fix(cli): skip provisioned ledger ddl (CLI-2275)

[7ttp]

TL;DR

stop sending the migration ledger DDL to remotes that already have the ledger, which is the traffic the Supavisor session pooler kills...

what's biting?

migration repair dies with a connection error over the session pooler while migration list works on the same connection. every history command runs the seven statement ledger setup transaction on every invocation, even when the ledger already exists, and that DDL is what the pooler drops. list only sends a SELECT.

now fixed by:

a read-only probe with the same wire shape as the list SELECT.
ledger fully there: no DDL is sent. anything less, or any odd probe answer: the full unchanged DDL runs, so ledger upgrades behave exactly as before. covers the history and seed ledgers...

ref:

• closes: migration repair fails over Supavisor Session Pooler while migration list succeeds #6393

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@32b40e4e8db92103f31c3d40f83be6a3cb5ff40d

Preview package for commit 32b40e4.

[github-actions]

🤖 AI Review

Six distinct findings were reviewed. The probe-error regression is confirmed as a minor concern, along with two documentation/convention nits. The alleged lack of live PostgreSQL coverage is refuted by the existing migration-up live test, and the interpolation and system-column findings have no current correctness or security impact because the helper is private and receives fixed literals.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/legacy/shared/legacy-migration-history.ts:99	error-handling	claude	A failure of the newly added provisioning query aborts commands instead of falling back to the previous DDL path, introducing a new failure point before ledger setup.
⚪ NIT	apps/cli/src/legacy/shared/legacy-migration-history.unit.test.ts:300	repo-conventions	codex	The new test name describes expected behavior as “Go-ordered,” contrary to the repository's convention that the legacy TypeScript implementation is authoritative and behavior should be described in its own terms.
⚪ NIT	apps/cli/src/legacy/shared/legacy-migration-history.ts:21	documentation	claude	The module header says its SQL is verbatim from Go even though the newly added provisioning query is TypeScript-specific.

Findings outside the diff

• ⚪ NIT apps/cli/src/legacy/shared/legacy-migration-history.ts:21 — The module header says its SQL is verbatim from Go even though the newly added provisioning query is TypeScript-specific.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/legacy/shared/legacy-migration-history.unit.test.ts:256 (test-coverage): The provisioning query is never exercised against a real PostgreSQL server, leaving its syntax and returned boolean representation unverified.
  Refuted: The live migration-up test supplies a pending migration at lines 45-51. up.handler.ts:136-144 calls legacyApplyMigrationFile, which calls legacyCreateMigrationTable at legacy-migration-apply.ts:831. Consequently, the new query is executed by a real PostgreSQL-backed suite and its result must be decoded successfully for the command to pass.
• apps/cli/src/legacy/shared/legacy-migration-history.ts:87 (security): The probe factory interpolates relation and column names without escaping, creating a potential SQL-injection hazard for a future dynamic caller.
  Refuted: There is no current injection path: the factory is unexported, both call sites are adjacent and pass compile-time literals, and the comment at lines 84-85 explicitly records that constraint. The finding is hypothetical future hardening rather than a defect in this change.
• apps/cli/src/legacy/shared/legacy-migration-history.ts:88 (correctness): The catalog query lacks a.attnum > 0, so PostgreSQL system attributes could be counted as provisioned columns.
  Refuted: None of PostgreSQL's system attributes has any of the five fixed requested names, so a system attribute cannot contribute to either count. The omitted conventional predicate cannot cause a false positive for the actual call sites.

Stats

Claude findings: 5 · Codex findings: 1 · Confirmed: 3 · Refuted: 3 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.