feat(cli): add experimental stack status

[jgoux]

supabase stack status reports the selected stack's identity, runtime, owner, readiness, endpoints, and configuration drift. It loads configuration from the selected stack's project, including when inspecting an ID from another working directory.

Adds a read-only configuration comparison to the stack package that reports changed paths without exposing secret values. Invalid or unreadable project configuration leaves inspection available and marks drift as unavailable. An absent config.toml is compared against default settings, matching what stack start does (develop's project loader treats an absent file as defaults, not an error).

status --env

Ported from #6517 (closed):

• status --env exports connection variables as dotenv (text) or a JSON variable map (--output-format json / stream-json). Ordinary status never reveals credentials.
• --override-name API_URL=NEXT_PUBLIC_SUPABASE_URL renames exported variables (CSV or repeated; requires --env; rejects unknown sources, invalid names, and duplicate destinations).
• Database-only stacks export database credentials with API credentials omitted when Auth is disabled. stack.credentials() in @supabase/stack now returns an optional api instead of failing when Auth is disabled.
• A stopped stack or credential failure produces an error with no partial output.
• Every explicit legacy -o/--output value is rejected with --output-format guidance; -o env points at --env.
• Dotenv export quotes each value with the first of ', ", ` that round-trips; a value none can carry fails with a pointer to --output-format json.

Feature-flag routing

Top-level supabase status now follows [experimental] stack = true / SUPABASE_EXPERIMENTAL_STACK exactly like start and stop, so a project on the new backend gets a status command that understands its stack. supabase stack status always uses the new backend.

Also in this PR

• Merged develop twice (refactor(stack): simplify stack identity #6531's descriptor(state, id) change, then feat(cli): add stack command options and destruction #6576's destroy/discoverStacks additions and the handle's Effect-valued status/credentials).
• Lifecycle and dotenv-encoding failures classify as user-actionable (startStack/provideFlags), not network errors; a rejected config comparison reports its typed diagnostic.
• Fixed CI: lint:effect:check warnings in the drift test, the error-tag telemetry fixture, and the routing test's hardcoded stack subcommand list.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@34ca600fdad2a3cbe8f166998f05d4b6fdbc4d6f

Preview package for commit 34ca600.

[jgoux]

/ai-review

[jgoux]

On this one, can we integrate :

status --env exports connection variables as dotenv or a JSON variable map, with --override-name for application-specific names. Ordinary status does not reveal credentials. Database-only stacks can retrieve database credentials with API credentials omitted when Auth is disabled.

It was done here but I'm closing this PR as well and porting what was done for start/stop/destroy directly from develop.

[Coly010]

/ai-review

[github-actions]

🤖 AI Review

Verified all 11 reported findings against the PR code and trusted repository conventions. One duplicate was merged, yielding 10 findings: five minor and five nit-level. All are confirmed; no critical or major issues were found.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/experimental/stack/status/status.errors.ts:16	telemetry	claude	The runtime reason is incorrectly classified as an external-service network failure even when it represents user-actionable lifecycle or local encoding errors.
🟡 MINOR	apps/cli/src/commands/experimental/stack/status/status.handler.ts:229	error-handling	claude	Configuration comparison errors discard their precise typed diagnostic and inaccurately report that the project configuration could not be loaded.
🟡 MINOR	apps/cli/docs/stack-commands.md:31	documentation	claude	The migration guide mentions rejection of legacy -o env but omits that every explicit legacy -o/--output value, including json and pretty, is rejected by the stack backend.
🟡 MINOR	apps/cli/src/commands/experimental/stack/status/status.env.ts:84	correctness	codex	Text export rejects values containing both a single quote and a backtick even when they can be represented losslessly with dotenv double quotes.
🟡 MINOR	apps/cli/src/commands/experimental/stack/status/status.env.ts:39	correctness	codex	Override collision validation includes optional variables that will not be exported, rejecting non-colliding renames on capability-limited stacks.
⚪ NIT	packages/config/src/experimental.ts:44	documentation	claude	The generated public configuration schemas retain the old description that says the stack backend affects only start and stop.
⚪ NIT	apps/cli/src/commands/experimental/stack/status/status.env.ts:37	validation	claude	Conflicting repeated overrides for the same source variable are silently resolved last-wins.
⚪ NIT	apps/cli/src/commands/experimental/stack/status/status.handler.ts:213	code-quality	claude	The environment-export branch returns an unrelated optional inspection whose presence depends solely on whether --stack-id was used.
⚪ NIT	apps/cli/src/commands/experimental/stack/status/status.handler.ts:226	performance	claude	Status with --stack-id and a loadable configuration inspects the stack twice, repeating the owner status RPC.
⚪ NIT	apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md:49	documentation	claude+codex	The side-effect contract omits the command's exit-code behavior and telemetry-state write.

Stats

Claude findings: 8 · Codex findings: 3 · Confirmed: 10 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: manual · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.