refactor(config): split entrypoints into pure default, /io and /effect (CLI-2231)

[Coly010]

Summary

Splits @supabase/config's public surface into three strictly layered entrypoints, per CLI-2231 (including its 2026-08-24 amendment for browser consumers):

• . — pure, browser-safe. Schema, types, document encode functions, defaults/sparse mapping, error classes, and constants only. No Effect-returning functions are exported, and no @effect/platform-*, node:, or bun: module can enter its transitive graph — Studio (see feat: Add a config drift page in Studio supabase#48906) can bundle this platform-free. The pure document layer was physically partitioned out of io.ts/functions-manifest.ts (new config-document.ts, functions-manifest-model.ts) so the invariant is structural, and a static import-graph test (entrypoint-purity.unit.test.ts) enforces it: file allowlist, bare-specifier allowlist (effect/smol-toml/dedent), dynamic-import()/require detection, and inline-snapshot pinning of both export surfaces. Browser bundle drops 387 KB → ~355 KB with zero file-IO code reachable.
• ./effect — Effect-native superset. Re-exports everything in . plus the Effect-native surface (loadProjectConfig, saveProjectConfig, discovery, env loading, inferFunctionsManifest, ProjectConfigStore, projectConfigStoreLayer, …), so Effect-native consumers need one specifier (Option B from the issue). The 22 apps/cli files that import Effect-native symbols were repointed with byte-identical symbol lists; the other 37 consumer files keep the bare specifier unchanged. On the issue's open decision: resolveProjectValue/resolveProjectSubtree stay Effect-typed in ./effect only (the amendment requires . to carry plain-sync signatures; unwrapping can be revisited in CLI-2234).
• ./io — Promise facade for non-Effect consumers, replacing the unused ./bun/./node subpaths (verified zero consumers) with bun/node/browser/default export conditions. The browser condition resolves to a side-effect-free stub exporting the same seven names, each rejecting at invocation with a pointer to ., instead of dragging @effect/platform-node into a browser bundle (kept side-effect-free so isomorphic/edge bundles that never call config IO still build and load). All three condition targets re-export the pure surface, so ./io consumers never need a second specifier for parameter/return types. Both facades now share one lazily built ManagedRuntime via a common factory — previously each call did ManagedRuntime.make(...) fresh and never disposed it — and the runtime layer is narrowed to FileSystem + Path (the former full *Services.layer attached a permanent process.stdin listener via Terminal).
• ./schema.json — unchanged.

Dependency reshape: effect moves to peerDependencies — Effect v4 resolves services by string key, so this isn't about tag identity; the real grounds are a single effect version across the dependency graph while rc-to-rc internals churn, dedupe/bundle size, and letting the consumer own the version — and @effect/platform-bun/-node become optional peers (a consumer only needs the one matching their runtime), each mirrored in devDependencies for local build/test. dedent and smol-toml stay regular dependencies.

Docs: ADR 0009's open "config package architecture" bullet is resolved with the entrypoint contract, and packages/config/AGENTS.md records the monorepo import rule (Effect symbols → /effect; pure-only → .; ./io is for external non-Effect consumers only).

Out of scope (tracked separately): npm publishing/compiled dist output (CLI-2232/CLI-2233) and the public-surface audit (CLI-2234).

Linked issue

Linear: CLI-2231

• The linked issue is open and carries the open-for-contribution label (or I'm a Supabase maintainer).

Checklist

• The PR title follows Conventional Commits (e.g. fix(cli): …).
• Tests added or updated for the change.
• pnpm check:all and pnpm test pass for the workspace(s) I touched.

[Coly010]

Review of the three-entrypoint split. What was verified before commenting: packages/config unit tests (183/183), lint/fmt/knip, and tsc --noEmit clean; apps/clitsc --noEmit clean plus targeted unit/integration runs over the repointed areas; pnpm install --frozen-lockfile clean with a byte-identical lockfile; a scripted scan of all 92 @supabase/config importers confirming zero value-imports of the 14 symbols removed from ., no file mixing . and ./effect, and zero consumers of the removed ./bun/./node subpaths; empirical bun build --target=browser runs against each ./io condition; and the ManagedRuntime lifecycle against the pinned effect source (build fiber memoized, scope finalizers removed via addObserver, no accumulation — the never-disposed singleton is sound).

The layering itself is right and the partition is a verbatim move with no behavior drift. Seven inline comments below: four should-fix (the browser condition of ./io breaks builds instead of producing the documented runtime error; the stdin-leak regression test does not fail when the regression is reintroduced; the purity walker has two reproducible false negatives; ADR 0009 records a factually wrong mechanism for the effect peer-dep move) and three consider (./io is not type-self-sufficient; a new type-level import cycle through errors.ts; the two monorepo-wide import rules are prose-only). All findings were reproduced or source-verified, not pattern-matched.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@7b23f744f7b1ceed756fad69929ca70df7051368

Preview package for commit 7b23f74.

[avallete]

The three-entrypoint split holds on HEAD: . stays a physical, browser-safe partition; ./effect is a real unshadowed superset; ./io is a lazy Promise facade over FileSystem | Path only, with a side-effect-free browser stub. The seven earlier self-review threads are still fixed. CLI Effect call sites moved to /effect; remaining @supabase/config imports are schema/types/constants.

Two non-blocking nits inline — neither needs to land before merge:

1. The monorepo import-contract test will not re-run when another workspace adds a forbidden /io or deep import (test:unit inputs are project-local). Add workspace extraInputs the way packages/stack already does; scanning .tsx too would close the other documented hole.
2. A couple of leftover review-history comments in the facade tests can shrink to the current invariant.

Approve as-is.