@devdogsuga/devtools 0.1.12 → 0.1.13

package/dist/images/commands.js

@@ -12,9 +12,14 @@
  * not. So an officer can type `pnpm devtools images` and be walked through it,
  * and a script can pass every flag and never see a prompt.
  *
- * Event graphics are the one group backed by a database rather than by files in
- * this repo, and the one group that can therefore be unavailable. See
- * {@link loadEvents} for what the command says when it is.
+ * Event graphics used to be the one group backed by a database rather than by
+ * files in this repo — and the one group that could therefore be unavailable
+ * without one. They no longer are: `configEvents()` (`events.ts`) reads
+ * `@devdogsuga/events`'s committed config directly, the same source a
+ * reconcile job used to copy into the database first, so this command needs
+ * no running stack at all any more. See {@link loadEvents} for what remains
+ * of the "unavailable" branch — a repo `@devdogsuga/events` cannot resolve
+ * in, rather than a database that is not up.
  */
 import { mkdir, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -23,9 +28,8 @@ import { log, note } from "@clack/prompts";
 import { loadOpenGraph } from "../repo/source.js";
 import { findRepoRoot } from "../repo/root.js";
 import { positionals } from "../args.js";
-import { adminClient } from "../instance.js";
-import { errorMessage, explain } from "../ui.js";
-import { supabaseEvents } from "./events.js";
+import { errorMessage, explain, explainError, UsageError } from "../ui.js";
+import { configEvents } from "./events.js";
 import { assertUniqueStems, eventGraphics, staticGraphics, } from "./graphics.js";
 import { pickFormats, pickGraphics, pickOutput } from "./prompts.js";
 import { render } from "./render.js";
@@ -76,29 +80,21 @@ export function namesEvents(patterns) {
 /**
  * Meetings, or a clear account of why there are none.
  *
- * The database is the one dependency of this command that a contributor cannot
- * see, so every failure here says which database it looked at and what to run.
- * Two failures, treated differently, matching what each one means:
+ * `@devdogsuga/events` is an optional peer (see `repo/peers.ts`'s header), so
+ * loading it can still fail — outside a DevDogsUGA checkout, or one where
+ * nothing depends on it. That is the one way this command still needs an
+ * account of what went wrong, and two failures are treated differently,
+ * matching what each one means:
  *
- *   - **Unreachable, under a wildcard.** `images *` means "everything", and
+ *   - **Unavailable, under a wildcard.** `images *` means "everything", and
  *     everything else is renderable. It renders, and reports the events it
  *     could not.
- *   - **Unreachable, named.** `images 'event/*'` asked for exactly the thing
+ *   - **Unavailable, named.** `images 'event/*'` asked for exactly the thing
  *     that is missing. Nothing to degrade to, so it fails.
  */
 async function loadEvents(patterns, deps) {
     const required = namesEvents(patterns);
-    const instance = await deps.connect();
-    if (!instance) {
-        if (required) {
-            throw new Error("Event images come from the database, and there is no database to read.");
-        }
-        return {
-            graphics: [],
-            skipped: "no database reachable — run `pnpm devtools db start`",
-        };
-    }
-    const reader = (deps.reader ?? ((i) => supabaseEvents(adminClient(i))))(instance);
+    const reader = (deps.reader ?? configEvents)();
     let meetings;
     try {
         meetings = await reader.meetings();
@@ -126,7 +122,7 @@ function display(file) {
     const rel = relative(findRepoRoot(), file);
     return rel.startsWith("..") || isAbsolute(rel) ? file : rel;
 }
-export async function runImages(argv, deps) {
+export async function runImages(argv, deps = {}) {
     const options = parseImagesArgs(argv);
     if (options.out && options.defaultOut) {
         explain("Two answers to one question.", "--out names a directory and --default-out says to use each graphic's own.", [
@@ -140,7 +136,7 @@ export async function runImages(argv, deps) {
         await images(options, deps);
     }
     catch (err) {
-        explain("Could not render that.", errorMessage(err), [
+        explainError("Could not render that.", err, [
             "pnpm devtools images                      # pick from a list",
             "pnpm devtools images 'event/*' --all-formats --out ~/images",
             "pnpm devtools images '*' --default-out",
@@ -162,7 +158,7 @@ async function images(options, deps) {
         ? await pickGraphics(registry)
         : resolvePatterns(options.patterns, registry);
     if (graphics.length === 0) {
-        throw new Error("Nothing to render.");
+        throw new UsageError("Nothing to render.");
     }
     // ── At what sizes ─────────────────────────────────────────────────────────
     const { FORMATS } = await loadOpenGraph();
@@ -173,19 +169,19 @@ async function images(options, deps) {
             : await pickFormats(graphics);
     const unknown = requested.filter((name) => !FORMATS[name]);
     if (unknown.length > 0) {
-        throw new Error(`No format called ${unknown.join(", ")}. Try one of ${Object.keys(FORMATS).join(", ")}.`);
+        throw new UsageError(`No format called ${unknown.join(", ")}. Try one of ${Object.keys(FORMATS).join(", ")}.`);
     }
     const { selections, unsupported } = await pair(graphics, requested);
     // Naming one graphic and one format it cannot do is a mistake worth saying
     // out loud; sweeping up combinations that do not exist under a wildcard is
     // not, and reporting every one of those would bury the output.
     if (selections.length === 0 && unsupported.length > 0) {
-        throw new Error(unsupported
+        throw new UsageError(unsupported
             .map((miss) => `${miss.graphic} has no ${miss.format} rendition`)
             .join("; "));
     }
     if (selections.length === 0)
-        throw new Error("Nothing to render.");
+        throw new UsageError("Nothing to render.");
     // ── Where ─────────────────────────────────────────────────────────────────
     const out = options.defaultOut
         ? undefined
@@ -224,10 +220,10 @@ function resolvePatterns(patterns, registry) {
     const askedForEvents = unmatched.some((pattern) => pattern === "event" || pattern.startsWith("event/"));
     const haveEvents = registry.some((graphic) => graphic.group === "event");
     if (askedForEvents && !haveEvents) {
-        throw new Error("This database has no meetings, so there are no event images to render. " +
+        throw new UsageError("This database has no meetings, so there are no event images to render. " +
             "Reconcile it from `@devdogsuga/events`, or point at a database that has been.");
     }
     const groups = [...new Set(registry.map((graphic) => `${graphic.group}/*`))];
-    throw new Error(`Nothing called ${unmatched.join(", ")}. Names are group/name — try ` +
+    throw new UsageError(`Nothing called ${unmatched.join(", ")}. Names are group/name — try ` +
         `${groups.join(", ")}, or * for all of them.`);
 }

package/dist/images/events.d.ts

@@ -1,26 +1,37 @@
-import type { DevtoolsClient } from "../instance.js";
+import type { Meeting } from "@devdogsuga/events";
 import type { EventGraphicSource } from "./graphics.js";
 /**
- * Meetings, for the one group of graphics that cannot be drawn from the repo.
+ * Meetings, for the one group of graphics that cannot be drawn from files
+ * alone.
  *
- * Every other graphic is a function of committed files. An event poster is a
- * function of meetings reconciled into the database from
- * `@devdogsuga/events`, so `devtools images event/*` needs a running
- * database that has that config loaded into it — and there is nothing about
- * typing a command that makes that obvious. Making it obvious is most of what
- * this file is for: the reads are small, and {@link EventReader} is the seam
- * the command talks to, so tests never open a socket.
- *
- * Reads go through `adminClient`, against the local instance resolved by the
- * command. `platform` is exposed to PostgREST (`supabase/config.toml`),
- * and the service role bypasses the RLS that otherwise keeps `meetings` and
- * `workshops` closed to every client.
+ * Every other graphic is a function of committed files. An event poster used
+ * to be a function of meetings RECONCILED into the database from
+ * `@devdogsuga/events` — which meant `devtools images event/*` needed a
+ * running local stack just to draw a picture that comes entirely out of this
+ * repo. It no longer does: `@devdogsuga/events`'s `getClubConfig()` is the
+ * authored source those database rows were always reconciled FROM (see
+ * `apps/platform/src/server/config/reconcile.ts` in the target repo), so
+ * reading it directly here skips the round trip through Postgres rather than
+ * duplicating it. {@link EventReader} is the seam the command talks to, so
+ * tests never touch the filesystem or the network.
  */
 /** The seam the command talks to, so tests never open a socket. */
 export interface EventReader {
     meetings(): Promise<EventGraphicSource[]>;
 }
-export declare function supabaseEvents(client: DevtoolsClient): EventReader;
+/**
+ * Builds the reader from `@devdogsuga/events`'s committed data file.
+ *
+ * Replaces `supabaseEvents`, which read the `meetings`/`workshops` tables a
+ * reconcile job had already copied this same config into. The config's shape
+ * (`schema.ts`) is deliberately a near-mirror of those tables' columns for
+ * exactly this reason — see that file's header — so the mapping below is
+ * closer to a rename than a translation: `Meeting.id` is the row's `slug`,
+ * `Meeting.title` is what the DB called `nameOverride`, and a workshop's
+ * `project` (free text in the config) stands in for the DB's
+ * `projects.displayName` join.
+ */
+export declare function configEvents(): EventReader;
 /**
  * The meeting's name, in descending order of how much somebody meant it.
  *
@@ -33,4 +44,4 @@ export declare function supabaseEvents(client: DevtoolsClient): EventReader;
  * package cannot depend on. `events.test.ts` pins the chain so a change to one
  * shows up as a failure rather than as a differently-titled poster.
  */
-export declare function meetingTitle(nameOverride: string | null, kind: string | null, startsAt: Date, agenda: readonly string[]): string;
+export declare function meetingTitle(nameOverride: string | null, kind: Meeting["kind"], startsAt: Date, agenda: readonly string[]): string;

package/dist/images/events.js

@@ -1,39 +1,29 @@
-import { loadBrandEvent } from "../repo/peers.js";
-export function supabaseEvents(client) {
+import { loadBrandEvent, loadEvents } from "../repo/peers.js";
+/**
+ * Builds the reader from `@devdogsuga/events`'s committed data file.
+ *
+ * Replaces `supabaseEvents`, which read the `meetings`/`workshops` tables a
+ * reconcile job had already copied this same config into. The config's shape
+ * (`schema.ts`) is deliberately a near-mirror of those tables' columns for
+ * exactly this reason — see that file's header — so the mapping below is
+ * closer to a rename than a translation: `Meeting.id` is the row's `slug`,
+ * `Meeting.title` is what the DB called `nameOverride`, and a workshop's
+ * `project` (free text in the config) stands in for the DB's
+ * `projects.displayName` join.
+ */
+export function configEvents() {
     return {
         async meetings() {
-            // Cancelled nights are included deliberately: a cancellation is exactly
-            // when somebody needs a fresh graphic, and the card has a layout for it.
-            // Deleted ones are not.
-            //
-            // No competitions query any more: a competition is a mirrored GitHub
-            // issue now (see apps/platform/src/server/github/competitions.ts), not
-            // something a meeting kicks off or judges, so there is no "kickoff" or
-            // "judging" segment left for a meeting poster to draw. Every workshop
-            // item is plain "workshop".
-            const [meetings, workshops] = await Promise.all([
-                client
-                    .from("meetings")
-                    .select("id, slug, nameOverride, kind, building, location, startsAt, endsAt, cancelledAt, cancellationReason")
-                    .is("deletedAt", null)
-                    .order("startsAt", { ascending: false }),
-                client
-                    .from("workshops")
-                    .select("id, meetingId, title, projects(displayName, sortOrder)")
-                    .is("deletedAt", null),
-            ]);
-            if (meetings.error)
-                throw new Error(`Could not read meetings: ${meetings.error.message}`);
-            if (workshops.error) {
-                throw new Error(`Could not read workshops: ${workshops.error.message}`);
-            }
-            const workshopRows = (workshops.data ?? []);
-            const agendas = groupAgendas(workshopRows);
+            const { getClubConfig } = await loadEvents();
             const { EVENT_SEGMENT_VISUALS, meetingCardDetail, meetingLocation } = await loadBrandEvent();
-            return (meetings.data ?? []).map((row) => {
-                const agenda = agendas.get(row.id) ?? [];
+            // Newest first, matching the DB reader's `order("startsAt", {
+            // ascending: false })` — the picker should offer the most recent
+            // meeting first, not whatever order the config file happens to list
+            // them in.
+            const meetings = [...getClubConfig().meetings].sort((a, b) => Date.parse(b.startsAt) - Date.parse(a.startsAt));
+            return meetings.map((row) => {
                 const meeting = {
-                    slug: row.slug,
+                    slug: row.id,
                     startsAt: new Date(row.startsAt),
                     endsAt: new Date(row.endsAt),
                     building: row.building,
@@ -42,20 +32,21 @@ export function supabaseEvents(client) {
                     cancelledAt: row.cancelledAt ? new Date(row.cancelledAt) : null,
                     cancellationReason: row.cancellationReason,
                 };
-                const items = workshopRows
-                    .filter((workshop) => workshop.meetingId === row.id)
-                    .map((workshop) => ({
+                // No competitions here either, for the same reason `supabaseEvents`
+                // dropped them: a competition is a mirrored GitHub issue now, not
+                // config a meeting kicks off. Every agenda item is plain "workshop".
+                const items = row.agenda.map((workshop) => ({
                     label: workshopLabel(workshop),
                     segment: "workshop",
                 }));
                 const detail = meetingCardDetail({
                     meeting,
-                    title: meetingTitle(row.nameOverride, row.kind, meeting.startsAt, agenda),
+                    title: meetingTitle(row.title, row.kind, meeting.startsAt, items.map((item) => item.label)),
                     agenda: items.map((item) => `${EVENT_SEGMENT_VISUALS[item.segment].label}: ${item.label}`),
                     location: meetingLocation(row.building, row.location),
                 });
                 return {
-                    slug: row.slug,
+                    slug: row.id,
                     hint: describeMeeting(meeting),
                     detail,
                     items: items.map((item) => {
@@ -83,38 +74,11 @@ function slugPart(label) {
         .replace(/[^a-z0-9]+/g, "-")
         .replace(/^-|-$/g, "") || "agenda-item");
 }
+/** Unlike the old DB `WorkshopRow`, `Workshop.title` is non-nullable in the
+ * config schema (`workshopSchema`), so there is no `projects.displayName`
+ * fallback left to reach for. */
 function workshopLabel(row) {
-    return row.title ?? row.projects?.displayName ?? "Workshop";
-}
-/**
- * Workshop labels per meeting, in the order the app shows them.
- *
- * `projects.sortOrder` first, then the project's name, then the workshop's own
- * title — the ordering `getMeetingWorkshops` uses, so an agenda here reads the
- * same way it does on the page. A workshop with no project keeps its own title
- * and sorts last, which is what `nulls last` does there.
- */
-function groupAgendas(rows) {
-    const byMeeting = new Map();
-    for (const row of rows) {
-        const list = byMeeting.get(row.meetingId) ?? [];
-        list.push(row);
-        byMeeting.set(row.meetingId, list);
-    }
-    const agendas = new Map();
-    for (const [meetingId, list] of byMeeting) {
-        const labels = list
-            .sort((a, b) => {
-            const order = (a.projects?.sortOrder ?? Number.MAX_SAFE_INTEGER) -
-                (b.projects?.sortOrder ?? Number.MAX_SAFE_INTEGER);
-            if (order !== 0)
-                return order;
-            return ((a.projects?.displayName ?? "").localeCompare(b.projects?.displayName ?? "") || (a.title ?? "").localeCompare(b.title ?? ""));
-        })
-            .map(workshopLabel);
-        agendas.set(meetingId, labels);
-    }
-    return agendas;
+    return row.title;
 }
 /**
  * The meeting's name, in descending order of how much somebody meant it.

package/dist/images/graphics.js

@@ -1,4 +1,5 @@
 import { loadOpenGraph } from "../repo/source.js";
+import { UsageError } from "../ui.js";
 const BRAND = "apps/platform/public/brand";
 /** The two renditions anything may need, because anything may reach the GDG platform. */
 const GDG = ["gdgc-wide", "gdgc-square"];
@@ -226,7 +227,7 @@ export function assertUniqueStems(graphics) {
     for (const graphic of graphics) {
         const clash = seen.get(graphic.stem);
         if (clash) {
-            throw new Error(`${graphic.name} and ${clash} share the leaf "${graphic.stem}", so a flat --out would overwrite one with the other.`);
+            throw new UsageError(`${graphic.name} and ${clash} share the leaf "${graphic.stem}", so a flat --out would overwrite one with the other.`);
         }
         seen.set(graphic.stem, graphic.name);
     }

package/dist/images/prompts.js

@@ -1,6 +1,6 @@
 import { autocompleteMultiselect, isTTY, multiselect, path, select, } from "@clack/prompts";
 import { loadOpenGraph } from "../repo/source.js";
-import { unwrap } from "../ui.js";
+import { unwrap, UsageError } from "../ui.js";
 import { formatsFor } from "./select.js";
 /**
  * What the command asks for when the command line did not say.
@@ -18,7 +18,7 @@ import { formatsFor } from "./select.js";
 export function requireInteractive(what, flag) {
     if (isTTY(process.stdout))
         return;
-    throw new Error(`No terminal to ask which ${what} to use. Pass ${flag} — this is not an interactive shell.`);
+    throw new UsageError(`No terminal to ask which ${what} to use. Pass ${flag} — this is not an interactive shell.`);
 }
 /**
  * Which graphics.

package/dist/instance.d.ts

@@ -1,3 +1,4 @@
+import { type DbConnection } from "./db/connection.js";
 import { findRepoRoot } from "./repo/root.js";
 /**
  * The repo root, which is where `supabase/config.toml` lives.
@@ -25,43 +26,44 @@ export interface Instance {
     publishableKey: string;
     secretKey: string;
 }
-/** The seeded personas, from `supabase/seed/development/02_moderation.sql`. */
-export declare const PERSONAS: {
-    readonly member: "member@devdogs.test";
-    readonly author: "author@devdogs.test";
-    readonly moderator: "moderator@devdogs.test";
-};
 /** The built-in Root role, from `supabase/seed/production/01_roles.sql`. */
 export declare const ROOT_ROLE_ID = "00000000-0000-0000-0000-000000000002";
-export declare const PERSONA_PASSWORD = "password";
-/**
- * Reads the local stack's credentials from the Supabase CLI.
- *
- * `-o env` rather than parsing the human-readable table: the table's labels
- * have changed between CLI versions, the env output has not.
- */
-export declare function detectLocalInstance(cwd?: string): Instance;
+export interface ResolvedInstance {
+    connection: DbConnection;
+    instance: Instance;
+}
+export interface ResolveInstanceOptions {
+    /** Stderr prefix, e.g. "devtools grant-root". */
+    label?: string;
+    /** Injectable for tests; defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+}
 /**
- * Confirms the instance has actually been migrated.
+ * Resolves the session's database AND the Supabase client credentials for it.
  *
- * This used to be `assertNotProduction()`, which read a tier out of a singleton
- * `platform."instance"` table and refused anything reporting itself as
- * production. That table is gone, and the tier column was guarding a door that
- * was already walled up: `detectLocalInstance()` above reads `supabase status`,
- * which only ever describes the Docker stack on this machine, so a remote
- * project cannot reach these commands in the first place.
+ * Goes through `resolveDbConnection()` first — the exact check `db
+ * migrate`/`db reset` run, including the local-stack-offline and
+ * inherited-development-values guards — so a caller here refuses in exactly
+ * the same situations and with the same messages those commands already do.
+ * What this adds is reading `API_URL`/`PUBLISHABLE_KEY`/`SECRET_KEY` out of
+ * the same already-entered session env `DB_URL` came from (see this file's
+ * header), rather than shelling out to `supabase status` — which is what
+ * makes hosted tiers reachable here at all.
  *
- * What was useful was its error message, because "have you run migrations?" is
- * the failure a contributor actually hits. That is all this does now.
+ * Returns `null` after reporting the reason on stderr, same contract as
+ * `resolveDbConnection` — never throws for an expected failure.
  */
-export declare function assertMigrated(instance: Instance): Promise<void>;
+export declare function resolveInstance(opts?: ResolveInstanceOptions): Promise<ResolvedInstance | null>;
 /** A service-role client. Bypasses RLS, so setup and teardown only. */
 export declare function adminClient(instance: Instance, schema?: string): DevtoolsClient;
 /**
- * A client signed in as a seeded persona, subject to RLS.
+ * A client signed in with a real email/password, subject to RLS.
  *
  * Signs in for real rather than hand-signing a JWT, so the token path exercised
  * is the one production uses, with whatever claims Supabase Auth actually puts
- * in a token rather than the ones we assume.
+ * in a token rather than the ones we assume. Takes the password explicitly —
+ * there is no fixed persona password any more (see `persona.ts` and
+ * `moderation.ts`'s `withTemporaryModerator`, both of which generate a fresh
+ * random one per account).
  */
-export declare function personaClient(instance: Instance, email: string, schema?: string): Promise<DevtoolsClient>;
+export declare function signedInClient(instance: Instance, email: string, password: string, schema?: string): Promise<DevtoolsClient>;

package/dist/instance.js

@@ -1,12 +1,23 @@
 /**
  * Finding the instance to work against, and signing in to it.
  *
- * Detection is automatic where possible: `supabase status -o env` already
- * prints everything needed, so nobody has to copy a URL and a key from one
- * terminal into another.
+ * `resolveInstance()` is the one entry point every command that needs a
+ * Supabase client — `db`'s own commands excepted, which only ever need a
+ * Postgres URL — should call. It goes through the SAME session
+ * (`resolveDbConnection()`, `db/connection.ts`) `db migrate`/`db reset` do,
+ * rather than a local-only `supabase status` probe: every session's env
+ * carries `API_URL`/`PUBLISHABLE_KEY`/`SECRET_KEY` alongside `DB_URL` (see
+ * `.env.example`), so whichever tier `--tier` named is exactly the instance
+ * this resolves to, local Docker included.
+ *
+ * This replaces `detectLocalInstance()`+`assertMigrated()`, which read
+ * `supabase status -o env` directly and therefore only ever found the Docker
+ * stack on this machine — the reason `moderation check` and `grant-root`
+ * used to be local-only long after `db reset`/`db migrate` moved onto the
+ * session system.
  */
-import { execFileSync } from "node:child_process";
 import { createClient } from "@supabase/supabase-js";
+import { resolveDbConnection } from "./db/connection.js";
 import { findRepoRoot } from "./repo/root.js";
 /**
  * The repo root, which is where `supabase/config.toml` lives.
@@ -33,97 +44,59 @@ function makeClient(url, key, schema) {
         auth: { autoRefreshToken: false, persistSession: false },
     });
 }
-/** The seeded personas, from `supabase/seed/development/02_moderation.sql`. */
-export const PERSONAS = {
-    member: "member@devdogs.test",
-    author: "author@devdogs.test",
-    moderator: "moderator@devdogs.test",
-};
 /** The built-in Root role, from `supabase/seed/production/01_roles.sql`. */
 export const ROOT_ROLE_ID = "00000000-0000-0000-0000-000000000002";
-export const PERSONA_PASSWORD = "password";
 /**
- * Reads the local stack's credentials from the Supabase CLI.
+ * Resolves the session's database AND the Supabase client credentials for it.
  *
- * `-o env` rather than parsing the human-readable table: the table's labels
- * have changed between CLI versions, the env output has not.
- */
-export function detectLocalInstance(cwd = findRepoRoot()) {
-    let output;
-    try {
-        // Through `pnpm exec` because the Supabase CLI is a workspace devDependency
-        // rather than a global install. Invoking `supabase` directly works only on
-        // machines that happen to have it on PATH.
-        output = execFileSync("pnpm", ["exec", "supabase", "status", "-o", "env"], {
-            cwd,
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-    }
-    catch (err) {
-        throw new Error(`Could not read the local Supabase stack.\n${err instanceof Error ? err.message : String(err)}`);
-    }
-    // The CLI prefixes the block with a "Stopped services: [...]" line whenever
-    // any optional service is down, which is the normal state here. Lines that do
-    // not parse as KEY="value" are skipped rather than treated as an error.
-    const values = new Map();
-    for (const line of output.split("\n")) {
-        const match = /^([A-Z0-9_]+)="?([^"]*)"?$/.exec(line.trim());
-        if (match?.[1])
-            values.set(match[1], match[2] ?? "");
-    }
-    const apiUrl = values.get("API_URL");
-    // Newer CLI versions print PUBLISHABLE_KEY/SECRET_KEY; older ones print the
-    // ANON_KEY/SERVICE_ROLE_KEY names. Both are accepted so the tool does not
-    // break on whichever the contributor happens to have installed.
-    const publishableKey = values.get("PUBLISHABLE_KEY") ?? values.get("ANON_KEY");
-    const secretKey = values.get("SECRET_KEY") ?? values.get("SERVICE_ROLE_KEY");
-    if (!apiUrl || !publishableKey || !secretKey) {
-        throw new Error("`supabase status` did not report an API URL and keys. Is the stack running?");
-    }
-    return { apiUrl, publishableKey, secretKey };
-}
-/**
- * Confirms the instance has actually been migrated.
- *
- * This used to be `assertNotProduction()`, which read a tier out of a singleton
- * `platform."instance"` table and refused anything reporting itself as
- * production. That table is gone, and the tier column was guarding a door that
- * was already walled up: `detectLocalInstance()` above reads `supabase status`,
- * which only ever describes the Docker stack on this machine, so a remote
- * project cannot reach these commands in the first place.
+ * Goes through `resolveDbConnection()` first — the exact check `db
+ * migrate`/`db reset` run, including the local-stack-offline and
+ * inherited-development-values guards — so a caller here refuses in exactly
+ * the same situations and with the same messages those commands already do.
+ * What this adds is reading `API_URL`/`PUBLISHABLE_KEY`/`SECRET_KEY` out of
+ * the same already-entered session env `DB_URL` came from (see this file's
+ * header), rather than shelling out to `supabase status` — which is what
+ * makes hosted tiers reachable here at all.
  *
- * What was useful was its error message, because "have you run migrations?" is
- * the failure a contributor actually hits. That is all this does now.
+ * Returns `null` after reporting the reason on stderr, same contract as
+ * `resolveDbConnection` — never throws for an expected failure.
  */
-export async function assertMigrated(instance) {
-    const client = makeClient(instance.apiUrl, instance.secretKey, "platform");
-    const { error } = await client.from("apps").select("slug").limit(1);
-    if (error) {
-        throw new Error(`Could not read platform."apps": ${error.message}. ` +
-            "Have migrations been applied? `pnpm devtools db reset` rebuilds from scratch.");
+export async function resolveInstance(opts = {}) {
+    const label = opts.label ?? "devtools";
+    const connection = await resolveDbConnection({ label: opts.label });
+    if (!connection)
+        return null;
+    const env = opts.env ?? process.env;
+    const apiUrl = env.API_URL;
+    const publishableKey = env.PUBLISHABLE_KEY;
+    const secretKey = env.SECRET_KEY;
+    if (!apiUrl || !publishableKey || !secretKey) {
+        process.stderr.write(`${label}: this session has a DB_URL but no API_URL/PUBLISHABLE_KEY/` +
+            "SECRET_KEY — run `pnpm devtools env pull` for this tier, or " +
+            "`pnpm devtools db start` for the local stack.\n");
+        return null;
     }
+    return { connection, instance: { apiUrl, publishableKey, secretKey } };
 }
 /** A service-role client. Bypasses RLS, so setup and teardown only. */
 export function adminClient(instance, schema = "platform") {
     return makeClient(instance.apiUrl, instance.secretKey, schema);
 }
 /**
- * A client signed in as a seeded persona, subject to RLS.
+ * A client signed in with a real email/password, subject to RLS.
  *
  * Signs in for real rather than hand-signing a JWT, so the token path exercised
  * is the one production uses, with whatever claims Supabase Auth actually puts
- * in a token rather than the ones we assume.
+ * in a token rather than the ones we assume. Takes the password explicitly —
+ * there is no fixed persona password any more (see `persona.ts` and
+ * `moderation.ts`'s `withTemporaryModerator`, both of which generate a fresh
+ * random one per account).
  */
-export async function personaClient(instance, email, schema = "platform") {
+export async function signedInClient(instance, email, password, schema = "platform") {
     const client = makeClient(instance.apiUrl, instance.publishableKey, schema);
-    const { error } = await client.auth.signInWithPassword({
-        email,
-        password: PERSONA_PASSWORD,
-    });
+    const { error } = await client.auth.signInWithPassword({ email, password });
     if (error) {
-        throw new Error(`Could not sign in as ${email}: ${error.message}. ` +
-            "Seeded personas come from `pnpm devtools` → Reset database.");
+        throw new Error(`Could not sign in as ${email}: ${error.message}.`);
     }
     return client;
 }

package/dist/launch-ci.js

@@ -31,8 +31,12 @@
 import { findRepoRoot } from "./repo/root.js";
 import { loadEnvLoad, loadEnvSession } from "./repo/peers.js";
 import { stripTierFlag } from "./launch.js";
+import { captureDevtoolsError, initDevtoolsTelemetry } from "./telemetry.js";
 export async function launchCi(argv) {
     const { explicit, rest } = stripTierFlag(argv);
+    // See `launch.ts`'s matching call: early, so tier resolution and env entry
+    // are covered too. Same tag `ci.ts`'s `main()` would compute.
+    initDevtoolsTelemetry(rest.slice(0, 2).join(" ") || "help");
     const envLoad = await loadEnvLoad();
     const envSession = await loadEnvSession();
     const resolution = await envSession.resolveSessionTier({
@@ -70,11 +74,7 @@ export async function launchCi(argv) {
     }
     catch (err) {
         process.stderr.write(`devtools-ci: ${err instanceof Error ? err.message : String(err)}\n`);
-        // Report BEFORE exiting — see `captureDevtoolsError`'s header. `ci.ts`'s
-        // own `main()` already initialized telemetry (it does so at its own
-        // bootstrap, before this throw could happen), so this call only needs to
-        // capture and flush.
-        const { captureDevtoolsError } = await import("./telemetry.js");
+        // Report BEFORE exiting — see `captureDevtoolsError`'s header.
         await captureDevtoolsError(err);
         process.exit(1);
     }

package/dist/launch.d.ts

@@ -8,7 +8,8 @@ export declare function stripTierFlag(argv: readonly string[]): {
     rest: string[];
 };
 /**
- * Resolves the session's deploy tier, enters it, and hands off to `cli.ts`.
+ * Resolves the session's deploy tier, enters it (or defers entry to the
+ * menu — see this file's header), and hands off to `cli.ts`.
  *
  * Exits the process directly on a refusal from `resolveSessionTier` — there
  * is no command dispatched yet for a caller to fall back to, so there is