@devdogsuga/devtools 0.1.21 → 0.1.23

package/dist/bws/pace.d.ts

@@ -21,7 +21,5 @@
 export type CallKind = "read" | "write";
 export declare const WRITE_GAP_MS = 1100;
 export declare const READ_GAP_MS = 350;
-export interface Pacer {
-    (kind: CallKind): Promise<void>;
-}
+export type Pacer = (kind: CallKind) => Promise<void>;
 export declare function makePacer(now?: () => number, sleep?: (ms: number) => Promise<void>): Pacer;

package/dist/bws/pace.js

@@ -37,7 +37,7 @@ export function makePacer(now = Date.now, sleep = wait) {
         });
         // The chain never rejects: a pacer that fails closed would wedge every
         // later call behind a rejection that had nothing to do with them.
-        chain = turn.catch(() => { });
+        chain = turn.catch(() => undefined);
         return turn;
     };
 }

package/dist/bws/token.js

@@ -18,7 +18,7 @@ import { unwrap } from "../ui.js";
 export class NoAccessTokenError extends Error {
 }
 export async function resolveToken(sources) {
-    const announce = sources.onSource ?? (() => { });
+    const announce = sources.onSource ?? (() => undefined);
     // Explicit beats ambient. Someone who passes the flag while an environment
     // variable is set is overriding on purpose, and silently ignoring them would
     // point the command at the account they were trying to avoid.

package/dist/bws/vault.js

@@ -40,9 +40,8 @@ export async function vaultStatus() {
         // `--response` wraps the payload; the bare form is also accepted, so read
         // whichever shape came back rather than depending on one.
         const parsed = JSON.parse(stdout);
-        const status = ("status" in parsed && parsed.status) ||
-            ("data" in parsed && parsed.data?.template?.status) ||
-            undefined;
+        const status = ("status" in parsed ? parsed.status : undefined) ??
+            ("data" in parsed ? parsed.data?.template?.status : undefined);
         if (status === "unlocked")
             return "unlocked";
         if (status === "locked")

package/dist/cli.js

@@ -45,7 +45,7 @@ import { loadEnv } from "./repo/peers.js";
 import { setExplicitAccessToken } from "./bws/client.js";
 import { positionals } from "./args.js";
 import { resolveVaultTarget } from "./pick.js";
-import { bail, errorMessage, explain, explainError, renderChecks, unwrap } from "./ui.js";
+import { bail, errorMessage, explain, explainError, renderChecks, unwrap, } from "./ui.js";
 import { helpPath, renderHelp } from "./help.js";
 import { subcommandList, subcommandNames } from "./commands.js";
 import { bareGroupStartPath, runMenu } from "./menu.js";
@@ -597,7 +597,9 @@ async function runDbCommand(rest) {
         return;
     }
     if (sub === "types") {
-        const connection = await resolveDbConnection({ label: "devtools db types" });
+        const connection = await resolveDbConnection({
+            label: "devtools db types",
+        });
         if (!connection) {
             process.exitCode = 1;
             return;

package/dist/commands.js

@@ -677,7 +677,7 @@ const DECLARED_GROUPS = [
                     {
                         flag: "--base-url",
                         value: "<url>",
-                        summary: "DevDogs API URL for \"Paste credentials instead\". Defaults to https://api.devdogsuga.org.",
+                        summary: 'DevDogs API URL for "Paste credentials instead". Defaults to https://api.devdogsuga.org.',
                     },
                     {
                         flag: "--platform-url",

package/dist/cron/discovery.js

@@ -8,7 +8,7 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
-import { parseConfigFileTextToJson } from "typescript";
+import { flattenDiagnosticMessageText, parseConfigFileTextToJson, } from "typescript";
 import { findRepoRoot } from "../repo/root.js";
 import { CronRoutes, WorkflowCrons, } from "./schema.js";
 export const CRON_TIERS = ["development", "staging", "production"];
@@ -19,7 +19,7 @@ export function isCronTier(value) {
 export function parseWrangler(path) {
     const result = parseConfigFileTextToJson(path, readFileSync(path, "utf8"));
     if (result.error) {
-        throw new Error(`${path}: ${result.error.messageText}`);
+        throw new Error(`${path}: ${flattenDiagnosticMessageText(result.error.messageText, "\n")}`);
     }
     return result.config;
 }
@@ -57,7 +57,7 @@ export async function discoverCronMaps() {
         const scheduledPath = join(findRepoRoot(), "apps", app, "cloudflare", "scheduled.ts");
         if (!existsSync(scheduledPath))
             continue;
-        const mod = await import(pathToFileURL(scheduledPath).href);
+        const mod = (await import(pathToFileURL(scheduledPath).href));
         const parsed = CronRoutes.safeParse(mod.CRON_ROUTES);
         if (!parsed.success) {
             throw new Error(`${scheduledPath}: CRON_ROUTES does not match the required shape.\n` +

package/dist/db/new-migration.js

@@ -42,7 +42,10 @@ export function migrationName(appSlug, description) {
 async function pickApp() {
     return unwrap(await select({
         message: "Whose schema is this migration for?",
-        options: Object.keys(APP_SCHEMAS).map((value) => ({ value, label: value })),
+        options: Object.keys(APP_SCHEMAS).map((value) => ({
+            value,
+            label: value,
+        })),
     }));
 }
 export async function runNewMigration(appArg, descriptionArg) {

package/dist/db/seed-roles.js

@@ -13,7 +13,9 @@ import { supabase } from "./run.js";
 // top-level `const`, which broke `--help`/`setup` outside a repo — see
 // `workers.ts`'s header for the general pattern this follows).
 function seedFiles() {
-    return [join(findRepoRoot(), "supabase", "seed", "production", "01_roles.sql")];
+    return [
+        join(findRepoRoot(), "supabase", "seed", "production", "01_roles.sql"),
+    ];
 }
 /**
  * Always `--db-url` — the session's own connection string, never the

package/dist/deploy/secrets-file.js

@@ -83,15 +83,14 @@ export async function runDeploySecretsFile(options) {
         if (!declaredBy(entries, app))
             continue;
         const meta = entries[0].meta;
-        // Public server keys ship alongside the secrets, because nothing else
-        // reaches the Worker's runtime: OpenNext copies the Worker env into
-        // process.env per request, and a value that was only in the composed
-        // .env file at build time is gone by then. The first staging deploy
-        // proved it: the schedule-builder Worker booted without API_URL,
-        // REST_URL, PUBLISHABLE_KEY, STORAGE_S3_URL or S3_PROTOCOL_REGION and
-        // answered 500 on every route. Client (NEXT_PUBLIC) keys are excluded
-        // by `declaredBy` (inlined at build); never-store keys stay excluded
-        // because a Worker secret is a remote copy, the thing they forbid.
+        // Public server keys ship alongside the secrets because a value that was
+        // only in the composed .env file at build time is absent from the deployed
+        // Worker's runtime environment. The first staging deploy proved it: the
+        // schedule-builder Worker booted without API_URL, REST_URL,
+        // PUBLISHABLE_KEY, STORAGE_S3_URL or S3_PROTOCOL_REGION and answered 500
+        // on every route. Client (NEXT_PUBLIC) keys are excluded by `declaredBy`
+        // (inlined at build); never-store keys stay excluded because a Worker
+        // secret is a remote copy, the thing they forbid.
         if (meta.secrecy === "secret") {
             if (!storable.has(key)) {
                 minted.push(key);

package/dist/deploy/write-env.js

@@ -237,7 +237,9 @@ function compose(options, env) {
     }
     const ghSecrets = readContext("DEPLOY_GITHUB_SECRETS", env);
     const ghVars = readContext("DEPLOY_GITHUB_VARS", env);
-    const smuggled = getEnvSync().neverStoreKeys().filter((k) => k in ghSecrets || k in ghVars);
+    const smuggled = getEnvSync()
+        .neverStoreKeys()
+        .filter((k) => k in ghSecrets || k in ghVars);
     if (smuggled.length > 0) {
         throw new DeployError(`${smuggled.join(", ")} must never be a GitHub secret or variable.`, [
             "Delete it from the repository and the environment, then rotate it.",

package/dist/env/audit.js

@@ -136,7 +136,7 @@ export function audit(input) {
         // variable store is an orphan from a rename, reported as one below.
         // Calling it a leaked secret would be a guess, and a loud wrong one. With
         // no declared set there is no way to tell the two apart, so neither fires.
-        if (input.declared === undefined || !input.declared.has(copy.name))
+        if (!input.declared?.has(copy.name))
             continue;
         findings.push({
             key: copy.name,
@@ -174,7 +174,7 @@ export function audit(input) {
                 "exactly like this report. Run `gh variable list` by hand",
         });
     }
-    const repositoryNames = repository !== undefined && repository.readable ? repository.names : [];
+    const repositoryNames = repository?.readable ? repository.names : [];
     for (const name of repositoryNames) {
         // Membership in `variables` IS the declaration test for this branch, since
         // the set comes from the registry, which is why it does not also consult
@@ -213,7 +213,7 @@ export function audit(input) {
         // variable, and calling that a leaked secret would be a loud guess.
         if (ignore.has(name))
             continue;
-        if (input.declared === undefined || !input.declared.has(name))
+        if (!input.declared?.has(name))
             continue;
         findings.push({
             key: name,

package/dist/env/commands.js

@@ -491,12 +491,13 @@ export async function runEnvAudit(options) {
         };
     }
     catch (err) {
+        const firstLine = errorMessage(err).split("\n")[0]?.trim() ?? "";
         repositoryVariables = {
             readable: false,
             // The FIRST line only. `describe()` in the gh client returns a paragraph
             // of guidance, and a finding is one line. The rest is reproducible by
             // running the command the finding names.
-            reason: errorMessage(err).split("\n")[0]?.trim() || "`gh` failed",
+            reason: firstLine || "`gh` failed",
         };
     }
     const { secrets: cloudflare, unreadable } = await listWorkerSecrets(target);

package/dist/env/example.js

@@ -190,7 +190,9 @@ function derivedValue(meta, routed) {
     const derivation = getEnvSync().derivationOf(meta);
     if (derivation === null)
         return "";
-    return getEnvSync().envReferences(derivation).every((ref) => routed.has(ref))
+    return getEnvSync()
+        .envReferences(derivation)
+        .every((ref) => routed.has(ref))
         ? derivation
         : "";
 }

package/dist/env/selection.js

@@ -53,7 +53,9 @@ export function pushableVariables() {
 export function ignoredFor(target) {
     assertRegistryLoaded();
     const pushable = pushableVariables();
-    const skip = new Set(getEnvSync().neverSecretKeys().filter((key) => !pushable.has(key)));
+    const skip = new Set(getEnvSync()
+        .neverSecretKeys()
+        .filter((key) => !pushable.has(key)));
     for (const key of getEnvSync().mintedKeys())
         skip.add(key);
     if (target !== "production") {

package/dist/environment-doctor.d.ts

@@ -12,9 +12,9 @@ export interface DoctorCheck {
  * pins 24, which is what a `fnm use` picks up; a machine below the floor is
  * a WARN, not an error — plenty of contributors' shells still resolve an
  * old global `node` first. */
-export declare function checkNodeVersion(nodeVersion: string, app: string): DoctorCheck;
-export declare function checkFnmHookPresent(shellProfile: string | null, app: string): DoctorCheck;
-export declare function checkPnpmVersion(pnpmVersion: string | null, pinned: string, app: string): DoctorCheck;
+export declare function checkNodeVersion(nodeVersion: string): DoctorCheck;
+export declare function checkFnmHookPresent(shellProfile: string | null): DoctorCheck;
+export declare function checkPnpmVersion(pnpmVersion: string | null, pinned: string): DoctorCheck;
 /** `git config core.autocrlf` — `input` or `false` is correct on every
  * platform this repo documents (WSL2, native Windows, macOS, Linux); `true`
  * rewrites LF to CRLF on checkout and breaks anything that shells out to a

package/dist/environment-doctor.js

@@ -26,7 +26,11 @@ import { log, note } from "@clack/prompts";
 import { parse as parseDotenv } from "dotenv";
 import { discoverRepoRoot } from "./repo/root.js";
 import { validateSessionPoolerUrl } from "./db/pooler.js";
-const TROUBLESHOOTING_APPS = ["schedule-builder", "study-group-finder", "platform"];
+const TROUBLESHOOTING_APPS = [
+    "schedule-builder",
+    "study-group-finder",
+    "platform",
+];
 function faqUrl(app, id) {
     return `https://devdogsuga.org/docs/${app}/getting-started/troubleshooting#${id}`;
 }
@@ -35,7 +39,7 @@ function faqUrl(app, id) {
  * pins 24, which is what a `fnm use` picks up; a machine below the floor is
  * a WARN, not an error — plenty of contributors' shells still resolve an
  * old global `node` first. */
-export function checkNodeVersion(nodeVersion, app) {
+export function checkNodeVersion(nodeVersion) {
     const [major = 0, minor = 0] = nodeVersion.split(".").map(Number);
     const ok = major > 22 || (major === 22 && minor >= 12);
     return {
@@ -50,8 +54,9 @@ export function checkNodeVersion(nodeVersion, app) {
         faqId: ok ? undefined : "node-version",
     };
 }
-export function checkFnmHookPresent(shellProfile, app) {
-    const present = Boolean(shellProfile?.includes("fnm env") || shellProfile?.includes("fnm_env"));
+export function checkFnmHookPresent(shellProfile) {
+    const present = shellProfile !== null &&
+        (shellProfile.includes("fnm env") || shellProfile.includes("fnm_env"));
     return {
         id: "fnm-not-found",
         status: present ? "ok" : "warn",
@@ -64,13 +69,13 @@ export function checkFnmHookPresent(shellProfile, app) {
         faqId: present ? undefined : "fnm-not-found",
     };
 }
-export function checkPnpmVersion(pnpmVersion, pinned, app) {
+export function checkPnpmVersion(pnpmVersion, pinned) {
     if (!pnpmVersion) {
         return {
             id: "pnpm-missing",
             status: "warn",
             summary: "pnpm is not on PATH",
-            fix: '`npm install -g pnpm` (never `corepack enable` — this repo does not use corepack).',
+            fix: "`npm install -g pnpm` (never `corepack enable` — this repo does not use corepack).",
             faqId: "pnpm-missing",
         };
     }
@@ -206,7 +211,12 @@ function readShellProfile() {
     const home = process.env.HOME;
     if (!home)
         return null;
-    for (const file of [".bashrc", ".zshrc", ".config/fish/config.fish", ".bash_profile"]) {
+    for (const file of [
+        ".bashrc",
+        ".zshrc",
+        ".config/fish/config.fish",
+        ".bash_profile",
+    ]) {
         const path = join(home, file);
         if (existsSync(path)) {
             try {
@@ -234,13 +244,13 @@ export async function runEnvironmentDoctor(opts) {
     const app = opts.app && TROUBLESHOOTING_APPS.includes(opts.app) ? opts.app : "platform";
     const repoRoot = discoverRepoRoot();
     const checks = [];
-    const nodeCheck = checkNodeVersion(process.versions.node, app);
+    const nodeCheck = checkNodeVersion(process.versions.node);
     checks.push(nodeCheck);
     // Only worth raising when Node is wrong: nvm, Volta or a system Node that
     // already satisfies the floor is fine, and flagging a missing fnm hook there
     // is a false alarm.
     if (nodeCheck.status !== "ok") {
-        checks.push(checkFnmHookPresent(readShellProfile(), app));
+        checks.push(checkFnmHookPresent(readShellProfile()));
     }
     else {
         const pinnedMajor = repoRoot ? readNvmrc(repoRoot)?.split(".")[0] : null;
@@ -258,14 +268,14 @@ export async function runEnvironmentDoctor(opts) {
     const pnpmVersion = has("pnpm", ["--version"]);
     const pin = repoRoot ? readPackageManagerPin(repoRoot) : null;
     checks.push(pin
-        ? checkPnpmVersion(pnpmVersion, pin, app)
+        ? checkPnpmVersion(pnpmVersion, pin)
         : {
             id: "pnpm-version",
             status: pnpmVersion ? "ok" : "warn",
             summary: pnpmVersion ? `pnpm ${pnpmVersion}` : "pnpm is not on PATH",
             fix: pnpmVersion
                 ? undefined
-                : '`npm install -g pnpm` (never `corepack enable`).',
+                : "`npm install -g pnpm` (never `corepack enable`).",
             faqId: pnpmVersion ? undefined : "pnpm-missing",
         });
     checks.push(checkAutocrlf(gitConfig("core.autocrlf")));
@@ -281,7 +291,9 @@ export async function runEnvironmentDoctor(opts) {
         checks.push({
             id: "docker-not-running",
             status: dockerUp ? "ok" : "warn",
-            summary: dockerUp ? "Docker is running" : "Docker daemon is not answering",
+            summary: dockerUp
+                ? "Docker is running"
+                : "Docker daemon is not answering",
             fix: dockerUp
                 ? undefined
                 : "Start Docker Desktop, or Docker Engine in WSL2. Never Colima.",
@@ -294,7 +306,9 @@ export async function runEnvironmentDoctor(opts) {
             id: "flutter-missing",
             status: flutter ? "ok" : "skip",
             summary: flutter ? "Flutter is installed" : "Flutter is not installed",
-            fix: flutter ? undefined : "Install the Flutter SDK for study-group-finder.",
+            fix: flutter
+                ? undefined
+                : "Install the Flutter SDK for study-group-finder.",
             faqId: flutter ? undefined : "flutter-missing",
         });
         if (flutter) {
@@ -322,7 +336,9 @@ export async function runEnvironmentDoctor(opts) {
         checks.push(checkEnvKeysPresent(env, ["API_URL", "PUBLISHABLE_KEY"]));
     }
     // ── Hosted checks — only when .env looks like a hosted project ───────────
-    const isHosted = Boolean(env.API_URL && !env.API_URL.includes("127.0.0.1") && !env.API_URL.includes("localhost"));
+    const isHosted = Boolean(env.API_URL &&
+        !env.API_URL.includes("127.0.0.1") &&
+        !env.API_URL.includes("localhost"));
     if (isHosted && env.API_URL) {
         let reachable = false;
         let probeStatus = null;
@@ -360,7 +376,10 @@ export async function runEnvironmentDoctor(opts) {
             let keysValid = false;
             try {
                 const res = await fetch(`${env.API_URL}/auth/v1/admin/users?page=1&per_page=1`, {
-                    headers: { Authorization: `Bearer ${env.SECRET_KEY}`, apikey: env.SECRET_KEY },
+                    headers: {
+                        Authorization: `Bearer ${env.SECRET_KEY}`,
+                        apikey: env.SECRET_KEY,
+                    },
                     signal: AbortSignal.timeout(5000),
                 });
                 keysValid = res.status !== 401 && res.status !== 403;
@@ -371,7 +390,9 @@ export async function runEnvironmentDoctor(opts) {
             checks.push({
                 id: "supabase-keys-invalid",
                 status: keysValid ? "ok" : "warn",
-                summary: keysValid ? "SECRET_KEY is accepted" : "SECRET_KEY was rejected",
+                summary: keysValid
+                    ? "SECRET_KEY is accepted"
+                    : "SECRET_KEY was rejected",
                 fix: keysValid
                     ? undefined
                     : "Copy the service_role secret key again from Project Settings -> API.",

package/dist/environment.js

@@ -86,7 +86,9 @@ function run(file, args) {
  * which reads the session's already-entered env at the moment it matters.
  */
 export function probeEnvironment(execute = run) {
-    const envFile = existsSync(join(findRepoRoot(), ".env")) ? "yes" : "no";
+    const envFile = existsSync(join(findRepoRoot(), ".env"))
+        ? "yes"
+        : "no";
     // `docker info` rather than `docker version`: version answers from the
     // client alone, so it reports success against a daemon that is not running.
     const docker = execute("docker", ["info"]) === null ? "no" : "yes";

package/dist/gen/hypno.js

@@ -55,7 +55,7 @@ async function loadChromium() {
         join(findRepoRoot(), "node_modules/.pnpm/playwright@1.62.1/node_modules/playwright"),
     ]) {
         try {
-            const mod = await import(require_.resolve(spec));
+            const mod = (await import(require_.resolve(spec)));
             const chromium = mod.chromium ?? mod.default?.chromium;
             if (chromium)
                 return chromium;

package/dist/gh/client.js

@@ -107,7 +107,8 @@ function describe(err) {
             "burst of pushes can trip the secondary limit — wait a minute and " +
             "re-run; already-written values are simply overwritten with themselves.");
     }
-    return stderr || e.message || "gh failed with no output.";
+    const message = e.message ?? "";
+    return stderr || message || "gh failed with no output.";
 }
 /** Environment secret names and when each last changed. Never values. */
 export async function listSecrets(environment) {

package/dist/gh/rulesets/actors.js

@@ -17,7 +17,8 @@ const run = promisify(execFile);
 function describe(err) {
     const e = err;
     const stderr = (e.stderr ?? "").trim();
-    return stderr || e.message || "gh failed with no output.";
+    const message = e.message ?? "";
+    return stderr || message || "gh failed with no output.";
 }
 /** `GET /orgs/{org}/teams/{slug}` -> the team's numeric id. */
 export async function resolveTeamId(org, slug) {

package/dist/gh/rulesets/api.js

@@ -24,7 +24,8 @@ export class GhRulesetsError extends Error {
 function describe(err) {
     const e = err;
     const stderr = (e.stderr ?? "").trim();
-    return stderr || e.message || "gh failed with no output.";
+    const message = e.message ?? "";
+    return stderr || message || "gh failed with no output.";
 }
 function path(r, suffix = "") {
     return `repos/${r.owner}/${r.repo}/rulesets${suffix}`;
@@ -36,7 +37,9 @@ export async function listRulesets(r) {
             maxBuffer: MAX_BUFFER,
             shell: false,
         });
-        return stdout.trim() === "" ? [] : JSON.parse(stdout);
+        return stdout.trim() === ""
+            ? []
+            : JSON.parse(stdout);
     }
     catch (err) {
         throw new GhRulesetsError(describe(err));

package/dist/gh/rulesets/desired.js

@@ -48,7 +48,11 @@ export function buildDesiredRulesets(actors) {
             // side of a `main` push, so `always` (not `pull_request`-only) is the
             // right bypass mode here.
             bypass_actors: [
-                { actor_id: actors.devopsTeamId, actor_type: "Team", bypass_mode: "always" },
+                {
+                    actor_id: actors.devopsTeamId,
+                    actor_type: "Team",
+                    bypass_mode: "always",
+                },
             ],
             rules: [
                 { type: "deletion" },
@@ -161,7 +165,11 @@ export function buildDesiredRulesets(actors) {
                 },
             },
             bypass_actors: [
-                { actor_id: actors.devopsTeamId, actor_type: "Team", bypass_mode: "always" },
+                {
+                    actor_id: actors.devopsTeamId,
+                    actor_type: "Team",
+                    bypass_mode: "always",
+                },
                 // Renovate (TASK-299) creates and updates `renovate/*` branches for
                 // its dependency-update PRs — an ordinary bot workflow, not a hole,
                 // so it bypasses the same way the platform App bypasses `team/**`.
@@ -215,8 +223,16 @@ export function buildDesiredRulesets(actors) {
                 ref_name: { include: ["refs/heads/team/**"], exclude: [] },
             },
             bypass_actors: [
-                { actor_id: actors.appId, actor_type: "Integration", bypass_mode: "always" },
-                { actor_id: actors.devopsTeamId, actor_type: "Team", bypass_mode: "always" },
+                {
+                    actor_id: actors.appId,
+                    actor_type: "Integration",
+                    bypass_mode: "always",
+                },
+                {
+                    actor_id: actors.devopsTeamId,
+                    actor_type: "Team",
+                    bypass_mode: "always",
+                },
             ],
             rules: [
                 { type: "creation" },
@@ -238,8 +254,16 @@ export function buildDesiredRulesets(actors) {
                 ref_name: { include: ["refs/tags/**"], exclude: [] },
             },
             bypass_actors: [
-                { actor_id: actors.adminsTeamId, actor_type: "Team", bypass_mode: "always" },
-                { actor_id: actors.devopsTeamId, actor_type: "Team", bypass_mode: "always" },
+                {
+                    actor_id: actors.adminsTeamId,
+                    actor_type: "Team",
+                    bypass_mode: "always",
+                },
+                {
+                    actor_id: actors.devopsTeamId,
+                    actor_type: "Team",
+                    bypass_mode: "always",
+                },
             ],
             rules: [{ type: "creation" }, { type: "update" }, { type: "deletion" }],
         },

package/dist/gh/rulesets/diff.js

@@ -164,5 +164,7 @@ export function planRulesets(liveSummaries, liveDetails, actors, desiredRulesets
 }
 /** Whether a plan would write anything at all. */
 export function planHasChanges(plan) {
-    return (plan.creates.length > 0 || plan.updates.length > 0 || plan.deletes.length > 0);
+    return (plan.creates.length > 0 ||
+        plan.updates.length > 0 ||
+        plan.deletes.length > 0);
 }

package/dist/gh/settings/api.js

@@ -22,7 +22,8 @@ export class GhSettingsError extends Error {
 function describe(err) {
     const e = err;
     const stderr = (e.stderr ?? "").trim();
-    return stderr || e.message || "gh failed with no output.";
+    const message = e.message ?? "";
+    return stderr || message || "gh failed with no output.";
 }
 function repoPath(r, suffix = "") {
     return `repos/${r.owner}/${r.repo}${suffix}`;
@@ -50,7 +51,10 @@ async function writeJson(method, apiPath, body) {
         const args = body === undefined
             ? ["api", apiPath, "-X", method]
             : ["api", apiPath, "-X", method, "--input", "-"];
-        const child = spawn("gh", args, { stdio: ["pipe", "pipe", "pipe"], shell: false });
+        const child = spawn("gh", args, {
+            stdio: ["pipe", "pipe", "pipe"],
+            shell: false,
+        });
         let stdout = "";
         let stderr = "";
         child.stdout.on("data", (c) => (stdout += c.toString()));
@@ -129,7 +133,11 @@ export async function getSelectedActions(r) {
     catch (err) {
         if (err instanceof GhSettingsError &&
             (/\b409\b/.test(err.message) || /\(conflict\)/i.test(err.message))) {
-            return { github_owned_allowed: false, verified_allowed: false, patterns_allowed: [] };
+            return {
+                github_owned_allowed: false,
+                verified_allowed: false,
+                patterns_allowed: [],
+            };
         }
         throw err;
     }

package/dist/gh/settings/commands.js

@@ -16,7 +16,7 @@ import { confirm } from "@clack/prompts";
 import { addDeploymentBranchPolicy, deleteDeploymentBranchPolicy, getActionsPermissions, getAutomatedSecurityFixes, getDeploymentBranchPolicies, getEnvironment, getRepo, getSelectedActions, getVulnerabilityAlertsEnabled, getWorkflowPermissions, patchSecurityAndAnalysis, setActionsPermissions, setAutomatedSecurityFixesEnabled, setDeploymentBranchPolicyMode, setSelectedActions, setVulnerabilityAlertsEnabled, setWorkflowPermissions, } from "./api.js";
 import { buildDesiredSettings } from "./desired.js";
 import { planHasFixableChanges, planSettings, } from "./diff.js";
-import { collectActionUses, computeActionPatterns, unpinnedActionUses } from "./workflows.js";
+import { collectActionUses, computeActionPatterns, unpinnedActionUses, } from "./workflows.js";
 import { findRepoRoot } from "../../repo/root.js";
 import { unwrap } from "../../ui.js";
 const DEFAULT_ORG = "DevDogsUGA";
@@ -113,16 +113,22 @@ async function confirmApply(yes) {
  * `PUT .../actions/permissions`) are written together, once.
  */
 async function applyPlan(r, desired, live, plan) {
-    const drift = new Set(plan.checks.filter((c) => c.status === "drift" && c.fixable).map((c) => c.key));
+    const drift = new Set(plan.checks
+        .filter((c) => c.status === "drift" && c.fixable)
+        .map((c) => c.key));
     const secretScanningFields = {};
     if (drift.has("security_and_analysis.secret_scanning")) {
         secretScanningFields.secret_scanning = {
-            status: desired.securityAndAnalysis.secretScanning ? "enabled" : "disabled",
+            status: desired.securityAndAnalysis.secretScanning
+                ? "enabled"
+                : "disabled",
         };
     }
     if (drift.has("security_and_analysis.secret_scanning_push_protection")) {
         secretScanningFields.secret_scanning_push_protection = {
-            status: desired.securityAndAnalysis.secretScanningPushProtection ? "enabled" : "disabled",
+            status: desired.securityAndAnalysis.secretScanningPushProtection
+                ? "enabled"
+                : "disabled",
         };
     }
     if (drift.has("security_and_analysis.secret_scanning_non_provider_patterns")) {
@@ -134,7 +140,9 @@ async function applyPlan(r, desired, live, plan) {
     }
     if (drift.has("security_and_analysis.secret_scanning_validity_checks")) {
         secretScanningFields.secret_scanning_validity_checks = {
-            status: desired.securityAndAnalysis.secretScanningValidityChecks ? "enabled" : "disabled",
+            status: desired.securityAndAnalysis.secretScanningValidityChecks
+                ? "enabled"
+                : "disabled",
         };
     }
     if (Object.keys(secretScanningFields).length > 0) {
@@ -146,7 +154,8 @@ async function applyPlan(r, desired, live, plan) {
     if (drift.has("dependabot_security_updates")) {
         await setAutomatedSecurityFixesEnabled(r, desired.dependabotSecurityUpdates);
     }
-    if (drift.has("actions.sha_pinning_required") || drift.has("actions.allowed_actions")) {
+    if (drift.has("actions.sha_pinning_required") ||
+        drift.has("actions.allowed_actions")) {
         await setActionsPermissions(r, {
             enabled: live.actionsPermissions.enabled,
             allowed_actions: drift.has("actions.allowed_actions")

package/dist/gh/settings/desired.js

@@ -28,7 +28,11 @@ export function buildDesiredSettings(actionPatterns) {
         },
         environments: [
             { name: "staging", allowedBranches: ["main"], requireReviewers: false },
-            { name: "production", allowedBranches: ["production"], requireReviewers: false },
+            {
+                name: "production",
+                allowedBranches: ["production"],
+                requireReviewers: false,
+            },
             {
                 name: "production-apply",
                 allowedBranches: ["production"],

package/dist/gh/settings/diff.js

@@ -81,7 +81,8 @@ export function planSettings(desired, live, unpinnedActions) {
             : "drift",
         fixable: true,
     });
-    const patternsMatch = live.selectedActions.github_owned_allowed === desired.actions.githubOwnedAllowed &&
+    const patternsMatch = live.selectedActions.github_owned_allowed ===
+        desired.actions.githubOwnedAllowed &&
         live.selectedActions.verified_allowed === desired.actions.verifiedAllowed &&
         sameSet(live.selectedActions.patterns_allowed, desired.actions.patterns);
     checks.push({
@@ -118,21 +119,25 @@ export function planSettings(desired, live, unpinnedActions) {
             continue;
         }
         const liveBranches = snapshot.branchPolicies.map((p) => p.name);
-        const branchesMatch = snapshot.environment.deployment_branch_policy?.custom_branch_policies === true &&
-            snapshot.environment.deployment_branch_policy?.protected_branches === false &&
+        const branchesMatch = snapshot.environment.deployment_branch_policy?.custom_branch_policies ===
+            true &&
+            snapshot.environment.deployment_branch_policy?.protected_branches ===
+                false &&
             sameSet(liveBranches, env.allowedBranches);
         checks.push({
             key: `environments.${env.name}.branch_policy`,
             description: `Environment "${env.name}" deployment branch policy`,
             desired: [...env.allowedBranches].sort().join(", "),
             live: snapshot.environment.deployment_branch_policy
-                ? [...liveBranches].sort().join(", ") || "(no branch restriction — all branches allowed)"
+                ? [...liveBranches].sort().join(", ") ||
+                    "(no branch restriction — all branches allowed)"
                 : "(no deployment branch policy configured)",
             status: branchesMatch ? "ok" : "drift",
             fixable: true,
         });
         if (env.requireReviewers) {
-            const hasReviewers = (snapshot.environment.protection_rules ?? []).some((rule) => rule.type === "required_reviewers" && (rule.reviewers?.length ?? 0) > 0);
+            const hasReviewers = (snapshot.environment.protection_rules ?? []).some((rule) => rule.type === "required_reviewers" &&
+                (rule.reviewers?.length ?? 0) > 0);
             checks.push({
                 key: `environments.${env.name}.required_reviewers`,
                 description: `Environment "${env.name}" required reviewers`,

package/dist/gh/settings/workflows.js

@@ -82,7 +82,11 @@ export function parseUsesLines(file, contents) {
         }
         out.push({
             raw: value,
-            ref: { owner: spec.slice(0, slash), repo: spec.slice(slash + 1), version },
+            ref: {
+                owner: spec.slice(0, slash),
+                repo: spec.slice(slash + 1),
+                version,
+            },
             file,
             line: i + 1,
         });

package/dist/images/commands.js

@@ -104,7 +104,10 @@ async function loadEvents(patterns, deps) {
             throw err;
         return { graphics: [], skipped: errorMessage(err) };
     }
-    return { graphics: eventGraphics(await loadOpenGraph(), meetings), skipped: null };
+    return {
+        graphics: eventGraphics(await loadOpenGraph(), meetings),
+        skipped: null,
+    };
 }
 /** Where one selection is written. */
 export function destinationOf({ graphic, format }, out) {
@@ -183,13 +186,12 @@ async function images(options, deps) {
     if (selections.length === 0)
         throw new UsageError("Nothing to render.");
     // ── Where ─────────────────────────────────────────────────────────────────
+    // An empty `--out` counts as absent, exactly as the old truthiness test did.
+    const explicitOut = options.out === "" ? undefined : options.out;
     const out = options.defaultOut
         ? undefined
-        : options.out
-            ? options.out
-            : options.noOutput
-                ? undefined
-                : await pickOutput(graphics);
+        : (explicitOut ??
+            (options.noOutput ? undefined : await pickOutput(graphics)));
     if (skipped)
         log.warn(`event graphics skipped — ${skipped}`);
     if (options.noOutput) {

package/dist/images/render.js

@@ -37,7 +37,11 @@ async function satoriFonts() {
     })));
 }
 export async function render(element, { width, height, scale = 1 }) {
-    const svg = await satori(element, { width, height, fonts: await satoriFonts() });
+    const svg = await satori(element, {
+        width,
+        height,
+        fonts: await satoriFonts(),
+    });
     const png = new Resvg(svg, {
         fitTo: { mode: "width", value: Math.round(width * scale) },
         // Satori has already turned every glyph into a path, so resvg never needs

package/dist/launch-ci.js

@@ -54,7 +54,9 @@ export async function launchCi(argv) {
     }
     const tier = resolution.tier;
     try {
-        const entered = await envSession.enterEnvironment(tier, { override: false });
+        const entered = await envSession.enterEnvironment(tier, {
+            override: false,
+        });
         for (const warning of entered.warnings) {
             process.stderr.write(`devtools-ci: ${warning}\n`);
         }

package/dist/launch.js

@@ -52,7 +52,7 @@ import { select } from "@clack/prompts";
 import { findCommand } from "./commands.js";
 import { enterSessionEnvironment, realEnvEntryDeps, setMenuEnvHook, } from "./env-entry.js";
 import { bareGroupStartPath } from "./menu.js";
-import { discoverRepoRoot, findRepoRoot, RepoNotFoundError } from "./repo/root.js";
+import { discoverRepoRoot, findRepoRoot, RepoNotFoundError, } from "./repo/root.js";
 import { loadEnvLoad, loadEnvSession } from "./repo/peers.js";
 import { captureDevtoolsError, initDevtoolsTelemetry } from "./telemetry.js";
 import { ignoreClosedPipes } from "./pipes.js";
@@ -188,12 +188,12 @@ export async function launch(argv) {
     // holds this session's entered values, not the outer shell's, and
     // recomputing from it would misclassify every one of them as a genuine
     // shell export — the exact bug this marker exists to prevent, one layer in.
-    if (process.env[envLoad.SHELL_KEYS_ENV] === undefined) {
-        process.env[envLoad.SHELL_KEYS_ENV] = Object.keys(process.env).join(",");
-    }
+    process.env[envLoad.SHELL_KEYS_ENV] ??= Object.keys(process.env).join(",");
     let tier;
     let devDatabase;
-    if (rest[0] === "setup" || rest[0] === "completions" || isEnvFreeCommand(rest)) {
+    if (rest[0] === "setup" ||
+        rest[0] === "completions" ||
+        isEnvFreeCommand(rest)) {
         // Two commands run BEFORE there is a tier to resolve, and forcing the
         // mandate on them breaks each in its own way:
         //
@@ -246,7 +246,9 @@ export async function launch(argv) {
         const remoteCandidate = couldBeBareDevelopment
             ? await envSession.developmentRemoteCandidate(findRepoRoot())
             : undefined;
-        const localStackOnline = typeof remoteCandidate === "string" ? await envLoad.probeLocalStack() : undefined;
+        const localStackOnline = typeof remoteCandidate === "string"
+            ? await envLoad.probeLocalStack()
+            : undefined;
         const resolution = await envSession.resolveSessionTier({
             explicit,
             deployEnv: process.env.DEPLOY_ENV,

package/dist/moderation.js

@@ -25,11 +25,13 @@
 import { adminClient, signedInClient, } from "./instance.js";
 /** Runs `platform.conformance_check()` as the given moderator client. */
 export async function conformance(client, appSlug) {
-    const { data, error } = await client.rpc("conformance_check", {
+    const response = await client.rpc("conformance_check", {
         app_slug: appSlug,
     });
-    if (error)
-        throw new Error(error.message);
+    if (response.error)
+        throw new Error(response.error.message);
+    // The generated types do not describe this function's return shape.
+    const data = response.data;
     return (data ?? []);
 }
 /**

package/dist/oauth/db.js

@@ -35,7 +35,7 @@ export function detectLocalSupabase(cwd) {
             if (first.code === "ENOENT") {
                 throw new Error("supabase CLI not found — install it from https://supabase.com/docs/guides/cli");
             }
-            const stderr = first.stderr?.trim();
+            const stderr = (first.stderr ?? "").trim();
             throw new Error(stderr || (first instanceof Error ? first.message : String(first)));
         }
     }

package/dist/oauth/device.js

@@ -50,7 +50,9 @@ export async function requestDeviceCode({ platformUrl, label, callbackUri, fetch
     if (response.status === 429) {
         const retryAfterSeconds = retryAfterSecondsFrom(response);
         throw new DeviceError("rate_limited", `${url} is rate-limited` +
-            (retryAfterSeconds !== undefined ? ` — retry after ${retryAfterSeconds}s.` : "."), retryAfterSeconds);
+            (retryAfterSeconds !== undefined
+                ? ` — retry after ${retryAfterSeconds}s.`
+                : "."), retryAfterSeconds);
     }
     let body;
     try {
@@ -61,8 +63,12 @@ export async function requestDeviceCode({ platformUrl, label, callbackUri, fetch
     }
     if (!response.ok) {
         const errBody = (body ?? {});
-        const description = typeof errBody.error_description === "string" ? errBody.error_description : undefined;
-        const code = typeof errBody.error === "string" ? errBody.error : `HTTP ${response.status}`;
+        const description = typeof errBody.error_description === "string"
+            ? errBody.error_description
+            : undefined;
+        const code = typeof errBody.error === "string"
+            ? errBody.error
+            : `HTTP ${response.status}`;
         throw new DeviceError("invalid_request", description ? `${code}: ${description}` : code);
     }
     const result = (body ?? {});
@@ -167,7 +173,9 @@ export async function pollForToken({ platformUrl, deviceCode, intervalSeconds, e
         }
         const errBody = (body ?? {});
         const errorCode = typeof errBody.error === "string" ? errBody.error : undefined;
-        const description = typeof errBody.error_description === "string" ? errBody.error_description : undefined;
+        const description = typeof errBody.error_description === "string"
+            ? errBody.error_description
+            : undefined;
         switch (errorCode) {
             case "authorization_pending":
                 continue;

package/dist/oauth/exchange.js

@@ -53,7 +53,9 @@ export async function exchangeCode({ platformUrl, code, codeVerifier, }) {
     }
     if (response.status === 429) {
         const retryAfterHeader = response.headers.get("retry-after");
-        const retryAfterSeconds = retryAfterHeader ? Number(retryAfterHeader) : undefined;
+        const retryAfterSeconds = retryAfterHeader
+            ? Number(retryAfterHeader)
+            : undefined;
         throw new ExchangeError("rate_limited", `${url} is rate-limited` +
             (Number.isFinite(retryAfterSeconds)
                 ? ` — retry after ${retryAfterSeconds}s.`
@@ -69,8 +71,12 @@ export async function exchangeCode({ platformUrl, code, codeVerifier, }) {
     if (!response.ok) {
         const errBody = (body ?? {});
         const kind = errBody.error === "invalid_grant" ? "invalid_grant" : "invalid_request";
-        const description = typeof errBody.error_description === "string" ? errBody.error_description : undefined;
-        const code = typeof errBody.error === "string" ? errBody.error : `HTTP ${response.status}`;
+        const description = typeof errBody.error_description === "string"
+            ? errBody.error_description
+            : undefined;
+        const code = typeof errBody.error === "string"
+            ? errBody.error
+            : `HTTP ${response.status}`;
         throw new ExchangeError(kind, description ? `${code}: ${description}` : code);
     }
     const result = (body ?? {});

package/dist/oauth/loopback.js

@@ -66,7 +66,7 @@ export function verifyState(expected, callback) {
     return callback;
 }
 function renderCallbackPage(heading, body) {
-    return ("<!doctype html><html><head><meta charset=\"utf-8\"><title>DevDogs devtools</title></head>" +
+    return ('<!doctype html><html><head><meta charset="utf-8"><title>DevDogs devtools</title></head>' +
         `<body style="font-family: system-ui, sans-serif; max-width: 32rem; margin: 4rem auto; text-align: center;">` +
         `<h1>${heading}</h1><p>${body}</p></body></html>`);
 }
@@ -96,7 +96,7 @@ export function start(opts = {}) {
         // moments later — this dummy handler exists purely to be that first
         // listener; it does not consume the rejection for real callers, who
         // still get their own `await`/`.catch` on the same promise.
-        result.catch(() => { });
+        result.catch(() => undefined);
         const server = createServer((req, res) => {
             const url = new URL(req.url ?? "/", "http://127.0.0.1");
             if (url.pathname !== "/callback") {
@@ -107,16 +107,22 @@ export function start(opts = {}) {
             const state = url.searchParams.get("state") ?? undefined;
             const error = url.searchParams.get("error");
             if (error) {
-                res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(DENIED_PAGE);
+                res
+                    .writeHead(200, { "content-type": "text/html; charset=utf-8" })
+                    .end(DENIED_PAGE);
                 settle(() => rejectResult(new CallbackDeniedError(error, state, url.searchParams.get("error_description") ?? undefined)));
                 return;
             }
             if (!code || !state) {
-                res.writeHead(400, { "content-type": "text/html; charset=utf-8" }).end(DENIED_PAGE);
+                res
+                    .writeHead(400, { "content-type": "text/html; charset=utf-8" })
+                    .end(DENIED_PAGE);
                 settle(() => rejectResult(new CallbackMalformedError()));
                 return;
             }
-            res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(SUCCESS_PAGE);
+            res
+                .writeHead(200, { "content-type": "text/html; charset=utf-8" })
+                .end(SUCCESS_PAGE);
             settle(() => resolveResult({ code, state }));
         });
         const timer = setTimeout(() => {

package/dist/oauth/wizard.js

@@ -28,7 +28,7 @@ import { openBrowser } from "./browser.js";
 import { codeChallengeFor, generateCodeVerifier, generateState, } from "./pkce.js";
 import { CallbackDeniedError, CallbackMalformedError, CallbackTimeoutError, StateMismatchError, start as startLoopback, verifyState, } from "./loopback.js";
 import { buildConnectUrl } from "./connect-url.js";
-import { ExchangeError, exchangeCode } from "./exchange.js";
+import { ExchangeError, exchangeCode, } from "./exchange.js";
 import { DeviceError, PollError, pollForToken, requestDeviceCode, } from "./device.js";
 import { decideTransport } from "./transport.js";
 import { defaultLabel } from "./label.js";
@@ -70,6 +70,11 @@ function requireUrl(v) {
         return "Enter a valid URL";
     }
 }
+/** An environment variable's value, with an empty one treated as unset. */
+function nonEmptyEnv(key) {
+    const value = process.env[key];
+    return value === "" ? undefined : value;
+}
 function requireNonEmpty(v) {
     return v?.trim() ? undefined : "Required";
 }
@@ -101,7 +106,11 @@ async function chooseHostedTargetFromEnvOrPrompt(cwd) {
     const fromFiles = readHostedTargetFromEnvFiles(cwd);
     if (fromFiles.apiUrl && fromFiles.serviceRoleKey) {
         log.info("Using the Supabase URL and service-role key from .env.local/.env.");
-        return { apiUrl: fromFiles.apiUrl, serviceRoleKey: fromFiles.serviceRoleKey, kind: "hosted" };
+        return {
+            apiUrl: fromFiles.apiUrl,
+            serviceRoleKey: fromFiles.serviceRoleKey,
+            kind: "hosted",
+        };
     }
     const apiUrl = unwrap(await text({ message: "Supabase project URL", validate: requireUrl })).replace(/\/+$/, "");
     const serviceRoleKey = unwrap(await password({
@@ -343,9 +352,11 @@ export async function connectViaOneClick(target, platformUrl, cwd, transportOver
 async function connectByPasting(baseUrlOverride) {
     // Not prompted: contributors always want the canonical API. `--base-url` /
     // `OAUTH_BASE_URL` stay as overrides for testing against another project.
-    const baseUrl = (baseUrlOverride ?? process.env[ENV_KEYS.baseUrl] ?? DEFAULT_API_URL).replace(/\/+$/, "");
-    let clientId = process.env[ENV_KEYS.clientId] || undefined;
-    let clientSecret = process.env[ENV_KEYS.clientSecret] || undefined;
+    const baseUrl = (baseUrlOverride ??
+        process.env[ENV_KEYS.baseUrl] ??
+        DEFAULT_API_URL).replace(/\/+$/, "");
+    let clientId = nonEmptyEnv(ENV_KEYS.clientId);
+    let clientSecret = nonEmptyEnv(ENV_KEYS.clientSecret);
     if (clientId && clientSecret) {
         const useSaved = unwrap(await confirm({
             message: `Use saved credentials? (client ID: ${clientId})`,

package/dist/persona.js

@@ -28,7 +28,7 @@
  */
 import { randomUUID } from "node:crypto";
 import { confirm, log, note, select } from "@clack/prompts";
-import { adminClient, resolveInstance, } from "./instance.js";
+import { adminClient, resolveInstance } from "./instance.js";
 import { grantModerator } from "./moderation.js";
 import { explain, unwrap } from "./ui.js";
 export const PERSONA_KINDS = ["member", "moderator"];

package/dist/planner/checks.js

@@ -37,7 +37,7 @@ export const CHECK_MIGRATIONS = "select count(*)::int as n from supabase_migrati
 export async function checkPlanner(db) {
     const lines = [];
     const [identity] = await db.run(CHECK_IDENTITY);
-    const who = String(identity?.who ?? "");
+    const who = typeof identity?.who === "string" ? identity.who : "";
     if (who !== PLANNER_ROLE) {
         return {
             ok: false,

package/dist/planner/commands.js

@@ -337,7 +337,7 @@ export async function runPlannerDrop(options = {}) {
         return;
     }
     const stored = doc.get("DB_URL");
-    if (stored && stored.includes(PLANNER_ROLE)) {
+    if (stored?.includes(PLANNER_ROLE)) {
         doc.set("DB_URL", "");
         await writeFile(path, doc.toString());
         log.info(`Blanked the dead DB_URL in ${fileFor("preflight")}. After the next ` +

package/dist/planner/db.js

@@ -24,7 +24,7 @@ export function connectDb(url) {
     });
     return {
         async run(query) {
-            return (await sql.unsafe(query));
+            return await sql.unsafe(query);
         },
         async end() {
             await sql.end({ timeout: 5 });

package/dist/repo/source.d.ts

@@ -4,7 +4,7 @@ import type { OpenGraphModule } from "../images/open-graph-types.js";
 export declare function loadOpenGraph(): Promise<OpenGraphModule>;
 import type { EmailTemplates } from "../emails/email-types.js";
 export interface EmailModule {
-    render<K extends keyof EmailTemplates>(name: K, props: EmailTemplates[K]): {
+    render: <K extends keyof EmailTemplates>(name: K, props: EmailTemplates[K]) => {
         subject: string;
         html: string;
         text: string;

package/dist/run/pick.js

@@ -417,7 +417,7 @@ async function runDev(plan, filters, rest, tierEnv) {
     }));
     // Ctrl-C reaches every child through the terminal's process group; this
     // process waits for them to finish rather than dying first.
-    const ignore = () => { };
+    const ignore = () => undefined;
     process.on("SIGINT", ignore);
     process.on("SIGTERM", ignore);
     const first = await Promise.race(children.map((child) => new Promise((resolve) => {

package/dist/setup.js

@@ -16,7 +16,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { join } from "node:path";
-import { confirm, log, note, password, select, spinner, text } from "@clack/prompts";
+import { confirm, log, note, password, select, spinner, text, } from "@clack/prompts";
 import { loadRegistry } from "./env/discovery.js";
 import { renderInit, resolveSections } from "./env/example.js";
 import { discoverRepoRoot } from "./repo/root.js";

package/dist/telemetry.js

@@ -44,7 +44,9 @@ function bakedSentryDsn() {
 }
 /** The run-time `DEVTOOLS_SENTRY_DSN` if set, else the baked one. */
 export function resolveDevtoolsDsn(env, baked) {
-    return env.DEVTOOLS_SENTRY_DSN || baked;
+    // An empty override (`DEVTOOLS_SENTRY_DSN=`) must fall back to the baked DSN.
+    const override = env.DEVTOOLS_SENTRY_DSN ?? "";
+    return override || baked;
 }
 let initialized = false;
 /**

package/dist/tier.js

@@ -50,10 +50,13 @@ export async function resolveTier(given, message, opts = {}) {
     // file is missing, which `loadEnvironment` then reports — so it is validated
     // for shape only, not existence, and does NOT fall through to the picker.
     const entered = opts.deployEnv ?? process.env.DEPLOY_ENV;
-    if (entered !== undefined && entered !== "" && env.isDeployEnvironment(entered)) {
+    if (entered !== undefined &&
+        entered !== "" &&
+        env.isDeployEnvironment(entered)) {
         return entered;
     }
-    const available = opts.available ?? (await (await loadEnvSession()).availableTiers(findRepoRoot()));
+    const available = opts.available ??
+        (await (await loadEnvSession()).availableTiers(findRepoRoot()));
     // Zero or one tier file present: there is nothing to choose between, so
     // asking would be a question with one possible answer. Fall through to
     // whichever tier is present, or development when nothing is (a machine

package/dist/version.js

@@ -6,9 +6,7 @@ let cachedOwnDir;
  * i.e. the devtools package's own root (`dist/version.js` → up one).
  * Exported for tests; memoized since it never changes within a process. */
 export function ownPackageDir() {
-    if (cachedOwnDir === undefined) {
-        cachedOwnDir = join(dirname(fileURLToPath(import.meta.url)), "..");
-    }
+    cachedOwnDir ??= join(dirname(fileURLToPath(import.meta.url)), "..");
     return cachedOwnDir;
 }
 /** Reads this build's own `package.json` version — used by `telemetry.ts`

package/dist/workers.js

@@ -21,9 +21,7 @@ import { findRepoRoot } from "./repo/root.js";
 let cachedWorkerPaths;
 /** Workspace-relative paths, exactly as listed in root `workers.json`. */
 export function workerPaths() {
-    if (cachedWorkerPaths === undefined) {
-        cachedWorkerPaths = JSON.parse(readFileSync(join(findRepoRoot(), "workers.json"), "utf8"));
-    }
+    cachedWorkerPaths ??= JSON.parse(readFileSync(join(findRepoRoot(), "workers.json"), "utf8"));
     return cachedWorkerPaths;
 }
 /** Basenames, e.g. `"schedule-builder"` — the `pnpm --filter` / CLI slug. */

package/dist/workflows/commands.js

@@ -7,7 +7,7 @@ import { basename, join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { confirm, select, text } from "@clack/prompts";
 import { loadEnvLoad } from "../repo/peers.js";
-import { createTemporaryWranglerEnv, renderWranglerEnvFile, scopedProcessEnv, } from "../cf/local-env.js";
+import { createTemporaryWranglerEnv, scopedProcessEnv, } from "../cf/local-env.js";
 import { buildWorkspaceDeps, needsFrameworkBuild } from "../cf/build.js";
 import { runWithStderr } from "../db/run.js";
 import { findRepoRoot } from "../repo/root.js";
@@ -614,7 +614,8 @@ export async function runWorkflowsRun(argv) {
     let triggerEnv;
     if (tier !== "development") {
         try {
-            triggerEnv = (await envLoad.loadEnvironment(tier, { override: true })).env;
+            triggerEnv = (await envLoad.loadEnvironment(tier, { override: true }))
+                .env;
         }
         catch (err) {
             if (err instanceof envLoad.MissingEnvFileError) {

package/env.ts

@@ -78,11 +78,11 @@ declare({
         .optional(),
       {
         doc:
-          "The Cloudflare account the Workers live in. OpenNext's R2 cache " +
-          "provisioning reads it from the environment and cannot infer it " +
-          "from the scoped CLOUDFLARE_API_TOKEN (the first staging deploy " +
-          "hung on exactly that); wrangler honors it too. Identifies, does " +
-          "not authorize — every capability is the token's.",
+          "The Cloudflare account the Workers live in. Wrangler honors this " +
+          "public identifier in the environment; each app's wrangler config " +
+          "pins the same value so scoped deploy tokens never need account " +
+          "discovery. Identifies, does not authorize — every capability is " +
+          "the token's.",
         scope: "default",
         secrecy: "public",
         example: "61d185ff419ef7bd5bd4b3d314081a49",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/devtools",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "private": false,
   "type": "module",
   "description": "Contributor CLI for a DevDogsUGA checkout: database, env, images, emails, cron, deploy. Ships built JS; run via `pnpm dlx @devdogsuga/devtools` (or the `devtools`/`devtools-ci` bins once installed) from inside a DevDogsUGA clone.",
@@ -38,7 +38,7 @@
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "zod": "4.4.3",
-    "@devdogsuga/telemetry": "0.1.1"
+    "@devdogsuga/telemetry": "0.1.2"
   },
   "peerDependencies": {
     "@devdogsuga/brand": "*",
@@ -64,13 +64,14 @@
     "@types/node": "^26.2.0",
     "@types/react": "^19.2.18",
     "@vitest/coverage-v8": "^4.1.11",
+    "eslint": "^9.39.5",
     "react": "^19.2.8",
     "vitest": "^4.1.11",
-    "@devdogsuga/brand": "0.1.2",
-    "@devdogsuga/config": "0.1.1",
-    "@devdogsuga/db": "0.1.1",
-    "@devdogsuga/events": "0.1.3",
-    "@devdogsuga/env": "0.1.2"
+    "@devdogsuga/brand": "0.1.3",
+    "@devdogsuga/config": "0.1.2",
+    "@devdogsuga/env": "0.1.3",
+    "@devdogsuga/db": "0.1.2",
+    "@devdogsuga/events": "0.1.4"
   },
   "scripts": {
     "build": "tsc && node scripts/write-build-info.mjs",
@@ -80,6 +81,8 @@
     "typecheck": "tsc --noEmit -p tsconfig.typecheck.json",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:contract": "vitest run --config vitest.contract.config.ts"
+    "test:contract": "vitest run --config vitest.contract.config.ts",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix"
   }
 }