@devdogsuga/devtools 0.1.41 → 0.1.42

package/dist/{cli-CeCAuSJd.js → cli-BkHyIT5V.js}

@@ -1,9 +1,9 @@
 import { a as cliName, d as positionals, u as flagValue } from "./failure-log-B5GG_8T1.js";
-import { C as helpPath, S as catalog, T as renderHelp, _ as bail, a as recordEnteredTier, b as explainError, c as describeEnvironment, d as resolveDbConnection, f as sessionIsLocal, i as beginInvocation, l as probeEnvironment, n as bareGroupStartPath, o as recordResolved, p as sessionLabel, r as runMenu, s as reproducibleCommand, t as bareGroupStartFlags, u as nonEmpty, v as errorMessage, w as renderCommandList, x as unwrap, y as explain } from "./menu-Craj11Sn.js";
+import { C as helpPath, S as catalog, T as renderHelp, _ as bail, a as recordEnteredTier, b as explainError, c as describeEnvironment, d as resolveDbConnection, f as sessionIsLocal, i as beginInvocation, l as probeEnvironment, n as bareGroupStartPath, o as recordResolved, p as sessionLabel, r as runMenu, s as reproducibleCommand, t as bareGroupStartFlags, u as nonEmpty, v as errorMessage, w as renderCommandList, x as unwrap, y as explain } from "./menu-DXT1ICTI.js";
 import { _ as dryRunKind, c as reportRuns, f as supabase, g as runInGroup, h as reportRan, l as run$1, s as dbPush, u as runWithStderr, v as isDryRun, x as wouldRunLine } from "./supabase-project-Bw8sBFcE.js";
 import { a as ownVersion, n as discoverRepoRoot, r as findRepoRoot } from "./root-C2OmZDwD.js";
 import { i as loadEnvSession, n as loadEnv, r as loadEnvLoad, t as getEnvSync } from "./peers-RBplwovA.js";
-import { d as hasYes, f as isNonInteractive, n as captureDevtoolsError, o as initDevtoolsTelemetry, r as devtoolsEnvironment, t as captureDevtoolsDeprecation } from "./telemetry-Do13RFhc.js";
+import { d as hasYes, f as isNonInteractive, n as captureDevtoolsError, o as initDevtoolsTelemetry, r as devtoolsEnvironment, t as captureDevtoolsDeprecation } from "./telemetry-xNMpvX5K.js";
 import { n as assertRegistryLoaded, r as loadRegistry, t as scopedProcessEnv } from "./local-env-hH4encfD.js";
 import { t as runStackCommand } from "./stack-7PuRcaI2.js";
 import { cancel, confirm, intro, isCancel, log, multiselect, note, outro, password, select, spinner, text } from "@clack/prompts";
@@ -1931,7 +1931,7 @@ function targetHeader(target, count) {
 		"#",
 		...comment(`The ${count} key${count === 1 ? "" : "s"} a \`pnpm devtools env push --target ${target}\` routes, and nothing else. The committed defaults and the per-developer values go nowhere, and a minted credential is signed at deploy time rather than stored, so none of the three has a line here to fill in.`),
 		"#",
-		...comment(target === "production" ? "The apply-tier credential IS here — SUPABASE_ACCESS_TOKEN reaches the production-apply GitHub environment, and no other target carries it." : `The apply-tier credential is NOT here. It exists to reshape production, so a copy in ${target} would be a second write-capable token to rotate for no benefit — and \`env push\` skips it outside production anyway.`),
+		...comment(target === "production" ? "The apply-tier credential IS here — SUPABASE_ACCESS_TOKEN reaches the production GitHub environment, and no other target carries it." : `The apply-tier credential is NOT here. It exists to reshape production, so a copy in ${target} would be a second write-capable token to rotate for no benefit — and \`env push\` skips it outside production anyway.`),
 		"#",
 		...comment(`Fill the values in, or run \`pnpm devtools env pull --target ${target}\` to fetch what Bitwarden already holds. Nothing is commented out: push reads assignments, and a commented line is not one — a value typed on it would be silently skipped.`),
 		"#",

package/dist/launch.js

@@ -1,9 +1,9 @@
 import { a as cliName, t as installFailureLog } from "./failure-log-B5GG_8T1.js";
-import { C as helpPath, S as catalog, _ as bail, g as setMenuEnvHook, h as realEnvEntryDeps, m as enterSessionEnvironment, n as bareGroupStartPath, u as nonEmpty, v as errorMessage, x as unwrap } from "./menu-Craj11Sn.js";
+import { C as helpPath, S as catalog, _ as bail, g as setMenuEnvHook, h as realEnvEntryDeps, m as enterSessionEnvironment, n as bareGroupStartPath, u as nonEmpty, v as errorMessage, x as unwrap } from "./menu-DXT1ICTI.js";
 import { b as setDryRun, m as formatCommand, v as isDryRun, y as resolveDryRun } from "./supabase-project-Bw8sBFcE.js";
 import { n as discoverRepoRoot, r as findRepoRoot, t as RepoNotFoundError } from "./root-C2OmZDwD.js";
 import { i as loadEnvSession, r as loadEnvLoad } from "./peers-RBplwovA.js";
-import { d as hasYes, f as isNonInteractive, m as stripTierFlag, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as stripNoEnvFlag, s as lastSentryEventId } from "./telemetry-Do13RFhc.js";
+import { d as hasYes, f as isNonInteractive, m as stripTierFlag, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as stripNoEnvFlag, s as lastSentryEventId } from "./telemetry-xNMpvX5K.js";
 import { confirm, select } from "@clack/prompts";
 //#region ../cli-core/src/session.ts
 /**
@@ -166,7 +166,7 @@ async function startStack() {
 * post-tier-resolution path.
 */
 async function dispatch(argv) {
-	const { main } = await import("./cli-CeCAuSJd.js");
+	const { main } = await import("./cli-BkHyIT5V.js");
 	try {
 		await main(argv);
 	} catch (err) {

package/dist/{menu-Craj11Sn.js → menu-DXT1ICTI.js}

@@ -2,7 +2,7 @@ import { c as YES, d as positionals, i as suppressFailureLog, l as createCatalog
 import { a as listContainerNames, i as foreignStackProjectId, n as containerPrefix, o as readProjectId, p as supabaseCapture, r as foreignStackMessage, t as STACK_API_PORT } from "./supabase-project-Bw8sBFcE.js";
 import { r as findRepoRoot } from "./root-C2OmZDwD.js";
 import { n as loadEnv, r as loadEnvLoad } from "./peers-RBplwovA.js";
-import { c as reportDevtoolsError, f as isNonInteractive } from "./telemetry-Do13RFhc.js";
+import { c as reportDevtoolsError, f as isNonInteractive } from "./telemetry-xNMpvX5K.js";
 import { cancel, confirm, isCancel, log, note, select, text } from "@clack/prompts";
 import { existsSync } from "node:fs";
 import { writeFile } from "node:fs/promises";

package/dist/{telemetry-Do13RFhc.js → telemetry-xNMpvX5K.js}

@@ -2,7 +2,7 @@ import { a as cliName, n as noteError } from "./failure-log-B5GG_8T1.js";
 import { a as ownVersion, n as discoverRepoRoot } from "./root-C2OmZDwD.js";
 import { readFileSync } from "node:fs";
 import * as Sentry from "@sentry/node";
-import { buildSentryOptions } from "@devdogsuga/telemetry";
+import "@sentry/core";
 //#region ../cli-core/src/mode.ts
 /**
 * Non-interactive mode: the one definition both published CLIs share.
@@ -75,6 +75,142 @@ function stripTierFlag(argv) {
 	};
 }
 //#endregion
+//#region ../telemetry/dist/constants.js
+/**
+* `tracesSampleRate` by environment. Every environment not listed samples at
+* 0 — that is the "else 0" branch, not an omission, and covers `development`,
+* `ci`, and `local` today without needing an entry each.
+*/
+const TRACES_SAMPLE_RATE_BY_ENVIRONMENT = {
+	production: .2,
+	staging: .05
+};
+function tracesSampleRateFor(environment) {
+	return TRACES_SAMPLE_RATE_BY_ENVIRONMENT[environment] ?? 0;
+}
+/**
+* Tag keys every surface should spell the same way, so a Sentry search for
+* `service:platform` or `alert:true` works regardless of which app or
+* package produced the event.
+*/
+const TAG_KEYS = {
+	/** Which of {@link SERVICES} produced the event. */
+	SERVICE: "service",
+	/** Set to `"true"` on every event sent through {@link alert}. */
+	ALERT: "alert"
+};
+//#endregion
+//#region ../telemetry/dist/scrub.js
+/**
+* Pure scrubbing functions plus the `beforeSend` that composes them.
+*
+* Every function here operates on plain strings or a plain `Event` object —
+* no Sentry client, no network, nothing that needs a DSN to unit-test.
+*/
+const POSIX_PATH = /(?<=^|[\s"'(<])\/(?:[^\s"'()<>:]+\/)+([^\s"'()<>:]+)/g;
+const WINDOWS_PATH = /[A-Za-z]:\\(?:[^\s"'()<>]+\\)*([^\s"'()<>]+)/g;
+/** Replaces absolute filesystem paths in `text` with just their basename. */
+function scrubPaths(text) {
+	return text.replace(WINDOWS_PATH, "$1").replace(POSIX_PATH, "$1");
+}
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+/** Redacts anything that looks like an email address. */
+function scrubEmails(text) {
+	return text.replace(EMAIL, "[redacted-email]");
+}
+const ENV_ASSIGNMENT = /\b([A-Z][A-Z0-9_]{2,}(?:_KEY|_TOKEN|_SECRET|_PASSWORD)\w*)=[^\s"'`)]+/g;
+const BEARER_TOKEN = /\b[Bb]earer\s+[A-Za-z0-9._-]+/g;
+/** Redacts env-var-style assignments and bearer tokens. */
+function scrubSecrets(text) {
+	return text.replace(ENV_ASSIGNMENT, "$1=[redacted]").replace(BEARER_TOKEN, "Bearer [redacted]");
+}
+/** Runs all three text scrubbers, in order. */
+function scrubText(text) {
+	return scrubSecrets(scrubEmails(scrubPaths(text)));
+}
+function scrubFrame(frame) {
+	return {
+		...frame,
+		filename: frame.filename ? scrubText(frame.filename) : frame.filename,
+		abs_path: frame.abs_path ? scrubText(frame.abs_path) : frame.abs_path,
+		context_line: frame.context_line ? scrubText(frame.context_line) : frame.context_line
+	};
+}
+function scrubException(exception) {
+	return {
+		...exception,
+		value: exception.value ? scrubText(exception.value) : exception.value,
+		stacktrace: exception.stacktrace ? {
+			...exception.stacktrace,
+			frames: exception.stacktrace.frames?.map(scrubFrame)
+		} : exception.stacktrace
+	};
+}
+/**
+* Applies every scrubber to the parts of an event that carry free text:
+* the top-level message, each exception's message and stack frames, and
+* breadcrumb messages. Never returns `null` — this is a scrub, not a filter;
+* see {@link browserNoiseFilter} in `./browser-filter.ts` for dropping
+* events outright.
+*/
+function scrubEvent(event, _hint) {
+	return {
+		...event,
+		message: event.message ? scrubText(event.message) : event.message,
+		exception: event.exception ? { values: event.exception.values?.map(scrubException) } : event.exception,
+		breadcrumbs: event.breadcrumbs?.map((crumb) => crumb.message ? {
+			...crumb,
+			message: scrubText(crumb.message)
+		} : crumb)
+	};
+}
+//#endregion
+//#region ../telemetry/dist/options.js
+/**
+* Chains `beforeSend`-shaped functions left to right, short-circuiting the
+* moment one drops the event. Used to compose the shared scrubbers with a
+* consumer's own additions (e.g. {@link browserNoiseFilter} on the browser
+* side only) without every consumer re-implementing the chaining.
+*/
+function composeBeforeSend(...fns) {
+	return (event, hint) => {
+		let current = event;
+		for (const fn of fns) {
+			if (current === null) return null;
+			current = fn(current, hint);
+		}
+		return current;
+	};
+}
+/**
+* The options every `Sentry.init()` call in the workspace shares: DSN,
+* environment, release passthrough, the sample-rate table, Sentry Logs, PII
+* off by default, and the scrubbing `beforeSend` chain.
+*
+* Returns `undefined` when `dsn` is falsy, so every consumer can write
+* `const opts = buildSentryOptions(...); if (opts) Sentry.init(opts);` and
+* no-op cleanly with no DSN configured (the normal case in local dev).
+*
+* The return type is `@sentry/core`'s `Options` (`CoreOptions`) — the
+* options shape shared by `@sentry/node`, `@sentry/cloudflare`, and
+* `@sentry/nextjs`'s `init()` calls alike, so this same object is valid
+* input to any of them.
+*/
+function buildSentryOptions({ service, environment, dsn, release, extraBeforeSend = [] }) {
+	if (!dsn) return void 0;
+	return {
+		dsn,
+		environment,
+		release,
+		tracesSampleRate: tracesSampleRateFor(environment),
+		sampleRate: 1,
+		enableLogs: true,
+		sendDefaultPii: false,
+		initialScope: { tags: { [TAG_KEYS.SERVICE]: service } },
+		beforeSend: composeBeforeSend(scrubEvent, ...extraBeforeSend)
+	};
+}
+//#endregion
 //#region ../cli-core/src/telemetry.ts
 /**
 * devtools' own Sentry wiring — the CLI is a consumer of

package/dist/telemetry.js

@@ -1,2 +1,2 @@
-import { a as hasRealCaller, c as reportDevtoolsError, i as devtoolsTelemetryEnabled, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, r as devtoolsEnvironment, s as lastSentryEventId, t as captureDevtoolsDeprecation, u as resolveDevtoolsDsn } from "./telemetry-Do13RFhc.js";
+import { a as hasRealCaller, c as reportDevtoolsError, i as devtoolsTelemetryEnabled, l as reportDevtoolsFailure, n as captureDevtoolsError, o as initDevtoolsTelemetry, r as devtoolsEnvironment, s as lastSentryEventId, t as captureDevtoolsDeprecation, u as resolveDevtoolsDsn } from "./telemetry-xNMpvX5K.js";
 export { captureDevtoolsDeprecation, captureDevtoolsError, devtoolsEnvironment, devtoolsTelemetryEnabled, hasRealCaller, initDevtoolsTelemetry, lastSentryEventId, reportDevtoolsError, reportDevtoolsFailure, resolveDevtoolsDsn };

package/env.ts

@@ -50,7 +50,7 @@ declare({
         "A Supabase personal access token, carrying full account privileges " +
         "across both Supabase organizations. Only `supabase config push` " +
         "needs it -- the one mutation with no dry run -- so in GitHub it " +
-        "reaches the production-apply environment only, behind required " +
+        "reaches the production environment only, behind required " +
         "reviewers.",
       scope: "environment",
       secrecy: "secret",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/devtools",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "private": false,
   "type": "module",
   "description": "Contributor CLI for a DevDogsUGA checkout: the real tools with the session's tier filled in, a menu over them, and the checks CI runs. Ships built JS; run via `pnpm dlx @devdogsuga/devtools` (or the `devtools` bin once installed) from inside a DevDogsUGA clone.",
@@ -24,14 +24,14 @@
   ],
   "dependencies": {
     "@clack/prompts": "1.7.0",
+    "@sentry/core": "10.75.1",
     "@sentry/node": "10.75.1",
     "@supabase/supabase-js": "^2.112.3",
     "dotenv": "^17.4.2",
     "postgres": "^3.4.9",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "zod": "4.4.3",
-    "@devdogsuga/telemetry": "0.1.5"
+    "zod": "4.4.3"
   },
   "peerDependencies": {
     "@devdogsuga/db": "*",
@@ -52,9 +52,10 @@
     "tsdown": "^0.23.0",
     "vitest": "^4.1.11",
     "@devdogsuga/cli-core": "0.0.0",
-    "@devdogsuga/config": "0.1.3",
+    "@devdogsuga/env": "0.1.6",
     "@devdogsuga/db": "0.1.4",
-    "@devdogsuga/env": "0.1.6"
+    "@devdogsuga/config": "0.1.3",
+    "@devdogsuga/telemetry": "0.1.5"
   },
   "scripts": {
     "build": "tsdown && node scripts/write-build-info.mjs && node ../../scripts/check-bundle-imports.mjs",