@devdogsuga/devtools 0.1.26 → 0.1.28

package/dist/telemetry.js

@@ -1,148 +1,2 @@
-/**
- * devtools' own Sentry wiring — the CLI is a consumer of
- * `@devdogsuga/telemetry` like `apps/platform`, `apps/schedule-builder`, and
- * `apps/sandbox`, but on `@sentry/node` rather than a framework SDK: a CLI
- * process starts, runs one command, and exits, with none of a server's
- * request lifecycle for a framework integration to hook into.
- *
- * ## Reporting is on by default
- *
- * Every other `*_SENTRY_DSN` in this org is optional-and-empty until
- * configured (see `@devdogsuga/telemetry`'s no-op-without-DSN contract), and
- * so is this one — empty means `buildSentryOptions` returns `undefined` and
- * `Sentry.init` never runs — but the DEFAULT here is reporting ON once a DSN
- * exists, unlike a feature a contributor opts into. `DEVTOOLS_TELEMETRY=0` is
- * the one escape hatch, checked before `Sentry.init` and before every capture
- * call, so it also works as a kill switch after init already ran (a
- * long-lived `pnpm devtools` menu session, for instance).
- *
- * ## Where the DSN comes from
- *
- * Baked in at build time, not read from the consumer's environment: devtools
- * runs on contributors' machines, where no `.env` could be relied on to carry
- * it. `scripts/write-build-info.mjs` writes `dist/build-info.json` from the
- * build's `DEVTOOLS_SENTRY_DSN`, which Backstage's `publish.yaml` sets from
- * the repo's Actions variable of the same name. Every other build bakes ""
- * and reports nothing. `DEVTOOLS_SENTRY_DSN` in the run-time environment still
- * wins, for pointing a local build at a test project.
- */
-import { readFileSync } from "node:fs";
-import * as Sentry from "@sentry/node";
-import { buildSentryOptions } from "@devdogsuga/telemetry";
-import { discoverRepoRoot } from "./repo/root.js";
-import { ownVersion } from "./version.js";
-/** The DSN baked into this build, or "" if there is none (a source run under
- * tsx, or a build made without `DEVTOOLS_SENTRY_DSN`). */
-function bakedSentryDsn() {
-    try {
-        const info = JSON.parse(readFileSync(new URL("./build-info.json", import.meta.url), "utf8"));
-        return typeof info.sentryDsn === "string" ? info.sentryDsn : "";
-    }
-    catch {
-        return "";
-    }
-}
-/** The run-time `DEVTOOLS_SENTRY_DSN` if set, else the baked one. */
-export function resolveDevtoolsDsn(env, baked) {
-    // An empty override (`DEVTOOLS_SENTRY_DSN=`) must fall back to the baked DSN.
-    const override = env.DEVTOOLS_SENTRY_DSN ?? "";
-    return override || baked;
-}
-let initialized = false;
-/**
- * `'ci'` in every GitHub Actions job (`CI` is set by the runner itself,
- * before any workflow-authored env), `'local'` on a contributor's machine.
- * One of `@devdogsuga/telemetry`'s `ENVIRONMENTS`.
- */
-export function devtoolsEnvironment() {
-    return process.env.CI ? "ci" : "local";
-}
-/**
- * `DEVTOOLS_TELEMETRY=0` (any other value, including unset, leaves reporting
- * on) is the only opt-out. Checked by both `initDevtoolsTelemetry` (skips
- * `Sentry.init` outright) and `captureDevtoolsError` (so setting it mid-run,
- * or between two invocations in the same process, still works).
- */
-export function devtoolsTelemetryEnabled() {
-    return process.env.DEVTOOLS_TELEMETRY !== "0";
-}
-/**
- * Whether anyone is actually using devtools in this process. Package-registry
- * scanners install every published version within minutes and run it in a
- * throwaway sandbox (random `DESKTOP-xxxxxx` hosts, Firecracker VMs, a fuzzer
- * that turns `process.exit` into a throw). Left unfiltered, each release filed
- * the same two issues from them. They run with no DevDogsUGA checkout and no
- * terminal. A person has at least one of the two (`setup` runs outside a
- * checkout, but in a terminal), and CI always has a checkout.
- */
-export function hasRealCaller(inRepo, isTTY) {
-    return inRepo || isTTY;
-}
-/**
- * Initializes `@sentry/node` for this CLI process. Safe to call more than
- * once (idempotent) and safe to call with no DSN configured (no-ops via
- * `buildSentryOptions`, see its header).
- *
- * `command` becomes a `command` tag on every event this process reports, so
- * an issue in Sentry names the subcommand it came from (`db reset`,
- * `deploy platform`, …) without anyone opening the job log first.
- */
-export function initDevtoolsTelemetry(command) {
-    if (initialized)
-        return;
-    initialized = true;
-    if (!devtoolsTelemetryEnabled())
-        return;
-    if (!hasRealCaller(discoverRepoRoot() !== null, process.stdin.isTTY === true)) {
-        return;
-    }
-    const options = buildSentryOptions({
-        service: "devtools",
-        environment: devtoolsEnvironment(),
-        dsn: resolveDevtoolsDsn(process.env, bakedSentryDsn()),
-        // The published version, so an issue names the release it came from; a
-        // dlx run has no SENTRY_RELEASE of its own.
-        release: `devtools@${ownVersion()}`,
-    });
-    if (!options)
-        return;
-    Sentry.init(options);
-    Sentry.getCurrentScope().setTag("command", command);
-}
-/**
- * Reports an error nothing below the entry points caught — `launch.ts`'s
- * `dispatch`, `launch-ci.ts`, and the bins — then flushes before the process
- * exits. Node's event loop dies with `process.exit`, taking any in-flight
- * request to Sentry's ingest endpoint with it, so the flush must be awaited
- * BEFORE that call — never after.
- *
- * A short timeout: a CLI exiting on error should not hang perceptibly longer
- * because Sentry's ingest is slow or unreachable.
- */
-export async function captureDevtoolsError(err) {
-    if (!devtoolsTelemetryEnabled())
-        return;
-    Sentry.captureException(err);
-    await Sentry.flush(2000);
-}
-/**
- * Reports an error a command caught and explained to the reader itself
- * (`explainError` in `ui.ts`, `devtools-ci deploy`'s catch), then carried on
- * to a normal exit. Not flushed: the SDK's in-flight request keeps the event
- * loop alive until it lands, so a natural exit waits for it on its own. A
- * path that ends in `process.exit` instead must use `captureDevtoolsError`.
- */
-export function reportDevtoolsError(err) {
-    if (!devtoolsTelemetryEnabled())
-        return;
-    Sentry.captureException(err);
-}
-/**
- * Reports a failure that has no error object — a subprocess or deploy step
- * that exited non-zero. Same no-flush contract as `reportDevtoolsError`.
- */
-export function reportDevtoolsFailure(message, extra = {}) {
-    if (!devtoolsTelemetryEnabled())
-        return;
-    Sentry.captureMessage(message, { level: "error", extra });
-}
+import { a as hasRealCaller, c as reportDevtoolsError, i as devtoolsTelemetryEnabled, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, r as devtoolsEnvironment, s as lastSentryEventId, t as captureDevtoolsDeprecation, u as resolveDevtoolsDsn } from "./telemetry-C4foD8MD.js";
+export { captureDevtoolsDeprecation, captureDevtoolsError, devtoolsEnvironment, devtoolsTelemetryEnabled, hasRealCaller, initDevtoolsTelemetry, lastSentryEventId, reportDevtoolsError, reportDevtoolsFailure, resolveDevtoolsDsn };

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@devdogsuga/devtools",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "private": false,
   "type": "module",
-  "description": "Contributor CLI for a DevDogsUGA checkout: database, env, images, emails, cron, deploy. Ships built JS; run via `pnpm dlx @devdogsuga/devtools` (or the `devtools`/`devtools-ci` bins once installed) from inside a DevDogsUGA clone.",
+  "description": "Contributor CLI for a DevDogsUGA checkout: the real tools with the session's tier filled in, a menu over them, and the checks CI runs. Ships built JS; run via `pnpm dlx @devdogsuga/devtools` (or the `devtools` bin once installed) from inside a DevDogsUGA clone.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -15,9 +15,7 @@
     "provenance": true
   },
   "bin": {
-    "devtools": "./bin/devtools.mjs",
-    "devtools-ci": "./bin/devtools-ci.mjs",
-    "devtools-ci-bare": "./bin/devtools-ci-bare.mjs"
+    "devtools": "./bin/devtools.mjs"
   },
   "files": [
     "bin",
@@ -25,59 +23,42 @@
     "env.ts"
   ],
   "dependencies": {
-    "@bitwarden/cli": "2026.7.0",
-    "@bitwarden/sdk-napi": "1.0.0",
     "@clack/prompts": "1.7.0",
-    "@resvg/resvg-js": "^2.6.2",
     "@sentry/node": "10.75.1",
     "@supabase/supabase-js": "^2.112.3",
     "dotenv": "^17.4.2",
     "postgres": "^3.4.9",
-    "satori": "^0.33.4",
-    "sharp": "0.35.3",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "zod": "4.4.3",
-    "@devdogsuga/telemetry": "0.1.2"
+    "@devdogsuga/telemetry": "0.1.3"
   },
   "peerDependencies": {
-    "@devdogsuga/brand": "*",
     "@devdogsuga/db": "*",
-    "@devdogsuga/env": "*",
-    "@devdogsuga/events": "*"
+    "@devdogsuga/env": "*"
   },
   "peerDependenciesMeta": {
-    "@devdogsuga/brand": {
-      "optional": true
-    },
     "@devdogsuga/db": {
       "optional": true
     },
     "@devdogsuga/env": {
       "optional": true
-    },
-    "@devdogsuga/events": {
-      "optional": true
     }
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
-    "@types/react": "^19.2.18",
     "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^9.39.5",
-    "react": "^19.2.8",
+    "tsdown": "^0.23.0",
     "vitest": "^4.1.11",
-    "@devdogsuga/db": "0.1.2",
-    "@devdogsuga/env": "0.1.4",
+    "@devdogsuga/env": "0.1.5",
+    "@devdogsuga/cli-core": "0.0.0",
     "@devdogsuga/config": "0.1.2",
-    "@devdogsuga/events": "0.1.4",
-    "@devdogsuga/brand": "0.1.4"
+    "@devdogsuga/db": "0.1.3"
   },
   "scripts": {
-    "build": "tsc && node scripts/write-build-info.mjs",
+    "build": "tsdown && node scripts/write-build-info.mjs && node ../../scripts/check-bundle-imports.mjs",
     "cli": "node ./bin/devtools.mjs",
-    "ci": "node ./dist/ci.js",
-    "ci:env": "node ./bin/devtools-ci.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.typecheck.json",
     "test": "vitest run",
     "test:watch": "vitest",

package/bin/devtools-ci-bare.mjs

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-/**
- * Entry point for the `devtools-ci-bare` bin: `ci.ts`'s `main()` with no tier
- * resolution and no env-file loading — the counterpart to the old in-repo
- * `"ci": "tsx --conditions=devdogs-source src/ci.ts"` package script.
- *
- * `devtools-ci` (`bin/devtools-ci.mjs` -> `src/launch-ci.ts`) ALWAYS resolves
- * a deploy tier and calls `enterEnvironment` before dispatching to `ci.ts`.
- * That's wrong for two kinds of CI step: `deploy write-env`, which CREATES
- * the env file tier resolution would otherwise insist on reading first (a
- * bootstrap cycle), and the handful of steps that hold one narrow credential
- * via the job's own `env:` block and compose no env file at all (`preflight`,
- * `migrate`, `plan`, `require-planner`, `require-token`, `orphans`). Those
- * steps need `ci.ts`'s `main()` with nothing in front of it.
- *
- * Same technique as `bin/devtools.mjs` and `bin/devtools-ci.mjs` — see
- * `bin/devtools.mjs`'s header — except it imports `dist/ci.js` directly
- * rather than going through a `launch*.ts` wrapper: `ci.ts` has no
- * tier-resolution step to run first, so there is nothing for a wrapper
- * module to do. `dist/ci.js`'s own self-invoke guard
- * (`import.meta.url === file://${process.argv[1]}`) does not fire here —
- * `process.argv[1]` is this bin script, not `dist/ci.js` — so importing it
- * only defines `main`, exactly like `bin/devtools-ci.mjs`'s import of
- * `launch-ci.js` relies on.
- */
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const ciEntry = join(
-  dirname(fileURLToPath(import.meta.url)),
-  "..",
-  "dist",
-  "ci.js",
-);
-
-const { main } = await import(ciEntry);
-try {
-  await main(process.argv.slice(2));
-} catch (err) {
-  process.stderr.write(
-    `devtools-ci-bare: ${err instanceof Error ? err.message : String(err)}\n`,
-  );
-  const { captureDevtoolsError } = await import(
-    join(dirname(fileURLToPath(import.meta.url)), "..", "dist", "telemetry.js")
-  );
-  await captureDevtoolsError(err);
-  process.exitCode = 1;
-}

package/bin/devtools-ci.mjs

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-/**
- * Entry point for the `devtools-ci` bin. Same technique as `bin/devtools.mjs`
- * — see that file's header — pointed at `dist/launch-ci.js` instead.
- */
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const launchCiEntry = join(
-  dirname(fileURLToPath(import.meta.url)),
-  "..",
-  "dist",
-  "launch-ci.js",
-);
-
-const { launchCi } = await import(launchCiEntry);
-try {
-  await launchCi(process.argv.slice(2));
-} catch (err) {
-  // Whatever escapes before a command is dispatched (repo discovery, tier
-  // resolution, env entry) — the dispatch itself reports its own. See
-  // `bin/devtools-ci-bare.mjs` for the same shape.
-  process.stderr.write(
-    `devtools-ci: ${err instanceof Error ? err.message : String(err)}\n`,
-  );
-  const { captureDevtoolsError } = await import(
-    join(dirname(fileURLToPath(import.meta.url)), "..", "dist", "telemetry.js")
-  );
-  await captureDevtoolsError(err);
-  process.exitCode = 1;
-}

package/dist/args.d.ts

@@ -1,26 +0,0 @@
-/**
- * Positional arguments, with flag values excluded.
- *
- * Its own module because of one bug it prevents. The first positional is the
- * subcommand, and `pull`, `push` and `audit` do very different things to live
- * credentials. A naive `filter((a) => !a.startsWith("--"))` reads a flag's
- * VALUE as a positional, so `env --file notes.env audit` fails loudly:
- * `notes.env` is not a subcommand and the command refuses. The quiet version
- * is the one that matters:
- *
- *     env --file push audit
- *
- * which runs `push`, writing to Bitwarden and GitHub, when the caller asked
- * for `audit`, which writes nothing at all.
- */
-/**
- * Flags that consume the token after them.
- *
- * `--env` is here even though nothing accepts it any more. It was this CLI's
- * spelling of `--target` until the two vocabularies behind it were merged, and
- * a stale `env push --env staging` in somebody's shell history must not read
- * `staging` as the subcommand. `cli.ts` rejects the flag by name instead,
- * which says what happened.
- */
-export declare const VALUE_FLAGS: Set<string>;
-export declare function positionals(argv: readonly string[]): string[];

package/dist/args.js

@@ -1,78 +0,0 @@
-/**
- * Positional arguments, with flag values excluded.
- *
- * Its own module because of one bug it prevents. The first positional is the
- * subcommand, and `pull`, `push` and `audit` do very different things to live
- * credentials. A naive `filter((a) => !a.startsWith("--"))` reads a flag's
- * VALUE as a positional, so `env --file notes.env audit` fails loudly:
- * `notes.env` is not a subcommand and the command refuses. The quiet version
- * is the one that matters:
- *
- *     env --file push audit
- *
- * which runs `push`, writing to Bitwarden and GitHub, when the caller asked
- * for `audit`, which writes nothing at all.
- */
-/**
- * Flags that consume the token after them.
- *
- * `--env` is here even though nothing accepts it any more. It was this CLI's
- * spelling of `--target` until the two vocabularies behind it were merged, and
- * a stale `env push --env staging` in somebody's shell history must not read
- * `staging` as the subcommand. `cli.ts` rejects the flag by name instead,
- * which says what happened.
- */
-export const VALUE_FLAGS = new Set([
-    "--access-token",
-    // `qr`: every value flag, so `qr --out poster.png https://…` still reads
-    // the URL as the text and not `poster.png`.
-    "--background",
-    "--color",
-    "--ecl",
-    "--format",
-    // `images`: so `images --format og page/events` reads `og` as the format and
-    // `page/events` as the graphic, not both as graphics.
-    "--format",
-    "--logo",
-    "--logo-padding",
-    "--logo-size",
-    "--margin",
-    "--out",
-    "--size",
-    "--text",
-    "--version",
-    "--app",
-    "--apps",
-    "--base-url",
-    "--env",
-    "--file",
-    "--source",
-    "--target",
-    "--tier",
-    "--cron",
-    "--workflow",
-    "--params",
-    "--port",
-    "--preview-url",
-    "--db-url",
-    "--user",
-    "--filter",
-    "--shell",
-]);
-export function positionals(argv) {
-    const found = [];
-    for (let i = 0; i < argv.length; i += 1) {
-        const arg = argv[i];
-        if (!arg.startsWith("-")) {
-            found.push(arg);
-            continue;
-        }
-        // Skip the value, but only if it looks like one. `--file --yes` is a
-        // mistake, and swallowing `--yes` would turn it into a silent one.
-        const next = argv[i + 1];
-        if (VALUE_FLAGS.has(arg) && next !== undefined && !next.startsWith("-")) {
-            i += 1;
-        }
-    }
-    return found;
-}

package/dist/bws/bw.d.ts

@@ -1,18 +0,0 @@
-/**
- * The `[command, args]` pair that runs the bundled Bitwarden CLI.
- *
- * Runs `build/bw.js` under this Node rather than through a shim, so it works
- * the same wherever devtools is installed. Falls back to `bw` on PATH when the
- * package cannot be resolved, which keeps a missing install surfacing as the
- * ENOENT every caller already handles.
- */
-export declare function bwCommand(args: string[]): [string, string[]];
-/**
- * Runs the Bitwarden CLI with `args`, then exits with its status.
- *
- * Returns a promise that never settles, because every path out of it ends in
- * `process.exit`. That signature is load-bearing rather than pedantic: a
- * `void` return would let the caller carry on and print `outro("Done.")`
- * while `bw login` was still waiting for a master password.
- */
-export declare function runBw(args: string[]): Promise<never>;

package/dist/bws/bw.js

@@ -1,70 +0,0 @@
-/**
- * `pnpm devtools bw …`, the Bitwarden CLI passed through untouched.
- *
- * This is not a command of this CLI wearing a Bitwarden hat. Everything after
- * `bw` goes to the real binary verbatim, and its exit code comes back
- * verbatim, because the thing people actually run is `bw login` and its
- * session handling is Bitwarden's business rather than ours.
- *
- * It exists because `@bitwarden/cli` is a dependency of this package, so the
- * binary sits in devtools' own `node_modules/.bin` and nowhere else. Before
- * this, reaching it meant a root alias (`pnpm bw`) that ran
- * `pnpm --filter @devdogsuga/devtools exec bw`, the last script at the
- * workspace root whose whole job was to reach into this package.
- *
- * ⚠️ The binary is resolved from `@bitwarden/cli` itself, never looked up on
- * PATH. A dependency's bin is only linked into the `node_modules/.bin` of the
- * package that depends on it, so under `pnpm dlx`, or with devtools installed
- * in a clone, nothing puts `bw` on PATH and a bare `spawn("bw")` is ENOENT.
- */
-import { spawn } from "node:child_process";
-import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
-/**
- * The `[command, args]` pair that runs the bundled Bitwarden CLI.
- *
- * Runs `build/bw.js` under this Node rather than through a shim, so it works
- * the same wherever devtools is installed. Falls back to `bw` on PATH when the
- * package cannot be resolved, which keeps a missing install surfacing as the
- * ENOENT every caller already handles.
- */
-export function bwCommand(args) {
-    try {
-        const require_ = createRequire(import.meta.url);
-        const pkgPath = require_.resolve("@bitwarden/cli/package.json");
-        const pkg = require_(pkgPath);
-        return [process.execPath, [join(dirname(pkgPath), pkg.bin.bw), ...args]];
-    }
-    catch {
-        return ["bw", args];
-    }
-}
-/**
- * Runs the Bitwarden CLI with `args`, then exits with its status.
- *
- * Returns a promise that never settles, because every path out of it ends in
- * `process.exit`. That signature is load-bearing rather than pedantic: a
- * `void` return would let the caller carry on and print `outro("Done.")`
- * while `bw login` was still waiting for a master password.
- */
-export function runBw(args) {
-    return new Promise(() => {
-        const child = spawn(...bwCommand(args), { stdio: "inherit" });
-        child.on("error", (err) => {
-            // ENOENT here means the dependency is not installed rather than that the
-            // user mistyped, so say the thing that fixes it.
-            console.error(`bw: ${err.message}\n` +
-                "The Bitwarden CLI ships as a devtools dependency — " +
-                "run `pnpm install` at the repo root.");
-            process.exit(1);
-        });
-        child.on("exit", (code, signal) => {
-            // Re-raise rather than translating to a number: a Ctrl-C in `bw login`
-            // should look to the shell exactly like a Ctrl-C in `bw login`.
-            if (signal)
-                process.kill(process.pid, signal);
-            else
-                process.exit(code ?? 1);
-        });
-    });
-}

package/dist/bws/client.d.ts

@@ -1,43 +0,0 @@
-export declare class BwsError extends Error {
-}
-export interface BwsSecret {
-    id: string;
-    key: string;
-    value: string;
-    note: string;
-    projectId: string;
-    /**
-     * ISO 8601, when this secret last changed.
-     *
-     * Optional because push and pull do not need it. It is the whole basis of
-     * the staleness half of `env audit`, which cannot compare values (GitHub
-     * secrets are write-only) and instead asks whether GitHub was updated after
-     * this.
-     */
-    revisionDate?: string;
-}
-/** Records `--access-token`, before any command runs. */
-export declare function setExplicitAccessToken(token: string | undefined): void;
-/**
- * The access token, found once per process.
- *
- * Memoized as a **promise**, not a value: resolution can prompt, and a single
- * command makes several Secrets Manager calls. Caching the value alone would
- * still let two concurrent calls open two prompts over each other.
- *
- * Whatever the source, the token reaches the SDK as a function argument in
- * this process, never argv, never a child's environment.
- */
-export declare function accessToken(): Promise<string>;
-/** Resolves a project name to its id. Names are unique within an org. */
-export declare function projectIdFor(name: string): Promise<string>;
-export declare function listSecrets(projectId: string): Promise<BwsSecret[]>;
-export declare function createSecret(projectId: string, key: string, value: string, note: string): Promise<void>;
-/**
- * Takes the whole secret rather than an id: the SDK's update is a full
- * replace (organization, key, project list included), and every caller
- * already holds the listed secret it is updating.
- */
-export declare function updateSecret(secret: BwsSecret, value: string, note: string): Promise<void>;
-export declare function deleteSecrets(ids: string[]): Promise<void>;
-export declare function byKey(secrets: BwsSecret[]): Map<string, BwsSecret>;