@devdogsuga/devtools 0.1.25 → 0.1.27

package/dist/gen/commands.d.ts

@@ -1 +0,0 @@
-export declare function runGen(argv: readonly string[]): Promise<number>;

package/dist/gen/commands.js

@@ -1,25 +0,0 @@
-/**
- * Dispatch for `devtools gen *`.
- *
- * `gen og-assets` and `gen email-templates` delegate to the owning package
- * scripts via pnpm. `gen campus-map` and `gen hypno` are devtools-owned.
- */
-import { run } from "../db/run.js";
-import { runGenCampusMap } from "./campus-map.js";
-import { runGenHypno } from "./hypno.js";
-export async function runGen(argv) {
-    const sub = argv[0];
-    if (sub === "campus-map")
-        return runGenCampusMap();
-    if (sub === "hypno")
-        return runGenHypno();
-    if (sub === "og-assets") {
-        return run(["--filter", "@devdogsuga/open-graph", "run", "generate"]);
-    }
-    if (sub === "email-templates") {
-        return run(["--filter", "@devdogsuga/email", "run", "compile"]);
-    }
-    process.stderr.write(`devtools gen: unknown subcommand "${sub ?? "(none)"}". ` +
-        "Expected: campus-map, hypno, og-assets, email-templates.\n");
-    return 1;
-}

package/dist/gen/hypno.d.ts

@@ -1 +0,0 @@
-export declare function runGenHypno(): Promise<number>;

package/dist/gen/hypno.js

@@ -1,134 +0,0 @@
-/// <reference lib="dom" />
-/**
- * `devtools gen hypno`
- *
- * Bakes the hero's spiral into a pre-blurred raster at
- * `apps/platform/src/assets/hypno.webp`.
- *
- * Why this exists: the spiral used to be an inline 24-path SVG, ~3,530 CSS px
- * square, rotating forever under a `blur-sm` filter. Measured on a production
- * build, that single element held the page to 36.8 FPS at idle; hiding it
- * restored 60.4. The cost is the live filter, not the geometry — shrinking the
- * surface 6x bought 3 FPS, removing the blur at full size bought 25. Rotating a
- * texture that already has the blur painted into it is free by comparison, and
- * it keeps both the motion and the exact hazy look.
- *
- * Two details make the bake match the original:
- *
- * 1. The source sets `vector-effect: non-scaling-stroke`, so its 2px stroke is
- *    2 *device* px no matter how far the SVG is scaled up. A raster does not
- *    work that way — its stroke scales with the image. So the stroke is
- *    converted into viewBox units for the size the element actually renders at
- *    (2 * 1926.25 / RENDER_PX), which reproduces the same apparent weight.
- * 2. At the raster sizes worth shipping, both the stroke and the blur land
- *    below one pixel, and Skia's box-approximated blur is inaccurate at
- *    sub-pixel sigma. Everything is therefore drawn at SS x the target and
- *    downsampled, which resolves both correctly.
- */
-import { readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { createRequire } from "node:module";
-import { findRepoRoot } from "../repo/root.js";
-// Lazy — computed inside `runGenHypno`/`loadChromium`, not at module load.
-// This file used to compute these as top-level `const`s, which called
-// `findRepoRoot()` (and threw `RepoNotFoundError`) the instant anything
-// imported this module — including `devtools --help` from outside a repo,
-// since the command tree pulls every command module in transitively. See
-// `workers.ts`'s header for the general pattern.
-function srcPath() {
-    return join(findRepoRoot(), "apps", "platform", "src", "components", "HeroSection", "Hypno.tsx");
-}
-function outPath() {
-    return join(findRepoRoot(), "apps", "platform", "src", "assets", "hypno.webp");
-}
-const RENDER_PX = 3536;
-const VIEWBOX = 1926.25;
-const BLUR_CSS_PX = 8;
-const SS = 3;
-const STROKE = "rgba(216,180,254,0.75)";
-const BUDGET = 60_000;
-async function loadChromium() {
-    const require_ = createRequire(import.meta.url);
-    for (const spec of [
-        "playwright",
-        "playwright-core",
-        join(findRepoRoot(), "node_modules/.pnpm/playwright@1.62.1/node_modules/playwright"),
-    ]) {
-        try {
-            const mod = (await import(require_.resolve(spec)));
-            const chromium = mod.chromium ?? mod.default?.chromium;
-            if (chromium)
-                return chromium;
-        }
-        catch {
-            /* try the next one */
-        }
-    }
-    throw new Error("playwright not resolvable. Run `pnpm dlx playwright@1.62 install chromium` " +
-        "or run this command from a workspace where playwright is installed.");
-}
-export async function runGenHypno() {
-    const src = readFileSync(srcPath(), "utf8");
-    const paths = [...src.matchAll(/<path d="([^"]+)"/g)].map((m) => m[1]);
-    if (paths.length !== 24) {
-        process.stderr.write(`expected 24 paths in Hypno.tsx, found ${paths.length}\n`);
-        return 1;
-    }
-    const strokeW = (2 * VIEWBOX) / RENDER_PX;
-    const svg = (px) => `<svg xmlns="http://www.w3.org/2000/svg" width="${px}" height="${px}"
- viewBox="0 0 ${VIEWBOX} ${VIEWBOX}">
-<g fill="none" stroke="${STROKE}" stroke-width="${strokeW}" stroke-linecap="round" stroke-linejoin="round">
-${paths.map((d) => `<path d="${d}"/>`).join("\n")}
-</g></svg>`;
-    const chromium = await loadChromium();
-    const browser = await chromium.launch();
-    const page = await browser.newPage();
-    await page.goto("data:text/html,<html><body></body></html>");
-    const bake = async (target, quality) => page.evaluate(async ({ markup, target, ss, blur, quality, }) => {
-        const big = target * ss;
-        const img = new Image();
-        img.src =
-            "data:image/svg+xml;charset=utf-8," + encodeURIComponent(markup);
-        await new Promise((r) => {
-            img.onload = r;
-            img.onerror = r;
-        });
-        const hi = document.createElement("canvas");
-        hi.width = hi.height = big;
-        const hx = hi.getContext("2d");
-        hx.filter = `blur(${blur * ss}px)`;
-        hx.drawImage(img, 0, 0, big, big);
-        const lo = document.createElement("canvas");
-        lo.width = lo.height = target;
-        const lx = lo.getContext("2d");
-        lx.imageSmoothingEnabled = true;
-        lx.imageSmoothingQuality = "high";
-        lx.drawImage(hi, 0, 0, target, target);
-        return lo.toDataURL("image/webp", quality);
-    }, {
-        markup: svg(target * SS),
-        target,
-        ss: SS,
-        blur: (BLUR_CSS_PX * target) / RENDER_PX,
-        quality,
-    });
-    const bytes = (dataUrl) => Buffer.from(dataUrl.split(",")[1], "base64").byteLength;
-    console.log("size  quality   bytes");
-    const results = [];
-    for (const target of [512, 768, 1024]) {
-        for (const q of [0.5, 0.65, 0.8]) {
-            const url = await bake(target, q);
-            const b = bytes(url);
-            results.push({ target, q, b, url });
-            console.log(`${String(target).padStart(4)}  ${q.toFixed(2)}   ${String(b).padStart(7)}`);
-        }
-    }
-    const pick = results
-        .filter((r) => r.b <= BUDGET)
-        .sort((a, b) => b.target - a.target || b.q - a.q)[0] ??
-        results.sort((a, b) => a.b - b.b)[0];
-    writeFileSync(outPath(), Buffer.from(pick.url.split(",")[1], "base64"));
-    console.log(`\nwrote ${outPath()}\n  ${pick.target}px @ q=${pick.q} -> ${pick.b} bytes (budget ${BUDGET})`);
-    await browser.close();
-    return 0;
-}

package/dist/gh/client.d.ts

@@ -1,80 +0,0 @@
-export declare class GhError extends Error {
-}
-export interface GhSecret {
-    name: string;
-    updatedAt: string;
-}
-/** Unlike `GhSecret`, this carries the value: variables are readable. */
-export interface GhVariable {
-    name: string;
-    value: string;
-    updatedAt: string;
-}
-/** Environment secret names and when each last changed. Never values. */
-export declare function listSecrets(environment: string): Promise<GhSecret[]>;
-/**
- * Sets one secret, passing the value on **stdin**.
- *
- * Not `--body`, which would put a live credential in argv where `ps` can read
- * it. Not `--env-file` either, despite it being one call for the whole set:
- * that hands the file to `gh`'s own dotenv parser, and this tool has already
- * parsed it with different rules. Two parsers over one file agree right up
- * until a multi-line value, a PEM private key being the case, and then disagree
- * silently, storing something that looks like a key and is not.
- *
- * One process per secret is the cost. It is paid once per rotation.
- */
-export declare function setSecret(environment: string, name: string, value: string): Promise<void>;
-export declare function deleteSecret(environment: string, name: string): Promise<void>;
-/**
- * Environment variable names, VALUES, and when each last changed.
- *
- * The value is the point. It is what turns the GitHub half of `env audit` from
- * a presence check into a real comparison for these keys: a variable whose
- * value drifted from Bitwarden is detectable, where the same drift in a secret
- * is not detectable by anything.
- */
-export declare function listVariables(environment: string): Promise<GhVariable[]>;
-/**
- * Sets one variable, passing the value on **stdin**.
- *
- * Stdin rather than `--body` even though a variable is public by definition:
- * argv is shared machinery, and a rule with an exception ("stdin for secrets,
- * argv for variables") is a rule somebody applies to the wrong call. The
- * `--env-file` form is refused for the reason `setSecret` refuses it: it would
- * hand the file to `gh`'s own dotenv parser, which agrees with this tool's
- * parser right up until a multi-line value and then disagrees silently.
- */
-export declare function setVariable(environment: string, name: string, value: string): Promise<void>;
-export declare function deleteVariable(environment: string, name: string): Promise<void>;
-/**
- * A repository-level variable. NAME ONLY, and that is deliberate.
- *
- * `gh variable list` will return the value here as readily as it does for an
- * environment variable, and fetching it would invite the obvious next step,
- * comparing it against Bitwarden. That comparison has no correct answer. This
- * copy is unmanaged whatever it holds, so a value that matches today proves
- * nothing except that somebody set them the same way once; reporting only the
- * mismatch would then read as "the matching one is fine", which is the belief
- * this whole check exists to break.
- */
-export interface GhRepositoryVariable {
-    name: string;
-    updatedAt: string;
-}
-/**
- * The repository's OWN variables, the ones with no environment.
- *
- * ⚠️ The reason this exists at all: an environment variable of the same name
- * **shadows** a repository one, and nothing in GitHub's UI says so. Every job
- * that runs in the environment reads the environment copy, so a repository
- * variable a person set by hand before `env push` routed that key keeps its
- * stale value indefinitely and invisibly, right up until somebody deletes the
- * environment copy, at which point the stale value silently becomes live.
- *
- * No `--env`, and that missing flag IS the call. Everything else in this file
- * addresses one environment; this addresses the repository itself, which is
- * the scope nothing here writes to and therefore the scope nothing here would
- * otherwise notice.
- */
-export declare function listRepositoryVariables(): Promise<GhRepositoryVariable[]>;

package/dist/gh/client.js

@@ -1,259 +0,0 @@
-/**
- * A thin wrapper over the `gh` CLI, for environment secrets and variables.
- *
- * `gh` rather than the REST API for the same reason `bws` is used over its API:
- * a secret's value has to be encrypted client-side with a libsodium sealed box
- * against the environment's public key before it can be sent. `gh` does that
- * locally. Doing it by hand means fetching the key, pulling in a sodium
- * binding, and owning that code forever to avoid one dependency that is already
- * installed.
- *
- * ## Secrets and variables are two different stores
- *
- * They share an environment and nothing else, and the differences are the whole
- * reason the public per-environment values go to the second:
- *
- *   |            | Sent as    | Readable back | In logs        |
- *   |------------|------------|---------------|----------------|
- *   | secret     | sealed box | never         | masked, by substring |
- *   | variable   | plaintext  | value and all | verbatim       |
- *
- * The masking is not a nicety either way. `PROJECT_REF` as a *secret* rewrites
- * `https://supabase.com/dashboard/project/<ref>` to `.../***`, which is the
- * paused-project gate's whole output. And because the ref is a substring of
- * every Supabase hostname, it corrupts unrelated log lines across the repo. The
- * readability is what lets `env audit` compare a variable by VALUE, which it
- * cannot do for anything on the top row.
- *
- * ⚠️ The corollary, and the reason each setter is its own function rather than
- * one with a flag: putting a secret in the variable store publishes its value
- * to anyone with read access to the repository's Actions config, silently and
- * irreversibly. There is no operation here that can be pointed at the wrong
- * store by a boolean somebody passed the wrong way round.
- */
-import { spawn } from "node:child_process";
-import { promisify } from "node:util";
-import { execFile } from "node:child_process";
-const run = promisify(execFile);
-const MAX_BUFFER = 16 * 1024 * 1024;
-export class GhError extends Error {
-}
-let warnedAboutTokenOverride = false;
-/**
- * Says, once, when `gh` is about to ignore its own login.
- *
- * `gh` prefers `GH_TOKEN` / `GITHUB_TOKEN` from the environment over the
- * account somebody logged in with, and `with-env` loads `.env` for every
- * devtools command, so a token line in that file takes over EVERY `gh` call
- * silently. That is how a leftover classic PAT kept authenticating after the
- * operator's real login was a perfectly valid OAuth token, right up until
- * the org's classic-PAT block turned it into a 403 with no visible cause.
- * stderr and not clack, so it shows the same way from every command shape.
- */
-function warnOnEnvTokenOverride() {
-    if (warnedAboutTokenOverride)
-        return;
-    const source = process.env.GH_TOKEN
-        ? "GH_TOKEN"
-        : process.env.GITHUB_TOKEN
-            ? "GITHUB_TOKEN"
-            : undefined;
-    if (!source)
-        return;
-    warnedAboutTokenOverride = true;
-    console.error(`gh: authenticating with ${source} from the environment, NOT your ` +
-        "`gh auth login` account. with-env loads .env, so a token line there " +
-        "takes over silently — comment it out if that is not what you meant.");
-}
-/**
- * Turns a spawn failure into something with a next step in it.
- *
- * The three that happen are a missing binary, an unauthenticated CLI, and an
- * environment that does not exist yet. The last reports as a bare 404, because
- * an environment you cannot see and one that was never created look identical
- * from here.
- */
-function describe(err) {
-    const e = err;
-    if (e.code === "ENOENT") {
-        return ("The `gh` CLI is not installed, or is not on PATH.\n" +
-            "Install it from https://cli.github.com, then run `gh auth login`.");
-    }
-    const stderr = (e.stderr ?? "").trim();
-    if (/personal access token \(classic\)/i.test(stderr)) {
-        return (`${stderr}\n\n` +
-            "The organization forbids classic PATs (by design — §0.3), and gh " +
-            "authenticated with one anyway. gh prefers GH_TOKEN / GITHUB_TOKEN " +
-            "from the environment over your `gh auth login`, and with-env loads " +
-            ".env — so the usual culprit is a leftover ghp_ token line in that " +
-            "file. Comment it out (and revoke the token at " +
-            "github.com/settings/tokens); your stored gh login then takes over.");
-    }
-    if (/not logged into|authentication required|gh auth login/i.test(stderr)) {
-        return `${stderr}\n\nRun \`gh auth login\`. Managing environment secrets needs the \`repo\` scope.`;
-    }
-    if (/404|not found/i.test(stderr)) {
-        return (`${stderr}\n\n` +
-            "A 404 usually means the environment does not exist yet — GitHub creates " +
-            "environments explicitly, and a typo silently addresses a different one. " +
-            "Check Settings → Environments.");
-    }
-    if (/403|forbidden|must have admin/i.test(stderr)) {
-        return `${stderr}\n\nSetting environment secrets needs admin on the repository.`;
-    }
-    if (/\b429\b|rate.?limit|too many requests/i.test(stderr)) {
-        return (`${stderr}\n\n` +
-            "GitHub rate-limited this. A push is one API call per secret, so a " +
-            "burst of pushes can trip the secondary limit — wait a minute and " +
-            "re-run; already-written values are simply overwritten with themselves.");
-    }
-    const message = e.message ?? "";
-    return stderr || message || "gh failed with no output.";
-}
-/** Environment secret names and when each last changed. Never values. */
-export async function listSecrets(environment) {
-    warnOnEnvTokenOverride();
-    try {
-        const { stdout } = await run("gh", ["secret", "list", "--env", environment, "--json", "name,updatedAt"], { maxBuffer: MAX_BUFFER, shell: false });
-        return stdout.trim() === "" ? [] : JSON.parse(stdout);
-    }
-    catch (err) {
-        throw new GhError(describe(err));
-    }
-}
-/**
- * Sets one secret, passing the value on **stdin**.
- *
- * Not `--body`, which would put a live credential in argv where `ps` can read
- * it. Not `--env-file` either, despite it being one call for the whole set:
- * that hands the file to `gh`'s own dotenv parser, and this tool has already
- * parsed it with different rules. Two parsers over one file agree right up
- * until a multi-line value, a PEM private key being the case, and then disagree
- * silently, storing something that looks like a key and is not.
- *
- * One process per secret is the cost. It is paid once per rotation.
- */
-export async function setSecret(environment, name, value) {
-    warnOnEnvTokenOverride();
-    await new Promise((resolve, reject) => {
-        const child = spawn("gh", ["secret", "set", name, "--env", environment], {
-            stdio: ["pipe", "ignore", "pipe"],
-            shell: false,
-        });
-        let stderr = "";
-        child.stderr.on("data", (c) => (stderr += c.toString()));
-        child.on("error", (err) => reject(new GhError(describe(err))));
-        child.on("close", (code) => code === 0
-            ? resolve()
-            : reject(new GhError(describe({ stderr, message: `gh exited ${code}` }))));
-        // Exactly the bytes, with no trailing newline: `gh` stores stdin verbatim,
-        // so a stray "\n" becomes part of the secret and every comparison against
-        // it fails in a way that reads like a wrong value rather than a stray byte.
-        child.stdin.end(value);
-    });
-}
-export async function deleteSecret(environment, name) {
-    warnOnEnvTokenOverride();
-    try {
-        await run("gh", ["secret", "delete", name, "--env", environment], {
-            shell: false,
-        });
-    }
-    catch (err) {
-        throw new GhError(describe(err));
-    }
-}
-// ── variables ────────────────────────────────────────────────────────────────
-/**
- * Environment variable names, VALUES, and when each last changed.
- *
- * The value is the point. It is what turns the GitHub half of `env audit` from
- * a presence check into a real comparison for these keys: a variable whose
- * value drifted from Bitwarden is detectable, where the same drift in a secret
- * is not detectable by anything.
- */
-export async function listVariables(environment) {
-    warnOnEnvTokenOverride();
-    try {
-        const { stdout } = await run("gh", [
-            "variable",
-            "list",
-            "--env",
-            environment,
-            "--json",
-            "name,value,updatedAt",
-        ], { maxBuffer: MAX_BUFFER, shell: false });
-        return stdout.trim() === "" ? [] : JSON.parse(stdout);
-    }
-    catch (err) {
-        throw new GhError(describe(err));
-    }
-}
-/**
- * Sets one variable, passing the value on **stdin**.
- *
- * Stdin rather than `--body` even though a variable is public by definition:
- * argv is shared machinery, and a rule with an exception ("stdin for secrets,
- * argv for variables") is a rule somebody applies to the wrong call. The
- * `--env-file` form is refused for the reason `setSecret` refuses it: it would
- * hand the file to `gh`'s own dotenv parser, which agrees with this tool's
- * parser right up until a multi-line value and then disagrees silently.
- */
-export async function setVariable(environment, name, value) {
-    warnOnEnvTokenOverride();
-    await new Promise((resolve, reject) => {
-        const child = spawn("gh", ["variable", "set", name, "--env", environment], {
-            stdio: ["pipe", "ignore", "pipe"],
-            shell: false,
-        });
-        let stderr = "";
-        child.stderr.on("data", (c) => (stderr += c.toString()));
-        child.on("error", (err) => reject(new GhError(describe(err))));
-        child.on("close", (code) => code === 0
-            ? resolve()
-            : reject(new GhError(describe({ stderr, message: `gh exited ${code}` }))));
-        // No trailing newline, for a reason that bites harder here than it does for
-        // a secret: the stored value IS readable, so a stray "\n" turns every
-        // `audit` run into a value-drift error against a Bitwarden copy that is
-        // actually identical, and no amount of re-pushing fixes it.
-        child.stdin.end(value);
-    });
-}
-export async function deleteVariable(environment, name) {
-    warnOnEnvTokenOverride();
-    try {
-        await run("gh", ["variable", "delete", name, "--env", environment], {
-            shell: false,
-        });
-    }
-    catch (err) {
-        throw new GhError(describe(err));
-    }
-}
-/**
- * The repository's OWN variables, the ones with no environment.
- *
- * ⚠️ The reason this exists at all: an environment variable of the same name
- * **shadows** a repository one, and nothing in GitHub's UI says so. Every job
- * that runs in the environment reads the environment copy, so a repository
- * variable a person set by hand before `env push` routed that key keeps its
- * stale value indefinitely and invisibly, right up until somebody deletes the
- * environment copy, at which point the stale value silently becomes live.
- *
- * No `--env`, and that missing flag IS the call. Everything else in this file
- * addresses one environment; this addresses the repository itself, which is
- * the scope nothing here writes to and therefore the scope nothing here would
- * otherwise notice.
- */
-export async function listRepositoryVariables() {
-    warnOnEnvTokenOverride();
-    try {
-        const { stdout } = await run("gh", ["variable", "list", "--json", "name,updatedAt"], { maxBuffer: MAX_BUFFER, shell: false });
-        return stdout.trim() === ""
-            ? []
-            : JSON.parse(stdout);
-    }
-    catch (err) {
-        throw new GhError(describe(err));
-    }
-}

package/dist/gh/environments.d.ts

@@ -1,83 +0,0 @@
-export declare const GITHUB_ENVIRONMENTS: readonly ["preflight", "staging", "production", "production-apply"];
-export type GithubEnvironment = (typeof GITHUB_ENVIRONMENTS)[number];
-export declare function isGithubEnvironment(v: string): v is GithubEnvironment;
-export interface GithubEnvironmentSpec {
-    /** BWS project to compare against, or null when nothing backs it. */
-    bwsProject: string | null;
-    /** Deployment branch policy, for the summary line. */
-    branch: string;
-    /**
-     * Keys allowed here, or null for "whatever the file defines".
-     *
-     * ⚠️ NULL ON EVERY ROW TODAY, and that is the deliberate state rather than a
-     * field nobody got round to filling in. `production-apply` used to carry the
-     * apply-tier pair here, on the reasoning that "holding a third credential
-     * makes the reviewer gate stop meaning anything", which conflated two
-     * constraints and kept only the one that was not the gate. An allowlist here
-     * restricts what the REVIEWED environment may hold; the gate is
-     * `production.excludeKeys`, which restricts what the UNREVIEWED one may hold.
-     * Only the second is a security property, and it is enforced below.
-     *
-     * Kept as a field because the mechanism is worth having and costs one branch
-     * in `accepts()`: a future environment that genuinely holds a fixed short
-     * list, a third-party integration's two keys and nothing else, states it here
-     * rather than as an `excludeKeys` of everything else.
-     */
-    onlyKeys: readonly string[] | null;
-    /**
-     * Keys that must never reach this environment.
-     *
-     * The whole reviewer gate now lives in this field: `production` (and
-     * `staging`) exclude the apply-tier set, and nothing else stops a
-     * write-capable credential from landing in an environment that deploys with
-     * nobody in front of it.
-     */
-    excludeKeys: readonly string[];
-    /** Extra confirmation before writing. */
-    guarded: boolean;
-}
-export declare const GITHUB_ENVIRONMENT_SPECS: Record<GithubEnvironment, GithubEnvironmentSpec>;
-/** The GitHub environments fed by one Bitwarden project, in precedence order. */
-export declare function githubTargets(bwsProject: string): GithubEnvironment[];
-/** Whether one environment takes a given key. */
-export declare function accepts(environment: GithubEnvironment, key: string): boolean;
-/**
- * The PRIMARY environment a key belongs in, or `null` for "nowhere here".
- *
- * `null` is not an error. Pushing `staging` with an apply-only credential in
- * the file is the ordinary case: that key belongs to production and has no home
- * in the staging environment.
- *
- * ⚠️ "Primary", not "only". Since `production-apply` became a superset, an
- * ordinary production key legitimately lives in TWO environments and this
- * returns the first, the unreviewed one, where the deploy reads it. A caller
- * asking "is this copy misplaced?" wants `acceptedBy()` instead; answering that
- * question with this function reports every correctly-pushed copy in
- * `production-apply` as a stray that somebody should delete.
- */
-export declare function routeTo(bwsProject: string, key: string): GithubEnvironment | null;
-/**
- * EVERY environment of a project that takes a key, in precedence order.
- *
- * The set-shaped question, for callers that compare against what a push
- * actually wrote rather than against one destination. `routeTo()` is this with
- * `[0]` taken, and the difference is only ever visible for `production`, the
- * one project that fans out to two environments.
- */
-export declare function acceptedBy(bwsProject: string, key: string): GithubEnvironment[];
-/**
- * `accepts()` for an environment name that has not been narrowed yet, in the
- * argument order `AuditInput.accepted` wants.
- *
- * Exists so that the predicate `env audit` hands the audit is a NAME rather
- * than a lambda written at the call site: `runEnvAudit` cannot be unit-tested
- * without mocking Bitwarden, GitHub and Cloudflare at once, so anything spelled
- * out there is untested by construction.
- *
- * ⚠️ An unrecognised environment is REFUSED, not accepted. The string comes
- * from whatever `gh` listed, and the audit uses this to decide whether a found
- * copy is a stray. Failing open here would silence the finding for a copy
- * sitting in an environment this repository has never heard of, which is
- * exactly the case worth hearing about.
- */
-export declare function acceptsKey(key: string, environment: string): boolean;