@devdogsuga/backstage 0.1.2 → 0.1.4

package/dist/{cli-YLCe3Zrx.js → cli-BI5Vn9sR.js}

@@ -1,18 +1,22 @@
 import { C as discoverRepoRoot, T as cliName, b as ownPackageDir, c as reportDevtoolsError, f as isNoEnv, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive, w as findRepoRoot, x as ownVersion } from "./telemetry-Bjoz29Hl.js";
-import { _ as repoPeerUrl, a as recordEnteredTier, b as renderHelp, f as nonEmpty, h as loadEnvLoad, i as beginInvocation, l as dbPush, m as loadEnv, n as bareGroupStartPath, o as recordResolved, p as getEnvSync, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun, v as helpPath, y as renderCommandList } from "./catalog-BOBE4ee7.js";
+import { a as recordEnteredTier, f as helpPath, i as beginInvocation, l as dbPush, m as renderHelp, n as bareGroupStartPath, o as recordResolved, p as renderCommandList, r as runMenu, s as reproducibleCommand, t as catalog, u as dbPushDryRun } from "./catalog-BuNLUu08.js";
+import { a as repoPeerUrl, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-B0KDkI6a.js";
+import { t as nonEmpty } from "./connection-D3XsOE3S.js";
 import { a as dryRunKind, l as wouldRunLine, o as isDryRun } from "./options-BTjOf5KP.js";
 import { a as explainError, i as explain, n as bail, o as unwrap, r as errorMessage } from "./ui-CdKo8mLw.js";
 import { n as positionals, t as flagValue } from "./args-Cjr_Iqts.js";
+import { a as listSecrets$1, c as updateSecret, i as createSecret, o as projectIdFor, r as byKey, s as setExplicitAccessToken } from "./client-B7HhuTaA.js";
+import { c as EnvDocument } from "./vault-C8LYJFOQ.js";
 import { t as DONE } from "./dispatch-D048O65I.js";
-import { createRequire, register } from "node:module";
+import { register } from "node:module";
 import { pathToFileURL } from "node:url";
 import { appendFileSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
-import { confirm, intro, log, note, outro, password, select, spinner, text } from "@clack/prompts";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, join, resolve } from "node:path";
+import { confirm, intro, log, note, outro, select } from "@clack/prompts";
+import { chmod, readFile, writeFile } from "node:fs/promises";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import { homedir, tmpdir } from "node:os";
+import { tmpdir } from "node:os";
 import { z } from "zod";
 import { randomBytes } from "node:crypto";
 import postgres from "postgres";
@@ -1387,7 +1391,7 @@ function ambientValue(ambient, name) {
 * character fails at the far end of the pipeline, against a service that will
 * only say "unauthorized".
 */
-function quote$1(key, value) {
+function quote(key, value) {
 	if (value.startsWith("'") || value.endsWith("'")) throw new DeployError(`${key} begins or ends with a single quote, which cannot be quoted.`, ["Re-issue the credential, or wrap it (base64) at both ends."]);
 	return `'${value}'`;
 }
@@ -1489,7 +1493,7 @@ function compose(options, env) {
 			throw error;
 		}
 		else value = entry.value;
-		lines.push(`${key}=${quote$1(key, value)}`);
+		lines.push(`${key}=${quote(key, value)}`);
 		provenance.set(key, entry.from);
 	}
 	try {
@@ -1746,292 +1750,6 @@ async function runDeployCommand(rest) {
 	}
 }
 //#endregion
-//#region ../cli-core/src/env/document.ts
-/**
-* An editable `.env` that survives being edited.
-*
-* The root `.env` is not a data file. It is 150 lines of hard-won commentary
-* about which value breaks the Supabase CLI when empty, which one must stay
-* commented out, and why. A writer that parses to a Map and serializes back
-* destroys all of it on the first save.
-*
-* So this keeps the file as **lines** and edits in place. An untouched line is
-* returned byte-for-byte, including its spacing, quoting style and trailing
-* comment. Only the lines actually being changed are rewritten.
-*
-* Nothing is ever deleted. Removing a key comments it out, so the value stays
-* recoverable from the file itself, and re-adding it later uncomments that line
-* rather than appending a duplicate.
-*/
-/**
-* `KEY=value`, active. Groups: indent, `export ` prefix, key, value.
-*
-* The prefix is CAPTURED rather than skipped so an update can put it back.
-* Dropping it turns `export FOO=` into `FOO=`, which still parses here and
-* stops being exported to child processes. That shows up as a missing variable
-* three tools downstream.
-*/
-const ACTIVE = /^(\s*)((?:export\s+)?)([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/;
-/** `# KEY=value`, the commented form this tool writes and reads back. */
-const COMMENTED = /^(\s*)#\s?((?:export\s+)?)([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/;
-/**
-* Reads the value half of an assignment.
-*
-* Deliberately NOT a general dotenv parser: it does not expand `$VAR`, because
-* a stored value that means one thing in the file and another in the process
-* cannot be rotated with confidence.
-*/
-function parseValue(rest) {
-	const text = rest.trim();
-	if (text.startsWith("\"")) {
-		const end = findClosing(text, "\"");
-		if (end === -1) return unescape(text.slice(1));
-		return unescape(text.slice(1, end));
-	}
-	if (text.startsWith("'")) {
-		const end = findClosing(text, "'");
-		if (end === -1) return text.slice(1);
-		return text.slice(1, end);
-	}
-	const hash = text.search(/\s#/);
-	return (hash === -1 ? text : text.slice(0, hash)).trim();
-}
-function findClosing(text, quote) {
-	for (let i = 1; i < text.length; i += 1) {
-		if (text[i] === "\\") {
-			i += 1;
-			continue;
-		}
-		if (text[i] === quote) return i;
-	}
-	return -1;
-}
-function unescape(text) {
-	return text.replace(/\\([nrt\\"'])/g, (_, c) => c === "n" ? "\n" : c === "r" ? "\r" : c === "t" ? "	" : c);
-}
-/**
-* Splits everything after `=` into its value and its trailing comment.
-*
-* Quote-aware, because the naive "cut at the first `#`" truncates a generated
-* password into something that still looks like one. A `#` inside quotes is
-* part of the value; outside them it starts a comment only when whitespace
-* precedes it.
-*/
-function splitComment(rest) {
-	const text = rest.trimStart();
-	let after;
-	if (text.startsWith("\"") || text.startsWith("'")) {
-		const end = findClosing(text, text[0]);
-		after = end === -1 ? text.length : end + 1;
-	} else {
-		const hash = text.search(/\s#/);
-		after = hash === -1 ? text.length : hash;
-	}
-	const tail = text.slice(after);
-	const hash = tail.indexOf("#");
-	return { comment: hash === -1 ? "" : tail.slice(hash).trimEnd() };
-}
-/**
-* Recognises a stamp this tool wrote, so it is replaced rather than duplicated.
-*
-* Deliberately narrow: it matches the exact bracketed shape below and nothing
-* else, because the cost of a false positive is deleting somebody's own note.
-*/
-const STAMP = /\s*#\s*\[[a-z][a-z0-9-]* (?:pushed|pulled) \d{4}-\d{2}-\d{2}\]\s*$/;
-function stampText(stamp) {
-	return `# [${stamp.environment} ${stamp.action} ${stamp.date}]`;
-}
-function isStamp(comment) {
-	return STAMP.test(comment);
-}
-/** Always double-quoted, so a multi-line value round-trips through one line. */
-function quote(value) {
-	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")}"`;
-}
-var EnvDocument = class EnvDocument {
-	lines;
-	/** Whether this session has already appended, so it separates only once. */
-	appended = false;
-	constructor(lines) {
-		this.lines = lines;
-	}
-	static parse(text) {
-		const lines = text.split("\n").map((raw) => {
-			const active = ACTIVE.exec(raw);
-			if (active) return {
-				raw,
-				key: active[3],
-				value: parseValue(active[4])
-			};
-			const commented = COMMENTED.exec(raw);
-			if (commented) return {
-				raw,
-				key: commented[3],
-				value: parseValue(commented[4]),
-				commented: true
-			};
-			return { raw };
-		});
-		return new EnvDocument(lines);
-	}
-	static empty() {
-		return new EnvDocument([]);
-	}
-	find(key, commented) {
-		return this.lines.findIndex((l) => l.key === key && Boolean(l.commented) === commented);
-	}
-	/** The active value, or undefined when absent or commented out. */
-	get(key) {
-		const i = this.find(key, false);
-		return i === -1 ? void 0 : this.lines[i].value;
-	}
-	/** Present and active. */
-	has(key) {
-		return this.find(key, false) !== -1;
-	}
-	/** Present, but commented out. */
-	isCommented(key) {
-		return this.find(key, false) === -1 && this.find(key, true) !== -1;
-	}
-	/** Every active assignment, in file order. */
-	entries() {
-		return this.lines.filter((l) => l.key !== void 0 && !l.commented).map((l) => [l.key, l.value]);
-	}
-	keys() {
-		return this.entries().map(([k]) => k);
-	}
-	/**
-	* Sets a value, preferring to revive a commented line over appending.
-	*
-	* Appending when a commented form already exists is how a file ends up with
-	* the same key twice: one stale, both plausible, and which one looks
-	* authoritative depends on where the reader scrolled to.
-	*/
-	set(key, value, stamp) {
-		const active = this.find(key, false);
-		if (active !== -1) {
-			const line = this.lines[active];
-			const match = ACTIVE.exec(line.raw);
-			const existing = splitComment(match[4]).comment;
-			if (stamp && existing !== "" && !isStamp(existing)) this.lines.splice(this.first(key), 0, { raw: existing });
-			const trailing = stamp ? ` ${stampText(stamp)}` : existing === "" ? "" : ` ${existing}`;
-			const at = this.find(key, false);
-			const target = this.lines[at];
-			target.raw = `${match[1]}${match[2]}${key}=${quote(value)}${trailing}`;
-			target.value = value;
-			return;
-		}
-		const commented = this.find(key, true);
-		if (commented !== -1) {
-			const line = this.lines[commented];
-			line.raw = `${key}=${quote(value)}${stamp ? ` ${stampText(stamp)}` : ""}`;
-			line.value = value;
-			line.commented = false;
-			return;
-		}
-		if (!this.appended && this.lines.length > 0 && this.lines.at(-1).raw !== "") this.lines.push({ raw: "" });
-		this.appended = true;
-		this.lines.push({
-			raw: `${key}=${quote(value)}${stamp ? ` ${stampText(stamp)}` : ""}`,
-			key,
-			value
-		});
-	}
-	/** Index of the first line mentioning a key, active or commented. */
-	first(key) {
-		return this.lines.findIndex((l) => l.key === key);
-	}
-	/**
-	* Moves every line for a key next to that key's first appearance.
-	*
-	* Files drift: a key gets commented out near the bottom, re-added at the top
-	* six weeks later, and now two lines claim the same name a hundred lines
-	* apart. Whichever one a reader scrolls to first looks authoritative.
-	*
-	* The FIRST occurrence keeps its position, so the standalone comment block
-	* documenting a key stays attached to it. Everything else moves up to join
-	* it, in the order it already had.
-	*/
-	group() {
-		const out = [];
-		const taken = /* @__PURE__ */ new Set();
-		let moved = false;
-		for (let i = 0; i < this.lines.length; i += 1) {
-			if (taken.has(i)) continue;
-			const line = this.lines[i];
-			out.push(line);
-			taken.add(i);
-			if (line.key === void 0) continue;
-			for (let j = i + 1; j < this.lines.length; j += 1) {
-				if (taken.has(j) || this.lines[j].key !== line.key) continue;
-				if (j !== i + 1 || taken.has(i + 1)) moved = true;
-				out.push(this.lines[j]);
-				taken.add(j);
-			}
-		}
-		this.lines = out;
-		return moved;
-	}
-	/**
-	* Blanks every active value without losing one.
-	*
-	* Each becomes a commented line holding what it was, plus an empty active
-	* line under it. The file still declares every key it needs, which is what
-	* makes it a usable checklist, while holding nothing.
-	*
-	* Already-empty keys are skipped. Commenting out `FOO=""` to write `FOO=""`
-	* underneath is churn that makes the next diff harder to read.
-	*/
-	reset() {
-		const out = [];
-		const cleared = [];
-		for (const line of this.lines) {
-			if (line.key === void 0 || line.commented || line.value === "") {
-				out.push(line);
-				continue;
-			}
-			const exported = ACTIVE.exec(line.raw)?.[2] ?? "";
-			line.raw = `# ${line.raw.trimStart()}`;
-			line.commented = true;
-			out.push(line);
-			out.push({
-				raw: `${exported}${line.key}=""`,
-				key: line.key,
-				value: ""
-			});
-			cleared.push(line.key);
-		}
-		this.lines = out;
-		return cleared;
-	}
-	/**
-	* Comments a key out rather than deleting it.
-	*
-	* A no-op when it is already commented or absent, so running a sync twice
-	* cannot produce `## KEY=`.
-	*/
-	comment(key) {
-		const i = this.find(key, false);
-		if (i === -1) return false;
-		const line = this.lines[i];
-		line.raw = `# ${line.raw.trimStart()}`;
-		line.commented = true;
-		return true;
-	}
-	/** Restores a commented assignment. Returns its value, or undefined. */
-	uncomment(key) {
-		const i = this.find(key, true);
-		if (i === -1) return void 0;
-		const line = this.lines[i];
-		line.raw = line.raw.replace(/^(\s*)#\s?/, "$1");
-		line.commented = false;
-		return line.value;
-	}
-	toString() {
-		return this.lines.map((l) => l.raw).join("\n");
-	}
-};
-//#endregion
 //#region ../cli-core/src/env/files.ts
 /**
 * Reading and writing a target's env file, shared by every command that edits
@@ -2217,665 +1935,6 @@ async function resolveVaultTarget(given, message) {
 	}));
 }
 //#endregion
-//#region src/bws/token.ts
-/**
-* Finding the Secrets Manager access token, in four places, in order.
-*
-*   1. `--access-token`   explicit, and explicit beats ambient
-*   2. `BWS_ACCESS_TOKEN` the environment, which includes your `.env`,
-*                         since `with-env` loads it for every command
-*   3. the Bitwarden Password Manager vault, via the bundled `bw`
-*                         (`env` signs in and unlocks it for itself)
-*   4. ask, and offer to save it to `.env` (the default) or the vault, so
-*      this is the last time
-*
-* The ordering logic is separated from the four implementations because it is
-* the part that can be wrong invisibly. A chain that silently prefers a stale
-* environment variable over a rotated vault entry authenticates as the wrong
-* account and reports nothing, so the order is asserted rather than assumed.
-*/
-var NoAccessTokenError = class extends Error {};
-async function resolveToken(sources) {
-	const announce = sources.onSource ?? (() => void 0);
-	if (sources.explicit) {
-		announce("flag");
-		return sources.explicit;
-	}
-	if (sources.env) {
-		announce("environment");
-		return sources.env;
-	}
-	const stored = await sources.fromVault();
-	if (stored) {
-		announce("vault");
-		return stored;
-	}
-	const typed = await sources.prompt();
-	if (!typed) throw new NoAccessTokenError("No access token. Put BWS_ACCESS_TOKEN in your .env (an interactive run offers to do this for you), pass --access-token, or store one in your Bitwarden vault. See docs/toolkit/guides/env/commands.md.");
-	announce("prompt");
-	if (await sources.offerSave()) try {
-		await sources.save(typed);
-	} catch (err) {
-		log.warn(`Could not save to your vault: ${err instanceof Error ? err.message : String(err)}. Continuing with the token you typed.`);
-	}
-	return typed;
-}
-/**
-* A weak shape check, to turn a paste error into a sentence rather than a 401.
-*
-* Machine account tokens are `0.<uuid>.<secret>:<secret>`. This checks the
-* leading version segment only, and **warns rather than refuses**: the format
-* is Bitwarden's to change, and a tool that rejects a valid token because its
-* prefix moved is worse than one that passes a bad token to `bws` and lets the
-* real error surface.
-*/
-function looksLikeAccessToken(value) {
-	return /^\d+\.[0-9a-f-]{36}\./i.test(value.trim());
-}
-/** The interactive half. Masked, and never echoed back. */
-async function promptForToken() {
-	if (!process.stdin.isTTY) return void 0;
-	const typed = unwrap(await password({
-		message: "Paste the Secrets Manager access token for the `admin` account",
-		mask: "•",
-		validate: (v) => (v ?? "").trim() === "" ? "An access token is required." : void 0
-	})).trim();
-	if (!looksLikeAccessToken(typed)) log.warn("That does not look like a machine account access token (they start `0.<uuid>.`). Continuing anyway — if it is wrong, Bitwarden will say so.");
-	return typed;
-}
-//#endregion
-//#region src/bws/retry.ts
-/**
-* Retrying exactly one failure class: HTTP 429, rate limiting.
-*
-* A 429 is the server saying "correct request, wrong minute", the only error
-* where trying the same thing again IS the fix. Everything else (bad token,
-* missing project, malformed input) re-throws untouched on the first attempt,
-* because retrying those just triples the time to the real message.
-*
-* Written for the Secrets Manager calls, where the minute matters: a push is
-* ~45 sequential writes plus a login, several targets get pushed back-to-back,
-* and Bitwarden's identity endpoint rate-limits repeated access-token logins
-* aggressively. The login half is also fixed at the source, since the client
-* now caches its login in a state file, so the retry is the belt on that
-* suspender.
-*/
-function isRateLimited(err) {
-	const message = err instanceof Error ? err.message : String(err);
-	return /\b429\b|too many requests|rate.?limit/i.test(message);
-}
-const wait$1 = (ms) => new Promise((r) => setTimeout(r, ms));
-async function withRateLimitRetry(op, { retries = 3, baseMs = 5e3, sleep = wait$1, doing }) {
-	for (let attempt = 0;; attempt++) try {
-		return await op();
-	} catch (err) {
-		if (!isRateLimited(err) || attempt >= retries) throw err;
-		const ms = baseMs * 2 ** attempt;
-		log.warn(`Bitwarden rate-limited ${doing} (HTTP 429). Waiting ${ms / 1e3}s and retrying (${attempt + 1}/${retries})…`);
-		await sleep(ms);
-	}
-}
-//#endregion
-//#region src/bws/pace.ts
-const WRITE_GAP_MS = 1100;
-const wait = (ms) => new Promise((r) => setTimeout(r, ms));
-function makePacer(now = Date.now, sleep = wait) {
-	let notBefore = 0;
-	let chain = Promise.resolve();
-	return (kind) => {
-		const gap = kind === "write" ? WRITE_GAP_MS : 350;
-		const turn = chain.then(async () => {
-			const pause = notBefore - now();
-			if (pause > 0) await sleep(pause);
-			notBefore = now() + gap;
-		});
-		chain = turn.catch(() => void 0);
-		return turn;
-	};
-}
-//#endregion
-//#region src/bws/store.ts
-/**
-* Saving a prompted value into the developer's own `.env`.
-*
-* The development file only, by construction: the path is fixed to
-* `fileFor("development")`, so no caller can point this at a vault target's
-* file. Those are what `env push` uploads, and the values saved here
-* (`BWS_ACCESS_TOKEN`, `BWS_ORG_ID`) exist so they never ride a push. The
-* token is refused there by name anyway; this keeps the write from ever being
-* the thing that needs refusing.
-*
-* `EnvDocument.set` revives the commented line the rendered file already
-* carries (never-store keys ship as `# KEY=""` with their documentation), so a
-* saved value lands under its own doc comment rather than appended bare.
-*/
-async function saveToDevEnv(key, value) {
-	const { fileFor } = await loadEnv();
-	const path = resolve(findRepoRoot(), fileFor("development"));
-	let doc;
-	try {
-		doc = EnvDocument.parse(await readFile(path, "utf8"));
-	} catch {
-		doc = EnvDocument.empty();
-	}
-	doc.set(key, value);
-	await writeFile(path, doc.toString());
-}
-//#endregion
-//#region src/bws/bw.ts
-/**
-* Where the bundled Bitwarden CLI (`bw`) is, for the vault code that signs in
-* and reads the Secrets Manager token (`vault.ts`).
-*
-* There is no `bw` command of ours: `env` runs `bw login` and `bw unlock`
-* itself when it needs the token. The binary is still resolved from
-* `@bitwarden/cli`, never looked up on PATH. A dependency's bin is only linked
-* into the `node_modules/.bin` of the package that depends on it, so under
-* `pnpm dlx` nothing puts `bw` on PATH and a bare `spawn("bw")` is ENOENT.
-*/
-/**
-* The `[command, args]` pair that runs the bundled Bitwarden CLI.
-*
-* Runs `build/bw.js` under this Node rather than through a shim, so it works
-* the same wherever backstage is installed. Falls back to `bw` on PATH when the
-* package cannot be resolved, which keeps a missing install surfacing as the
-* ENOENT every caller already handles.
-*/
-function bwCommand(args) {
-	try {
-		const require_ = createRequire(import.meta.url);
-		const pkgPath = require_.resolve("@bitwarden/cli/package.json");
-		const pkg = require_(pkgPath);
-		return [process.execPath, [join(dirname(pkgPath), pkg.bin.bw), ...args]];
-	} catch {
-		return ["bw", args];
-	}
-}
-//#endregion
-//#region src/bws/vault.ts
-/**
-* The Bitwarden **Password Manager** vault, via the `bw` CLI.
-*
-* A different product from Secrets Manager and a different CLI, which is the
-* point: `bws` has no user authentication at all, so the access token it needs
-* has to be held somewhere a person can log in to. That somewhere is the
-* Password Manager vault, and this module reads it back rather than making
-* somebody paste a token every session.
-*
-* Everything here degrades to `undefined`. A missing `bw`, a locked vault, a
-* declined unlock, a missing item: none of them are errors, because each has a
-* good fallback, which is to ask. Throwing would turn a convenience into a
-* prerequisite.
-*
-* ⚠️ The token never passes through argv in either direction. Reads use
-* `bw get password <search>`, which puts only the item NAME on the command
-* line, and writes pipe base64 JSON through **stdin**, which `bw create item`
-* documents as an accepted input.
-*/
-const run$5 = promisify(execFile);
-/**
-* The item this looks for, and creates.
-*
-* Named for what it unlocks rather than for this tool, because whoever finds it
-* in the vault six months from now needs to know what it is, not which script
-* wrote it.
-*/
-const VAULT_ITEM_NAME = "DevDogs Secrets Manager access token (admin)";
-/** `bw status`, or `unavailable` when the CLI is not installed. */
-async function vaultStatus() {
-	try {
-		const { stdout } = await run$5(...bwCommand(bwArgs(["status", "--response"])), { shell: false });
-		const parsed = JSON.parse(stdout);
-		const status = ("status" in parsed ? parsed.status : void 0) ?? ("data" in parsed ? parsed.data?.template?.status : void 0);
-		if (status === "unlocked") return "unlocked";
-		if (status === "locked") return "locked";
-		return "unauthenticated";
-	} catch (err) {
-		if (err.code === "ENOENT") return "unavailable";
-		return "unauthenticated";
-	}
-}
-/**
-* Offers to sign in to the vault when it is not, and does it with the bundled
-* `bw` (`bw login`, interactive). There is no `bw` command of ours to run by
-* hand any more: `env` signs in and unlocks for itself, at the moment it needs
-* the Secrets Manager token. Returns the status afterwards.
-*
-* Asks first, like the unlock below: a master-password prompt that appears
-* unannounced is shaped exactly like the thing people are told never to type
-* their master password into. Without a terminal there is nobody to sign in,
-* so the status comes back unchanged.
-*/
-async function signInIfNeeded(status) {
-	if (status !== "unauthenticated" || !process.stdin.isTTY) return status;
-	if (!unwrap(await confirm({
-		message: "You are not signed in to Bitwarden. Sign in now to look for the access token?",
-		initialValue: true
-	}))) return status;
-	if (await new Promise((resolve) => {
-		const child = spawn(...bwCommand(["login"]), {
-			stdio: "inherit",
-			shell: false
-		});
-		child.on("error", () => resolve(null));
-		child.on("close", (exit) => resolve(exit));
-	}) !== 0) return status;
-	return vaultStatus();
-}
-/**
-* A usable session key, unlocking if the person agrees.
-*
-* `BW_SESSION` is preferred and silent. Otherwise this ASKS before unlocking:
-* a tool that pops a master-password prompt unannounced is shaped exactly like
-* the thing people are told never to type their master password into.
-*
-* The password is typed straight into `bw`. stdin is inherited, so it never
-* passes through this process.
-*/
-async function session(status) {
-	if (process.env.BW_SESSION) return process.env.BW_SESSION;
-	if (status !== "locked") return void 0;
-	if (!process.stdin.isTTY) return void 0;
-	if (!unwrap(await confirm({
-		message: "Your Bitwarden vault is locked. Unlock it to look for the access token?",
-		initialValue: true
-	}))) return void 0;
-	return new Promise((resolve) => {
-		const child = spawn(...bwCommand(["unlock", "--raw"]), {
-			stdio: [
-				"inherit",
-				"pipe",
-				"inherit"
-			],
-			shell: false
-		});
-		let out = "";
-		child.stdout.on("data", (c) => out += c.toString());
-		child.on("error", () => resolve(void 0));
-		child.on("close", (code) => resolve(code === 0 && out.trim() !== "" ? out.trim() : void 0));
-	});
-}
-/**
-* Adds the session key, and `--nointeraction` always.
-*
-* The second one is not belt-and-braces. `bw` prompts for a master password on
-* stdin whenever the vault is locked, as `bw get template item` does against a
-* locked vault, and this module runs `bw` with piped stdio, where that prompt
-* has nobody to answer it and hangs until something gives up. `--nointeraction`
-* turns that into an immediate non-zero exit, which every caller here already
-* treats as "not available, ask instead".
-*/
-function bwArgs(args, key) {
-	const withNoInteraction = [...args, "--nointeraction"];
-	return key ? [
-		...withNoInteraction,
-		"--session",
-		key
-	] : withNoInteraction;
-}
-/**
-* The stored token, or `undefined` for every reason it might not be there.
-*
-* `bw get password` takes a search term and fails when it matches more than one
-* item, which is the behaviour worth having: two items called something like
-* this means somebody should look, not that this should guess.
-*/
-async function readTokenFromVault() {
-	const status = await signInIfNeeded(await vaultStatus());
-	if (status === "unavailable" || status === "unauthenticated") {
-		log.info(explainVault(status));
-		return;
-	}
-	const key = await session(status);
-	if (status === "locked" && !key) return void 0;
-	const s = spinner();
-	s.start("Looking in your Bitwarden vault");
-	try {
-		const { stdout } = await run$5(...bwCommand(bwArgs([
-			"get",
-			"password",
-			VAULT_ITEM_NAME,
-			"--raw"
-		], key)), { shell: false });
-		const token = stdout.trim();
-		if (token === "") {
-			s.stop("Nothing stored in the vault yet");
-			return;
-		}
-		s.stop(`Read the access token from your vault ("${VAULT_ITEM_NAME}")`);
-		return token;
-	} catch {
-		s.stop("No single matching item in your vault");
-		return;
-	}
-}
-/**
-* Creates the item, with the token arriving on **stdin** as base64 JSON.
-*
-* `bw create item` documents an encoded-JSON positional AND stdin. Using stdin
-* is the difference between a live credential that is invisible and one that
-* sits in `ps` output for the length of the call.
-*/
-async function saveTokenToVault(token) {
-	const status = await signInIfNeeded(await vaultStatus());
-	if (status === "unavailable" || status === "unauthenticated") return false;
-	const key = await session(status);
-	if (status === "locked" && !key) return false;
-	const item = {
-		organizationId: null,
-		collectionIds: null,
-		folderId: null,
-		type: 1,
-		name: VAULT_ITEM_NAME,
-		notes: "Bitwarden Secrets Manager access token for the `admin` machine account, read/write on preflight, staging and production.\n\nRead automatically by `backstage env`. Never put this in a .env file: it unlocks all three projects, and the tool refuses to upload it.",
-		favorite: false,
-		reprompt: 0,
-		login: {
-			username: null,
-			password: token,
-			totp: null
-		}
-	};
-	return new Promise((resolve) => {
-		const child = spawn(...bwCommand(bwArgs(["create", "item"], key)), {
-			stdio: [
-				"pipe",
-				"ignore",
-				"pipe"
-			],
-			shell: false
-		});
-		let stderr = "";
-		child.stderr.on("data", (c) => stderr += c.toString());
-		child.on("error", () => resolve(false));
-		child.on("close", (code) => {
-			if (code !== 0 && stderr.trim() !== "") log.warn(stderr.trim());
-			resolve(code === 0);
-		});
-		child.stdin.end(Buffer.from(JSON.stringify(item)).toString("base64"));
-	});
-}
-/** Why the vault could not be used, phrased as something to do about it. */
-function explainVault(status) {
-	if (status === "unavailable") return "The `bw` CLI is not installed, so the vault could not be checked. It ships with backstage, so reinstall it.";
-	if (status === "unauthenticated") return "You are not signed in to Bitwarden, and with no terminal there is nobody to sign in. Set BWS_ACCESS_TOKEN instead.";
-}
-//#endregion
-//#region src/bws/client.ts
-/**
-* Secrets Manager, through the official SDK. No `bws` binary to install.
-*
-* This wrapped the `bws` CLI until 2026-08-19. The CLI was the right call
-* against the raw REST API: Secrets Manager is end-to-end encrypted, the
-* server stores ciphertext, and the client derives the key that opens it from
-* the access token, so `fetch` returns blobs and reimplementing the crypto is
-* not a trade worth making. `@bitwarden/sdk-napi` is that same client-side
-* crypto (the same Rust core the CLI wraps), loaded in-process, which buys two
-* things the CLI could not:
-*
-*   * **Nothing to install.** The SDK is a dependency of this package, so
-*     `pnpm install` is the whole setup. No "install bws from the releases
-*     page" step, and no version somebody's laptop drifted on.
-*   * **No credential in argv.** `bws secret create` took the VALUE as a
-*     positional argument, visible to `ps` for the length of the call, a
-*     documented property of the tool this wrapper could only apologize for.
-*     In-process values never touch a process table.
-*
-* ⚠️ Imported LAZILY, at the first real call. The SDK is a native module, and
-* loading it at import time would tax every `cli:no-env` path, the CI guards
-* included, with a `.node` binary none of them use.
-*
-* The one thing the SDK needs that the CLI did not: the ORGANIZATION ID. The
-* CLI derived it from the access token's login response; the SDK's every list
-* and create takes it as an argument, and nothing in its API discovers it. It
-* is a public identifier (a UUID that confers nothing), read from `BWS_ORG_ID`.
-* See the declaration in `packages/devtools/env.ts`.
-*/
-var BwsError = class extends Error {};
-/**
-* One pacer for the process: every Secrets Manager request funnels through
-* it, spaced under the published per-IP limits so the 429 retry stays a
-* backstop instead of the plan. See `pace.ts` for the numbers and sources.
-*/
-const pace = makePacer();
-let explicitToken;
-let resolved;
-/** Where a just-typed token goes, picked in `offerSave`, used in `save`. */
-let saveDestination = "no";
-/** Records `--access-token`, before any command runs. */
-function setExplicitAccessToken(token) {
-	explicitToken = token;
-	resolved = void 0;
-}
-/**
-* The access token, found once per process.
-*
-* Memoized as a **promise**, not a value: resolution can prompt, and a single
-* command makes several Secrets Manager calls. Caching the value alone would
-* still let two concurrent calls open two prompts over each other.
-*
-* Whatever the source, the token reaches the SDK as a function argument in
-* this process, never argv, never a child's environment.
-*/
-async function accessToken() {
-	resolved ??= resolveToken({
-		explicit: explicitToken,
-		env: process.env.BWS_ACCESS_TOKEN,
-		fromVault: readTokenFromVault,
-		prompt: promptForToken,
-		offerSave: async () => {
-			saveDestination = unwrap(await select({
-				message: "Save it, so this is the last time you paste it?",
-				options: [
-					{
-						value: "env",
-						label: "yes — into .env",
-						hint: "gitignored, this machine only; push refuses it by name"
-					},
-					{
-						value: "vault",
-						label: "yes — into my Bitwarden vault",
-						hint: "needs `pnpm devtools bw login`; follows you across machines"
-					},
-					{
-						value: "no",
-						label: "no — ask me again next time"
-					}
-				],
-				initialValue: "env"
-			}));
-			return saveDestination !== "no";
-		},
-		save: async (token) => {
-			if (saveDestination === "env") {
-				await saveToDevEnv("BWS_ACCESS_TOKEN", token);
-				log.success("Stored in .env — with-env loads it on every run.");
-				return;
-			}
-			if (await saveTokenToVault(token)) log.success(`Stored as "${VAULT_ITEM_NAME}" in your Bitwarden vault.`);
-			else log.warn("Could not save it. The command will continue with the token you typed; nothing was written to your vault.");
-		},
-		onSource: (source) => {
-			if (source === "flag") log.warn("--access-token puts a live credential in argv, where `ps` can read it for the length of the call, and in your shell history. Prefer BWS_ACCESS_TOKEN or the vault.");
-		}
-	}).catch((err) => {
-		resolved = void 0;
-		throw err instanceof NoAccessTokenError ? new BwsError(err.message) : err;
-	});
-	return resolved;
-}
-let resolvedOrgId;
-/**
-* The organization the machine account belongs to: the environment, else a
-* prompt with an offer to save.
-*
-* Prompted rather than only refused because it is the one Secrets Manager
-* input with nothing secret about it: a public UUID that identifies without
-* authorizing. Where nobody can answer (a pipe), the named refusal below is
-* the answer, because an SDK error about a malformed UUID would send somebody
-* debugging the token, which is the one thing that is fine.
-*/
-function organizationId() {
-	resolvedOrgId ??= (async () => {
-		const fromEnv = process.env.BWS_ORG_ID;
-		if (fromEnv) return fromEnv;
-		if (!process.stdin.isTTY) throw new BwsError("BWS_ORG_ID is not set. The Secrets Manager SDK addresses everything by organization id — a public UUID, shown in the Secrets Manager URL (bitwarden.com/#/sm/<org-id>/...) and on the machine-account page. Put it in your .env; it identifies, it does not authorize.");
-		const typed = unwrap(await text({
-			message: "What is the Bitwarden organization id? (the UUID in the Secrets Manager URL: bitwarden.com/#/sm/<org-id>/...)",
-			validate: (v) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test((v ?? "").trim()) ? void 0 : "That is not a UUID."
-		})).trim();
-		try {
-			await saveToDevEnv("BWS_ORG_ID", typed);
-			log.success("Stored BWS_ORG_ID in .env.");
-		} catch (err) {
-			log.warn(`Could not save it to .env: ${err instanceof Error ? err.message : String(err)}. Continuing with the id you typed.`);
-		}
-		return typed;
-	})();
-	resolvedOrgId.catch(() => {
-		resolvedOrgId = void 0;
-	});
-	return resolvedOrgId;
-}
-/** The lazily-loaded, logged-in SDK client, one per process. */
-let sdk;
-/**
-* Where the SDK caches its login, so a process is not a fresh authentication.
-*
-* ⚠️ This file is what stops the 429s. Bitwarden's identity endpoint
-* rate-limits repeated access-token logins hard, and "push preflight, audit,
-* push staging, audit, push production, audit" is six devtools processes in
-* two minutes: six logins without this, ONE with it. The `bws` binary kept a
-* state directory for exactly this reason, and the SDK migration dropped it.
-* Per machine account (the token's client-id UUID is in the filename, public
-* by format), under 0700 directories, and outside the repository, because it
-* caches an auth token and must live where nothing syncs or commits it.
-*/
-function stateFileFor(accessToken) {
-	const clientId = /^\d+\.([0-9a-f-]{36})\./i.exec(accessToken)?.[1] ?? "default";
-	return join(homedir(), ".config", "devdogs-devtools", `bws-state-${clientId}.json`);
-}
-async function client() {
-	sdk ??= (async () => {
-		const token = await accessToken();
-		const { BitwardenClient } = await import("@bitwarden/sdk-napi");
-		const instance = new BitwardenClient();
-		try {
-			const stateFile = stateFileFor(token);
-			await mkdir(dirname(stateFile), {
-				recursive: true,
-				mode: 448
-			});
-			await withRateLimitRetry(async () => {
-				await pace("write");
-				return instance.auth().loginAccessToken(token, stateFile);
-			}, { doing: "the login" });
-		} catch (err) {
-			throw new BwsError(describeSdkFailure(err, "logging in"));
-		}
-		return instance;
-	})();
-	sdk.catch(() => {
-		sdk = void 0;
-	});
-	return sdk;
-}
-/**
-* Turns an SDK failure into something with a next step in it.
-*
-* The two that actually happen are a rejected token and a token that does not
-* cover the project. The latter surfaces as a bare "not found", because a
-* project you cannot see and a project that does not exist are deliberately
-* the same answer.
-*/
-function describeSdkFailure(err, doing) {
-	const message = err instanceof Error ? err.message : String(err);
-	if (/\b429\b|too many requests/i.test(message)) return `${message}\n\nBitwarden rate-limited this even after the automatic retries. Wait a minute and re-run — the login is cached in a state file now, so re-running does not spend another authentication.`;
-	if (/404|not.?found/i.test(message)) return `${message}\n\nA 404 here usually means the access token is valid but its machine account is not assigned to this project — Secrets Manager reports 'invisible' and 'absent' identically.`;
-	if (/401|unauthoriz|invalid|expired/i.test(message)) return `${message}\n\nThe access token was rejected while ${doing}. It may have been revoked or belong to another organization.`;
-	return message || `Secrets Manager failed with no message while ${doing}.`;
-}
-function iso(value) {
-	if (value instanceof Date) return value.toISOString();
-	if (typeof value === "string" && value !== "") return value;
-}
-/** Resolves a project name to its id. Names are unique within an org. */
-async function projectIdFor(name) {
-	const c = await client();
-	const org = await organizationId();
-	let projects;
-	try {
-		projects = (await withRateLimitRetry(async () => {
-			await pace("read");
-			return c.projects().list(org);
-		}, { doing: "listing projects" })).data;
-	} catch (err) {
-		throw new BwsError(describeSdkFailure(err, "listing projects"));
-	}
-	const match = projects.find((p) => p.name === name);
-	if (!match) {
-		const visible = projects.map((p) => p.name).sort();
-		throw new BwsError(`No project named "${name}".\n` + (visible.length > 0 ? `This token can see: ${visible.join(", ")}` : "This token can see no projects at all, which usually means the machine account has no project assignments yet."));
-	}
-	return match.id;
-}
-async function listSecrets$1(projectId) {
-	const c = await client();
-	const org = await organizationId();
-	try {
-		const identifiers = (await withRateLimitRetry(async () => {
-			await pace("read");
-			return c.secrets().list(org);
-		}, { doing: "listing secrets" })).data;
-		if (identifiers.length === 0) return [];
-		return (await withRateLimitRetry(async () => {
-			await pace("read");
-			return c.secrets().getByIds(identifiers.map((i) => i.id));
-		}, { doing: "reading secrets" })).data.filter((s) => s.projectId === projectId).map((s) => ({
-			id: s.id,
-			key: s.key,
-			value: s.value,
-			note: s.note,
-			projectId,
-			revisionDate: iso(s.revisionDate)
-		}));
-	} catch (err) {
-		throw new BwsError(describeSdkFailure(err, "listing secrets"));
-	}
-}
-async function createSecret(projectId, key, value, note) {
-	const c = await client();
-	const org = await organizationId();
-	try {
-		await withRateLimitRetry(async () => {
-			await pace("write");
-			return c.secrets().create(org, key, value, note, [projectId]);
-		}, { doing: `creating ${key}` });
-	} catch (err) {
-		throw new BwsError(describeSdkFailure(err, `creating ${key}`));
-	}
-}
-/**
-* Takes the whole secret rather than an id: the SDK's update is a full
-* replace (organization, key, project list included), and every caller
-* already holds the listed secret it is updating.
-*/
-async function updateSecret(secret, value, note) {
-	const c = await client();
-	const org = await organizationId();
-	try {
-		await withRateLimitRetry(async () => {
-			await pace("write");
-			return c.secrets().update(org, secret.id, secret.key, value, note, [secret.projectId]);
-		}, { doing: `updating ${secret.key}` });
-	} catch (err) {
-		throw new BwsError(describeSdkFailure(err, `updating ${secret.key}`));
-	}
-}
-function byKey(secrets) {
-	return new Map(secrets.map((s) => [s.key, s]));
-}
-//#endregion
 //#region src/gh/client.ts
 /**
 * A thin wrapper over the `gh` CLI, for environment secrets and variables.
@@ -4118,7 +3177,8 @@ async function runEnvAudit(options) {
 	const spec = environmentSpecs()[target];
 	const path = pathFor(target, options.file);
 	const doc = await readDocument(path);
-	const bwsSecrets = await listSecrets$1(await projectIdFor(spec.project));
+	const projectId = await projectIdFor(spec.project);
+	const bwsSecrets = await listSecrets$1(projectId);
 	const github = [];
 	const githubVariables = [];
 	const unreachable = [];
@@ -4462,107 +3522,107 @@ async function resolveAppId(org, appSlug) {
 }
 //#endregion
 //#region src/github/rulesets/desired.ts
-/**
-* Canonical fixed-ruleset name -> earlier name(s) this reconciler recognizes
-* as the SAME slot, so the first run renames rather than creating a
-* duplicate that leaves the old one live and unmanaged.
-*
-* Only `main` has a legacy alias today (`main-protection`, live on GitHub as
-* of 2026-09-24). `production`, `~ALL` and `team/**` have no live ruleset to
-* rename — they are created fresh. The tag ruleset keeps its live name,
-* `tag-protection`, unchanged; nothing about its shape is wrong today, so
-* there is no rename to make.
-*/
-const LEGACY_NAME_ALIASES = { main: ["main-protection"] };
-/** Ruleset names this reconciler deletes outright — nothing in the desired set replaces them. */
-const DELETE_RULESET_NAMES = ["comp-branches"];
-/**
-* A live ruleset name this reconciler must NEVER touch: one `teamSync.ts`
-* created and owns (`team/<slug>`, an exact-ref ruleset), as opposed to the
-* `team/**` wildcard-creation ruleset this module itself manages.
-*
-* `teamRulesetName()` in DevDogsUGA's `rulesets.ts` builds these as
-* `team/${slug}`, and slugs never contain `/`, so a live name is a per-team
-* ruleset iff it starts with `team/` and is not the literal `team/**` this
-* reconciler owns.
-*/
+/** Earlier live names which occupy the same managed slot. */
+const LEGACY_NAME_ALIASES = { "main-reviews": ["main", "main-protection"] };
+/** Obsolete fixed rulesets removed after the production-branch cutover. */
+const DELETE_RULESET_NAMES = ["comp-branches", "production"];
 function isPerTeamRulesetName(name) {
 	return name.startsWith("team/") && name !== "team/**";
 }
+const main$1 = { ref_name: {
+	include: ["refs/heads/main"],
+	exclude: []
+} };
+const always = (actor_id) => ({
+	actor_id,
+	actor_type: "Team",
+	bypass_mode: "always"
+});
 /**
-* The five fixed rulesets, built from resolved actor ids.
+* Fixed DevDogsUGA rulesets.
 *
-* Pure — no network, no `gh` — so `desired.test.ts` can assert the shape
-* without mocking anything, and `commands.ts` calls this only after
-* resolving `RulesetActors` from the live org.
+* The main policy is deliberately split. A bypass actor bypasses every rule
+* in one ruleset, so combining immutable history, PR reviews, updates and CI
+* would make a direct-push exception an accidental force-push exception too.
 */
 function buildDesiredRulesets(actors) {
 	return [
 		{
-			name: "main",
+			name: "main-integrity",
 			target: "branch",
 			enforcement: "active",
-			conditions: { ref_name: {
-				include: ["refs/heads/main"],
-				exclude: []
-			} },
-			bypass_actors: [{
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}],
-			rules: [
-				{ type: "deletion" },
-				{ type: "non_fast_forward" },
+			conditions: main$1,
+			bypass_actors: [],
+			rules: [{ type: "deletion" }, { type: "non_fast_forward" }]
+		},
+		{
+			name: "main-updates",
+			target: "branch",
+			enforcement: "active",
+			conditions: main$1,
+			bypass_actors: [
 				{
-					type: "update",
-					parameters: { update_allows_fetch_and_merge: false }
+					actor_id: actors.reviewersTeamId,
+					actor_type: "Team",
+					bypass_mode: "pull_request"
 				},
-				{
-					type: "pull_request",
-					parameters: {
-						allowed_merge_methods: ["squash"],
-						dismiss_stale_reviews_on_push: false,
-						require_code_owner_review: false,
-						require_last_push_approval: false,
-						required_approving_review_count: 0,
-						required_review_thread_resolution: false
-					}
+				always(actors.devopsTeamId),
+				always(actors.adminsTeamId)
+			],
+			rules: [{
+				type: "update",
+				parameters: { update_allows_fetch_and_merge: false }
+			}]
+		},
+		{
+			name: "main-reviews",
+			target: "branch",
+			enforcement: "active",
+			conditions: main$1,
+			bypass_actors: [always(actors.devopsTeamId), always(actors.adminsTeamId)],
+			rules: [{
+				type: "pull_request",
+				parameters: {
+					allowed_merge_methods: ["squash"],
+					dismiss_stale_reviews_on_push: false,
+					require_code_owner_review: true,
+					require_last_push_approval: true,
+					required_approving_review_count: 1,
+					required_review_thread_resolution: true
 				}
-			]
+			}]
 		},
 		{
-			name: "production",
+			name: "main-ci",
 			target: "branch",
 			enforcement: "active",
-			conditions: { ref_name: {
-				include: ["refs/heads/production"],
-				exclude: []
-			} },
-			bypass_actors: [{
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "pull_request"
-			}],
-			rules: [
-				{ type: "deletion" },
-				{ type: "non_fast_forward" },
-				{
-					type: "update",
-					parameters: { update_allows_fetch_and_merge: false }
-				},
-				{
-					type: "pull_request",
-					parameters: {
-						allowed_merge_methods: ["merge"],
-						dismiss_stale_reviews_on_push: false,
-						require_code_owner_review: true,
-						require_last_push_approval: false,
-						required_approving_review_count: 1,
-						required_review_thread_resolution: false
-					}
+			conditions: main$1,
+			bypass_actors: [always(actors.devopsTeamId), always(actors.adminsTeamId)],
+			rules: [{
+				type: "required_status_checks",
+				parameters: {
+					do_not_enforce_on_create: false,
+					strict_required_status_checks_policy: false,
+					required_status_checks: [
+						{
+							context: "validate",
+							integration_id: 15368
+						},
+						{
+							context: "database",
+							integration_id: 15368
+						},
+						{
+							context: "format",
+							integration_id: 15368
+						},
+						{
+							context: "flutter",
+							integration_id: 15368
+						}
+					]
 				}
-			]
+			}]
 		},
 		{
 			name: "~ALL",
@@ -4570,17 +3630,17 @@ function buildDesiredRulesets(actors) {
 			enforcement: "active",
 			conditions: { ref_name: {
 				include: ["~ALL"],
-				exclude: ["refs/heads/team/**"]
+				exclude: ["refs/heads/main", "refs/heads/team/**"]
 			} },
-			bypass_actors: [{
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}, ...actors.renovateAppId !== void 0 ? [{
-				actor_id: actors.renovateAppId,
-				actor_type: "Integration",
-				bypass_mode: "always"
-			}] : []],
+			bypass_actors: [
+				always(actors.devopsTeamId),
+				always(actors.adminsTeamId),
+				...actors.renovateAppId === void 0 ? [] : [{
+					actor_id: actors.renovateAppId,
+					actor_type: "Integration",
+					bypass_mode: "always"
+				}]
+			],
 			rules: [
 				{
 					type: "update",
@@ -4599,15 +3659,15 @@ function buildDesiredRulesets(actors) {
 				include: ["refs/heads/team/**"],
 				exclude: []
 			} },
-			bypass_actors: [{
-				actor_id: actors.appId,
-				actor_type: "Integration",
-				bypass_mode: "always"
-			}, {
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}],
+			bypass_actors: [
+				{
+					actor_id: actors.appId,
+					actor_type: "Integration",
+					bypass_mode: "always"
+				},
+				always(actors.devopsTeamId),
+				always(actors.adminsTeamId)
+			],
 			rules: [
 				{ type: "creation" },
 				{ type: "deletion" },
@@ -4622,15 +3682,7 @@ function buildDesiredRulesets(actors) {
 				include: ["refs/tags/**"],
 				exclude: []
 			} },
-			bypass_actors: [{
-				actor_id: actors.adminsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}, {
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}],
+			bypass_actors: [always(actors.adminsTeamId), always(actors.devopsTeamId)],
 			rules: [
 				{ type: "creation" },
 				{ type: "update" },
@@ -4702,6 +3754,17 @@ function canonicalizeRule(rule) {
 			}
 		};
 	}
+	if (rule.type === "required_status_checks") return {
+		type: "required_status_checks",
+		parameters: {
+			do_not_enforce_on_create: rule.parameters.do_not_enforce_on_create,
+			strict_required_status_checks_policy: rule.parameters.strict_required_status_checks_policy,
+			required_status_checks: [...rule.parameters.required_status_checks].sort((a, b) => a.context.localeCompare(b.context)).map((check) => ({
+				context: check.context,
+				integration_id: check.integration_id
+			}))
+		}
+	};
 	return { type: rule.type };
 }
 function sortRules(rules) {
@@ -4824,6 +3887,7 @@ const DEFAULT_REPO$1 = "DevDogsUGA";
 const DEFAULT_APP_SLUG = "devdogs-platform";
 const DEFAULT_DEVOPS_SLUG = "devops";
 const DEFAULT_ADMINS_SLUG = "admins";
+const DEFAULT_REVIEWERS_SLUG = "reviewers";
 /** TASK-299 — installed separately from the platform App; may not exist yet. */
 const DEFAULT_RENOVATE_SLUG = "renovate";
 function parseOptions$1(argv) {
@@ -4903,11 +3967,13 @@ async function runGithubRulesets(argv) {
 	};
 	let devopsTeamId;
 	let adminsTeamId;
+	let reviewersTeamId;
 	let appId;
 	try {
-		[devopsTeamId, adminsTeamId, appId] = await Promise.all([
+		[devopsTeamId, adminsTeamId, reviewersTeamId, appId] = await Promise.all([
 			resolveTeamId(opts.org, DEFAULT_DEVOPS_SLUG),
 			resolveTeamId(opts.org, DEFAULT_ADMINS_SLUG),
+			resolveTeamId(opts.org, DEFAULT_REVIEWERS_SLUG),
 			resolveAppId(opts.org, opts.appSlug)
 		]);
 	} catch (err) {
@@ -4923,6 +3989,7 @@ async function runGithubRulesets(argv) {
 	const actors = {
 		devopsTeamId,
 		adminsTeamId,
+		reviewersTeamId,
 		appId,
 		renovateAppId
 	};
@@ -6202,7 +5269,8 @@ const HANDLERS = {
 	github: handleGithub,
 	graphics: async (rest) => (await import("./commands-Dv5TXjvb.js")).handleGraphics(rest),
 	qr: async (rest) => (await import("./commands-Bk7IbhPD.js")).handleQr(rest),
-	newsletter: async (rest) => (await import("./commands-D345F-Od.js")).handleNewsletter(rest)
+	newsletter: async (rest) => (await import("./commands-D345F-Od.js")).handleNewsletter(rest),
+	creds: async (rest) => (await import("./commands-Dl3UlhBf.js")).handleCreds(rest)
 };
 /**
 * Names that were commands of the contributor CLI, refused with where they