@devdogsuga/devtools 0.1.50 → 0.1.51-next.526

package/dist/supabase-project-BoJKMCxL.js

@@ -0,0 +1,766 @@
+import { o as noteRan, r as findRepoRoot, t as RepoNotFoundError, u as cliName } from "./root-CsocfxnK.js";
+import { createRequire } from "node:module";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { execFile, execFileSync, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { pathToFileURL } from "node:url";
+//#region ../cli-core/src/dry-run.ts
+const DRY_RUN_FLAG = "--dry-run";
+/** Commands that forward everything after their name to another tool. */
+const FORWARDING = /* @__PURE__ */ new Set([
+	"supabase",
+	"wrangler",
+	"drizzle-kit",
+	"psql",
+	"bw",
+	"run"
+]);
+let active = false;
+function setDryRun(on) {
+	active = on;
+}
+function isDryRun() {
+	return active;
+}
+/**
+* Decides whether `argv` asks for a dry run and returns the argv to dispatch.
+*
+* For a forwarding command a leading `--dry-run` is consumed (the tool never
+* sees it) and a later one is the tool's. For any other command the argv is
+* returned as it came, because several commands read `--dry-run` themselves.
+*/
+function resolveDryRun(argv) {
+	const firstPositional = argv.findIndex((arg) => !arg.startsWith("-"));
+	const lead = firstPositional === -1 ? argv.length : firstPositional;
+	const command = argv[firstPositional];
+	if (command !== void 0 && FORWARDING.has(command)) {
+		const rest = argv.filter((arg, i) => i >= lead || arg !== "--dry-run");
+		return {
+			dryRun: rest.length !== argv.length,
+			rest
+		};
+	}
+	return {
+		dryRun: argv.includes(DRY_RUN_FLAG),
+		rest: [...argv]
+	};
+}
+/**
+* How a command treats `--dry-run`, from the nearest node on its path that
+* says. `undefined` means it did not say, and the dispatcher stops it.
+*/
+function dryRunKind(catalog, path) {
+	for (let end = path.length; end > 0; end -= 1) {
+		const kind = catalog.findCommand(path.slice(0, end))?.dryRun;
+		if (kind !== void 0) return kind;
+	}
+}
+/** The command line a stopped command would have run. */
+function wouldRunLine(argv) {
+	return `Would run: ${cliName()} ${argv.join(" ")}`;
+}
+//#endregion
+//#region ../cli-core/src/process-group.ts
+/**
+* Running a child tool so that stopping it stops everything it started.
+*
+* `pnpm run dev` forks a shell that forks vinext that forks workerd. Killing
+* only the pnpm process (what a plain `child.kill()` does, and what a closed
+* terminal tab or a `kill` from another window delivers) orphans the rest,
+* and the orphan keeps its port. So the child gets its own process group, and
+* every stop signal this process receives is sent to the whole group.
+*
+* Ctrl-C needs the same care in reverse: a child in its own group is not in
+* the terminal's foreground group, so the terminal no longer delivers ^C to
+* it. The signal handlers below forward it.
+*
+* The group is only swept after the direct child exits when that exit was a
+* signal we forwarded; a child that exits on its own is left to have cleaned
+* up after itself, so a tool that deliberately leaves a daemon running keeps it.
+*/
+const FORWARDED = [
+	"SIGINT",
+	"SIGTERM",
+	"SIGHUP"
+];
+const SIGNAL_NUMBERS = {
+	SIGHUP: 1,
+	SIGINT: 2,
+	SIGTERM: 15,
+	SIGKILL: 9
+};
+/** How long a group gets to leave after SIGTERM before SIGKILL. */
+const GRACE_MS = 5e3;
+/** Sends `signal` to every process in `pid`'s group. False if it is already gone. */
+function signalGroup(pid, signal) {
+	try {
+		process.kill(process.platform === "win32" ? pid : -pid, signal);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function runInGroup(command, args, opts = {}) {
+	if (isDryRun()) {
+		process.stderr.write(`Would run: ${formatCommand(command, args)}\n`);
+		return Promise.resolve({
+			code: 0,
+			signal: null
+		});
+	}
+	return new Promise((resolve) => {
+		const child = spawn(command, [...args], {
+			stdio: opts.stdio ?? "inherit",
+			cwd: opts.cwd,
+			env: opts.env,
+			detached: process.platform !== "win32"
+		});
+		const pid = child.pid;
+		let forwarded = null;
+		let escalation;
+		const forward = (signal) => {
+			if (pid === void 0) return;
+			forwarded ??= signal;
+			signalGroup(pid, signal);
+			escalation ??= setTimeout(() => signalGroup(pid, "SIGKILL"), GRACE_MS);
+			escalation.unref();
+		};
+		if (opts.abort?.aborted) forward("SIGTERM");
+		else opts.abort?.addEventListener("abort", () => forward("SIGTERM"), { once: true });
+		const handlers = FORWARDED.map((signal) => {
+			const handler = () => forward(signal);
+			process.on(signal, handler);
+			return [signal, handler];
+		});
+		const onExit = () => {
+			if (pid !== void 0) signalGroup(pid, "SIGKILL");
+		};
+		process.on("exit", onExit);
+		const finish = (result) => {
+			noteRan(`${formatCommand(command, args)}  (exit ${result.code})`);
+			for (const [signal, handler] of handlers) process.off(signal, handler);
+			process.off("exit", onExit);
+			if (escalation) clearTimeout(escalation);
+			if (forwarded !== null && pid !== void 0) signalGroup(pid, "SIGKILL");
+			resolve(result);
+		};
+		child.on("error", (error) => {
+			process.stderr.write(`${error.message}\n`);
+			finish({
+				code: 1,
+				signal: null
+			});
+		});
+		child.on("exit", (code, signal) => {
+			const bySignal = signal ? 128 + (SIGNAL_NUMBERS[signal] ?? 0) : 1;
+			finish({
+				code: code ?? bySignal,
+				signal
+			});
+		});
+	});
+}
+const URL_CREDENTIALS = /\/\/[^/@\s]*@/;
+/**
+* The command as a person would type it, for printing. A database URL carries
+* its password, so the value after `--db-url` (and any URL with credentials)
+* is replaced rather than echoed.
+*/
+function formatCommand(command, args) {
+	const shown = [];
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i];
+		if (arg === "--db-url" && i + 1 < args.length) {
+			shown.push(arg, "<DB_URL>");
+			i += 1;
+		} else if (arg.startsWith("--db-url=")) shown.push("--db-url=<DB_URL>");
+		else shown.push(arg.replace(URL_CREDENTIALS, "//***@"));
+	}
+	return [command, ...shown].map((part) => /^[\w@%+=:,./<>*-]+$/.test(part) ? part : JSON.stringify(part)).join(" ");
+}
+/**
+* Prints the exact command that ran, AFTER it ran so the tool's own output
+* cannot bury it. On stderr, so a tool whose stdout is a pipe stays clean.
+*/
+function reportRan(command, args, result) {
+	if (isDryRun()) return;
+	const status = result.code === 0 ? "" : `  (exit ${result.code})`;
+	process.stderr.write(`Ran: ${formatCommand(command, args)}${status}\n`);
+}
+/** The directory (relative to a Backstage root) holding the DevDogsUGA checkout. */
+const DEVDOGSUGA_LINK = "devdogsuga";
+var DevdogsugaMissingError = class extends Error {
+	constructor(path) {
+		super(`The DevDogsUGA checkout is missing at ${path}. Run \`pnpm devdogsuga\` (links the sibling clone, or \$DEVDOGSUGA_DIR) or \`pnpm install\` in the Backstage root first.`);
+		this.name = "DevdogsugaMissingError";
+	}
+};
+/** The kind of repo `dir` is the root of, by its `package.json` name; null if neither. */
+function repoKindOf(dir) {
+	try {
+		const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+		if (pkg.name === "devdogs-monorepo") return "devdogsuga";
+		if (pkg.name === "backstage") return "backstage";
+	} catch {}
+	return null;
+}
+function isDir(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/**
+* The layout of the repo rooted at `root`. Pure: nothing is memoized, so tests
+* can build fixtures freely. An unrecognised package name is treated as
+* DevDogsUGA (the contract fixtures and every pre-Backstage caller).
+*/
+function layoutAt(root) {
+	const kind = repoKindOf(root) === "backstage" ? "backstage" : "devdogsuga";
+	const sibling = join(root, DEVDOGSUGA_LINK);
+	const hasDevdogsuga = kind === "devdogsuga" || isDir(sibling);
+	const devdogsugaRoot = kind === "devdogsuga" ? root : sibling;
+	const appsDirs = [join(root, "apps")];
+	if (kind === "backstage" && hasDevdogsuga) appsDirs.push(join(devdogsugaRoot, "apps"));
+	return {
+		kind,
+		root,
+		get devdogsugaRoot() {
+			if (!hasDevdogsuga) throw new DevdogsugaMissingError(sibling);
+			return devdogsugaRoot;
+		},
+		...kind === "backstage" ? { backstageRoot: root } : {},
+		hasDevdogsuga,
+		appsDirs: appsDirs.filter(isDir),
+		envMirrors: kind === "backstage" && hasDevdogsuga ? [devdogsugaRoot] : []
+	};
+}
+/** `layout.devdogsugaRoot`, or null instead of a throw when the checkout is missing. */
+function devdogsugaRootOrNull(layout) {
+	return layout.hasDevdogsuga ? layout.devdogsugaRoot : null;
+}
+let cached;
+let cachedFor;
+/** The layout of the repo the process is in (`findRepoRoot()`), memoized per root. */
+function resolveLayout() {
+	const root = findRepoRoot();
+	if (cached === void 0 || cachedFor !== root) {
+		cached = layoutAt(root);
+		cachedFor = root;
+	}
+	return cached;
+}
+/** Every directory under `appsDirs` (one app each), de-duplicated by name, sorted by name. */
+function listApps(layout = resolveLayout()) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const parent of layout.appsDirs) for (const entry of readdirSync(parent, { withFileTypes: true })) {
+		if (!entry.isDirectory()) continue;
+		if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
+		if (!seen.has(entry.name)) seen.set(entry.name, {
+			name: entry.name,
+			dir: join(parent, entry.name)
+		});
+	}
+	return [...seen.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/** The directory of the app called `name`, or undefined when no repo has it. */
+function findApp(name, layout = resolveLayout()) {
+	return listApps(layout).find((app) => app.name === name)?.dir;
+}
+/**
+* Resolves a workspace-relative path such as `workers.json`'s
+* `apps/schedule-builder` to a directory: the repo you are in first, then
+* DevDogsUGA's. When neither has it the first candidate is returned, so
+* callers get an ordinary ENOENT naming the path rather than a second error.
+*/
+function resolveAppPath(relative, layout = resolveLayout()) {
+	const first = join(layout.root, relative);
+	if (existsSync(first)) return first;
+	if (layout.kind === "backstage" && layout.hasDevdogsuga) {
+		const second = join(layout.devdogsugaRoot, relative);
+		if (existsSync(second)) return second;
+	}
+	return first;
+}
+/**
+* The pnpm workspace root holding the app called `name`: where
+* `pnpm --filter <name>` has to run. DevDogsUGA's root for its apps seen from a
+* Backstage checkout, `layout.root` otherwise.
+*/
+function appWorkspaceRoot(name, layout = resolveLayout()) {
+	const dir = findApp(name, layout);
+	return dir === void 0 ? layout.root : dirname(dirname(dir));
+}
+//#endregion
+//#region ../cli-core/src/repo/resolve.ts
+/**
+* Resolves an `@devdogsuga/*` package FROM the target repo, not from
+* devtools' own (dlx-isolated) `node_modules`.
+*
+* Ported from the `devtools-dlx` prototype
+* (`/home/sloan/scratchpad/devdogs/prototypes/devtools-dlx/FINDINGS.md`,
+* experiments 2 and 4 — read that file for the two gotchas this module
+* exists to avoid). The short version:
+*
+*   - `require.resolve(\`${specifier}/package.json\`)` throws
+*     `ERR_PACKAGE_PATH_NOT_EXPORTED` on packages (like `@devdogsuga/env`,
+*     `@devdogsuga/open-graph`) whose `exports` map does not list
+*     `"./package.json"`, even though the file is on disk.
+*   - A resolved path cannot be assumed to contain a literal
+*     `node_modules/<specifier>` segment — pnpm workspace-linked packages
+*     resolve to their REALPATH (e.g. `packages/open-graph/dist/index.js`),
+*     which has no such segment at all.
+*   - `require.resolve` ignores whatever `conditions` a caller has set on
+*     `tsx`'s `register()` — condition-based resolution (the
+*     `devdogs-source` condition) has to be done by hand, reading the
+*     target package's own `exports["."]` map.
+*
+* Both problems are solved the same way: walk up from the resolved file's
+* directory to the nearest `package.json` whose own `"name"` field matches
+* the specifier. That works for a real installed dependency AND a
+* workspace symlink, uniformly.
+*/
+/**
+* The installable package name a (possibly subpath) specifier belongs to:
+* `@devdogsuga/env/load` → `@devdogsuga/env`, `foo/bar` → `foo`. A repo's
+* package.json declares the PACKAGE as a dependency, never a subpath, so
+* `findDependent` has to search on this rather than the literal specifier a
+* caller wants to import.
+*/
+function packageNameOf(specifier) {
+	const parts = specifier.split("/");
+	return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+}
+/**
+* Scans `apps/*` and `packages/*` under `repoRoot` for the first
+* `package.json` whose `dependencies`/`devDependencies`/`peerDependencies`
+* names `specifier`'s package (see `packageNameOf`). Returns its path
+* relative to `repoRoot`, or `null` if nothing in the repo depends on it.
+*
+* Re-scans the filesystem on every call — fine for a short-lived CLI
+* invocation calling this a handful of times; see FINDINGS item 5 if this
+* is ever called in a hot loop.
+*/
+function findDependent(repoRoot, specifier) {
+	const packageName = packageNameOf(specifier);
+	for (const group of ["apps", "packages"]) {
+		const groupDir = join(repoRoot, group);
+		let entries;
+		try {
+			entries = readdirSync(groupDir);
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			const pkgJsonPath = join(groupDir, entry, "package.json");
+			if (!existsSync(pkgJsonPath)) continue;
+			let pkg;
+			try {
+				pkg = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+			} catch {
+				continue;
+			}
+			if (packageName in {
+				...pkg.dependencies,
+				...pkg.devDependencies,
+				...pkg.peerDependencies
+			}) return join(group, entry, "package.json");
+		}
+	}
+	return null;
+}
+/** Walks up from `startDir` to the nearest `package.json` whose `"name"` matches `specifier`. */
+function findOwningPackageJson(startDir, specifier) {
+	const packageName = packageNameOf(specifier);
+	let dir = startDir;
+	for (;;) {
+		const candidate = join(dir, "package.json");
+		if (existsSync(candidate)) try {
+			if (JSON.parse(readFileSync(candidate, "utf8")).name === packageName) return candidate;
+		} catch {}
+		const parent = dirname(dir);
+		if (parent === dir) throw new Error(`resolveFromRepo: could not find ${specifier}'s own package.json by walking up from ${startDir}`);
+		dir = parent;
+	}
+}
+/**
+* Resolves `specifier` as `resolutionBase` (a workspace-relative
+* `package.json` path known to depend on it, from `findDependent()`) would
+* see it.
+*
+* `opts.condition`, when given, is NOT passed through to Node's resolver —
+* `require.resolve` ignores tsx's `register({ conditions })` entirely (see
+* this module's header). Instead the target package's own
+* `exports["."]` map is read directly and `exports["."][condition]` is
+* picked, falling back to `.default`.
+*/
+function resolveFromRepo(repoRoot, resolutionBase, specifier, opts) {
+	const baseFile = join(repoRoot, resolutionBase);
+	const require = createRequire(baseFile);
+	let resolvedPath;
+	if (opts?.condition) {
+		const defaultEntry = require.resolve(specifier);
+		const pkgJsonPath = findOwningPackageJson(dirname(defaultEntry), specifier);
+		const rootExport = JSON.parse(readFileSync(pkgJsonPath, "utf8")).exports?.["."];
+		const conditioned = rootExport && typeof rootExport === "object" ? rootExport[opts.condition] ?? rootExport.default : void 0;
+		if (typeof conditioned !== "string") throw new Error(`resolveFromRepo: ${specifier} has no "${opts.condition}" (or "default") export in its exports["."] map`);
+		resolvedPath = join(dirname(pkgJsonPath), conditioned);
+	} else resolvedPath = require.resolve(specifier);
+	const pkgJsonPath = findOwningPackageJson(dirname(resolvedPath), specifier);
+	const pkg = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+	return {
+		resolvedPath,
+		version: pkg.version ?? "0.0.0",
+		pkgJsonPath
+	};
+}
+//#endregion
+//#region ../cli-core/src/repo/peers.ts
+/**
+* Loads devtools' optional-peer `@devdogsuga/*` libraries — the ones
+* published to npm and consumed by the TARGET repo, which devtools reads at
+* runtime rather than bundling its own copy of (see this package's
+* `package.json`: `peerDependencies` + `peerDependenciesMeta.optional`, and
+* `FINDINGS.md` experiment 2).
+*
+* Every export here is memoized per module (one dynamic `import()` per
+* process, not per call) — this is what makes the module-identity guarantee
+* in FINDINGS experiment 3 hold: every devtools call site that needs
+* `@devdogsuga/sdk/env`'s registry gets the exact same module instance the
+* repo's own manifests populated via `declare()`/`define()`, because both
+* resolve to the identical absolute file path and Node's ESM cache is keyed
+* by resolved URL.
+*/
+const moduleCache = /* @__PURE__ */ new Map();
+/** The file URL each peer resolved to through the target repo, set only on
+*  that path (not on either plain bare-specifier fallback). See
+*  `repoPeerUrl()`. */
+const resolvedUrls = /* @__PURE__ */ new Map();
+/**
+* Dynamically imports `specifier` as the repo would resolve it, memoized so
+* repeated calls in one process return the SAME module instance (required
+* for the env-registry identity guarantee above).
+*
+* Falls back to a plain bare-specifier `import()` when devtools is not
+* running inside a DevDogsUGA checkout at all (`findRepoRoot()` throws
+* `RepoNotFoundError`). That is not a production affordance — under real
+* `pnpm dlx` use, `specifier` is an optional peer devtools' own package
+* never installs, so the fallback import fails with the ordinary
+* `MODULE_NOT_FOUND` either way. It exists so devtools' OWN test suite
+* (which has no target repo to discover, but does have every one of these
+* peers as a real Backstage workspace package) exercises this code against
+* the genuine package rather than needing every test to mock this module.
+*/
+function loadPeer(specifier) {
+	const cached = moduleCache.get(specifier);
+	if (cached) return cached;
+	const promise = (async () => {
+		if (process.env.DEVTOOLS_TEST_REPO_ROOT) return import(specifier);
+		let repoRoot;
+		try {
+			repoRoot = findRepoRoot();
+		} catch (err) {
+			if (err instanceof RepoNotFoundError) return import(specifier);
+			throw err;
+		}
+		const resolutionBase = findDependent(repoRoot, specifier);
+		if (!resolutionBase) throw new Error(`Nothing in this repo depends on ${specifier} — expected an app or package under apps/* or packages/* to declare it (dependencies/devDependencies/peerDependencies).`);
+		const { resolvedPath } = resolveFromRepo(repoRoot, resolutionBase, specifier);
+		const url = pathToFileURL(resolvedPath).href;
+		resolvedUrls.set(specifier, url);
+		return import(url);
+	})();
+	moduleCache.set(specifier, promise);
+	return promise;
+}
+/**
+* The file URL `specifier` was loaded from through the target repo, or
+* undefined if it has not been loaded yet or came from a plain bare-specifier
+* `import()` (the test-suite and not-in-a-repo fallbacks above).
+*
+* For code devtools imports that itself names a peer by bare specifier --
+* today only devtools' own `env.ts` manifest. From an installed copy that
+* specifier cannot resolve at all (an optional peer is never installed next
+* to devtools under `pnpm dlx`), and even where it can, the only copy that
+* keeps module identity is this one. `repo/peer-redirect.ts` uses it to
+* point the import here.
+*/
+function repoPeerUrl(specifier) {
+	return resolvedUrls.get(specifier);
+}
+let resolvedEnvModule;
+function loadEnv() {
+	return loadPeer("@devdogsuga/sdk/env").then((mod) => {
+		resolvedEnvModule = mod;
+		return mod;
+	});
+}
+/**
+* The synchronous companion to `loadEnv()`, for the handful of call sites
+* (`gh/environments.ts`'s `GITHUB_ENVIRONMENT_SPECS` getters) that cannot
+* become async without changing their own callers' contract — they read a
+* plain array off a getter, not a Promise. Safe ONLY after `loadEnv()` has
+* resolved at least once; every caller of these getters already requires
+* `env/discovery.ts`'s `loadRegistry()` (which calls `loadEnv()` itself) to
+* have run first, via `assertRegistryLoaded()`'s own guard.
+*/
+function getEnvSync() {
+	if (!resolvedEnvModule) throw new Error("getEnvSync() called before loadEnv() ever resolved — call loadRegistry() (env/discovery.ts) first.");
+	return resolvedEnvModule;
+}
+/** The env loader (`loadEnvironment` and the tier/file selection). Bundled. */
+function loadEnvLoad() {
+	return import("./load-Czhayrsk.js");
+}
+/** The session policy (tier resolution, `enterEnvironment`). Bundled. */
+function loadEnvSession() {
+	return import("./session-CmDxHEMn.js");
+}
+//#endregion
+//#region ../cli-core/src/db/run.ts
+/**
+* Shared helpers for running supabase CLI and pnpm commands.
+*
+* The supabase CLI is a workspace devDependency (not a global install), so
+* every invocation goes through `pnpm exec supabase`. Plain pnpm commands run
+* in `findRepoRoot()`; the supabase ones run in DevDogsUGA's root
+* (`supabaseRoot()`), where `supabase/config.toml` lives and where the CLI is
+* installed. From a Backstage checkout that is `<root>/devdogsuga`, so it needs
+* its own `pnpm install` there before any of these work.
+*/
+const runFile = promisify(execFile);
+/** Where `supabase/` lives, and so the cwd of every supabase CLI call. */
+function supabaseRoot() {
+	return resolveLayout().devdogsugaRoot;
+}
+/** Spawn a pnpm command with inherited stdio; resolves to the exit code. Pass
+* `env` to run the child against a loaded tier rather than process.env. The
+* child runs in its own process group, so stopping this process stops
+* whatever it started (see `process-group.ts`). */
+async function run(args, env, cwd = findRepoRoot()) {
+	const result = await runInGroup("pnpm", args, {
+		cwd,
+		...env ? { env } : {}
+	});
+	if (reporting) reportRan("pnpm", args, result);
+	return result.code;
+}
+let reporting = false;
+/**
+* Makes every `run()` after this print the exact command it ran (on stderr,
+* after it finishes). Off by default, so a deploy log or a piped command is
+* not changed under its caller; the presets turn it on because showing the
+* tool calls behind a button is their whole point.
+*/
+function reportRuns(enabled) {
+	reporting = enabled;
+}
+/** Spawn a pnpm command while echoing and retaining stderr for diagnostics.
+* Pass `env` to run the child against a loaded tier rather than process.env. */
+function runWithStderr(args, env, cwd = findRepoRoot()) {
+	return new Promise((resolve) => {
+		const child = spawn("pnpm", args, {
+			stdio: [
+				"inherit",
+				"inherit",
+				"pipe"
+			],
+			cwd,
+			...env ? { env } : {}
+		});
+		let stderr = "";
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+			process.stderr.write(chunk);
+		});
+		child.on("error", (error) => {
+			const message = `${error.message}\n`;
+			stderr += message;
+			process.stderr.write(message);
+			resolve({
+				code: 1,
+				stderr
+			});
+		});
+		child.on("exit", (code) => resolve({
+			code: code ?? 1,
+			stderr
+		}));
+	});
+}
+/** Spawn a pnpm command, capture stdout, throw on non-zero exit. */
+async function capture(args, cwd = findRepoRoot()) {
+	const { stdout } = await runFile("pnpm", args, {
+		cwd,
+		encoding: "utf8"
+	});
+	return stdout;
+}
+/** `pnpm exec supabase …` with inherited stdio. */
+const supabase = (...args) => run([
+	"exec",
+	"supabase",
+	...args
+], void 0, supabaseRoot());
+/** `pnpm exec supabase …` with captured stdout. */
+const supabaseCapture = (...args) => capture([
+	"exec",
+	"supabase",
+	...args
+], supabaseRoot());
+/**
+* `supabase db push` over `dbUrl`, inherited stdio, resolving to the exit code.
+*
+* The one spelling of the migration push, shared by the contributor `db
+* migrate` path (`stack.ts`'s `pushMigrations`) and CI's `deploy migrate`.
+* `--yes` is the unattended apply CI wants; the contributor path omits it so a
+* human still confirms. `includeSeed` adds the `[db.seed]` files, which the
+* CLI runs once each and records in `supabase_migrations.seed_files`. Neither variant regenerates types — that is
+* `pushMigrations`' own second step, layered on top only where a checkout is
+* meant to be rewritten. A CI apply must NOT write back into the repo, which is
+* exactly why the bare push is factored out here rather than reused whole.
+*/
+function dbPush(dbUrl, opts = {}) {
+	const args = [
+		"db",
+		"push",
+		"--db-url",
+		dbUrl
+	];
+	if (opts.includeSeed) args.push("--include-seed");
+	if (opts.yes) args.push("--yes");
+	return supabase(...args);
+}
+/** Seed storage buckets on the local stack or a resolved tier's project. */
+async function seedBuckets(conn) {
+	if (conn.kind === "local") return supabase("seed", "buckets", "--local", "--yes");
+	if (!conn.projectRef) {
+		process.stderr.write("devtools db: seed buckets against a hosted project needs PROJECT_REF in the session's env file.\n");
+		return 1;
+	}
+	return supabase("seed", "buckets", "--project-ref", conn.projectRef, "--linked");
+}
+//#endregion
+//#region ../cli-core/src/repo/supabase-project.ts
+/**
+* This repo's Supabase project id — read from `supabase/config.toml` — and
+* the container-name conventions the Supabase CLI derives from it.
+*
+* Shared by `environment.ts`'s adaptive-menu probe (does a stack answer for
+* THIS project?) and the foreign-stack detection in `db/generated-env.ts`
+* and `stack.ts` (does a DIFFERENT project's stack hold the shared ports? —
+* the case where `supabase status -o env` fails not because nothing is
+* running, but because what is running on 127.0.0.1:54321 belongs to
+* another workspace, or to this same repo before/after a `project_id`
+* rename). One project-id reader and one container-name parser, so both
+* questions agree on what "this project" means.
+*/
+/**
+* Reads `project_id` out of `<repoRoot>/supabase/config.toml`, or `null`
+* when the file is missing or unparsable.
+*
+* Regex, not a TOML parser: it is one line, the shape has been stable
+* across every CLI version this repo has seen, and a parser on a path some
+* callers pay before their first real subprocess is a cost that stays
+* invisible until it is why the tool feels slow.
+*/
+function readProjectId(repoRoot) {
+	try {
+		const path = join(repoRoot, "supabase", "config.toml");
+		return /^\s*project_id\s*=\s*"([^"]+)"/m.exec(readFileSync(path, "utf8"))?.[1] ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The Supabase CLI's container name prefix for a project id, or the bare
+* `supabase_db_` fallback when the id could not be read.
+*
+* Falling back to the bare prefix means a machine whose `config.toml`
+* cannot be read still detects *a* stack, at the cost of over-matching a
+* differently-named project — deliberate, and unchanged from this
+* function's original home in `environment.ts`: over-matching offers
+* `stop`/a foreign-stack hint for a stack that turns out to be this
+* project's own, which is harmless to see and decline, while
+* under-matching hides a real signal entirely.
+*/
+function containerPrefix(projectId) {
+	return projectId ? `supabase_db_${projectId}` : "supabase_db_";
+}
+/**
+* The local stack's API port, published by its Kong container. Mirrors
+* `env-runtime/load`'s `LOCAL_STACK_PORT`, which this module cannot import
+* statically (that package is an optional peer, loaded on demand).
+*/
+const STACK_API_PORT = 54321;
+function defaultExec(file, args) {
+	try {
+		return execFileSync(file, args, {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 3e3
+		});
+	} catch {
+		return null;
+	}
+}
+/**
+* `docker ps --format '{{.Names}}'`, split into trimmed, non-empty names —
+* or `null` when Docker could not be read at all (no daemon, not
+* installed, timed out). With `publish`, only the containers publishing that
+* host port. `execute` is injectable for tests, mirroring `environment.ts`'s
+* own probes.
+*/
+function listContainerNames(publish, execute = defaultExec) {
+	const out = execute("docker", [
+		"ps",
+		...publish === void 0 ? [] : ["--filter", `publish=${publish}`],
+		"--format",
+		"{{.Names}}"
+	]);
+	if (out === null) return null;
+	return out.split("\n").map((name) => name.trim()).filter((name) => name.length > 0);
+}
+/**
+* Finds the `supabase_kong_<id>` container among `names` whose id differs
+* from `projectId` — the signature of a stack started from a DIFFERENT
+* Supabase project (this same repo before/after a rename, or another
+* project entirely) holding the shared ports. Kong is the container that
+* publishes the API port, so callers pass the names `listContainerNames`
+* returns for `STACK_API_PORT`: that names the stack actually on 54321,
+* not just any Supabase stack on the machine.
+*
+* Returns that foreign id, or `null` when every matching container belongs
+* to this project, none match at all, or `projectId` itself could not be
+* read — with no known id of our own, there is nothing to compare against,
+* and guessing would risk telling a contributor their OWN stack is
+* foreign.
+*/
+function foreignStackProjectId(names, projectId) {
+	if (projectId === null) return null;
+	for (const name of names) {
+		const match = /^supabase_kong_(.+)$/.exec(name);
+		if (!match) continue;
+		const id = match[1];
+		if (id !== projectId) return id;
+	}
+	return null;
+}
+/**
+* The actionable message for a detected foreign stack — shared by
+* `db/generated-env.ts` (a failed `supabase status -o env`) and `stack.ts`
+* (a failed `supabase start`), so both name the same fix in the same
+* words.
+*/
+function foreignStackMessage(foreignProjectId) {
+	return `The stack on port ${STACK_API_PORT} belongs to project "${foreignProjectId}", not this checkout's. Stop it with \`supabase stop --project-id ${foreignProjectId}\` then \`pnpm devtools supabase start\`.`;
+}
+//#endregion
+export { dryRunKind as A, layoutAt as C, formatCommand as D, resolveLayout as E, resolveDryRun as M, setDryRun as N, reportRan as O, wouldRunLine as P, findApp as S, resolveAppPath as T, loadEnvLoad as _, listContainerNames as a, appWorkspaceRoot as b, reportRuns as c, seedBuckets as d, supabase as f, loadEnv as g, getEnvSync as h, foreignStackProjectId as i, isDryRun as j, runInGroup as k, run as l, supabaseRoot as m, containerPrefix as n, readProjectId as o, supabaseCapture as p, foreignStackMessage as r, dbPush as s, STACK_API_PORT as t, runWithStderr as u, loadEnvSession as v, listApps as w, devdogsugaRootOrNull as x, repoPeerUrl as y };