@devdogsuga/devtools 0.1.11 → 0.1.13

package/dist/cli.js

@@ -18,8 +18,9 @@
  * anywhere, so there is nothing to fall out of step.
  */
 import { confirm, intro, log, note, outro, select, spinner, } from "@clack/prompts";
-import { assertMigrated, detectLocalInstance, PERSONAS, } from "./instance.js";
-import { conformance, listApps, quarantineRoundTrip } from "./moderation.js";
+import { resolveInstance } from "./instance.js";
+import { conformance, withTemporaryModerator } from "./moderation.js";
+import { runPersona, refuseUnlessDevelopment } from "./persona.js";
 import { runEnvironmentDoctor } from "./environment-doctor.js";
 import { currentRootHolder, grantRoot, listCandidates, transferRoot, } from "./grantRoot.js";
 import { connectRemoteProject, runStackCommand, } from "./stack.js";
@@ -44,7 +45,7 @@ import { loadEnv } from "./repo/peers.js";
 import { setExplicitAccessToken } from "./bws/client.js";
 import { positionals } from "./args.js";
 import { resolveVaultTarget } from "./pick.js";
-import { bail, errorMessage, explain, renderChecks, unwrap } from "./ui.js";
+import { bail, errorMessage, explain, explainError, renderChecks, unwrap } from "./ui.js";
 import { helpPath, renderHelp } from "./help.js";
 import { subcommandList, subcommandNames } from "./commands.js";
 import { bareGroupStartPath, runMenu } from "./menu.js";
@@ -62,10 +63,6 @@ import { runWorkflows } from "./workflows/commands.js";
 import { runCf } from "./cf/commands.js";
 import { captureDevtoolsError, initDevtoolsTelemetry } from "./telemetry.js";
 import { ownVersion } from "./version.js";
-const MODERATION_COMMANDS = ["moderation", "grant-root"];
-function isModerationCommand(value) {
-    return MODERATION_COMMANDS.includes(value);
-}
 function flagValue(rest, flag) {
     const index = rest.indexOf(flag);
     if (index === -1)
@@ -93,46 +90,6 @@ function refuseRetiredDbFlags(rest) {
     }
     return false;
 }
-// ── Connecting ───────────────────────────────────────────────────────────────
-/**
- * Finds the local stack and checks it has been migrated.
- *
- * These commands only ever run against a local stack, and that is structural
- * rather than a rule they follow: `detectLocalInstance` reads `supabase
- * status`, which describes the Docker stack on this machine and nothing else.
- * There is no remote project for it to return, so the tier check that used to
- * sit here, reading a `production` flag out of the database, bought nothing and
- * has been removed along with the table it read.
- */
-async function connect() {
-    const s = spinner();
-    s.start("Looking for your database");
-    let instance;
-    try {
-        instance = detectLocalInstance();
-    }
-    catch (err) {
-        s.stop("Could not find a running database");
-        explain("The local Supabase stack is not reachable.", errorMessage(err), [
-            "1. Make sure Docker is running",
-            "2. Run `pnpm devtools db start` (or choose Database → start in the menu)",
-            "3. Confirm with `supabase status`",
-        ]);
-        return null;
-    }
-    try {
-        await assertMigrated(instance);
-        s.stop(`Connected to your database at ${instance.apiUrl}`);
-    }
-    catch (err) {
-        s.stop("Connected, but the schema is not there");
-        explain("That instance cannot be used here.", errorMessage(err), [
-            "Run `pnpm devtools db reset` to rebuild your own database from migrations and seeds.",
-        ]);
-        return null;
-    }
-    return instance;
-}
 // ── Commands ─────────────────────────────────────────────────────────────────
 async function runStack(command, rest) {
     // The data commands need the session's connection before anything else —
@@ -227,43 +184,56 @@ async function runStack(command, rest) {
         }
     }
     catch (err) {
-        explain(`\`${command}\` failed.`, errorMessage(err));
+        explainError(`\`${command}\` failed.`, err);
         process.exitCode = 1;
     }
 }
-async function runModerationCatalog(instance) {
-    const catalog = await readCatalog(instance);
-    note(renderCatalog(catalog), "Moderation catalog");
-}
+/**
+ * `moderation check [--app <slug>]`.
+ *
+ * With no app, this is what `moderation catalog` used to be on its own: the
+ * report reasons and every app's moderatable content types, the two halves
+ * of "what can be reported here" that used to have no answer anywhere but
+ * the database. With one, it runs `platform.conformance_check()` for that
+ * app, as it always did. Folded into one command because they were always
+ * the same question at two different zoom levels, asked through two
+ * differently-named commands for no reason better than history.
+ *
+ * Both halves run inside ONE `withTemporaryModerator` — one throwaway
+ * account, created and torn down around whichever half ran, rather than a
+ * separate one per RPC call.
+ */
 async function runModerationCheck(instance, appSlug) {
-    let slug = appSlug;
-    if (!slug) {
-        const apps = await listApps(instance);
-        slug = unwrap(await select({
-            message: "Which app should I check?",
-            options: apps.map((value) => ({
-                value,
-                label: value,
-                hint: value === "platform" ? "the worked example" : undefined,
-            })),
-        }));
+    if (!appSlug) {
+        const s = spinner();
+        s.start("Signing in as a temporary moderator");
+        try {
+            const catalog = await withTemporaryModerator(instance, readCatalog);
+            s.stop("Read the catalog");
+            note(renderCatalog(catalog), "Moderation catalog");
+        }
+        catch (err) {
+            s.stop("Could not read the catalog");
+            explainError("Reading the catalog failed.", err);
+            process.exitCode = 1;
+        }
+        return;
     }
     const s = spinner();
-    s.start(`Checking ${slug}`);
+    s.start(`Checking ${appSlug}`);
     let types;
     try {
-        types = await conformance(instance, slug);
-        s.stop(`Checked ${slug}`);
+        types = await withTemporaryModerator(instance, (client) => conformance(client, appSlug));
+        s.stop(`Checked ${appSlug}`);
     }
     catch (err) {
         s.stop("The check could not run");
-        explain("conformance_check() failed.", errorMessage(err), [
-            `Signing in as ${PERSONAS.moderator} needs the seeds — try \`pnpm devtools db reset\`.`,
-        ]);
+        explainError("conformance_check() failed.", err);
+        process.exitCode = 1;
         return;
     }
     if (types.length === 0) {
-        note(`${slug} has no moderatable content types.\n\n` +
+        note(`${appSlug} has no moderatable content types.\n\n` +
             "A table becomes one by carrying a foreign key to\n" +
             'platform."reportResolutions" -- adding that column is the whole\n' +
             "registration. See docs/platform/reporting-and-feedback.md.", "Nothing to check");
@@ -276,7 +246,7 @@ async function runModerationCheck(instance, appSlug) {
         note(renderChecks(type.checks), `${type.tableName} → "${type.contentType}"`);
     }
     if (failures === 0) {
-        log.success(`${slug} looks correctly integrated.`);
+        log.success(`${appSlug} looks correctly integrated.`);
     }
     else {
         log.warn(`${failures} check${failures === 1 ? "" : "s"} failed. The last two are ` +
@@ -284,29 +254,6 @@ async function runModerationCheck(instance, appSlug) {
             "than trusting outright.");
     }
 }
-async function runModerationRoundTrip(instance) {
-    const s = spinner();
-    s.start("Filing a report, quarantining it, and looking again");
-    try {
-        const steps = await quarantineRoundTrip(instance);
-        s.stop("Round-trip finished");
-        note(renderChecks(steps), "What happened");
-        const failed = steps.filter((step) => !step.ok);
-        if (failed.length === 0) {
-            log.success("Quarantine freezes a reported profile and resets the display name, and the fixtures were cleaned up.");
-        }
-        else {
-            log.warn(`${failed.length} step${failed.length === 1 ? "" : "s"} did not hold. ` +
-                "The fixtures were still cleaned up.");
-        }
-    }
-    catch (err) {
-        s.stop("The round-trip could not run");
-        explain("Something went wrong before the checks could finish.", errorMessage(err), [
-            "`pnpm devtools db reset` rebuilds the database with the seeded personas and the open report they act on.",
-        ]);
-    }
-}
 /**
  * Grants Root, asking who to if it was not told.
  *
@@ -314,8 +261,14 @@ async function runModerationRoundTrip(instance) {
  * different actions wearing the same name: one gives you a console you did not
  * have, the other takes somebody else's away. `userRoles_root_singleton` means
  * there is no state where both hold it, so the release cannot be skipped.
+ *
+ * Runs on any tier the session resolves to now — `resolveInstance` (see
+ * `instance.ts`) replaced the local-only `supabase status` probe this used
+ * to go through — so a PRODUCTION target gets the same `--yes`/stern-confirm
+ * treatment `db reset` does: this is a privilege escalation on whatever
+ * database it runs against, and on production that database is live.
  */
-async function runGrantRoot(instance, userEmail) {
+async function runGrantRoot(connection, instance, userEmail, rest) {
     let holder;
     let candidates;
     try {
@@ -325,14 +278,16 @@ async function runGrantRoot(instance, userEmail) {
         ]);
     }
     catch (err) {
-        explain("Could not read the current roles.", errorMessage(err));
+        explainError("Could not read the current roles.", err);
         process.exitCode = 1;
         return;
     }
     if (candidates.length === 0) {
         explain("There are no accounts on this database yet.", "", [
             "Sign in once through the app, then run this again.",
-            `Or use a seeded persona: ${PERSONAS.member}, password \`password\`.`,
+            ...(connection.tier === "development"
+                ? ["Or create one: `pnpm devtools persona member`."]
+                : []),
         ]);
         return;
     }
@@ -357,14 +312,40 @@ async function runGrantRoot(instance, userEmail) {
         log.info(`${target.email} already holds Root.`);
         return;
     }
-    try {
-        if (holder) {
+    const action = holder
+        ? `Take Root away from ${holder.email} and give it to ${target.email}`
+        : `Give ${target.email} Root, which confers every permission`;
+    if (connection.tier === "production") {
+        // ⚠️ SAFETY: same gate `runStack` uses for `db reset`/`migrate` — see
+        // that function's header for why `--yes` is checked before anything
+        // TTY-dependent runs.
+        if (!rest.includes("--yes")) {
+            if (!process.stdin.isTTY) {
+                process.stderr.write("devtools grant-root: --yes is required to run non-interactively.\n");
+                process.exitCode = 1;
+                return;
+            }
             const confirmed = unwrap(await confirm({
-                message: `Root is held by ${holder.email}. Take it away and give it to ${target.email}?`,
+                message: `${action} on the PRODUCTION database. Continue?`,
                 initialValue: false,
             }));
             if (!confirmed)
                 bail("Left Root where it was.");
+        }
+    }
+    else if (holder) {
+        // Transferring away from someone still asks, even off production —
+        // taking a console away from an existing holder is worth a question
+        // granting to nobody-yet-holding is not.
+        const confirmed = unwrap(await confirm({
+            message: `Root is held by ${holder.email}. Take it away and give it to ${target.email}?`,
+            initialValue: false,
+        }));
+        if (!confirmed)
+            bail("Left Root where it was.");
+    }
+    try {
+        if (holder) {
             await transferRoot(instance, holder.userId, target.userId);
         }
         else {
@@ -374,8 +355,9 @@ async function runGrantRoot(instance, userEmail) {
             "Sign out and back in if the console was already open.");
     }
     catch (err) {
-        explain("Could not grant Root.", errorMessage(err), [
-            "Seeds create the Root role definition — try `pnpm devtools db reset` first.",
+        explainError("Could not grant Root.", err, [
+            "Seeds create the Root role definition — try `pnpm devtools db reset` " +
+                "(development) or `pnpm devtools db seed production` (staging/production) first.",
         ]);
         process.exitCode = 1;
     }
@@ -437,7 +419,7 @@ async function runEnvCommand(rest) {
             });
         }
         catch (err) {
-            explain("The reset failed.", errorMessage(err));
+            explainError("The reset failed.", err);
             process.exitCode = 1;
         }
         return;
@@ -459,7 +441,7 @@ async function runEnvCommand(rest) {
             await runEnvExample({ check: rest.includes("--check") });
         }
         catch (err) {
-            explain("Generating .env.example failed.", errorMessage(err));
+            explainError("Generating .env.example failed.", err);
             process.exitCode = 1;
         }
         return;
@@ -486,7 +468,7 @@ async function runEnvCommand(rest) {
             await runEnvInit(given, flagValue(rest, "--apps") ?? undefined);
         }
         catch (err) {
-            explain("env init failed.", errorMessage(err));
+            explainError("env init failed.", err);
             process.exitCode = 1;
         }
         return;
@@ -523,7 +505,7 @@ async function runEnvCommand(rest) {
             await runEnvAudit(options);
     }
     catch (err) {
-        explain("The env command failed.", errorMessage(err), [
+        explainError("The env command failed.", err, [
             "The access token is read from --access-token, then BWS_ACCESS_TOKEN,",
             "then your Bitwarden vault, and finally by asking.",
             "`gh auth status` shows whether the GitHub CLI is signed in.",
@@ -836,10 +818,10 @@ async function dispatch(argv) {
         return DONE;
     }
     if (first === "images") {
-        // `connect` is passed rather than called: only event graphics need a
-        // database, and `images page/*` must not demand a running stack to draw
-        // pictures that come entirely out of this repo.
-        await runImages(rest, { connect });
+        // No database dependency to pass through any more: event graphics read
+        // `@devdogsuga/events`'s committed config directly (see
+        // `images/events.ts`), so `images` never needs a running stack at all.
+        await runImages(rest);
         return DONE;
     }
     if (first === "emails") {
@@ -917,15 +899,23 @@ async function dispatch(argv) {
     }
     // The old moderation names, refused with the new namespace rather than
     // falling into "Unknown command" — same rationale as `secrets` above.
-    // `doctor` itself is NOT here: that name now belongs to the environment
-    // checker below, a deliberate reuse rather than a collision.
-    if (first === "catalog" || first === "roundtrip") {
-        explain(`\`${first}\` is now \`devtools moderation ${first}\`.`, "", [
-            `pnpm devtools moderation ${first}`,
+    // `catalog` still has an answer (`moderation check`, now folded together —
+    // see that function's header); `roundtrip` does not, because the command it
+    // named is gone outright, not renamed. `doctor` itself is NOT here: that
+    // name now belongs to the environment checker below, a deliberate reuse
+    // rather than a collision.
+    if (first === "catalog") {
+        explain("`catalog` is now `devtools moderation check`.", "", [
+            "pnpm devtools moderation check",
         ]);
         process.exitCode = 1;
         return null;
     }
+    if (first === "roundtrip") {
+        explain("`roundtrip` is gone. The app repo's own CI covers the file/quarantine/check round trip more thoroughly than this command ever did.", "", ["pnpm devtools moderation check --app <slug>"]);
+        process.exitCode = 1;
+        return null;
+    }
     if (first === "doctor") {
         await runEnvironmentDoctor({
             app: flagValue(rest, "--app"),
@@ -933,30 +923,23 @@ async function dispatch(argv) {
         });
         return DONE;
     }
-    if (!isModerationCommand(first)) {
-        log.error(`Unknown command: ${first}`);
-        // The top level only. The command is unknown, so there is no level below
-        // it to describe, and reprinting the whole tree here is what made the old
-        // help unreadable in the first place.
-        log.message(renderHelp());
-        process.exitCode = 1;
-        return null;
-    }
-    const instance = await connect();
-    if (!instance) {
-        process.exitCode = 1;
-        return null;
+    if (first === "persona") {
+        await runPersona(rest);
+        return DONE;
     }
     if (first === "moderation") {
-        const [msub, ...mrest] = rest;
-        if (msub === "check") {
-            await runModerationCheck(instance, flagValue(mrest, "--app"));
+        const resolved = await resolveInstance({ label: "devtools moderation" });
+        if (!resolved) {
+            process.exitCode = 1;
+            return null;
         }
-        else if (msub === "catalog") {
-            await runModerationCatalog(instance);
+        if (refuseUnlessDevelopment(resolved.connection, "devtools moderation check")) {
+            process.exitCode = 1;
+            return null;
         }
-        else if (msub === "roundtrip") {
-            await runModerationRoundTrip(instance);
+        const [msub, ...mrest] = rest;
+        if (msub === "check") {
+            await runModerationCheck(resolved.instance, flagValue(mrest, "--app"));
         }
         else {
             log.error(msub
@@ -964,11 +947,24 @@ async function dispatch(argv) {
                 : `devtools moderation: which of ${subcommandList(["moderation"])}?`);
             process.exitCode = 1;
         }
+        return DONE;
     }
-    else {
-        await runGrantRoot(instance, flagValue(rest, "--user"));
+    if (first === "grant-root") {
+        const resolved = await resolveInstance({ label: "devtools grant-root" });
+        if (!resolved) {
+            process.exitCode = 1;
+            return null;
+        }
+        await runGrantRoot(resolved.connection, resolved.instance, flagValue(rest, "--user"), rest);
+        return DONE;
     }
-    return DONE;
+    log.error(`Unknown command: ${first}`);
+    // The top level only. The command is unknown, so there is no level below
+    // it to describe, and reprinting the whole tree here is what made the old
+    // help unreadable in the first place.
+    log.message(renderHelp());
+    process.exitCode = 1;
+    return null;
 }
 // ── Entry ────────────────────────────────────────────────────────────────────
 /**

package/dist/commands.d.ts

@@ -121,10 +121,16 @@ export interface CommandNode {
     /**
      * Offer this always, but say on the line why it will not work right now.
      *
-     * The four moderation commands carry it: each one opens a client against
-     * Supabase on this machine and has no remote path at all, so with it down
-     * they are a spinner followed by a connection error. The hint turns that
-     * into a sentence the reader sees before choosing.
+     * Nothing in the tree carries it at the moment — the four moderation
+     * commands were the only ones that ever did, back when each opened a
+     * client against Supabase on this machine with no remote path at all, so
+     * with it down they were a spinner followed by a connection error. They
+     * moved onto the session system alongside `db migrate`/`db reset`, neither
+     * of which has ever gated on a local probe (a hosted session has no local
+     * stack to probe), so nothing here needs the hint any more. Left declared
+     * rather than deleted: a future local-only command is exactly the shape of
+     * thing that would want it back, and `blockedBecause`
+     * (`environment.test.ts`) still exercises the mechanism directly.
      */
     needs?: Condition;
     /**

package/dist/commands.js

@@ -339,47 +339,63 @@ const DECLARED_GROUPS = [
             {
                 name: "moderation",
                 summary: "An app's moderation integration: the catalog and its wiring.",
-                hint: "check, catalog, roundtrip",
+                hint: "check",
                 subcommands: [
                     {
                         name: "check",
-                        summary: "Check an app's moderation integration.",
-                        hint: "and whether the catalog holds up",
-                        needs: "instance-running",
+                        summary: "List the catalog, or check one app's moderation integration.",
+                        hint: "reasons and content types with no --app; per-app wiring with one",
+                        // No `needs: "instance-running"` any more — this resolves through
+                        // the session system now (`resolveInstance`, `instance.ts`), the
+                        // same as `db migrate`/`db reset`, so it works against a hosted
+                        // development database with no local stack at all. Refuses
+                        // staging/production itself, with its own message, rather than a
+                        // menu-only hint.
                         options: [
                             {
                                 flag: "--app",
                                 value: "<slug>",
-                                summary: "App to check. Asked for when absent.",
+                                summary: "App to check. Prints the catalog when absent.",
                             },
                             JSON_FLAG,
                         ],
                     },
-                    {
-                        name: "catalog",
-                        summary: "List the report reasons and content types in the database.",
-                        hint: "what can be reported here",
-                        needs: "instance-running",
-                        options: [JSON_FLAG],
-                    },
-                    {
-                        name: "roundtrip",
-                        summary: "File a report, quarantine it, and check the freeze.",
-                        hint: "end to end, then cleans up",
-                        needs: "instance-running",
-                    },
                 ],
             },
             {
                 name: "grant-root",
                 summary: "Give an account every permission on your own database.",
-                needs: "instance-running",
+                // Also on the session system now — every tier, not just local. See
+                // `check`'s note above; production additionally gets `YES`'s stern
+                // confirmation, the same treatment `db reset` gives it.
                 options: [
                     {
                         flag: "--user",
                         value: "<email>",
                         summary: "Account to grant Root to. Asked for when absent.",
                     },
+                    YES,
+                ],
+            },
+        ],
+    },
+    {
+        title: "Personas",
+        commands: [
+            {
+                name: "persona",
+                summary: "A throwaway member or moderator account for development.",
+                hint: "member, moderator, or --clean",
+                options: [
+                    {
+                        flag: "--clean",
+                        summary: "Delete every account this command has created, instead of making one.",
+                        prompt: {
+                            kind: "confirm",
+                            message: "Clean up every persona this command created, instead of making one?",
+                            initial: false,
+                        },
+                    },
                 ],
             },
         ],
@@ -661,22 +677,12 @@ const DECLARED_GROUPS = [
                     {
                         flag: "--base-url",
                         value: "<url>",
-                        summary: "DevDogs API URL. Only used by \"Paste credentials instead\".",
-                        prompt: {
-                            kind: "text",
-                            message: "DevDogs API URL? (blank asks inside the wizard)",
-                            optional: true,
-                        },
+                        summary: "DevDogs API URL for \"Paste credentials instead\". Defaults to https://api.devdogsuga.org.",
                     },
                     {
                         flag: "--platform-url",
                         value: "<url>",
                         summary: "Platform URL for one-click connect. Defaults to https://devdogsuga.org.",
-                        prompt: {
-                            kind: "text",
-                            message: "Platform URL? (blank uses the default)",
-                            optional: true,
-                        },
                     },
                     {
                         flag: "--device",
@@ -1111,6 +1117,10 @@ export const GROUPS = [
         title: "Moderation",
         commands: commands("moderation", "grant-root"),
     },
+    {
+        title: "Personas",
+        commands: commands("persona"),
+    },
     {
         title: "Environment",
         commands: commands("doctor"),

package/dist/db/generated-env.d.ts

@@ -0,0 +1,69 @@
+import type { DeployEnvironment } from "@devdogsuga/env";
+import type { DevDatabase } from "@devdogsuga/env/load";
+export interface EnsureGeneratedEnvDeps {
+    /** Is anything listening on the local stack port? Injected so tests never
+     *  open a real socket. */
+    probeLocalStack: () => boolean | Promise<boolean>;
+    /** File existence, relative to `repoRoot`. Injected so tests never touch
+     *  a real filesystem. */
+    exists: (file: string) => boolean;
+    /** `supabase status -o env`'s stdout, or a rejection when the CLI fails —
+     *  most commonly because the stack on 54321 belongs to a different
+     *  project. Injected so tests never spawn the real CLI. */
+    captureStatus: () => Promise<string>;
+    /** Writes `.env.generated`'s full path. Injected so tests never touch a
+     *  real filesystem. */
+    write: (path: string, contents: string) => Promise<void>;
+    /** `docker ps --format '{{.Names}}'`, pre-split — or `null` when Docker
+     *  could not be read. Injected so tests never spawn a real subprocess. */
+    listContainerNames: () => string[] | null;
+    /** This checkout's own `project_id`, or `null` if unreadable. Injected so
+     *  tests never touch a real filesystem. */
+    projectId: () => string | null;
+    /** Used only to build the path `write` receives. */
+    repoRoot: string;
+}
+export type EnsureGeneratedEnvResult = {
+    outcome: "skipped";
+} | {
+    outcome: "wrote";
+    line: string;
+} | {
+    outcome: "foreign";
+    projectId: string;
+    line: string;
+} | {
+    outcome: "unreachable";
+};
+/**
+ * Regenerates `.env.generated` from a running local stack when THIS
+ * checkout's own copy is missing.
+ *
+ * A no-op (`"skipped"`) unless every one of these holds: `tier` is
+ * `"development"`, `devDatabase` is not `"remote"` (an explicit `"local"`
+ * or the probe-decides `undefined` both qualify), the file is genuinely
+ * absent, and something answers the local stack's port. That last check
+ * also covers "the file is missing because the stack is genuinely down" —
+ * nothing here runs `supabase status` against a stack that is not there;
+ * the existing `LocalStackOfflineError`/warning handling covers that case
+ * exactly as before.
+ *
+ * `"foreign"` and `"unreachable"` both mean `supabase status -o env`
+ * itself failed — the port answered, but the CLI could not produce a
+ * connection block. `"foreign"` is the case a running Docker container's
+ * name resolves to: another project's stack holds the port.
+ * `"unreachable"` is everything else (an unreadable `config.toml`, an
+ * unreadable `docker ps`, a container name that matches nobody) — the
+ * caller falls through to its existing offline handling either way, since
+ * `.env.generated` is still missing on disk.
+ */
+export declare function ensureGeneratedEnvFile(tier: DeployEnvironment, devDatabase: DevDatabase | undefined, deps: EnsureGeneratedEnvDeps): Promise<EnsureGeneratedEnvResult>;
+/**
+ * The production wiring for `EnsureGeneratedEnvDeps`, shared by
+ * `../env-entry.ts` (via `realEnvEntryDeps`) and `../stack.ts`'s `db
+ * status`. `probeLocalStack` is passed in rather than resolved here because
+ * both callers already hold the loaded `@devdogsuga/env/load` peer their
+ * own dispatch needs anyway — resolving it again here would mean two
+ * different copies of the same optional peer in play.
+ */
+export declare function realEnsureGeneratedEnvDeps(probeLocalStack: () => boolean | Promise<boolean>): EnsureGeneratedEnvDeps;