chore: pre-shape repo into pnpm-workspace monorepo layout

Reshape the CLI repo into a pnpm workspace so it can be cleanly
git-subtree-imported into the future getsentry/toolkit monorepo
(#1238, part of #1248).

Layout:
- Move the CLI package into packages/cli/ (src, test, script, patches,
  plugins, install, configs, package.json).
- Move docs/ into apps/cli-docs/.
- Keep GitHub/Craft-read files at the repo root (.github/, .craft.yml,
  LICENSE, CHANGELOG, .gitignore, .nojekyll) so the repo stays fully
  operational (releases + nightlies) through and after the merge.
- Add pnpm-workspace.yaml (packages/* + apps/*) and a thin delegating
  root package.json that forwards scripts to the sentry package and
  hoists the pnpm block (patchedDependencies now reference
  packages/cli/patches/**).
- Add a minimal root README; the CLI README moves to packages/cli/.

Internal path fixes:
- Shared script/paths.ts (DOCS_ROOT etc.) for cross-package doc paths;
  generate/check scripts updated to use it.
- Re-point apps/cli-docs public symlinks (install, skill files) to the
  new packages/cli/ locations.
- build.ts / bundle.ts resolve @sentry/symbolic WASM via module
  resolution and invoke fossilize via `pnpm exec` (both hoist to the
  workspace root now).
- biome.jsonc + packages/cli/.gitignore so Biome finds an ignore file.
- .gitignore path-anchored entries updated to the nested layout.

Workflows / release (kept root-relative where GitHub/Craft require it):
- ci.yml, docs-preview.yml, eval-skill-fork.yml: paths-filter globs,
  node_modules cache paths, patches hashFiles glob, artifact paths
  (packages/cli/dist-bin, apps/cli-docs/dist), docs working-directory,
  package.json version reads, npm pack dir.
- .craft.yml pre/post release commands cd into packages/cli.

node-linker=isolated (was hoisted): under the workspace, hoisted mode
let an unpatched transitive @sentry/core@10.65.0 (via
@spotlightjs/spotlight -> @sentry/node) win the flat hoist over the
patched direct @sentry/core@10.63.0, so the CLI bundled the unpatched
copy (masked only by esbuild tree-shaking). isolated mode keeps
per-package variants so the patched copy is used. check-patches.ts now
reads patchedDependencies from the workspace root and resolves the
package copy the CLI actually links via require.resolve.

Verified: typecheck, lint, all check:* scripts, build (+ binary smoke,
patched bundle), and the full unit suite (399 files, 8474 passed).

Author: BYK

.craft.yml

@@ -3,8 +3,8 @@ changelog:
   policy: auto
 versioning:
   policy: auto
-preReleaseCommand: node --experimental-strip-types script/bump-version.ts --pre
-postReleaseCommand: node --experimental-strip-types script/bump-version.ts --post
+preReleaseCommand: bash -c 'cd packages/cli && node --experimental-strip-types script/bump-version.ts --pre'
+postReleaseCommand: bash -c 'cd packages/cli && node --experimental-strip-types script/bump-version.ts --post'
 artifactProvider:
   name: github
   config:

.github/workflows/ci.yml

@@ -61,24 +61,24 @@ jobs:
         with:
           filters: |
             skill:
-              - 'src/**'
-              - 'docs/**'
-              - 'package.json'
-              - 'README.md'
-              - 'DEVELOPMENT.md'
-              - 'script/generate-skill.ts'
-              - 'script/generate-command-docs.ts'
-              - 'script/generate-docs-sections.ts'
-              - 'script/eval-skill.ts'
-              - 'test/skill-eval/**'
+              - 'packages/cli/src/**'
+              - 'apps/cli-docs/**'
+              - 'packages/cli/package.json'
+              - 'packages/cli/README.md'
+              - 'packages/cli/DEVELOPMENT.md'
+              - 'packages/cli/script/generate-skill.ts'
+              - 'packages/cli/script/generate-command-docs.ts'
+              - 'packages/cli/script/generate-docs-sections.ts'
+              - 'packages/cli/script/eval-skill.ts'
+              - 'packages/cli/test/skill-eval/**'
             code:
-              - 'src/**'
-              - 'test/**'
-              - 'script/**'
-              - 'patches/**'
-              - 'docs/**'
-              - 'plugins/**'
-              - 'package.json'
+              - 'packages/cli/src/**'
+              - 'packages/cli/test/**'
+              - 'packages/cli/script/**'
+              - 'packages/cli/patches/**'
+              - 'apps/cli-docs/**'
+              - 'packages/cli/plugins/**'
+              - 'packages/cli/package.json'
               - 'pnpm-lock.yaml'
               - '.github/workflows/ci.yml'
             codemod:
@@ -113,7 +113,7 @@ jobs:
         if: github.ref == 'refs/heads/main' && github.event_name == 'push'
         run: |
           TS=$(date -d "$COMMIT_TIMESTAMP" +%s)
-          CURRENT=$(jq -r .version package.json)
+          CURRENT=$(jq -r .version packages/cli/package.json)
           VERSION=$(echo "$CURRENT" | sed "s/-dev\.[0-9]*$/-dev.${TS}/")
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Nightly version: ${VERSION}"
@@ -163,8 +163,11 @@ jobs:
       - uses: actions/cache@v5
         id: cache
         with:
-          path: node_modules
-          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'patches/**') }}
+          path: |
+            node_modules
+            packages/*/node_modules
+            apps/*/node_modules
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
         run: pnpm install --frozen-lockfile
       - name: Generate API Schema
@@ -218,8 +221,11 @@ jobs:
       - uses: actions/cache@v5
         id: cache
         with:
-          path: node_modules
-          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'patches/**') }}
+          path: |
+            node_modules
+            packages/*/node_modules
+            apps/*/node_modules
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
         run: pnpm install --frozen-lockfile
       - run: pnpm run generate:schema
@@ -249,8 +255,11 @@ jobs:
       - uses: actions/cache@v5
         id: cache
         with:
-          path: node_modules
-          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'patches/**') }}
+          path: |
+            node_modules
+            packages/*/node_modules
+            apps/*/node_modules
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
         run: pnpm install --frozen-lockfile
       - name: Generate API Schema
@@ -284,8 +293,11 @@ jobs:
       - uses: actions/cache@v5
         id: cache
         with:
-          path: node_modules
-          key: node-modules-${{ matrix.os }}-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'patches/**') }}
+          path: |
+            node_modules
+            packages/*/node_modules
+            apps/*/node_modules
+          key: node-modules-${{ matrix.os }}-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}
       - name: Install dependencies
         if: steps.cache.outputs.cache-hit != 'true'
         shell: bash
@@ -331,8 +343,8 @@ jobs:
         if: needs.changes.outputs.nightly-version != ''
         shell: bash
         run: |
-          jq --arg v "${{ needs.changes.outputs.nightly-version }}" '.version = $v' package.json > package.json.tmp
-          mv package.json.tmp package.json
+          jq --arg v "${{ needs.changes.outputs.nightly-version }}" '.version = $v' packages/cli/package.json > packages/cli/package.json.tmp
+          mv packages/cli/package.json.tmp packages/cli/package.json
       - name: Build
         env:
           # Environment-scoped (production) — must be set at step level to
@@ -351,9 +363,9 @@ jobs:
         shell: bash
         run: |
           if [[ "${{ matrix.target }}" == "windows-x64" ]]; then
-            ./dist-bin/sentry-windows-x64.exe --help
+            ./packages/cli/dist-bin/sentry-windows-x64.exe --help
           else
-            ./dist-bin/sentry-${{ matrix.target }} --help
+            ./packages/cli/dist-bin/sentry-${{ matrix.target }} --help
           fi
       - name: Smoke test (deep — SQLite, telemetry, auth DB)
         if: matrix.can-test
@@ -363,9 +375,9 @@ jobs:
           SENTRY_TOKEN: ""
         run: |
           if [[ "${{ matrix.target }}" == "windows-x64" ]]; then
-            BIN=./dist-bin/sentry-windows-x64.exe
+            BIN=./packages/cli/dist-bin/sentry-windows-x64.exe
           else
-            BIN=./dist-bin/sentry-${{ matrix.target }}
+            BIN=./packages/cli/dist-bin/sentry-${{ matrix.target }}
           fi
           # auth status without a token exercises SQLite init, schema
           # migrations, telemetry lazy import, and the CJS require chain.
@@ -391,23 +403,23 @@ jobs:
           (github.ref_name == 'main' || startsWith(github.ref_name, 'release/'))
         shell: bash
         run: |
-          BIN=./dist-bin/sentry-${{ matrix.target }}
+          BIN=./packages/cli/dist-bin/sentry-${{ matrix.target }}
           echo "Verifying code signature on $BIN..."
           rcodesign verify "$BIN"
       - name: Upload binary artifact
         uses: actions/upload-artifact@v7
         with:
           name: sentry-${{ matrix.target }}
           path: |
-            dist-bin/sentry-*
-            !dist-bin/*.gz
+            packages/cli/dist-bin/sentry-*
+            !packages/cli/dist-bin/*.gz
 
       - name: Upload compressed artifact
         if: github.event_name != 'pull_request'
         uses: actions/upload-artifact@v7
         with:
           name: sentry-${{ matrix.target }}-gz
-          path: dist-bin/*.gz
+          path: packages/cli/dist-bin/*.gz
 
   generate-patches:
     name: Generate Delta Patches
@@ -748,8 +760,11 @@ jobs:
       - uses: actions/cache@v5
         id: cache
         with:
-          path: node_modules
-          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'patches/**') }}
+          path: |
+            node_modules
+            packages/*/node_modules
+            apps/*/node_modules
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
         run: pnpm install --frozen-lockfile
       - name: Download Linux binary
@@ -790,8 +805,11 @@ jobs:
       - uses: actions/cache@v5
         id: cache
         with:
-          path: node_modules
-          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'patches/**') }}
+          path: |
+            node_modules
+            packages/*/node_modules
+            apps/*/node_modules
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
         run: pnpm install --frozen-lockfile
       - name: Bundle
@@ -800,7 +818,7 @@ jobs:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
         run: pnpm run bundle
       - name: Smoke test (Node.js)
-        run: node dist/bin.cjs --help
+        run: node packages/cli/dist/bin.cjs --help
       - name: Smoke test (Node.js — deep)
         shell: bash
         env:
@@ -810,7 +828,7 @@ jobs:
           # auth status without a token exercises SQLite init, schema
           # migrations, telemetry lazy import, and the CJS require chain.
           # Expected: exit 10 (AUTH_NOT_AUTHENTICATED), NOT a crash/syntax error.
-          OUTPUT=$(node dist/bin.cjs auth status 2>&1) && EXIT_CODE=$? || EXIT_CODE=$?
+          OUTPUT=$(node packages/cli/dist/bin.cjs auth status 2>&1) && EXIT_CODE=$? || EXIT_CODE=$?
           if [[ $EXIT_CODE -ne 10 ]]; then
             echo "::error::Expected exit code 10 (not authenticated), got $EXIT_CODE"
             echo "$OUTPUT"
@@ -822,12 +840,13 @@ jobs:
             exit 1
           fi
       - run: npm pack
+        working-directory: packages/cli
       - name: Upload artifact
         if: matrix.node == '22'
         uses: actions/upload-artifact@v7
         with:
           name: npm-package
-          path: "*.tgz"
+          path: "packages/cli/*.tgz"
 
   build-docs:
     name: Build Docs
@@ -853,13 +872,16 @@ jobs:
       - uses: actions/cache@v5
         id: cache
         with:
-          path: node_modules
-          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'patches/**') }}
+          path: |
+            node_modules
+            packages/*/node_modules
+            apps/*/node_modules
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}
       - if: steps.cache.outputs.cache-hit != 'true'
         run: pnpm install --frozen-lockfile
       - name: Get CLI version
         id: version
-        run: echo "version=$(node -p 'require("./package.json").version')" >> "$GITHUB_OUTPUT"
+        run: echo "version=$(node -p 'require("./packages/cli/package.json").version')" >> "$GITHUB_OUTPUT"
       - name: Download compiled CLI binary
         uses: actions/download-artifact@v8
         with:
@@ -870,7 +892,7 @@ jobs:
       - name: Generate docs content
         run: pnpm run generate:schema && pnpm run generate:docs
       - name: Build Docs
-        working-directory: docs
+        working-directory: apps/cli-docs
         env:
           PUBLIC_SENTRY_ENVIRONMENT: production
           SENTRY_RELEASE: ${{ steps.version.outputs.version }}
@@ -887,18 +909,18 @@ jobs:
           SENTRY_ORG: sentry
           SENTRY_PROJECT: cli-website
         run: |
-          ./dist-bin/sentry-linux-x64 sourcemap inject docs/dist/
-          ./dist-bin/sentry-linux-x64 sourcemap upload docs/dist/ \
+          ./dist-bin/sentry-linux-x64 sourcemap inject apps/cli-docs/dist/
+          ./dist-bin/sentry-linux-x64 sourcemap upload apps/cli-docs/dist/ \
             --release "${{ steps.version.outputs.version }}" \
             --url-prefix "~/"
       # Remove .map files — they were uploaded to Sentry but shouldn't
       # be deployed to production.
       - name: Remove sourcemaps from output
-        run: find docs/dist -name '*.map' -delete
+        run: find apps/cli-docs/dist -name '*.map' -delete
       - name: Package Docs
         run: |
-          cp .nojekyll docs/dist/
-          cd docs/dist && zip -r ../../gh-pages.zip .
+          cp .nojekyll apps/cli-docs/dist/
+          cd apps/cli-docs/dist && zip -r "$GITHUB_WORKSPACE/gh-pages.zip" .
       - name: Upload docs artifact
         uses: actions/upload-artifact@v7
         with:

.github/workflows/docs-preview.yml

@@ -4,11 +4,11 @@ on:
   push:
     branches: [main]
     paths:
-      - 'docs/**'
-      - 'src/**'
-      - 'script/generate-command-docs.ts'
-      - 'script/generate-skill.ts'
-      - 'install'
+      - 'apps/cli-docs/**'
+      - 'packages/cli/src/**'
+      - 'packages/cli/script/generate-command-docs.ts'
+      - 'packages/cli/script/generate-skill.ts'
+      - 'packages/cli/install'
       - '.github/workflows/docs-preview.yml'
   pull_request:
     # No paths filter here: the 'closed' event must ALWAYS fire so
@@ -48,11 +48,11 @@ jobs:
         with:
           filters: |
             docs:
-              - 'docs/**'
-              - 'src/**'
-              - 'script/generate-command-docs.ts'
-              - 'script/generate-skill.ts'
-              - 'install'
+              - 'apps/cli-docs/**'
+              - 'packages/cli/src/**'
+              - 'packages/cli/script/generate-command-docs.ts'
+              - 'packages/cli/script/generate-skill.ts'
+              - 'packages/cli/install'
               - '.github/workflows/docs-preview.yml'
 
       # Central gate. `build` = produce the site (push, or a docs PR being
@@ -93,24 +93,27 @@ jobs:
         id: cache
         if: steps.gate.outputs.build == 'true'
         with:
-          path: node_modules
-          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'patches/**') }}
+          path: |
+            node_modules
+            packages/*/node_modules
+            apps/*/node_modules
+          key: node-modules-${{ hashFiles('pnpm-lock.yaml', '.npmrc', 'packages/cli/patches/**') }}
 
       - if: steps.gate.outputs.build == 'true' && steps.cache.outputs.cache-hit != 'true'
         run: pnpm install --frozen-lockfile
 
       - name: Get CLI version
         id: version
         if: steps.gate.outputs.build == 'true'
-        run: echo "version=$(node -p 'require("./package.json").version')" >> "$GITHUB_OUTPUT"
+        run: echo "version=$(node -p 'require("./packages/cli/package.json").version')" >> "$GITHUB_OUTPUT"
 
       - name: Generate docs content
         if: steps.gate.outputs.build == 'true'
         run: pnpm run generate:schema && pnpm run generate:docs
 
       - name: Build Docs for Preview
         if: steps.gate.outputs.build == 'true'
-        working-directory: docs
+        working-directory: apps/cli-docs
         env:
           DOCS_BASE_PATH: ${{ github.event_name == 'push'
             && '/_preview/pr-main'
@@ -129,15 +132,15 @@ jobs:
           SENTRY_ORG: sentry
           SENTRY_PROJECT: cli-website
         run: |
-          pnpm run cli sourcemap inject docs/dist/
-          pnpm run cli sourcemap upload docs/dist/ \
+          pnpm run cli sourcemap inject "$GITHUB_WORKSPACE/apps/cli-docs/dist/"
+          pnpm run cli sourcemap upload "$GITHUB_WORKSPACE/apps/cli-docs/dist/" \
             --release "${{ steps.version.outputs.version }}" \
             --url-prefix "~/"
 
       # Remove .map files — uploaded to Sentry but shouldn't be deployed.
       - name: Remove sourcemaps from output
         if: steps.gate.outputs.build == 'true'
-        run: find docs/dist -name '*.map' -delete
+        run: find apps/cli-docs/dist -name '*.map' -delete
 
       - name: Ensure .nojekyll at gh-pages root
         # Runs whenever we deploy (build or a 'closed' cleanup), but never for
@@ -180,7 +183,7 @@ jobs:
         if: steps.gate.outputs.deploy == 'true'
         uses: rossjrw/pr-preview-action@v1
         with:
-          source-dir: docs/dist/
+          source-dir: apps/cli-docs/dist/
           preview-branch: gh-pages
           umbrella-dir: _preview
           pages-base-url: cli.sentry.dev