@devdogsuga/devtools 0.1.11 → 0.1.13

package/dist/moderation.js

@@ -1,34 +1,30 @@
 /**
  * Does my app's moderation integration actually work?
  *
- * Two checks, and the second is the one that matters.
- *
  * `conformance()` asks the database what it derived from your schema: is the
  * table addressable, can an author be attributed, does quarantine have a column
  * to write to, can a client still write that column. All of it is answerable
  * from the catalog, and `platform.conformance_check()` does the answering.
  *
- * `quarantineRoundTrip()` answers the question the catalog cannot: *does
- * quarantine do anything?* Quarantine is the only moderation outcome whose
- * effect lives in the app's own policies rather than the platform's, so it is
- * the only one that can be wired up wrong while everything appears to work.
- * The platform records the decision, sets the column, and has no way to notice
- * nobody reads it. The only proof is to file, resolve, and then look.
- *
- * It runs against `platform.profile`, where quarantine means FREEZE rather than
- * hide: the display name is reset to the member's name of record and they lose
- * the ability to change it back. A profile cannot be hidden: rosters, teams
- * and standings all render the name, and the row is own-row-only over PostgREST
- * anyway, so there is nobody to hide it from. See
- * 20260808000000_platform_profile_moderation.sql.
+ * The end-to-end round trip that used to live here (`quarantineRoundTrip`,
+ * `moderation roundtrip`) is gone: the app repo's own CI covers that path —
+ * file, quarantine, and check the freeze — more thoroughly than a devtools
+ * command driven by hand ever did, and keeping two implementations of the
+ * same assertion around was a drift risk with no offsetting benefit.
  *
- * Both run as seeded personas over PostgREST rather than as `postgres` over
- * SQL, because RLS is the thing under test and a superuser bypasses it.
+ * Both `conformance()` and `catalog.ts`'s `readCatalog()` need to run as a
+ * moderator, subject to the same RLS and `canModerate` checks a real one
+ * would hit, rather than as `postgres` bypassing them. `withTemporaryModerator`
+ * below is what supplies that account: a throwaway user, created through the
+ * admin API and deleted again in a `finally`, rather than the seeded
+ * `moderator@devdogs.test` persona this package used to sign in as — that
+ * persona came from `supabase/seed/development/02_moderation.sql`, which only
+ * ever ran on a local reset and is going away along with the rest of
+ * `seed/development/` (see `persona.ts`'s header for the replacement).
  */
-import { adminClient, personaClient, PERSONA_PASSWORD, PERSONAS, } from "./instance.js";
-/** Runs `platform.conformance_check()` as the seeded moderator. */
-export async function conformance(instance, appSlug) {
-    const client = await personaClient(instance, PERSONAS.moderator);
+import { adminClient, signedInClient, } from "./instance.js";
+/** Runs `platform.conformance_check()` as the given moderator client. */
+export async function conformance(client, appSlug) {
     const { data, error } = await client.rpc("conformance_check", {
         app_slug: appSlug,
     });
@@ -36,190 +32,95 @@ export async function conformance(instance, appSlug) {
         throw new Error(error.message);
     return (data ?? []);
 }
-/** The apps that have anything to check, for the picker. */
-export async function listApps(instance) {
-    const { data, error } = await adminClient(instance)
-        .from("apps")
-        .select("slug")
-        .order("slug");
-    if (error)
-        throw new Error(error.message);
-    return (data ?? []).map((row) => row.slug);
-}
 /**
- * Files a report against a profile, resolves it with quarantine, and checks
- * that the freeze and the name reset both landed.
+ * The role every devtools-granted moderator holds — `moderation check`'s
+ * throwaway account and `persona moderator`'s longer-lived one alike, so
+ * both resolve to the SAME role row rather than each accumulating their own.
  *
- * The subject is a THROWAWAY member created for the run, not one of the seeded
- * personas, and that is not squeamishness about touching fixtures.
- * `file_report` corroborates an existing open report rather than filing a
- * second one against the same content, and the seeds ship exactly such a report
- * against the author persona's profile. Reusing it would make this function's
- * first step silently become "add a corroboration", and every assertion after
- * it would be reading the seed's decision instead of its own.
+ * Reuses the id `supabase/seed/development/02_moderation.sql` used to seed
+ * this same role under, on the theory that an existing local database that
+ * still has that seeded row should be upserted into agreement rather than
+ * given a second, redundant "Moderator" role.
+ */
+export const MODERATOR_ROLE_ID = "00000000-0000-4000-9000-000000000001";
+/**
+ * Creates (or updates) the Moderator role definition, and returns its id.
  *
- * Everything it creates, it deletes, including on the failure paths, which is
- * why the teardown is in a `finally`. A contributor running this twice should
- * get the same answer the second time.
+ * `canModerate: true` and nothing else — not Root, not any of the other
+ * `roles` permission columns — mirroring exactly what the seed persona held.
+ * Idempotent (`upsert`) so repeated calls, from either caller above, never
+ * race each other into two rows or fail on the second one.
  */
-export async function quarantineRoundTrip(instance) {
-    const steps = [];
+export async function ensureModeratorRole(admin) {
+    const { error } = await admin.from("roles").upsert({
+        id: MODERATOR_ROLE_ID,
+        title: "Moderator",
+        description: "Created by `pnpm devtools`: works the report queue, and nothing else.",
+        roleType: "custom",
+        rank: 5000,
+        canModerate: true,
+    });
+    if (error) {
+        throw new Error(`Could not create the Moderator role: ${error.message}`);
+    }
+    return MODERATOR_ROLE_ID;
+}
+/** Grants the Moderator role to `userId`, creating the role definition first
+ * if this is the first account to need it. */
+export async function grantModerator(admin, userId) {
+    const roleId = await ensureModeratorRole(admin);
+    const { error } = await admin.from("userRoles").insert({ userId, roleId });
+    if (error) {
+        throw new Error(`Could not grant the Moderator role: ${error.message}`);
+    }
+}
+/** An email that unambiguously belongs to devtools, not a real account —
+ * see `persona.ts`'s header for the `@persona.test` convention this shares. */
+function temporaryModeratorEmail() {
+    return `devtools-moderator-${crypto.randomUUID().slice(0, 8)}@persona.test`;
+}
+/** A password nobody needs to remember — this account lives for the
+ * duration of one command. */
+function randomPassword() {
+    return crypto.randomUUID() + crypto.randomUUID();
+}
+/**
+ * Runs `fn` with a client signed in as a throwaway moderator, created for
+ * this call and deleted again in a `finally` whether or not `fn` throws.
+ *
+ * The admin API's `createUser` bypasses the app's `before_user_created`
+ * uga.edu hook (that hook only runs on the sign-up/OTP paths a real user
+ * takes, not the service-role admin API), which is why a `@persona.test`
+ * address works here at all — see `persona.ts`'s header for the same note
+ * in more detail, since that is the command a contributor is more likely to
+ * read first.
+ */
+export async function withTemporaryModerator(instance, fn) {
     const admin = adminClient(instance);
-    const email = `roundtrip-${crypto.randomUUID().slice(0, 8)}@devdogs.test`;
-    const abusiveName = "BUY CHEAP FOLLOWERS NOW";
-    let subjectId = null;
-    let reportId = null;
+    const email = temporaryModeratorEmail();
+    const password = randomPassword();
+    let userId = null;
     try {
-        // ── Arrange: a member with an abusive display name and a name of record ──
-        //
-        // Through the GoTrue admin API rather than `from("users")`: the `auth`
-        // schema is not exposed over PostgREST, and should not be.
-        const { data: created, error: createErr } = await admin.auth.admin.createUser({
+        const { data, error } = await admin.auth.admin.createUser({
             email,
-            password: PERSONA_PASSWORD,
+            password,
             email_confirm: true,
+            user_metadata: { createdBy: "devtools moderation check" },
         });
-        if (createErr ?? !created.user) {
-            throw new Error(`Could not create the subject account: ${createErr?.message}`);
-        }
-        subjectId = created.user.id;
-        const { error: profileErr } = await admin.from("profile").insert({
-            userId: subjectId,
-            preferredName: abusiveName,
-            bio: "Created by `pnpm devtools`, and deleted again immediately.",
-            // The name the reset restores. Written by the Involvement roster import
-            // in production (server/actions/verification.ts); set by hand here so the
-            // round-trip exercises the branch that has something to restore.
-            legalFirstName: "Round",
-            legalLastName: "Trip",
-        });
-        if (profileErr) {
-            throw new Error(`Could not create a profile: ${profileErr.message}`);
-        }
-        steps.push({
-            name: "fixture",
-            ok: true,
-            detail: `Created a profile named "${abusiveName}" with a name of record.`,
-        });
-        // ── Editable before ─────────────────────────────────────────────────────
-        //
-        // Establishes the baseline the freeze is measured against. Without it a
-        // profile that was never editable in the first place would pass the freeze
-        // check for the wrong reason.
-        const subject = await personaClient(instance, email);
-        await subject
-            .from("profile")
-            .update({ bio: "Edited." })
-            .eq("userId", subjectId);
-        const { data: beforeRow } = await admin
-            .from("profile")
-            .select("bio")
-            .eq("userId", subjectId)
-            .single();
-        const editableBefore = beforeRow?.bio === "Edited.";
-        steps.push({
-            name: "editable_before",
-            ok: editableBefore,
-            detail: editableBefore
-                ? "The member can edit their own profile before it is reported."
-                : "The member could NOT edit their own profile before it was reported — the update policy is denying more than quarantine.",
-        });
-        // ── Act: file a report as the seeded member ─────────────────────────────
-        const memberClient = await personaClient(instance, PERSONAS.member);
-        // A literal, not a lookup. The vocabulary is a platform-owned enum, so
-        // there is no per-app row to find first. If this label ever stops existing,
-        // Postgres rejects the call by type rather than silently reporting "no
-        // reasons configured".
-        const { data: filed, error: fileErr } = await memberClient.rpc("file_report", {
-            app_slug: "platform",
-            content_type: "profile",
-            content_ref: subjectId,
-            reason: "spam",
-            description: "Filed by the devtools round-trip.",
-        });
-        if (fileErr)
-            throw new Error(`file_report failed: ${fileErr.message}`);
-        // A one-element array, not an object: these RPCs return `setof` now, so
-        // PostgREST serialises even a single result as a list.
-        const [row] = (filed ?? []);
-        if (!row)
-            throw new Error("file_report returned no rows");
-        reportId = row.reportId;
-        steps.push({
-            name: "file_report",
-            ok: true,
-            detail: `A member filed a report against the profile (${reportId}).`,
-        });
-        // ── Act: resolve with quarantine as the moderator ───────────────────────
-        const moderator = await personaClient(instance, PERSONAS.moderator);
-        const { error: resolveErr } = await moderator.rpc("resolve_report", {
-            report_id: reportId,
-            subject_action: "no_action",
-            filer_action: "no_action",
-            content_action: "quarantine",
-            moderator_note: "devtools round-trip",
-        });
-        if (resolveErr) {
-            throw new Error(`resolve_report failed: ${resolveErr.message}`);
+        if (error || !data.user) {
+            throw new Error(`Could not create a temporary moderator: ${error?.message}`);
         }
-        steps.push({
-            name: "resolve_report",
-            ok: true,
-            detail: "A moderator resolved the report with `quarantine`.",
-        });
-        // ── Assert: the effect actually landed ──────────────────────────────────
-        const { data: after } = await admin
-            .from("profile")
-            .select("quarantinedBy, preferredName")
-            .eq("userId", subjectId)
-            .single();
-        const columnSet = Boolean(after?.quarantinedBy);
-        steps.push({
-            name: "quarantine_column",
-            ok: columnSet,
-            detail: columnSet
-                ? 'The resolution set "quarantinedBy" on the row.'
-                : 'The resolution did NOT set "quarantinedBy" — apply_content_action did not reach this table.',
-        });
-        const nameReset = after?.preferredName === "Round Trip";
-        steps.push({
-            name: "name_reset",
-            ok: nameReset,
-            detail: nameReset
-                ? 'The display name was reset to the name of record ("Round Trip").'
-                : `The display name is still "${String(after?.preferredName)}" — the reset trigger did not fire, so the remedy is a record with no effect.`,
-        });
-        // ── Assert: and that the member stopped being able to undo it ───────────
-        //
-        // The check that matters. A denied UPDATE under RLS is not an error, it
-        // simply matches no rows, so asserting on `error` here would pass just as
-        // happily if the write had landed. Read the value back instead.
-        await subject
-            .from("profile")
-            .update({ preferredName: abusiveName })
-            .eq("userId", subjectId);
-        const { data: frozenRow } = await admin
-            .from("profile")
-            .select("preferredName")
-            .eq("userId", subjectId)
-            .single();
-        const frozen = frozenRow?.preferredName !== abusiveName;
-        steps.push({
-            name: "frozen_after",
-            ok: frozen,
-            detail: frozen
-                ? "The member can no longer change their display name back."
-                : 'The member CHANGED IT STRAIGHT BACK. The update policy does not filter on "quarantinedBy" — this is the check that matters.',
-        });
-        return steps;
+        userId = data.user.id;
+        await grantModerator(admin, userId);
+        const client = await signedInClient(instance, email, password);
+        return await fn(client);
     }
     finally {
-        // Teardown runs whether or not the assertions held. Deleting the report
-        // first lets the resolution cascade, which releases the FK on the profile;
-        // deleting the auth user then cascades to the profile row itself.
-        if (reportId)
-            await admin.from("reports").delete().eq("id", reportId);
-        if (subjectId)
-            await admin.auth.admin.deleteUser(subjectId);
+        // `userRoles.userId` cascades on delete (see the migration that defines
+        // it), so deleting the auth user is the whole teardown — no separate
+        // `userRoles` row to clean up, and the Moderator role DEFINITION is left
+        // in place for the next caller, same as `ensureModeratorRole` intends.
+        if (userId)
+            await admin.auth.admin.deleteUser(userId);
     }
 }

package/dist/oauth/wizard.d.ts

@@ -20,8 +20,8 @@ import { type ConnectTarget } from "./target.js";
  */
 export declare function connectViaOneClick(target: ConnectTarget, platformUrl: string, cwd: string, transportOverride: ConnectTransport | undefined): Promise<ExchangeResult>;
 /**
- * The wizard. `baseUrlOverride`/`platformUrlOverride`, when given, skip
- * their respective prompts (only reachable via "Paste credentials instead"
+ * The wizard. `baseUrlOverride`/`platformUrlOverride`, when given, replace
+ * the canonical API and platform URLs (used by "Paste credentials instead"
  * and the one-click flow respectively). `transportOverride` (`--device`/
  * `--loopback`) forces the one-click flow's transport — see
  * `connectViaOneClick` — and is ignored on the "Paste credentials instead"

package/dist/oauth/wizard.js

@@ -33,7 +33,6 @@ import { DeviceError, PollError, pollForToken, requestDeviceCode, } from "./devi
 import { decideTransport } from "./transport.js";
 import { defaultLabel } from "./label.js";
 import { HostedCredentialsMissingError, NoTierResolvedError, readHostedTargetFromEnvFiles, resolveLocalTarget, resolveHostedTargetInRepo, } from "./target.js";
-import { recordResolved } from "../invocation.js";
 import { loadEnvSession } from "../repo/peers.js";
 import { discoverRepoRoot } from "../repo/root.js";
 import { resolveTier } from "../tier.js";
@@ -340,30 +339,11 @@ export async function connectViaOneClick(target, platformUrl, cwd, transportOver
     }
     return connectOneClick(target, platformUrl, cwd, decision.reason, listener);
 }
-/** Step 2 (paste branch): the original manual flow — DevDogs API URL, then client ID/secret. */
+/** Step 2 (paste branch): the original manual flow — client ID/secret against the DevDogs API. */
 async function connectByPasting(baseUrlOverride) {
-    let baseUrl = baseUrlOverride ?? process.env[ENV_KEYS.baseUrl] ?? DEFAULT_API_URL;
-    if (!baseUrlOverride) {
-        baseUrl = unwrap(await text({
-            message: "DevDogs API URL",
-            initialValue: baseUrl,
-            validate: (v) => {
-                if (!v)
-                    return;
-                try {
-                    new URL(v);
-                }
-                catch {
-                    return "Enter a valid URL (e.g. https://api.devdogsuga.org)";
-                }
-            },
-        }));
-    }
-    baseUrl = baseUrl.replace(/\/+$/, "");
-    // A base URL entered at the prompt (not passed as --base-url) is what the
-    // rerun line needs to skip this step next time.
-    if (!baseUrlOverride)
-        recordResolved("--base-url", baseUrl);
+    // Not prompted: contributors always want the canonical API. `--base-url` /
+    // `OAUTH_BASE_URL` stay as overrides for testing against another project.
+    const baseUrl = (baseUrlOverride ?? process.env[ENV_KEYS.baseUrl] ?? DEFAULT_API_URL).replace(/\/+$/, "");
     let clientId = process.env[ENV_KEYS.clientId] || undefined;
     let clientSecret = process.env[ENV_KEYS.clientSecret] || undefined;
     if (clientId && clientSecret) {
@@ -414,8 +394,8 @@ async function connectByPasting(baseUrlOverride) {
     return { clientId, clientSecret, issuer };
 }
 /**
- * The wizard. `baseUrlOverride`/`platformUrlOverride`, when given, skip
- * their respective prompts (only reachable via "Paste credentials instead"
+ * The wizard. `baseUrlOverride`/`platformUrlOverride`, when given, replace
+ * the canonical API and platform URLs (used by "Paste credentials instead"
  * and the one-click flow respectively). `transportOverride` (`--device`/
  * `--loopback`) forces the one-click flow's transport — see
  * `connectViaOneClick` — and is ignored on the "Paste credentials instead"

package/dist/persona.d.ts

@@ -0,0 +1,18 @@
+import type { DbConnection } from "./db/connection.js";
+export declare const PERSONA_KINDS: readonly ["member", "moderator"];
+export type PersonaKind = (typeof PERSONA_KINDS)[number];
+export declare function isPersonaKind(value: string): value is PersonaKind;
+/**
+ * Refuses outside development — a staging or production database has real
+ * members on it, and this command exists to populate one that does not.
+ * Exported so `cli.ts`'s `moderation check` (also development-only now, for
+ * the same reason) shares the exact refusal wording.
+ */
+export declare function refuseUnlessDevelopment(connection: DbConnection, label: string): boolean;
+export interface CreatedPersona {
+    email: string;
+    password: string;
+    userId: string;
+    preferredName: string;
+}
+export declare function runPersona(argv: string[]): Promise<void>;

package/dist/persona.js

@@ -0,0 +1,221 @@
+/**
+ * `persona <member|moderator>` / `persona --clean` — throwaway accounts for
+ * a development database.
+ *
+ * These replace the seeded `member@devdogs.test` / `author@devdogs.test` /
+ * `moderator@devdogs.test` personas that used to come from
+ * `supabase/seed/development/02_moderation.sql`. That file — and the rest of
+ * `supabase/seed/development/` — is going away in the app repo, so a fresh
+ * `db reset` no longer leaves a signed-in account to switch to; this is what
+ * creates one on demand instead.
+ *
+ * Every account this creates lives at `<kind>-<8 hex>@persona.test`: a
+ * domain that cannot collide with a real UGA address, and — not
+ * coincidentally — the same reason it can exist here at all. `.createUser`
+ * goes through GoTrue's ADMIN API, which inserts the row directly rather
+ * than running the app's `before_user_created` Auth Hook (the one that
+ * requires a uga.edu address on the sign-up/OTP paths a real member takes).
+ * The admin API was never wired to that hook, so a `@persona.test` address
+ * sails through here uncontested.
+ *
+ * `--clean` deletes every account this command created — matched on BOTH the
+ * `@persona.test` domain AND a `user_metadata.createdBy` marker, never the
+ * domain alone. A shared development database can carry `@persona.test`
+ * accounts this command did not create — CI's own fixtures, most likely, or
+ * a `moderation check` run whose `withTemporaryModerator` teardown never
+ * reached its `finally` because the process was killed. The marker is what
+ * keeps `--clean` from reaching past accounts it is not responsible for.
+ */
+import { randomUUID } from "node:crypto";
+import { confirm, log, note, select } from "@clack/prompts";
+import { adminClient, resolveInstance, } from "./instance.js";
+import { grantModerator } from "./moderation.js";
+import { explain, unwrap } from "./ui.js";
+export const PERSONA_KINDS = ["member", "moderator"];
+export function isPersonaKind(value) {
+    return PERSONA_KINDS.includes(value);
+}
+/** Every account this command creates carries this in `user_metadata`, and
+ * `--clean` refuses to delete anything without it — see the header. */
+const CREATED_BY = "devtools persona";
+function personaEmail(kind) {
+    return `${kind}-${randomUUID().slice(0, 8)}@persona.test`;
+}
+/** Nobody needs to remember this — it is printed once, for whoever asked. */
+function randomPassword() {
+    return randomUUID() + randomUUID();
+}
+/**
+ * Refuses outside development — a staging or production database has real
+ * members on it, and this command exists to populate one that does not.
+ * Exported so `cli.ts`'s `moderation check` (also development-only now, for
+ * the same reason) shares the exact refusal wording.
+ */
+export function refuseUnlessDevelopment(connection, label) {
+    if (connection.tier === "development")
+        return false;
+    process.stderr.write(`${label}: only runs against a development database — this session ` +
+        `targets ${connection.tier}. Relaunch with --tier development:local ` +
+        "or development:remote.\n");
+    return true;
+}
+/**
+ * Creates the account and its profile — `userId` and `preferredName` are the
+ * only two columns `platform.profile` requires (see the migration; every
+ * other column is nullable or defaulted), which is why this needs nothing
+ * from `02_moderation.sql`'s richer INSERT beyond the shape of the two rows
+ * it wrote. Grants the Moderator role too, for `kind === "moderator"`.
+ */
+async function createPersona(instance, kind) {
+    const admin = adminClient(instance);
+    const email = personaEmail(kind);
+    const password = randomPassword();
+    const preferredName = kind === "moderator" ? "Devtools Moderator" : "Devtools Member";
+    const { data, error } = await admin.auth.admin.createUser({
+        email,
+        password,
+        email_confirm: true,
+        user_metadata: { createdBy: CREATED_BY },
+    });
+    if (error || !data.user) {
+        throw new Error(`Could not create the account: ${error?.message}`);
+    }
+    const userId = data.user.id;
+    const { error: profileErr } = await admin
+        .from("profile")
+        .insert({ userId, preferredName });
+    if (profileErr) {
+        throw new Error(`Could not create a profile: ${profileErr.message}`);
+    }
+    if (kind === "moderator")
+        await grantModerator(admin, userId);
+    return { email, password, userId, preferredName };
+}
+/** Any OTHER profile on this database, for a moderator persona to report —
+ * `null` when this is the only account around, which the caller reports
+ * rather than guessing at a subject that does not exist. */
+async function findOtherProfile(instance, excludeUserId) {
+    const { data, error } = await adminClient(instance)
+        .from("profile")
+        .select("userId, preferredName")
+        .neq("userId", excludeUserId)
+        .limit(1)
+        .maybeSingle();
+    if (error)
+        throw new Error(`Could not read platform.profile: ${error.message}`);
+    return data;
+}
+/**
+ * Files one open report, mirroring the "one open report" `02_moderation.sql`
+ * used to seed — inserted directly rather than through
+ * `platform.file_report()`, the same reasoning that seed's own comment gave:
+ * neither a seed nor this command has a session to attribute the RPC call to.
+ */
+async function fileSampleReport(instance, reporterId, subjectId, subjectName) {
+    const admin = adminClient(instance);
+    const { data: app, error: appErr } = await admin
+        .from("apps")
+        .select("id")
+        .eq("slug", "platform")
+        .single();
+    if (appErr || !app) {
+        throw new Error(`Could not find the platform app row: ${appErr?.message}`);
+    }
+    const { error } = await admin.from("reports").insert({
+        appId: app.id,
+        reporterUserId: reporterId,
+        reportedUserId: subjectId,
+        contentType: "profile",
+        contentRef: subjectId,
+        contentSnapshot: subjectName,
+        description: "Filed by `pnpm devtools persona` so the moderation queue has something in it.",
+        reason: "spam",
+    });
+    if (error) {
+        throw new Error(`Could not file the sample report: ${error.message}`);
+    }
+}
+async function runClean(instance) {
+    const admin = adminClient(instance);
+    const { data, error } = await admin.auth.admin.listUsers();
+    if (error)
+        throw new Error(`Could not list accounts: ${error.message}`);
+    // Both conditions — see the header on why the domain alone is not enough.
+    const targets = data.users.filter((u) => u.email?.endsWith("@persona.test") &&
+        u.user_metadata?.createdBy === CREATED_BY);
+    if (targets.length === 0) {
+        log.info("No `pnpm devtools persona`-created accounts to clean up.");
+        return;
+    }
+    // Deleting the auth user cascades to its profile, its Moderator role grant
+    // (if any) and any reports it filed or was reported in — every FK a
+    // persona account touches is `on delete cascade` — so there is nothing
+    // else to clean up per account.
+    for (const user of targets) {
+        await admin.auth.admin.deleteUser(user.id);
+        log.success(`Deleted ${user.email}.`);
+    }
+    log.info(`Deleted ${targets.length} account${targets.length === 1 ? "" : "s"}.`);
+}
+export async function runPersona(argv) {
+    const clean = argv.includes("--clean");
+    const positional = argv.find((arg) => !arg.startsWith("--"));
+    if (clean && positional) {
+        explain("Two answers to one question.", "--clean deletes every account this command made; a kind creates a new one.", ["pnpm devtools persona member", "pnpm devtools persona --clean"]);
+        process.exitCode = 1;
+        return;
+    }
+    const resolved = await resolveInstance({ label: "devtools persona" });
+    if (!resolved) {
+        process.exitCode = 1;
+        return;
+    }
+    const { connection, instance } = resolved;
+    if (refuseUnlessDevelopment(connection, "devtools persona")) {
+        process.exitCode = 1;
+        return;
+    }
+    if (clean) {
+        await runClean(instance);
+        return;
+    }
+    let kind;
+    if (positional) {
+        if (!isPersonaKind(positional)) {
+            explain(`"${positional}" is not a persona kind.`, "", [
+                "pnpm devtools persona member",
+                "pnpm devtools persona moderator",
+            ]);
+            process.exitCode = 1;
+            return;
+        }
+        kind = positional;
+    }
+    else {
+        kind = unwrap(await select({
+            message: "Which kind of persona?",
+            options: PERSONA_KINDS.map((value) => ({ value, label: value })),
+        }));
+    }
+    const persona = await createPersona(instance, kind);
+    note(`Email:    ${persona.email}\nPassword: ${persona.password}`, `${kind} persona created`);
+    const fileReport = unwrap(await confirm({
+        message: "File a sample report against a member profile, so the moderation queue isn't empty?",
+        initialValue: kind === "moderator",
+    }));
+    if (!fileReport)
+        return;
+    // A member persona reports itself — there is no separate reporter account
+    // on offer here, and nothing downstream cares who filed it, only that the
+    // queue has one open report to practice resolving. A moderator persona
+    // reports whatever OTHER profile already exists.
+    const subject = kind === "member"
+        ? { userId: persona.userId, preferredName: persona.preferredName }
+        : await findOtherProfile(instance, persona.userId);
+    if (!subject) {
+        log.warn("No other account to report yet — run `pnpm devtools persona member` first.");
+        return;
+    }
+    await fileSampleReport(instance, persona.userId, subject.userId, subject.preferredName);
+    log.success("Filed a sample report. Resolve it from /console/moderation.");
+}

package/dist/repo/peer-redirect-hooks.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Module-loader hooks for `repo/peer-redirect.ts`. Runs on Node's loader
+ * thread, not the main one, so nothing here can import devtools state: the
+ * redirects arrive once, as `initialize()`'s data, and are never updated.
+ */
+import type { InitializeHook, ResolveHook } from "node:module";
+export interface PeerRedirect {
+    /** The exact file URL of the importing module the redirect applies to. */
+    parentURL: string;
+    /** The bare specifier it imports, e.g. `@devdogsuga/env`. */
+    specifier: string;
+    /** Where that specifier should resolve instead. */
+    url: string;
+}
+export declare const initialize: InitializeHook<PeerRedirect[]>;
+export declare const resolve: ResolveHook;

package/dist/repo/peer-redirect-hooks.js

@@ -0,0 +1,10 @@
+let redirects = [];
+export const initialize = (data) => {
+    redirects = data;
+};
+export const resolve = (specifier, context, nextResolve) => {
+    const redirect = redirects.find((r) => r.specifier === specifier && r.parentURL === context.parentURL);
+    if (redirect)
+        return { url: redirect.url, shortCircuit: true };
+    return nextResolve(specifier, context);
+};