorFor("destroy", cause)),
           )
         : Effect.void;
diff --git a/packages/stack/src/services/DatabaseSnapshot.integration.test.ts b/packages/stack/src/services/DatabaseSnapshot.integration.test.ts
index a04ea1f8c1..577890ae03 100644
--- a/packages/stack/src/services/DatabaseSnapshot.integration.test.ts
+++ b/packages/stack/src/services/DatabaseSnapshot.integration.test.ts
@@ -1,8 +1,7 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Clock,
-  Crypto,
   Data,
   Effect,
   Exit,
@@ -14,6 +13,7 @@ import {
   Scope,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { resolveArtifact } from "../Artifacts.ts";
 import { selection } from "../../tests/pins.ts";
@@ -40,7 +40,8 @@ class ShellError extends Data.TaggedError("ShellError")<{ readonly message: stri
 
 type Services =
   | ChildProcessSpawner.ChildProcessSpawner
-  | Crypto.Crypto
+  | SecureRandom.SecureRandom
+  | Digest.Digest
   | FileSystem.FileSystem
   | Path.Path
   | Scope.Scope;
@@ -74,7 +75,7 @@ const rewriting = (
 ): Spawner =>
   ChildProcessSpawner.make((command) => {
     if (!ChildProcess.isStandardCommand(command)) return spawner.spawn(command);
-    const replaced = rewrite(command.command, command.args);
+    const replaced = rewrite(command.command, command.args.map(String));
     if (replaced === undefined) return spawner.spawn(command);
     const [executable = "", ...args] = replaced;
     return spawner.spawn(ChildProcess.make(executable, args, command.options));
@@ -200,7 +201,7 @@ const StorageMarker = Schema.fromJsonString(
 const docker = Effect.fnUntraced(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const services = yield* Effect.context<Services>();
   const scope = yield* Scope.Scope;
@@ -213,9 +214,7 @@ const docker = Effect.fnUntraced(function* () {
     target,
     root,
   });
-  const helpers = yield* makeDockerHelperRegistry(
-    `snapshot-contract-${yield* crypto.randomUUIDv4}`,
-  );
+  const helpers = yield* makeDockerHelperRegistry(`snapshot-contract-${yield* crypto.uuidV4()}`);
   const inspector = yield* Ref.make<string | undefined>(undefined);
   // The inspector mounts the store volume only after storage has created and labelled it.
   const inspect = (volume: string) =>
@@ -281,6 +280,7 @@ const docker = Effect.fnUntraced(function* () {
         fs: overrides.fs ?? fs,
         path,
         crypto,
+        digest: yield* Digest.Digest,
         container,
         spawner: overrides.partialCopy === true ? partialCopy : spawner,
         helpers,
@@ -368,7 +368,7 @@ const setup = <E>(make: () => Effect.Effect<Engine, E, Services>) =>
   });
 
 const live = <A, E>(effect: Effect.Effect<A, E, Services>) =>
-  Effect.scoped(effect).pipe(Effect.provide(NodeServices.layer));
+  Effect.scoped(effect).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer]));
 
 for (const { name, make } of engines)
   describe(`${name} database snapshots`, { timeout: 120_000 }, () => {
diff --git a/packages/stack/src/services/DatabaseSnapshot.ts b/packages/stack/src/services/DatabaseSnapshot.ts
index 79106f2ad7..4ef9d7208e 100644
--- a/packages/stack/src/services/DatabaseSnapshot.ts
+++ b/packages/stack/src/services/DatabaseSnapshot.ts
@@ -2,7 +2,6 @@
 import { DatabaseSync } from "node:sqlite";
 import {
   Clock,
-  Crypto,
   Data,
   Effect,
   Exit,
@@ -13,6 +12,7 @@ import {
   Schedule,
   Schema,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import type { PlatformError } from "effect/PlatformError";
 import { ChildProcessSpawner } from "effect/process";
 import type { ArtifactPin } from "../Artifacts.ts";
@@ -174,7 +174,8 @@ export const makeSnapshotStore = Effect.fn("DatabaseSnapshot.makeStore")(functio
 }) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
+  const hasher = yield* Digest.Digest;
   const { backends, runtime, version } = options;
   const { Adopt, Clear, Copy, Ensure, Expect, ExpectEmpty, ExpectText } = SnapshotStep;
   const { Prune, Read, Recover, Remove, Rename, Touch, Write } = SnapshotStep;
@@ -197,7 +198,9 @@ export const makeSnapshotStore = Effect.fn("DatabaseSnapshot.makeStore")(functio
       const bytes = yield* Schema.encodeEffect(Schema.fromJsonString(SnapshotIdentity))(
         identity,
       ).pipe(
-        Effect.flatMap((encoded) => crypto.digest("SHA-256", new TextEncoder().encode(encoded))),
+        Effect.flatMap((encoded) =>
+          hasher.digest(Digest.sha256, new TextEncoder().encode(encoded)),
+        ),
       );
       const keyDigest = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
       const descriptor = yield* Schema.encodeEffect(Schema.fromJsonString(SnapshotDescriptor))({
@@ -214,7 +217,7 @@ export const makeSnapshotStore = Effect.fn("DatabaseSnapshot.makeStore")(functio
       "lock",
       fs.makeDirectory(path.dirname(backend.lockFile), { recursive: true, mode: 0o700 }),
     ).pipe(Effect.andThen(withStoreLock(backend.lockFile, effect)));
-  const token = mapError("stage", crypto.randomUUIDv4);
+  const token = crypto.uuidV4();
   // Compensation also runs after an interrupt; a failed compensation must not hide the
   // failure it follows.
   const compensate =
diff --git a/packages/stack/src/services/Functions.integration.test.ts b/packages/stack/src/services/Functions.integration.test.ts
index 25aa3e351f..b594c1d395 100644
--- a/packages/stack/src/services/Functions.integration.test.ts
+++ b/packages/stack/src/services/Functions.integration.test.ts
@@ -1,8 +1,7 @@
-import { NodeHttpClient, NodePath, NodeServices } from "@effect/platform-node";
-import { describe, expect, it } from "@effect/vitest";
+import { NodeCrypto, NodeHttpClient, NodePath, NodeServices } from "@effect/platform-node";
+import { beforeAll, describe, expect, it } from "@effect/vitest";
 import {
   Cause,
-  Crypto,
   Deferred,
   Effect,
   Exit,
@@ -14,14 +13,17 @@ import {
   Scope,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { prepareNativeArtifact } from "../Artifacts.ts";
 import type { FunctionsBootstrapOwner } from "../functions/FunctionsBootstrap.ts";
 import { ContainerError, type ContainerRuntime } from "../runtime/Container.ts";
 import { makeFakeNpmRegistry } from "../../tests/fake-npm-registry.ts";
 import { makeStandaloneService } from "../../tests/standalone-service.ts";
 import { makeServiceRecipe } from "./Catalog.ts";
 import * as Functions from "./Functions.ts";
+import { serviceJwt } from "./ServiceConfig.ts";
 import { makeProcessRecipe } from "./ProcessRecipe.ts";
 import { engineTarget, testEngine } from "../../tests/engine-target.ts";
 import { httpHost } from "../../tests/helpers/endpoint.ts";
@@ -145,61 +147,85 @@ describe("service catalog", () => {
           expect(inspectorResponse.status).toBe(200);
           yield* instance.stop;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 
-  it.live("destroy survives a symlink planted where its runtime directory used to be", () =>
-    Effect.scoped(
-      Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const path = yield* Path.Path;
-        const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-symlink-" });
-        const stackId = "c".repeat(64);
-        const instanceId = "functions-symlink-instance";
-        const callerRoot = yield* fs.makeTempDirectoryScoped({
-          prefix: "functions-symlink-caller-",
-        });
-        const functionsRoot = `${callerRoot}/user-functions`;
-        yield* fs.makeDirectory(functionsRoot, { recursive: true });
-        yield* fs.writeFileString(`${functionsRoot}/index.ts`, "export default {};");
-        const recipe = yield* makeServiceRecipe(
-          {
-            service: "functions",
-            pin: selection.functions,
-            config: { functionsRoot, databaseUrl: "postgres://functions-db" },
-          },
-          {
-            ...options(root),
-            stackId,
-            instanceId,
-            cacheRoot: testArtifactCacheRoot,
-          },
-        );
-        const config = recipe.creation;
-        yield* recipe.definition.prepare?.(config) ?? Effect.void;
-        const instanceRoot = path.join(root, instanceId);
-        const runtimeDir = path.join(instanceRoot, "runtime");
-        expect(yield* fs.exists(runtimeDir)).toBe(true);
-        const outside = yield* fs.makeTempDirectoryScoped({
-          prefix: "functions-symlink-outside-",
-        });
-        // removeData reaches for `<runtime>/functions` specifically, not the whole runtime
-        // directory; the sentinel sits there so this test proves that previously endangered
-        // data survives, not just the symlink target's top level.
-        const sentinel = path.join(outside, "functions", "sentinel");
-        yield* fs.makeDirectory(path.join(outside, "functions"), { recursive: true });
-        yield* fs.writeFileString(sentinel, "do not remove me");
-        // The planted attack: the recipe's own runtime directory replaced by a symlink.
-        yield* fs.remove(runtimeDir, { recursive: true, force: true });
-        yield* fs.symlink(outside, runtimeDir);
-        const scope = yield* Scope.make();
-        yield* recipe.definition.removeData({ id: instanceId, config, scope });
-        yield* Scope.close(scope, Exit.void);
-        expect(yield* fs.exists(sentinel)).toBe(true);
-      }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
-  );
+  describe("with a warm Edge Runtime artifact", () => {
+    // A cold download can outlast the test timeout, so it gets its own guard here.
+    beforeAll(
+      () =>
+        prepareNativeArtifact(
+          { service: "functions", pin: selection.functions },
+          testArtifactCacheRoot,
+        ).pipe(
+          Effect.provide(
+            Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+          ),
+        ),
+      120_000,
+    );
+
+    it.live("destroy survives a symlink planted where its runtime directory used to be", () =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const root = yield* fs.makeTempDirectoryScoped({ prefix: "functions-symlink-" });
+          const stackId = "c".repeat(64);
+          const instanceId = "functions-symlink-instance";
+          const callerRoot = yield* fs.makeTempDirectoryScoped({
+            prefix: "functions-symlink-caller-",
+          });
+          const functionsRoot = `${callerRoot}/user-functions`;
+          yield* fs.makeDirectory(functionsRoot, { recursive: true });
+          yield* fs.writeFileString(`${functionsRoot}/index.ts`, "export default {};");
+          const recipe = yield* makeServiceRecipe(
+            {
+              service: "functions",
+              pin: selection.functions,
+              config: { functionsRoot, databaseUrl: "postgres://functions-db" },
+            },
+            {
+              ...options(root),
+              stackId,
+              instanceId,
+              cacheRoot: testArtifactCacheRoot,
+            },
+          );
+          const config = recipe.creation;
+          yield* recipe.definition.prepare?.(config) ?? Effect.void;
+          const instanceRoot = path.join(root, instanceId);
+          const runtimeDir = path.join(instanceRoot, "runtime");
+          expect(yield* fs.exists(runtimeDir)).toBe(true);
+          const outside = yield* fs.makeTempDirectoryScoped({
+            prefix: "functions-symlink-outside-",
+          });
+          // removeData reaches for `<runtime>/functions` specifically, not the whole runtime
+          // directory; the sentinel sits there so this test proves that previously endangered
+          // data survives, not just the symlink target's top level.
+          const sentinel = path.join(outside, "functions", "sentinel");
+          yield* fs.makeDirectory(path.join(outside, "functions"), { recursive: true });
+          yield* fs.writeFileString(sentinel, "do not remove me");
+          // The planted attack: the recipe's own runtime directory replaced by a symlink.
+          yield* fs.remove(runtimeDir, { recursive: true, force: true });
+          yield* fs.symlink(outside, runtimeDir);
+          const scope = yield* Scope.make();
+          yield* recipe.definition.removeData({ id: instanceId, config, scope });
+          yield* Scope.close(scope, Exit.void);
+          expect(yield* fs.exists(sentinel)).toBe(true);
+        }),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
+    );
+  });
 
   const ancestors = [
     {
@@ -294,7 +320,11 @@ describe("service catalog", () => {
             expect(yield* response.text).toBe("shared");
             yield* instance.stop;
           }),
-        ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+        ).pipe(
+          Effect.provide(
+            Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+          ),
+        ),
       { timeout: 120_000 },
     );
 
@@ -368,7 +398,11 @@ describe("service catalog", () => {
           expect(yield* response.text).toBe("config");
           yield* instance.stop;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 
@@ -456,7 +490,11 @@ describe("service catalog", () => {
           );
           yield* instance.stop;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 });
@@ -486,7 +524,7 @@ for (const runtime of ["native", testEngine] as const) {
           yield* fs.makeDirectory(`${filesRoot}/source`, { recursive: true });
           yield* fs.writeFileString(
             `${filesRoot}/source/main.ts`,
-            `import {message} from "message"; Deno.serve(async () => Response.json({message, local: Deno.env.get("LOCAL"), shared: Deno.env.get("SHARED"), asset: await Deno.readTextFile(new URL("./asset.txt", import.meta.url))}));`,
+            `import {message} from "message"; Deno.serve(async () => Response.json({message, local: Deno.env.get("LOCAL"), shared: Deno.env.get("SHARED"), multi: Deno.env.get("MULTI"), legacy: Deno.env.get("LEGACY.NAME"), perFunction: Deno.env.get("PER_FUNCTION"), nul: Deno.env.get("NUL_VALUE"), asset: await Deno.readTextFile(new URL("./asset.txt", import.meta.url))}));`,
           );
           yield* fs.writeFileString(
             `${filesRoot}/source/message.ts`,
@@ -501,6 +539,12 @@ for (const runtime of ["native", testEngine] as const) {
             `${functionsRoot}/locked/index.ts`,
             'Deno.serve(() => new Response("locked"));',
           );
+          /* No functions entry: its env arrives only through $default. */
+          yield* fs.makeDirectory(`${functionsRoot}/unlisted`, { recursive: true });
+          yield* fs.writeFileString(
+            `${functionsRoot}/unlisted/index.ts`,
+            'Deno.serve(() => Response.json({multi: Deno.env.get("MULTI"), legacy: Deno.env.get("LEGACY.NAME"), perFunction: Deno.env.get("PER_FUNCTION"), nul: Deno.env.get("NUL_VALUE")}));',
+          );
           const recipe = yield* makeServiceRecipe(
             {
               service: "functions",
@@ -513,6 +557,10 @@ for (const runtime of ["native", testEngine] as const) {
                 env: {
                   SHARED: "shared",
                   LOCAL: "global",
+                  MULTI: "first\r\nsecond\nthird",
+                  "LEGACY.NAME": "legacy",
+                  NUL_VALUE: "a\0b",
+                  PER_FUNCTION: "shared\nvalue",
                   SUPABASE_INTERNAL_DEBUG: "true",
                 },
                 functions: {
@@ -521,7 +569,7 @@ for (const runtime of ["native", testEngine] as const) {
                     entrypoint: `${filesRoot}/source/main.ts`,
                     import_map: `${filesRoot}/supabase/import_map.json`,
                     static_files: [`${filesRoot}/source/*.txt`],
-                    env: { LOCAL: "function" },
+                    env: { LOCAL: "function", PER_FUNCTION: "function\r\nvalue" },
                   },
                   disabled: { enabled: false, entrypoint: `${filesRoot}/source/main.ts` },
                 },
@@ -569,6 +617,10 @@ for (const runtime of ["native", testEngine] as const) {
                   message: Schema.String,
                   local: Schema.String,
                   shared: Schema.String,
+                  multi: Schema.String,
+                  legacy: Schema.String,
+                  perFunction: Schema.String,
+                  nul: Schema.String,
                   asset: Schema.String,
                 }),
               ),
@@ -577,8 +629,38 @@ for (const runtime of ["native", testEngine] as const) {
               message: "custom entrypoint",
               local: "function",
               shared: "shared",
+              multi: "first\r\nsecond\nthird",
+              legacy: "legacy",
+              perFunction: "function\r\nvalue",
+              nul: "a\0b",
               asset: "static content",
             });
+            const unlisted = yield* client.execute(
+              HttpClientRequest.get(`${base}/unlisted`).pipe(
+                HttpClientRequest.bearerToken(
+                  yield* serviceJwt("anon", "test-function-jwt-with-at-least-32-characters"),
+                ),
+              ),
+            );
+            const unlistedText = yield* unlisted.text;
+            expect(unlisted.status, unlistedText).toBe(200);
+            expect(
+              yield* Schema.decodeEffect(
+                Schema.fromJsonString(
+                  Schema.Struct({
+                    multi: Schema.String,
+                    legacy: Schema.String,
+                    perFunction: Schema.String,
+                    nul: Schema.String,
+                  }),
+                ),
+              )(unlistedText),
+            ).toEqual({
+              multi: "first\r\nsecond\nthird",
+              legacy: "legacy",
+              perFunction: "shared\nvalue",
+              nul: "a\0b",
+            });
             expect((yield* client.get(`${base}/disabled`)).status).toBe(404);
             expect((yield* client.get(`${base}/locked`)).status).toBe(401);
             yield* instance.stop;
@@ -592,7 +674,11 @@ for (const runtime of ["native", testEngine] as const) {
             ),
           );
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 }
@@ -690,7 +776,11 @@ it.live(
           ),
         );
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   { timeout: 120_000 },
 );
 
@@ -739,7 +829,8 @@ it.effect("passes POSIX project paths to a docker Functions container from a Win
         borrowCallerPath: () => Effect.die("borrowCallerPath not exercised in this test"),
         fs: yield* FileSystem.FileSystem,
         path: yield* Path.Path.pipe(Effect.provide(NodePath.layerWin32)),
-        crypto: yield* Crypto.Crypto,
+        crypto: yield* SecureRandom.SecureRandom,
+        digest: yield* Digest.Digest,
         client: yield* HttpClient.HttpClient,
         spawner: yield* ChildProcessSpawner.ChildProcessSpawner,
         container,
@@ -785,5 +876,82 @@ it.effect("passes POSIX project paths to a docker Functions container from a Win
         static_files: ["/__supabase_project/source/*.txt"],
       });
     }),
-  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
+);
+
+it.effect("passes the API host port and debug mode to the docker Functions runtime", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const launched = yield* Ref.make<Parameters<ContainerRuntime["launch"]>[0] | undefined>(
+        undefined,
+      );
+      const container: ContainerRuntime = {
+        prepare: () => Effect.void,
+        prepareImage: (image) => Effect.succeed(image),
+        ensureImage: (image) => Effect.succeed({ image, pulled: false }),
+        launchCommand: () => Effect.die("Functions has no startup commands"),
+        launch: (spec) =>
+          Ref.set(launched, spec).pipe(
+            Effect.andThen(
+              Effect.fail(new ContainerError({ operation: "start", message: "captured" })),
+            ),
+          ),
+      };
+      const fakeBootstrap: FunctionsBootstrapOwner = {
+        root: "/fake-bootstrap-root",
+        write: () => Effect.succeed("/fake-bootstrap-root/generation-fake/index.ts"),
+      };
+      const deps = {
+        borrowCallerPath: () => Effect.die("borrowCallerPath not exercised in this test"),
+        fs: yield* FileSystem.FileSystem,
+        path: yield* Path.Path,
+        crypto: yield* SecureRandom.SecureRandom,
+        digest: yield* Digest.Digest,
+        client: yield* HttpClient.HttpClient,
+        spawner: yield* ChildProcessSpawner.ChildProcessSpawner,
+        container,
+      };
+      const recipe = yield* makeProcessRecipe(
+        { ...options("/stack"), stackId: "f".repeat(64), runtime: "docker" },
+        deps,
+        Functions.makeSpec(fakeBootstrap, deps.path, deps.fs),
+      );
+      const capture = Effect.fn(function* (apiUrl: string) {
+        const scope = yield* Scope.make();
+        yield* recipe.definition
+          .launch({
+            id: "debug",
+            config: {
+              service: "functions",
+              pin: selection.functions,
+              config: {
+                functionsRoot: "/project/supabase/functions",
+                apiUrl,
+                debug: true,
+                env: { PLAIN: "plain" },
+              },
+            },
+            scope,
+            launchId: 1,
+          })
+          .pipe(Effect.flip, Effect.ensuring(Scope.close(scope, Exit.void)));
+        return yield* Ref.get(launched);
+      });
+
+      const spec = yield* capture("http://host.supabase.internal:61121");
+      expect(spec?.env.SUPABASE_INTERNAL_HOST_PORT).toBe("61121");
+      expect(spec?.env.SUPABASE_INTERNAL_DEBUG).toBe("true");
+      expect(spec?.args).toContain("--verbose");
+      expect(spec?.env.PLAIN).toBe("plain");
+      expect((yield* capture("http://127.0.0.1:80"))?.env.SUPABASE_INTERNAL_HOST_PORT).toBe("80");
+    }),
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
diff --git a/packages/stack/src/services/Functions.ts b/packages/stack/src/services/Functions.ts
index 91f0b26f7a..33da70b38e 100644
--- a/packages/stack/src/services/Functions.ts
+++ b/packages/stack/src/services/Functions.ts
@@ -1,4 +1,5 @@
-import { Crypto, Effect, FileSystem, Path, Schema } from "effect";
+import { Effect, FileSystem, Path, Schema } from "effect";
+import { Digest } from "effect/crypto";
 import {
   makeFunctionsBootstrapOwner,
   type FunctionsBootstrapOwner,
@@ -46,6 +47,7 @@ export const Config = Schema.Struct({
   policy: Schema.optionalKey(Schema.String),
   verifyJwt: Schema.optionalKey(Schema.Boolean),
   inspector: Schema.optionalKey(Schema.Boolean),
+  debug: Schema.optionalKey(Schema.Boolean),
 });
 
 export interface Config extends Schema.Schema.Type<typeof Config> {}
@@ -108,6 +110,13 @@ export const makeSpec = (
         container && filesRoot === undefined
           ? "/__supabase_functions"
           : runtimePath(creation.config.functionsRoot);
+      /* A process env cannot carry these names or values; the JSON runtime config carries them
+         once in $default, which the bootstrap merges under each function's own env. */
+      const portable = ([name, value]: readonly [string, string]) =>
+        /^[A-Za-z_][A-Za-z0-9_]*$/u.test(name) && !/[\0\r\n]/u.test(value);
+      const entries = Object.entries(creation.config.env ?? {});
+      const configEnv = Object.fromEntries(entries.filter((entry) => !portable(entry)));
+      const hasConfigEnv = Object.keys(configEnv).length > 0;
       const functions = Object.fromEntries(
         Object.entries(creation.config.functions ?? {}).map(([name, settings]) => [
           name,
@@ -132,11 +141,16 @@ export const makeSpec = (
       const serviceRoleKey =
         creation.config.serviceRoleKey ??
         (jwt === undefined ? undefined : yield* serviceJwt("service_role", jwt));
+      const apiUrl =
+        creation.config.apiUrl === undefined ? null : URL.parse(creation.config.apiUrl);
+      /* URL.port is empty for the scheme's default port. */
+      const hostPort =
+        apiUrl === null ? undefined : apiUrl.port || (apiUrl.protocol === "https:" ? "443" : "80");
       return {
         // The image has no passwd entry: Docker then defaults HOME to /, Podman leaves it unset,
         // and the runtime needs it to place its Deno cache.
         ...(container ? { HOME: "/" } : {}),
-        ...creation.config.env,
+        ...Object.fromEntries(entries.filter(portable)),
         ...(http === undefined ? {} : { EDGE_RUNTIME_PORT: String(http.port) }),
         SUPABASE_INTERNAL_FUNCTIONS_ROOT: root,
         ...(filesRoot === undefined
@@ -152,12 +166,20 @@ export const makeSpec = (
         ...(creation.config.secretKey === undefined
           ? {}
           : { SUPABASE_INTERNAL_SECRET_KEY: creation.config.secretKey }),
-        ...(creation.config.verifyJwt === undefined && creation.config.functions === undefined
+        ...(creation.config.verifyJwt === undefined &&
+        creation.config.functions === undefined &&
+        !hasConfigEnv
           ? {}
           : {
               SUPABASE_INTERNAL_FUNCTIONS_CONFIG: yield* Schema.encodeEffect(
                 FunctionsRuntimeConfigJson,
-              )({ $default: { verifyJWT: creation.config.verifyJwt ?? true }, ...functions }).pipe(
+              )({
+                $default: {
+                  verifyJWT: creation.config.verifyJwt ?? true,
+                  ...(hasConfigEnv ? { env: configEnv } : {}),
+                },
+                ...functions,
+              }).pipe(
                 Effect.mapError(
                   (cause) =>
                     new ServiceError({
@@ -169,6 +191,8 @@ export const makeSpec = (
               ),
             }),
         ...(creation.config.apiUrl === undefined ? {} : { SUPABASE_URL: creation.config.apiUrl }),
+        ...(hostPort === undefined ? {} : { SUPABASE_INTERNAL_HOST_PORT: hostPort }),
+        ...(creation.config.debug === true ? { SUPABASE_INTERNAL_DEBUG: "true" } : {}),
         ...(creation.config.databaseUrl === undefined
           ? {}
           : { SUPABASE_DB_URL: creation.config.databaseUrl }),
@@ -206,6 +230,7 @@ export const makeSpec = (
         ...(creation.config.inspector === true && inspector !== undefined
           ? [`--inspect=${context.container ? "0.0.0.0" : "127.0.0.1"}:${inspector.port}`]
           : []),
+        ...(creation.config.debug === true ? ["--verbose"] : []),
       ];
     }),
   mounts: (creation) =>
@@ -266,7 +291,7 @@ export const makeRecipe = Effect.fn("Functions.makeRecipe")(
       }).pipe(
         Effect.provideService(FileSystem.FileSystem, deps.fs),
         Effect.provideService(Path.Path, deps.path),
-        Effect.provideService(Crypto.Crypto, deps.crypto),
+        Effect.provideService(Digest.Digest, deps.digest),
         Effect.mapError(
           (cause) =>
             new CatalogError({
diff --git a/packages/stack/src/services/Imgproxy.ts b/packages/stack/src/services/Imgproxy.ts
index cc5dbbca72..21cb2716a0 100644
--- a/packages/stack/src/services/Imgproxy.ts
+++ b/packages/stack/src/services/Imgproxy.ts
@@ -25,6 +25,13 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
         ? {}
         : { IMGPROXY_BIND: `${container ? "0.0.0.0" : "127.0.0.1"}:${http.port}` }),
       IMGPROXY_LOCAL_FILESYSTEM_ROOT: "/",
+      IMGPROXY_MAX_SRC_RESOLUTION: "50",
+      IMGPROXY_MAX_SRC_FILE_SIZE: "25000000",
+      IMGPROXY_MAX_ANIMATION_FRAMES: "60",
+      IMGPROXY_ENABLE_WEBP_DETECTION: "true",
+      IMGPROXY_PRESETS: "default=width:3000/height:8192",
+      IMGPROXY_FORMAT_QUALITY: "jpeg=80,avif=62,webp=80",
+      /* IMGPROXY_USE_ETAG is left out: imgproxy treats the legacy "/" like unset (no ETag). */
     });
   },
   args: () => Effect.succeed([]),
diff --git a/packages/stack/src/services/Mail.integration.test.ts b/packages/stack/src/services/Mail.integration.test.ts
index 84a0ed4bde..e4661f68b9 100644
--- a/packages/stack/src/services/Mail.integration.test.ts
+++ b/packages/stack/src/services/Mail.integration.test.ts
@@ -1,12 +1,13 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, FileSystem, Layer, Path } from "effect";
+import { Data, Effect, Exit, FileSystem, Layer, Path, Ref, Stream } from "effect";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 import { makeStandaloneService } from "../../tests/standalone-service.ts";
 import { makeServiceRecipe } from "./Catalog.ts";
 import { engineTarget, testEngine } from "../../tests/engine-target.ts";
 import { httpHost } from "../../tests/helpers/endpoint.ts";
 import { selection } from "../../tests/pins.ts";
+import { failOnStall } from "../../tests/stall-guard.ts";
 
 const options = (root: string) => ({
   stackId: "catalog-mail",
@@ -59,31 +60,67 @@ const sendTestEmail = (
     yield* HttpClientResponse.filterStatusOk(response);
   });
 
+class MailStallError extends Data.TaggedError("MailStallError")<{ readonly message: string }> {}
+
+const mailStall = (duration: `${number} seconds`, phase: Ref.Ref<string>, logs: Ref.Ref<string>) =>
+  failOnStall(
+    duration,
+    Effect.all([Ref.get(phase), Ref.get(logs)]).pipe(
+      Effect.flatMap(([stalled, output]) =>
+        Effect.fail(
+          new MailStallError({
+            message: `Mailpit ${stalled} did not finish within ${duration}; output:\n${output || "(none)"}`,
+          }),
+        ),
+      ),
+    ),
+  );
+
 describe("service catalog", () => {
   it.live("launches the real Mailpit recipe and serves its HTTP endpoint", () =>
-    Effect.scoped(
-      Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const client = yield* HttpClient.HttpClient;
-        const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-mail-" });
-        const recipe = yield* makeServiceRecipe(
-          { service: "mail", pin: selection.mail, config: {} },
-          dockerOptions(root),
-        );
-        const instance = yield* makeStandaloneService(recipe.definition, {
-          id: "mail",
-          config: recipe.creation,
-        });
-        yield* instance.start;
-        yield* instance.ready;
-        const endpoint = yield* recipe.endpoint("http");
-        const response = yield* client.execute(
-          HttpClientRequest.get(`http://${httpHost(endpoint)}:${endpoint.port}/readyz`),
-        );
-        expect(response.status).toBe(200);
-        yield* instance.stop;
-      }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    Effect.gen(function* () {
+      const phase = yield* Ref.make("setup");
+      const logs = yield* Ref.make("");
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const client = yield* HttpClient.HttpClient;
+          const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-mail-" });
+          const recipe = yield* makeServiceRecipe(
+            { service: "mail", pin: selection.mail, config: {} },
+            dockerOptions(root),
+          );
+          const decoders = { stdout: new TextDecoder(), stderr: new TextDecoder() };
+          yield* Stream.fromSubscription(yield* recipe.logs).pipe(
+            Stream.runForEach(({ stream, bytes }) =>
+              Ref.update(logs, (text) => text + decoders[stream].decode(bytes, { stream: true })),
+            ),
+            Effect.forkScoped({ startImmediately: true }),
+          );
+          const instance = yield* makeStandaloneService(recipe.definition, {
+            id: "mail",
+            config: recipe.creation,
+          });
+          yield* Ref.set(phase, "start");
+          yield* instance.start;
+          yield* Ref.set(phase, "readiness");
+          yield* instance.ready;
+          yield* Ref.set(phase, "/readyz request");
+          const endpoint = yield* recipe.endpoint("http");
+          const response = yield* client.execute(
+            HttpClientRequest.get(`http://${httpHost(endpoint)}:${endpoint.port}/readyz`),
+          );
+          expect(response.status).toBe(200);
+          yield* Ref.set(phase, "stop");
+          yield* instance.stop;
+          yield* Ref.set(phase, "scope teardown");
+        }),
+      ).pipe(mailStall("25 seconds", phase, logs));
+    }).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live(
@@ -121,7 +158,11 @@ describe("service catalog", () => {
             concurrency: "unbounded",
           });
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
   );
 
   it.live("keeps a captured email after a native mail stop and start", () =>
@@ -153,7 +194,11 @@ describe("service catalog", () => {
         );
         yield* instance.stop;
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live("keeps a captured email after a Docker mail stop and start", () =>
@@ -187,7 +232,11 @@ describe("service catalog", () => {
         );
         yield* instance.stop;
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live("removes the native mail instance directory when destroyed", () =>
@@ -211,7 +260,11 @@ describe("service catalog", () => {
         yield* instance.destroy;
         expect(yield* fs.exists(instanceRoot)).toBe(false);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 
   it.live("rejects a traversal instance id and creates nothing outside the root", () =>
@@ -232,6 +285,10 @@ describe("service catalog", () => {
         expect(Exit.isFailure(exit)).toBe(true);
         expect(yield* fs.exists(path.join(root, "..", "escaped"))).toBe(false);
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 });
diff --git a/packages/stack/src/services/Pooler.integration.test.ts b/packages/stack/src/services/Pooler.integration.test.ts
index 343b9249be..f2eae33556 100644
--- a/packages/stack/src/services/Pooler.integration.test.ts
+++ b/packages/stack/src/services/Pooler.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Context, Effect, Layer, Redacted } from "effect";
 import { PgClient } from "@effect/sql-pg";
@@ -108,7 +108,11 @@ describe("service catalog", () => {
           }
           yield* database.stop;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 });
diff --git a/packages/stack/src/services/Pooler.ts b/packages/stack/src/services/Pooler.ts
index b49f41ff34..3fb2c90ab5 100644
--- a/packages/stack/src/services/Pooler.ts
+++ b/packages/stack/src/services/Pooler.ts
@@ -2,6 +2,7 @@ import { Effect, Schema } from "effect";
 import { EndpointIntent, serviceCreation } from "./Recipe.ts";
 import { databaseConnection, requiredInput, localJwtSecret } from "./ServiceConfig.ts";
 import {
+  DEFAULT_ERL_MAX_PORTS,
   DEFAULT_LOCAL_SERVICE_SECRET_KEY_BASE,
   DEFAULT_POOLER_VAULT_ENCRYPTION_KEY,
 } from "../Defaults.ts";
@@ -48,6 +49,7 @@ const environment: ProcessRecipeSpec<Creation>["env"] = (creation, endpoints, co
       DEFAULT_POOL_SIZE: String(creation.config.defaultPoolSize ?? 20),
       MAX_CLIENT_CONN: String(creation.config.maxClientConnections ?? 100),
       POOL_MODE: mode,
+      ERL_MAX_PORTS: DEFAULT_ERL_MAX_PORTS,
       // Supavisor advertises Ranch-bound ports, so native instances can use ephemeral internal listeners.
       ...(container
         ? {}
diff --git a/packages/stack/src/services/Pooler.unit.test.ts b/packages/stack/src/services/Pooler.unit.test.ts
index e813f5a6c9..475e3f0545 100644
--- a/packages/stack/src/services/Pooler.unit.test.ts
+++ b/packages/stack/src/services/Pooler.unit.test.ts
@@ -2,6 +2,25 @@ import { describe, expect, it } from "@effect/vitest";
 import { Effect } from "effect";
 import type { ServiceEndpoint } from "./Recipe.ts";
 import * as Pooler from "./Pooler.ts";
+import { selection } from "../../tests/pins.ts";
+
+describe("Pooler environment", () => {
+  it.effect("caps Supavisor's BEAM port table", () =>
+    Effect.gen(function* () {
+      const env = yield* Pooler.makeSpec().env(
+        {
+          service: "pooler",
+          pin: selection.pooler,
+          config: { databaseUrl: "postgresql://supabase_admin:postgres@db.internal:5432/postgres" },
+        },
+        new Map(),
+        true,
+      );
+
+      expect(env).toMatchObject({ ERL_MAX_PORTS: "65536" });
+    }),
+  );
+});
 
 describe("native Pooler readiness output", () => {
   it.effect("requires the selected HTTP port on a successful endpoint bind line", () =>
diff --git a/packages/stack/src/services/ProcessRecipe.integration.test.ts b/packages/stack/src/services/ProcessRecipe.integration.test.ts
index 694d40496f..5a55727293 100644
--- a/packages/stack/src/services/ProcessRecipe.integration.test.ts
+++ b/packages/stack/src/services/ProcessRecipe.integration.test.ts
@@ -1,9 +1,8 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   PlatformError,
   Context,
-  Crypto,
   Deferred,
   Effect,
   Exit,
@@ -17,6 +16,7 @@ import {
   Sink,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { TestClock } from "effect/testing";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
@@ -193,7 +193,8 @@ describe("ProcessRecipe launch cleanup", () => {
           const dependencies = {
             fs: yield* FileSystem.FileSystem,
             path: yield* Path.Path,
-            crypto: yield* Crypto.Crypto,
+            crypto: yield* SecureRandom.SecureRandom,
+            digest: yield* Digest.Digest,
             client: yield* HttpClient.HttpClient,
             spawner: yield* ChildProcessSpawner.ChildProcessSpawner,
             container,
@@ -221,7 +222,11 @@ describe("ProcessRecipe launch cleanup", () => {
           expect(yield* Ref.get(serviceLaunches)).toBe(1);
           expect(yield* Ref.get(active)).toBe(1);
           yield* service.stop;
-        }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+        }).pipe(
+          Effect.provide(
+            Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+          ),
+        ),
       ),
     );
   }
@@ -231,7 +236,7 @@ describe("ProcessRecipe launch cleanup", () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const client = yield* HttpClient.HttpClient;
         const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
         const cleanupFailure = yield* Ref.make(true);
@@ -245,7 +250,7 @@ describe("ProcessRecipe launch cleanup", () => {
                 !command.args.some(
                   (argument) =>
                     argument === "__supabase_stack_native__" ||
-                    argument.endsWith("/native-launcher.ts"),
+                    (typeof argument === "string" && argument.endsWith("/native-launcher.ts")),
                 )
               )
                 return handle;
@@ -284,6 +289,7 @@ describe("ProcessRecipe launch cleanup", () => {
           fs,
           path,
           crypto,
+          digest: yield* Digest.Digest,
           client,
           spawner,
           container: undefined,
@@ -306,7 +312,11 @@ describe("ProcessRecipe launch cleanup", () => {
         yield* Ref.set(cleanupFailure, false);
         yield* service.stop;
         expect((yield* service.get).lifecycle).toBe("stopped");
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
   );
 
@@ -315,7 +325,7 @@ describe("ProcessRecipe launch cleanup", () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const client = yield* HttpClient.HttpClient;
         const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
         const testScope = yield* Scope.Scope;
@@ -396,6 +406,7 @@ describe("ProcessRecipe launch cleanup", () => {
           fs,
           path,
           crypto,
+          digest: yield* Digest.Digest,
           client,
           spawner,
           container: undefined,
@@ -420,7 +431,11 @@ describe("ProcessRecipe launch cleanup", () => {
           expect(port).toBeLessThan(nativePortBase + nativePortSpan);
         }
         yield* service.stop;
-      }).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     ),
   );
 });
@@ -476,7 +491,8 @@ const realtimeService = Effect.fn(function* (container: ContainerRuntime) {
       borrowCallerPath: () => Effect.die("borrowCallerPath not exercised in this test"),
       fs: yield* FileSystem.FileSystem,
       path: yield* Path.Path,
-      crypto: yield* Crypto.Crypto,
+      crypto: yield* SecureRandom.SecureRandom,
+      digest: yield* Digest.Digest,
       client: yield* HttpClient.HttpClient,
       spawner: yield* ChildProcessSpawner.ChildProcessSpawner,
       container,
@@ -486,7 +502,7 @@ const realtimeService = Effect.fn(function* (container: ContainerRuntime) {
   return yield* makeStandaloneService(recipe.definition, { id: "realtime", config: creation });
 });
 
-const platform = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const platform = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 
 const nativeFixtureArtifact = Effect.fn(function* (
   cacheRoot: string,
@@ -672,7 +688,7 @@ const nativeRestRecipe = Effect.fn(function* (
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const client = yield* HttpClient.HttpClient;
   const cacheRoot = path.join(root, "cache");
   yield* nativeRestArtifact(cacheRoot, program);
@@ -690,6 +706,7 @@ const nativeRestRecipe = Effect.fn(function* (
       fs,
       path,
       crypto,
+      digest: yield* Digest.Digest,
       client,
       spawner,
       container: undefined,
@@ -791,15 +808,15 @@ describe("process recipe startup", () => {
     Effect.scoped(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "process-recipe-claim-" });
         const state = Context.get(
           yield* Layer.build(StackNamespace.layer({ root: `${root}/state` })),
           StackNamespace.Service,
         );
-        const owner = `recipe-claim-owner-${yield* crypto.randomUUIDv4}`;
-        const other = `recipe-claim-other-${yield* crypto.randomUUIDv4}`;
+        const owner = `recipe-claim-owner-${yield* crypto.uuidV4()}`;
+        const other = `recipe-claim-other-${yield* crypto.uuidV4()}`;
         for (const id of [owner, other])
           yield* state.save({
             id,
@@ -949,7 +966,7 @@ describe("process recipe startup", () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const client = yield* HttpClient.HttpClient;
         const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "process-recipe-port-race-" });
@@ -1034,6 +1051,7 @@ describe("process recipe startup", () => {
             fs,
             path,
             crypto,
+            digest: yield* Digest.Digest,
             client,
             spawner: interceptingSpawner,
             container: undefined,
@@ -1078,7 +1096,7 @@ describe("process recipe startup", () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const client = yield* HttpClient.HttpClient;
         const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
         const root = yield* fs.makeTempDirectoryScoped({
@@ -1113,6 +1131,7 @@ describe("process recipe startup", () => {
             fs,
             path,
             crypto,
+            digest: yield* Digest.Digest,
             client,
             spawner: countingSpawner(spawner, mainLaunches, startupLaunches, true),
             container: undefined,
@@ -1165,7 +1184,7 @@ describe("process recipe startup", () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const client = yield* HttpClient.HttpClient;
         const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "process-recipe-deadline-" });
@@ -1252,6 +1271,7 @@ describe("process recipe startup", () => {
             fs,
             path,
             crypto,
+            digest: yield* Digest.Digest,
             client,
             spawner: deadlineSpawner,
             container: undefined,
@@ -1286,7 +1306,7 @@ describe("process recipe startup", () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const client = yield* HttpClient.HttpClient;
         const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
         const root = yield* fs.makeTempDirectoryScoped({
@@ -1321,6 +1341,7 @@ describe("process recipe startup", () => {
             fs,
             path,
             crypto,
+            digest: yield* Digest.Digest,
             client,
             spawner: countingSpawner(spawner, mainLaunches, startupLaunches),
             container: undefined,
@@ -1356,7 +1377,7 @@ describe("process recipe startup", () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
         const client = yield* HttpClient.HttpClient;
         const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "process-recipe-exit-failure-" });
@@ -1432,6 +1453,7 @@ describe("process recipe startup", () => {
             fs,
             path,
             crypto,
+            digest: yield* Digest.Digest,
             client,
             spawner: failingSpawner,
             container: undefined,
diff --git a/packages/stack/src/services/ProcessRecipe.ts b/packages/stack/src/services/ProcessRecipe.ts
index 792fa0718f..c2dc2914ef 100644
--- a/packages/stack/src/services/ProcessRecipe.ts
+++ b/packages/stack/src/services/ProcessRecipe.ts
@@ -2,7 +2,6 @@ import { withAttemptCount } from "../internal/attempts.ts";
 import {
   Cause,
   Clock,
-  Crypto,
   Data,
   Deferred,
   Duration,
@@ -17,6 +16,7 @@ import {
   Scope,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { ChildProcessSpawner } from "effect/process";
 import type { ChildProcessSpawner as ChildProcessSpawnerService } from "effect/process/ChildProcessSpawner";
 import { HttpClient, HttpClientRequest } from "effect/http";
@@ -188,7 +188,8 @@ export const resolveStartupCommand = <C extends RecipeCreation<ServiceKind, unkn
 export interface ProcessDependencies {
   readonly fs: FileSystem.FileSystem;
   readonly path: Path.Path;
-  readonly crypto: Crypto.Crypto;
+  readonly crypto: SecureRandom.SecureRandom["Service"];
+  readonly digest: Digest.Digest["Service"];
   readonly client: HttpClient.HttpClient;
   readonly spawner: ChildProcessSpawnerService["Service"];
   readonly container: ContainerRuntime | undefined;
@@ -446,7 +447,8 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
         ).pipe(
           Effect.provideService(FileSystem.FileSystem, deps.fs),
           Effect.provideService(Path.Path, deps.path),
-          Effect.provideService(Crypto.Crypto, deps.crypto),
+          Effect.provideService(SecureRandom.SecureRandom, deps.crypto),
+          Effect.provideService(Digest.Digest, deps.digest),
           Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, deps.spawner),
           Effect.provideService(HttpClient.HttpClient, deps.client),
           Effect.mapError((cause) => serviceError("prepare", cause)),
@@ -480,7 +482,8 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
           Scope.provide(launchScope),
           Effect.provideService(FileSystem.FileSystem, deps.fs),
           Effect.provideService(Path.Path, deps.path),
-          Effect.provideService(Crypto.Crypto, deps.crypto),
+          Effect.provideService(SecureRandom.SecureRandom, deps.crypto),
+          Effect.provideService(Digest.Digest, deps.digest),
           Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, deps.spawner),
           Effect.provideService(HttpClient.HttpClient, deps.client),
           Effect.mapError((cause) => serviceError("launch", cause)),
diff --git a/packages/stack/src/services/Realtime.integration.test.ts b/packages/stack/src/services/Realtime.integration.test.ts
index 03c0b72c80..3abd1d7afb 100644
--- a/packages/stack/src/services/Realtime.integration.test.ts
+++ b/packages/stack/src/services/Realtime.integration.test.ts
@@ -1,14 +1,16 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Layer, Redacted } from "effect";
+import { Data, Effect, Layer, Redacted, Ref, Stream } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { makeStandaloneService } from "../../tests/standalone-service.ts";
 import { makeServiceRecipe } from "./Catalog.ts";
+import type { CatalogLogs } from "./Recipe.ts";
 import { makeDockerHttpRelay, makeDockerTcpRelay } from "../../tests/docker-relay.ts";
 import { makeDockerDatabaseRoot } from "../../tests/docker-fixture.ts";
 import { engineTarget, testEngine } from "../../tests/engine-target.ts";
 import { httpHost } from "../../tests/helpers/endpoint.ts";
 import { selection } from "../../tests/pins.ts";
+import { failOnStall } from "../../tests/stall-guard.ts";
 
 const options = (root: string) => ({
   stackId: "catalog-realtime",
@@ -25,120 +27,198 @@ const dockerOptions = (root: string) => ({
   engineTarget,
 });
 
+class CatalogStallError extends Data.TaggedError("CatalogStallError")<{
+  readonly message: string;
+}> {}
+
+/** Tracks the current launch phase and each service's output so a stall names both. */
+const makeLaunchTrace = Effect.gen(function* () {
+  const phase = yield* Ref.make({ service: "database", step: "setup" });
+  const outputs = yield* Ref.make<ReadonlyMap<string, string>>(new Map());
+  const capture = Effect.fnUntraced(function* (service: string, logs: CatalogLogs) {
+    const decoders = { stdout: new TextDecoder(), stderr: new TextDecoder() };
+    yield* Stream.fromSubscription(yield* logs).pipe(
+      Stream.runForEach(({ stream, bytes }) =>
+        Ref.update(outputs, (current) =>
+          new Map(current).set(
+            service,
+            ((current.get(service) ?? "") + decoders[stream].decode(bytes, { stream: true })).slice(
+              -4_000,
+            ),
+          ),
+        ),
+      ),
+      Effect.forkScoped({ startImmediately: true }),
+    );
+  });
+  const enter = (service: string, step: string) => Ref.set(phase, { service, step });
+  const guard = (duration: `${number} seconds`) =>
+    failOnStall(
+      duration,
+      Effect.all([Ref.get(phase), Ref.get(outputs)]).pipe(
+        Effect.flatMap(([{ service, step }, output]) =>
+          Effect.fail(
+            new CatalogStallError({
+              message: [
+                `${service} ${step} did not finish within ${duration}`,
+                ...(service === "database" ? [service] : [service, "database"]).map(
+                  (name) => `${name} output:\n${output.get(name) || "(none)"}`,
+                ),
+              ].join("\n"),
+            }),
+          ),
+        ),
+      ),
+    );
+  return { capture, enter, guard };
+});
+
 describe("service catalog", () => {
   it.live(
     "serves Realtime, pg-meta, and Studio against the owned database",
     () =>
-      Effect.scoped(
-        Effect.gen(function* () {
-          const client = yield* HttpClient.HttpClient;
-          const root = yield* makeDockerDatabaseRoot("catalog-optional-api-");
-          const secret = "catalog-optional-api-secret-with-at-least-32-chars";
-          const databaseRecipe = yield* makeServiceRecipe(
-            {
-              service: "database",
-              pin: selection.database,
-              config: {
-                databasePassword: Redacted.make("postgres"),
-                jwtSecret: Redacted.make(secret),
-                jwtExpiry: 3600,
+      Effect.gen(function* () {
+        const trace = yield* makeLaunchTrace;
+        yield* Effect.scoped(
+          Effect.gen(function* () {
+            const client = yield* HttpClient.HttpClient;
+            const root = yield* makeDockerDatabaseRoot("catalog-optional-api-");
+            const secret = "catalog-optional-api-secret-with-at-least-32-chars";
+            const databaseRecipe = yield* makeServiceRecipe(
+              {
+                service: "database",
+                pin: selection.database,
+                config: {
+                  databasePassword: Redacted.make("postgres"),
+                  jwtSecret: Redacted.make(secret),
+                  jwtExpiry: 3600,
+                },
               },
-            },
-            dockerOptions(root),
-          );
-          const database = yield* makeStandaloneService(databaseRecipe.definition, {
-            id: "database",
-            config: databaseRecipe.creation,
-          });
-          yield* database.start;
-          yield* database.ready;
-          const databaseRelay = yield* makeDockerTcpRelay(databaseRecipe.endpoint("sql"));
-          const databaseUrl = `postgresql://supabase_admin:postgres@${databaseRelay.host}:${databaseRelay.port}/postgres`;
+              dockerOptions(root),
+            );
+            yield* trace.capture("database", databaseRecipe.logs);
+            const database = yield* makeStandaloneService(databaseRecipe.definition, {
+              id: "database",
+              config: databaseRecipe.creation,
+            });
+            yield* trace.enter("database", "start");
+            yield* database.start;
+            yield* trace.enter("database", "readiness");
+            yield* database.ready;
+            yield* trace.enter("database", "relay");
+            const databaseRelay = yield* makeDockerTcpRelay(databaseRecipe.endpoint("sql"));
+            const databaseUrl = `postgresql://supabase_admin:postgres@${databaseRelay.host}:${databaseRelay.port}/postgres`;
 
-          const realtimeRecipe = yield* makeServiceRecipe(
-            {
-              service: "realtime",
-              pin: selection.realtime,
-              config: { databaseUrl, jwtSecret: secret },
-            },
-            dockerOptions(root),
-          );
-          const realtime = yield* makeStandaloneService(realtimeRecipe.definition, {
-            id: "realtime",
-            config: realtimeRecipe.creation,
-          });
-          yield* realtime.start;
-          yield* realtime.ready;
-          const realtimeEndpoint = yield* realtimeRecipe.endpoint("http");
-          const realtimeResponse = yield* client.execute(
-            HttpClientRequest.get(
-              `http://${httpHost(realtimeEndpoint)}:${realtimeEndpoint.port}/healthcheck`,
-            ),
-          );
-          expect(realtimeResponse.status).toBe(200);
+            yield* trace.enter("realtime", "recipe");
+            const realtimeRecipe = yield* makeServiceRecipe(
+              {
+                service: "realtime",
+                pin: selection.realtime,
+                config: { databaseUrl, jwtSecret: secret },
+              },
+              dockerOptions(root),
+            );
+            yield* trace.capture("realtime", realtimeRecipe.logs);
+            const realtime = yield* makeStandaloneService(realtimeRecipe.definition, {
+              id: "realtime",
+              config: realtimeRecipe.creation,
+            });
+            yield* trace.enter("realtime", "start");
+            yield* realtime.start;
+            yield* trace.enter("realtime", "readiness");
+            yield* realtime.ready;
+            yield* trace.enter("realtime", "/healthcheck request");
+            const realtimeEndpoint = yield* realtimeRecipe.endpoint("http");
+            const realtimeResponse = yield* client.execute(
+              HttpClientRequest.get(
+                `http://${httpHost(realtimeEndpoint)}:${realtimeEndpoint.port}/healthcheck`,
+              ),
+            );
+            expect(realtimeResponse.status).toBe(200);
+            yield* trace.enter("pgmeta", "recipe");
 
-          const pgmetaRecipe = yield* makeServiceRecipe(
-            { service: "pgmeta", pin: selection.pgmeta, config: { databaseUrl } },
-            dockerOptions(root),
-          );
-          const pgmeta = yield* makeStandaloneService(pgmetaRecipe.definition, {
-            id: "pgmeta",
-            config: pgmetaRecipe.creation,
-          });
-          yield* pgmeta.start;
-          yield* pgmeta.ready;
-          const pgmetaEndpoint = yield* pgmetaRecipe.endpoint("http");
-          const pgmetaRelay = yield* makeDockerHttpRelay(pgmetaRecipe.endpoint("http"));
-          const schemasResponse = yield* client.execute(
-            HttpClientRequest.get(
-              `http://${httpHost(pgmetaEndpoint)}:${pgmetaEndpoint.port}/schemas`,
-            ),
-          );
-          expect(schemasResponse.status).toBe(200);
-          expect(yield* schemasResponse.text).toContain("public");
+            const pgmetaRecipe = yield* makeServiceRecipe(
+              { service: "pgmeta", pin: selection.pgmeta, config: { databaseUrl } },
+              dockerOptions(root),
+            );
+            yield* trace.capture("pgmeta", pgmetaRecipe.logs);
+            const pgmeta = yield* makeStandaloneService(pgmetaRecipe.definition, {
+              id: "pgmeta",
+              config: pgmetaRecipe.creation,
+            });
+            yield* trace.enter("pgmeta", "start");
+            yield* pgmeta.start;
+            yield* trace.enter("pgmeta", "readiness");
+            yield* pgmeta.ready;
+            yield* trace.enter("pgmeta", "relay");
+            const pgmetaEndpoint = yield* pgmetaRecipe.endpoint("http");
+            const pgmetaRelay = yield* makeDockerHttpRelay(pgmetaRecipe.endpoint("http"));
+            yield* trace.enter("pgmeta", "/schemas request");
+            const schemasResponse = yield* client.execute(
+              HttpClientRequest.get(
+                `http://${httpHost(pgmetaEndpoint)}:${pgmetaEndpoint.port}/schemas`,
+              ),
+            );
+            expect(schemasResponse.status).toBe(200);
+            expect(yield* schemasResponse.text).toContain("public");
+            yield* trace.enter("studio", "recipe");
 
-          const studioRecipe = yield* makeServiceRecipe(
-            {
-              service: "studio",
-              pin: selection.studio,
-              config: {
-                databaseUrl,
-                pgmetaUrl: `http://${pgmetaRelay.host}:${pgmetaRelay.port}`,
-                analyticsApiKey: "catalog-analytics-key",
-                apiUrl: "http://localhost:8000",
-                publicApiUrl: "http://localhost:8000",
-                jwtSecret: secret,
+            const studioRecipe = yield* makeServiceRecipe(
+              {
+                service: "studio",
+                pin: selection.studio,
+                config: {
+                  databaseUrl,
+                  pgmetaUrl: `http://${pgmetaRelay.host}:${pgmetaRelay.port}`,
+                  analyticsApiKey: "catalog-analytics-key",
+                  apiUrl: "http://localhost:8000",
+                  publicApiUrl: "http://localhost:8000",
+                  jwtSecret: secret,
+                },
               },
-            },
-            dockerOptions(root),
-          );
-          const studio = yield* makeStandaloneService(studioRecipe.definition, {
-            id: "studio",
-            config: studioRecipe.creation,
-          });
-          yield* studio.start;
-          yield* studio.ready;
-          const studioEndpoint = yield* studioRecipe.endpoint("http");
-          const profileResponse = yield* client.execute(
-            HttpClientRequest.get(
-              `http://${httpHost(studioEndpoint)}:${studioEndpoint.port}/api/platform/profile`,
-            ),
-          );
-          expect(profileResponse.status).toBe(200);
-          const queryResponse = yield* client.execute(
-            HttpClientRequest.post(
-              `http://${httpHost(studioEndpoint)}:${studioEndpoint.port}/api/platform/pg-meta/default/query`,
-            ).pipe(HttpClientRequest.bodyJsonUnsafe({ query: "select current_user" })),
-          );
-          expect(queryResponse.status).toBe(200);
-          expect(yield* queryResponse.text).toContain('"current_user":"postgres"');
+              dockerOptions(root),
+            );
+            yield* trace.capture("studio", studioRecipe.logs);
+            const studio = yield* makeStandaloneService(studioRecipe.definition, {
+              id: "studio",
+              config: studioRecipe.creation,
+            });
+            yield* trace.enter("studio", "start");
+            yield* studio.start;
+            yield* trace.enter("studio", "readiness");
+            yield* studio.ready;
+            yield* trace.enter("studio", "API requests");
+            const studioEndpoint = yield* studioRecipe.endpoint("http");
+            const profileResponse = yield* client.execute(
+              HttpClientRequest.get(
+                `http://${httpHost(studioEndpoint)}:${studioEndpoint.port}/api/platform/profile`,
+              ),
+            );
+            expect(profileResponse.status).toBe(200);
+            const queryResponse = yield* client.execute(
+              HttpClientRequest.post(
+                `http://${httpHost(studioEndpoint)}:${studioEndpoint.port}/api/platform/pg-meta/default/query`,
+              ).pipe(HttpClientRequest.bodyJsonUnsafe({ query: "select current_user" })),
+            );
+            expect(queryResponse.status).toBe(200);
+            expect(yield* queryResponse.text).toContain('"current_user":"postgres"');
 
-          yield* studio.stop;
-          yield* pgmeta.stop;
-          yield* realtime.stop;
-          yield* database.stop;
-        }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+            yield* trace.enter("studio", "stop");
+            yield* studio.stop;
+            yield* trace.enter("pgmeta", "stop");
+            yield* pgmeta.stop;
+            yield* trace.enter("realtime", "stop");
+            yield* realtime.stop;
+            yield* trace.enter("database", "stop");
+            yield* database.stop;
+            yield* trace.enter("database", "scope teardown");
+          }),
+        ).pipe(trace.guard("110 seconds"));
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 });
diff --git a/packages/stack/src/services/Realtime.ts b/packages/stack/src/services/Realtime.ts
index cf5de65e93..d7cb404b5c 100644
--- a/packages/stack/src/services/Realtime.ts
+++ b/packages/stack/src/services/Realtime.ts
@@ -2,6 +2,7 @@ import { Effect, Schema } from "effect";
 import { EndpointIntent, serviceCreation } from "./Recipe.ts";
 import { databaseConnection, requiredInput, localJwtSecret } from "./ServiceConfig.ts";
 import {
+  DEFAULT_ERL_MAX_PORTS,
   DEFAULT_LOCAL_SERVICE_SECRET_KEY_BASE,
   DEFAULT_REALTIME_DB_ENCRYPTION_KEY,
 } from "../Defaults.ts";
@@ -83,6 +84,7 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
         MAX_HEADER_LENGTH: String(creation.config.maxHeaderLength ?? 4096),
         ERL_AFLAGS:
           creation.config.ipVersion === "IPv6" ? "-proto_dist inet6_tcp" : "-proto_dist inet_tcp",
+        ERL_MAX_PORTS: DEFAULT_ERL_MAX_PORTS,
         // The stack database listens on IPv4 only. This covers Realtime's own repo; tenant
         // connections probe IPv6 first and rely on the runtime host alias having no AAAA record.
         DB_IP_VERSION: "ipv4",
diff --git a/packages/stack/src/services/Realtime.unit.test.ts b/packages/stack/src/services/Realtime.unit.test.ts
index 719d907aa8..b805cf40c8 100644
--- a/packages/stack/src/services/Realtime.unit.test.ts
+++ b/packages/stack/src/services/Realtime.unit.test.ts
@@ -31,6 +31,12 @@ it.effect("connects to the database over IPv4 whichever family Realtime binds",
   }),
 );
 
+it.effect("caps Realtime's BEAM port table", () =>
+  Effect.gen(function* () {
+    expect(yield* realtimeEnv(undefined)).toMatchObject({ ERL_MAX_PORTS: "65536" });
+  }),
+);
+
 it.effect("requires the selected HTTP port on a successful native endpoint bind line", () =>
   Effect.sync(() => {
     const readinessOutput = makeSpec().nativeReadinessOutput;
diff --git a/packages/stack/src/services/Rest.integration.test.ts b/packages/stack/src/services/Rest.integration.test.ts
index 1a1156c960..0ad3ba121d 100644
--- a/packages/stack/src/services/Rest.integration.test.ts
+++ b/packages/stack/src/services/Rest.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Context, Effect, FileSystem, Layer, Path, Redacted, Ref } from "effect";
 import { PgClient } from "@effect/sql-pg";
@@ -198,7 +198,11 @@ describe("service catalog", () => {
           yield* databaseNamespace.release;
           yield* network.releaseStack;
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 120_000 },
   );
 
@@ -308,6 +312,10 @@ END $$;`);
         yield* rest.stop;
         yield* database.stop;
       }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    ).pipe(
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
+    ),
   );
 });
diff --git a/packages/stack/src/services/StorageGateway.integration.test.ts b/packages/stack/src/services/StorageGateway.integration.test.ts
index 6b7a744cc1..b1a7a3bcc1 100644
--- a/packages/stack/src/services/StorageGateway.integration.test.ts
+++ b/packages/stack/src/services/StorageGateway.integration.test.ts
@@ -1,6 +1,7 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
-import { Context, Crypto, Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
+import { Context, Effect, FileSystem, Layer, Option, Path, Redacted } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import {
   DEFAULT_LOCAL_S3_ACCESS_KEY_ID,
@@ -48,8 +49,8 @@ const layout = Effect.fnUntraced(function* (runtime: SavedStack["runtime"], stac
 /** Starts Database and Storage in an owned stack and returns Storage's gateway URL. */
 const serveStorage = Effect.fnUntraced(function* (runtime: SavedStack["runtime"]) {
   const fs = yield* FileSystem.FileSystem;
-  const crypto = yield* Crypto.Crypto;
-  const stackId = `storage-gateway-${runtime}-${(yield* crypto.randomUUIDv4).slice(0, 8)}`;
+  const crypto = yield* SecureRandom.SecureRandom;
+  const stackId = `storage-gateway-${runtime}-${(yield* crypto.uuidV4()).slice(0, 8)}`;
   const { stateRoot, dataRoot, storageRoot } = yield* layout(runtime, stackId);
   yield* fs.makeDirectory(storageRoot, { recursive: true });
   const saved: SavedStack = {
@@ -180,6 +181,10 @@ for (const runtime of ["native", testEngine] as const)
               expect(Option.getOrUndefined(info.uid)).toBe(process.getuid?.());
           }
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
     { timeout: 180_000 },
   );
diff --git a/packages/stack/src/services/Studio.integration.test.ts b/packages/stack/src/services/Studio.integration.test.ts
index e86f1fd392..15f9365676 100644
--- a/packages/stack/src/services/Studio.integration.test.ts
+++ b/packages/stack/src/services/Studio.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { Effect, FileSystem, Layer } from "effect";
 import { makeStandaloneService } from "../../tests/standalone-service.ts";
@@ -41,6 +41,10 @@ describe("studio recipe", () => {
           const failure = yield* studio.start.pipe(Effect.flip);
           expect(failure.message).toContain("resolves inside the owned data root");
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+      ).pipe(
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
+      ),
   );
 });
diff --git a/packages/stack/src/services/Studio.ts b/packages/stack/src/services/Studio.ts
index 30a57e44e9..d5039a6b16 100644
--- a/packages/stack/src/services/Studio.ts
+++ b/packages/stack/src/services/Studio.ts
@@ -1,4 +1,5 @@
 import { Effect, Schema } from "effect";
+import { DEFAULT_LOCAL_S3_ACCESS_KEY_ID, DEFAULT_LOCAL_S3_SECRET_ACCESS_KEY } from "../Defaults.ts";
 import { EndpointIntent, serviceCreation } from "./Recipe.ts";
 import { databaseConnection, serviceJwt } from "./ServiceConfig.ts";
 import { type ProcessRecipeSpec } from "./ProcessRecipe.ts";
@@ -53,6 +54,12 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
       const values: Record<string, string> = {
         ...(http === undefined ? {} : { PORT: String(http.port) }),
         HOSTNAME: container ? "0.0.0.0" : "127.0.0.1",
+        S3_PROTOCOL_ACCESS_KEY_ID: DEFAULT_LOCAL_S3_ACCESS_KEY_ID,
+        S3_PROTOCOL_ACCESS_KEY_SECRET: DEFAULT_LOCAL_S3_SECRET_ACCESS_KEY,
+        ENABLED_FEATURES_LOGS_ALL: String(
+          creation.config.analyticsUrl !== undefined &&
+            creation.config.analyticsApiKey !== undefined,
+        ),
       };
       if (creation.config.databaseUrl !== undefined) {
         // Studio encrypts a connection string from these for pg-meta; the bootstrap gives the
@@ -68,10 +75,8 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
         values.STUDIO_PG_META_URL = creation.config.pgmetaUrl;
       if (creation.config.analyticsUrl !== undefined)
         values.LOGFLARE_URL = creation.config.analyticsUrl;
-      if (creation.config.analyticsApiKey !== undefined) {
+      if (creation.config.analyticsApiKey !== undefined)
         values.LOGFLARE_PRIVATE_ACCESS_TOKEN = creation.config.analyticsApiKey;
-        values.NEXT_PUBLIC_ENABLE_LOGS = "true";
-      }
       if (creation.config.analyticsBackend !== undefined)
         values.NEXT_ANALYTICS_BACKEND_PROVIDER = creation.config.analyticsBackend;
       if (jwt !== undefined) values.AUTH_JWT_SECRET = jwt;
diff --git a/packages/stack/src/services/Studio.unit.test.ts b/packages/stack/src/services/Studio.unit.test.ts
index 3df34ffb7f..9439573507 100644
--- a/packages/stack/src/services/Studio.unit.test.ts
+++ b/packages/stack/src/services/Studio.unit.test.ts
@@ -1,5 +1,6 @@
 import { expect, it } from "@effect/vitest";
 import { Effect } from "effect";
+import { DEFAULT_LOCAL_S3_ACCESS_KEY_ID, DEFAULT_LOCAL_S3_SECRET_ACCESS_KEY } from "../Defaults.ts";
 import { makeSpec, type Creation } from "./Studio.ts";
 import { selection } from "../../tests/pins.ts";
 
@@ -42,3 +43,29 @@ it.effect("mounts the snippets folder read-write and names it per runtime", () =
     ]);
   }),
 );
+
+it.effect("gives Studio the local S3 protocol keys that Storage accepts", () =>
+  Effect.gen(function* () {
+    const env = yield* makeSpec().env(creation({}), new Map(), false);
+    expect(env).toMatchObject({
+      S3_PROTOCOL_ACCESS_KEY_ID: DEFAULT_LOCAL_S3_ACCESS_KEY_ID,
+      S3_PROTOCOL_ACCESS_KEY_SECRET: DEFAULT_LOCAL_S3_SECRET_ACCESS_KEY,
+    });
+  }),
+);
+
+it.effect("gives Studio its Logs pages only when analytics is bound", () =>
+  Effect.gen(function* () {
+    const spec = makeSpec();
+    const analyticsEnv = yield* spec.env(
+      creation({ analyticsUrl: "http://127.0.0.1:4000", analyticsApiKey: "api-key" }),
+      new Map(),
+      false,
+    );
+    const keyOnlyEnv = yield* spec.env(creation({ analyticsApiKey: "api-key" }), new Map(), false);
+    const noAnalyticsEnv = yield* spec.env(creation({}), new Map(), false);
+    expect(analyticsEnv.ENABLED_FEATURES_LOGS_ALL).toBe("true");
+    expect(keyOnlyEnv.ENABLED_FEATURES_LOGS_ALL).toBe("false");
+    expect(noAnalyticsEnv.ENABLED_FEATURES_LOGS_ALL).toBe("false");
+  }),
+);
diff --git a/packages/stack/src/shutdown.integration.test.ts b/packages/stack/src/shutdown.integration.test.ts
index 0f09f2baa4..74c04924fb 100644
--- a/packages/stack/src/shutdown.integration.test.ts
+++ b/packages/stack/src/shutdown.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Context, Data, Effect, FileSystem, Layer, Option, Schema, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
@@ -9,7 +9,7 @@ import { StackError } from "./Rpc.ts";
 import * as StackNamespace from "./StackNamespace.ts";
 import { open as openEffect } from "./effect.ts";
 
-const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
 class FixtureError extends Data.TaggedError("ShutdownFixtureError")<{ readonly message: string }> {}
 const fixturePath = fileURLToPath(new URL("../tests/host-process-fixture.ts", import.meta.url));
 
diff --git a/packages/stack/src/storage/DockerDatabaseStorage.integration.test.ts b/packages/stack/src/storage/DockerDatabaseStorage.integration.test.ts
index 436f181c09..c379cbe225 100644
--- a/packages/stack/src/storage/DockerDatabaseStorage.integration.test.ts
+++ b/packages/stack/src/storage/DockerDatabaseStorage.integration.test.ts
@@ -1,12 +1,12 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { fileURLToPath } from "node:url";
 import {
   Clock,
   ConfigProvider,
-  Crypto,
   Data,
   Deferred,
+  Duration,
   Effect,
   Exit,
   Fiber,
@@ -20,9 +20,10 @@ import {
   Ref,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import * as TestClock from "effect/testing/TestClock";
-import { resolveArtifact, type ArtifactPin } from "../Artifacts.ts";
+import { resolveArtifact, slimImageMirrors, type ArtifactPin } from "../Artifacts.ts";
 import {
   makeContainerRuntime,
   removeStackContainers,
@@ -42,6 +43,19 @@ const dockerTarget: EngineTarget = { engine: "docker", argv: [], daemonId: "test
 const containerTarget: EngineTarget = { ...engineTarget, argv: [] };
 const postgresImage = (pin: ArtifactPin) =>
   resolveArtifact({ service: "database", pin }).pipe(Effect.map(({ image }) => image));
+/** Falls back to the registry mirror the stack wires in production when the primary rate-limits. */
+const containerRuntime = (options: Parameters<typeof makeContainerRuntime>[0]) =>
+  makeContainerRuntime({ imageMirrors: slimImageMirrors, ...options });
+/** Pulls a database image for direct engine runs, returning the mirror reference when it fell back. */
+const preparedPostgresImage = Effect.fnUntraced(function* (
+  pin: ArtifactPin,
+  target: EngineTarget = dockerTarget,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-image-" });
+  const container = yield* containerRuntime({ target, root });
+  return yield* container.prepareImage(yield* postgresImage(pin));
+});
 const Marker = Schema.Struct({
   backend: Schema.Literals(["docker", "host"]),
   volume: Schema.optionalKey(Schema.String),
@@ -58,6 +72,19 @@ class DockerTestError extends Data.TaggedError("DockerTestError")<{
 class PublishBarrierError extends Data.TaggedError("PublishBarrierError")<{
   readonly message: string;
 }> {}
+class PhaseStallError extends Data.TaggedError("PhaseStallError")<{
+  readonly message: string;
+}> {}
+
+/** Fails with the stalled phase's name before the test's own timeout hides which step hung. */
+const phaseDeadline =
+  (phase: string, seconds = 5) =>
+  <A, E, R>(self: Effect.Effect<A, E, R>) =>
+    Effect.timeoutOrElse(self, {
+      duration: Duration.seconds(seconds),
+      orElse: () =>
+        Effect.fail(new PhaseStallError({ message: `${phase} did not finish within ${seconds}s` })),
+    });
 
 const dockerStoragePublishLoopFixture = fileURLToPath(
   new URL("../../tests/docker-storage-publish-loop-fixture.ts", import.meta.url),
@@ -88,7 +115,7 @@ const fakeHelperEngine = (
     Effect.gen(function* () {
       if (!ChildProcess.isStandardCommand(command))
         return yield* Effect.die("unexpected piped command");
-      const args = [...command.args];
+      const args = command.args.map(String);
       commands.push(args);
       if (args[0] === "info") return handle(0, "fake-daemon-id");
       if (args[0] === "version") return handle(0, "27.0.0|27.0.0");
@@ -195,15 +222,15 @@ const ownerDeathScenario = (mode: "instance" | "shared" | "stall-before-start")
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
-      const crypto = yield* Crypto.Crypto;
+      const crypto = yield* SecureRandom.SecureRandom;
       const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
       const shared = mode === "shared";
       const stalled = mode === "stall-before-start";
       const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-helper-owner-death-" });
-      const stackId = `storage-owner-death-${yield* crypto.randomUUIDv4}`;
+      const stackId = `storage-owner-death-${yield* crypto.uuidV4()}`;
       const filter = `label=com.supabase.stack=${stackId}`;
       // Pull before spawning so a cold image cache does not consume the owner's readiness timeout.
-      const container = yield* makeContainerRuntime({ target: dockerTarget, root });
+      const container = yield* containerRuntime({ target: dockerTarget, root });
       yield* container.prepareImage(yield* postgresImage(selection.database));
       const child = yield* spawner.spawn(
         ChildProcess.make(
@@ -312,7 +339,7 @@ const ownerDeathScenario = (mode: "instance" | "shared" | "stall-before-start")
       }
       expect(yield* engine(["ps", "-aq", "--filter", filter])).toBe("");
     }),
-  ).pipe(Effect.provide(NodeServices.layer));
+  ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer]));
 
 // The volume backend, helper registry and volume-labelling contracts exist only on Docker; Podman
 // always stores data in host directories, covered by the host storage suite below.
@@ -340,7 +367,8 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const root = yield* fs.makeTempDirectoryScoped({
             prefix: "docker-helper-create-cancel-",
           });
@@ -393,6 +421,7 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
+            digest,
             spawner,
             container: {
               prepare: () => Effect.void,
@@ -410,43 +439,59 @@ describe.runIf(testEngine === "docker")(
           yield* Fiber.await(operation);
           expect(yield* Ref.get(removals)).toEqual([true]);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
-    it.effect("reports a helper readiness timeout alongside Docker warnings", () =>
+    it.effect("reports a helper readiness timeout with Docker warnings and the helper state", () =>
       Effect.scoped(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-helper-timeout-" });
           const waiting = yield* Deferred.make<void>();
           const commands: string[][] = [];
+          let attachKilled = false;
           const warning =
             "WARNING: The requested image's platform does not match the host platform";
           const spawner = ChildProcessSpawner.make((command) =>
             Effect.gen(function* () {
               if (!ChildProcess.isStandardCommand(command))
                 return yield* Effect.die("Unexpected command");
-              commands.push([...command.args]);
+              commands.push(command.args.map(String));
               const creating = command.args[0] === "create";
               const attaching = command.args[0] === "start";
+              const encode = (text: string) => Stream.succeed(new TextEncoder().encode(text));
+              // `--rm` removes the helper once its attach is killed, so later inspection fails.
+              const removed = command.args[0] === "inspect" && attachKilled;
               return ChildProcessSpawner.makeHandle({
                 pid: ChildProcessSpawner.ProcessId(0),
-                exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(0)),
+                exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(removed ? 1 : 0)),
                 isRunning: Effect.succeed(false),
-                kill: () => Effect.void,
+                kill: () =>
+                  Effect.sync(() => {
+                    if (attaching) attachKilled = true;
+                  }),
                 stdin: Sink.drain,
                 stdout: attaching
                   ? Stream.fromEffect(Deferred.succeed(waiting, undefined)).pipe(
                       Stream.drain,
                       Stream.concat(Stream.never),
                     )
-                  : Stream.empty,
+                  : command.args[0] === "inspect" && !removed
+                    ? encode("running\t0\t\n")
+                    : command.args[0] === "logs"
+                      ? encode("supabase-helper-ready\n")
+                      : Stream.empty,
                 // Docker prints the platform warning while creating the container, before start.
                 stderr: creating
-                  ? Stream.succeed(new TextEncoder().encode(`${warning}\n`))
-                  : Stream.empty,
+                  ? encode(`${warning}\n`)
+                  : removed
+                    ? encode("Error: No such container\n")
+                    : command.args[0] === "logs"
+                      ? encode("helper stderr line\n")
+                      : Stream.empty,
                 all: Stream.empty,
                 getInputFd: () => Sink.drain,
                 getOutputFd: () => Stream.empty,
@@ -465,6 +510,7 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
+            digest,
             spawner,
             container: {
               prepare: () => Effect.void,
@@ -482,7 +528,12 @@ describe.runIf(testEngine === "docker")(
           yield* TestClock.adjust("30 seconds");
           const failure = yield* Fiber.join(operation);
           expect(failure.message).toBe(
-            `Database helper did not become ready within 30 seconds: ${warning}`,
+            [
+              `Database helper did not become ready within 30 seconds: ${warning}`,
+              "helper state: running (exit 0)",
+              "helper logs: supabase-helper-ready",
+              "helper stderr line",
+            ].join("\n"),
           );
           const create = commands.find((args) => args[0] === "create");
           const name = create?.[create.indexOf("--name") + 1];
@@ -498,7 +549,9 @@ describe.runIf(testEngine === "docker")(
           ]);
           expect(commands.filter((args) => args[0] === "rm")).toEqual([["rm", "-f", name]]);
         }),
-      ).pipe(Effect.provide([NodeServices.layer, TestClock.layer()])),
+      ).pipe(
+        Effect.provide([Layer.merge(NodeServices.layer, NodeCrypto.layer), TestClock.layer()]),
+      ),
     );
 
     it.effect("bounds helper creation and still removes the helper by name afterwards", () =>
@@ -506,7 +559,8 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const root = yield* fs.makeTempDirectoryScoped({
             prefix: "docker-helper-create-timeout-",
           });
@@ -520,7 +574,7 @@ describe.runIf(testEngine === "docker")(
             Effect.gen(function* () {
               if (!ChildProcess.isStandardCommand(command))
                 return yield* Effect.die("Unexpected command");
-              commands.push([...command.args]);
+              commands.push(command.args.map(String));
               const create = command.args[0] === "create";
               if (create) yield* Deferred.succeed(creating, undefined);
               const missing = command.args[0] === "rm" && !(yield* Ref.getAndSet(present, false));
@@ -560,6 +614,7 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
+            digest,
             spawner,
             container: {
               prepare: () => Effect.void,
@@ -593,7 +648,9 @@ describe.runIf(testEngine === "docker")(
           ]);
           expect(yield* Ref.get(present)).toBe(false);
         }),
-      ).pipe(Effect.provide([NodeServices.layer, TestClock.layer()])),
+      ).pipe(
+        Effect.provide([Layer.merge(NodeServices.layer, NodeCrypto.layer), TestClock.layer()]),
+      ),
     );
 
     it.live("starts a storage helper with the mirror image selected during preparation", () => {
@@ -602,7 +659,8 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "storage-helper-mirror-" });
           const storageRoot = path.join(root, "state", "stack", "data");
           const cacheRoot = path.join(root, "cache");
@@ -625,6 +683,7 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
+            digest,
             container,
             spawner,
           });
@@ -639,7 +698,7 @@ describe.runIf(testEngine === "docker")(
             engine.commands.filter((args) => args[0] === "pull").map((args) => args.at(-1)),
           ).toEqual([expect.stringContaining("ghcr.io/supabase/cli/postgres:"), helperMirror]);
         }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, engine.layer)));
+      ).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, engine.layer)));
     });
 
     it.live("round-trips PostgreSQL 15 data with its catalog image", () =>
@@ -647,8 +706,9 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
-          const helperImage = yield* postgresImage(database15);
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
+          const helperImage = yield* preparedPostgresImage(database15);
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-pg15-" });
           const storageRoot = path.join(root, "state", "stack", "data");
           const cacheRoot = path.join(root, "cache");
@@ -657,12 +717,12 @@ describe.runIf(testEngine === "docker")(
           yield* fs.makeDirectory(sourceRoot, { recursive: true });
           yield* fs.makeDirectory(targetRoot, { recursive: true });
           yield* fs.makeDirectory(cacheRoot, { recursive: true });
-          const container = yield* makeContainerRuntime({
+          const container = yield* containerRuntime({
             target: dockerTarget,
             root,
           });
           const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-          const stackId = `storage-pg15-${yield* crypto.randomUUIDv4}`;
+          const stackId = `storage-pg15-${yield* crypto.uuidV4()}`;
           const makeStorage = (instanceId: string, instanceRoot: string) =>
             makeDockerDatabaseStorage({
               runtime: "docker",
@@ -675,6 +735,7 @@ describe.runIf(testEngine === "docker")(
               fs,
               path,
               crypto,
+              digest,
               container,
               spawner,
             });
@@ -745,7 +806,7 @@ describe.runIf(testEngine === "docker")(
           yield* source.destroyData(database15);
           yield* engine(["volume", "rm", sourceMarker.volume]);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("round-trips stopped data and protects managed namespaces", () =>
@@ -753,8 +814,9 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
-          const helperImage = yield* postgresImage(selection.database);
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
+          const helperImage = yield* preparedPostgresImage(selection.database);
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-" });
           const stateRoot = path.join(root, "state");
           const storageRoot = path.join(stateRoot, "stack", "data");
@@ -764,7 +826,7 @@ describe.runIf(testEngine === "docker")(
           yield* fs.makeDirectory(sourceRoot, { recursive: true });
           yield* fs.makeDirectory(targetRoot, { recursive: true });
           yield* fs.makeDirectory(cacheRoot, { recursive: true });
-          const container = yield* makeContainerRuntime({
+          const container = yield* containerRuntime({
             target: dockerTarget,
             root,
           });
@@ -786,6 +848,7 @@ describe.runIf(testEngine === "docker")(
               fs,
               path,
               crypto,
+              digest,
               container,
               spawner,
             });
@@ -947,7 +1010,7 @@ describe.runIf(testEngine === "docker")(
           yield* target.destroyData(selection.database);
           yield* engine(["volume", "rm", sourceMarker.volume]);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("labels its volume with the configured test run", () =>
@@ -955,19 +1018,20 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-test-run-" });
           const storageRoot = path.join(root, "state", "stack", "data");
           const cacheRoot = path.join(root, "cache");
           const instanceRoot = path.join(storageRoot, "database");
           yield* fs.makeDirectory(instanceRoot, { recursive: true });
-          const container = yield* makeContainerRuntime({
+          const container = yield* containerRuntime({
             target: dockerTarget,
             root,
           });
           const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-          const stackId = `storage-test-run-${yield* crypto.randomUUIDv4}`;
-          const testRunId = `storage-test-run-${(yield* crypto.randomUUIDv4).slice(0, 8)}`;
+          const stackId = `storage-test-run-${yield* crypto.uuidV4()}`;
+          const testRunId = `storage-test-run-${(yield* crypto.uuidV4()).slice(0, 8)}`;
           // This run id overrides the ambient one, so the shared run teardown never sees the volume.
           yield* Effect.addFinalizer(() => removeTestRunVolumes(testRunId).pipe(Effect.orDie));
           const storage = yield* makeDockerDatabaseStorage({
@@ -981,6 +1045,7 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
+            digest,
             container,
             spawner,
           });
@@ -1007,7 +1072,7 @@ describe.runIf(testEngine === "docker")(
           ]);
           expect(labels).toBe(testRunId);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("removes an unprepared storage without requiring Docker", () =>
@@ -1015,7 +1080,8 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-empty-" });
           const instanceRoot = path.join(root, "state", "stack", "data", "empty");
@@ -1030,6 +1096,7 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
+            digest,
             container: undefined,
             spawner,
           });
@@ -1039,7 +1106,7 @@ describe.runIf(testEngine === "docker")(
             false,
           );
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live(
@@ -1049,7 +1116,8 @@ describe.runIf(testEngine === "docker")(
           Effect.gen(function* () {
             const fs = yield* FileSystem.FileSystem;
             const path = yield* Path.Path;
-            const crypto = yield* Crypto.Crypto;
+            const crypto = yield* SecureRandom.SecureRandom;
+            const digest = yield* Digest.Digest;
             const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
             const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-crash-" });
             const instanceRoot = path.join(root, "state", "stack", "data", "crash");
@@ -1057,7 +1125,9 @@ describe.runIf(testEngine === "docker")(
             const cacheRoot = path.join(root, "cache");
             yield* fs.makeDirectory(instanceRoot, { recursive: true });
             const markerPath = path.join(instanceRoot, ".supabase-database-storage.json");
-            const helperImage = yield* postgresImage(selection.database);
+            const helperImage = yield* preparedPostgresImage(selection.database).pipe(
+              phaseDeadline("helper image preparation", 10),
+            );
             const storage = yield* makeDockerDatabaseStorage({
               runtime: "docker",
               target: dockerTarget,
@@ -1069,7 +1139,8 @@ describe.runIf(testEngine === "docker")(
               fs,
               path,
               crypto,
-              container: yield* makeContainerRuntime({
+              digest,
+              container: yield* containerRuntime({
                 target: dockerTarget,
                 root: instanceRoot,
               }),
@@ -1079,9 +1150,11 @@ describe.runIf(testEngine === "docker")(
             // the global test-run teardown, since a container that mounted it may not yet be
             // reaped by the time that teardown runs.
             yield* Effect.addFinalizer(() =>
-              storage.destroyData(selection.database).pipe(Effect.ignore),
+              storage
+                .destroyData(selection.database)
+                .pipe(Effect.ignore, phaseDeadline("destroyData cleanup"), Effect.orDie),
             );
-            yield* storage.prepare(selection.database);
+            yield* storage.prepare(selection.database).pipe(phaseDeadline("prepare"));
             const before = yield* Schema.decodeEffect(Schema.fromJsonString(Marker))(
               yield* fs.readFileString(markerPath),
             );
@@ -1105,6 +1178,8 @@ describe.runIf(testEngine === "docker")(
                     : engine(["rm", "--force", ...ids]).pipe(Effect.asVoid);
                 }),
                 Effect.ignore,
+                phaseDeadline(`helper container cleanup for volume ${volume}`),
+                Effect.orDie,
               ),
             );
             // `markInitialized` (below, and inside the killed writer) checks this file through a
@@ -1119,7 +1194,7 @@ describe.runIf(testEngine === "docker")(
               "/bin/sh",
               "-c",
               `set -eu; mkdir -p ${quote(`/store/${before.namespace}/data`)}; printf 17 > ${quote(`/store/${before.namespace}/data/PG_VERSION`)}`,
-            ]);
+            ]).pipe(phaseDeadline(`PG_VERSION seed in volume ${volume}`));
 
             const writer = yield* spawner.spawn(
               ChildProcess.make(
@@ -1168,9 +1243,9 @@ describe.runIf(testEngine === "docker")(
               }),
             );
             yield* Effect.sync(() => process.kill(Number(writer.pid), "SIGKILL"));
-            yield* writer.exitCode.pipe(Effect.ignore);
-            yield* Fiber.join(output);
-            yield* Fiber.join(diagnostics);
+            yield* writer.exitCode.pipe(Effect.ignore, phaseDeadline("killed writer exit"));
+            yield* Fiber.join(output).pipe(phaseDeadline("killed writer stdout close"));
+            yield* Fiber.join(diagnostics).pipe(phaseDeadline("killed writer stderr close"));
 
             // The killed writer never reached the rename: the prior marker is untouched, and only
             // its staging file, never a partial target, is left behind.
@@ -1182,13 +1257,15 @@ describe.runIf(testEngine === "docker")(
               (yield* fs.readDirectory(instanceRoot)).filter((entry) => entry.endsWith(".tmp")),
             ).toHaveLength(1);
 
-            yield* storage.markInitialized(selection.database);
+            yield* storage
+              .markInitialized(selection.database)
+              .pipe(phaseDeadline("markInitialized retry"));
             const afterRetry = yield* Schema.decodeEffect(Schema.fromJsonString(Marker))(
               yield* fs.readFileString(markerPath),
             );
             expect(afterRetry.initialized).toBe(true);
           }),
-        ).pipe(Effect.provide(NodeServices.layer)),
+        ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
       20_000,
     );
 
@@ -1197,8 +1274,9 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
-          const helperImage = yield* postgresImage(selection.database);
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
+          const helperImage = yield* preparedPostgresImage(selection.database);
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-unmarked-" });
           const storageRoot = path.join(root, "state", "stack", "data");
           const cacheRoot = path.join(root, "cache");
@@ -1224,7 +1302,7 @@ describe.runIf(testEngine === "docker")(
             "-c",
             "chown -R 100:101 /instance/data /instance/.supabase-snapshots; chmod -R 700 /instance/data /instance/.supabase-snapshots",
           ]);
-          const container = yield* makeContainerRuntime({
+          const container = yield* containerRuntime({
             target: dockerTarget,
             root,
           });
@@ -1232,7 +1310,7 @@ describe.runIf(testEngine === "docker")(
           const storage = yield* makeDockerDatabaseStorage({
             runtime: "docker",
             target: dockerTarget,
-            stackId: `storage-unmarked-${yield* crypto.randomUUIDv4}`,
+            stackId: `storage-unmarked-${yield* crypto.uuidV4()}`,
             instanceId: "unmarked",
             instanceRoot,
             root: storageRoot,
@@ -1240,6 +1318,7 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
+            digest,
             container,
             spawner,
           });
@@ -1255,7 +1334,7 @@ describe.runIf(testEngine === "docker")(
           expect(yield* fs.exists(markerPath)).toBe(false);
           yield* fs.remove(cacheRoot, { recursive: true, force: true });
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("refuses to adopt unmarked Docker data at startup", () =>
@@ -1263,7 +1342,8 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-unmarked-" });
           const storageRoot = path.join(root, "state", "stack", "data");
           const instanceRoot = path.join(storageRoot, "unmarked");
@@ -1281,7 +1361,8 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
-            container: yield* makeContainerRuntime({
+            digest,
+            container: yield* containerRuntime({
               target: dockerTarget,
               root,
             }),
@@ -1295,7 +1376,7 @@ describe.runIf(testEngine === "docker")(
           );
           expect(yield* fs.readFileString(path.join(dataRoot, "PG_VERSION"))).toBe("17\n");
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("recovers after an owned helper is removed externally", () =>
@@ -1303,23 +1384,24 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-helper-" });
           const storageRoot = path.join(root, "state", "stack", "data");
           const cacheRoot = path.join(root, "cache");
           const instanceRoot = path.join(storageRoot, "recovery");
           yield* fs.makeDirectory(instanceRoot, { recursive: true });
           yield* fs.makeDirectory(cacheRoot, { recursive: true });
-          const container = yield* makeContainerRuntime({
+          const container = yield* containerRuntime({
             target: dockerTarget,
             root,
           });
           const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-          const stackId = `storage-helper-recovery-${yield* crypto.randomUUIDv4}`;
+          const stackId = `storage-helper-recovery-${yield* crypto.uuidV4()}`;
           const instanceId = "recovery";
           const helperScope = yield* Scope.make();
           yield* Effect.addFinalizer(() => Scope.close(helperScope, Exit.void));
-          const helperRegistry = yield* makeDockerHelperRegistry(yield* crypto.randomUUIDv4).pipe(
+          const helperRegistry = yield* makeDockerHelperRegistry(yield* crypto.uuidV4()).pipe(
             Effect.provideService(Scope.Scope, helperScope),
           );
           const storage = yield* makeDockerDatabaseStorage({
@@ -1333,6 +1415,7 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
+            digest,
             container,
             spawner,
             helpers: helperRegistry,
@@ -1360,7 +1443,7 @@ describe.runIf(testEngine === "docker")(
           yield* Scope.close(helperScope, Exit.void);
           yield* engine(["volume", "rm", volume]);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("keeps another owner's volume helper running when one owner closes", () =>
@@ -1368,7 +1451,8 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
           const root = yield* fs.makeTempDirectoryScoped({
             prefix: "docker-storage-helper-owner-",
           });
@@ -1377,12 +1461,12 @@ describe.runIf(testEngine === "docker")(
           const instanceRoot = path.join(storageRoot, "database");
           yield* fs.makeDirectory(instanceRoot, { recursive: true });
           yield* fs.makeDirectory(cacheRoot, { recursive: true });
-          const container = yield* makeContainerRuntime({
+          const container = yield* containerRuntime({
             target: dockerTarget,
             root,
           });
           const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-          const stackId = `storage-helper-owner-${yield* crypto.randomUUIDv4}`;
+          const stackId = `storage-helper-owner-${yield* crypto.uuidV4()}`;
           const firstScope = yield* Scope.make();
           const secondScope = yield* Scope.make();
           yield* Effect.addFinalizer(() =>
@@ -1418,6 +1502,7 @@ describe.runIf(testEngine === "docker")(
               fs,
               path,
               crypto,
+              digest,
               container,
               spawner,
               helpers,
@@ -1457,7 +1542,7 @@ describe.runIf(testEngine === "docker")(
           yield* secondStorage.destroyData(selection.database);
           yield* Scope.close(secondScope, Exit.void);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("destroys an initialized storage after its volume is removed", () =>
@@ -1465,20 +1550,21 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
-          const helperImage = yield* postgresImage(selection.database);
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
+          const helperImage = yield* preparedPostgresImage(selection.database);
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-missing-" });
           const storageRoot = path.join(root, "state", "stack", "data");
           const cacheRoot = path.join(root, "cache");
           const instanceRoot = path.join(storageRoot, "missing");
           yield* fs.makeDirectory(instanceRoot, { recursive: true });
           yield* fs.makeDirectory(cacheRoot, { recursive: true });
-          const container = yield* makeContainerRuntime({
+          const container = yield* containerRuntime({
             target: dockerTarget,
             root,
           });
           const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-          const stackId = `storage-missing-${yield* crypto.randomUUIDv4}`;
+          const stackId = `storage-missing-${yield* crypto.uuidV4()}`;
           const makeStorage = () =>
             makeDockerDatabaseStorage({
               runtime: "docker",
@@ -1491,6 +1577,7 @@ describe.runIf(testEngine === "docker")(
               fs,
               path,
               crypto,
+              digest,
               container,
               spawner,
             });
@@ -1543,7 +1630,7 @@ describe.runIf(testEngine === "docker")(
             }),
           );
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live(
@@ -1553,20 +1640,21 @@ describe.runIf(testEngine === "docker")(
           Effect.gen(function* () {
             const fs = yield* FileSystem.FileSystem;
             const path = yield* Path.Path;
-            const crypto = yield* Crypto.Crypto;
-            const helperImage = yield* postgresImage(selection.database);
+            const crypto = yield* SecureRandom.SecureRandom;
+            const digest = yield* Digest.Digest;
+            const helperImage = yield* preparedPostgresImage(selection.database);
             const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-no-marker-" });
             const storageRoot = path.join(root, "state", "stack", "data");
             const cacheRoot = path.join(root, "cache");
             const instanceRoot = path.join(storageRoot, "sleeping");
             yield* fs.makeDirectory(instanceRoot, { recursive: true });
             yield* fs.makeDirectory(cacheRoot, { recursive: true });
-            const container = yield* makeContainerRuntime({
+            const container = yield* containerRuntime({
               target: dockerTarget,
               root,
             });
             const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-            const stackId = `storage-no-marker-${yield* crypto.randomUUIDv4}`;
+            const stackId = `storage-no-marker-${yield* crypto.uuidV4()}`;
             // One storage object spans the whole case, the way an Owner keeps one per instance for
             // the stack's lifetime: its resolved identity stays in memory across the sleep below.
             const storage = yield* makeDockerDatabaseStorage({
@@ -1580,6 +1668,7 @@ describe.runIf(testEngine === "docker")(
               fs,
               path,
               crypto,
+              digest,
               container,
               spawner,
             });
@@ -1625,7 +1714,7 @@ describe.runIf(testEngine === "docker")(
             expect(remaining.trim()).toBe("absent");
             yield* engine(["volume", "rm", volume]);
           }),
-        ).pipe(Effect.provide(NodeServices.layer)),
+        ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live(
@@ -1635,8 +1724,9 @@ describe.runIf(testEngine === "docker")(
           Effect.gen(function* () {
             const fs = yield* FileSystem.FileSystem;
             const path = yield* Path.Path;
-            const crypto = yield* Crypto.Crypto;
-            const helperImage = yield* postgresImage(selection.database);
+            const crypto = yield* SecureRandom.SecureRandom;
+            const digest = yield* Digest.Digest;
+            const helperImage = yield* preparedPostgresImage(selection.database);
             // `root` is deleted entirely below; nest it under the scope's own temp dir so the test
             // framework's own cleanup of that outer, still-present directory does not fail.
             const tempDir = yield* fs.makeTempDirectoryScoped({
@@ -1648,12 +1738,12 @@ describe.runIf(testEngine === "docker")(
             const instanceRoot = path.join(storageRoot, "sleeping");
             yield* fs.makeDirectory(instanceRoot, { recursive: true });
             yield* fs.makeDirectory(cacheRoot, { recursive: true });
-            const container = yield* makeContainerRuntime({
+            const container = yield* containerRuntime({
               target: dockerTarget,
               root,
             });
             const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-            const stackId = `storage-no-root-${yield* crypto.randomUUIDv4}`;
+            const stackId = `storage-no-root-${yield* crypto.uuidV4()}`;
             // One storage object spans the whole case, the way an Owner keeps one per instance for
             // the stack's lifetime: its resolved identity stays in memory across the sleep below.
             const storage = yield* makeDockerDatabaseStorage({
@@ -1667,6 +1757,7 @@ describe.runIf(testEngine === "docker")(
               fs,
               path,
               crypto,
+              digest,
               container,
               spawner,
             });
@@ -1712,7 +1803,7 @@ describe.runIf(testEngine === "docker")(
             expect(remaining.trim()).toBe("absent");
             yield* engine(["volume", "rm", volume]);
           }),
-        ).pipe(Effect.provide(NodeServices.layer)),
+        ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("reopens managed storage and preserves snapshots after source destruction", () =>
@@ -1720,8 +1811,9 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
-          const helperImage = yield* postgresImage(selection.database);
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
+          const helperImage = yield* preparedPostgresImage(selection.database);
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-reopen-" });
           const stateRoot = path.join(root, "state");
           const storageRoot = path.join(stateRoot, "stack", "data");
@@ -1731,7 +1823,7 @@ describe.runIf(testEngine === "docker")(
           yield* fs.makeDirectory(sourceRoot, { recursive: true });
           yield* fs.makeDirectory(targetRoot, { recursive: true });
           yield* fs.makeDirectory(cacheRoot, { recursive: true });
-          const container = yield* makeContainerRuntime({
+          const container = yield* containerRuntime({
             target: dockerTarget,
             root,
           });
@@ -1752,6 +1844,7 @@ describe.runIf(testEngine === "docker")(
               fs,
               path,
               crypto,
+              digest,
               container,
               spawner,
             });
@@ -1842,7 +1935,7 @@ describe.runIf(testEngine === "docker")(
             }),
           );
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
 
     it.live("resumes unfinished volume data only on the identity its first start recorded", () =>
@@ -1850,8 +1943,9 @@ describe.runIf(testEngine === "docker")(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
-          const helperImage = yield* postgresImage(selection.database);
+          const crypto = yield* SecureRandom.SecureRandom;
+          const digest = yield* Digest.Digest;
+          const helperImage = yield* preparedPostgresImage(selection.database);
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-line-" });
           const storageRoot = path.join(root, "state", "stack", "data");
           const cacheRoot = path.join(root, "cache");
@@ -1862,7 +1956,7 @@ describe.runIf(testEngine === "docker")(
           const storage = yield* makeDockerDatabaseStorage({
             runtime: "docker",
             target: dockerTarget,
-            stackId: `storage-line-${yield* crypto.randomUUIDv4}`,
+            stackId: `storage-line-${yield* crypto.uuidV4()}`,
             instanceId: "line",
             instanceRoot,
             root: storageRoot,
@@ -1870,7 +1964,8 @@ describe.runIf(testEngine === "docker")(
             fs,
             path,
             crypto,
-            container: yield* makeContainerRuntime({ target: dockerTarget, root }),
+            digest,
+            container: yield* containerRuntime({ target: dockerTarget, root }),
             spawner,
           });
           let volume: string | undefined;
@@ -1914,7 +2009,7 @@ describe.runIf(testEngine === "docker")(
           );
           yield* storage.prepare(oriole);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
     );
   },
 );
@@ -1925,7 +2020,8 @@ describe("Host database storage", { timeout: 120_000 }, () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
+        const crypto = yield* SecureRandom.SecureRandom;
+        const digest = yield* Digest.Digest;
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-host-line-" });
         const storageRoot = path.join(root, "state", "stack", "data");
         const cacheRoot = path.join(root, "cache");
@@ -1959,7 +2055,8 @@ describe("Host database storage", { timeout: 120_000 }, () => {
           fs,
           path,
           crypto,
-          container: yield* makeContainerRuntime({ target: containerTarget, root }),
+          digest,
+          container: yield* containerRuntime({ target: containerTarget, root }),
           spawner,
         });
         yield* Effect.addFinalizer(() =>
@@ -1989,7 +2086,7 @@ describe("Host database storage", { timeout: 120_000 }, () => {
         yield* storage.prepare(oriole);
         expect(yield* fs.readFileString(path.join(data, "PG_VERSION"))).toBe("17\n");
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 
   it.live("handles root-owned host data through helper operations", () =>
@@ -1997,8 +2094,9 @@ describe("Host database storage", { timeout: 120_000 }, () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
-        const crypto = yield* Crypto.Crypto;
-        const helperImage = yield* postgresImage(selection.database);
+        const crypto = yield* SecureRandom.SecureRandom;
+        const digest = yield* Digest.Digest;
+        const helperImage = yield* preparedPostgresImage(selection.database, containerTarget);
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-host-" });
         const stateRoot = path.join(root, "state");
         const storageRoot = path.join(stateRoot, "stack", "data");
@@ -2032,7 +2130,7 @@ describe("Host database storage", { timeout: 120_000 }, () => {
           path.join(instanceRoot, ".supabase-database-ready.json"),
           `{"runtime":"${testEngine}","profile":"supabase"}`,
         );
-        const container = yield* makeContainerRuntime({
+        const container = yield* containerRuntime({
           target: containerTarget,
           root,
         });
@@ -2058,6 +2156,7 @@ describe("Host database storage", { timeout: 120_000 }, () => {
           fs,
           path,
           crypto,
+          digest,
           container,
           spawner,
         });
@@ -2137,6 +2236,6 @@ describe("Host database storage", { timeout: 120_000 }, () => {
         expect(yield* fs.exists(path.join(instanceRoot, ".supabase-snapshots"))).toBe(false);
         yield* fs.remove(cacheRoot, { recursive: true });
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 });
diff --git a/packages/stack/src/storage/DockerDatabaseStorage.ts b/packages/stack/src/storage/DockerDatabaseStorage.ts
index c5a6c145fe..4f1ccf081f 100644
--- a/packages/stack/src/storage/DockerDatabaseStorage.ts
+++ b/packages/stack/src/storage/DockerDatabaseStorage.ts
@@ -1,6 +1,5 @@
 import {
   Cause,
-  Crypto,
   Effect,
   Exit,
   Fiber,
@@ -13,6 +12,7 @@ import {
   Semaphore,
   Stream,
 } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { ChildProcess } from "effect/process";
 import type {
   ChildProcessHandle,
@@ -145,7 +145,8 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
     readonly cacheRoot: string;
     readonly fs: FileSystem.FileSystem;
     readonly path: Path.Path;
-    readonly crypto: Crypto.Crypto;
+    readonly crypto: SecureRandom.SecureRandom["Service"];
+    readonly digest: Digest.Digest["Service"];
     readonly container: ContainerRuntime | undefined;
     readonly spawner: ChildProcessSpawnerService["Service"];
     readonly helpers?: DockerHelperRegistry;
@@ -168,12 +169,13 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
       const stateRoot = options.path.dirname(options.path.dirname(options.root));
       const dataNamespace = `instance-${options.stackId}-${options.instanceId}`;
       const hash = (value: string) =>
-        options.crypto.digest("SHA-256", new TextEncoder().encode(value)).pipe(
-          Effect.map((bytes) =>
-            Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(""),
-          ),
-          Effect.mapError((cause) => errorFor("identity", cause)),
-        );
+        options.digest
+          .digest(Digest.sha256, new TextEncoder().encode(value))
+          .pipe(
+            Effect.map((bytes) =>
+              Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(""),
+            ),
+          );
       const encodeMarker = Schema.encodeEffect(Schema.fromJsonString(Marker));
       const validateMarker = (marker: Marker) =>
         Effect.gen(function* () {
@@ -375,7 +377,10 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
       );
 
       const engineCommand = Effect.fn("DockerDatabaseStorage.engineCommand")(
-        (args: ReadonlyArray<string>): Effect.Effect<string, DockerDatabaseStorageError> =>
+        (
+          args: ReadonlyArray<string>,
+          output: "stdout" | "all" = "stdout",
+        ): Effect.Effect<string, DockerDatabaseStorageError> =>
           Effect.scoped(
             Effect.gen(function* () {
               yield* Effect.annotateCurrentSpan({
@@ -415,7 +420,9 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
                   "engine",
                   stderr.trim() || `Container engine exited with ${code}`,
                 );
-              return stdout.trim();
+              return output === "all"
+                ? [stdout.trim(), stderr.trim()].filter((part) => part !== "").join("\n")
+                : stdout.trim();
             }),
           ).pipe(Effect.mapError((cause) => errorFor("engine", cause))),
       );
@@ -638,6 +645,57 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
           )
           .pipe(Effect.mapError((cause) => errorFor("helper", cause)));
         const stderr = yield* stderrTail(child);
+        const diagnosticProbe = (command: Effect.Effect<string, DockerDatabaseStorageError>) =>
+          command.pipe(
+            Effect.map((output) => ({ outcome: "ok" as const, output })),
+            Effect.timeoutOrElse({
+              duration: "5 seconds",
+              orElse: () =>
+                Effect.succeed({
+                  outcome: "timeout" as const,
+                  output: "unavailable: timed out after 5 seconds",
+                }),
+            }),
+            Effect.catch((cause) =>
+              Effect.succeed({
+                outcome: "error" as const,
+                output: `unavailable: ${cause.message}`,
+              }),
+            ),
+          );
+        const stalledHelperState = Effect.fn("DockerDatabaseStorage.stalledHelperState")(
+          function* () {
+            const [inspected, logs] = yield* Effect.all(
+              [
+                diagnosticProbe(
+                  engineCommand([
+                    "inspect",
+                    "--format",
+                    "{{.State.Status}}\t{{.State.ExitCode}}\t{{.State.Error}}",
+                    name,
+                  ]),
+                ),
+                // `logs` relays the helper's stderr on the engine's own stderr.
+                diagnosticProbe(engineCommand(["logs", "--tail", "20", name], "all")),
+              ],
+              { concurrency: "unbounded" },
+            );
+            yield* Effect.annotateCurrentSpan({
+              "helper.inspect.outcome": inspected.outcome,
+              "helper.logs.outcome": logs.outcome,
+            });
+            let state = inspected.output;
+            if (inspected.outcome === "ok") {
+              const [status = "", exitCode = "", engineError = ""] = inspected.output.split("\t");
+              yield* Effect.annotateCurrentSpan({
+                "helper.status": status,
+                "helper.exit_code": Number(exitCode),
+              });
+              state = `${status} (exit ${exitCode})${engineError === "" ? "" : `: ${engineError}`}`;
+            }
+            return `helper state: ${state}\nhelper logs: ${logs.output || "(empty)"}`;
+          },
+        );
         return yield* child.stdout.pipe(
           Stream.decodeText,
           Stream.splitLines,
@@ -650,6 +708,11 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
             exit.value.value === "supabase-helper-ready"
               ? Effect.succeed(name)
               : Effect.gen(function* () {
+                  const timedOut =
+                    Exit.isFailure(exit) &&
+                    Option.exists(Cause.findErrorOption(exit.cause), Cause.isTimeoutError);
+                  // Inspect before the kill: `--rm` removes the helper once its attach ends.
+                  const state = timedOut ? yield* stalledHelperState() : "";
                   yield* child
                     .kill({ killSignal: "SIGTERM", forceKillAfter: "5 seconds" })
                     .pipe(Effect.ignore);
@@ -659,7 +722,7 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
                   );
                   // Docker prints warnings such as a platform mismatch on `create`, so keep that
                   // output alongside what `start` wrote.
-                  const tail = [createTail, diagnostic.trim()]
+                  const tail = [createTail, diagnostic.trim(), state]
                     .filter((part) => part !== "")
                     .join("\n");
                   const reason = Exit.isFailure(exit)
@@ -749,9 +812,7 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
                   .prepareImage(image)
                   .pipe(Effect.mapError((cause) => errorFor("helper", cause))),
               );
-              const token = yield* options.crypto.randomUUIDv4.pipe(
-                Effect.mapError((cause) => errorFor("helper", cause)),
-              );
+              const token = yield* options.crypto.uuidV4();
               const name = `supabase-db-helper-${token}`;
               // Register the owned name before remote create so interrupted startup can remove it.
               yield* Ref.set(helperId, name);
@@ -1195,7 +1256,8 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
         }).pipe(
           Effect.provideService(FileSystem.FileSystem, options.fs),
           Effect.provideService(Path.Path, options.path),
-          Effect.provideService(Crypto.Crypto, options.crypto),
+          Effect.provideService(SecureRandom.SecureRandom, options.crypto),
+          Effect.provideService(Digest.Digest, options.digest),
         );
       };
       const saveSnapshot = Effect.fn("DockerDatabaseStorage.saveSnapshot")(
diff --git a/packages/stack/src/testing.integration.test.ts b/packages/stack/src/testing.integration.test.ts
index 66e1cef661..48c441eda8 100644
--- a/packages/stack/src/testing.integration.test.ts
+++ b/packages/stack/src/testing.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices, NodeSocketServer } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices, NodeSocketServer } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -89,7 +89,9 @@ it.live(
       expect(yield* snapshotDescriptors(cacheRoot)).toEqual([]);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 240_000 },
 );
@@ -129,7 +131,9 @@ it.live(
       expect(failure.message).not.toContain("was reset without restoring checkpoint");
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 120_000 },
 );
@@ -169,7 +173,9 @@ it.live(
       expect(yield* sql(test.stack, databaseUrl, "SELECT 1")).toBe("1");
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 120_000 },
 );
@@ -221,7 +227,9 @@ it.live(
       expect((yield* fs.exists(data)) ? yield* fs.readDirectory(data) : []).toEqual([]);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 120_000 },
 );
@@ -256,7 +264,9 @@ it.live(
       expect(yield* discover({ stateRoot })).toEqual([]);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 120_000 },
 );
@@ -278,7 +288,9 @@ it.live(
       expect(yield* discover({ stateRoot })).toEqual([]);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 120_000 },
 );
@@ -302,7 +314,9 @@ it.live("rejects an unknown SUPABASE_STACK_TEST_RUNTIME before creating a stack"
     expect(yield* discover({ stateRoot })).toEqual([]);
   }).pipe(
     Effect.scoped,
-    Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
   ),
 );
 
@@ -332,7 +346,9 @@ it.live(
       expect(yield* databaseVersion(pinned)).toMatch(/^15\./);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
   { timeout: 240_000 },
 );
@@ -357,6 +373,8 @@ it.live(
       expect(yield* discover({ stateRoot })).toEqual([]);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+      Effect.provide(
+        Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+      ),
     ),
 );
diff --git a/packages/stack/src/testing.ts b/packages/stack/src/testing.ts
index 268faf82f6..f98c3219aa 100644
--- a/packages/stack/src/testing.ts
+++ b/packages/stack/src/testing.ts
@@ -1,7 +1,6 @@
 import {
   Config,
   Context,
-  Crypto,
   Effect,
   FileSystem,
   Layer,
@@ -12,6 +11,7 @@ import {
   Schema,
   Scope,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 // oxlint-disable-next-line effecttsgo/node-builtin-import -- FileSystem exposes no OS temp or home directory path for the shared roots.
 import { homedir, tmpdir, userInfo } from "node:os";
 import type { PlatformError } from "effect/PlatformError";
@@ -214,7 +214,7 @@ const make = Effect.fn("TestStack.make")(function* <
 ) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const runtime =
     options.runtime ?? Option.getOrUndefined(yield* runtimeOverride) ?? defaultRuntime();
   // Shared roots are created owner-only, so each OS user needs its own.
@@ -265,7 +265,7 @@ const make = Effect.fn("TestStack.make")(function* <
       stateRoot,
       cacheRoot,
       runtime,
-      name: `test-${yield* crypto.randomUUIDv4}`,
+      name: `test-${yield* crypto.uuidV4()}`,
       lifetime: "session",
     }),
     (created) => created.destroy.pipe(Effect.orDie),
@@ -454,12 +454,12 @@ export const seedSavedStack = Effect.fn("TestStack.seedSavedStack")(
   function* (options: SeedSavedStackOptions) {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
     const runtime = options.runtime ?? "native";
     const pins = defaultArtifactSelection();
     const identity = yield* resolveStackIdentity({ projectRoot: options.projectRoot });
     const stackId = yield* deriveStackId(identity);
-    const databaseId = yield* crypto.randomUUIDv4;
+    const databaseId = yield* crypto.uuidV4();
     const database: ServiceCreation = {
       service: "database",
       pin: pins.database,
@@ -472,7 +472,7 @@ export const seedSavedStack = Effect.fn("TestStack.seedSavedStack")(
     };
     const writers = yield* Effect.forEach(options.composed ?? [], (service) =>
       Effect.all({
-        id: crypto.randomUUIDv4,
+        id: crypto.uuidV4(),
         creation: Schema.decodeUnknownEffect(ServiceCreation)({
           service,
           pin: pins[service],
diff --git a/packages/stack/tests/artifact-store-fixture.ts b/packages/stack/tests/artifact-store-fixture.ts
index 3fe0f3b006..81cc989979 100644
--- a/packages/stack/tests/artifact-store-fixture.ts
+++ b/packages/stack/tests/artifact-store-fixture.ts
@@ -1,5 +1,5 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
-import { Console, Crypto, Effect, FileSystem, Layer } from "effect";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { Console, Effect, FileSystem, Layer } from "effect";
 import {
   makeArtifactStore,
   type ArtifactRequest,
@@ -52,10 +52,7 @@ const fastSource: ArtifactSource = {
       yield* fs.makeDirectory(`${destination}/etc`, { recursive: true });
       yield* fs.writeFileString(`${destination}/bin/postgres`, "native postgres", { mode: 0o755 });
       yield* fs.writeFileString(`${destination}/etc/postgres.conf`, "config", { mode: 0o644 });
-      const crypto = yield* Crypto.Crypto;
-      yield* verifySha256(archive, expectedSha256).pipe(
-        Effect.provideService(Crypto.Crypto, crypto),
-      );
+      yield* verifySha256(archive, expectedSha256);
     }).pipe(mapMaterializeError),
 };
 
@@ -88,6 +85,10 @@ const program = Effect.scoped(
     }
     throw new Error(`Unknown fixture mode: ${mode}`);
   }),
-).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)));
+).pipe(
+  Effect.provide(
+    Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+  ),
+);
 
 await Effect.runPromise(program);
diff --git a/packages/stack/tests/compiled-dispatch-fixture.ts b/packages/stack/tests/compiled-dispatch-fixture.ts
index 40d950ab50..2b5da90736 100644
--- a/packages/stack/tests/compiled-dispatch-fixture.ts
+++ b/packages/stack/tests/compiled-dispatch-fixture.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { Data, Effect, FileSystem, Layer, Option, Stream } from "effect";
 import {
   runHostProcessIfDispatched,
@@ -46,6 +46,7 @@ if (!(await runHostProcessIfDispatched(argv)) && !(await runNativeProcessIfDispa
       Effect.provide(
         Layer.mergeAll(
           NodeServices.layer,
+          NodeCrypto.layer,
           NodeHttpClient.layerNodeHttp,
           StackNamespace.layer({ root: stateRoot }).pipe(Layer.provide(NodeServices.layer)),
         ),
diff --git a/packages/stack/tests/docker-fixture.integration.test.ts b/packages/stack/tests/docker-fixture.integration.test.ts
index ebf32760ed..01f527680a 100644
--- a/packages/stack/tests/docker-fixture.integration.test.ts
+++ b/packages/stack/tests/docker-fixture.integration.test.ts
@@ -1,5 +1,5 @@
 import { PgClient } from "@effect/sql-pg";
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { Context, Effect, FileSystem, Layer, Redacted, Schema, Stream } from "effect";
@@ -145,7 +145,9 @@ describe.runIf(testEngine === "docker")(
         Effect.tap((results) =>
           Effect.sync(() => results.forEach(({ exists }) => expect(exists).toBe(true))),
         ),
-        Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
+        Effect.provide(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+        ),
       ),
     );
   },
diff --git a/packages/stack/tests/docker-fixture.ts b/packages/stack/tests/docker-fixture.ts
index 2f3a001fd9..ade8a2fb5f 100644
--- a/packages/stack/tests/docker-fixture.ts
+++ b/packages/stack/tests/docker-fixture.ts
@@ -84,15 +84,16 @@ export const engineStub = (
     Effect.gen(function* () {
       if (!ChildProcess.isStandardCommand(command))
         return yield* Effect.die("Unexpected child process command");
-      const argv = [command.command, ...command.args];
+      const commandArgs = command.args.map(String);
+      const argv = [command.command, ...commandArgs];
       commands.push(argv);
-      const args = TARGET_OPTIONS.includes(command.args[0] ?? "")
-        ? command.args.slice(2)
-        : command.args;
+      const args = TARGET_OPTIONS.includes(commandArgs[0] ?? "")
+        ? commandArgs.slice(2)
+        : commandArgs;
       const [subcommand] = args;
       const failure = failures[`${command.command} ${subcommand}`] ?? failures[command.command];
       const inventory = inventories.get(command.command) ?? [];
-      const filters = command.args.filter((_, index) => command.args[index - 1] === "--filter");
+      const filters = commandArgs.filter((_, index) => commandArgs[index - 1] === "--filter");
       const listed = inventory.filter((container) =>
         filters.every((filter) =>
           [
@@ -104,7 +105,7 @@ export const engineStub = (
         ),
       );
       const listing = Effect.gen(function* () {
-        if (!command.args.includes("--format")) return listed.map(({ id }) => id).join("\n");
+        if (!commandArgs.includes("--format")) return listed.map(({ id }) => id).join("\n");
         const labels = yield* Effect.forEach(listed, ({ stackId, root }) =>
           encodeLabels([stackId, root]).pipe(Effect.orDie),
         );
@@ -125,7 +126,7 @@ export const engineStub = (
       if (failure === undefined && subcommand === "rm")
         inventories.set(
           command.command,
-          inventory.filter(({ id }) => id !== command.args.at(-1)),
+          inventory.filter(({ id }) => id !== commandArgs.at(-1)),
         );
       yield* onCommand(argv);
       return ChildProcessSpawner.makeHandle({
diff --git a/packages/stack/tests/docker-storage-publish-loop-fixture.ts b/packages/stack/tests/docker-storage-publish-loop-fixture.ts
index 4e25945a35..a3a14b1c11 100644
--- a/packages/stack/tests/docker-storage-publish-loop-fixture.ts
+++ b/packages/stack/tests/docker-storage-publish-loop-fixture.ts
@@ -1,6 +1,8 @@
-import { NodeServices } from "@effect/platform-node";
-import { Console, Crypto, Effect, FileSystem, Layer, Path } from "effect";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
+import { Console, Effect, FileSystem, Layer, Path } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { ChildProcessSpawner } from "effect/process";
+import { slimImageMirrors } from "../src/Artifacts.ts";
 import { makeContainerRuntime } from "../src/runtime/Container.ts";
 import { makeDockerDatabaseStorage } from "../src/storage/DockerDatabaseStorage.ts";
 import { selection } from "./pins.ts";
@@ -32,7 +34,7 @@ const program = Effect.scoped(
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const crypto = yield* Crypto.Crypto;
+    const crypto = yield* SecureRandom.SecureRandom;
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     // Matches the caller's own target exactly, so this fixture's identity agrees with the
     // marker the caller's `prepare` already published through it.
@@ -40,6 +42,7 @@ const program = Effect.scoped(
     const container = yield* makeContainerRuntime({
       target,
       root: instanceRoot,
+      imageMirrors: slimImageMirrors,
     });
     const storage = yield* makeDockerDatabaseStorage({
       runtime: "docker",
@@ -52,11 +55,16 @@ const program = Effect.scoped(
       fs,
       path,
       crypto,
+      digest: yield* Digest.Digest,
       container,
       spawner,
     });
     yield* storage.markInitialized(selection.database);
   }),
-).pipe(Effect.provide(barrierFs.pipe(Layer.provideMerge(NodeServices.layer))));
+).pipe(
+  Effect.provide(
+    barrierFs.pipe(Layer.provideMerge(Layer.merge(NodeServices.layer, NodeCrypto.layer))),
+  ),
+);
 
 await Effect.runPromise(program);
diff --git a/packages/stack/tests/docker-volume-run.integration.test.ts b/packages/stack/tests/docker-volume-run.integration.test.ts
index 50f87710b0..de79e894b8 100644
--- a/packages/stack/tests/docker-volume-run.integration.test.ts
+++ b/packages/stack/tests/docker-volume-run.integration.test.ts
@@ -1,6 +1,7 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
-import { Crypto, DateTime, Effect, FileSystem, Path } from "effect";
+import { DateTime, Effect, FileSystem, Path } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { runEngine } from "./docker-fixture.ts";
 import {
@@ -74,8 +75,8 @@ describe("test-run Docker volume cleanup", { timeout: 120_000 }, () => {
   it.live("removes exactly the volumes labelled for this run", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const crypto = yield* Crypto.Crypto;
-        const suffix = (yield* crypto.randomUUIDv4).slice(0, 8);
+        const crypto = yield* SecureRandom.SecureRandom;
+        const suffix = (yield* crypto.uuidV4()).slice(0, 8);
         const runId = `run-${suffix}`;
         const otherRunId = `other-run-${suffix}`;
         const owned = `sb-test-run-owned-${suffix}`;
@@ -102,7 +103,7 @@ describe("test-run Docker volume cleanup", { timeout: 120_000 }, () => {
         expect(yield* volumeExists(foreign)).toBe(true);
         expect(yield* volumeExists(unlabelled)).toBe(true);
       }),
-    ).pipe(Effect.provide(NodeServices.layer)),
+    ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 });
 
@@ -114,9 +115,9 @@ describe("dead test-run recovery", { timeout: 120_000 }, () => {
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
           const path = yield* Path.Path;
-          const crypto = yield* Crypto.Crypto;
+          const crypto = yield* SecureRandom.SecureRandom;
           const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-          const suffix = (yield* crypto.randomUUIDv4).slice(0, 8);
+          const suffix = (yield* crypto.uuidV4()).slice(0, 8);
           const deadRunId = `recovery-dead-${suffix}`;
           const liveRunId = `recovery-live-${suffix}`;
           const deadVolume = `sb-recovery-dead-volume-${suffix}`;
@@ -197,6 +198,6 @@ describe("dead test-run recovery", { timeout: 120_000 }, () => {
           expect(yield* volumeExists(unlabelledVolume)).toBe(true);
           expect(yield* containerExists(unlabelledContainer)).toBe(true);
         }),
-      ).pipe(Effect.provide(NodeServices.layer)),
+      ).pipe(Effect.provide([NodeServices.layer, NodeCrypto.layer])),
   );
 });
diff --git a/packages/stack/tests/helper-owner-fixture.ts b/packages/stack/tests/helper-owner-fixture.ts
index a1f0e51497..48a0b8d1a9 100644
--- a/packages/stack/tests/helper-owner-fixture.ts
+++ b/packages/stack/tests/helper-owner-fixture.ts
@@ -1,6 +1,8 @@
-import { NodeServices } from "@effect/platform-node";
-import { Crypto, Effect, FileSystem, Path, Schema } from "effect";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
+import { Effect, FileSystem, Path, Schema } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { slimImageMirrors } from "../src/Artifacts.ts";
 import { makeContainerRuntime } from "../src/runtime/Container.ts";
 import { makeDockerDatabaseStorage } from "../src/storage/DockerDatabaseStorage.ts";
 import { makeDockerHelperRegistry } from "../src/storage/DockerHelperRegistry.ts";
@@ -23,7 +25,7 @@ const HostMarker = Schema.Struct({
 const run = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const crypto = yield* Crypto.Crypto;
+  const crypto = yield* SecureRandom.SecureRandom;
   const realSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const spawner = stallBeforeStart
     ? ChildProcessSpawner.make((command) =>
@@ -51,8 +53,8 @@ const run = Effect.gen(function* () {
       { mode: 0o600 },
     );
   const target = { engine: "docker" as const, argv: [], daemonId: "test-daemon-id" };
-  const container = yield* makeContainerRuntime({ target, root });
-  const helpers = shared ? yield* makeDockerHelperRegistry(yield* crypto.randomUUIDv4) : undefined;
+  const container = yield* makeContainerRuntime({ target, root, imageMirrors: slimImageMirrors });
+  const helpers = shared ? yield* makeDockerHelperRegistry(yield* crypto.uuidV4()) : undefined;
   const storage = yield* makeDockerDatabaseStorage({
     runtime: "docker",
     target,
@@ -64,6 +66,7 @@ const run = Effect.gen(function* () {
     fs,
     path,
     crypto,
+    digest: yield* Digest.Digest,
     container,
     spawner,
     helpers,
@@ -74,4 +77,6 @@ const run = Effect.gen(function* () {
   return yield* Effect.never;
 });
 
-await Effect.runPromise(run.pipe(Effect.scoped, Effect.provide(NodeServices.layer)));
+await Effect.runPromise(
+  run.pipe(Effect.scoped, Effect.provide([NodeServices.layer, NodeCrypto.layer])),
+);
diff --git a/packages/stack/tests/host-process-fixture.ts b/packages/stack/tests/host-process-fixture.ts
index 8c4690cea9..c609adafdd 100644
--- a/packages/stack/tests/host-process-fixture.ts
+++ b/packages/stack/tests/host-process-fixture.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices, NodeStream } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices, NodeStream } from "@effect/platform-node";
 import {
   Context,
   Data,
@@ -153,7 +153,7 @@ const launcher = Effect.scoped(
 );
 
 try {
-  const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+  const layer = Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp);
   if (mode === "launcher") await Effect.runPromise(launcher.pipe(Effect.provide(layer)));
   else await Effect.runPromise(owner.pipe(Effect.provide(layer)));
 } catch (cause) {
diff --git a/packages/stack/tests/session-client-fixture.ts b/packages/stack/tests/session-client-fixture.ts
index 6cdb8392bf..3df5be9b2d 100644
--- a/packages/stack/tests/session-client-fixture.ts
+++ b/packages/stack/tests/session-client-fixture.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { Effect, Layer, Schema } from "effect";
 import { create } from "../src/effect.ts";
 import { selection } from "./pins.ts";
@@ -33,5 +33,9 @@ const program = Effect.scoped(
 );
 
 await Effect.runPromise(
-  program.pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  program.pipe(
+    Effect.provide(
+      Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NodeHttpClient.layerNodeHttp),
+    ),
+  ),
 );
diff --git a/packages/stack/tests/snapshot-restore-barrier-fixture.ts b/packages/stack/tests/snapshot-restore-barrier-fixture.ts
index c58c4c4ab6..e40e0dc6f9 100644
--- a/packages/stack/tests/snapshot-restore-barrier-fixture.ts
+++ b/packages/stack/tests/snapshot-restore-barrier-fixture.ts
@@ -1,4 +1,4 @@
-import { NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeServices } from "@effect/platform-node";
 import { Console, Effect, FileSystem, Layer, Path, Ref } from "effect";
 import { schemaWritersFile } from "../src/internal/schema-writers.ts";
 import { makeDatabaseSnapshots } from "../src/services/DatabaseSnapshot.ts";
@@ -59,6 +59,10 @@ const program = Effect.scoped(
     });
     yield* snapshots.restoreSnapshot(key);
   }),
-).pipe(Effect.provide(barrierFs.pipe(Layer.provideMerge(NodeServices.layer))));
+).pipe(
+  Effect.provide(
+    barrierFs.pipe(Layer.provideMerge(Layer.merge(NodeServices.layer, NodeCrypto.layer))),
+  ),
+);
 
 await Effect.runPromise(program);
diff --git a/packages/stack/tests/stall-guard.ts b/packages/stack/tests/stall-guard.ts
new file mode 100644
index 0000000000..e718450742
--- /dev/null
+++ b/packages/stack/tests/stall-guard.ts
@@ -0,0 +1,15 @@
+import { type Duration, Effect, Fiber } from "effect";
+
+/**
+ * Fails with `onStall` once `duration` passes, without waiting for the stalled effect's finalizers,
+ * which may hang too; the stalled fiber is interrupted in the background so its cleanup still runs.
+ */
+export const failOnStall =
+  <E2, R2>(duration: Duration.Input, onStall: Effect.Effect<never, E2, R2>) =>
+  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E | E2, R | R2> =>
+    Effect.flatMap(Effect.forkDetach(effect), (fiber) =>
+      Fiber.join(fiber).pipe(
+        Effect.onInterrupt(() => Effect.forkDetach(Fiber.interrupt(fiber))),
+        Effect.timeoutOrElse({ duration, orElse: () => onStall }),
+      ),
+    );
diff --git a/packages/stack/tests/whole-stack/fixture.ts b/packages/stack/tests/whole-stack/fixture.ts
index 7738d31d2d..5602d53085 100644
--- a/packages/stack/tests/whole-stack/fixture.ts
+++ b/packages/stack/tests/whole-stack/fixture.ts
@@ -1,8 +1,7 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import {
   ByteSize,
   Cause,
-  Crypto,
   Effect,
   Exit,
   FileSystem,
@@ -13,6 +12,7 @@ import {
   Ref,
   Stream,
 } from "effect";
+import { SecureRandom } from "effect/crypto";
 import { postgres } from "../../src/Commands.ts";
 import { homedir } from "node:os";
 import { HttpClient, HttpClientRequest } from "effect/http";
@@ -42,6 +42,9 @@ export const serviceNames = [
   "pooler",
 ] as const;
 
+/* Auth answers with its built-in email when a template fetch fails, so only this proves the fetch. */
+export const recoveryTemplateMarker = "whole-stack recovery template";
+
 export type Runtime = "native" | ContainerEngine;
 export type WholeStack = Readonly<{
   readonly stack: Stack;
@@ -126,16 +129,22 @@ export const wholeStack = Effect.fn("WholeStack.fixture")((runtime: Runtime) =>
       prefix: `stack-whole-${runtime}-`,
       ...(runtime === "native" && process.platform === "linux" ? { directory: homedir() } : {}),
     });
+    /* Template containment compares canonical paths; the rest of the fixture keeps `root` as created. */
+    const templateRoot = yield* fs.realPath(root);
     const functionsRoot = `${root}/functions`;
     const storageRoot = `${root}/storage`;
     yield* fs.makeDirectory(`${functionsRoot}/hello`, { recursive: true });
     yield* fs.makeDirectory(storageRoot, { recursive: true });
+    yield* fs.writeFileString(
+      `${root}/recovery.html`,
+      `<p>${recoveryTemplateMarker}</p><a href="{{ .ConfirmationURL }}">Reset</a>`,
+    );
     yield* fs.writeFileString(
       `${functionsRoot}/hello/index.ts`,
       "Deno.serve(async (request) => { const authorization = request.headers.get('authorization') ?? ''; const input = await request.json(); const response = await fetch(`${Deno.env.get('SUPABASE_URL')}/rest/v1/whole_stack_items?id=eq.${input.id}`, { headers: { authorization, apikey: authorization.replace('Bearer ', '') } }); return new Response(await response.text(), { status: response.status, headers: { 'content-type': 'application/json' } }); });",
     );
-    const crypto = yield* Crypto.Crypto;
-    const secret = `whole-stack-${yield* crypto.randomUUIDv4}-secret`;
+    const crypto = yield* SecureRandom.SecureRandom;
+    const secret = `whole-stack-${yield* crypto.uuidV4()}-secret`;
     const locations = {
       stateRoot: `${root}/state`,
       cacheRoot: testArtifactCacheRoot,
@@ -177,7 +186,12 @@ export const wholeStack = Effect.fn("WholeStack.fixture")((runtime: Runtime) =>
         {
           service: "auth",
           pin: selection.auth,
-          config: { jwtSecret: secret },
+          config: {
+            jwtSecret: secret,
+            templates: [
+              { id: "recovery", path: `${templateRoot}/recovery.html`, root: templateRoot },
+            ],
+          },
           endpoints: { http: endpoint("auto") },
         },
         {
@@ -401,7 +415,11 @@ export const waitForLifecycle = Effect.fn("WholeStack.waitForLifecycle")(
     ),
 );
 
-const servicesLayer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const servicesLayer = Layer.mergeAll(
+  NodeServices.layer,
+  NodeCrypto.layer,
+  NodeHttpClient.layerNodeHttp,
+);
 
 export const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   Effect.scoped(effect).pipe(Effect.provide(servicesLayer));
diff --git a/packages/stack/tests/whole-stack/scenarios.ts b/packages/stack/tests/whole-stack/scenarios.ts
index 9c3ac0ff43..d443ead6ac 100644
--- a/packages/stack/tests/whole-stack/scenarios.ts
+++ b/packages/stack/tests/whole-stack/scenarios.ts
@@ -6,6 +6,7 @@ import {
   allMembers,
   clearStackOwner,
   jsonRequest,
+  recoveryTemplateMarker,
   requestWithHeaders,
   refreshLogTails,
   sql,
@@ -268,6 +269,7 @@ const exerciseStack = Effect.fn("WholeStack.exerciseStack")(
             const mailBody = `${mail.Text ?? ""}\n${mail.HTML ?? ""}`;
             expect(mailBody).toContain(authOrigin);
             expect(mailBody).toContain("/verify?token=");
+            expect(mailBody).toContain(recoveryTemplateMarker);
             const realtime = yield* subscribeRealtime(
               realtimeUrl,
               loginBody.access_token,
@@ -682,6 +684,10 @@ export const writeConfinement = (runtime: Runtime) =>
  */
 export const loopbackOnly = withFixture("native", (fixture) =>
   Effect.gen(function* () {
+    // PostgREST only sees the table once it loads its schema cache, so create it before REST starts.
+    yield* fixture.stack.composition.start;
+    yield* prepareSchema(fixture);
+    yield* fixture.stack.composition.stop;
     yield* setActivation(fixture.stack, "eager");
     yield* fixture.stack.composition.start;
     yield* assertLifecycle(fixture, "running");
diff --git a/packages/stack/tests/whole-stack/websocket.ts b/packages/stack/tests/whole-stack/websocket.ts
index 4a1da692c9..7a07c3a2ca 100644
--- a/packages/stack/tests/whole-stack/websocket.ts
+++ b/packages/stack/tests/whole-stack/websocket.ts
@@ -1,5 +1,5 @@
 import { Effect, Queue, Schedule, Schema, Scope } from "effect";
-import { NodeSocket } from "@effect/platform-node";
+import { NodeWS } from "@effect/platform-node";
 import * as Socket from "effect/socket/Socket";
 
 class RealtimeProbeError extends Schema.TaggedError<RealtimeProbeError>()("RealtimeProbeError", {
@@ -53,7 +53,7 @@ export const openWebSocket = Effect.fn("WholeStack.openWebSocket")(
     Effect.gen(function* () {
       const messages = yield* Queue.unbounded<string, WebSocketChannelError>();
       const socket = yield* Socket.makeWebSocket(url, { openTimeout: "60 seconds" }).pipe(
-        Effect.provide(NodeSocket.layerWebSocketConstructorWS),
+        Effect.provide(NodeWS.layerWebSocketConstructor),
       );
       const pull = yield* Socket.readerString(socket).pipe(Effect.mapError(channelError));
       yield* pull.pipe(
diff --git a/patches/@effect__platform-node-shared@4.0.2.patch b/patches/@effect__platform-node-shared@4.0.2.patch
deleted file mode 100644
index e478a007e3..0000000000
--- a/patches/@effect__platform-node-shared@4.0.2.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/dist/NodeChildProcessSpawner.js b/dist/NodeChildProcessSpawner.js
-index b3e4deaa75124184262437280a97bad2b9e07c9d..4b1f5f5f4c119e738991b6d8b84d59fd425d0833 100644
---- a/dist/NodeChildProcessSpawner.js
-+++ b/dist/NodeChildProcessSpawner.js
-@@ -214,6 +214,10 @@ const make = /*#__PURE__*/Effect.gen(function* () {
-     // sink that will attached to the process handle
-     let sink = Sink.drain;
-     if (Predicate.isNotNull(childProcess.stdin)) {
-+      // A child that exits before reading its input fails the final flush of `end()` with
-+      // EPIPE after the sink's own listener is gone; without a listener Node raises it as an
-+      // uncaught exception. The write loop still reports write failures through `onError`.
-+      childProcess.stdin.on("error", () => {});
-       sink = NodeSink.fromWritable({
-         evaluate: () => childProcess.stdin,
-         onError: error => toPlatformError("fromWritable(stdin)", toError(error), command),
diff --git a/patches/@effect__platform-node-shared@4.1.2.patch b/patches/@effect__platform-node-shared@4.1.2.patch
new file mode 100644
index 0000000000..3357bf0bb7
--- /dev/null
+++ b/patches/@effect__platform-node-shared@4.1.2.patch
@@ -0,0 +1,29 @@
+diff --git a/dist/NodeSink.js b/dist/NodeSink.js
+index e04ed48a8a21a7323b37c5f7ef5df8f531c94b95..4fbe8198796491de7e2ab92a58b1dc79413c8d11 100644
+--- a/dist/NodeSink.js
++++ b/dist/NodeSink.js
+@@ -86,7 +86,9 @@ export const pullIntoWritable = options => Effect.withFiber(fiber => {
+   const cleanup = finished(options.writable, {
+     readable: false
+   }, error => {
+-    if (error) {
++    // A writable closed by its reader, such as the stdin of a child that already
++    // exited, has nothing left to deliver; later writes still fail through their callback.
++    if (error && error.code !== "ERR_STREAM_PREMATURE_CLOSE") {
+       onError(error);
+     } else {
+       Deferred.doneUnsafe(completion, Effect.void);
+diff --git a/dist/NodeWS.js b/dist/NodeWS.js
+index e29eb7dae33882898922845f57a3ac21cbc41181..d3cdda830f7bc4e6bb393e6d1a96638e29f9b90f 100644
+--- a/dist/NodeWS.js
++++ b/dist/NodeWS.js
+@@ -10,5 +10,8 @@
+  * @category re-exports
+  * @since 4.1.0
+  */
+-export * from "ws";
++// Bun's bundler drops values re-exported with `export *` from a side-effect-free
++// package, which crashes the compiled CLI: https://github.com/oven-sh/bun/issues/18008
++// (fix pending in https://github.com/oven-sh/bun/pull/46903)
++export { createWebSocketStream, Receiver, Sender, WebSocket, WebSocketServer } from "ws";
+ //# sourceMappingURL=NodeWS.js.map
diff --git a/patches/@effect__vitest@4.0.2.patch b/patches/@effect__vitest@4.0.2.patch
deleted file mode 100644
index 8074e0173a..0000000000
--- a/patches/@effect__vitest@4.0.2.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/dist/internal/internal.js b/dist/internal/internal.js
-index 7138319bb00fb82572338e74ddc8947aa7c2967e..018a7180229568cdb42db75fe8c0a73a33bc1230 100644
---- a/dist/internal/internal.js
-+++ b/dist/internal/internal.js
-@@ -28,12 +28,24 @@ const runPromise = /*#__PURE__*/Effect.fnUntraced(function* (effect, _ctx) {
- }));
- /** @internal */
- const runTest = ctx => effect => {
--  const promise = runPromise(effect, ctx);
-+  // Rejects with the pretty errors themselves (an AggregateError when there are several) so
-+  // Vitest prints the defect instead of the runtime's squashed wrapper, and reports a cause
-+  // that mixes an interrupt with a real failure once the finalizers have run.
-+  const failure = cause => {
-+    const errors = Cause.prettyErrors(cause);
-+    return errors.length > 1 ? new AggregateError(errors) : errors[0] ?? Cause.squash(cause);
-+  };
-+  const exitPromise = Effect.runPromiseExit(effect, {
-+    signal: ctx?.signal
-+  });
-+  const promise = exitPromise.then(exit => Exit.isSuccess(exit) ? exit.value : Promise.reject(failure(exit.cause)));
-   if (ctx) {
-     // Vitest stops awaiting the test promise once the signal aborts (timeout or
-     // cancellation), so only then add a hook that waits for the finalizers.
-     // Registering it unconditionally would change the teardown of every test.
--    const onAbort = () => ctx.onTestFinished(() => promise.then(constVoid, constVoid));
-+    const onAbort = () => ctx.onTestFinished(() => exitPromise.then(exit => {
-+      if (Exit.isFailure(exit) && Cause.hasInterrupts(exit.cause) && !Cause.hasInterruptsOnly(exit.cause)) return Promise.reject(failure(exit.cause));
-+    }));
-     ctx.signal.addEventListener("abort", onAbort, {
-       once: true
-     });
diff --git a/patches/@effect__vitest@4.1.2.patch b/patches/@effect__vitest@4.1.2.patch
new file mode 100644
index 0000000000..92d42fe772
--- /dev/null
+++ b/patches/@effect__vitest@4.1.2.patch
@@ -0,0 +1,42 @@
+diff --git a/dist/internal/internal.js b/dist/internal/internal.js
+index 6c1b1c1..5194e0f 100644
+--- a/dist/internal/internal.js
++++ b/dist/internal/internal.js
+@@ -31,11 +31,19 @@ Effect.uninterruptibleMask(restore => Effect.gen(function* () {
+ })), {
+   signal: ctx?.signal
+ });
+-const settleOnAbort = (ctx, promise) => {
++// Rejects with the pretty errors themselves (an AggregateError when there are several) so
++// Vitest prints the defect instead of the runtime's squashed wrapper.
++const prettyFailure = cause => {
++  const errors = Cause.prettyErrors(cause);
++  return errors.length > 1 ? new AggregateError(errors) : errors[0] ?? Cause.squash(cause);
++};
++const settleOnAbort = (ctx, promise, exitPromise) => {
+   // Vitest stops awaiting the promise once the signal aborts (timeout or
+-  // cancellation), so only then add a hook that waits for the finalizers.
+-  // Registering it unconditionally would change the teardown of every test.
+-  const onAbort = () => ctx.onTestFinished(() => promise.then(constVoid, constVoid));
++  // cancellation), so only then add a hook that waits for the finalizers and
++  // reports a cause that mixes an interrupt with a real failure.
++  const onAbort = () => ctx.onTestFinished(() => exitPromise ? exitPromise.then(exit => {
++    if (Exit.isFailure(exit) && Cause.hasInterrupts(exit.cause) && !Cause.hasInterruptsOnly(exit.cause)) return Promise.reject(prettyFailure(exit.cause));
++  }) : promise.then(constVoid, constVoid));
+   ctx.signal.addEventListener("abort", onAbort, {
+     once: true
+   });
+@@ -47,8 +55,11 @@ const settleOnAbort = (ctx, promise) => {
+ };
+ /** @internal */
+ const runTest = ctx => effect => {
+-  const promise = runPromise(effect, ctx);
+-  return ctx ? settleOnAbort(ctx, promise) : promise;
++  const exitPromise = Effect.runPromiseExit(effect, {
++    signal: ctx?.signal
++  });
++  const promise = exitPromise.then(exit => Exit.isSuccess(exit) ? exit.value : Promise.reject(prettyFailure(exit.cause)));
++  return ctx ? settleOnAbort(ctx, promise, exitPromise) : promise;
+ };
+ const TestEnv = /*#__PURE__*/Layer.mergeAll(TestConsole.layer, /*#__PURE__*/TestClock.layer());
+ /** @internal */
diff --git a/patches/effect@4.1.2.patch b/patches/effect@4.1.2.patch
new file mode 100644
index 0000000000..0aa5f3c544
--- /dev/null
+++ b/patches/effect@4.1.2.patch
@@ -0,0 +1,136 @@
+diff --git a/dist/Channel.js b/dist/Channel.js
+index f42ac740a5927835f288afb938bec0dcf2dbeab8..35051ba558fb365321cd6b9ab4235fc7d6e5da3f 100644
+--- a/dist/Channel.js
++++ b/dist/Channel.js
+@@ -3463,7 +3463,9 @@ export const unwrapUpstreamFailure = cause => hasUpstreamFailure(cause) ? Cause.
+  *
+  * @internal
+  */
+-export const restoreUpstreamFailure = effect => Effect.catchCause(effect, cause => Effect.failCause(unwrapUpstreamFailure(cause)));
++// Failure handlers are skipped in an interrupted fiber, so unwrap outside the
++// interruptible region or the encoded upstream failure leaks as a defect.
++export const restoreUpstreamFailure = effect => Effect.uninterruptibleMask(restore => Effect.catchCause(restore(effect), cause => Effect.failCause(unwrapUpstreamFailure(cause))));
+ /**
+  * Constructs a `Channel` from a scoped effect that will result in a
+  * `Channel` if successful.
+diff --git a/dist/cli/Command.js b/dist/cli/Command.js
+index 0561587191e2fe2fff812729b955db15b3224568..8285aac8ee9a25894744100a1129982262ff31d8 100644
+--- a/dist/cli/Command.js
++++ b/dist/cli/Command.js
+@@ -1192,7 +1192,8 @@ export const runWith = (command, config) => {
+         return entries !== undefined && entries.length > 0;
+       });
+       if (!hasEntry) continue;
+-      const [, value] = yield* flag.flag.parse(emptyArgs).pipe(toShowHelp);
++      // TODO(CLI-2922): keeps 4.0's plain error (no help dump) for an invalid global flag until the next major.
++      const [, value] = yield* flag.flag.parse(emptyArgs);
+       if (flag === GlobalFlag.Wizard) {
+         const {
+           colors
+@@ -1233,11 +1234,12 @@ export const runWith = (command, config) => {
+     const input = yield* commandImpl.parse(parsedArgs).pipe(toShowHelp);
+     // 7. Provide setting values
+     let program = commandImpl.handle(input, [command.name]);
+-    const logLevel = activeFlags.includes(GlobalFlag.LogLevel) ? (yield* GlobalFlag.LogLevel.flag.parse(emptyArgs).pipe(toShowHelp))[1] : Option.none();
++    // TODO(CLI-2922): keeps 4.0's plain error (no help dump) for an invalid global flag until the next major.
++    const logLevel = activeFlags.includes(GlobalFlag.LogLevel) ? (yield* GlobalFlag.LogLevel.flag.parse(emptyArgs))[1] : Option.none();
+     program = Effect.provideService(program, GlobalFlag.LogLevel, logLevel);
+     for (const flag of activeFlags) {
+       if (flag._tag !== "Setting" || flag === GlobalFlag.LogLevel) continue;
+-      const [, value] = yield* flag.flag.parse(emptyArgs).pipe(toShowHelp);
++      const [, value] = yield* flag.flag.parse(emptyArgs);
+       program = Effect.provideService(program, flag, value);
+     }
+     // 8. Apply built-in setting behavior
+diff --git a/dist/cli/GlobalFlag.js b/dist/cli/GlobalFlag.js
+index 843c67241055adb98092c84e1bf982025ba293f2..d1993f3fdeade431f24d0c29c894bcc4c60b973e 100644
+--- a/dist/cli/GlobalFlag.js
++++ b/dist/cli/GlobalFlag.js
+@@ -137,7 +137,8 @@ export const Wizard = /*#__PURE__*/Action({
+  * @since 4.0.0
+  */
+ export const Completions = /*#__PURE__*/Action({
+-  flag: /*#__PURE__*/Flag.ChoiceWithValue("completions", [["bash", "bash"], ["zsh", "zsh"], ["fish", "fish"], ["powershell", "powershell"], ["sh", "bash"], ["pwsh", "powershell"]]).pipe(Flag.optional, /*#__PURE__*/Flag.withMetavar("<bash|zsh|fish|powershell|sh|pwsh>"), /*#__PURE__*/Flag.withDescription("Print shell completion script")),
++  // TODO(CLI-2922): keeps 4.0's shell choices (no powershell/pwsh) until the next major.
++  flag: /*#__PURE__*/Flag.Literals("completions", ["bash", "zsh", "fish", "sh"]).pipe(Flag.optional, /*#__PURE__*/Flag.map(v => Option.map(v, s => s === "sh" ? "bash" : s)), /*#__PURE__*/Flag.withMetavar("<bash|zsh|fish|sh>"), /*#__PURE__*/Flag.withDescription("Print shell completion script")),
+   run: /*#__PURE__*/Effect.fnUntraced(function* (shell, {
+     command
+   }) {
+diff --git a/dist/cli/Param.js b/dist/cli/Param.js
+index d6e1f3a78af446ab70776fdc451b385923bdf05d..a027da3b86e8af7998cf4a95fdec672331a55311 100644
+--- a/dist/cli/Param.js
++++ b/dist/cli/Param.js
+@@ -1486,14 +1486,8 @@ const parseFlag = /*#__PURE__*/Effect.fnUntraced(function* (name, primitiveType,
+       option: name
+     });
+   }
+-  if (providedValues.length > 1) {
+-    return yield* new CliError.InvalidValue({
+-      option: name,
+-      value: `${providedValues.length} occurrences`,
+-      expected: "at most 1 value",
+-      kind: "flag"
+-    });
+-  }
++  // Keeps 4.0's behaviour for a repeated single-value flag (first occurrence is used);
++  // 4.1 rejects it, which would break existing invocations.
+   const arg = providedValues[0];
+   const value = yield* Effect.mapError(primitiveType.parse(arg), error => new CliError.InvalidValue({
+     option: name,
+diff --git a/dist/cli/internal/completions/bash.js b/dist/cli/internal/completions/bash.js
+index c7d92426383c57362b517d89c8739a36eb69fc4a..f20326850994b8e715e52cb716c07b81bee9dfad 100644
+--- a/dist/cli/internal/completions/bash.js
++++ b/dist/cli/internal/completions/bash.js
+@@ -154,7 +154,9 @@ const valueCompletion = (type, helpers) => {
+         return `${helpers.choices} "$cur" "$_comp_word" ${values}`;
+       }
+     case "Path":
+-      return `${helpers.paths} ${type.pathType === "directory" ? "-d" : "-f"} "$cur" "$_comp_word"`;
++      // TODO(CLI-2922): keeps 4.0's plain compgen path completion until the next major.
++      if (type.pathType === "directory") return `COMPREPLY=( $(compgen -d -- "$cur") )`;
++      return `COMPREPLY=( $(compgen -f -- "$cur") )`;
+     default:
+       return undefined;
+   }
+@@ -353,7 +355,6 @@ export const generate = (executableName, descriptor) => {
+   lines.push(`fi`);
+   lines.push(``);
+   choicesHelper(helpers.choices, lines);
+-  pathsHelper(helpers, lines);
+   generateFunction(descriptor, [], lines, helpers);
+   lines.push(`complete -F _${safeName} ${escapeForBash(executableName)}`);
+   lines.push(`###-end-${escapeForBash(executableName)}-completions-###`);
+diff --git a/dist/cli/internal/completions/zsh.js b/dist/cli/internal/completions/zsh.js
+index c8ea8917cfef77b940484443a41d986c95bd9abe..561d27462af270f0504b19c60a87644313e9e33a 100644
+--- a/dist/cli/internal/completions/zsh.js
++++ b/dist/cli/internal/completions/zsh.js
+@@ -3,7 +3,8 @@ import { negatedName } from "./descriptor.js";
+ // Helpers
+ // ---------------------------------------------------------------------------
+ const escapeZsh = s => s.replace(/\\/g, "\\\\").replace(/'/g, "'\\''").replace(/:/g, "\\:");
+-const escapeZshExplanation = s => escapeZsh(s).replace(/]/g, "\\]");
++// TODO(CLI-2922): keeps 4.0's unescaped `]` in descriptions until the next major.
++const escapeZshExplanation = escapeZsh;
+ /** Escape choices for the second parse of a Zsh `_arguments` action. */
+ const escapeZshChoice = s => s.replace(/[^A-Za-z0-9_.,/@%+-]/gu, "\\$&").replace(/'/g, "'\\''");
+ const sanitize = s => s.replace(/[^a-zA-Z0-9_]/g, "_");
+diff --git a/dist/cli/internal/help.js b/dist/cli/internal/help.js
+index 7bc8443b159de35d44f3d6a03b791dcd72ba0e2d..8efe8a1e700a9cf0e8b4394e837e4b77159eb5fd 100644
+--- a/dist/cli/internal/help.js
++++ b/dist/cli/internal/help.js
+@@ -133,12 +133,11 @@ export const getHelpForCommandPath = (command, commandPath, builtIns) => Effect.
+       break;
+     }
+   }
++  // TODO(CLI-2922): keeps 4.0's help doc shape (inherited flags merged into flags) until the next major.
+   return {
+     ...baseDoc,
+-    inheritedFlags,
+-    globalFlags: globalFlagDocs,
+-    globalFlagsScope: commandPath.slice(0, scopeLength),
+-    commandPath
++    flags: [...inheritedFlags, ...baseDoc.flags],
++    globalFlags: globalFlagDocs
+   };
+ });
+ //# sourceMappingURL=help.js.map
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a65f64d186..49ff64c6f6 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -165,20 +165,20 @@ settings:
 catalogs:
   default:
     '@effect/platform-bun':
-      specifier: 4.0.2
-      version: 4.0.2
+      specifier: 4.1.2
+      version: 4.1.2
     '@effect/platform-node':
-      specifier: 4.0.2
-      version: 4.0.2
+      specifier: 4.1.2
+      version: 4.1.2
     '@effect/sql-pg':
-      specifier: 4.0.2
-      version: 4.0.2
+      specifier: 4.1.2
+      version: 4.1.2
     '@effect/tsgo':
       specifier: 0.37.0
       version: 0.37.0
     '@effect/vitest':
-      specifier: 4.0.2
-      version: 4.0.2
+      specifier: 4.1.2
+      version: 4.1.2
     '@supabase/supabase-js':
       specifier: ^2.110.7
       version: 2.112.4
@@ -195,8 +195,8 @@ catalogs:
       specifier: ^5.0.0
       version: 5.0.0
     effect:
-      specifier: 4.0.2
-      version: 4.0.2
+      specifier: 4.1.2
+      version: 4.1.2
     knip:
       specifier: ^6.32.2
       version: 6.34.0
@@ -234,9 +234,10 @@ overrides:
 packageExtensionsChecksum: sha256-gAA6Mc6Jn3jUpogzVWO9hE5trVRioaB8peQBgDbyG6I=
 
 patchedDependencies:
-  '@effect/platform-node-shared@4.0.2': 90a5d5bd45ffbfc265807a93f30110c9a2fc3393633fe82b92ee628c00a78658
-  '@effect/vitest@4.0.2': 9c4eb0354e3ac316883a3575b51bed9a215d49f34f117682c427d5137a5a2146
+  '@effect/platform-node-shared@4.1.2': 66b729af95a256e50b86614a9b3363c34232990e88503e313277096512c76e7f
+  '@effect/vitest@4.1.2': 6247418cdcd517fdfb3b197ba9e463a7843554e13f1ee0bfe13591181c44a3ce
   '@libpg-query/parser@17.6.10': ed67c0ca88b6ced3ec50fd6862f191d6192a246cf20d9c777d45efdb8373bed3
+  effect@4.1.2: faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c
 
 importers:
 
@@ -250,7 +251,7 @@ importers:
         version: 21.2.2
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
       '@effect/tsgo':
         specifier: 'catalog:'
         version: 0.37.0
@@ -262,7 +263,7 @@ importers:
         version: 1.4.2
       effect:
         specifier: 'catalog:'
-        version: 4.0.2
+        version: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
       husky:
         specifier: ^9.1.7
         version: 9.1.7
@@ -317,13 +318,13 @@ importers:
         version: 1.7.0
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
       '@effect/sql-pg':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.2(patch_hash=9c4eb0354e3ac316883a3575b51bed9a215d49f34f117682c427d5137a5a2146)(effect@4.0.2)(vite@8.2.2(@types/node@26.4.1)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)
+        version: 4.1.2(patch_hash=6247418cdcd517fdfb3b197ba9e463a7843554e13f1ee0bfe13591181c44a3ce)(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))(vite@8.2.2(@types/node@26.4.1)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)
       '@modelcontextprotocol/sdk':
         specifier: ^1.30.0
         version: 1.30.0(supports-color@7.2.0)(zod@4.5.4)
@@ -349,8 +350,8 @@ importers:
         specifier: 'catalog:'
         version: 2.112.4
       '@supabase/typegen':
-        specifier: 0.3.1
-        version: 0.3.1(oxfmt@0.66.0)
+        specifier: 0.3.2
+        version: 0.3.2(oxfmt@0.66.0)
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.11
@@ -374,7 +375,7 @@ importers:
         version: 17.4.2
       effect:
         specifier: 'catalog:'
-        version: 4.0.2
+        version: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
       esbuild:
         specifier: ^0.28.2
         version: 0.28.2
@@ -441,16 +442,16 @@ importers:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)(redis@6.2.1)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))(redis@6.2.1)
       '@supabase/cli-test-helpers':
         specifier: workspace:*
         version: link:../../packages/cli-test-helpers
       effect:
         specifier: 'catalog:'
-        version: 4.0.2
+        version: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
     devDependencies:
       '@tsconfig/bun':
         specifier: 'catalog:'
@@ -506,13 +507,13 @@ importers:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)(redis@6.2.1)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))(redis@6.2.1)
       effect:
         specifier: 'catalog:'
-        version: 4.0.2
+        version: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
     devDependencies:
       '@tsconfig/bun':
         specifier: 'catalog:'
@@ -546,10 +547,10 @@ importers:
     dependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
       effect:
         specifier: 'catalog:'
-        version: 4.0.2
+        version: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
     devDependencies:
       '@tsconfig/bun':
         specifier: 'catalog:'
@@ -579,16 +580,19 @@ importers:
       dedent:
         specifier: ^1.7.2
         version: 1.7.2
+      jsonc-parser:
+        specifier: ^3.3.1
+        version: 3.3.1
       smol-toml:
         specifier: ^1.8.0
         version: 1.8.0
     devDependencies:
       '@effect/platform-bun':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)(redis@6.2.1)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))(redis@6.2.1)
       '@semantic-release/commit-analyzer':
         specifier: ^13.0.1
         version: 13.0.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@7.0.2))(supports-color@7.2.0)
@@ -609,7 +613,7 @@ importers:
         version: 8.20.0
       effect:
         specifier: 'catalog:'
-        version: 4.0.2
+        version: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
       semantic-release:
         specifier: 'catalog:'
         version: 25.0.9(supports-color@7.2.0)(typescript@7.0.2)
@@ -627,20 +631,20 @@ importers:
     dependencies:
       '@effect/platform-node':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)(redis@6.2.1)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))(redis@6.2.1)
       '@effect/sql-pg':
         specifier: 'catalog:'
-        version: 4.0.2(effect@4.0.2)
+        version: 4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
       effect:
         specifier: 'catalog:'
-        version: 4.0.2
+        version: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
       jose:
         specifier: ^6.2.10
         version: 6.2.10
     devDependencies:
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.2(patch_hash=9c4eb0354e3ac316883a3575b51bed9a215d49f34f117682c427d5137a5a2146)(effect@4.0.2)(vite@8.2.2(@types/node@26.4.1)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)
+        version: 4.1.2(patch_hash=6247418cdcd517fdfb3b197ba9e463a7843554e13f1ee0bfe13591181c44a3ce)(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))(vite@8.2.2(@types/node@26.4.1)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.11
@@ -741,11 +745,11 @@ packages:
       zod:
         optional: true
 
-  '@ark/schema@0.56.7':
-    resolution: {integrity: sha512-jmoOJlYIc4k1uv8oYBDNOFnAsKk2a2D9t/D6npF2JUfW4ecPB0v6ce6lruKg7lkBxIBA8Z7UtxfmvephYbhUGQ==}
+  '@ark/schema@0.56.8':
+    resolution: {integrity: sha512-R05TOe85oQBGFFw2zKMuZpqkXibLKuC/aJt6VwFn5Cjc4x3NkWfhvGRpRDycNkj3ddcHnOPtIsmjVowJO9Yxdw==}
 
-  '@ark/util@0.56.7':
-    resolution: {integrity: sha512-z8pVnrPk/x9GC18yOp5wCe8rR2+Z6us4CTSg7dvxdsDLuA2xXYq+QETD1fO6f3fMuXe+PCjpvtCnhTW9RHLgEw==}
+  '@ark/util@0.56.8':
+    resolution: {integrity: sha512-XLiQyGfpJcws1zCtp2Cva8s1oheCdFn1Rt6JSyC4NnkDrpwCJnlaiawuuOc1Z97vMH+jEzW5vyyf0xOju5wUQA==}
 
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
@@ -903,28 +907,28 @@ packages:
     peerDependencies:
       '@noble/ciphers': ^1.0.0
 
-  '@effect/platform-bun@4.0.2':
-    resolution: {integrity: sha512-wbQ9jQKtTjqHOYvMrgINWKuP05Q0cXe/Rze2c2gOAakztE34tVzT4aRvvooUR2l+JGWf/hL26nmHXJ4/Urkqiw==}
+  '@effect/platform-bun@4.1.2':
+    resolution: {integrity: sha512-waEAa84CITqjctgw9VdhlL9PyXRHICG3KAWTFRDPUE2XL/pfMPhO7V9oFdfx22dbAhhUzV+MHs0d9hnmy/DQ7w==}
     peerDependencies:
-      effect: ^4.0.2
+      effect: ^4.1.2
 
-  '@effect/platform-node-shared@4.0.2':
-    resolution: {integrity: sha512-xn8aDw9p/QUPt1Yi0C3HUMcycT+MjHfAe19FDUDrUuzcwq0xxskkamVSqbdykF/Dsuus4aZTsCBZA/vkhHIfbQ==}
-    engines: {node: '>=18.0.0'}
+  '@effect/platform-node-shared@4.1.2':
+    resolution: {integrity: sha512-wSwl9A/G1hcVvF8nLI+YfB3EyOIDvWS6+lsTZBkmgDnPBL7m8YWZF+1HD+mdEsb52SUGfukip46Q3gRwSdk3QA==}
+    engines: {node: '>=22.19.0'}
     peerDependencies:
-      effect: ^4.0.2
+      effect: ^4.1.2
 
-  '@effect/platform-node@4.0.2':
-    resolution: {integrity: sha512-RWesXBQStnFHdD465gR5thFKgXO7FSyCKRZ56nWXB7PedNVzr8vV0nb/3MULLdri493sMz/b/pmGBTb6K8cBjQ==}
-    engines: {node: '>=18.0.0'}
+  '@effect/platform-node@4.1.2':
+    resolution: {integrity: sha512-ye0UjxORdd5Qu3paZ1LljgGOALWHt7muP9VTpjUSCNfcesiB/Hm7wPJIvZeu4gnwpTe5BtEnO1VHngWqjJp8mA==}
+    engines: {node: '>=22.19.0'}
     peerDependencies:
-      effect: ^4.0.2
-      redis: '>=5.0.0 <7.0.0'
+      effect: ^4.1.2
+      redis: '>=5.1.0 <7.0.0'
 
-  '@effect/sql-pg@4.0.2':
-    resolution: {integrity: sha512-i2N5F0L5s1S8Nx2I8V7k+awBinP26b5xiiHL1zn5b6RALNnloiU7FK1yS4dAkmqG9B0EcOVxvJrIpoMWwrB4hw==}
+  '@effect/sql-pg@4.1.2':
+    resolution: {integrity: sha512-0UehR7B5W8dC+dX6fDeWStLbVbBb2M4pk4HBATEeH0cmV4Odl2lckTg0jFmLuadekTLa4OyB+bZQo1yTG1y2Mw==}
     peerDependencies:
-      effect: ^4.0.2
+      effect: ^4.1.2
 
   '@effect/tsgo-darwin-arm64@0.37.0':
     resolution: {integrity: sha512-D9o2NKswmRklu+sG28HkxZAvtvOa0Mt+bLVjJKydF2kVw+gePxiHuTbbI3e4Kqumv4ucLT3TtqU1a2RirC80lA==}
@@ -965,10 +969,10 @@ packages:
     resolution: {integrity: sha512-jCJIUcNgI0vaoylao/mhOv+7hDfaJRwZJSJrg5kA/FCQ4aGDhAYqyQx+hoZh8AW3pzD9Qp1RWtUsVFqOzIOENw==}
     hasBin: true
 
-  '@effect/vitest@4.0.2':
-    resolution: {integrity: sha512-Zb72nu7iUy3rNdBp9J1Xu5oUQGwJ8cOYsUwmYgujj88aqyvASRDjOS01SjlcPViqf77csduetKdCJTVndMNfzw==}
+  '@effect/vitest@4.1.2':
+    resolution: {integrity: sha512-JJPwAHkJHxvM/woW9mMW/khjasAHcmwWdOMAgMy16rfqsxcVhFDnrRsvN9VI2+kMv8zDCCyBE2q1n5hzZlfE0w==}
     peerDependencies:
-      effect: ^4.0.2
+      effect: ^4.1.2
       vite: '*'
       vitest: '>=5.0.0 <6.0.0'
 
@@ -2902,8 +2906,8 @@ packages:
     resolution: {integrity: sha512-uaubtPSeg2TR4wrtfQoQWgkTAe+a0qWX2KhmwvTfNl5mGN9+U7owiJt6abk3o/V6O899PSRD1yzxs5RlF4xTug==}
     engines: {node: '>=22.0.0'}
 
-  '@supabase/postgrest-typegen@0.6.0':
-    resolution: {integrity: sha512-3aCh88bSqPpLbKQV3q9obZcYSJ9BYbQgkYFCYgGcu9pv/WEE/9sK7k2aWJqKJR9hK9NTWXBD85/yx7vSMvEw+A==}
+  '@supabase/postgrest-typegen@0.7.0':
+    resolution: {integrity: sha512-B1Wh2arVChXsX9ACdOv6CuX7m1+5S7jYFjB0b+yhNWJq63RFkOTgRlz4Q1uGI/M9nSPXtM3XC03KxpvKzTknCg==}
     engines: {node: '>=22.12.0'}
     peerDependencies:
       oxfmt: 0.66.0
@@ -2928,8 +2932,8 @@ packages:
       '@opentelemetry/api':
         optional: true
 
-  '@supabase/typegen@0.3.1':
-    resolution: {integrity: sha512-Xv/CxMuKPRBxGQrWmCqSg3YBqykZcHZab5A3YwVP2QIzU2Yy+YTBpGqQXEmtdvXw7rdIpOde+10Z9bKCrg1O5w==}
+  '@supabase/typegen@0.3.2':
+    resolution: {integrity: sha512-b48/ZCYnKtl6qdjDlkuXpU33lWEYo0x4pvZCaFyLaY+mbJ0DxZAoS6Jpsa0pBUYGwcDVupBLpDKcjXQPSZPNJA==}
     engines: {node: '>=22.12.0'}
     peerDependencies:
       oxfmt: 0.66.0
@@ -3278,67 +3282,79 @@ packages:
     resolution: {integrity: sha512-6dOwkawiJYtUUBchfjrFo7poz460Yg+aQNgr4lHUPZ2fNW+llpMEZkbznTq25BEmmiBGPJr+L15dzTvR8zP4vQ==}
     cpu: [arm64]
     os: [android]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-darwin-arm64@0.9.3':
     resolution: {integrity: sha512-DTRoWK7AqNfshN+DcCS/s4n86br0ZusISeXLZWWNuvnZ3b9LCVXdWRVPlnMpEwsmSH3c3QSwL7MAOPyEHMe+FA==}
     cpu: [arm64]
     os: [darwin]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-darwin-x64@0.9.3':
     resolution: {integrity: sha512-EWzaR0/AL3ikZfUiADG1SmbB+wF7GGhXFKhMWm3RbOTf+ATyEW7Fa9nsjo1K70pWEeVZHRm9MU4iq7LIUEEgfg==}
     cpu: [x64]
     os: [darwin]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-freebsd-x64@0.9.3':
     resolution: {integrity: sha512-Ao4/v+ppzIFVs2SldvBM2hc9NsijXNsKc1xUY+d+Nv20HrjRdm96HtrkIViw7zI5i6Ca77jkd8VbhWE8E4kgyg==}
     cpu: [x64]
     os: [freebsd]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-linux-arm-gnu@0.9.3':
     resolution: {integrity: sha512-EZc2H6bAyl4u3z48Jtqf4Un1657TpOkBWEmSdPCY1tHCO4YUFaNAz4dPA93yWgo5t38oRQT9UoXlwse/4aLtxw==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-linux-arm-musl@0.9.3':
     resolution: {integrity: sha512-pKny3wEa2Xl4kPoqNU8fO5NCzcp9VgMAkLpN3GZ5TOkdz23ppuzUqddlhad43/9puxfckX5aZqfxML/1vGoxBw==}
     cpu: [arm]
     os: [linux]
     libc: [musl]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-linux-arm64-gnu@0.9.3':
     resolution: {integrity: sha512-bfpsIupfbX7N4ueSjo3Zm+Mob0q7MjrZX+INMGcPjNnXBcyKjkzrTotkqbEbwgfiNKhqyDVjynwsh64xsv5IPg==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-linux-arm64-musl@0.9.3':
     resolution: {integrity: sha512-Q+AAUrrsgYgHb0/Wrm+HnSKN7xOpkC+6Y2812dZw5/rrSX7+qjRjJ+3uNnCZlkHpH3Hy7WXbLIa/IncP4bcHQA==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-linux-x64-gnu@0.9.3':
     resolution: {integrity: sha512-ZQyjmSDRHTkDlddrzmIG1/nMUYDZC21XUguzQ4qvSWtfq6CsfJvIDFBPfJ03YDNQ+wR0px9Ly/xAa8VC0p9rHQ==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-linux-x64-musl@0.9.3':
     resolution: {integrity: sha512-EIYzThB5pI3BiZHFNYyY8nMQ38z9l8/kT8uYvfYVpZ9TNEC0YgqX95MH61l9RILCYFDx+DbLoGajGY55JFvb6Q==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-win32-arm64@0.9.3':
     resolution: {integrity: sha512-KF+Ho3jtjikfPYJ76NL1KiPYwF+0UjnsASX0k461BZ1Er4pRQG39o8WvsngLT+fDg6JxB3v5J+ScDrto29RVnA==}
     cpu: [arm64]
     os: [win32]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-analyzer/binding-win32-x64@0.9.3':
     resolution: {integrity: sha512-4pdUfYVYPf05vyygvWiXsiI/tdPqn5bBiHs7c1TBIm3Kx7/w5pq++myNQ/8CUH/Proz+1kHtCr/lDJF9k67fqg==}
     cpu: [x64]
     os: [win32]
+    deprecated: yuku-analyzer runs on yuku-core since 0.14
 
   '@yuku-toolchain/types@0.9.3':
     resolution: {integrity: sha512-rFE+5P4g2wxko5C85MugJOlVjBHEQq87dIkhLkniLXLp63PEtgaFjD954i5HXlfnyzLxPcZHsSOVDVgmo1HToA==}
@@ -3383,6 +3399,11 @@ packages:
 
   ajv-formats@3.0.1:
     resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
 
   ajv@8.20.0:
     resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
@@ -3432,11 +3453,11 @@ packages:
     resolution: {integrity: sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==}
     engines: {node: '>=10'}
 
-  arkregex@0.0.13:
-    resolution: {integrity: sha512-c17sqCqiiZauxyoU1KZ2zbzCgeghGmc8dR2CrdQnlEtpq3bLhRLoLrxTL52M/8yQD8e/i1/IBRpRCNAuqJa7xQ==}
+  arkregex@0.0.14:
+    resolution: {integrity: sha512-G3I/uCtWE0IKQiPh0qqmmAFDdtjZKZQ5mNPR6gJBeAMZ7VqYCpoaDeXnLju2Zo6ywExtmxZJELeVFb0MPDjPyA==}
 
-  arktype@2.2.8:
-    resolution: {integrity: sha512-tZyLza7kO2vN8BXBKcj4t43IVMe8/ZyqlITH0chZv7FfEw+edLovpY922tqcK4mCjTpf4oNo2xV6np7tquP1ww==}
+  arktype@2.2.9:
+    resolution: {integrity: sha512-Cja0IMEn19rB35on9da1i1z6QMasuS7ULffXbetCry09jvCGYT8Bi1KgYiqri5FymF4nQAXkM90yksYkgSK2EA==}
 
   array-flatten@1.1.1:
     resolution: {integrity: sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==}
@@ -3964,8 +3985,8 @@ packages:
   ee-first@1.1.1:
     resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
 
-  effect@4.0.2:
-    resolution: {integrity: sha512-YeYnLqSFrL4+tCOXRrfNP03w8FILoF/wDl+ukraJAGzXrjcS383W7LAAvGBbLatEyktmLxRq+9xJinx7QzXW5A==}
+  effect@4.1.2:
+    resolution: {integrity: sha512-d3Oah1WyKxFLFh19yWheS5IXIVaITzxZ71JkE1rkUozq/6EcJSU5nPk5bF2QrSygZ3SQoiNQB8TsxFriyMeMaQ==}
 
   emoji-regex@10.6.0:
     resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
@@ -4772,6 +4793,9 @@ packages:
   json-with-bigint@3.5.12:
     resolution: {integrity: sha512-uwbF/wSSuOgC7qqlq27Xp5B6a2MHVug3t0idZdTqu0JnlFvgJuH7ju+KAk/J06C7GfhoYy2gnb9wz2INqcne7w==}
 
+  jsonc-parser@3.3.1:
+    resolution: {integrity: sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==}
+
   jsonfile@6.2.1:
     resolution: {integrity: sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==}
 
@@ -6451,8 +6475,8 @@ packages:
     resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
     engines: {node: '>=20.18.1'}
 
-  undici@8.11.2:
-    resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==}
+  undici@8.12.3:
+    resolution: {integrity: sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==}
     engines: {node: '>=22.19.0'}
 
   unicode-emoji-modifier-base@1.0.0:
@@ -6719,8 +6743,8 @@ packages:
       utf-8-validate:
         optional: true
 
-  ws@8.22.0:
-    resolution: {integrity: sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==}
+  ws@8.22.1:
+    resolution: {integrity: sha512-oyL6OPYme/CmiFvNuGzeoxCJ4nOrZE2O1FwM9MWM1AsGri6nLXB2pg+lNA8aLeXMSav0J6eIVS1j6vUPzUtK9g==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -6849,11 +6873,11 @@ snapshots:
     optionalDependencies:
       zod: 4.5.4
 
-  '@ark/schema@0.56.7':
+  '@ark/schema@0.56.8':
     dependencies:
-      '@ark/util': 0.56.7
+      '@ark/util': 0.56.8
 
-  '@ark/util@0.56.7': {}
+  '@ark/util@0.56.8': {}
 
   '@babel/code-frame@7.29.7':
     dependencies:
@@ -7069,36 +7093,36 @@ snapshots:
     dependencies:
       '@noble/ciphers': 1.3.0
 
-  '@effect/platform-bun@4.0.2(effect@4.0.2)':
+  '@effect/platform-bun@4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))':
     dependencies:
-      '@effect/platform-node-shared': 4.0.2(patch_hash=90a5d5bd45ffbfc265807a93f30110c9a2fc3393633fe82b92ee628c00a78658)(effect@4.0.2)
-      effect: 4.0.2
+      '@effect/platform-node-shared': 4.1.2(patch_hash=66b729af95a256e50b86614a9b3363c34232990e88503e313277096512c76e7f)(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
+      effect: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/platform-node-shared@4.0.2(patch_hash=90a5d5bd45ffbfc265807a93f30110c9a2fc3393633fe82b92ee628c00a78658)(effect@4.0.2)':
+  '@effect/platform-node-shared@4.1.2(patch_hash=66b729af95a256e50b86614a9b3363c34232990e88503e313277096512c76e7f)(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))':
     dependencies:
       '@types/ws': 8.18.2
-      effect: 4.0.2
-      ws: 8.22.0
+      effect: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
+      ws: 8.22.1
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/platform-node@4.0.2(effect@4.0.2)(redis@6.2.1)':
+  '@effect/platform-node@4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))(redis@6.2.1)':
     dependencies:
-      '@effect/platform-node-shared': 4.0.2(patch_hash=90a5d5bd45ffbfc265807a93f30110c9a2fc3393633fe82b92ee628c00a78658)(effect@4.0.2)
-      effect: 4.0.2
+      '@effect/platform-node-shared': 4.1.2(patch_hash=66b729af95a256e50b86614a9b3363c34232990e88503e313277096512c76e7f)(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))
+      effect: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
       redis: 6.2.1
-      undici: 8.11.2
+      undici: 8.12.3
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@effect/sql-pg@4.0.2(effect@4.0.2)':
+  '@effect/sql-pg@4.1.2(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))':
     dependencies:
-      effect: 4.0.2
+      effect: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
 
   '@effect/tsgo-darwin-arm64@0.37.0':
     optional: true
@@ -7131,9 +7155,9 @@ snapshots:
       '@effect/tsgo-win32-arm64': 0.37.0
       '@effect/tsgo-win32-x64': 0.37.0
 
-  '@effect/vitest@4.0.2(patch_hash=9c4eb0354e3ac316883a3575b51bed9a215d49f34f117682c427d5137a5a2146)(effect@4.0.2)(vite@8.2.2(@types/node@26.4.1)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)':
+  '@effect/vitest@4.1.2(patch_hash=6247418cdcd517fdfb3b197ba9e463a7843554e13f1ee0bfe13591181c44a3ce)(effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c))(vite@8.2.2(@types/node@26.4.1)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)':
     dependencies:
-      effect: 4.0.2
+      effect: 4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c)
       vite: 8.2.2(@types/node@26.4.1)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.9.0)
       vitest: 5.0.0(@types/node@26.4.1)(@vitest/coverage-v8@5.0.0)(vite@8.2.2(@types/node@26.4.1)(esbuild@0.28.2)(jiti@2.7.0)(yaml@2.9.0))
 
@@ -8614,9 +8638,9 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/postgrest-typegen@0.6.0(oxfmt@0.66.0)':
+  '@supabase/postgrest-typegen@0.7.0(oxfmt@0.66.0)':
     dependencies:
-      arktype: 2.2.8
+      arktype: 2.2.9
     optionalDependencies:
       oxfmt: 0.66.0
 
@@ -8638,9 +8662,9 @@ snapshots:
       '@supabase/realtime-js': 2.112.4
       '@supabase/storage-js': 2.112.4
 
-  '@supabase/typegen@0.3.1(oxfmt@0.66.0)':
+  '@supabase/typegen@0.3.2(oxfmt@0.66.0)':
     dependencies:
-      '@supabase/postgrest-typegen': 0.6.0(oxfmt@0.66.0)
+      '@supabase/postgrest-typegen': 0.7.0(oxfmt@0.66.0)
     optionalDependencies:
       oxfmt: 0.66.0
 
@@ -9120,15 +9144,15 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  arkregex@0.0.13:
+  arkregex@0.0.14:
     dependencies:
-      '@ark/util': 0.56.7
+      '@ark/util': 0.56.8
 
-  arktype@2.2.8:
+  arktype@2.2.9:
     dependencies:
-      '@ark/schema': 0.56.7
-      '@ark/util': 0.56.7
-      arkregex: 0.0.13
+      '@ark/schema': 0.56.8
+      '@ark/util': 0.56.8
+      arkregex: 0.0.14
 
   array-flatten@1.1.1: {}
 
@@ -9614,7 +9638,7 @@ snapshots:
 
   ee-first@1.1.1: {}
 
-  effect@4.0.2: {}
+  effect@4.1.2(patch_hash=faa1652a408bc1c627b2c98c6ebcab36b114ffce91795781a692d6ef4970150c): {}
 
   emoji-regex@10.6.0: {}
 
@@ -10558,6 +10582,8 @@ snapshots:
 
   json-with-bigint@3.5.12: {}
 
+  jsonc-parser@3.3.1: {}
+
   jsonfile@6.2.1:
     dependencies:
       universalify: 2.0.1
@@ -12650,7 +12676,7 @@ snapshots:
 
   undici@7.29.0: {}
 
-  undici@8.11.2: {}
+  undici@8.12.3: {}
 
   unicode-emoji-modifier-base@1.0.0: {}
 
@@ -12906,7 +12932,7 @@ snapshots:
 
   ws@8.21.3: {}
 
-  ws@8.22.0: {}
+  ws@8.22.1: {}
 
   xtend@4.0.2: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index ab9ce8003d..7604013415 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,18 +11,18 @@ allowBuilds:
   sharp: true
 
 catalog:
-  "@effect/platform-bun": "4.0.2"
-  "@effect/platform-node": "4.0.2"
-  "@effect/sql-pg": "4.0.2"
+  "@effect/platform-bun": "4.1.2"
+  "@effect/platform-node": "4.1.2"
+  "@effect/sql-pg": "4.1.2"
   "@effect/tsgo": &effect-tsgo-version "0.37.0"
-  "@effect/vitest": "4.0.2"
+  "@effect/vitest": "4.1.2"
   "@supabase/supabase-js": ^2.110.7
   "@tsconfig/bun": "^1.0.11"
   "@types/bun": "^1.4.2"
   "@types/ws": "8.18.1"
   "typescript": "^7.0.2"
   "@vitest/coverage-v8": "^5.0.0"
-  "effect": "4.0.2"
+  "effect": "4.1.2"
   "knip": "^6.32.2"
   "oxfmt": "^0.65.0"
   "oxlint": "1.80.0"
@@ -102,17 +102,18 @@ minimumReleaseAgeExclude:
   - "@turbo/linux-arm64@2.10.11"
   - "@turbo/windows-64@2.10.11"
   - "@turbo/windows-arm64@2.10.11"
-  - "@effect/platform-bun@4.0.2"
-  - "@effect/platform-node@4.0.2"
-  - "@effect/platform-node-shared@4.0.2"
-  - "@effect/sql-pg@4.0.2"
-  - "@effect/vitest@4.0.2"
+  - "@effect/platform-bun@4.1.2"
+  - "@effect/platform-node@4.1.2"
+  - "@effect/platform-node-shared@4.1.2"
+  - "@effect/sql-pg@4.1.2"
+  - "@effect/vitest@4.1.2"
   - "@supabase/pg-delta@1.0.0-alpha.60"
   - "@supabase/pg-topo@1.0.0-alpha.8"
-  - "@supabase/postgrest-typegen@0.6.0"
-  - "@supabase/typegen@0.3.1"
-  - "effect@4.0.2"
+  - "@supabase/postgrest-typegen@0.7.0"
+  - "@supabase/typegen@0.3.2"
+  - "effect@4.1.2"
   - "turbo@2.10.11"
+  - "ws@8.22.1"
 
 supportedArchitectures:
   cpu:
@@ -130,8 +131,9 @@ supportedArchitectures:
     - win32
 
 patchedDependencies:
-  "@effect/platform-node-shared@4.0.2": patches/@effect__platform-node-shared@4.0.2.patch
-  "@effect/vitest@4.0.2": patches/@effect__vitest@4.0.2.patch
+  "@effect/platform-node-shared@4.1.2": patches/@effect__platform-node-shared@4.1.2.patch
+  "@effect/vitest@4.1.2": patches/@effect__vitest@4.1.2.patch
   "@libpg-query/parser@17.6.10": patches/@libpg-query__parser@17.6.10.patch
+  "effect@4.1.2": patches/effect@4.1.2.patch
 
 virtualStoreType: global
diff --git a/turbo.json b/turbo.json
index 2cdbbc3bee..2d10e7b252 100644
--- a/turbo.json
+++ b/turbo.json
@@ -17,12 +17,6 @@
     "lint:fix": {
       "cache": false
     },
-    "lint:effect:check": {
-      "cache": false
-    },
-    "lint:effect:fix": {
-      "cache": false
-    },
     "lint:actions:check": {
       "cache": false
     },