feat(cli)!: consistent local vs remote target defaults and one hosted-mutation consent rule

apps/cli-e2e/src/tests/functions.e2e.test.ts

@@ -95,6 +95,7 @@ describe("functions", () => {
         "--use-api",
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("Invalid token");
@@ -114,6 +115,7 @@ describe("functions", () => {
         "--use-api",
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("Forbidden");
@@ -136,6 +138,7 @@ describe("functions", () => {
         "--use-api",
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("Too Many Requests");
@@ -155,6 +158,7 @@ describe("functions", () => {
         "--use-api",
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("Internal Server Error");
@@ -171,6 +175,7 @@ describe("functions", () => {
           FUNCTION_NAME,
           "--project-ref",
           projectRef,
+          "--yes",
         ]);
         expect(result.exitCode).toBe(0);
         expect(result.stdout).toContain("Deleted Function");
@@ -189,6 +194,7 @@ describe("functions", () => {
         FUNCTION_NAME,
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("does not exist");
@@ -206,6 +212,7 @@ describe("functions", () => {
         FUNCTION_NAME,
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("Invalid token");
@@ -223,6 +230,7 @@ describe("functions", () => {
         FUNCTION_NAME,
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("Forbidden");
@@ -240,6 +248,7 @@ describe("functions", () => {
         FUNCTION_NAME,
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("Too Many Requests");
@@ -257,6 +266,7 @@ describe("functions", () => {
         FUNCTION_NAME,
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
       expect(result.stderr).toContain("Internal Server Error");

apps/cli-e2e/src/tests/secrets.e2e.test.ts

@@ -85,7 +85,7 @@ describe("secrets", () => {
 
   describe("secrets:set", () => {
     testBehaviour("sets a single secret", async ({ run, projectRef }) => {
-      const result = await run(["secrets", "set", "FOO=bar", "--project-ref", projectRef]);
+      const result = await run(["secrets", "set", "FOO=bar", "--project-ref", projectRef, "--yes"]);
       expect(result.exitCode).toBe(0);
       expect(result.stdout).toContain("Finished");
     });
@@ -98,6 +98,7 @@ describe("secrets", () => {
         "BAZ=qux",
         "--project-ref",
         projectRef,
+        "--yes",
       ]);
       expect(result.exitCode).toBe(0);
       expect(result.stdout).toContain("Finished");
@@ -112,6 +113,7 @@ describe("secrets", () => {
         ".env.local",
         "--project-ref",
         projectRef,
+        "--yes",
       ]);
       expect(result.exitCode).toBe(0);
       expect(result.stdout).toContain("Finished");
@@ -126,7 +128,14 @@ describe("secrets", () => {
           body: { message: "Validation failed", errors: [{ message: "Invalid secret name" }] },
         }),
       });
-      const result = await run(["secrets", "set", "FOO=bar", "--project-ref", PROJECT_REF]);
+      const result = await run([
+        "secrets",
+        "set",
+        "FOO=bar",
+        "--project-ref",
+        PROJECT_REF,
+        "--yes",
+      ]);
       expect(result.exitCode).not.toBe(0);
     });
 
@@ -138,6 +147,7 @@ describe("secrets", () => {
         "nonexistent.env",
         "--project-ref",
         PROJECT_REF,
+        "--yes",
       ]);
       expect(result.exitCode).not.toBe(0);
     });
@@ -148,7 +158,14 @@ describe("secrets", () => {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ status: 401, body: { message: "Invalid token" } }),
       });
-      const result = await run(["secrets", "set", "FOO=bar", "--project-ref", PROJECT_REF]);
+      const result = await run([
+        "secrets",
+        "set",
+        "FOO=bar",
+        "--project-ref",
+        PROJECT_REF,
+        "--yes",
+      ]);
       expect(result.exitCode).not.toBe(0);
     });
   });
@@ -161,7 +178,7 @@ describe("secrets", () => {
     });
 
     testBehaviour("removes multiple secrets", async ({ run, projectRef }) => {
-      await run(["secrets", "set", "FOO=bar", "BAR=baz", "--project-ref", projectRef]);
+      await run(["secrets", "set", "FOO=bar", "BAR=baz", "--project-ref", projectRef, "--yes"]);
       const result = await run([
         "secrets",
         "unset",

apps/cli/AGENTS.md

@@ -225,6 +225,31 @@ text layer. Therefore stdout is payload-only for either machine flag. Do not cha
 layer to move spinners; that would change text output globally. Handlers check `--output` first and
 use established encoders before the `output.format` branch.
 
+## Targets and hosted consent
+
+Every leaf declares its target group and consent default with `withTargetPolicy`; the
+classification test in `src/command-internal/target/target-policy.unit.test.ts` fails a leaf
+without one. Declare the target flags only through `targetFlags` in
+`src/command-internal/target/target-flags.ts`.
+
+- Database, storage, and seed commands call `resolveTarget`, then `resolveConnection`. Never pass a
+  default target: the policy owns the default, so a call site cannot fall back to local or linked.
+- A command that binds `--password` passes `hasPasswordFlag: true` to `resolveConnection`.
+- The linked `Target:` banner comes from `resolveTarget` and `resolveRef`; never build a linked
+  `ResolvedTarget` by hand.
+- Hosted writes call `requireHostedMutationConsent` (or `requireTargetMutationConsent` when the
+  target may be local) after the plan and before the first persistent effect, and pass the
+  returned `HostedMutationConsent` to anything that needs proof of it.
+- Never read stdin for consent. JSON, piped, and agent runs need `--yes` or a shell
+  `SUPABASE_YES`; `supabase/.env` and a cwd `.env*` file do not count. Write the action as an
+  imperative sentence-case phrase with no trailing period (`Delete project <ref>`).
+- A `sync` or `selectable` leaf with `consent: "none"` declares a `consentExemptReason`.
+- Every leaf with consent has a `describeHostedConsent("<command path>", …)` test from
+  `tests/helpers/hosted-consent.ts`.
+
+See [ADR 0033](../../docs/adr/0033-target-selection-and-hosted-mutation-consent.md) for the
+target-default and consent rules.
+
 ## Tests
 
 Follow the root testing philosophy and use the package scripts in `package.json`. Cover meaningful

apps/cli/docs/command-target.md

@@ -0,0 +1,35 @@
+# Command target
+
+Every command that acts on a database or hosted project announces the target it resolved, once, before it acts. The same identity goes to machine consumers as the JSON `target` object.
+
+## Banner
+
+`Target: <text>` on stderr in every output format, printed once per distinct text.
+
+| Target                                | Text                                                                                |
+| ------------------------------------- | ----------------------------------------------------------------------------------- |
+| Local stack                           | `local stack (<host>:<port>)`                                                       |
+| Local stack, nothing selected, linked | `local stack (<host>:<port>) · default; pass --linked for <name> (<ref>)`           |
+| `--db-url`                            | `custom Postgres (<host>:<port>)`; the connection string's credentials never appear |
+| Linked project the cache names        | `project <name> (<ref>) · production`                                               |
+| Linked project nothing vouches for    | `project <ref>`, or `project <name> (<ref>)` when the project picker named it       |
+| Ref other than the linked project     | `project <ref> (not the linked project)`                                            |
+| Branch found by name or UUID          | `project <parent ref> · branch <name> (<ref>)`, or `branch <ref>` for a UUID        |
+
+The `default; pass --linked` hint appears only when the checkout is linked and neither a selector flag nor a workspace `target` chose local. "Branch" is claimed only on positive evidence: a branch lookup by name or UUID, or a live probe. A cached link never proves one.
+
+## JSON `target`
+
+`json` and `stream-json` results carry `target`, tagged by `kind`:
+
+| `kind`   | Fields                                                                                                                                                    |
+| -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `local`  | `host`, `port`                                                                                                                                            |
+| `db-url` | `host`, `port`                                                                                                                                            |
+| `linked` | `project_ref`, `environment` (`production`, `branch` or `unverified`), optional `project_name`, optional `parent_project_ref` (a branch's parent project) |
+
+`environment` is `production` when the linked-project cache names the resolved ref, `branch` on positive evidence, and `unverified` otherwise. A failed identity check is `unverified`, never `branch`.
+
+The first announced target becomes the run's `target`. It is merged into object results and into the machine error envelope. Array results are written unchanged. A command that owns extra `target` fields (for example `branch`, `local_scope`, or `config push`'s probed `environment`) adds them in front of the announced identity's, and its own values win on a clash.
+
+The schema is `CommandTargetJson` in `src/shared/output/command-target.service.ts`; every target is encoded through it before it reaches output.

apps/cli/docs/compute-commands.md

@@ -47,3 +47,9 @@ settings into an ignored file. To deploy a source directory without a Compute
 configuration entry, `compute push` requires an explicit `--exposure public` or
 `--exposure private`. Record the entry in the authoritative config to persist
 its deployment settings.
+
+`compute push` and `compute delete` change the remote project, so both ask for
+confirmation first, and both default to no. `compute delete` asks for the
+compute's name to be typed back. Pass `--yes`, or set `SUPABASE_YES` in your
+shell, to confirm in scripts and CI; without it, a run that cannot prompt fails
+before changing anything.

apps/cli/docs/supabase/config/diff.md

@@ -12,4 +12,4 @@ Local values are shown as the configuration your file would produce once pushed,
 
 With `--exit-code`, the command exits `2` when any difference is found, keeping exit `1` for errors — so scripts can distinguish drift from failure.
 
-Machine-readable output is available through `--output-format json|stream-json` — a versioned payload (`schema_version`, `config_schema`, `target`, `scope`, `changes[]`, `masked[]`, `unmanaged[]`, `counts`) with per-change `path`s as segment arrays. The legacy global `-o`/`--output` flag is not supported by this command; use `--output-format json|stream-json` instead.
+Machine-readable output is available through `--output-format json|stream-json` — a versioned payload (`schema_version`, `config_schema`, `target`, `scope`, `changes[]`, `masked[]`, `unmanaged[]`, `counts`) with per-change `path`s as segment arrays. `target` identifies the compared project: `kind` (`linked`), `project_ref`, `project_name` and `environment` (`production`, `branch` or `unverified`) when known, `parent_project_ref` for a branch, `branch` when it was named, and `local_scope` (`base` or `remotes.<name>`). The legacy global `-o`/`--output` flag is not supported by this command; use `--output-format json|stream-json` instead.

apps/cli/docs/supabase/config/pull.md

@@ -46,4 +46,4 @@ max_rows = 250
 
 Running the same command again finds no differences and writes nothing.
 
-Machine-readable output is available through `--output-format json|stream-json` — a versioned payload (`schema_version`, `config_schema`, `config_path`, `format`, `target`, `destination`, `dry_run`, `wrote`, `scope`, `changes[]`, `warnings[]`, `masked[]`, `unmanaged[]`, `counts`) with per-change `path`s as segment arrays, each carrying `written` and, when unwritten, a `skipped_reason` (`env_reference | local_only | remote_env_reference | unwritable | would_invalidate | declined | dry_run`). A `would_invalidate` warning additionally carries `missing_fields` (`[{path, env_variable?}]`) naming what actually blocked the family. The legacy global `-o`/`--output` flag is not supported by this command; use `--output-format json|stream-json` instead. Note: the payload spells the root scope `"base"` (`target.local_scope`), while text output calls the same thing `config root`.
+Machine-readable output is available through `--output-format json|stream-json` — a versioned payload (`schema_version`, `config_schema`, `config_path`, `format`, `target`, `destination`, `dry_run`, `wrote`, `scope`, `changes[]`, `warnings[]`, `masked[]`, `unmanaged[]`, `counts`) — `target` identifies the pulled project the same way `config diff` does (`kind`, `project_ref`, `project_name`, `environment`, `parent_project_ref`, `branch`, `local_scope`) — with per-change `path`s as segment arrays, each carrying `written` and, when unwritten, a `skipped_reason` (`env_reference | local_only | remote_env_reference | unwritable | would_invalidate | declined | dry_run`). A `would_invalidate` warning additionally carries `missing_fields` (`[{path, env_variable?}]`) naming what actually blocked the family. The legacy global `-o`/`--output` flag is not supported by this command; use `--output-format json|stream-json` instead. Note: the payload spells the root scope `"base"` (`target.local_scope`), while text output calls the same thing `config root`.

apps/cli/docs/supabase/config/push.md

@@ -6,6 +6,8 @@ This command allows you to manage project configuration as code by defining sett
 
 Pass `--project-ref` to push to a specific project, or the name (or UUID) of a branch of the currently linked project — values that are exactly 20 lowercase letters are always treated as project refs. Without it, the linked project is the target.
 
-Before anything is pushed, the command reports the project it resolved — its name and ref. When the resolved target is a preview branch that was only _inferred_ (for example after `supabase link <branch-name>`, or via `SUPABASE_PROJECT_ID`) rather than named on this invocation, it says so, names the branch and its parent project where they can be resolved, and asks for confirmation first. Declining — including on an unattended run with no `--yes` and no piped answer — fails the command rather than pushing. Pass `--yes` (or set `SUPABASE_YES`) to skip that confirmation in CI and scripted runs.
+Before anything is pushed, the command prints the `Target:` line for the project or branch it resolved (name, ref, and for a branch its parent project), then shows the exact diff for every resource that will change. It then asks once — a single question covering every changed resource, with a default answer of no — and sends nothing until you confirm. If a change enables a paid add-on, its price is printed before the question.
 
-An explicit `--project-ref <branch-name-or-uuid>` on the same invocation skips the confirmation entirely (the target is still echoed) — naming the branch yourself already counts as confirming it. Because the confirmation reads one line of piped input just like any other prompt, a script piping multiple `y`/`n` answers to an _inferred_ branch target needs one extra leading answer for it, ahead of the per-service prompts it already answers.
+A push with nothing to change never asks. Declining fails the command and writes nothing. Piped answers are never read, so a script, a JSON run (`-o json`, `--output-format json`) or an agent must pass `--yes` or set `SUPABASE_YES` in the shell; a `SUPABASE_YES` in `supabase/.env` does not count. With `--yes` the command echoes `Confirmed by --yes: …` to stderr and pushes.
+
+In `json` output the result carries a `target` object with the resolved identity (`kind`, `project_ref`, `project_name`, `environment`, and `parent_project_ref` for a branch) next to the push summary.

apps/cli/docs/supabase/db/advisors.md

@@ -1,3 +1,5 @@
 ## supabase-db-advisors
 
 Inspects the database for common security and performance issues such as missing RLS policies, unindexed foreign keys, exposed auth.users, and more.
+
+With no target flag the command inspects the workspace target, which is the local database unless `SUPABASE_TARGET` or `target` in `config.toml` says otherwise. Pass `--linked` for the linked project or `--db-url` for another database. The command prints a `Target:` line on stderr naming the database it resolved, and never asks for confirmation.

apps/cli/docs/supabase/db/diff.md

@@ -2,7 +2,7 @@
 
 Diffs schema changes made to the local or remote database.
 
-Requires the local development stack to be running when diffing against the local database. To diff against a remote or self-hosted database, specify the `--linked` or `--db-url` flag respectively.
+Requires the local development stack to be running when diffing against the local database. To diff against a remote or self-hosted database, specify the `--linked` or `--db-url` flag respectively. With no target flag the command diffs the workspace target, which is the local database unless `SUPABASE_TARGET` or `target` in `config.toml` says otherwise. The command prints a `Target:` line on stderr naming the database it resolved, and never asks for confirmation.
 
 Compares schema differences between the target database and a shadow database, using the bundled pg-delta engine by default. The legacy [djrobstep/migra](https://github.com/djrobstep/migra) engine, which runs in a container, remains available as a fallback (see below). The shadow database is created by applying migrations in local `supabase/migrations` directory in a separate container. Output is written to stdout by default. For convenience, you can also save the schema diff as a new migration file by passing in `-f` flag.
 

apps/cli/docs/supabase/db/dump.md

@@ -1,8 +1,8 @@
 ## supabase-db-dump
 
-Dumps contents from a remote database.
+Dumps contents from the target database.
 
-Requires your local project to be linked to a remote database by running `supabase link`. For self-hosted databases, you can pass in the connection parameters using `--db-url` flag.
+Dumps the local database by default, unless `SUPABASE_TARGET` or `target` in `config.toml` selects the linked project. Pass `--linked` to dump the linked project, which requires your local project to be linked by running `supabase link`. For self-hosted databases, you can pass in the connection parameters using `--db-url` flag. The command prints a `Target:` line on stderr naming the database it resolved, and never asks for confirmation.
 
 Runs `pg_dump` in a container with additional flags to exclude Supabase managed schemas. The ignored schemas include auth, storage, and those created by extensions.