@devdogsuga/devtools 0.1.50 → 0.1.51-next.527

package/dist/{cli-t3gWyy3w.js → cli-D4LUUxUR.js}

@@ -1,21 +1,19 @@
-import { a as cliName, d as positionals, u as flagValue } from "./failure-log-DOt6E3hS.js";
-import { C as helpPath, S as catalog, T as renderHelp, _ as bail, a as recordEnteredTier, b as explainError, c as describeEnvironment, d as resolveDbConnection, f as sessionIsLocal, i as beginInvocation, l as probeEnvironment, n as bareGroupStartPath, o as recordResolved, p as sessionLabel, r as runMenu, s as reproducibleCommand, t as bareGroupStartFlags, u as nonEmpty, v as errorMessage, w as renderCommandList, x as unwrap, y as explain } from "./menu-DYQ-Dd-O.js";
-import { S as wouldRunLine, _ as runInGroup, c as reportRuns, f as supabase, g as reportRan, l as run$1, m as supabaseRoot, s as dbPush, u as runWithStderr, v as dryRunKind, y as isDryRun } from "./supabase-project-C93xRFkN.js";
-import { a as ownVersion, n as discoverRepoRoot, r as findRepoRoot } from "./root-CjPWNkBu.js";
-import { c as devdogsugaRootOrNull, d as listApps, f as resolveAppPath, i as loadEnvSession, l as findApp, n as loadEnv, p as resolveLayout, r as loadEnvLoad, s as appWorkspaceRoot, t as getEnvSync, u as layoutAt } from "./peers-DvUH5VxX.js";
-import { d as hasYes, f as isNonInteractive, n as captureDevtoolsError, o as initDevtoolsTelemetry, r as devtoolsEnvironment, t as captureDevtoolsDeprecation } from "./telemetry-C07-ioHm.js";
-import { n as assertRegistryLoaded, r as loadRegistry, t as scopedProcessEnv } from "./local-env-BuHU5Ckd.js";
-import { t as runStackCommand } from "./stack-C_50FafG.js";
-import { cancel, confirm, intro, isCancel, log, multiselect, note, outro, password, select, spinner, text } from "@clack/prompts";
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { c as ownPackageDir, g as positionals, h as flagValue, l as ownVersion, n as discoverRepoRoot, r as findRepoRoot, u as cliName } from "./root-CsocfxnK.js";
+import { A as renderCommandList, C as currentProduct, E as isProductMode, O as catalog, S as ProductConfigError, T as activeCatalog, _ as bail, a as recordEnteredTier, b as explainError, c as describeEnvironment, d as resolveDbConnection, f as sessionIsLocal, i as beginInvocation, j as renderHelp, k as helpPath, l as probeEnvironment, n as bareGroupStartPath, o as recordResolved, p as sessionLabel, r as runMenu, s as reproducibleCommand, t as bareGroupStartFlags, u as nonEmpty, v as errorMessage, x as unwrap, y as explain } from "./menu-DjE4EZKO.js";
+import { A as dryRunKind, C as layoutAt, E as resolveLayout, O as reportRan, P as wouldRunLine, S as findApp, T as resolveAppPath, _ as loadEnvLoad, b as appWorkspaceRoot, c as reportRuns, f as supabase, g as loadEnv, h as getEnvSync, j as isDryRun, k as runInGroup, l as run$1, m as supabaseRoot, s as dbPush, u as runWithStderr, v as loadEnvSession, w as listApps, x as devdogsugaRootOrNull, y as repoPeerUrl } from "./supabase-project-BoJKMCxL.js";
+import { d as hasYes, f as isNonInteractive, n as captureDevtoolsError, o as initDevtoolsTelemetry } from "./telemetry-BKFDtzXI.js";
+import { t as runStackCommand } from "./stack-7Lbym6Wq.js";
+import { register } from "node:module";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { z } from "zod";
+import { confirm, intro, log, multiselect, note, outro, password, select, spinner, text } from "@clack/prompts";
 import { chmod, readFile, writeFile } from "node:fs/promises";
-import { basename, dirname, join, resolve } from "node:path";
-import { execFile, execFileSync, spawn } from "node:child_process";
+import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { parse } from "dotenv";
 import postgres from "postgres";
 import { flattenDiagnosticMessageText, parseConfigFileTextToJson } from "typescript";
-import { z } from "zod";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { createServer } from "node:net";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -33,6 +31,296 @@ import { createServer as createServer$1 } from "node:http";
 /** The `outro()` line for a command that finished. */
 const DONE = "Done.";
 //#endregion
+//#region ../cli-core/src/repo/peer-redirect.ts
+/**
+* Points one module's bare import of a peer at the copy the target repo
+* resolved (`repo/peers.ts`).
+*
+* devtools' own `env.ts` manifest imports `@devdogsuga/sdk/env` by bare
+* specifier, and from an installed copy that specifier resolves relative to
+* the manifest's own location: inside the pnpm store, next to devtools,
+* where an optional peer is never installed under `pnpm dlx`. The import
+* failed with ERR_MODULE_NOT_FOUND, and every `env` command with it. Even
+* where the specifier does resolve (devtools installed as a devDependency),
+* the only copy that keeps the registry's module identity is the one the
+* repo's manifests use, so the redirect is applied whenever that copy is
+* known rather than only as a fallback.
+*
+* Node resolve hooks (`module.register`) rather than rewriting the file: the
+* manifest also imports `zod`, which has to keep resolving from devtools'
+* own location, and a copy written anywhere else would lose that.
+*/
+/** `redirectPeer` for several at once: the hooks keep one table per
+*  registration, so everything that needs redirecting goes in one call. */
+function redirectPeers(redirects) {
+	register("./peer-redirect-hooks.js", import.meta.url, { data: redirects });
+}
+//#endregion
+//#region ../cli-core/src/repo/tsx-loader.ts
+/**
+* Loads the repo's own TypeScript at runtime: env manifests
+* (each app's `src/env.ts` and friends), cron contracts
+* (each app's `cloudflare/scheduled.ts`), and — via `source.ts` — the
+* `devdogs-source` condition packages (`open-graph`, `email`, `docs`).
+*
+* Uses `tsx`'s programmatic API (`register()` from `tsx/esm/api`), NOT the
+* `--conditions=devdogs-source` CLI flag the old in-repo devtools used —
+* this package ships built JS and runs from `dist/`, so there is no `tsx`
+* process wrapping it anymore (see the package README / CUTOVER note on
+* "built JS, tsx only for repo TS").
+*
+* Gotcha (FINDINGS.md experiments 3 and 4, gotcha C): do NOT pass a
+* `namespace` to `register()`. It silently breaks tsx's own relative
+* `./foo.js` → `./foo.ts` extension-fallback resolution for files loaded
+* under that registration — exactly the convention `open-graph`, `email`,
+* and any future `devdogs-source` package use for their internal relative
+* imports. `register({})` (no options) is the only form validated.
+*/
+let registered = false;
+/** Idempotent: registers tsx's ESM loader hooks once per process. */
+async function ensureRegistered() {
+	if (registered) return;
+	const { register } = await import("tsx/esm/api");
+	register();
+	registered = true;
+}
+/**
+* Imports a repo TypeScript file at an absolute path, loaded through tsx.
+* Returns the module namespace, typed as `T` by the caller (there is no way
+* to know the shape of an arbitrary repo file's exports statically here).
+*/
+async function importRepoTs(absolutePath) {
+	await ensureRegistered();
+	return import(pathToFileURL(absolutePath).href);
+}
+//#endregion
+//#region ../cli-core/src/env/discovery.ts
+/**
+* Fills the `@devdogsuga/sdk/env` registry by importing every manifest.
+*
+* The registry populates as a SIDE EFFECT of importing each manifest module.
+* `declare()` runs at import time, so a process that never imports them sees an
+* empty registry and every derived selector returns nothing. That is the
+* fail-open shape this module closes: anything that routes secrets calls
+* `loadRegistry()` first, and `assertRegistryLoaded()` is the guard the
+* selectors' consumers use to refuse an empty answer.
+*
+* Discovery is by filename, per the model doc: `src/env.ts`, then `env.ts`, per
+* workspace package. Both present is a hard error, because two manifests in one
+* package means two places for the next declaration to land and no rule saying
+* which. No `package.json` pointer: every other tool in this repo is found by
+* filename (`tsconfig.json`, `wrangler.jsonc`, `supadart.yaml`), and a pointer
+* would be the only one of its kind.
+*
+* From a Backstage checkout the scan covers BOTH repos (`repo/layout.ts`):
+* Backstage's `apps/*` and `packages/*`, then DevDogsUGA's through
+* `devdogsuga/`, de-duplicated by directory name with Backstage first.
+*
+* One special case: `supabase/env.ts` sits at DevDogsUGA's root, OUTSIDE the
+* workspace globs. Its variables belong to `config.toml` and the Supabase
+* CLI, not to any package, so it lives next to the config that reads them.
+*
+* `@devdogsuga/sdk/env` itself (the package that exports `define()`/`declare()`)
+* no longer needs a special-case exclusion here: since the Backstage
+* cutover it is an installed npm dependency, not a workspace package under
+* `packages/`, so this scan never sees it at all.
+*
+* devtools' OWN operator manifest (this package's root `env.ts` — the keys
+* no app reads at all: `BWS_ACCESS_TOKEN`, `CLOUDFLARE_API_TOKEN`, and
+* friends) has the same problem in reverse: since the Backstage cutover
+* devtools is no longer one of the TARGET repo's workspace packages either,
+* so the scan below would never see it. It is loaded unconditionally,
+* always, regardless of which repo devtools is running against — see
+* `ownManifestPath()`'s own comment for how it stays resolvable both from a
+* workspace checkout and from an installed `pnpm dlx`/`node_modules` copy,
+* and for why loading it through the same `importRepoTs()` tsx path as
+* every other manifest (rather than a plain static `import`) is what keeps
+* its `declare()`/`define()` calls landing in the SAME `@devdogsuga/sdk/env`
+* registry instance the target repo's manifests populate (module identity —
+* see `repo/peers.ts`'s header and the devtools-dlx prototype's
+* FINDINGS.md experiment 3). Its bare `@devdogsuga/sdk/env` import is
+* redirected to the copy `loadEnv()` resolved through the repo, because
+* from a `pnpm dlx` copy the specifier does not resolve at all: devtools
+* ships no copy of its own (`@devdogsuga/sdk/env` is only ever an optional
+* peer), and nothing installs one next to it. See `repo/peer-redirect.ts`.
+*
+* Most workspace packages declare nothing, so "no env.ts found" means
+* not-a-manifest rather than an error.
+*
+* ⚠️ A Worker still needs a manifest, even though its bindings arrive as a
+* function argument rather than `process.env`: a manifest is the only thing
+* that routes a credential to a deployed environment and the only thing that
+* tells `env audit` a Worker secret is supposed to be there. Without one, a
+* minted secret (in no Bitwarden project by design) is reported as an orphan,
+* i.e. as safe for the §3.6 prune path to delete.
+*/
+/**
+* The single in-flight (or settled) load.
+*
+* Node's module cache already makes a second `import()` of the same manifest a
+* no-op, but memoizing the whole pass is asserted here rather than inherited: a
+* future bundler or test runner that re-evaluates modules would duplicate every
+* declaration, and duplicated declarations are what the completeness test
+* treats as a bug. A failed load stays failed. Every later call gets the same
+* rejection, because retrying into a half-populated registry would hide the
+* manifest that broke.
+*/
+let loaded;
+/**
+* Imports every manifest so the registry populates. Idempotent; concurrent
+* callers share one pass. Await this before touching any derived selector.
+*/
+function loadRegistry() {
+	loaded ??= importManifests();
+	return loaded;
+}
+/**
+* Refuses to proceed on an empty registry.
+*
+* For SYNC consumers of the derived selectors (`selectForPush`, `routeTo`),
+* which cannot await the load themselves. An empty registry makes every
+* selector return `[]`, and `[]` fails open in the worst direction: nothing is
+* never-store, so `BWS_ACCESS_TOKEN` would upload. Better a crash naming the
+* missing call than a push that quietly stores the unstorable.
+*/
+function assertRegistryLoaded() {
+	if (getEnvSync().variables().size === 0) throw new Error("The env registry is empty — no manifest has been imported, so the derived key sets would all be []. Await loadRegistry() (from devtools' env/discovery.ts) before routing or selecting secrets.");
+}
+async function importManifests() {
+	await loadEnv();
+	const redirects = [];
+	const envUrl = repoPeerUrl("@devdogsuga/sdk/env");
+	if (envUrl) {
+		redirects.push({
+			parentURL: pathToFileURL(ownManifestPath()).href,
+			specifier: "@devdogsuga/sdk/env",
+			url: envUrl
+		});
+		redirects.push(...siblingRedirects(envUrl));
+	}
+	if (redirects.length > 0) redirectPeers(redirects);
+	const previous = process.env.SKIP_ENV_VALIDATION;
+	process.env.SKIP_ENV_VALIDATION = "1";
+	try {
+		for (const path of manifestPaths()) try {
+			await importRepoTs(path);
+		} catch (cause) {
+			throw new Error(`The env manifest at ${path} failed to import.`, { cause });
+		}
+	} finally {
+		if (previous === void 0) delete process.env.SKIP_ENV_VALIDATION;
+		else process.env.SKIP_ENV_VALIDATION = previous;
+	}
+}
+/**
+* From a Backstage checkout, the manifests under `devdogsuga/` import
+* `@devdogsuga/sdk/env` through THAT checkout's `node_modules` (or not at all, when
+* it has none): a second copy of the package, and so a second registry that
+* every `declare()` there would populate instead of the one this process
+* reads. Point their imports at the copy `loadEnv()` resolved. Resolved
+* through `realpath`, because the loader sees the module's real location, not
+* the `devdogsuga` symlink.
+*/
+function siblingRedirects(envUrl) {
+	const layout = resolveLayout();
+	if (layout.kind !== "backstage" || !layout.hasDevdogsuga) return [];
+	const redirects = [];
+	for (const path of manifestPaths()) {
+		if (!path.startsWith(layout.devdogsugaRoot)) continue;
+		const parentURL = pathToFileURL(realpathSync(path)).href;
+		redirects.push({
+			parentURL,
+			specifier: "@devdogsuga/sdk/env",
+			url: envUrl
+		});
+	}
+	return redirects;
+}
+/**
+* Every manifest file, in a stable order.
+*
+* The workspace members are enumerated by scanning `apps/*` and `packages/*`
+* plus the literal `docs`, a deliberately boring mirror of the three globs in
+* `pnpm-workspace.yaml` rather than a YAML parse: the globs have not changed
+* since the workspace existed, devtools carries no YAML dependency, and a new
+* top-level glob would already mean editing more interesting files than this
+* one.
+*/
+function manifestPaths() {
+	const paths = [];
+	for (const dir of workspaceDirs()) {
+		const manifest = manifestIn(dir);
+		if (manifest) paths.push(manifest);
+	}
+	const layout = resolveLayout();
+	const supabase = layout.hasDevdogsuga ? manifestIn(join(layout.devdogsugaRoot, "supabase")) : null;
+	if (supabase) paths.push(supabase);
+	paths.push(ownManifestPath());
+	return paths;
+}
+/**
+* The absolute path to devtools' own `env.ts`, resolved relative to THIS
+* module's own file rather than the target repo — it ships alongside
+* `dist/` (see `package.json`'s `files`), not inside the target repo's
+* workspace, so `findRepoRoot()`/`workspaceDirs()` can never find it.
+*
+* The package root is `ownPackageDir()`: `env.ts` sits there, deliberately
+* outside `src/` (see that file's own header, and `tsconfig.typecheck.json`,
+* which includes it as a sibling of `src` for exactly that reason). Same file,
+* same relative shape, in both a workspace checkout
+* (`packages/devtools/env.ts`) and an installed copy
+* (`node_modules/@devdogsuga/devtools/env.ts`).
+*/
+function ownManifestPath() {
+	return join(ownPackageDir(), "env.ts");
+}
+/**
+* The CLIs' own packages: each loads its own operator manifest through
+* `ownManifestPath()`, so scanning them from a Backstage checkout would
+* declare the same keys twice.
+*/
+const CLI_PACKAGES = /* @__PURE__ */ new Set(["devtools", "backstage"]);
+/**
+* `apps/*` and `packages/*` of every repo in the layout (the repo you are in
+* first, so it wins a name clash: before the cutover both repos carry
+* `apps/platform` and `packages/email`), then DevDogsUGA's `docs`.
+*/
+function workspaceDirs() {
+	const layout = resolveLayout();
+	const roots = [layout.root];
+	if (layout.kind === "backstage" && layout.hasDevdogsuga) roots.push(layout.devdogsugaRoot);
+	const dirs = [];
+	for (const parent of ["apps", "packages"]) {
+		const found = /* @__PURE__ */ new Map();
+		for (const root of roots) {
+			let entries;
+			try {
+				entries = readdirSync(join(root, parent), { withFileTypes: true });
+			} catch {
+				continue;
+			}
+			for (const entry of entries) {
+				if (!entry.isDirectory()) continue;
+				if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
+				if (layout.kind === "backstage" && parent === "packages" && CLI_PACKAGES.has(entry.name)) continue;
+				if (!found.has(entry.name)) found.set(entry.name, join(root, parent, entry.name));
+			}
+		}
+		for (const name of [...found.keys()].sort()) dirs.push(found.get(name));
+	}
+	if (layout.hasDevdogsuga) dirs.push(join(layout.devdogsugaRoot, "docs"));
+	return dirs;
+}
+/** `src/env.ts`, then `env.ts`; both present in one package is a hard error. */
+function manifestIn(dir) {
+	const inSrc = join(dir, "src", "env.ts");
+	const atRoot = join(dir, "env.ts");
+	const hasSrc = existsSync(inSrc);
+	const hasRoot = existsSync(atRoot);
+	if (hasSrc && hasRoot) throw new Error(`${dir} has BOTH src/env.ts and env.ts. One package gets one manifest — two of them means two places for the next declaration to land, and no rule saying which. Merge them.`);
+	return hasSrc ? inSrc : hasRoot ? atRoot : null;
+}
+//#endregion
 //#region src/check/env.ts
 /**
 * `check env`: every env variable is declared, and the registry is
@@ -243,7 +531,7 @@ function checkMigrationOrder(root, baseRef) {
 			`${baseRef}^{commit}`
 		]);
 	} catch {
-		throw new MigrationBaseError(`${baseRef} is not a commit in ${root}. Migrations live in DevDogsUGA, so the base is a ref of that checkout (a Backstage CI checkout has only the pinned commit): pass --base <ref>, e.g. the previous devdogsuga.lock SHA.`);
+		throw new MigrationBaseError(`${baseRef} is not a commit in ${root}. The base is a ref of this checkout (a shallow CI checkout may lack it): pass --base <ref>, e.g. the previous commit on main.`);
 	}
 	const baseFiles = basenames(git$1(root, [
 		"ls-tree",
@@ -368,23 +656,28 @@ function expandWorkspacePackages(root, globs) {
 	return packages;
 }
 /** The `matrix.include` blocks' `app:` values, in the `strategy: matrix:
-* include:` shape `deploy-app.yaml` uses. */
+* include:` shape the deploy workflows use. An entry may carry other keys
+* (`dir:`, `release:`, `mint:`), indented under its `- app:` line. */
 function deployMatrixApps(yamlText) {
 	const lines = yamlText.split("\n");
 	const blocks = [];
+	const indentOf = (line) => line.length - line.trimStart().length;
 	for (let i = 0; i < lines.length; i += 1) {
 		if (!/^\s*matrix:\s*$/.test(lines[i])) continue;
 		let j = i + 1;
 		while (j < lines.length && !/^\s*include:\s*$/.test(lines[j])) j += 1;
 		const apps = [];
+		let entryIndent = null;
 		for (let k = j + 1; k < lines.length; k += 1) {
 			const line = lines[k];
 			const appMatch = /^\s*- app:\s*(\S+)\s*$/.exec(line);
 			if (appMatch?.[1]) {
 				apps.push(appMatch[1]);
+				entryIndent ??= indentOf(line);
 				continue;
 			}
-			if (/^\s*mint:/.test(line) || /^\s*#/.test(line) || /^\s*$/.test(line)) continue;
+			if (/^\s*#/.test(line) || /^\s*$/.test(line)) continue;
+			if (entryIndent !== null && indentOf(line) > entryIndent) continue;
 			break;
 		}
 		if (apps.length > 0) blocks.push(apps);
@@ -392,11 +685,34 @@ function deployMatrixApps(yamlText) {
 	return blocks;
 }
 /**
+* The Workers `deploy.yaml` deploys, read from its calls of the shared
+* `deploy-worker.yaml`: each caller job names its `tier` and `worker_dir`
+* under `with:`. Returns the directories' basenames (the app slugs) per tier.
+* A job that does not call deploy-worker.yaml is ignored.
+*/
+function deployWorkerCalls(yamlText) {
+	const staging = [];
+	const production = [];
+	for (const job of yamlText.split(/^ {2}(?=[\w-]+:\s*$)/m)) {
+		if (!/uses:\s*\.\/\.github\/workflows\/deploy-worker\.yaml/.test(job)) continue;
+		const tier = /^ {6}tier:\s*(\w+)\s*$/m.exec(job)?.[1];
+		const dir = /^ {6}worker_dir:\s*(\S+)\s*$/m.exec(job)?.[1];
+		if (!tier || !dir) continue;
+		(tier === "production" ? production : staging).push(basename(dir));
+	}
+	return {
+		staging,
+		production
+	};
+}
+/**
 * Apps with a `wrangler.jsonc` that are deliberately NOT in `workers.json`:
-* `workers.json` is the managed set (deploy matrix, smoke tests, env registry,
-* secret orphan sweep), and these are deployed by hand and have none of that.
-* `apps/slides` is the hosted workshop deck, shipped with `pnpm run deploy`
-* from its own directory (its `wrangler.jsonc` says so).
+* `workers.json` is the managed set (deploy matrix, env registry, secret orphan
+* sweep), and these have none of that. `apps/slides` is the hosted workshop
+* deck. It deploys through the same shared `deploy-worker.yaml` as the others
+* (called from slides.yaml, behind the `production` approval), with its smoke
+* test in `apps/slides/smoke.json` because it has no staging tier and no env
+* manifest.
 */
 const HAND_DEPLOYED_APPS = ["apps/slides"];
 function sameSet(a, b) {
@@ -438,12 +754,15 @@ function checkWorkers(root, layout = layoutAt(root)) {
 		const slug = path.split("/").pop();
 		if (name !== slug) problems.push(`${path}/package.json is named "${name}"; the directory name, package name and app slug must agree ("${slug}").`);
 	}
-	const deployApp = join(root, ".github", "workflows", "deploy-app.yaml");
-	if (!existsSync(deployApp)) {
-		if (layout.kind === "backstage") return problems;
-		problems.push(".github/workflows/deploy-app.yaml does not exist.");
-		return problems;
+	const deployWorkflow = join(root, ".github", "workflows", "deploy.yaml");
+	if (existsSync(deployWorkflow)) {
+		const calls = deployWorkerCalls(readFileSync(deployWorkflow, "utf8"));
+		if (calls.staging.length === 0) problems.push("deploy.yaml has no staging Worker deploy.");
+		else if (!sameSet(calls.staging, apps)) problems.push(`deploy.yaml deploys [${calls.staging.join(", ")}] to staging; workers.json lists [${apps.join(", ")}].`);
+		if (calls.production.length > 0 && !sameSet(calls.production, apps)) problems.push(`deploy.yaml deploys [${calls.production.join(", ")}] to production; workers.json lists [${apps.join(", ")}].`);
 	}
+	const deployApp = join(root, ".github", "workflows", "deploy-app.yaml");
+	if (!existsSync(deployApp)) return problems;
 	const blocks = deployMatrixApps(readFileSync(deployApp, "utf8"));
 	if (blocks.length !== 1) problems.push(`deploy-app.yaml should define its deploy matrix once; found ${blocks.length}.`);
 	for (const block of blocks) if (!sameSet(block, apps)) problems.push(`deploy-app.yaml's matrix is [${block.join(", ")}]; workers.json lists [${apps.join(", ")}].`);
@@ -758,7 +1077,7 @@ function runCompletions(catalog, argv) {
 //#endregion
 //#region src/completions/commands.ts
 const handleCompletions = async (rest) => {
-	const code = runCompletions(catalog, rest);
+	const code = runCompletions(activeCatalog(), rest);
 	process.exitCode = code;
 	return code === 0 ? DONE : null;
 };
@@ -2303,7 +2622,7 @@ const handleEnv = async (rest) => {
 * The shared `--tier` resolver for the handful of commands that pick a
 * deploy tier of their OWN, separate from the session-wide tier
 * `src/launch.ts` already resolved and entered before this CLI ever runs
-* (see that file's header, and `@devdogsuga/env/session`, which is where
+* (see that file's header, and `env-runtime/session`, which is where
 * `availableTiers` and the session-wide policy now live — this module used
 * to carry its own copy of both, one of two the wizard's tier question also
 * used to keep before it moved into `launch.ts`).
@@ -2655,7 +2974,7 @@ async function runCronRun(argv) {
 	}
 	return failed ? 1 : 0;
 }
-function readEnvFile(path) {
+function readEnvFile$1(path) {
 	return existsSync(path) ? parse(readFileSync(path, "utf8")) : {};
 }
 /** Resolve the selected app's origin without assuming every app uses port 3000. */
@@ -2663,8 +2982,8 @@ function resolveBaseUrl(app, tier, config, tierEnv) {
 	if (tier === "development" && app) {
 		const appRoot = findApp(app) ?? join(findRepoRoot(), "apps", app);
 		const local = {
-			...readEnvFile(join(appRoot, ".dev.vars.example")),
-			...readEnvFile(join(appRoot, ".dev.vars"))
+			...readEnvFile$1(join(appRoot, ".dev.vars.example")),
+			...readEnvFile$1(join(appRoot, ".dev.vars"))
 		};
 		if (local["BASE_URL"]) return local["BASE_URL"];
 	}
@@ -2692,6 +3011,60 @@ function parseCronRunOptions(argv) {
 	return opts;
 }
 //#endregion
+//#region src/cf/local-env.ts
+/** The app's declared keys, deduped and sorted, from the given entries or the
+* loaded registry.
+*
+* `DEPLOY_ENV` and `NODE_ENV` are excluded BY NAME, not by any registry-meta
+* heuristic. Their committed source is wrangler.jsonc's per-env `vars` blocks
+* (and the framework), never an env file — see each key's `define()` doc.
+* Materializing them into the temp `.dev.vars` this file feeds to `wrangler
+* dev` lets a stray or empty `.env` value OVERRIDE the tier's wrangler var,
+* which surfaced as a Workflow isolate reading a blank `DEPLOY_ENV` and
+* throwing "has no HYPERDRIVE binding".
+*
+* A `scope: "default"` + `commented: true` filter was tried first and is
+* WRONG: that shape also matches `GITHUB_COMPETITION_REPO`, an opt-in
+* override a contributor sets deliberately in their `.env` (its wrangler
+* config defines no such var), and the heuristic silently stripped it from
+* `wrangler dev`'s environment. Wrangler-ownership is a fact about
+* wrangler.jsonc, not about registry metadata, so the two keys it is true
+* for are named outright. */
+const WRANGLER_OWNED_KEYS = /* @__PURE__ */ new Set(["DEPLOY_ENV", "NODE_ENV"]);
+async function scopedKeys(app, entries) {
+	if (!entries) {
+		await loadRegistry();
+		entries = (await loadEnv()).declarations();
+	}
+	return [...new Set(entries.filter((entry) => entry.source === app).filter((entry) => !WRANGLER_OWNED_KEYS.has(entry.key)).map((entry) => entry.key))].sort();
+}
+/**
+* The process env for a `vinext dev` child, scoped the way the temp
+* `.dev.vars` is for `wrangler dev`.
+*
+* `@cloudflare/vite-plugin` has no `--env-file`: it reads the app dir's own
+* `.dev.vars`/`.env`, or — with `CLOUDFLARE_INCLUDE_PROCESS_ENV` — its whole
+* `process.env`, as Worker vars that override wrangler.jsonc's `vars`. So the
+* scoping happens on the child's env instead: every key some OTHER app
+* declares (and this app doesn't) is dropped, `NODE_ENV` is left to Vite, and
+* `DEPLOY_ENV` is pinned to the tier rather than dropped, because the Vite
+* process's own `next.config.ts` reads it too. Undeclared keys (PATH, HOME,
+* pnpm's own) stay; the child needs them and they carry no app secrets.
+*/
+async function scopedProcessEnv(app, environment, tier, entries) {
+	if (!entries) {
+		await loadRegistry();
+		entries = (await loadEnv()).declarations();
+	}
+	const own = new Set(await scopedKeys(app, entries));
+	const scoped = { ...environment };
+	for (const entry of entries) if (entry.source !== app && !own.has(entry.key)) delete scoped[entry.key];
+	delete scoped.NODE_ENV;
+	scoped.DEPLOY_ENV = tier;
+	scoped.CLOUDFLARE_INCLUDE_PROCESS_ENV = "true";
+	return scoped;
+}
+//#endregion
 //#region src/cf/build.ts
 /**
 * The build a Worker app needs before `wrangler dev` can boot it locally.
@@ -3581,6 +3954,350 @@ const handleJobs = async (rest) => {
 	process.exitCode = code;
 	return code === 0 ? DONE : null;
 };
+const WEBHOOK_ID = "webhook-id";
+const WEBHOOK_TIMESTAMP = "webhook-timestamp";
+const WEBHOOK_SIGNATURE = "webhook-signature";
+const encoder = new TextEncoder();
+function toBase64(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+function fromBase64(value) {
+	try {
+		const binary = atob(value);
+		const bytes = new Uint8Array(binary.length);
+		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+		return bytes;
+	} catch {
+		return null;
+	}
+}
+/** The raw key bytes of a `whsec_` secret (the prefix is optional). */
+function secretBytes(secret) {
+	const bytes = fromBase64(secret.startsWith("whsec_") ? secret.slice(6) : secret);
+	if (!bytes || bytes.length === 0) throw new Error("The signing secret is not a base64 value");
+	return bytes;
+}
+async function hmacKey(secret, usage) {
+	return crypto.subtle.importKey("raw", secretBytes(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, [usage]);
+}
+function signedContent(id, timestamp, body) {
+	return `${id}.${timestamp}.${body}`;
+}
+/** `v1,<base64>` for one message. */
+async function computeSignature(secret, id, timestamp, body) {
+	const key = await hmacKey(secret, "sign");
+	const mac = await crypto.subtle.sign("HMAC", key, encoder.encode(signedContent(id, String(timestamp), body)));
+	return `v1,${toBase64(new Uint8Array(mac))}`;
+}
+/** The three headers that authenticate `body`. */
+async function signMessage(secret, body, options = {}) {
+	const id = options.id ?? `msg_${crypto.randomUUID()}`;
+	const timestamp = options.timestamp ?? Math.floor(Date.now() / 1e3);
+	return {
+		[WEBHOOK_ID]: id,
+		[WEBHOOK_TIMESTAMP]: String(timestamp),
+		[WEBHOOK_SIGNATURE]: await computeSignature(secret, id, timestamp, body)
+	};
+}
+const reportReasonSchema = z.enum([
+	"harassment",
+	"hate_speech",
+	"spam",
+	"sexual_content",
+	"violence",
+	"impersonation",
+	"off_topic",
+	"other"
+]);
+/**
+* A content type is the app's own name for a kind of thing a member can write
+* (`session`, `profile`). Registered per app on the platform; a report naming
+* an unregistered one is refused.
+*/
+const contentTypeSchema = z.string().regex(/^[a-z][a-z0-9_]{0,62}$/, "lowercase letters, digits and underscores");
+z.object({
+	/** The platform user id of the member filing the report. */
+	reporterUserId: z.uuid(),
+	/** The platform user id of the member who wrote the content. */
+	authorUserId: z.uuid(),
+	contentType: contentTypeSchema,
+	/** The app's own id for the row; opaque to the platform. */
+	contentRef: z.string().min(1).max(256),
+	/** What the content said when it was reported. Frozen on the report. */
+	contentSnapshot: z.string().min(1).max(5e3),
+	/** A link a moderator can follow to the live content. https only. */
+	contentUrl: z.url({ protocol: /^https$/ }).max(2e3).nullish(),
+	reason: reportReasonSchema,
+	description: z.string().max(1e3).nullish()
+});
+z.object({
+	reportId: z.uuid(),
+	/** True when an open report already existed and this one was added to it. */
+	corroborated: z.boolean(),
+	/** True when the client is a development client: only its owner sees it. */
+	sandbox: z.boolean()
+});
+z.object({ error: z.object({
+	code: z.enum([
+		"invalid_json",
+		"invalid_request",
+		"missing_client",
+		"unknown_client",
+		"client_not_registered",
+		"bad_signature",
+		"unknown_content_type",
+		"unknown_user",
+		"reporter_not_allowed",
+		"rate_limited",
+		"not_configured"
+	]),
+	message: z.string()
+}) });
+const CONTENT_MESSAGE_TYPES = [
+	"content.hide",
+	"content.remove",
+	"content.restore"
+];
+const USER_MESSAGE_TYPES = [
+	"user.suspend",
+	"user.ban",
+	"user.restore"
+];
+const MESSAGE_TYPES = [...CONTENT_MESSAGE_TYPES, ...USER_MESSAGE_TYPES];
+const contentMessageSchema = z.object({
+	type: z.enum(CONTENT_MESSAGE_TYPES),
+	/** When the moderator decided, ISO 8601. The ordering key. */
+	timestamp: z.iso.datetime(),
+	data: z.object({
+		contentType: contentTypeSchema,
+		contentRef: z.string().min(1).max(256),
+		reportId: z.uuid().nullable()
+	})
+});
+const userMessageSchema = z.object({
+	type: z.enum(USER_MESSAGE_TYPES),
+	timestamp: z.iso.datetime(),
+	data: z.object({
+		/** The platform user id. Maps to the app's user through the identity. */
+		userId: z.uuid(),
+		reason: z.string().max(1e3).nullable(),
+		reportId: z.uuid().nullable()
+	})
+});
+z.union([contentMessageSchema, userMessageSchema]);
+const SAMPLE_CONTENT = {
+	contentType: "session",
+	contentRef: "00000000-0000-4000-8000-0000000000a1"
+};
+/** A message of any type, with sample targets unless told otherwise. */
+function buildMessage(input) {
+	const timestamp = input.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+	const reportId = input.reportId ?? null;
+	if (input.type.startsWith("content.")) return {
+		type: input.type,
+		timestamp,
+		data: {
+			contentType: input.contentType ?? SAMPLE_CONTENT.contentType,
+			contentRef: input.contentRef ?? SAMPLE_CONTENT.contentRef,
+			reportId
+		}
+	};
+	return {
+		type: input.type,
+		timestamp,
+		data: {
+			userId: input.userId ?? "00000000-0000-4000-8000-0000000000b1",
+			reason: input.reason ?? null,
+			reportId
+		}
+	};
+}
+/**
+* The conformance sequence. Send it in order to a fresh receiver:
+*
+* 1. hide a session: applied
+* 2. the same message again: duplicate
+* 3. a restore dated before the hide: stale
+* 4. a restore dated after it: applied
+* 5. suspend a user: applied
+* 6. a user restore dated before the suspension: stale
+*
+* Every message is signed for "now", so it is inside the five-minute window
+* however old its decision timestamp is.
+*/
+async function signedSamples(options = {}) {
+	const secret = options.secret ?? "whsec_c2FtcGxlLW1vZGVyYXRpb24tc2VjcmV0LW5vdC1yZWFs";
+	const now = options.now ?? Date.now();
+	const at = (offsetSeconds) => new Date(now + offsetSeconds * 1e3).toISOString();
+	const signedAt = Math.floor(now / 1e3);
+	const run = options.runId ?? Math.random().toString(36).slice(2, 10);
+	const messageId = (n) => `msg_sample_${run}_${n}`;
+	const contentRef = options.contentRef ?? crypto.randomUUID();
+	async function sample(name, id, expected, message) {
+		const body = JSON.stringify(message);
+		return {
+			name,
+			expected,
+			body,
+			headers: await signMessage(secret, body, {
+				id,
+				timestamp: signedAt
+			})
+		};
+	}
+	const hide = buildMessage({
+		type: "content.hide",
+		timestamp: at(0),
+		contentRef
+	});
+	return [
+		await sample("hide a session", messageId(1), "applied", hide),
+		await sample("replay of the hide", messageId(1), "duplicate", hide),
+		await sample("a restore dated before the hide", messageId(2), "stale", buildMessage({
+			type: "content.restore",
+			timestamp: at(-60),
+			contentRef
+		})),
+		await sample("a restore dated after the hide", messageId(3), "applied", buildMessage({
+			type: "content.restore",
+			timestamp: at(1),
+			contentRef
+		})),
+		await sample("suspend a user", messageId(4), "applied", buildMessage({
+			type: "user.suspend",
+			timestamp: at(0),
+			reason: "sample suspension"
+		})),
+		await sample("a user restore dated before the suspension", messageId(5), "stale", buildMessage({
+			type: "user.restore",
+			timestamp: at(-60)
+		}))
+	];
+}
+function isMessageType(value) {
+	return MESSAGE_TYPES.includes(value);
+}
+function target(rest) {
+	const secret = flagValue(rest, "--secret") ?? process.env.PLATFORM_MODERATION_SECRET;
+	return {
+		url: flagValue(rest, "--to") ?? "http://127.0.0.1:54321/functions/v1/platform-moderation",
+		secret: secret ?? "whsec_c2FtcGxlLW1vZGVyYXRpb24tc2VjcmV0LW5vdC1yZWFs",
+		usingSampleSecret: secret === void 0
+	};
+}
+/** POSTs a signed body. A refused connection says what to start, not a stack. */
+async function post({ url, secret }, body, options = {}, doFetch = fetch) {
+	const response = await doFetch(url, {
+		method: "POST",
+		headers: {
+			...await signMessage(secret, body, options),
+			"content-type": "application/json"
+		},
+		body
+	});
+	return {
+		status: response.status,
+		body: await response.text()
+	};
+}
+/** The outcome word a reference-shaped receiver answers with, if it does. */
+function outcomeOf(reply) {
+	try {
+		const parsed = JSON.parse(reply.body);
+		return typeof parsed.outcome === "string" ? parsed.outcome : null;
+	} catch {
+		return null;
+	}
+}
+function show(label, reply) {
+	const outcome = outcomeOf(reply);
+	process.stdout.write(`${label}: HTTP ${reply.status}${outcome ? ` (${outcome})` : ""}${reply.status >= 400 && reply.body ? ` ${reply.body.slice(0, 200)}` : ""}\n`);
+}
+function unreachable(url, error) {
+	explain(`Could not reach ${url}.`, error instanceof Error ? error.message : String(error), ["Start your local stack (`supabase start`) and serve the function (`supabase functions serve`),", "or pass --to <url> for a receiver running somewhere else."]);
+	process.exitCode = 1;
+}
+function noteSecret(t) {
+	if (t.usingSampleSecret) process.stderr.write("Signing with the sample secret. Set your receiver's secret to it, or pass --secret / PLATFORM_MODERATION_SECRET.\n");
+}
+async function runSend(rest) {
+	const action = positionals(rest)[1];
+	if (!action || !isMessageType(action)) {
+		explain(action ? `"${action}" is not a moderation action.` : "Which action?", "", [`devtools moderation send <${MESSAGE_TYPES.join(" | ")}>`]);
+		process.exitCode = 1;
+		return;
+	}
+	const t = target(rest);
+	noteSecret(t);
+	const stale = rest.includes("--stale");
+	const message = buildMessage({
+		type: action,
+		timestamp: (/* @__PURE__ */ new Date(Date.now() - (stale ? 6e4 : 0))).toISOString(),
+		contentType: flagValue(rest, "--content-type"),
+		contentRef: flagValue(rest, "--content-ref"),
+		userId: flagValue(rest, "--user")
+	});
+	const body = JSON.stringify(message);
+	const id = `msg_${crypto.randomUUID()}`;
+	try {
+		const first = await post(t, body, { id });
+		show(`${action}`, first);
+		if (first.status >= 300) process.exitCode = 1;
+		if (rest.includes("--replay")) {
+			const second = await post(t, body, { id });
+			show(`${action} (replay)`, second);
+			if (second.status >= 300) process.exitCode = 1;
+		}
+	} catch (error) {
+		unreachable(t.url, error);
+	}
+}
+async function runSamples(rest, doFetch = fetch) {
+	const t = target(rest);
+	noteSecret(t);
+	let allPassed = true;
+	try {
+		for (const sample of await signedSamples({ secret: t.secret })) {
+			const response = await doFetch(t.url, {
+				method: "POST",
+				headers: {
+					...sample.headers,
+					"content-type": "application/json"
+				},
+				body: sample.body
+			});
+			const reply = {
+				status: response.status,
+				body: await response.text()
+			};
+			const outcome = outcomeOf(reply);
+			const passed = reply.status < 300 && outcome === sample.expected;
+			const verdict = passed ? "ok" : reply.status < 300 && outcome === null ? "answered 2xx (no outcome to check)" : `expected ${sample.expected}, got HTTP ${reply.status}${outcome ? ` (${outcome})` : ""}`;
+			process.stdout.write(`${passed ? "pass" : "FAIL"}  ${sample.name}: ${verdict}\n`);
+			if (!passed && !(reply.status < 300 && outcome === null)) allPassed = false;
+		}
+	} catch (error) {
+		unreachable(t.url, error);
+		return false;
+	}
+	if (!allPassed) process.exitCode = 1;
+	return allPassed;
+}
+const handleModeration = async (rest) => {
+	const sub = positionals(rest)[0];
+	if (sub === "send") await runSend(rest);
+	else if (sub === "samples") await runSamples(rest);
+	else {
+		process.stderr.write(`devtools moderation: unknown subcommand "${sub ?? "(none)"}". Expected: send or samples.\n`);
+		process.exitCode = 1;
+	}
+	return process.exitCode ? null : DONE;
+};
 //#endregion
 //#region ../cli-core/src/instance.ts
 /**
@@ -4002,6 +4719,125 @@ const handleRoles = async (rest) => {
 	}
 	return process.exitCode ? null : DONE;
 };
+//#endregion
+//#region src/product/env.ts
+/**
+* The two env files a product keeps, and the manifest they come from.
+*
+*   * `.env.example` is committed and holds public values only. It is the
+*     manifest: `setup` writes `.env` from it, and the Flutter build reads
+*     `.env` with `--dart-define-from-file=.env`, so everything in it ships in
+*     the app. CI rejects a secret-looking key in it.
+*   * `.env.tooling` is git-ignored and holds what the tooling needs and the
+*     app must never see: the database URL and the secret key.
+*
+* Values are written unquoted: Flutter's `--dart-define-from-file` reads
+* `KEY=value` lines and keeps quotes as part of the value.
+*/
+function readEnvFile(path) {
+	return existsSync(path) ? parse(readFileSync(path, "utf8")) : {};
+}
+/** Sets `values` in an env file, keeping every other line (comments included) as it was. */
+function upsertEnvFile(path, values, header) {
+	const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+	const lines = existing.length > 0 ? existing.replace(/\n$/, "").split("\n") : [];
+	if (lines.length === 0 && header) lines.push(header);
+	const remaining = new Map(Object.entries(values));
+	const updated = lines.map((line) => {
+		const key = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line)?.[1];
+		if (key === void 0 || !remaining.has(key)) return line;
+		const value = remaining.get(key);
+		remaining.delete(key);
+		return `${key}=${value}`;
+	});
+	for (const [key, value] of remaining) updated.push(`${key}=${value}`);
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${updated.join("\n")}\n`, { mode: 384 });
+}
+/**
+* Makes sure `relPath` (relative to `root`) is ignored by git, adding it to
+* the root `.gitignore` when it is not. Returns true when it had to add it.
+*
+* Flutter's default `.gitignore` ignores none of `.env`, `.env.tooling` or
+* `.env.local`, and `.env.tooling` holds the database URL, the secret key and
+* the OAuth client secret, so devtools does not leave that to chance. Outside a
+* git work tree (or with no git) there is nothing to commit to, and it does
+* nothing.
+*/
+function ensureGitignored(root, relPath) {
+	const check = spawnSync("git", [
+		"check-ignore",
+		"-q",
+		"--",
+		relPath
+	], {
+		cwd: root,
+		stdio: "ignore"
+	});
+	if (check.error || check.status !== 1) return false;
+	const file = join(root, ".gitignore");
+	const existing = existsSync(file) ? readFileSync(file, "utf8") : "";
+	const lead = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+	appendFileSync(file, `${lead}/${relPath}\n`);
+	return true;
+}
+/** The keys of a manifest, in order. */
+function manifestKeys(text) {
+	return Object.keys(parse(text));
+}
+/**
+* `.env` for a fresh checkout: the manifest's own lines and comments, with
+* `overrides` applied. Keys the manifest does not declare are not added; the
+* file stays public-only by construction.
+*/
+function renderEnvFromManifest(manifest, overrides) {
+	const declared = new Set(manifestKeys(manifest));
+	const lines = manifest.replace(/\n$/, "").split("\n").map((line) => {
+		const key = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line)?.[1];
+		if (key === void 0) return line;
+		const value = overrides[key];
+		return value === void 0 ? line : `${key}=${value}`;
+	});
+	for (const key of Object.keys(overrides)) if (!declared.has(key)) throw new Error(`${key} is not in the manifest; add it to .env.example (public values only) first.`);
+	return `${lines.join("\n")}\n`;
+}
+/** Key names that mean a secret. `API_KEY` is not here: a browser Maps key is public by design. */
+const SECRET_KEY_NAME = /(?:^|_)(?:SECRET|PASSWORD|PASSWD|PRIVATE|TOKEN|SERVICE_ROLE|CREDENTIALS?)(?:_|$)|(?:^|_)(?:DB|DATABASE|POSTGRES|PG)_(?:URL|URI|PASSWORD)(?:_|$)/i;
+/** Values that look like a secret whatever the key is called. */
+const SECRET_VALUE = [
+	[/sb_secret_/, "a Supabase secret key"],
+	[/postgres(?:ql)?:\/\/[^:\s/]+:[^@\s]+@/i, "a database URL with a password"],
+	[/-----BEGIN [A-Z ]*PRIVATE KEY-----/, "a private key"],
+	[/\bwhsec_[A-Za-z0-9+/=]{16,}/, "a webhook signing secret"],
+	[/\bgh[pousr]_[A-Za-z0-9]{20,}/, "a GitHub token"]
+];
+/** Secret-looking entries in a manifest. The manifest ships in the app, so none may pass. */
+function findSecrets(manifest) {
+	const findings = [];
+	for (const [key, value] of Object.entries(parse(manifest))) {
+		if (SECRET_KEY_NAME.test(key)) {
+			findings.push({
+				key,
+				reason: "its name says it is a secret"
+			});
+			continue;
+		}
+		const hit = SECRET_VALUE.find(([pattern]) => pattern.test(value));
+		if (hit) findings.push({
+			key,
+			reason: `its value looks like ${hit[1]}`
+		});
+	}
+	return findings;
+}
+/**
+* Every host the platform's auth server has answered on, in the order to try.
+* The platform's project moves from its custom domain to the vanity name
+* `devdogsuga.supabase.co` at a deploy gate (Q90), and `api.devdogsuga.org`
+* then becomes a Worker-routed host with no `/auth/v1`; discovery tries each,
+* so one build of devtools works on both sides of the move.
+*/
+const DEFAULT_API_URLS = ["https://api.devdogsuga.org", "https://devdogsuga.supabase.co"];
 /**
 * DevDogs website — human-facing links, and (since TASK-351) the origin
 * that serves the one-click connect flow's `/tools/oauth/connect` and
@@ -4031,12 +4867,13 @@ const ENV_KEYS = {
 //#endregion
 //#region src/oauth/env-file.ts
 /**
-* Writes `values` into `.env.local` in `cwd`, updating any existing
-* `KEY=...` lines in place and appending keys that aren't present yet.
-* Leaves all other lines (comments, unrelated vars) untouched.
+* Writes `values` into `fileName` (`.env.local` by default) in `cwd`,
+* updating any existing `KEY=...` lines in place and appending keys that
+* aren't present yet. Leaves all other lines (comments, unrelated vars)
+* untouched. A product repo passes its `.env.tooling`, where its secrets live.
 */
-function upsertEnvLocal(cwd, values) {
-	const path = join(cwd, ".env.local");
+function upsertEnvLocal(cwd, values, fileName = ".env.local") {
+	const path = join(cwd, fileName);
 	const existing = existsSync(path) ? readFileSync(path, "utf-8") : "";
 	const lines = existing.length > 0 ? existing.split("\n") : [];
 	const remaining = new Map(Object.entries(values));
@@ -4051,7 +4888,7 @@ function upsertEnvLocal(cwd, values) {
 		return `${key}=${formatValue(value)}`;
 	});
 	for (const [key, value] of remaining) updated.push(`${key}=${formatValue(value)}`);
-	writeFileSync(path, `${updated.join("\n").replace(/\n*$/, "")}\n`);
+	writeFileSync(path, `${updated.join("\n").replace(/\n*$/, "")}\n`, { mode: 384 });
 }
 function formatValue(value) {
 	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
@@ -4224,6 +5061,22 @@ async function fetchIssuer(baseUrl) {
 	if (typeof issuer !== "string" || issuer.length === 0) throw new DiscoveryError(`${discoveryUrl} response had no "issuer" field`);
 	return issuer;
 }
+/**
+* `fetchIssuer` against each base in turn, returning the first that answers.
+* Only when every base fails does it throw, naming all of them.
+*/
+async function fetchIssuerFromAny(baseUrls) {
+	const failures = [];
+	for (const baseUrl of baseUrls) try {
+		return {
+			issuer: await fetchIssuer(baseUrl),
+			baseUrl
+		};
+	} catch (err) {
+		failures.push(err instanceof Error ? err.message : String(err));
+	}
+	throw new DiscoveryError(failures.join("\n"));
+}
 //#endregion
 //#region src/oauth/browser.ts
 /** Opens `url` in the user's default browser, cross-platform. */
@@ -5097,7 +5950,8 @@ async function connectViaOneClick(target, platformUrl, cwd, transportOverride) {
 }
 /** Step 2 (paste branch): the original manual flow — client ID/secret against the DevDogs API. */
 async function connectByPasting(baseUrlOverride) {
-	const baseUrl = (baseUrlOverride ?? process.env[ENV_KEYS.baseUrl] ?? "https://api.devdogsuga.org").replace(/\/+$/, "");
+	const explicitBase = baseUrlOverride ?? process.env[ENV_KEYS.baseUrl];
+	const candidates = explicitBase ? [explicitBase.replace(/\/+$/, "")] : DEFAULT_API_URLS;
 	let clientId = nonEmptyEnv(ENV_KEYS.clientId);
 	let clientSecret = nonEmptyEnv(ENV_KEYS.clientSecret);
 	if (clientId && clientSecret) {
@@ -5124,7 +5978,7 @@ async function connectByPasting(baseUrlOverride) {
 	discoverySpinner.start("Discovering issuer");
 	let issuer;
 	try {
-		issuer = await fetchIssuer(baseUrl);
+		({issuer} = await fetchIssuerFromAny(candidates));
 		discoverySpinner.stop(`Discovered issuer: ${issuer}`);
 	} catch (err) {
 		discoverySpinner.stop("Could not discover the issuer");
@@ -5148,7 +6002,7 @@ async function connectByPasting(baseUrlOverride) {
 * Intro and outro are the caller's, so this composes into the devtools menu
 * without drawing a second box inside the first.
 */
-async function runOAuthSetup(baseUrlOverride, platformUrlOverride, transportOverride, presetTarget) {
+async function runOAuthSetup(baseUrlOverride, platformUrlOverride, transportOverride, presetTarget, credentialsFile = ".env.local") {
 	const cwd = process.cwd();
 	log.info("Configures a Supabase project to support \"Sign in with DevDogs\".");
 	const target = presetTarget ?? await chooseTarget(cwd);
@@ -5219,9 +6073,10 @@ async function runOAuthSetup(baseUrlOverride, platformUrlOverride, transportOver
 		[ENV_KEYS.clientId]: clientId,
 		[ENV_KEYS.clientSecret]: clientSecret
 	};
-	if (!usedOneClick) envValues[ENV_KEYS.baseUrl] = baseUrlOverride ?? process.env[ENV_KEYS.baseUrl] ?? "https://api.devdogsuga.org";
-	upsertEnvLocal(cwd, envValues);
-	log.success("Credentials saved to .env.local");
+	const explicitBase = baseUrlOverride ?? process.env[ENV_KEYS.baseUrl];
+	if (!usedOneClick && explicitBase) envValues[ENV_KEYS.baseUrl] = explicitBase;
+	upsertEnvLocal(cwd, envValues, credentialsFile);
+	log.success(`Credentials saved to ${credentialsFile}`);
 	const callbackUri = `${target.apiUrl}/auth/v1/callback`;
 	if (!usedOneClick) {
 		const alreadyRegistered = unwrap(await confirm({
@@ -5266,7 +6121,10 @@ const handleOAuth = async (rest) => {
 		process.exitCode = 1;
 		return null;
 	}
-	await runOAuthSetup(flagValue(rest, "--base-url"), flagValue(rest, "--platform-url"), forceDevice ? "device" : forceLoopback ? "loopback" : void 0);
+	const product = currentProduct();
+	if (product) process.chdir(product.root);
+	if (product && ensureGitignored(product.root, product.config.env.tooling)) process.stderr.write(`devtools: added /${product.config.env.tooling} to .gitignore (it holds secrets).\n`);
+	await runOAuthSetup(flagValue(rest, "--base-url"), flagValue(rest, "--platform-url"), forceDevice ? "device" : forceLoopback ? "loopback" : void 0, void 0, product?.config.env.tooling);
 	return "All done! You're ready to \"Sign in with DevDogs\".";
 };
 //#endregion
@@ -5719,677 +6577,53 @@ async function handlePassthrough(tool, args) {
 	}
 }
 //#endregion
-//#region src/run/commands.ts
-/**
-* `pnpm devtools run <task>`: which apps a root pnpm task runs against.
-*
-* `pnpm dev` used to start every app in the workspace at once: two Next dev
-* servers on two ports and a Flutter run, when almost nobody is working on
-* more than one. pnpm's own `--filter` has always made scoping possible, so
-* the capability was there. The DEFAULT was wrong, and a default you have to
-* know a flag to escape is one most contributors never escape.
-*
-* So every root package script routes through here. With a TTY and no
-* explicit filter it asks; without either it is a passthrough that costs one
-* or two process spawns (one to build dependencies first, for tasks that need
-* that — see `NEEDS_DEPS_BUILT` below — then one to run the task itself).
-*
-* ## Why this lives in devtools now
-*
-* It began here, moved out to `scripts/pick.mjs` as plain Node, and has come
-* back. The move out rested on two grounds, and re-checking them on 2026-08-27
-* found one of them false:
-*
-*   * "CI pays for it." It does not. No workflow invokes the root task
-*     aliases: `ci.yaml` and `deploy.yaml` both call `pnpm -r …`/`pnpm --filter
-*     …` directly, which never reaches this file. Only a person at a terminal
-*     pays it, and there it buys the question this exists to ask. The `CI`
-*     guard in `shouldAsk` stays as insurance against a runner that one day
-*     does type `pnpm build`.
-*   * "It must not need a build." This one holds, and is why the module stays
-*     careful. `pnpm build` routes through here, so anything on this path that
-*     had to be compiled first would be a cycle. It is safe because devtools
-*     runs from source under `--conditions=devdogs-source`, and because the
-*     one workspace dependency with no source condition (`@devdogsuga/docs`,
-*     which is `dist`-only) is reached through a lazy `await import` in
-*     `docs/index-pages.ts` and never loads on this path. ⚠️ A top-level
-*     `import` of `@devdogsuga/docs` anywhere in the eager graph would
-*     deadlock `pnpm build` on itself.
-*
-* ## Building dependencies first, in pnpm terms
-*
-* A package's workspace dependencies have to be built before a task runs
-* against it, for every task in `NEEDS_DEPS_BUILT` below. pnpm has no single
-* flag that means this, but it has the two pieces that compose into it: `<pkg>^...` selects only the direct and indirect DEPENDENCIES of a
-* package (excluding the package itself), and plain recursive `pnpm -r` runs
-* scripts in dependency order (a package's own dependencies always run before
-* it). So building the deps-of set with `-r --filter '<pkg>^...' run build`
-* and then running the real task against the package itself gives that
-* ordering with two spawns.
-*
-* `@devdogsuga/email` is the one package that needs its OWN build before its
-* OWN typecheck/test, not just its dependencies' — its build step generates
-* gitignored `src/generated/templates.ts`. That case never runs through this
-* picker (it lists `apps/*`, not `packages/*`; see `appsWith` below), but
-* matters for anyone reasoning about the workspace-wide passthrough path
-* (see `passthroughApps` and `allAppNames`), which builds the union of every
-* app's dependencies — email included, since some app depends on it —
-* before the target task, deliberately stopping short of a bare `pnpm -r run
-* build`: that would also run every APP's own build script, which a
-* typecheck/lint/test/dev run has no business doing (see `passthroughApps`'s
-* doc comment for why that is more than just wasted work).
-*/
-/**
-* Where the last answer per task is kept.
-*
-* Under `node_modules/.cache` rather than a dotfile at the root: it is a
-* convenience, not configuration, and losing it to a reinstall costs one extra
-* keystroke. Putting it there also means no new `.gitignore` entry and no new
-* file in the listing every contributor sees.
-*/
-function memoryPath() {
-	return join(findRepoRoot(), "node_modules", ".cache", "devdogs", "tasks.json");
-}
-/**
-* pnpm's own ways of naming packages, plus `--scope` for backward
-* compatibility with anyone who still types the old flag out of habit.
-* Any of them means "already decided" for `shouldAsk`; `--scope`'s value is
-* translated into a `--filter` when a command actually gets built, since pnpm
-* itself has no `--scope` flag.
-*/
-const FILTERS = [
-	"--filter",
-	"-F",
-	"--scope"
-];
-/**
-* Tasks that need the packages a target depends on built first. Everything
-* else forwarded through `run` (`generate-types`, and any package script not
-* in this list) needs no dependency build, and nothing else is routed through
-* the root aliases this picker serves.
-*/
-const NEEDS_DEPS_BUILT = /* @__PURE__ */ new Set([
-	"build",
-	"dev",
-	"typecheck",
-	"lint",
-	"lint:fix",
-	"test"
-]);
-/** The workspace root an app lives in: `<root>/apps/<name>` gives `<root>`. */
-function workspaceRootOfApp(dir) {
-	return dirname(dirname(dir));
-}
-/**
-* Splits `filters` by the workspace that holds the app each one names. From a
-* Backstage checkout `schedule-builder` belongs to DevDogsUGA's workspace, and
-* a `pnpm --filter` run from Backstage's root would match nothing. A filter
-* naming no known app (a glob, a path) stays with the repo you are in. No
-* filters means the whole workspace of the repo you are in.
-*/
-function groupFiltersByRoot(filters, apps = appsWith(), repoRoot = findRepoRoot()) {
-	const groups = /* @__PURE__ */ new Map([[repoRoot, []]]);
-	for (const filter of filters) {
-		const root = apps.find((app) => app.name === filter)?.root ?? repoRoot;
-		const group = groups.get(root) ?? [];
-		group.push(filter);
-		groups.set(root, group);
-	}
-	if (filters.length > 0 && groups.get(repoRoot)?.length === 0) groups.delete(repoRoot);
-	return groups;
+//#region src/script/pick.ts
+/** Packages with a name and at least one script, in workspace order. */
+function runnablePackages(packages) {
+	return packages.flatMap((pkg) => pkg.name && Object.keys(pkg.scripts).length > 0 ? [{
+		name: pkg.name,
+		dir: pkg.dir,
+		scripts: pkg.scripts
+	}] : []);
 }
-/**
-* Runs one `pnpm` invocation to completion, reporting its own exit the way
-* `passthroughApps` needs to: it returns to keep going, and exits the process
-* on a non-zero status or when it is the final command.
-*
-* `pnpm` resolves from the workspace root's `node_modules/.bin`, which is
-* already on PATH. It runs through the process-group runner, so a Ctrl-C (or a
-* closed terminal) stops the dev server and everything it started rather than
-* orphaning vinext and workerd, and the exit status comes back as a shell would
-* report it (`128 + n` for a signal). The command that ran is printed after it
-* finishes.
-*
-* ⚠️ `cwd` is explicit, and must be. Reached through
-* `pnpm --filter @devdogsuga/devtools run cli`, this process starts in
-* `packages/devtools`, and a `pnpm -r`/`--filter` invoked there would scope
-* itself relative to that one package rather than the workspace root.
-*/
-async function runOne({ args, cwd }, extraEnv, { final }) {
-	const result = await runInGroup("pnpm", args, {
-		cwd,
-		env: {
-			...process.env,
-			...extraEnv,
-			DEVDOGS_PICK: "0"
-		}
-	});
-	reportRan("pnpm", args, result);
-	if (result.code !== 0 || final) process.exit(result.code);
+/** Every script name and how many packages define it, most common first. */
+function scriptNames(packages) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const pkg of packages) for (const script of Object.keys(pkg.scripts)) counts.set(script, (counts.get(script) ?? 0) + 1);
+	return [...counts].map(([script, count]) => ({
+		script,
+		count
+	})).sort((a, b) => b.count - a.count || a.script.localeCompare(b.script));
 }
-/**
-* Runs a sequence of `pnpm` invocations — typically "build the dependencies",
-* then "run the actual task" — stopping (and exiting non-zero) at the first
-* one that fails, and exiting with the LAST one's status otherwise. This is
-* what makes a dependency build failure and a task failure look identical
-* from the outside: the second spawn is never reached if the first one failed.
-*
-* Never returns: `runOne` exits on a failure and on the final command.
-*/
-async function passthrough(commands, extraEnv) {
-	for (const [index, command] of commands.entries()) await runOne(command, extraEnv, { final: index === commands.length - 1 });
-	process.exit(1);
+/** The packages that define `script`. */
+function packagesWith(packages, script) {
+	return packages.filter((pkg) => script in pkg.scripts);
 }
 /**
-* Whether to ask at all.
-*
-* Every one of these is a case where a prompt is either impossible or wrong:
-*
-*   * `CI`, set by GitHub Actions and every other runner. No workflow reaches
-*     this today (see the header), but a workflow that blocked on a
-*     multiselect would hang until its timeout with no output saying why, and
-*     that failure is bad enough to keep guarding against.
-*   * No TTY: a pipe, a `pnpm` invoked by a script, an editor task runner.
-*     Nobody is there to answer. Every other picker in this repo checks the
-*     same thing.
-*   * An explicit filter. The caller has already said which packages, and
-*     asking again would be asking them to repeat themselves.
-*   * `DEVDOGS_PICK=0`, the escape hatch and the recursion guard above.
+* Finds a package from what somebody typed: its exact name, its directory, or
+* the last segment of its name (`platform` for `@devdogsuga/platform`).
+* `null` when nothing matches or when the short form is ambiguous.
 */
-function shouldAsk(args) {
-	if (process.env.CI) return false;
-	if (process.env.DEVDOGS_PICK === "0") return false;
-	if (!process.stdin.isTTY) return false;
-	return !args.some((arg) => FILTERS.includes(arg) || FILTERS.some((f) => arg.startsWith(`${f}=`)));
+function findPackage(packages, typed) {
+	const exact = packages.find((pkg) => pkg.name === typed || pkg.dir === typed);
+	if (exact) return exact;
+	const short = packages.filter((pkg) => pkg.name.split("/").pop() === typed);
+	return short.length === 1 ? short[0] : null;
+}
+/** The arguments `pnpm` gets: `-F <package> run <script> [extra…]`. */
+function scriptArgs(pkg, script, extra = []) {
+	return [
+		"-F",
+		pkg.name,
+		"run",
+		script,
+		...extra
+	];
 }
+//#endregion
+//#region src/script/commands.ts
 /**
-* Pulls every `--filter`/`-F`/`--scope` value out of `args`, returning the
-* package patterns named and the remaining args with those flags removed.
-*
-* `--scope` is folded into the same bucket as `--filter` here: pnpm has no
-* `--scope` flag of its own, so a caller who still types the old name
-* gets it translated into a real `--filter` value rather than passed through
-* to a `pnpm` invocation that would reject it outright.
-*
-* Exported for the same reason `parseTierArg` is: pure, no `process.exit`, so
-* it is unit-testable without going through `passthrough`.
-*/
-function extractFilters(args) {
-	const filters = [];
-	const rest = [];
-	for (let i = 0; i < args.length; i++) {
-		const arg = args[i];
-		const eqFlag = FILTERS.find((f) => arg.startsWith(`${f}=`));
-		if (eqFlag) {
-			filters.push(arg.slice(eqFlag.length + 1));
-			continue;
-		}
-		if (FILTERS.includes(arg)) {
-			const value = args[i + 1];
-			if (value !== void 0) {
-				filters.push(value);
-				i++;
-				continue;
-			}
-		}
-		rest.push(arg);
-	}
-	return {
-		filters,
-		rest
-	};
-}
-/**
-* Every `apps/*` package name, regardless of whether it defines the task in
-* question — unlike `appsWith`, which is a picker concern (only offer apps
-* that actually have this script). This exists for exactly one thing: naming
-* "every dependency any app has" without hand-listing packages, since apps
-* are the only packages in this workspace nothing else depends on (every
-* `packages/*`/`docs` package is reachable from at least one app's
-* dependency graph, and no app depends on another app).
-*/
-function allAppNames(root = findRepoRoot()) {
-	const names = [];
-	for (const app of appManifests(root)) if (app.pkg.name) names.push(app.pkg.name);
-	return names;
-}
-/**
-* The parsed `package.json` of every app in the repo you are in, plus DevDogsUGA's
-* from a Backstage checkout (`repo/layout.ts`). With `root`, only that
-* workspace's. An unparsable manifest is one we cannot use, so it is skipped.
-*/
-function appManifests(root) {
-	const found = [];
-	for (const app of listApps(resolveLayout())) {
-		const appRoot = workspaceRootOfApp(app.dir);
-		if (root !== void 0 && appRoot !== root) continue;
-		const manifest = join(app.dir, "package.json");
-		if (!existsSync(manifest)) continue;
-		try {
-			found.push({
-				root: appRoot,
-				pkg: JSON.parse(readFileSync(manifest, "utf8"))
-			});
-		} catch {}
-	}
-	return found;
-}
-/**
-* Builds the `pnpm run <task>` invocation(s) for a set of package filters (or
-* none, for the whole workspace) and runs them via `passthrough`.
-*
-* Two spawns for a task in `NEEDS_DEPS_BUILT`: one that builds only the
-* dependencies of the target packages, then one that runs the real task
-* against the target packages themselves. A task outside `NEEDS_DEPS_BUILT`
-* skips straight to the second spawn.
-*
-* The first spawn's filter set matters more than it looks: it must build
-* every dependency the target packages need, and NOTHING ELSE — never an
-* app's own `build` script, since a dependency build never includes the target's own
-* (typechecking `platform` built platform's DEPENDENCIES, then ran
-* `platform`'s `typecheck` script; it never ran `platform`'s own `build`).
-* Getting this wrong is not just wasted work: an app's `build` script can
-* need things a `typecheck`/`lint`/`test` run has no reason to have (a
-* database, a chosen deploy tier, a Flutter SDK on PATH), so running one
-* unasked can fail outright.
-*
-*   * Filtered (`filters` non-empty): `<pkg>^...` per filter — pnpm's
-*     deps-of selector, excluding the package itself.
-*   * Whole workspace: the union of `<app>^...` over every app in the
-*     workspace (`allAppNames()`), NOT a bare `pnpm -r run build`. A bare
-*     recursive build would build every package with a `build` script,
-*     apps included, for exactly the reason above. Every non-app package in
-*     this workspace is reachable from at least one app's dependency graph
-*     (verified against every current `apps/*` package, not assumed), so
-*     this covers the same ground a bare `-r` would minus the apps
-*     themselves.
-*
-* `dev` is the one persistent task and runs with `--parallel`: pnpm's
-* ordinary recursive mode runs one package at a time in dependency order,
-* which is wrong for two dev servers that are each supposed to keep running
-* — `--parallel` "completely disregard[s] concurrency and topological
-* sorting, running a given script immediately in all matching packages with
-* prefixed streaming output" (pnpm's own words for the flag), which is
-* exactly the live, interleaved multi-app output a dev run wants. Every other
-* task keeps pnpm's default topological/serial recursion: independent tasks
-* (lint, typecheck, test across several apps) run one package at a time.
-* Slower on a multi-app selection, never wrong.
-*
-* `build` with no filter (the whole workspace) is the one case that skips
-* the separate dependency spawn even though it is in `NEEDS_DEPS_BUILT`: a
-* bare `pnpm -r run build` already builds every package — apps included, and
-* rightly so, since the task itself IS `build` — in dependency order in one
-* pass, so a preceding dependency-only spawn would just redo part of it. A
-* FILTERED build still needs the pre-step — naming a package by itself,
-* with no `^...`, selects only that package, not what it depends on.
-*/
-async function passthroughApps(task, filters, rest, extraEnv) {
-	const commands = [];
-	for (const [cwd, groupFilters] of groupFiltersByRoot(filters)) {
-		if (NEEDS_DEPS_BUILT.has(task) && (task !== "build" || filters.length > 0)) {
-			const depsFilters = (groupFilters.length > 0 ? groupFilters : allAppNames(cwd)).flatMap((f) => ["--filter", `${f}^...`]);
-			commands.push({
-				args: [
-					"-r",
-					"--if-present",
-					...depsFilters,
-					"run",
-					"build"
-				],
-				cwd
-			});
-		}
-		const ownFilters = groupFilters.flatMap((f) => ["--filter", f]);
-		const parallel = task === "dev" ? ["--parallel"] : [];
-		commands.push({
-			args: [
-				"-r",
-				"--if-present",
-				...parallel,
-				...ownFilters,
-				"run",
-				task,
-				...rest
-			],
-			cwd
-		});
-	}
-	return passthrough(commands, extraEnv);
-}
-/** A `dev` script that starts `vinext dev` (platform's `with-env vinext dev`). */
-const VINEXT_DEV = /(^|[\s;&|])vinext\s+dev\b/;
-/**
-* Splits a `dev` run between apps whose dev server is `vinext dev` and the
-* rest.
-*
-* A vinext app's server code runs in workerd, which only sees what
-* `@cloudflare/vite-plugin` hands it: the app dir's own `.dev.vars`/`.env`, or
-* with `CLOUDFLARE_INCLUDE_PROCESS_ENV` the whole `process.env`. The repo's
-* `.env` is at the root, so through the app's own `with-env vinext dev` script
-* the Worker gets nothing and env validation fails. So a vinext app skips its
-* script and runs `pnpm --filter <app> exec vinext dev` with the env
-* `scopedProcessEnv` builds, the same way `jobs run` starts one: the
-* flag set, and every other app's variables left out. Its script's own
-* `with-env` would load the whole `.env` back in, so it is not used.
-*
-* Everything else still runs its own `dev` script under one `pnpm --parallel`.
-* `apps` is every app with a `dev` script; `filters` the selection (empty for
-* all of them). Only apps are named here: no other package has a `dev`
-* script.
-*/
-function planDev(apps, filters, rest) {
-	const vinext = (filters.length > 0 ? apps.filter((app) => filters.includes(app.name)) : [...apps]).filter((app) => VINEXT_DEV.test(app.script)).map((app) => app.name);
-	const otherFilters = filters.length > 0 ? filters.filter((f) => !vinext.includes(f)) : apps.map((app) => app.name).filter((name) => !vinext.includes(name));
-	return {
-		vinext,
-		others: otherFilters.length > 0 ? [
-			"-r",
-			"--if-present",
-			"--parallel",
-			...otherFilters.flatMap((f) => ["--filter", f]),
-			"run",
-			"dev",
-			...rest
-		] : null
-	};
-}
-/**
-* `dev` when at least one selected app runs `vinext dev`: builds every
-* selected app's workspace dependencies, then starts the vinext apps (each
-* with its own scoped env, see `planDev`) and the rest side by side, and
-* exits when the first of them does, stopping the others.
-*
-* The env is the session's: `launch.ts` has already entered the tier into
-* `process.env` (or `--tier` loaded one into `tierEnv`).
-*/
-async function runDev(plan, filters, rest, tierEnv, root) {
-	await runOne({
-		args: [
-			"-r",
-			"--if-present",
-			...(filters.length > 0 ? filters : allAppNames(root)).flatMap((f) => ["--filter", `${f}^...`]),
-			"run",
-			"build"
-		],
-		cwd: root
-	}, tierEnv, { final: false });
-	const { scopedProcessEnv } = await import("./local-env-MqH18s-N.js");
-	const environment = {
-		...process.env,
-		...tierEnv
-	};
-	const tier = environment.DEPLOY_ENV ?? "development";
-	const children = [...await Promise.all(plan.vinext.map(async (app) => ({
-		args: [
-			"--filter",
-			app,
-			"exec",
-			"vinext",
-			"dev",
-			...rest
-		],
-		env: isDryRun() ? environment : await scopedProcessEnv(app, environment, tier)
-	}))), ...plan.others ? [{
-		args: plan.others,
-		env: environment
-	}] : []];
-	const stop = new AbortController();
-	let first;
-	const runs = children.map(async ({ args, env }) => {
-		const result = await runInGroup("pnpm", args, {
-			cwd: root,
-			env: {
-				...env,
-				DEVDOGS_PICK: "0"
-			},
-			abort: stop.signal
-		});
-		reportRan("pnpm", args, result);
-		first ??= result.code;
-		stop.abort();
-	});
-	await Promise.all(runs);
-	process.exit(first ?? 1);
-}
-/** `passthroughApps`, except that a `dev` selecting a vinext app goes to
-* `runDev`. */
-async function dispatch$1(task, filters, rest, tierEnv) {
-	if (task === "dev") {
-		const groups = groupFiltersByRoot(filters);
-		if (groups.size > 1) {
-			process.stderr.write("devtools run: dev servers from DevDogsUGA and Backstage cannot be started together; start them from their own checkouts.\n");
-			process.exit(1);
-		}
-		const root = [...groups.keys()][0];
-		const plan = planDev(appsWith("dev", root), filters, rest);
-		if (plan.vinext.length > 0) return runDev(plan, filters, rest, tierEnv, root);
-	}
-	return passthroughApps(task, filters, rest, tierEnv);
-}
-/** The tiers a loaded env can select. `preflight` is not a deploy environment
-* (see `@devdogsuga/env`'s target table) and is refused here for the same
-* reason `loadEnvironment` itself would refuse it. */
-const RUN_TIERS = /* @__PURE__ */ new Set([
-	"development",
-	"staging",
-	"production"
-]);
-/**
-* Parses and strips `--tier <value>` from pnpm-bound args, mirroring the
-* `--all` strip above.
-*
-* Pure on purpose — no `process.exit` — so this is unit-testable without
-* going through `passthrough`, which every other path in this file ends at
-* and which a test cannot observe return from. `runTask` is the one caller,
-* and it is the one that turns `error` into an exit.
-*/
-function parseTierArg(args) {
-	const idx = args.indexOf("--tier");
-	if (idx === -1) return { rest: [...args] };
-	const value = args[idx + 1];
-	if (!value || value.startsWith("-")) return {
-		rest: [...args],
-		error: "devtools run: --tier requires a value."
-	};
-	if (!RUN_TIERS.has(value)) return {
-		rest: [...args],
-		error: `devtools run: unknown tier "${value}". Expected: development, staging, production.`
-	};
-	return {
-		tier: value,
-		rest: [...args.slice(0, idx), ...args.slice(idx + 2)]
-	};
-}
-/**
-* The apps that actually define this task, by package name.
-*
-* `apps/*` only. Packages are libraries an app pulls in, and a filtered
-* `pnpm -r --filter '<app>^...' run build` already builds those first (see
-* `passthroughApps` above), so listing all twelve would ask about things the
-* answer does not change. Reading each `package.json` rather than shelling
-* out to a dry-run equivalent, which costs about a second before the first
-* question.
-*/
-function appsWith(task, root) {
-	const found = [];
-	for (const app of appManifests(root)) {
-		const script = task === void 0 ? "" : app.pkg.scripts?.[task];
-		if (app.pkg.name && (task === void 0 || script)) found.push({
-			name: app.pkg.name,
-			script: script ?? "",
-			root: app.root
-		});
-	}
-	return found;
-}
-function remembered(task) {
-	try {
-		return JSON.parse(readFileSync(memoryPath(), "utf8"))[task] ?? [];
-	} catch {
-		return [];
-	}
-}
-function remember(task, apps) {
-	try {
-		let all = {};
-		try {
-			all = JSON.parse(readFileSync(memoryPath(), "utf8"));
-		} catch {}
-		all[task] = apps;
-		mkdirSync(dirname(memoryPath()), { recursive: true });
-		writeFileSync(memoryPath(), `${JSON.stringify(all, null, 2)}\n`);
-	} catch {}
-}
-/** Groups every use of `run` into one Sentry issue, whatever the script. */
-const RUN_ALIAS_FINGERPRINT = "devtools-run-alias";
-/**
-* What replaces `run <task>`, as the line printed before it runs.
-*
-* `run` is a deprecated alias: branches behind main still call it. It says
-* what to type instead (`pnpm -r run <task>` for every package,
-* `pnpm -F <app> <task>` for one) and then does the job as before.
-*/
-function runAliasMessage(task) {
-	return `devtools run is deprecated. Use \`pnpm -r run ${task}\` for every package, or \`pnpm -F <app> ${task}\` for one app.`;
-}
-/**
-* Prints the replacement and reports the use. Each use sends one
-* warning-level Sentry message with a fixed fingerprint, tagged with the
-* script and local or CI, so the alias can be removed once that issue stops
-* receiving events (TASK-404).
-*/
-async function announceRunAlias(task) {
-	process.stderr.write(`${runAliasMessage(task)}\n`);
-	if (isDryRun()) return;
-	await captureDevtoolsDeprecation("devtools run is deprecated", RUN_ALIAS_FINGERPRINT, {
-		script: task,
-		mode: devtoolsEnvironment()
-	});
-}
-/**
-* Runs one root task, asking which apps first where that makes sense.
-*
-* Never returns: every path ends in `passthrough`, which exits with the
-* underlying `pnpm` invocation's own status. That is why `cli.ts` dispatches
-* this before `intro()`. There is no `outro()` to reach, and a banner would
-* land on the stream a dev server is about to take over.
-*/
-async function runTask(argv) {
-	const [task, ...args] = argv;
-	if (!task) {
-		console.error("usage: pnpm devtools run <task> [pnpm args…]");
-		process.exit(1);
-	}
-	await announceRunAlias(task);
-	const all = args.includes("--all");
-	const tierArg = parseTierArg(args.filter((arg) => arg !== "--all"));
-	if (tierArg.error) {
-		console.error(tierArg.error);
-		process.exit(1);
-	}
-	const { tier, rest } = tierArg;
-	if (tier === "production" && !isDryRun()) {
-		if (!process.stdin.isTTY) {
-			console.error("devtools run: --tier production needs a terminal to confirm — nothing ran.");
-			process.exit(1);
-		}
-		const approved = await confirm({
-			message: `Run \`${task}\` against production? This loads .env.production's credentials into the child process.`,
-			initialValue: false
-		});
-		if (isCancel(approved) || !approved) {
-			cancel("Nothing ran.");
-			process.exit(0);
-		}
-	}
-	let tierEnv;
-	if (tier) {
-		const { loadEnvironment, MissingEnvFileError } = await loadEnvLoad();
-		try {
-			tierEnv = {
-				...(await loadEnvironment(tier, { override: true })).env,
-				DEPLOY_ENV: tier
-			};
-		} catch (err) {
-			if (err instanceof MissingEnvFileError) {
-				console.error(`devtools run: ${err.message}`);
-				process.exit(1);
-			}
-			throw err;
-		}
-	}
-	if (all || !shouldAsk(rest)) {
-		const { filters, rest: cleanRest } = extractFilters(rest);
-		return dispatch$1(task, filters, cleanRest, tierEnv);
-	}
-	const apps = appsWith(task);
-	if (apps.length < 2) return dispatch$1(task, [], rest, tierEnv);
-	const previous = remembered(task);
-	const chosen = await multiselect({
-		message: `\`${task}\` — which apps? (a selects all; --all runs every package)`,
-		options: apps.map((app) => ({
-			value: app.name,
-			label: app.name,
-			hint: app.script.length > 58 ? `${app.script.slice(0, 57)}…` : app.script
-		})),
-		initialValues: previous.filter((name) => apps.some((app) => app.name === name)),
-		required: true
-	});
-	if (isCancel(chosen)) {
-		cancel("Nothing ran.");
-		process.exit(0);
-	}
-	if (!isDryRun()) remember(task, chosen);
-	return dispatch$1(task, chosen, rest, tierEnv);
-}
-//#endregion
-//#region src/script/pick.ts
-/** Packages with a name and at least one script, in workspace order. */
-function runnablePackages(packages) {
-	return packages.flatMap((pkg) => pkg.name && Object.keys(pkg.scripts).length > 0 ? [{
-		name: pkg.name,
-		dir: pkg.dir,
-		scripts: pkg.scripts
-	}] : []);
-}
-/** Every script name and how many packages define it, most common first. */
-function scriptNames(packages) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const pkg of packages) for (const script of Object.keys(pkg.scripts)) counts.set(script, (counts.get(script) ?? 0) + 1);
-	return [...counts].map(([script, count]) => ({
-		script,
-		count
-	})).sort((a, b) => b.count - a.count || a.script.localeCompare(b.script));
-}
-/** The packages that define `script`. */
-function packagesWith(packages, script) {
-	return packages.filter((pkg) => script in pkg.scripts);
-}
-/**
-* Finds a package from what somebody typed: its exact name, its directory, or
-* the last segment of its name (`platform` for `@devdogsuga/platform`).
-* `null` when nothing matches or when the short form is ambiguous.
-*/
-function findPackage(packages, typed) {
-	const exact = packages.find((pkg) => pkg.name === typed || pkg.dir === typed);
-	if (exact) return exact;
-	const short = packages.filter((pkg) => pkg.name.split("/").pop() === typed);
-	return short.length === 1 ? short[0] : null;
-}
-/** The arguments `pnpm` gets: `-F <package> run <script> [extra…]`. */
-function scriptArgs(pkg, script, extra = []) {
-	return [
-		"-F",
-		pkg.name,
-		"run",
-		script,
-		...extra
-	];
-}
-//#endregion
-//#region src/script/commands.ts
-/**
-* `devtools script [<package> <script> [args…]]`: the package-script picker.
+* `devtools script [<package> <script> [args…]]`: the package-script picker.
 *
 * Typed with a package and a script it runs them; with nothing, it asks. The
 * choice is made against the real `package.json` scripts, so there is no list
@@ -6528,7 +6762,7 @@ function readPnpmPin(repoRoot) {
 		return null;
 	}
 }
-async function runSetup() {
+async function runSetup$1() {
 	const checks = [];
 	const node = process.versions.node;
 	const [major = 0, minor = 0] = node.split(".").map(Number);
@@ -6717,10 +6951,1322 @@ async function promptSecretValue(doc, key, label) {
 	})).trim();
 }
 const handleSetup = async () => {
-	await runSetup();
+	await runSetup$1();
 	return DONE;
 };
 //#endregion
+//#region ../sdk/dist/constants/generated.js
+const OAUTH = {
+	"providerId": "custom:devdogsuga",
+	"providerName": "DevDogs",
+	"scopes": [
+		"openid",
+		"email",
+		"profile"
+	],
+	"tiers": ["development", "production"],
+	"authPath": "/auth/v1",
+	"discoveryPath": "/auth/v1/.well-known/openid-configuration",
+	"callbackPath": "/auth/v1/callback"
+};
+//#endregion
+//#region src/product/exec.ts
+const spawnRunner = (command, args, options) => new Promise((resolve, reject) => {
+	const child = spawn(command, [...args], {
+		cwd: options.cwd,
+		env: {
+			...process.env,
+			...options.env
+		},
+		stdio: options.inherit ? "inherit" : [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	let stdout = "";
+	let stderr = "";
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString("utf8");
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr += chunk.toString("utf8");
+	});
+	child.on("error", reject);
+	child.on("close", (code) => {
+		resolve({
+			code: code ?? 1,
+			stdout,
+			stderr
+		});
+	});
+});
+/** `command arg arg`, quoted only where a shell would need it. For messages. */
+function commandLine(command, args) {
+	return [command, ...args].map((part) => /^[\w@%+=:,./-]+$/.test(part) ? part : JSON.stringify(part)).join(" ");
+}
+//#endregion
+//#region src/product/supabase-cli.ts
+/**
+* Finding the Supabase CLI a product is pinned to.
+*
+* A product repo may have no `package.json` (DogPack has none), so the CLI
+* cannot be assumed to be a dependency. In order:
+*
+*   1. `node_modules/.bin/supabase` in the repo, when its version is the pin;
+*   2. a `supabase` on PATH whose version is the pin;
+*   3. `npx --yes supabase@<pin>`, which downloads and caches the right one.
+*
+* The pin is also part of the generated-types hash, so a contributor on a
+* different CLI would generate different types than CI; matching it is not
+* cosmetic.
+*/
+function cliLine(cli, args) {
+	return commandLine(cli.command, [...cli.prefix, ...args]);
+}
+function versionOf(output) {
+	return /\b(\d+\.\d+\.\d+)\b/.exec(output)?.[1] ?? null;
+}
+async function resolveSupabaseCli(root, pin, run, fileExists = existsSync) {
+	const candidates = [];
+	const local = join(root, "node_modules", ".bin", "supabase");
+	if (fileExists(local)) candidates.push({
+		command: local,
+		prefix: [],
+		source: "repo"
+	});
+	candidates.push({
+		command: "supabase",
+		prefix: [],
+		source: "path"
+	});
+	for (const candidate of candidates) try {
+		const result = await run(candidate.command, ["--version"], { cwd: root });
+		if (result.code === 0 && versionOf(result.stdout) === pin) return candidate;
+	} catch {}
+	return {
+		command: "npx",
+		prefix: ["--yes", `supabase@${pin}`],
+		source: "npx"
+	};
+}
+//#endregion
+//#region src/product/target.ts
+const TOOLING_KEYS = {
+	/** `local` or `hosted`: what `setup` last chose. Wins over everything else. */
+	target: "DEVTOOLS_TARGET",
+	dbUrl: "DB_URL",
+	secretKey: "SECRET_KEY",
+	accessToken: "SUPABASE_ACCESS_TOKEN"
+};
+var TargetError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TargetError";
+	}
+};
+/** The project ref or vanity name in a Supabase URL or pooler URL, if it has one. */
+function projectNameOf(url) {
+	try {
+		const { hostname, username } = new URL(url);
+		const fromHost = /^([a-z0-9-]+)\.supabase\.co$/.exec(hostname)?.[1];
+		if (fromHost) return fromHost;
+		const fromUser = /^postgres\.([a-z0-9]+)$/.exec(username)?.[1];
+		if (fromUser) return fromUser;
+		return /^db\.([a-z0-9]+)\.supabase\.co$/.exec(hostname)?.[1] ?? null;
+	} catch {
+		return null;
+	}
+}
+/** Refuses a URL that names one of the product's production projects. */
+function assertNotProduction(product, ...urls) {
+	const production = new Set(product.config.production.projects);
+	for (const url of urls) {
+		const name = projectNameOf(url);
+		if (name !== null && production.has(name)) throw new TargetError(`${url} is ${product.config.name}'s production project (${name}). devtools only acts on your own development project or the local Docker stack.`);
+	}
+}
+/** Reads `supabase status -o env` for the running local stack. */
+async function localTarget(product, cli, run) {
+	const args = [
+		...cli.prefix,
+		"status",
+		"-o",
+		"env"
+	];
+	const result = await run(cli.command, args, { cwd: product.root });
+	if (result.code !== 0) throw new TargetError(`The local Supabase stack is not running (${cliLine(cli, ["status"])} failed). Start it with \`devtools supabase start\`, or run \`devtools setup\`.`);
+	const env = parse(result.stdout);
+	const apiUrl = env["API_URL"];
+	const dbUrl = env["DB_URL"];
+	const publishableKey = env["PUBLISHABLE_KEY"] ?? env["ANON_KEY"];
+	const secretKey = env["SERVICE_ROLE_KEY"] ?? env["SECRET_KEY"];
+	if (!apiUrl || !dbUrl || !publishableKey || !secretKey) throw new TargetError("`supabase status -o env` did not report the API URL, DB URL and keys. Is the stack fully started?");
+	return {
+		kind: "local",
+		apiUrl,
+		dbUrl,
+		publishableKey,
+		secretKey
+	};
+}
+/** The contributor's own hosted project, from `.env` and `.env.tooling`. */
+function hostedTarget(product) {
+	const pub = readEnvFile(product.paths.envFile);
+	const tooling = readEnvFile(product.paths.toolingFile);
+	const { keys } = product.config.env;
+	const apiUrl = pub[keys.url];
+	const publishableKey = pub[keys.publishableKey];
+	const dbUrl = tooling[TOOLING_KEYS.dbUrl];
+	const secretKey = tooling[TOOLING_KEYS.secretKey];
+	const missing = [
+		[
+			keys.url,
+			apiUrl,
+			product.config.env.file
+		],
+		[
+			keys.publishableKey,
+			publishableKey,
+			product.config.env.file
+		],
+		[
+			TOOLING_KEYS.dbUrl,
+			dbUrl,
+			product.config.env.tooling
+		],
+		[
+			TOOLING_KEYS.secretKey,
+			secretKey,
+			product.config.env.tooling
+		]
+	].filter(([, value]) => !value);
+	if (missing.length > 0 || !apiUrl || !publishableKey || !dbUrl || !secretKey) throw new TargetError(`A hosted project needs ${missing.map(([key, , file]) => `${String(key)} (in ${String(file)})`).join(", ")}. Run \`devtools setup --hosted\`.`);
+	assertNotProduction(product, apiUrl, dbUrl);
+	return {
+		kind: "hosted",
+		apiUrl,
+		dbUrl,
+		publishableKey,
+		secretKey
+	};
+}
+/**
+* `--local` or `--hosted` if given; else what `setup` recorded in
+* `.env.tooling`; else hosted when that file carries a `DB_URL` (the
+* contributor chose their own project) and the local stack when it does not.
+*/
+function chooseKind(product, preference) {
+	if (preference) return preference;
+	const tooling = readEnvFile(product.paths.toolingFile);
+	const recorded = tooling[TOOLING_KEYS.target];
+	if (recorded === "local" || recorded === "hosted") return recorded;
+	return tooling[TOOLING_KEYS.dbUrl] ? "hosted" : "local";
+}
+async function resolveTarget(product, cli, run, preference) {
+	return chooseKind(product, preference) === "hosted" ? hostedTarget(product) : localTarget(product, cli, run);
+}
+//#endregion
+//#region src/product/dev-data.ts
+/**
+* `dev-data`: fill a development database with believable rows (DogPack's fake
+* hosts, and open, full and past sessions for the member's own courses).
+*
+* The product supplies the SQL (`devData.file`); devtools supplies who to
+* run it for. The file reads the signed-in member from a session setting:
+*
+* ```sql
+* select current_setting('devtools.member_id')::uuid;
+* ```
+*
+* `devtools.member_id` is the Supabase `auth.users` id of the member, found as
+* the most recent sign-in through "Sign in with DevDogs" unless `--member`
+* names someone. Nothing is seeded until someone has signed in, which is why
+* this is a command run afterwards and not part of `setup`.
+*
+* It refuses any database that is not the local stack or the contributor's own
+* project, and the SQL runs in one transaction.
+*/
+var DevDataError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "DevDataError";
+	}
+};
+function postgresSession(dbUrl) {
+	const sql = postgres(dbUrl, {
+		max: 1,
+		onnotice: () => void 0
+	});
+	return {
+		async members(provider) {
+			return (await sql`
+        select u.id, u.email, u.last_sign_in_at
+        from auth.users u
+        join auth.identities i on i.user_id = u.id
+        where i.provider = ${provider}
+        order by u.last_sign_in_at desc nulls last
+        limit 5`).map((r) => ({
+				id: r.id,
+				email: r.email,
+				lastSignInAt: r.last_sign_in_at?.toISOString() ?? null
+			}));
+		},
+		async memberByRef(ref) {
+			const row = (await sql`
+        select id, email, last_sign_in_at from auth.users
+        where id::text = ${ref} or lower(email) = lower(${ref})
+        limit 1`)[0];
+			return row ? {
+				id: row.id,
+				email: row.email,
+				lastSignInAt: row.last_sign_in_at?.toISOString() ?? null
+			} : null;
+		},
+		async runAs(memberId, text) {
+			await sql.begin(async (tx) => {
+				await tx`select set_config('devtools.member_id', ${memberId}, true)`;
+				await tx.unsafe(text);
+			});
+		},
+		close: () => sql.end({ timeout: 5 })
+	};
+}
+async function runDevData(product, target, open, options) {
+	const log = options.log ?? (() => void 0);
+	const { devData } = product.config;
+	if (!devData) throw new DevDataError(`${product.config.name} has no dev data: add "devData": { "file": "supabase/dev-data.sql" } to devtools.config.json.`);
+	try {
+		assertNotProduction(product, target.apiUrl, target.dbUrl);
+	} catch (err) {
+		if (err instanceof TargetError) throw new DevDataError(err.message);
+		throw err;
+	}
+	const file = join(product.root, devData.file);
+	const text = readFileSync(file, "utf8");
+	const session = open(target.dbUrl);
+	try {
+		const member = options.member ? await session.memberByRef(options.member) : (await session.members(options.provider))[0] ?? null;
+		if (!member) throw new DevDataError(options.member ? `No user matches ${options.member} in this database.` : `Nobody has signed in with DevDogs on this database yet. Start the app, sign in, then run this again (or name someone with --member).`);
+		log(`Seeding as ${member.email ?? member.id} (${member.id})`);
+		if (options.dryRun) {
+			log(`Would run ${devData.file} (${text.split("\n").length} lines) in one transaction.`);
+			return null;
+		}
+		await session.runAs(member.id, text);
+		return {
+			member,
+			file: devData.file
+		};
+	} finally {
+		await session.close();
+	}
+}
+//#endregion
+//#region src/product/management.ts
+/**
+* The two hosted-project auth settings "Sign in with DevDogs" needs and a
+* contributor would otherwise click through the dashboard for:
+*
+*   * `custom_oauth_enabled`: off by default, and GoTrue's custom-provider
+*     endpoint answers 404 "Custom OAuth providers are disabled" until it is
+*     on, so registering `custom:devdogsuga` fails without it;
+*   * `uri_allow_list`: the app's return addresses, which the local stack
+*     reads from `supabase/config.toml` instead.
+*
+* Both are the Management API's `PATCH /v1/projects/{ref}/config/auth`, with a
+* personal access token (`SUPABASE_ACCESS_TOKEN`, from the dashboard's Access
+* Tokens page). Without a token `setup` prints the two dashboard steps.
+*/
+const API = "https://api.supabase.com";
+var ManagementError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "ManagementError";
+	}
+};
+/** The project ref in `https://<ref>.supabase.co`, or null for a custom domain or local URL. */
+function projectRefOf(apiUrl) {
+	try {
+		return /^([a-z0-9]{20})\.supabase\.co$/.exec(new URL(apiUrl).hostname)?.[1] ?? null;
+	} catch {
+		return null;
+	}
+}
+/** The allow list with `wanted` added, keeping what was there; comma-separated as GoTrue stores it. */
+function mergeAllowList(current, wanted) {
+	const entries = (current ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+	for (const uri of wanted) if (!entries.includes(uri)) entries.push(uri);
+	return entries.join(",");
+}
+async function ensureHostedAuthSettings(input) {
+	const doFetch = input.fetch ?? fetch;
+	const headers = {
+		authorization: `Bearer ${input.token}`,
+		"content-type": "application/json"
+	};
+	const url = `${API}/v1/projects/${input.projectRef}/config/auth`;
+	const current = await doFetch(url, { headers });
+	if (!current.ok) throw new ManagementError(current.status === 401 || current.status === 403 ? "The Supabase access token was refused. Create one at https://supabase.com/dashboard/account/tokens." : `Reading the project's auth settings failed (${current.status}).`, current.status);
+	const settings = await current.json();
+	const patch = {};
+	const changed = [];
+	if (settings.custom_oauth_enabled !== true) {
+		patch["custom_oauth_enabled"] = true;
+		changed.push("custom_oauth_enabled");
+	}
+	const allow = mergeAllowList(settings.uri_allow_list, input.redirectUris);
+	if (allow !== (settings.uri_allow_list ?? "")) {
+		patch["uri_allow_list"] = allow;
+		changed.push("uri_allow_list");
+	}
+	if (changed.length === 0) return { changed };
+	const response = await doFetch(url, {
+		method: "PATCH",
+		headers,
+		body: JSON.stringify(patch)
+	});
+	if (!response.ok) throw new ManagementError(`Updating the project's auth settings failed (${response.status}).`, response.status);
+	return { changed };
+}
+//#endregion
+//#region src/product/oauth.ts
+/**
+* "Sign in with DevDogs" for a product's development database, without
+* prompts: the non-interactive halves of `devtools oauth`.
+*
+* The wizard (`../oauth/wizard.ts`) is the front door and is what `setup`
+* runs for a person. These two exist for the cases that have no person:
+*
+*   * a fresh-machine or CI run that already holds an OAuth client's id and
+*     secret (`DEVDOGS_OAUTH_CLIENT_ID` / `DEVDOGS_OAUTH_CLIENT_SECRET`);
+*   * `db sync --rebuild`, which resets the local database and with it
+*     `auth.custom_oauth_providers`, so the provider is registered again from
+*     the credentials the wizard saved to the product's `.env.tooling`.
+*/
+var OAuthRegistrationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OAuthRegistrationError";
+	}
+};
+function credentialsFromEnv(env) {
+	const clientId = env["DEVDOGS_OAUTH_CLIENT_ID"];
+	const clientSecret = env["DEVDOGS_OAUTH_CLIENT_SECRET"];
+	if (!clientId || !clientSecret) return null;
+	return {
+		clientId,
+		clientSecret,
+		baseUrl: env["DEVDOGS_OAUTH_BASE_URL"]
+	};
+}
+/** Registers `custom:devdogsuga` on the target with these credentials. */
+async function registerProvider(credentialsFile, target, credentials) {
+	const { issuer } = await fetchIssuerFromAny(credentials.baseUrl ? [credentials.baseUrl] : DEFAULT_API_URLS);
+	const row = await upsertDevDogsProvider({
+		apiUrl: target.apiUrl,
+		serviceRoleKey: target.secretKey
+	}, {
+		identifier: OAUTH.providerId,
+		name: PROVIDER_NAME,
+		clientId: credentials.clientId,
+		clientSecret: credentials.clientSecret,
+		issuer
+	});
+	upsertEnvFile(credentialsFile, {
+		[ENV_KEYS.clientId]: credentials.clientId,
+		[ENV_KEYS.clientSecret]: credentials.clientSecret
+	});
+	return row;
+}
+/** Registers the provider again from what the wizard saved to `.env.tooling`. */
+async function reRegisterSavedProvider(credentialsFile, target) {
+	const saved = readEnvFile(credentialsFile);
+	const clientId = saved[ENV_KEYS.clientId];
+	const clientSecret = saved[ENV_KEYS.clientSecret];
+	if (!clientId || !clientSecret) throw new OAuthRegistrationError(`No saved OAuth client in ${basename(credentialsFile)}, so "Sign in with DevDogs" cannot be registered again automatically. Run \`devtools oauth\`.`);
+	return registerProvider(credentialsFile, target, {
+		clientId,
+		clientSecret,
+		baseUrl: saved[ENV_KEYS.baseUrl]
+	});
+}
+//#endregion
+//#region src/product/schema-hash.ts
+/**
+* The schema hash that names a set of generated types.
+*
+* Generated types are never committed (Q82). CI builds them once per schema
+* change and uploads them to a rolling `generated-types` release; a
+* contributor who cannot (or would rather not) generate them downloads the
+* asset whose name carries the hash of the schema they have checked out. Two
+* checkouts with the same hash have the same types, so the hash must change
+* exactly when the generated output could.
+*
+* It covers:
+*   * every file under `supabase/schemas`, by sorted path (POSIX separators,
+*     relative to the schemas directory) and LF-normalised contents, so a
+*     Windows checkout with CRLF hashes like a Linux one;
+*   * the generator and its version (the pinned Supabase CLI for TypeScript,
+*     supadart for Dart), since a new generator rewrites the output.
+*/
+function listFiles(dir) {
+	if (!existsSync(dir)) return [];
+	const found = [];
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		const path = join(dir, entry.name);
+		if (entry.isDirectory()) found.push(...listFiles(path));
+		else found.push(path);
+	}
+	return found;
+}
+/** The files a hash covers, as POSIX paths relative to the schemas directory, sorted. */
+function schemaFiles(schemasDir) {
+	return listFiles(schemasDir).map((path) => relative(schemasDir, path).split(sep).join("/")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+}
+function normalise(contents) {
+	return Buffer.from(contents.toString("utf8").replace(/\r\n/g, "\n"), "utf8");
+}
+function hashSchemas(schemasDir, generator) {
+	const hash = createHash("sha256");
+	for (const path of schemaFiles(schemasDir)) {
+		hash.update(`file:${path}\0`);
+		hash.update(normalise(readFileSync(join(schemasDir, ...path.split("/")))));
+		hash.update("\0");
+	}
+	hash.update(`generator:${generator}`);
+	return hash.digest("hex");
+}
+/**
+* The generator and version string a product's types come from. For supadart
+* it is the version `pubspec.lock` resolved, else the constraint in
+* `pubspec.yaml`, so a Dart SDK bump that changes the models changes the hash.
+*/
+function generatorFor(product) {
+	const { types, supabase } = product.config;
+	if (types.kind === "typescript") return `supabase@${supabase.version}`;
+	const lock = join(product.root, "pubspec.lock");
+	if (existsSync(lock)) {
+		const match = /^ {2}supadart:\n(?:.*\n)*? {4}version: "([^"]+)"/m.exec(readFileSync(lock, "utf8"));
+		if (match?.[1]) return `supadart@${match[1]}`;
+	}
+	const pubspec = join(product.root, "pubspec.yaml");
+	if (existsSync(pubspec)) {
+		const match = /^\s+supadart:\s*([^\s#]+)/m.exec(readFileSync(pubspec, "utf8"));
+		if (match?.[1]) return `supadart@${match[1]}`;
+	}
+	return "supadart@unknown";
+}
+function schemaHashFor(product) {
+	return hashSchemas(product.paths.schemasDir, generatorFor(product));
+}
+/** The release asset CI uploads for a hash, and `db types --download` looks for. */
+function typesAssetName(product, hash) {
+	return `${product}-types-${hash}.tgz`;
+}
+//#endregion
+//#region src/product/sync.ts
+/**
+* `db sync`: make the contributor's development database match
+* `supabase/schemas/`.
+*
+* The schema files are the source; migrations are not committed in a product
+* (Q9), but the Supabase CLI's declarative flow still works in terms of them,
+* so a local, git-ignored `supabase/migrations/` is the record of what this
+* database has had applied:
+*
+*   1. `supabase db schema declarative sync --no-apply` diffs the schema tree
+*      against that record and writes the difference as a new migration, or
+*      nothing when they already agree. It needs Docker (a shadow database)
+*      but never touches the target.
+*   2. The new migration is applied: `supabase migration up --local` for the
+*      Docker stack, `supabase db push --db-url …` for a hosted project.
+*
+* A hosted project's applied migrations are also in its own history table, so a
+* machine with no local record (a second laptop, a deleted `supabase/migrations/`)
+* restores the record from there first (`supabase migration fetch --db-url`).
+* Without that, the diff would start from an empty database and write the whole
+* schema as one migration, which `db push` rejects as already applied.
+*
+* It never resets the database. A reset wipes `auth.custom_oauth_providers`,
+* which is where "Sign in with DevDogs" is registered (Q83); `--rebuild` is
+* the explicit escape hatch for a database that has drifted from its record,
+* and it registers the provider again afterwards.
+*/
+var SyncError = class extends Error {
+	output;
+	constructor(message, output) {
+		super(message);
+		this.output = output;
+		this.name = "SyncError";
+	}
+};
+/** `DROP TABLE|COLUMN|SCHEMA|TYPE|VIEW`, which loses data or breaks readers; constraints, indexes and policies do not. */
+const DESTRUCTIVE = /\bDROP\s+(?:TABLE|COLUMN|SCHEMA|TYPE|VIEW|MATERIALIZED\s+VIEW|FUNCTION)\b/i;
+function destructiveStatements(sql) {
+	return sql.split(/;\s*(?:\n|$)/).map((statement) => statement.trim()).filter((statement) => DESTRUCTIVE.test(statement.replace(/--.*$/gm, "")));
+}
+function migrationFiles(dir) {
+	return existsSync(dir) ? readdirSync(dir).filter((name) => name.endsWith(".sql")).sort() : [];
+}
+async function dbSync(product, cli, target, run, options) {
+	const log = options.log ?? (() => void 0);
+	const { migrationsDir, schemasDir } = product.paths;
+	if (!existsSync(schemasDir)) throw new SyncError(`${product.config.supabase.dir}/schemas does not exist; there is nothing to sync.`);
+	mkdirSync(migrationsDir, { recursive: true });
+	const generateArgs = [
+		...cli.prefix,
+		"db",
+		"schema",
+		"declarative",
+		"sync",
+		"--no-apply",
+		"--name",
+		"devtools_sync"
+	];
+	const fetchArgs = [
+		...cli.prefix,
+		"migration",
+		"fetch",
+		"--db-url",
+		target.dbUrl
+	];
+	const needsRecord = target.kind === "hosted" && migrationFiles(migrationsDir).length === 0;
+	if (options.dryRun) {
+		if (needsRecord) log(`Would run: ${cliLine(cli, [
+			"migration",
+			"fetch",
+			"--db-url",
+			"<DB_URL>"
+		])} (this machine has no record of what the project has had applied)`);
+		log(`Would run: ${cliLine(cli, generateArgs.slice(cli.prefix.length))}`);
+		log(target.kind === "local" ? `Would run: ${cliLine(cli, [
+			"migration",
+			"up",
+			"--local"
+		])}` : `Would run: ${cliLine(cli, [
+			"db",
+			"push",
+			"--db-url",
+			"<DB_URL>",
+			"--yes"
+		])}`);
+		return {
+			migration: null,
+			applied: false,
+			destructive: []
+		};
+	}
+	if (needsRecord) {
+		const fetched = await run(cli.command, fetchArgs, { cwd: product.root });
+		const restored = migrationFiles(migrationsDir).length;
+		if (fetched.code === 0 && restored > 0) log(`Restored ${restored} applied migration${restored === 1 ? "" : "s"} from the project's history.`);
+	}
+	const before = new Set(migrationFiles(migrationsDir));
+	let generated = await run(cli.command, generateArgs, { cwd: product.root });
+	if (generated.code !== 0 && isContainerFailure(generated)) {
+		log("The shadow database did not start; trying once more.");
+		generated = await run(cli.command, generateArgs, { cwd: product.root });
+	}
+	if (generated.code !== 0) throw new SyncError(isContainerFailure(generated) ? "Could not diff the schema: Docker is needed for the shadow database. Start Docker and try again." : "Could not diff the schema against what this database has had applied.", generated.stderr || generated.stdout);
+	const created = migrationFiles(migrationsDir).filter((f) => !before.has(f));
+	if (created.length === 0) {
+		log("The database already matches supabase/schemas.");
+		return {
+			migration: null,
+			applied: false,
+			destructive: []
+		};
+	}
+	const migration = created[created.length - 1];
+	const sql = readFileSync(join(migrationsDir, migration), "utf8");
+	const destructive = destructiveStatements(sql);
+	if (destructive.length > 0 && !options.yes) {
+		if (!(options.confirmDestructive ? await options.confirmDestructive(sql, destructive) : false)) {
+			for (const file of created) rmSync(join(migrationsDir, file));
+			throw new SyncError(`The change drops data in your development database (${destructive.length} statement${destructive.length === 1 ? "" : "s"}). Re-run with --yes to allow it.`, destructive.join(";\n"));
+		}
+	}
+	log(`Applying ${migration}`);
+	const applyArgs = target.kind === "local" ? [
+		...cli.prefix,
+		"migration",
+		"up",
+		"--local"
+	] : [
+		...cli.prefix,
+		"db",
+		"push",
+		"--db-url",
+		target.dbUrl,
+		"--yes"
+	];
+	const applied = await run(cli.command, applyArgs, { cwd: product.root });
+	if (applied.code !== 0) {
+		for (const file of created) rmSync(join(migrationsDir, file));
+		throw new SyncError("The change did not apply. Your schema files may not be valid SQL, or the database has drifted from what devtools recorded (`devtools db sync --rebuild` starts over).", applied.stderr || applied.stdout);
+	}
+	return {
+		migration,
+		applied: true,
+		destructive
+	};
+}
+function isContainerFailure(result) {
+	return /docker|container|image/i.test(result.stderr + result.stdout);
+}
+/** Forgets what was applied: removes the git-ignored local migrations. */
+function forgetMigrations(product) {
+	const files = migrationFiles(product.paths.migrationsDir);
+	for (const file of files) rmSync(join(product.paths.migrationsDir, file));
+	return files;
+}
+//#endregion
+//#region src/product/types.ts
+/**
+* `db types`: the generated TypeScript types or Dart models for a product's
+* schema. Never committed (Q82); three ways to have them:
+*
+*   * generate them from the contributor's own database (`db types`);
+*   * download the asset CI built for the exact schema hash
+*     (`db types --download`), which needs no database at all;
+*   * pack what was generated into that asset (`db types --pack file.tgz`),
+*     which is what CI does on every schema change on `main`.
+*/
+var TypesError = class extends Error {
+	output;
+	constructor(message, output) {
+		super(message);
+		this.output = output;
+		this.name = "TypesError";
+	}
+};
+function readTypesState(product) {
+	try {
+		return JSON.parse(readFileSync(product.paths.stateFile, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function writeTypesState(product, state) {
+	mkdirSync(dirname(product.paths.stateFile), { recursive: true });
+	writeFileSync(product.paths.stateFile, `${JSON.stringify(state, null, 2)}\n`);
+}
+/** Whether the types on disk were made from the schema as it is now. */
+function typesAreCurrent(product) {
+	const state = readTypesState(product);
+	return state !== null && existsSync(join(product.root, product.config.types.out)) && state.hash === schemaHashFor(product);
+}
+function redact(output, secret) {
+	return secret.length > 0 ? output.split(secret).join("<DB_URL>") : output;
+}
+async function generateTypes(product, cli, target, run, log = () => void 0) {
+	const { types, supabase } = product.config;
+	const out = join(product.root, types.out);
+	const hash = schemaHashFor(product);
+	if (types.kind === "typescript") {
+		const args = [
+			...cli.prefix,
+			"gen",
+			"types",
+			"typescript",
+			...target.kind === "local" ? ["--local"] : ["--db-url", target.dbUrl],
+			"--schema",
+			supabase.schemas.join(",")
+		];
+		log(`Running ${cliLine(cli, args.slice(cli.prefix.length).map((arg) => arg === target.dbUrl ? "<DB_URL>" : arg))}`);
+		const result = await run(cli.command, args, { cwd: product.root });
+		if (result.code !== 0 || result.stdout.trim().length === 0) throw new TypesError("The Supabase CLI could not generate types. Is the database up and synced (`devtools db sync`)?", redact(result.stderr || result.stdout, target.dbUrl));
+		mkdirSync(dirname(out), { recursive: true });
+		writeFileSync(out, `// @generated by \`devtools db types\` (${generatorFor(product)}) from supabase/schemas, hash ${hash.slice(0, 12)}. Not committed.\n${result.stdout}`);
+	} else {
+		log("Running dart run supadart");
+		const result = await run("dart", ["run", "supadart"], {
+			cwd: product.root,
+			env: {
+				SUPABASE_URL: target.apiUrl,
+				SUPABASE_API_KEY: target.secretKey
+			}
+		});
+		if (result.code !== 0) throw new TypesError("supadart could not generate the models. It needs Dart on PATH, `dart pub get` run once, and a synced database.", result.stderr || result.stdout);
+		if (!existsSync(out)) throw new TypesError(`supadart ran but ${types.out} does not exist; check that ${types.config} writes its output there.`);
+	}
+	const state = {
+		hash,
+		generator: generatorFor(product),
+		source: "generated",
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	writeTypesState(product, state);
+	return state;
+}
+/** `tar` the generated output into one asset, named for the hash by the caller. */
+async function packTypes(product, file, run) {
+	const out = join(product.root, product.config.types.out);
+	if (!existsSync(out)) throw new TypesError(`${product.config.types.out} does not exist; run \`devtools db types\` first.`);
+	const result = await run("tar", [
+		"-czf",
+		file,
+		"-C",
+		dirname(out),
+		basename(out)
+	], { cwd: product.root });
+	if (result.code !== 0) throw new TypesError("tar could not write the asset.", result.stderr);
+}
+async function downloadTypes(product, deps, log = () => void 0) {
+	const source = product.config.generatedTypes;
+	if (!source) throw new TypesError("This product publishes no generated types (no `generatedTypes` in devtools.config.json). Run `devtools db types` against a synced database instead.");
+	const hash = schemaHashFor(product);
+	const wanted = typesAssetName(product.config.product, hash);
+	const headers = {
+		accept: "application/vnd.github+json",
+		"user-agent": "devdogsuga-devtools"
+	};
+	if (deps.token) headers["authorization"] = `Bearer ${deps.token}`;
+	log(`Looking for ${wanted} in ${source.repo}@${source.tag}`);
+	const release = await deps.fetch(`https://api.github.com/repos/${source.repo}/releases/tags/${source.tag}`, { headers });
+	if (!release.ok) throw new TypesError(`Could not read the ${source.tag} release of ${source.repo} (${release.status}). Run \`devtools setup\` to generate the types from your own database instead.`);
+	const asset = (await release.json()).assets?.find((a) => a.name === wanted);
+	if (!asset) throw new TypesError(`There are no generated types for your schema yet (hash ${hash.slice(0, 12)}). CI builds them when a schema change lands on main; until then run \`devtools setup\` to generate them from your own database.`);
+	const download = await deps.fetch(asset.browser_download_url, { headers: { "user-agent": "devdogsuga-devtools" } });
+	if (!download.ok) throw new TypesError(`Downloading ${wanted} failed (${download.status}).`);
+	const out = join(product.root, product.config.types.out);
+	const staging = join(product.root, ".devtools", "download");
+	rmSync(staging, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(staging, { recursive: true });
+	const archive = join(staging, wanted);
+	writeFileSync(archive, Buffer.from(await download.arrayBuffer()));
+	const extracted = await deps.run("tar", [
+		"-xzf",
+		archive,
+		"-C",
+		staging
+	], { cwd: product.root });
+	if (extracted.code !== 0) throw new TypesError("tar could not read the downloaded asset.", extracted.stderr);
+	const unpacked = join(staging, basename(out));
+	if (!existsSync(unpacked)) throw new TypesError(`The asset does not contain ${basename(out)}.`);
+	rmSync(out, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(dirname(out), { recursive: true });
+	renameSync(unpacked, out);
+	rmSync(staging, {
+		recursive: true,
+		force: true
+	});
+	const state = {
+		hash,
+		generator: generatorFor(product),
+		source: "downloaded",
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	writeTypesState(product, state);
+	return state;
+}
+//#endregion
+//#region src/product/commands.ts
+/**
+* The product-mode commands: `setup`, `db sync|types|hash`, `dev-data`,
+* `doctor`, `check env-example` and the pinned `supabase`.
+*
+* Each handler is a thin reader of argv over the modules beside this one
+* (`sync.ts`, `types.ts`, `dev-data.ts`, ...), which take their collaborators
+* as parameters. The handlers get the real ones from `defaultDeps`; the tests
+* give them fakes.
+*/
+const defaultDeps = {
+	run: spawnRunner,
+	fetch: (input, init) => fetch(input, init),
+	openSql: (url) => postgresSession(url),
+	env: process.env,
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	interactive: () => !isNonInteractive()
+};
+function isKnown(err) {
+	return err instanceof ProductConfigError || err instanceof TargetError || err instanceof SyncError || err instanceof TypesError || err instanceof DevDataError || err instanceof ManagementError || err instanceof OAuthRegistrationError;
+}
+/** Runs a handler body; a known failure prints its message and sets the exit code. */
+async function guarded(body) {
+	try {
+		return await body();
+	} catch (err) {
+		if (!isKnown(err)) throw err;
+		log.error(err.message);
+		const output = "output" in err ? err.output : void 0;
+		if (output) process.stderr.write(`${output.trim()}\n`);
+		process.exitCode = 1;
+		return null;
+	}
+}
+function requireProduct() {
+	const product = currentProduct();
+	if (!product) throw new ProductConfigError("No devtools.config.json found in this directory or above it.");
+	return product;
+}
+function preferenceOf(rest) {
+	const local = rest.includes("--local");
+	const hosted = rest.includes("--hosted");
+	if (local && hosted) throw new TargetError("--local and --hosted are mutually exclusive.");
+	return local ? "local" : hosted ? "hosted" : void 0;
+}
+async function cliFor(product, deps) {
+	return resolveSupabaseCli(product.root, product.config.supabase.version, deps.run);
+}
+async function confirmDestructive(_sql, statements) {
+	note(statements.join(";\n"), "This change drops things in your development database");
+	return unwrap(await confirm({
+		message: "Apply it anyway?",
+		initialValue: false
+	}));
+}
+async function runSync(product, deps, rest) {
+	const cli = await cliFor(product, deps);
+	const preference = preferenceOf(rest);
+	const kind = chooseKind(product, preference);
+	const dryRun = isDryRun();
+	if (rest.includes("--rebuild")) {
+		if (kind !== "local") throw new SyncError("--rebuild resets the database, which devtools only does to the local Docker stack. Reset a hosted project from its dashboard (Database > Settings), then run `devtools db sync`.");
+		const tracked = await deps.run("git", [
+			"ls-files",
+			"--",
+			`${product.config.supabase.dir}/migrations`
+		], { cwd: product.root });
+		const committed = tracked.stdout.split("\n").filter((file) => file.endsWith(".sql"));
+		if (tracked.code === 0 && committed.length > 0) throw new SyncError(`${product.config.supabase.dir}/migrations has committed migrations (${committed[0]}, ...); a product keeps its migrations out of git, so --rebuild will not delete them.`);
+		if (!hasYes(rest) && deps.interactive()) {
+			if (!unwrap(await confirm({
+				message: "Reset your local database and rebuild it from supabase/schemas? Its data is lost.",
+				initialValue: false
+			}))) bail("Nothing was changed.");
+		} else if (!hasYes(rest)) throw new SyncError("--rebuild needs --yes when there is no terminal.");
+		if (dryRun) log.info(`Would run: ${cliLine(cli, [
+			"db",
+			"reset",
+			"--local",
+			"--yes"
+		])} after removing the local migration record.`);
+		else {
+			forgetMigrations(product);
+			if ((await deps.run(cli.command, [
+				...cli.prefix,
+				"db",
+				"reset",
+				"--local",
+				"--yes"
+			], {
+				cwd: product.root,
+				inherit: true
+			})).code !== 0) throw new SyncError("`supabase db reset` failed.");
+		}
+	}
+	const target = dryRun ? {
+		kind,
+		apiUrl: "",
+		dbUrl: "<DB_URL>",
+		publishableKey: "",
+		secretKey: ""
+	} : await resolveTarget(product, cli, deps.run, preference);
+	const result = await dbSync(product, cli, target, deps.run, {
+		yes: hasYes(rest),
+		confirmDestructive: deps.interactive() ? confirmDestructive : void 0,
+		dryRun,
+		log: (line) => log.info(line)
+	});
+	if (rest.includes("--rebuild") && !dryRun) try {
+		const row = await reRegisterSavedProvider(product.paths.toolingFile, target);
+		log.success(`Registered ${row.identifier} again.`);
+	} catch (err) {
+		if (!(err instanceof OAuthRegistrationError)) throw err;
+		log.warn(err.message);
+	}
+	return {
+		result,
+		cli,
+		target: dryRun ? null : target
+	};
+}
+/**
+* Q82: `db sync` also regenerates the types, so an edit-schema, sync loop never
+* leaves them behind. Skipped when nothing changed and the types on disk are
+* already for this schema. A failure here does not undo the sync.
+*/
+async function regenerateAfterSync(product, cli, target, result, deps) {
+	if (target === null) {
+		log.info(`Would regenerate ${product.config.types.out}.`);
+		return;
+	}
+	if (!result.migration && typesAreCurrent(product)) return;
+	try {
+		await generateTypes(product, cli, target, deps.run, (line) => log.info(line));
+		log.success(`Regenerated ${product.config.types.out}.`);
+	} catch (err) {
+		if (!(err instanceof TypesError)) throw err;
+		log.warn(`${err.message} The sync itself worked; run \`devtools db types\` once that is fixed.`);
+	}
+}
+async function runTypes(product, deps, rest) {
+	if (isDryRun()) {
+		log.info(`Would ${rest.includes("--download") ? "download" : "generate"} ${product.config.types.out}.`);
+		return DONE;
+	}
+	if (rest.includes("--download")) {
+		const state = await downloadTypes(product, {
+			fetch: deps.fetch,
+			run: deps.run,
+			token: deps.env["GITHUB_TOKEN"]
+		}, (line) => log.info(line));
+		log.success(`Downloaded the types for schema ${state.hash.slice(0, 12)} into ${product.config.types.out}.`);
+		return DONE;
+	}
+	const cli = await cliFor(product, deps);
+	const state = await generateTypes(product, cli, await resolveTarget(product, cli, deps.run, preferenceOf(rest)), deps.run, (line) => log.info(line));
+	log.success(`Generated ${product.config.types.out} for schema ${state.hash.slice(0, 12)}.`);
+	const pack = flagValue([...rest], "--pack");
+	if (pack) {
+		await packTypes(product, pack, deps.run);
+		log.success(`Packed it into ${pack}.`);
+	}
+	return DONE;
+}
+function runHash(product) {
+	process.stdout.write(`${schemaHashFor(product)}\n`);
+	process.stderr.write(`generator ${generatorFor(product)}\n`);
+	return DONE;
+}
+function createProductHandlers(deps = defaultDeps) {
+	const handleDb = (rest) => guarded(async () => {
+		const product = requireProduct();
+		const [sub] = positionals([...rest]);
+		const flags = rest.filter((arg) => arg !== sub);
+		switch (sub) {
+			case "sync": {
+				const { result, cli, target } = await runSync(product, deps, flags);
+				if (result.migration) log.success("Your database now matches supabase/schemas.");
+				await regenerateAfterSync(product, cli, target, result, deps);
+				return DONE;
+			}
+			case "types": return runTypes(product, deps, flags);
+			case "hash": return runHash(product);
+			default: throw new ProductConfigError(`db: expected sync, types or hash, got ${sub === void 0 ? "nothing" : `"${sub}"`}.`);
+		}
+	});
+	const handleDevData = (rest) => guarded(async () => {
+		const product = requireProduct();
+		const done = await runDevData(product, await resolveTarget(product, await cliFor(product, deps), deps.run, preferenceOf(rest)), deps.openSql, {
+			member: flagValue([...rest], "--member"),
+			provider: OAUTH.providerId,
+			dryRun: isDryRun(),
+			log: (line) => log.info(line)
+		});
+		if (done) log.success(`Ran ${done.file} for ${done.member.email ?? done.member.id}.`);
+		return DONE;
+	});
+	const handleCheck = (rest) => guarded(async () => {
+		const product = requireProduct();
+		const [sub] = positionals([...rest]);
+		if (sub !== "env-example") throw new ProductConfigError(`check: expected env-example, got "${sub ?? ""}".`);
+		const { envExample } = product.paths;
+		if (!existsSync(envExample)) throw new ProductConfigError(`${product.config.env.example} does not exist.`);
+		const findings = findSecrets(readFileSync(envExample, "utf8"));
+		if (findings.length > 0) {
+			for (const f of findings) log.error(`${product.config.env.example}: ${f.key} — ${f.reason}. This file ships in the app; keep secrets in ${product.config.env.tooling}.`);
+			process.exitCode = 1;
+			return null;
+		}
+		log.success(`${product.config.env.example} holds public values only.`);
+		return DONE;
+	});
+	const handleSupabase = async (rest) => {
+		const product = requireProduct();
+		const cli = await cliFor(product, deps);
+		const args = [...cli.prefix, ...rest];
+		if (isDryRun()) {
+			log.info(`Would run: ${commandLine(cli.command, args)}`);
+			return DONE;
+		}
+		const result = await deps.run(cli.command, args, {
+			cwd: product.root,
+			inherit: true
+		});
+		if (result.code !== 0) process.exitCode = result.code;
+		return result.code === 0 ? DONE : null;
+	};
+	const handleDoctor = (rest) => guarded(async () => {
+		return runDoctor(requireProduct(), deps);
+	});
+	const handleSetup = (rest) => guarded(async () => runSetup(requireProduct(), deps, rest));
+	return {
+		setup: handleSetup,
+		db: handleDb,
+		"dev-data": handleDevData,
+		doctor: handleDoctor,
+		check: handleCheck,
+		supabase: handleSupabase
+	};
+}
+async function runDoctor(product, deps) {
+	const lines = [];
+	const ok = (message) => void lines.push(`OK    ${message}`);
+	const warn = (message) => void lines.push(`WARN  ${message}`);
+	const info = (message) => void lines.push(`INFO  ${message}`);
+	ok(`${product.config.name} (${product.config.product}), Supabase CLI pinned at ${product.config.supabase.version}`);
+	const cli = await cliFor(product, deps);
+	if (cli.source === "npx") info(`The pinned Supabase CLI is fetched with npx on first use (${cliLine(cli, ["--version"])}).`);
+	else ok(`Supabase CLI ${product.config.supabase.version} (${cli.source})`);
+	const docker = await deps.run("docker", [
+		"info",
+		"--format",
+		"{{.ServerVersion}}"
+	], { cwd: product.root }).catch(() => ({
+		code: 1,
+		stdout: "",
+		stderr: ""
+	}));
+	if (docker.code === 0) ok(`Docker ${docker.stdout.trim()}`);
+	else warn("Docker is not reachable. The local stack and the schema diff need it.");
+	if (product.config.types.kind === "supadart") {
+		if ((await deps.run("dart", ["--version"], { cwd: product.root }).catch(() => ({
+			code: 1,
+			stdout: "",
+			stderr: ""
+		}))).code === 0) ok("Dart on PATH");
+		else warn("Dart is not on PATH; `db types` needs it for supadart.");
+	}
+	const pub = readEnvFile(product.paths.envFile);
+	const missing = Object.values(product.config.env.keys).filter((key) => !pub[key]);
+	if (!existsSync(product.paths.envFile)) warn(`${product.config.env.file} does not exist. Run \`devtools setup\`.`);
+	else if (missing.length > 0) warn(`${product.config.env.file} is missing ${missing.join(", ")}.`);
+	else ok(`${product.config.env.file} has the project URL and publishable key`);
+	const findings = existsSync(product.paths.envExample) ? findSecrets(readFileSync(product.paths.envExample, "utf8")) : [];
+	if (findings.length > 0) warn(`${product.config.env.example} has secret-looking keys: ${findings.map((f) => f.key).join(", ")}.`);
+	info(`Target: ${chooseKind(product, void 0) === "hosted" ? "your own hosted project" : "the local Docker stack"}`);
+	try {
+		ok(`Database reachable at ${(await resolveTarget(product, cli, deps.run, void 0)).apiUrl}`);
+	} catch (err) {
+		if (!(err instanceof TargetError)) throw err;
+		warn(err.message);
+	}
+	if (existsSync(product.paths.schemasDir)) {
+		if (typesAreCurrent(product)) ok(`Generated types match the schema (${readTypesState(product)?.source ?? "?"})`);
+		else warn(`${product.config.types.out} is missing or older than supabase/schemas. Run \`devtools db types\` (or \`--download\`).`);
+	}
+	note(lines.join("\n"), `${product.config.name} environment`);
+	return DONE;
+}
+async function chooseSetupKind(deps, preference) {
+	if (preference) return preference;
+	if (!deps.interactive()) return "local";
+	return unwrap(await select({
+		message: "Which Supabase should this checkout use?",
+		options: [{
+			value: "local",
+			label: "Local (Docker)",
+			hint: "needs Docker; nothing to create online"
+		}, {
+			value: "hosted",
+			label: "Your own free Supabase project",
+			hint: "create one at supabase.com first"
+		}],
+		initialValue: "local"
+	}));
+}
+async function promptHosted(product, deps) {
+	const tooling = readEnvFile(product.paths.toolingFile);
+	const pub = readEnvFile(product.paths.envFile);
+	const { keys } = product.config.env;
+	const fromEnv = (name) => {
+		const value = deps.env[name];
+		return value === "" ? void 0 : value;
+	};
+	const have = {
+		apiUrl: fromEnv("DEVTOOLS_SUPABASE_URL") ?? pub[keys.url],
+		publishableKey: fromEnv("DEVTOOLS_SUPABASE_PUBLISHABLE_KEY") ?? pub[keys.publishableKey],
+		secretKey: fromEnv("DEVTOOLS_SUPABASE_SECRET_KEY") ?? tooling[TOOLING_KEYS.secretKey],
+		dbUrl: fromEnv("DEVTOOLS_DB_URL") ?? tooling[TOOLING_KEYS.dbUrl]
+	};
+	const complete = have.apiUrl && have.publishableKey && have.secretKey && have.dbUrl;
+	if (!complete && !deps.interactive()) throw new TargetError("A hosted setup with no terminal needs DEVTOOLS_SUPABASE_URL, DEVTOOLS_SUPABASE_PUBLISHABLE_KEY, DEVTOOLS_SUPABASE_SECRET_KEY and DEVTOOLS_DB_URL in the environment.");
+	if (!complete) note([
+		"1. Create a free project at https://supabase.com/dashboard",
+		"2. Project Settings > API: copy the Project URL, the publishable key and the secret key.",
+		"3. Project Settings > Database > Connection string > Session pooler: copy that string (port 5432, not 6543)."
+	].join("\n"), "Your own Supabase project");
+	const ask = async (label, current, secret) => {
+		if (current) return current;
+		const validate = (v) => v?.trim() ? void 0 : "Required";
+		return unwrap(secret ? await password({
+			message: label,
+			validate
+		}) : await text({
+			message: label,
+			validate
+		})).trim();
+	};
+	const apiUrl = (await ask("Project URL", have.apiUrl, false)).replace(/\/+$/, "");
+	const publishableKey = await ask("Publishable key", have.publishableKey, false);
+	const secretKey = await ask("Secret key", have.secretKey, true);
+	let dbUrl = have.dbUrl;
+	for (;;) {
+		dbUrl = await ask("Session pooler connection string", dbUrl, true);
+		const validation = validateSessionPoolerUrl(dbUrl);
+		if (validation.ok) break;
+		if (!deps.interactive()) throw new TargetError(validation.message ?? "That DB_URL is not usable.");
+		log.error(validation.message ?? "That DB_URL is not usable.");
+		dbUrl = void 0;
+	}
+	assertNotProduction(product, apiUrl, dbUrl);
+	return {
+		kind: "hosted",
+		apiUrl,
+		dbUrl,
+		publishableKey,
+		secretKey
+	};
+}
+async function runSetup(product, deps, rest) {
+	const { config } = product;
+	const dryRun = isDryRun();
+	log.info(`Setting up ${config.name}.`);
+	if (!existsSync(product.paths.envExample)) throw new ProductConfigError(`${config.env.example} does not exist; it is the manifest .env is made from.`);
+	const manifest = readFileSync(product.paths.envExample, "utf8");
+	const secrets = findSecrets(manifest);
+	if (secrets.length > 0) throw new ProductConfigError(`${config.env.example} has secret-looking keys (${secrets.map((s) => s.key).join(", ")}); it ships in the app. Move them to ${config.env.tooling} first.`);
+	if (dryRun) {
+		log.info(`Would write ${config.env.file} from ${config.env.example}, start the database, sync the schema, get the types and set up sign in.`);
+		return DONE;
+	}
+	if (!existsSync(product.paths.envFile)) {
+		writeFileSync(product.paths.envFile, renderEnvFromManifest(manifest, {}));
+		log.success(`Created ${config.env.file} from ${config.env.example}.`);
+	}
+	for (const file of [config.env.file, config.env.tooling]) if (ensureGitignored(product.root, file)) log.warn(`${file} was not ignored by version control; added /${file} to the ignore file.`);
+	const cli = await cliFor(product, deps);
+	const kind = await chooseSetupKind(deps, preferenceOf(rest));
+	let target;
+	if (kind === "local") {
+		log.info("Starting the local Supabase stack (the first start downloads its images).");
+		if ((await deps.run(cli.command, [
+			...cli.prefix,
+			"start",
+			"--ignore-health-check"
+		], {
+			cwd: product.root,
+			inherit: true
+		})).code !== 0) throw new TargetError("`supabase start` failed. Is Docker running?");
+		target = await localTarget(product, cli, deps.run);
+		upsertEnvFile(product.paths.toolingFile, { [TOOLING_KEYS.target]: "local" }, "# Secrets for devtools. Never committed.");
+	} else {
+		target = await promptHosted(product, deps);
+		upsertEnvFile(product.paths.toolingFile, {
+			[TOOLING_KEYS.target]: "hosted",
+			[TOOLING_KEYS.dbUrl]: target.dbUrl,
+			[TOOLING_KEYS.secretKey]: target.secretKey
+		}, "# Secrets for devtools. Never committed.");
+	}
+	upsertEnvFile(product.paths.envFile, {
+		[config.env.keys.url]: target.apiUrl,
+		[config.env.keys.publishableKey]: target.publishableKey
+	});
+	log.success(`${config.env.file} points at ${target.apiUrl}.`);
+	const result = await dbSync(product, cli, target, deps.run, {
+		yes: hasYes(rest),
+		confirmDestructive: deps.interactive() ? confirmDestructive : void 0,
+		log: (line) => log.info(line)
+	});
+	log.success(result.migration ? "Applied supabase/schemas to your database." : "Your database already matched supabase/schemas.");
+	if (target.kind === "local") await waitForRest(target, deps, product);
+	if (rest.includes("--download-types")) try {
+		await downloadTypes(product, {
+			fetch: deps.fetch,
+			run: deps.run,
+			token: deps.env["GITHUB_TOKEN"]
+		}, (l) => log.info(l));
+		log.success("Downloaded the generated types.");
+	} catch (err) {
+		if (!(err instanceof TypesError)) throw err;
+		log.warn(`${err.message} Generating them from your database instead.`);
+		await generateTypes(product, cli, target, deps.run, (l) => log.info(l));
+	}
+	else {
+		await generateTypes(product, cli, target, deps.run, (l) => log.info(l));
+		log.success(`Generated ${config.types.out}.`);
+	}
+	await setUpSignIn(product, deps, target, rest);
+	note([
+		config.runHint ?? "Start the app, then sign in with DevDogs.",
+		"",
+		"Check the whole setup any time with `devtools doctor`."
+	].join("\n"), "Next");
+	return DONE;
+}
+/**
+* Waits for the API to serve the product's schema: PostgREST starts unhealthy
+* on an empty database and loads its schema cache on its next reconnect.
+*/
+async function waitForRest(target, deps, product) {
+	for (let attempt = 0; attempt < 30; attempt += 1) {
+		try {
+			if ((await deps.fetch(`${target.apiUrl}/rest/v1/`, { headers: {
+				apikey: target.publishableKey,
+				"accept-profile": product.config.supabase.schemas[0] ?? "public"
+			} })).ok) return;
+		} catch {}
+		await deps.sleep(2e3);
+	}
+	log.warn("The local API is not serving your schema yet. `devtools doctor` and `supabase status` will say more.");
+}
+async function setUpSignIn(product, deps, target, rest) {
+	if (rest.includes("--skip-oauth")) {
+		log.info("Skipped \"Sign in with DevDogs\" (--skip-oauth). Run `devtools oauth` when you want it.");
+		return;
+	}
+	if (target.kind === "hosted") {
+		const ref = projectRefOf(target.apiUrl);
+		const token = deps.env["SUPABASE_ACCESS_TOKEN"] ?? readEnvFile(product.paths.toolingFile)[TOOLING_KEYS.accessToken];
+		if (ref && token) {
+			const { changed } = await ensureHostedAuthSettings({
+				projectRef: ref,
+				token,
+				redirectUris: product.config.oauth.redirectUris,
+				fetch: deps.fetch
+			});
+			if (changed.length > 0) log.success(`Updated your project's auth settings: ${changed.join(", ")}.`);
+		} else note([
+			"Two settings on your project, in the dashboard:",
+			"  Authentication > Providers: turn on custom OAuth/OIDC providers.",
+			...product.config.oauth.redirectUris.length > 0 ? [`  Authentication > URL Configuration > Redirect URLs: add ${product.config.oauth.redirectUris.join(", ")}`] : [],
+			"Or put a personal access token in SUPABASE_ACCESS_TOKEN and run setup again."
+		].join("\n"), "Before sign in will work");
+	} else {
+		const configToml = join(product.paths.supabaseDir, "config.toml");
+		const text = existsSync(configToml) ? readFileSync(configToml, "utf8") : "";
+		const missing = product.config.oauth.redirectUris.filter((uri) => !text.includes(uri));
+		if (missing.length > 0) log.warn(`Allow ${missing.join(", ")} under [auth] additional_redirect_urls in ${product.config.supabase.dir}/config.toml, or sign in will be refused on this stack.`);
+	}
+	process.chdir(product.root);
+	const credentials = credentialsFromEnv(deps.env);
+	if (credentials) {
+		const row = await registerProvider(product.paths.toolingFile, target, credentials);
+		log.success(`Registered ${row.identifier} from DEVDOGS_OAUTH_CLIENT_ID.`);
+		return;
+	}
+	if (!deps.interactive()) {
+		log.warn("No terminal, so \"Sign in with DevDogs\" was not set up. Set DEVDOGS_OAUTH_CLIENT_ID and DEVDOGS_OAUTH_CLIENT_SECRET, or run `devtools oauth`.");
+		return;
+	}
+	await runOAuthSetup(void 0, void 0, void 0, {
+		kind: target.kind,
+		apiUrl: target.apiUrl,
+		serviceRoleKey: target.secretKey
+	}, product.config.env.tooling);
+}
+//#endregion
 //#region src/cli.ts
 /**
 * `pnpm devtools [--tier <development:local|development:remote|staging|production>] [command]`
@@ -6754,7 +8300,6 @@ const CONTRIBUTOR_HANDLERS = {
 	setup: handleSetup,
 	completions: handleCompletions,
 	check: handleCheck,
-	run: runTask,
 	oauth: handleOAuth,
 	script: handleScript,
 	jobs: handleJobs,
@@ -6764,7 +8309,8 @@ const CONTRIBUTOR_HANDLERS = {
 	"new-migration": handleNewMigration,
 	"apply-migrations": handleApplyMigrations,
 	"push-config": handlePushConfig,
-	roles: handleRoles
+	roles: handleRoles,
+	moderation: handleModeration
 };
 /**
 * The real tools with the session's env and tier. A typed one is handled in
@@ -6789,6 +8335,22 @@ const HANDLERS = {
 	...PASSTHROUGH_HANDLERS
 };
 /**
+* What a product repository (one with a `devtools.config.json`) runs instead:
+* its own `setup`, `db`, `dev-data`, `doctor`, `check` and pinned `supabase`,
+* and the same `oauth` wizard. Built on first use so the platform's startup
+* does not pay for it.
+*/
+let productHandlers;
+function handlersFor() {
+	if (!isProductMode()) return HANDLERS;
+	productHandlers ??= {
+		...createProductHandlers(),
+		oauth: handleOAuth,
+		moderation: handleModeration
+	};
+	return productHandlers;
+}
+/**
 * Names retired in favour of a new one, refused with the new name rather than
 * falling into "Unknown command": they are in this repo's own docs, scripts
 * and shell histories, so a bare "unknown" would leave the rename to be
@@ -6796,6 +8358,10 @@ const HANDLERS = {
 * environment checker, a deliberate reuse rather than a collision.
 */
 const RETIRED = {
+	run: {
+		message: "`run` is gone (TASK-404).",
+		hints: ["every package: pnpm -r run <task>", "one app:       pnpm -F <app> <task>"]
+	},
 	secrets: {
 		message: "`secrets` is now `backstage env`.",
 		hints: ["In a Backstage clone: pnpm backstage env <pull|push|audit>"]
@@ -6869,7 +8435,8 @@ const RETIRED = {
 async function dispatch(argv) {
 	const [first, ...rest] = argv;
 	if (!first) return DONE;
-	const handler = HANDLERS[first];
+	const catalog = activeCatalog();
+	const handler = handlersFor()[first];
 	if (handler) {
 		if (isDryRun() && dryRunKind(catalog, helpPath(argv)) === void 0) {
 			process.stderr.write(`${wouldRunLine(argv)}\n`);
@@ -6877,7 +8444,7 @@ async function dispatch(argv) {
 		}
 		return handler(rest);
 	}
-	const retired = RETIRED[first];
+	const retired = isProductMode() ? void 0 : RETIRED[first];
 	if (retired) {
 		const [sub] = rest;
 		const hoisted = sub !== void 0 && retired.hoisted?.includes(sub);
@@ -6901,9 +8468,14 @@ async function dispatch(argv) {
 * guard at the bottom of this file, for a direct `tsx src/cli.ts` run.
 */
 async function main(typed) {
+	const catalog = activeCatalog();
 	const argv = catalog.canonicalArgv(typed);
 	initDevtoolsTelemetry(argv[0] ?? "menu");
-	if (isPassthroughTool(argv[0])) {
+	if (isProductMode() && argv[0] === "supabase") {
+		await handlersFor()["supabase"](argv.slice(1));
+		return;
+	}
+	if (!isProductMode() && isPassthroughTool(argv[0])) {
 		await handlePassthrough(argv[0], argv.slice(1));
 		return;
 	}
@@ -6929,10 +8501,6 @@ async function main(typed) {
 		return;
 	}
 	const startPath = process.stdin.isTTY ? bareGroupStartPath(catalog, argv) : null;
-	if (!startPath && argv[0] === "run") {
-		await runTask(argv.slice(1));
-		return;
-	}
 	const banners = !isNonInteractive();
 	if (banners) intro("DevDogs devtools");
 	let closing;