refactor(config): consolidate command-family helpers (CLI-2292)

[Coly010]

Current Behavior

Follow-up debt recorded by the CLI-2064 architecture review (explicitly ruled a follow-up, not a pre-merge fix):

1. pathKey has separate definitions across the config command family's pull/ modules; deepEqualValue/valueAtPath/isDeclaredAtPath are each implemented twice (pull.plan.ts); deepSetAtPath is a third deep-set concept, only reachable through the planner.
2. LegacyConfigTargetErrors<A,B,C,D,E> in config.target.ts hand-injects five generic constructors per command, and reclassifies a 404 via a Predicate.hasProperty("status") duck-type check.
3. config diff and config pull render change classes through a shared label map in config.format.ts.
4. config-edit.ts's [remotes.<label>] placement logic hardcodes the "remotes"/"project_id" literals inline at each use site.

Expected Behavior

1. One config.paths.ts at the command family root holds the shared path/value helpers; the three pull/ modules that duplicated them now import from it. config-edit.ts (in @supabase/config, pinned to smol-toml as its only import per ADR 0023) keeps its own independent copies — deliberately out of scope.
2. config.target.ts now mints each family's four target-resolution error classes from a prefix (legacyMintConfigTargetErrors) and builds their shared message-template bundle in one place (legacyConfigTargetErrorsFor), collapsing LegacyConfigTargetErrors/legacyResolveConfigTarget from five generics to two and replacing the duck-typed 404 check with a typed LegacyConfigTargetResolveFailure bound. diff, pull, and push now all route through this factory — push adopted the shared resolver since the CLI-2064 review, meeting the precondition this item was waiting on.
3. Already done in feat(cli): rebuild config push as diff-first partial updates (CLI-2313) #6454 (CLI-2313) — diff.format.ts already renders through config.format.ts's shared label map. No changes needed; confirmed while implementing this issue.
4. config-edit.ts now names the two literals (REMOTES_TABLE_NAME, REMOTE_PROJECT_ID_KEY) and a shared isRemotesLabelRoot predicate next to the doc comment that already describes the exception.

No user-observable behavior changes — every renamed/relocated helper keeps its exact prior implementation, and the four minted error classes keep their original tags, actionability, and message text (verified against the existing diff/pull/push integration test suites and the error-actionability-coverage drift guard).

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@f943cfdc9da96db98a110bd5411c6066f58a75b6

Preview package for commit f943cfd.

[github-actions]

🤖 AI Review

Both independent reviews were available. Codex reported no findings; Claude reported five. Code inspection confirms all five: two minor consolidation/guard concerns and three nits involving comments, edge-case tests, and type ergonomics. No user-breaking behavioral regression was identified.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/config/config.paths.ts:24	duplication	claude	The new shared record predicate remains duplicated in two config-family modules, contrary to the repository's hoist-before-duplication convention, and the header's stated non-consolidations do not account for those copies.
🟡 MINOR	apps/cli/src/commands/config/config.target.ts:70	test-coverage	claude	Template-interpolating the 12 generated error tags removes them from the static actionability scan, while their runtime coverage now depends on each family errors module continuing to contain an unrelated literal-tagged error.
⚪ NIT	apps/cli/src/commands/config/diff/diff.handler.ts:155	documentation	claude	The diff and pull target-resolution comments still describe sharing only with each other, omitting config push.
⚪ NIT	apps/cli/src/commands/config/config.paths.unit.test.ts:42	test-coverage	claude	The new tests do not distinguish own-property lookup from inherited-property lookup and omit the empty-path and existing-scalar replacement semantics of legacyConfigDeepSetAtPath.
⚪ NIT	apps/cli/src/commands/config/diff/diff.errors.ts:46	api-design	claude	Changing the 12 exported error classes to const constructor aliases removes their direct type-position usability.

Stats

Claude findings: 5 · Codex findings: 0 · Confirmed: 5 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.