refactor: convert Tier 2-3 commands to return-based output and consola

Convert remaining non-streaming commands away from direct stdout/stderr
writes, continuing the output convergence started in #382.

Return-based output (OutputConfig<T>):
- project/view, log/view: pure formatter functions, return { data, hint }
- org/list, trace/list: return structured data with human formatters
- Add jsonTransform to OutputConfig for custom JSON envelopes (trace/list)
- Widen buildListCommand to accept OutputConfig alongside "json"

Consola logging:
- auth/login, logout, status: logger.withTag("auth.*"), log.info/success/warn
- cli/feedback, setup, fix, upgrade: logger.withTag("cli.*")
- api.ts: remove stderr: Writer param from 4 helper functions

Infrastructure:
- OutputConfig<T> gains jsonTransform property for envelope wrapping
- ListCommandFunction type allows unknown returns

All tests updated to spy on process.stderr.write (consola target) instead
of mock context stdout/stderr. 26 files changed across src and test.

Author: BYK

src/commands/api.ts

@@ -12,7 +12,8 @@ import { OutputError, ValidationError } from "../lib/errors.js";
 import { validateEndpoint } from "../lib/input-validation.js";
 import { logger } from "../lib/logger.js";
 import { getDefaultSdkConfig } from "../lib/sentry-client.js";
-import type { Writer } from "../types/index.js";
+
+const log = logger.withTag("api");
 
 type HttpMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
 
@@ -309,7 +310,7 @@ export function setNestedValue(
 
 /**
  * Auto-correct fields that use ':' instead of '=' as the separator, and warn
- * the user on stderr.
+ * the user via the module logger.
  *
  * This recovers from a common mistake where users write Sentry search-query
  * style syntax (`-F status:resolved`) instead of the required key=value form
@@ -325,14 +326,12 @@ export function setNestedValue(
  * downstream parser can throw its normal error.
  *
  * @param fields - Raw field strings from --field or --raw-field flags
- * @param stderr - Writer to emit warnings on (command's stderr)
  * @returns New array with corrected field strings (or the original array if no
  *   corrections were needed)
  * @internal Exported for testing
  */
 export function normalizeFields(
-  fields: string[] | undefined,
-  stderr: Writer
+  fields: string[] | undefined
 ): string[] | undefined {
   if (!fields || fields.length === 0) {
     return fields;
@@ -358,8 +357,8 @@ export function normalizeFields(
       const key = field.substring(0, colonIndex);
       const value = field.substring(colonIndex + 1);
       const corrected = `${key}=${value}`;
-      stderr.write(
-        `warning: field '${field}' looks like it uses ':' instead of '=' — interpreting as '${corrected}'\n`
+      log.warn(
+        `field '${field}' looks like it uses ':' instead of '=' — interpreting as '${corrected}'`
       );
       return corrected;
     }
@@ -742,10 +741,10 @@ function tryParseJsonField(
  *   was empty/undefined.
  * @internal Exported for testing
  */
-export function extractJsonBody(
-  fields: string[] | undefined,
-  stderr: Writer
-): { body?: Record<string, unknown> | unknown[]; remaining?: string[] } {
+export function extractJsonBody(fields: string[] | undefined): {
+  body?: Record<string, unknown> | unknown[];
+  remaining?: string[];
+} {
   if (!fields || fields.length === 0) {
     return {};
   }
@@ -771,9 +770,8 @@ export function extractJsonBody(
 
     jsonBody = parsed;
     const preview = field.length > 60 ? `${field.substring(0, 57)}...` : field;
-    stderr.write(
-      `hint: '${preview}' was used as the request body. ` +
-        "Use --data/-d to pass inline JSON next time.\n"
+    log.info(
+      `'${preview}' was used as the request body. Use --data/-d to pass inline JSON next time.`
     );
   }
 
@@ -913,28 +911,27 @@ export function resolveEffectiveHeaders(
  * Build body and params from field flags, auto-detecting bare JSON bodies.
  *
  * Runs colon-to-equals normalization, extracts any JSON body passed as a
- * field value (with a stderr hint about `--data`), and routes the remaining
+ * field value (with a logged hint about `--data`), and routes the remaining
  * fields to body or query params based on the HTTP method.
  *
  * @internal Exported for testing
  */
 export function buildFromFields(
   method: HttpMethod,
-  flags: Pick<ApiFlags, "field" | "raw-field">,
-  stderr: Writer
+  flags: Pick<ApiFlags, "field" | "raw-field">
 ): {
   body?: Record<string, unknown> | unknown[];
   params?: Record<string, string | string[]>;
 } {
-  const field = normalizeFields(flags.field, stderr);
-  let rawField = normalizeFields(flags["raw-field"], stderr);
+  const field = normalizeFields(flags.field);
+  let rawField = normalizeFields(flags["raw-field"]);
 
   // Auto-detect bare JSON passed as a field value (common mistake).
   // GET requests don't have a body — skip detection so JSON-shaped values
   // fall through to query-param routing (which will throw a clear error).
   let body: Record<string, unknown> | unknown[] | undefined;
   if (method !== "GET") {
-    const extracted = extractJsonBody(rawField, stderr);
+    const extracted = extractJsonBody(rawField);
     body = extracted.body;
     rawField = extracted.remaining;
   }
@@ -986,8 +983,7 @@ export function buildFromFields(
  */
 export async function resolveBody(
   flags: Pick<ApiFlags, "method" | "data" | "input" | "field" | "raw-field">,
-  stdin: NodeJS.ReadStream & { fd: 0 },
-  stderr: Writer
+  stdin: NodeJS.ReadStream & { fd: 0 }
 ): Promise<{
   body?: Record<string, unknown> | unknown[] | string;
   params?: Record<string, string | string[]>;
@@ -1026,13 +1022,11 @@ export async function resolveBody(
     return { body: await buildBodyFromInput(flags.input, stdin) };
   }
 
-  return buildFromFields(flags.method, flags, stderr);
+  return buildFromFields(flags.method, flags);
 }
 
 // Command Definition
 
-const log = logger.withTag("api");
-
 /** Log outgoing request details in `> ` curl-verbose style. */
 function logRequest(
   method: string,
@@ -1162,10 +1156,10 @@ export const apiCommand = buildCommand({
     },
   },
   async func(this: SentryContext, flags: ApiFlags, endpoint: string) {
-    const { stderr, stdin } = this;
+    const { stdin } = this;
 
     const normalizedEndpoint = normalizeEndpoint(endpoint);
-    const { body, params } = await resolveBody(flags, stdin, stderr);
+    const { body, params } = await resolveBody(flags, stdin);
 
     const headers =
       flags.header && flags.header.length > 0

src/commands/auth/login.ts

@@ -11,11 +11,13 @@ import {
 import { getDbPath } from "../../lib/db/index.js";
 import { setUserInfo } from "../../lib/db/user.js";
 import { AuthError } from "../../lib/errors.js";
-import { muted, success } from "../../lib/formatters/colors.js";
 import { formatUserIdentity } from "../../lib/formatters/human.js";
 import { runInteractiveLogin } from "../../lib/interactive-login.js";
+import { logger } from "../../lib/logger.js";
 import { clearResponseCache } from "../../lib/response-cache.js";
 
+const log = logger.withTag("auth.login");
+
 type LoginFlags = {
   readonly token?: string;
   readonly timeout: number;
@@ -47,19 +49,17 @@ export const loginCommand = buildCommand({
     },
   },
   async func(this: SentryContext, flags: LoginFlags): Promise<void> {
-    const { stdout, stderr } = this;
-
     // Check if already authenticated
     if (await isAuthenticated()) {
       if (isEnvTokenActive()) {
         const envVar = getActiveEnvVarName();
-        stdout.write(
+        log.info(
           `Authentication is provided via ${envVar} environment variable. ` +
-            `Unset ${envVar} to use OAuth-based login instead.\n`
+            `Unset ${envVar} to use OAuth-based login instead.`
         );
       } else {
-        stdout.write(
-          "You are already authenticated. Use 'sentry auth logout' first to re-authenticate.\n"
+        log.info(
+          "You are already authenticated. Use 'sentry auth logout' first to re-authenticate."
         );
       }
       return;
@@ -104,11 +104,11 @@ export const loginCommand = buildCommand({
         // Non-fatal: user info is supplementary. Token remains stored and valid.
       }
 
-      stdout.write(`${success("✓")} Authenticated with API token\n`);
+      log.success("Authenticated with API token");
       if (user) {
-        stdout.write(`  Logged in as: ${muted(formatUserIdentity(user))}\n`);
+        log.info(`Logged in as: ${formatUserIdentity(user)}`);
       }
-      stdout.write(`  Config saved to: ${getDbPath()}\n`);
+      log.info(`Config saved to: ${getDbPath()}`);
       return;
     }
 
@@ -119,7 +119,8 @@ export const loginCommand = buildCommand({
       // Non-fatal: cache directory may not exist
     }
 
-    // Device Flow OAuth
+    // Device Flow OAuth — still needs raw stdout/stderr Writers
+    const { stdout, stderr } = this;
     const loginSuccess = await runInteractiveLogin(
       stdout,
       stderr,

src/commands/auth/logout.ts

@@ -13,7 +13,9 @@ import {
   isEnvTokenActive,
 } from "../../lib/db/auth.js";
 import { getDbPath } from "../../lib/db/index.js";
-import { success } from "../../lib/formatters/colors.js";
+import { logger } from "../../lib/logger.js";
+
+const log = logger.withTag("auth.logout");
 
 export const logoutCommand = buildCommand({
   docs: {
@@ -25,24 +27,22 @@ export const logoutCommand = buildCommand({
     flags: {},
   },
   async func(this: SentryContext): Promise<void> {
-    const { stdout } = this;
-
     if (!(await isAuthenticated())) {
-      stdout.write("Not currently authenticated.\n");
+      log.info("Not currently authenticated.");
       return;
     }
 
     if (isEnvTokenActive()) {
       const envVar = getActiveEnvVarName();
-      stdout.write(
+      log.info(
         `Authentication is provided via ${envVar} environment variable.\n` +
-          `Unset ${envVar} to log out.\n`
+          `Unset ${envVar} to log out.`
       );
       return;
     }
 
     await clearAuth();
-    stdout.write(`${success("✓")} Logged out successfully.\n`);
-    stdout.write(`  Credentials removed from: ${getDbPath()}\n`);
+    log.success("Logged out successfully.");
+    log.info(`Credentials removed from: ${getDbPath()}`);
   },
 });