@devdogsuga/devtools 0.1.25 → 0.1.27

package/dist/supabase-project-0knM0mqd.js

@@ -0,0 +1,426 @@
+import { a as cliName, r as noteRan } from "./failure-log-BBPGejQv.js";
+import { r as findRepoRoot } from "./root-C2OmZDwD.js";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { execFile, execFileSync, spawn } from "node:child_process";
+import { promisify } from "node:util";
+//#region ../cli-core/src/dry-run.ts
+const DRY_RUN_FLAG = "--dry-run";
+/** Commands that forward everything after their name to another tool. */
+const FORWARDING = /* @__PURE__ */ new Set([
+	"supabase",
+	"wrangler",
+	"drizzle-kit",
+	"psql",
+	"bw",
+	"run"
+]);
+let active = false;
+function setDryRun(on) {
+	active = on;
+}
+function isDryRun() {
+	return active;
+}
+/**
+* Decides whether `argv` asks for a dry run and returns the argv to dispatch.
+*
+* For a forwarding command a leading `--dry-run` is consumed (the tool never
+* sees it) and a later one is the tool's. For any other command the argv is
+* returned as it came, because several commands read `--dry-run` themselves.
+*/
+function resolveDryRun(argv) {
+	const firstPositional = argv.findIndex((arg) => !arg.startsWith("-"));
+	const lead = firstPositional === -1 ? argv.length : firstPositional;
+	const command = argv[firstPositional];
+	if (command !== void 0 && FORWARDING.has(command)) {
+		const rest = argv.filter((arg, i) => i >= lead || arg !== "--dry-run");
+		return {
+			dryRun: rest.length !== argv.length,
+			rest
+		};
+	}
+	return {
+		dryRun: argv.includes(DRY_RUN_FLAG),
+		rest: [...argv]
+	};
+}
+/**
+* How a command treats `--dry-run`, from the nearest node on its path that
+* says. `undefined` means it did not say, and the dispatcher stops it.
+*/
+function dryRunKind(catalog, path) {
+	for (let end = path.length; end > 0; end -= 1) {
+		const kind = catalog.findCommand(path.slice(0, end))?.dryRun;
+		if (kind !== void 0) return kind;
+	}
+}
+/** The command line a stopped command would have run. */
+function wouldRunLine(argv) {
+	return `Would run: ${cliName()} ${argv.join(" ")}`;
+}
+//#endregion
+//#region ../cli-core/src/process-group.ts
+/**
+* Running a child tool so that stopping it stops everything it started.
+*
+* `pnpm run dev` forks a shell that forks vinext that forks workerd. Killing
+* only the pnpm process (what a plain `child.kill()` does, and what a closed
+* terminal tab or a `kill` from another window delivers) orphans the rest,
+* and the orphan keeps its port. So the child gets its own process group, and
+* every stop signal this process receives is sent to the whole group.
+*
+* Ctrl-C needs the same care in reverse: a child in its own group is not in
+* the terminal's foreground group, so the terminal no longer delivers ^C to
+* it. The signal handlers below forward it.
+*
+* The group is only swept after the direct child exits when that exit was a
+* signal we forwarded; a child that exits on its own is left to have cleaned
+* up after itself, so a tool that deliberately leaves a daemon running keeps it.
+*/
+const FORWARDED = [
+	"SIGINT",
+	"SIGTERM",
+	"SIGHUP"
+];
+const SIGNAL_NUMBERS = {
+	SIGHUP: 1,
+	SIGINT: 2,
+	SIGTERM: 15,
+	SIGKILL: 9
+};
+/** How long a group gets to leave after SIGTERM before SIGKILL. */
+const GRACE_MS = 5e3;
+/** Sends `signal` to every process in `pid`'s group. False if it is already gone. */
+function signalGroup(pid, signal) {
+	try {
+		process.kill(process.platform === "win32" ? pid : -pid, signal);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function runInGroup(command, args, opts = {}) {
+	if (isDryRun()) {
+		process.stderr.write(`Would run: ${formatCommand(command, args)}\n`);
+		return Promise.resolve({
+			code: 0,
+			signal: null
+		});
+	}
+	return new Promise((resolve) => {
+		const child = spawn(command, [...args], {
+			stdio: opts.stdio ?? "inherit",
+			cwd: opts.cwd,
+			env: opts.env,
+			detached: process.platform !== "win32"
+		});
+		const pid = child.pid;
+		let forwarded = null;
+		let escalation;
+		const forward = (signal) => {
+			if (pid === void 0) return;
+			forwarded ??= signal;
+			signalGroup(pid, signal);
+			escalation ??= setTimeout(() => signalGroup(pid, "SIGKILL"), GRACE_MS);
+			escalation.unref();
+		};
+		if (opts.abort?.aborted) forward("SIGTERM");
+		else opts.abort?.addEventListener("abort", () => forward("SIGTERM"), { once: true });
+		const handlers = FORWARDED.map((signal) => {
+			const handler = () => forward(signal);
+			process.on(signal, handler);
+			return [signal, handler];
+		});
+		const onExit = () => {
+			if (pid !== void 0) signalGroup(pid, "SIGKILL");
+		};
+		process.on("exit", onExit);
+		const finish = (result) => {
+			noteRan(`${formatCommand(command, args)}  (exit ${result.code})`);
+			for (const [signal, handler] of handlers) process.off(signal, handler);
+			process.off("exit", onExit);
+			if (escalation) clearTimeout(escalation);
+			if (forwarded !== null && pid !== void 0) signalGroup(pid, "SIGKILL");
+			resolve(result);
+		};
+		child.on("error", (error) => {
+			process.stderr.write(`${error.message}\n`);
+			finish({
+				code: 1,
+				signal: null
+			});
+		});
+		child.on("exit", (code, signal) => {
+			const bySignal = signal ? 128 + (SIGNAL_NUMBERS[signal] ?? 0) : 1;
+			finish({
+				code: code ?? bySignal,
+				signal
+			});
+		});
+	});
+}
+const URL_CREDENTIALS = /\/\/[^/@\s]*@/;
+/**
+* The command as a person would type it, for printing. A database URL carries
+* its password, so the value after `--db-url` (and any URL with credentials)
+* is replaced rather than echoed.
+*/
+function formatCommand(command, args) {
+	const shown = [];
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i];
+		if (arg === "--db-url" && i + 1 < args.length) {
+			shown.push(arg, "<DB_URL>");
+			i += 1;
+		} else if (arg.startsWith("--db-url=")) shown.push("--db-url=<DB_URL>");
+		else shown.push(arg.replace(URL_CREDENTIALS, "//***@"));
+	}
+	return [command, ...shown].map((part) => /^[\w@%+=:,./<>*-]+$/.test(part) ? part : JSON.stringify(part)).join(" ");
+}
+/**
+* Prints the exact command that ran, AFTER it ran so the tool's own output
+* cannot bury it. On stderr, so a tool whose stdout is a pipe stays clean.
+*/
+function reportRan(command, args, result) {
+	if (isDryRun()) return;
+	const status = result.code === 0 ? "" : `  (exit ${result.code})`;
+	process.stderr.write(`Ran: ${formatCommand(command, args)}${status}\n`);
+}
+//#endregion
+//#region ../cli-core/src/db/run.ts
+/**
+* Shared helpers for running supabase CLI and pnpm commands from the repo root.
+*
+* The supabase CLI is a workspace devDependency (not a global install), so
+* every invocation goes through `pnpm exec supabase`. The cwd is always
+* findRepoRoot(), where `supabase/config.toml` lives.
+*/
+const runFile = promisify(execFile);
+/** Spawn a pnpm command with inherited stdio; resolves to the exit code. Pass
+* `env` to run the child against a loaded tier rather than process.env. The
+* child runs in its own process group, so stopping this process stops
+* whatever it started (see `process-group.ts`). */
+async function run(args, env) {
+	const result = await runInGroup("pnpm", args, {
+		cwd: findRepoRoot(),
+		...env ? { env } : {}
+	});
+	if (reporting) reportRan("pnpm", args, result);
+	return result.code;
+}
+let reporting = false;
+/**
+* Makes every `run()` after this print the exact command it ran (on stderr,
+* after it finishes). Off by default, so a deploy log or a piped command is
+* not changed under its caller; the presets turn it on because showing the
+* tool calls behind a button is their whole point.
+*/
+function reportRuns(enabled) {
+	reporting = enabled;
+}
+/** Spawn a pnpm command while echoing and retaining stderr for diagnostics.
+* Pass `env` to run the child against a loaded tier rather than process.env. */
+function runWithStderr(args, env) {
+	return new Promise((resolve) => {
+		const child = spawn("pnpm", args, {
+			stdio: [
+				"inherit",
+				"inherit",
+				"pipe"
+			],
+			cwd: findRepoRoot(),
+			...env ? { env } : {}
+		});
+		let stderr = "";
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+			process.stderr.write(chunk);
+		});
+		child.on("error", (error) => {
+			const message = `${error.message}\n`;
+			stderr += message;
+			process.stderr.write(message);
+			resolve({
+				code: 1,
+				stderr
+			});
+		});
+		child.on("exit", (code) => resolve({
+			code: code ?? 1,
+			stderr
+		}));
+	});
+}
+/** Spawn a pnpm command, capture stdout, throw on non-zero exit. */
+async function capture(args) {
+	const { stdout } = await runFile("pnpm", args, {
+		cwd: findRepoRoot(),
+		encoding: "utf8"
+	});
+	return stdout;
+}
+/** `pnpm exec supabase …` with inherited stdio. */
+const supabase = (...args) => run([
+	"exec",
+	"supabase",
+	...args
+]);
+/** `pnpm exec supabase …` with captured stdout. */
+const supabaseCapture = (...args) => capture([
+	"exec",
+	"supabase",
+	...args
+]);
+/**
+* `supabase db push` over `dbUrl`, inherited stdio, resolving to the exit code.
+*
+* The one spelling of the migration push, shared by the contributor `db
+* migrate` path (`stack.ts`'s `pushMigrations`) and CI's `deploy migrate`.
+* `--yes` is the unattended apply CI wants; the contributor path omits it so a
+* human still confirms. Neither variant regenerates types — that is
+* `pushMigrations`' own second step, layered on top only where a checkout is
+* meant to be rewritten. A CI apply must NOT write back into the repo, which is
+* exactly why the bare push is factored out here rather than reused whole.
+*/
+function dbPush(dbUrl, opts = {}) {
+	const args = [
+		"db",
+		"push",
+		"--db-url",
+		dbUrl
+	];
+	if (opts.yes) args.push("--yes");
+	return supabase(...args);
+}
+/** Seed storage buckets on the local stack or a resolved tier's project. */
+async function seedBuckets(conn) {
+	if (conn.kind === "local") return supabase("seed", "buckets", "--local", "--yes");
+	if (!conn.projectRef) {
+		process.stderr.write("devtools db: seed buckets against a hosted project needs PROJECT_REF in the session's env file.\n");
+		return 1;
+	}
+	return supabase("seed", "buckets", "--project-ref", conn.projectRef, "--linked");
+}
+//#endregion
+//#region ../cli-core/src/repo/supabase-project.ts
+/**
+* This repo's Supabase project id — read from `supabase/config.toml` — and
+* the container-name conventions the Supabase CLI derives from it.
+*
+* Shared by `environment.ts`'s adaptive-menu probe (does a stack answer for
+* THIS project?) and the foreign-stack detection in `db/generated-env.ts`
+* and `stack.ts` (does a DIFFERENT project's stack hold the shared ports? —
+* the case where `supabase status -o env` fails not because nothing is
+* running, but because what is running on 127.0.0.1:54321 belongs to
+* another workspace, or to this same repo before/after a `project_id`
+* rename). One project-id reader and one container-name parser, so both
+* questions agree on what "this project" means.
+*/
+/**
+* Reads `project_id` out of `<repoRoot>/supabase/config.toml`, or `null`
+* when the file is missing or unparsable.
+*
+* Regex, not a TOML parser: it is one line, the shape has been stable
+* across every CLI version this repo has seen, and a parser on a path some
+* callers pay before their first real subprocess is a cost that stays
+* invisible until it is why the tool feels slow.
+*/
+function readProjectId(repoRoot) {
+	try {
+		const path = join(repoRoot, "supabase", "config.toml");
+		return /^\s*project_id\s*=\s*"([^"]+)"/m.exec(readFileSync(path, "utf8"))?.[1] ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The Supabase CLI's container name prefix for a project id, or the bare
+* `supabase_db_` fallback when the id could not be read.
+*
+* Falling back to the bare prefix means a machine whose `config.toml`
+* cannot be read still detects *a* stack, at the cost of over-matching a
+* differently-named project — deliberate, and unchanged from this
+* function's original home in `environment.ts`: over-matching offers
+* `stop`/a foreign-stack hint for a stack that turns out to be this
+* project's own, which is harmless to see and decline, while
+* under-matching hides a real signal entirely.
+*/
+function containerPrefix(projectId) {
+	return projectId ? `supabase_db_${projectId}` : "supabase_db_";
+}
+/**
+* The local stack's API port, published by its Kong container. Mirrors
+* `@devdogsuga/env/load`'s `LOCAL_STACK_PORT`, which this module cannot import
+* statically (that package is an optional peer, loaded on demand).
+*/
+const STACK_API_PORT = 54321;
+function defaultExec(file, args) {
+	try {
+		return execFileSync(file, args, {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 3e3
+		});
+	} catch {
+		return null;
+	}
+}
+/**
+* `docker ps --format '{{.Names}}'`, split into trimmed, non-empty names —
+* or `null` when Docker could not be read at all (no daemon, not
+* installed, timed out). With `publish`, only the containers publishing that
+* host port. `execute` is injectable for tests, mirroring `environment.ts`'s
+* own probes.
+*/
+function listContainerNames(publish, execute = defaultExec) {
+	const out = execute("docker", [
+		"ps",
+		...publish === void 0 ? [] : ["--filter", `publish=${publish}`],
+		"--format",
+		"{{.Names}}"
+	]);
+	if (out === null) return null;
+	return out.split("\n").map((name) => name.trim()).filter((name) => name.length > 0);
+}
+/**
+* Finds the `supabase_kong_<id>` container among `names` whose id differs
+* from `projectId` — the signature of a stack started from a DIFFERENT
+* Supabase project (this same repo before/after a rename, or another
+* project entirely) holding the shared ports. Kong is the container that
+* publishes the API port, so callers pass the names `listContainerNames`
+* returns for `STACK_API_PORT`: that names the stack actually on 54321,
+* not just any Supabase stack on the machine.
+*
+* Returns that foreign id, or `null` when every matching container belongs
+* to this project, none match at all, or `projectId` itself could not be
+* read — with no known id of our own, there is nothing to compare against,
+* and guessing would risk telling a contributor their OWN stack is
+* foreign.
+*/
+function foreignStackProjectId(names, projectId) {
+	if (projectId === null) return null;
+	for (const name of names) {
+		const match = /^supabase_kong_(.+)$/.exec(name);
+		if (!match) continue;
+		const id = match[1];
+		if (id !== projectId) return id;
+	}
+	return null;
+}
+/**
+* The actionable message for a detected foreign stack — shared by
+* `db/generated-env.ts` (a failed `supabase status -o env`) and `stack.ts`
+* (a failed `supabase start`), so both name the same fix in the same
+* words.
+*/
+function foreignStackMessage(foreignProjectId) {
+	return `The stack on port ${STACK_API_PORT} belongs to project "${foreignProjectId}", not this checkout's. Stop it with \`supabase stop --project-id ${foreignProjectId}\` then \`pnpm devtools supabase start\`.`;
+}
+//#endregion
+export { dryRunKind as _, listContainerNames as a, setDryRun as b, reportRuns as c, seedBuckets as d, supabase as f, runInGroup as g, reportRan as h, foreignStackProjectId as i, run as l, formatCommand as m, containerPrefix as n, readProjectId as o, supabaseCapture as p, foreignStackMessage as r, dbPush as s, STACK_API_PORT as t, runWithStderr as u, isDryRun as v, wouldRunLine as x, resolveDryRun as y };

package/dist/telemetry-C4foD8MD.js

@@ -0,0 +1,249 @@
+import { a as cliName, n as noteError } from "./failure-log-BBPGejQv.js";
+import { a as ownVersion, n as discoverRepoRoot } from "./root-C2OmZDwD.js";
+import { readFileSync } from "node:fs";
+import * as Sentry from "@sentry/node";
+import { buildSentryOptions } from "@devdogsuga/telemetry";
+//#region ../cli-core/src/mode.ts
+/**
+* Non-interactive mode: the one definition both published CLIs share.
+*
+* A run is non-interactive when nobody can answer a prompt: no TTY on stdin,
+* or `CI=true`. In that mode there is no wizard and no banner, output is plain
+* lines (errors on stderr), every confirmation needs `--yes`, the tier must be
+* named (`--tier` or `DEPLOY_ENV`), and Sentry reports the environment `ci`.
+* `--no-env` is the companion switch: it skips loading env files, for a job
+* that supplies its own environment.
+*/
+/** Skip every confirmation. Also the only way past the hosted-tier gate with no terminal. */
+const YES_FLAG = "--yes";
+/** Do not load env files; the caller's environment is the environment. */
+const NO_ENV_FLAG = "--no-env";
+/** `CI=true` (or `1`), the value every CI runner sets. */
+function isCiEnv(env = process.env) {
+	return env.CI === "true" || env.CI === "1";
+}
+/**
+* Whether this run has nobody to ask.
+*
+* Both inputs are injectable for tests; the defaults read the live process.
+*/
+function isNonInteractive(env = process.env, isTTY = process.stdin.isTTY === true) {
+	return !isTTY || isCiEnv(env);
+}
+/** Whether `--yes` was typed anywhere in `argv`. */
+function hasYes(argv) {
+	return argv.includes(YES_FLAG);
+}
+/**
+* Pulls `--no-env` out of `argv`, wherever it sits, leaving everything else in
+* order. Like `--tier`, it is a global flag the launcher strips before any
+* command sees the rest.
+*/
+function stripNoEnvFlag(argv) {
+	const rest = argv.filter((arg) => arg !== NO_ENV_FLAG);
+	return {
+		noEnv: rest.length !== argv.length,
+		rest
+	};
+}
+/**
+* Pulls a global `--tier <t>` out of `argv`, wherever it sits, leaving every
+* other argument untouched and in its original order.
+*
+* A trailing `--tier` with nothing after it removes just the flag; the
+* missing value then reaches tier resolution as `explicit: undefined`, which
+* falls through to `DEPLOY_ENV`/the sole tier/the prompt exactly as if
+* `--tier` had never been typed, rather than this function guessing. A
+* following token that is itself a flag is treated the same way, NOT consumed
+* as the value (the guard every other flag-value reader keeps): without it,
+* `--tier --help` would swallow the flag as a bogus tier and refuse with
+* "unknown tier" instead of reaching the help bypass.
+*/
+function stripTierFlag(argv) {
+	const rest = [...argv];
+	const index = rest.indexOf("--tier");
+	if (index === -1) return {
+		explicit: void 0,
+		rest
+	};
+	const value = rest[index + 1];
+	const missing = value === void 0 || value.startsWith("-");
+	rest.splice(index, missing ? 1 : 2);
+	return {
+		explicit: missing ? void 0 : value,
+		rest
+	};
+}
+//#endregion
+//#region ../cli-core/src/telemetry.ts
+/**
+* devtools' own Sentry wiring — the CLI is a consumer of
+* `@devdogsuga/telemetry` like `apps/platform`, `apps/schedule-builder`, and
+* `apps/sandbox`, but on `@sentry/node` rather than a framework SDK: a CLI
+* process starts, runs one command, and exits, with none of a server's
+* request lifecycle for a framework integration to hook into.
+*
+* ## Reporting is on by default
+*
+* Every other `*_SENTRY_DSN` in this org is optional-and-empty until
+* configured (see `@devdogsuga/telemetry`'s no-op-without-DSN contract), and
+* so is this one — empty means `buildSentryOptions` returns `undefined` and
+* `Sentry.init` never runs — but the DEFAULT here is reporting ON once a DSN
+* exists, unlike a feature a contributor opts into. `DEVTOOLS_TELEMETRY=0` is
+* the one escape hatch, checked before `Sentry.init` and before every capture
+* call, so it also works as a kill switch after init already ran (a
+* long-lived `pnpm devtools` menu session, for instance).
+*
+* ## Where the DSN comes from
+*
+* Baked in at build time, not read from the consumer's environment: devtools
+* runs on contributors' machines, where no `.env` could be relied on to carry
+* it. `scripts/write-build-info.mjs` writes `dist/build-info.json` from the
+* build's `DEVTOOLS_SENTRY_DSN`, which Backstage's `publish.yaml` sets from
+* the repo's Actions variable of the same name. Every other build bakes ""
+* and reports nothing. `DEVTOOLS_SENTRY_DSN` in the run-time environment still
+* wins, for pointing a local build at a test project.
+*/
+/** The DSN baked into this build, or "" if there is none (a source run under
+* tsx, or a build made without `DEVTOOLS_SENTRY_DSN`). */
+function bakedSentryDsn() {
+	try {
+		const info = JSON.parse(readFileSync(new URL("./build-info.json", import.meta.url), "utf8"));
+		return typeof info.sentryDsn === "string" ? info.sentryDsn : "";
+	} catch {
+		return "";
+	}
+}
+/** The run-time `DEVTOOLS_SENTRY_DSN` if set, else the baked one. */
+function resolveDevtoolsDsn(env, baked) {
+	return (env.DEVTOOLS_SENTRY_DSN ?? "") || baked;
+}
+let initialized = false;
+/** The id of the last event this process sent to Sentry, if any. */
+let lastEventId;
+/**
+* The Sentry event id of the last error or failure this run reported, or
+* `undefined` when telemetry is off or sent nothing. Printed with the failure
+* log so a maintainer can find the event.
+*/
+function lastSentryEventId() {
+	return lastEventId;
+}
+/** Records the id only when a client exists: without one nothing was sent. */
+function sent(id) {
+	if (Sentry.getClient()) lastEventId = id;
+}
+/**
+* `'ci'` whenever the run is non-interactive (no TTY, or `CI=true`, which the
+* runner sets itself before any workflow-authored env), `'local'` on a
+* contributor's terminal.
+* One of `@devdogsuga/telemetry`'s `ENVIRONMENTS`.
+*/
+function devtoolsEnvironment() {
+	return isNonInteractive() ? "ci" : "local";
+}
+/**
+* `DEVTOOLS_TELEMETRY=0` (any other value, including unset, leaves reporting
+* on) is the only opt-out. Checked by both `initDevtoolsTelemetry` (skips
+* `Sentry.init` outright) and `captureDevtoolsError` (so setting it mid-run,
+* or between two invocations in the same process, still works).
+*/
+function devtoolsTelemetryEnabled() {
+	return process.env.DEVTOOLS_TELEMETRY !== "0";
+}
+/**
+* Whether anyone is actually using devtools in this process. Package-registry
+* scanners install every published version within minutes and run it in a
+* throwaway sandbox (random `DESKTOP-xxxxxx` hosts, Firecracker VMs, a fuzzer
+* that turns `process.exit` into a throw). Left unfiltered, each release filed
+* the same two issues from them. They run with no DevDogsUGA checkout and no
+* terminal. A person has at least one of the two (`setup` runs outside a
+* checkout, but in a terminal), and CI always has a checkout.
+*/
+function hasRealCaller(inRepo, isTTY) {
+	return inRepo || isTTY;
+}
+/**
+* Initializes `@sentry/node` for this CLI process. Safe to call more than
+* once (idempotent) and safe to call with no DSN configured (no-ops via
+* `buildSentryOptions`, see its header).
+*
+* `command` becomes a `command` tag on every event this process reports, so
+* an issue in Sentry names the subcommand it came from (`db reset`,
+* `deploy platform`, …) without anyone opening the job log first.
+*/
+function initDevtoolsTelemetry(command) {
+	if (initialized) return;
+	initialized = true;
+	if (!devtoolsTelemetryEnabled()) return;
+	if (!hasRealCaller(discoverRepoRoot() !== null, process.stdin.isTTY === true)) return;
+	const options = buildSentryOptions({
+		service: "devtools",
+		environment: devtoolsEnvironment(),
+		dsn: resolveDevtoolsDsn(process.env, bakedSentryDsn()),
+		release: `${cliName()}@${ownVersion()}`
+	});
+	if (!options) return;
+	Sentry.init(options);
+	Sentry.getCurrentScope().setTag("command", command);
+}
+/**
+* Reports an error nothing below the entry points caught — `launch.ts`'s
+* `dispatch`, `launch-ci.ts`, and the bins — then flushes before the process
+* exits. Node's event loop dies with `process.exit`, taking any in-flight
+* request to Sentry's ingest endpoint with it, so the flush must be awaited
+* BEFORE that call — never after.
+*
+* A short timeout: a CLI exiting on error should not hang perceptibly longer
+* because Sentry's ingest is slow or unreachable.
+*/
+async function captureDevtoolsError(err) {
+	noteError(err);
+	if (!devtoolsTelemetryEnabled()) return;
+	sent(Sentry.captureException(err));
+	await Sentry.flush(2e3);
+}
+/**
+* Reports an error a command caught and explained to the reader itself
+* (`explainError` in `ui.ts`, `backstage deploy`'s catch), then carried on
+* to a normal exit. Not flushed: the SDK's in-flight request keeps the event
+* loop alive until it lands, so a natural exit waits for it on its own. A
+* path that ends in `process.exit` instead must use `captureDevtoolsError`.
+*/
+function reportDevtoolsError(err) {
+	noteError(err);
+	if (!devtoolsTelemetryEnabled()) return;
+	sent(Sentry.captureException(err));
+}
+/**
+* Reports a failure that has no error object — a subprocess or deploy step
+* that exited non-zero. Same no-flush contract as `reportDevtoolsError`.
+*/
+function reportDevtoolsFailure(message, extra = {}) {
+	noteError(new Error(message));
+	if (!devtoolsTelemetryEnabled()) return;
+	sent(Sentry.captureMessage(message, {
+		level: "error",
+		extra
+	}));
+}
+/**
+* Reports a warning-level message under a FIXED fingerprint, then flushes.
+*
+* For the deprecated aliases: every use groups into one Sentry issue per
+* fingerprint, so the issue's last-seen time says when the alias stopped
+* being used and is safe to remove. Flushed because the callers go on to
+* `process.exit`, which would otherwise drop the request in flight. The
+* timeout is short: the command being run is what the person came for.
+*/
+async function captureDevtoolsDeprecation(message, fingerprint, tags) {
+	if (!devtoolsTelemetryEnabled()) return;
+	Sentry.captureMessage(message, {
+		level: "warning",
+		fingerprint: [fingerprint],
+		tags
+	});
+	await Sentry.flush(1e3);
+}
+//#endregion
+export { hasRealCaller as a, reportDevtoolsError as c, hasYes as d, isNonInteractive as f, devtoolsTelemetryEnabled as i, reportDevtoolsFailure as l, stripTierFlag as m, captureDevtoolsError as n, initDevtoolsTelemetry as o, stripNoEnvFlag as p, devtoolsEnvironment as r, lastSentryEventId as s, captureDevtoolsDeprecation as t, resolveDevtoolsDsn as u };