feat: sync developer-cli from amplitude/javascript@4b6729b6eb11

[junjie-amplitude]

Maintainer sync PR (upstream mirror flow, not a community contribution).

Mirror of the monorepo developer-cli/ at 4b6729b6eb11f20da26ea74d8fc1879908cad444 (master, clean tree). Re-synced on 2026-10-01 after the upstream follow-ups below; earlier revisions of this branch were from f8bee6130bf3 and 3c9c5911518c.

What ships

New commands, generated from the current Developer API spec:

• amp heatmaps click-map, amp heatmaps scroll-map, amp zoning zone-metrics (heatmap and zoning query API; require analytics:read, which the default login set already includes).

Also in this sync:

• Saved skill delivery in amp skills (BA-695). Two new runtime dependencies, env-paths and filename-reserved-regex, are mirrored into this repo's package.json (plus the matching types devDependency) and the lockfile is refreshed; the sync script's dependency-parity check passes.
• JSON help now expands multi-token command prefixes, and one-token topics keep group members such as logout under auth (SR-5548, from the Bugbot review on the first revision).
• Scheduled event actions are hidden from the spec until GA (DMT-2556, per the #headless thread), so no events scheduled-actions commands ship in this release. The internal Orbit wording Bugbot flagged is gone with it, and the upstream denylist now catches that name before a sync.
• Source comments no longer describe the upstream repository layout or name hidden command families (SR-5548, from the Bugbot review on the second revision), and the upstream pre-sync check now scans synced source for that phrasing.

Regenerated src/generated/cli-manifest.ts, bundled OpenAPI (openapi/bundled/*), catalog curation for the new command groups, help/output test coverage, and the scope table in docs/cli.md.

Monorepo commits since the last sync (2026-09-21):

• SR-5548 [api-server] keep upstream layout out of synced CLI source comments
• BA-695 [api-server] make the skill materializer subprocess test layout-independent
• SR-5548 [api-server] fix nested CLI JSON help and drop internal names from spec descriptions
• DMT-2556 [api-server] hide scheduled event actions from OpenAPI until GA
• BA-695 [server] Add saved skill delivery
• BA-727 [api-server] Add OpenAPI spec for signup endpoint
• DMT-1669 [api-server] add scheduled event actions API (hidden again by DMT-2556)
• SR-5638 [api-server] move heatmaps and zoning APIs to analytics:read
• SR-5545 [api-server] heatmaps and zoning query contract with generated amp commands

feat: so release-please cuts a minor (0.4.0).

Checks

• pnpm check:developer-cli-external-ready (monorepo): isolation + portability tests pass (9, including the new synced-source check), CLI unit tests pass (705, 1 skipped).
• scripts/sync-developer-cli-external.sh --verify: dependency/engines parity with this repo's package.json, then in this repo pnpm install --frozen-lockfile, pnpm test (705 pass, 1 skipped, isolated HOME), pnpm test:typescript, pnpm build, pnpm pack (amplitude-developer-cli-0.3.1.tgz).
• Grep of the synced tree for internal names (Hydra, SecEng, Nova, Dash, Thunder, Falcon, Connector-Manager, Orbit, monorepo, monorepo paths): no new mentions. The one existing mention is a pre-existing code comment in src/credential-store.ts, unchanged by this sync.

.github/, community-health files and release-please config are repo-owned and untouched. package.json changes are limited to the two runtime dependencies and one types devDependency named above.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P4k27sLVxpcByNzndc2qco

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1fb74ca. Configure here.}