fix(cli): functions delete/download mark --project-ref telemetry-safe (Go parity)

apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md

@@ -2,28 +2,39 @@
 
 ## Files Read
 
-| Path | Format | When |
-| -------------------------- | ---------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path | Format | When |
+| ----------------------------------------------- | ---------- | ------------------------------------------------------------- |
+| `<SUPABASE_HOME or ~/.supabase>/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| `<SUPABASE_HOME or ~/.supabase>/profile` | plain text | when `--profile` and `SUPABASE_PROFILE` are both unset |
+| `<profile>.yaml` | YAML | when `SUPABASE_PROFILE` or `--profile` points to a file |
+| `<workdir>/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON | when present, before post-run telemetry state is refreshed |
 
 ## Files Written
 
-| Path | Format | When |
-| ---- | ------ | ---- |
-| — | — | — |
+| Path | Format | When |
+| ----------------------------------------------- | ------ | ----------------------------------------------------------------------- |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON | after resolving a project ref, cached on both success and failure paths |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON | after command completion, flushed on both success and failure paths |
 
 ## API Routes
 
-| Method | Path | Auth | Request body | Response (used fields) |
-| -------- | ------------------------------------- | ------------ | ------------ | ---------------------- |
-| `DELETE` | `/v1/projects/{ref}/functions/{slug}` | Bearer token | none | none |
+| Method | Path | Auth | Request body | Response (used fields) |
+| -------- | ------------------------------------- | ------------ | ------------ | ----------------------------------------------------- |
+| `DELETE` | `/v1/projects/{ref}/functions/{slug}` | Bearer token | none | none |
+| `GET` | `/v1/projects` | Bearer token | none | project picker options when no ref is supplied in TTY |
+| `GET` | `/v1/projects/{ref}` | Bearer token | none | linked project metadata used by the post-run cache |
 
 ## Environment Variables
 
-| Variable | Purpose | Required? |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (falls back to `~/.supabase/profile` -> `supabase`) |
+| Variable | Purpose | Required? |
+| ----------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `<SUPABASE_HOME or ~/.supabase>/access-token`) |
+| `SUPABASE_HOME` | overrides where `telemetry.json` and `profile` are read/written | no (defaults to `~/.supabase`) |
+| `SUPABASE_NO_KEYRING` | disables the OS keyring, forcing the access-token file fallback | no |
+| `SUPABASE_PROFILE` | select a built-in profile or YAML profile file with `api_url:` | no (falls back to `~/.supabase/profile` -> `supabase`) |
+| `SUPABASE_PROJECT_ID` | provides the project ref when `--project-ref` is unset | no (falls back to `<workdir>/supabase/.temp/project-ref`) |
+| `SUPABASE_WORKDIR` | sets `<workdir>` for local Supabase temp files | no (falls back to `--workdir` -> nearest ancestor with `supabase/config.toml` -> cwd) |
 
 ## Exit Codes
 
@@ -34,6 +45,12 @@
 | `1` | authentication error (no token found) |
 | `1` | network / connection failure |
 
+## Telemetry Events Fired
+
+| Event | When | Notable properties / groups |
+| ---------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`project-ref` recorded verbatim, matching `functions list`; every other flag redacted) |
+
 ## Output
 
 ### `--output-format text` (Go CLI compatible)

apps/cli/src/legacy/commands/functions/delete/delete.command.ts

@@ -1,5 +1,6 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+import { FUNCTIONS_PROJECT_REF_SAFE_FLAGS } from "../../../../shared/functions/functions.shared.ts";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
 import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
@@ -17,6 +18,14 @@ const config = {
 
 export type LegacyFunctionsDeleteFlags = CliCommand.Command.Config.Infer<typeof config>;
 
+// Exported so integration tests can drive the exact wiring `Command.withHandler`
+// uses below, instead of re-asserting the generic instrumentation mechanism.
+export const legacyFunctionsDeleteHandler = (flags: LegacyFunctionsDeleteFlags) =>
+ legacyFunctionsDelete(flags).pipe(
+ withLegacyCommandInstrumentation({ flags, safeFlags: FUNCTIONS_PROJECT_REF_SAFE_FLAGS }),
+ withJsonErrorHandling,
+ );
+
 export const legacyFunctionsDeleteCommand = Command.make("delete", config).pipe(
  Command.withDescription(
  "Delete a Function from the linked Supabase project. This does NOT remove the Function locally.",
@@ -32,11 +41,6 @@ export const legacyFunctionsDeleteCommand = Command.make("delete", config).pipe(
  description: "Delete a deployed function from a specific project",
  },
  ]),
- Command.withHandler((flags) =>
- legacyFunctionsDelete(flags).pipe(
- withLegacyCommandInstrumentation({ flags }),
- withJsonErrorHandling,
- ),
- ),
+ Command.withHandler(legacyFunctionsDeleteHandler),
  Command.provide(legacyManagementApiRuntimeLayer(["functions", "delete"])),
 );

apps/cli/src/legacy/commands/functions/delete/delete.integration.test.ts

@@ -1,6 +1,9 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Option } from "effect";
+import { Effect, Layer, Option, Stdio } from "effect";
 
+import { commandRuntimeLayer } from "../../../../shared/runtime/command-runtime.layer.ts";
+import { CurrentAnalyticsContext } from "../../../../shared/telemetry/analytics-context.ts";
+import { Analytics } from "../../../../shared/telemetry/analytics.service.ts";
 import {
  buildLegacyTestRuntime,
  mockLegacyCliConfig,
@@ -10,10 +13,34 @@ import {
  useLegacyTempWorkdir,
 } from "../../../../../tests/helpers/legacy-mocks.ts";
 import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
+import { legacyFunctionsDeleteHandler } from "./delete.command.ts";
 import { legacyFunctionsDelete } from "./delete.handler.ts";
 
 const tempRoot = useLegacyTempWorkdir("supabase-functions-delete-legacy-");
 
+// `withLegacyCommandInstrumentation` threads `flags`/`command`/etc. through
+// `CurrentAnalyticsContext`, not the direct `capture()` call args — mirrors
+// the identical local helper in `legacy-command-instrumentation.unit.test.ts`.
+// The shared `mockAnalytics()` in tests/helpers/mocks.ts deliberately doesn't
+// merge this context (most callers don't need it).
+function mockContextualAnalytics() {
+ const captured: Array<{ event: string; properties: Record<string, unknown> }> = [];
+ const layer = Layer.succeed(
+ Analytics,
+ Analytics.of({
+ capture: (event: string, properties: Record<string, unknown> = {}) =>
+ Effect.gen(function* () {
+ const context = yield* CurrentAnalyticsContext;
+ captured.push({ event, properties: { ...context, ...properties } });
+ }),
+ identify: () => Effect.void,
+ alias: () => Effect.void,
+ groupIdentify: () => Effect.void,
+ }),
+ );
+ return { layer, captured };
+}
+
 describe("legacy functions delete", () => {
  it.live("deletes a function natively through the Management API", () => {
  const out = mockOutput({ format: "text" });
@@ -68,4 +95,41 @@ describe("legacy functions delete", () => {
  expect(api.requests[0]?.url).toContain("/projects/qrstuvwxyzabcdefghij/functions/");
  }).pipe(Effect.provide(layer));
  });
+
+ it.live(
+ "does not redact --project-ref in cli_command_executed (Go parity: cmd/functions.go:153)",
+ () => {
+ const out = mockOutput({ format: "text" });
+ const api = mockLegacyPlatformApi({ response: { status: 200, body: null } });
+ const analytics = mockContextualAnalytics();
+ const layer = Layer.mergeAll(
+ buildLegacyTestRuntime({
+ out,
+ api,
+ cliConfig: mockLegacyCliConfig({ workdir: tempRoot.current }),
+ analytics,
+ }),
+ commandRuntimeLayer(["functions", "delete"]),
+ Stdio.layerTest({
+ args: Effect.succeed([
+ "functions",
+ "delete",
+ "hello-world",
+ "--project-ref",
+ "abcdefghijklmnopqrst",
+ ]),
+ }),
+ );
+
+ return Effect.gen(function* () {
+ yield* legacyFunctionsDeleteHandler({
+ functionName: "hello-world",
+ projectRef: Option.some("abcdefghijklmnopqrst"),
+ });
+
+ const event = analytics.captured.find((c) => c.event === "cli_command_executed");
+ expect(event?.properties.flags).toEqual({ "project-ref": "abcdefghijklmnopqrst" });
+ }).pipe(Effect.provide(layer));
+ },
+ );
 });

apps/cli/src/legacy/commands/functions/deploy/deploy.command.ts

@@ -1,5 +1,6 @@
 import { Argument, Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
+import { FUNCTIONS_PROJECT_REF_SAFE_FLAGS } from "../../../../shared/functions/functions.shared.ts";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { legacyManagementApiRuntimeLayer } from "../../../shared/legacy-management-api-runtime.layer.ts";
 import { withLegacyCommandInstrumentation } from "../../../telemetry/legacy-command-instrumentation.ts";
@@ -64,7 +65,7 @@ export const legacyFunctionsDeployCommand = Command.make("deploy", config).pipe(
  ]),
  Command.withHandler((flags) =>
  legacyFunctionsDeploy(flags).pipe(
- withLegacyCommandInstrumentation({ flags, safeFlags: ["project-ref"] }),
+ withLegacyCommandInstrumentation({ flags, safeFlags: FUNCTIONS_PROJECT_REF_SAFE_FLAGS }),
  withJsonErrorHandling,
  ),
  ),

apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md

@@ -2,23 +2,31 @@
 
 ## Files Read
 
-| Path | Format | When |
-| -------------------------- | ---------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| Path | Format | When |
+| ----------------------------------------------- | ---------- | ------------------------------------------------------------- |
+| `<SUPABASE_HOME or ~/.supabase>/access-token` | plain text | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
+| `<SUPABASE_HOME or ~/.supabase>/profile` | plain text | when `--profile` and `SUPABASE_PROFILE` are both unset |
+| `<profile>.yaml` | YAML | when `SUPABASE_PROFILE` or `--profile` points to a file |
+| `<workdir>/supabase/.temp/project-ref` | plain text | when `--project-ref` and `SUPABASE_PROJECT_ID` are both unset |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON | when present, before post-run telemetry state is refreshed |
 
 ## Files Written
 
-| Path | Format | When |
-| --------------------------------------------------- | ------ | ---------------------------------------- |
-| `<workdir>/supabase/functions/<slug>/<remote path>` | bytes | for each source file returned by the API |
+| Path | Format | When |
+| --------------------------------------------------- | ------ | ----------------------------------------------------------------------- |
+| `<workdir>/supabase/functions/<slug>/<remote path>` | bytes | for each source file returned by the API |
+| `<workdir>/supabase/.temp/linked-project.json` | JSON | after resolving a project ref, cached on both success and failure paths |
+| `<SUPABASE_HOME or ~/.supabase>/telemetry.json` | JSON | after command completion, flushed on both success and failure paths |
 
 ## API Routes
 
-| Method | Path | Auth | Request body | Response (used fields) |
-| ------ | ------------------------------------------ | ------------ | ------------ | ------------------------------------------ |
-| `GET` | `/v1/projects/{ref}/functions` | Bearer token | none | function slugs, when downloading all |
-| `GET` | `/v1/projects/{ref}/functions/{slug}` | Bearer token | none | entrypoint path, when absent from metadata |
-| `GET` | `/v1/projects/{ref}/functions/{slug}/body` | Bearer token | none | multipart function source |
+| Method | Path | Auth | Request body | Response (used fields) |
+| ------ | ------------------------------------------ | ------------ | ------------ | ----------------------------------------------------- |
+| `GET` | `/v1/projects/{ref}/functions` | Bearer token | none | function slugs, when downloading all |
+| `GET` | `/v1/projects/{ref}/functions/{slug}` | Bearer token | none | entrypoint path, when absent from metadata |
+| `GET` | `/v1/projects/{ref}/functions/{slug}/body` | Bearer token | none | multipart function source |
+| `GET` | `/v1/projects` | Bearer token | none | project picker options when no ref is supplied in TTY |
+| `GET` | `/v1/projects/{ref}` | Bearer token | none | linked project metadata used by the post-run cache |
 
 ## Subprocesses
 
@@ -28,10 +36,14 @@
 
 ## Environment Variables
 
-| Variable | Purpose | Required? |
-| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (falls back to `~/.supabase/profile` -> `supabase`) |
+| Variable | Purpose | Required? |
+| ----------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `<SUPABASE_HOME or ~/.supabase>/access-token`) |
+| `SUPABASE_HOME` | overrides where `telemetry.json` and `profile` are read/written | no (defaults to `~/.supabase`) |
+| `SUPABASE_NO_KEYRING` | disables the OS keyring, forcing the access-token file fallback | no |
+| `SUPABASE_PROFILE` | select a built-in profile or YAML profile file with `api_url:` | no (falls back to `~/.supabase/profile` -> `supabase`) |
+| `SUPABASE_PROJECT_ID` | provides the project ref when `--project-ref` is unset | no (falls back to `<workdir>/supabase/.temp/project-ref`) |
+| `SUPABASE_WORKDIR` | sets `<workdir>` for local Supabase temp files | no (falls back to `--workdir` -> nearest ancestor with `supabase/config.toml` -> cwd) |
 
 ## Exit Codes
 
@@ -43,6 +55,12 @@
 | `1` | network / connection failure |
 | `1` | invalid function slug or flag conflict |
 
+## Telemetry Events Fired
+
+| Event | When | Notable properties / groups |
+| ---------------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `cli_command_executed` | post-run, success or failure (via wrapper) | `exit_code`, `duration_ms`, `flags` (`project-ref` recorded verbatim, matching `functions list`/`delete`; `use-api`/`use-docker`/`legacy-bundle` also recorded verbatim since they are boolean flags, matching Go's `isBooleanFlag` branch; no flag on this command is currently redacted) |
+
 ## Output
 
 ### `--output-format text` (Go CLI compatible)