[Prashansa-K]

Maps gen types, gen signing-key and gen bearer-jwt to the Management API operations they call, so a scoped access token can be granted per command. gen keys stays pending.

gen types picks its target from flag values, so it declares flag conditions instead of a database target: --local, --db-url and --postgrest-v9-compat turn every call off. TypeScript calls the types endpoint. Other languages look the project up, fall back to the preview branch config on a 404, and reach the database through the database config resolver (login role, pooler config) and the pooler retry. The project picker and the linked-project cache fill are declared too. signing-key and bearer-jwt make no calls.

Shared block change: a target-free dbConfigPoolerFallbackLinked for commands that choose their target from flag values (dbConfigPoolerFallback is built from the same entries), and the first fallback context is reworded to fit every command. Dump, pull and the db-config tests are unchanged.

gen types runs through the real database config resolver and linked-project cache with the Management API recorded, for the TypeScript, pooler, IPv6 retry, preview branch, picker, --local=false and --db-url paths. On this command the pooler, login-role and network-ban calls are each declared by more than one source, so removing one source alone is not caught by a test; the grants are per operation either way. No operations without FGA permissions. Only typescript and go run through the recording mocks.

🤖 Generated with Claude Code

[github-actions]

🤖 AI Review

Both independent reviews completed and reported zero findings. Inspection of the changed code, surrounding handlers and shared layers found no additional actionable issues or fundamental conflicts with the supplied next-branch context. Tests were not run.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[avallete]

Approving: the gen types declarations match the calls on every path (local, db-url, v9-compat, TypeScript vs other languages, preview-branch fallback, interactive picker). signing-key and bearer-jwt are correctly API-free. Tests, typecheck and lint pass. On staging, gen types (ts and go) made only declared calls, and signing-key/bearer-jwt made none without a token.

Optional nits:

• types.integration.test.ts: the test named for --local=false produces the same active flags as passing no flag, so the drift check can't tell them apart. Consider dropping the flag and renaming it to the no-target-flag case.
• The three "makes no Management API request" tests (--local, --db-url, --postgrest-v9-compat) could be one it.each.
• gen types inherits two pooler entries keyed on --project-ref, which it doesn't have. They never apply today, but a future docs generator could list them.