@devdogsuga/devtools 0.1.10 → 0.1.12

package/dist/env/discovery.js

@@ -37,10 +37,11 @@
  * its `declare()`/`define()` calls landing in the SAME `@devdogsuga/env`
  * registry instance the target repo's manifests populate (module identity —
  * see `repo/peers.ts`'s header and the devtools-dlx prototype's
- * FINDINGS.md experiment 3): both resolve the `@devdogsuga/env` bare
- * specifier through pnpm's single physical store location for that one
- * installed version, not through devtools' own bundled copy (it ships
- * none — `@devdogsuga/env` is only ever an optional peer).
+ * FINDINGS.md experiment 3). Its bare `@devdogsuga/env` import is
+ * redirected to the copy `loadEnv()` resolved through the repo, because
+ * from a `pnpm dlx` copy the specifier does not resolve at all: devtools
+ * ships no copy of its own (`@devdogsuga/env` is only ever an optional
+ * peer), and nothing installs one next to it. See `repo/peer-redirect.ts`.
  *
  * Most workspace packages declare nothing, so "no env.ts found" means
  * not-a-manifest rather than an error.
@@ -58,8 +59,9 @@
  */
 import { existsSync, readdirSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { getEnvSync, loadEnv } from "../repo/peers.js";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { redirectPeer } from "../repo/peer-redirect.js";
+import { getEnvSync, loadEnv, repoPeerUrl } from "../repo/peers.js";
 import { findRepoRoot } from "../repo/root.js";
 import { importRepoTs } from "../repo/tsx-loader.js";
 /**
@@ -105,6 +107,17 @@ async function importManifests() {
     // see `repo/peers.ts`'s header), and `assertRegistryLoaded()` /
     // `gh/environments.ts`'s getters read it back synchronously afterward.
     await loadEnv();
+    // devtools' own manifest imports `@devdogsuga/env` by bare specifier, which
+    // does not resolve at all from a `pnpm dlx` copy. Point it at the copy
+    // `loadEnv()` just resolved through the repo. See `repo/peer-redirect.ts`.
+    const envUrl = repoPeerUrl("@devdogsuga/env");
+    if (envUrl) {
+        redirectPeer({
+            parentURL: pathToFileURL(ownManifestPath()).href,
+            specifier: "@devdogsuga/env",
+            url: envUrl,
+        });
+    }
     // The Next apps' manifests run `createEnv` at import time. Without this flag
     // they would validate the AMBIENT environment, a devtools process rather than
     // an app build, and throw on whatever is missing. The manifests already

package/dist/gh/rulesets/api.js

@@ -92,7 +92,9 @@ export async function createRuleset(r, desired) {
     return writeJson("POST", path(r), desired);
 }
 export async function updateRuleset(r, id, desired) {
-    return writeJson("PATCH", path(r, `/${id}`), desired);
+    // PUT, not PATCH: GitHub's rulesets API has no PATCH route and answers one
+    // with a 404, which reads like a missing ruleset rather than a wrong verb.
+    return writeJson("PUT", path(r, `/${id}`), desired);
 }
 export async function deleteRuleset(r, id) {
     await writeJson("DELETE", path(r, `/${id}`), {});

package/dist/gh/rulesets/diff.js

@@ -24,9 +24,22 @@
  */
 import { DELETE_RULESET_NAMES, LEGACY_NAME_ALIASES, isPerTeamRulesetName, } from "./desired.js";
 /**
- * Fills in defaults GitHub omits on the wire so an absent field and an
- * explicit default-valued one compare equal — see `UpdateRule.parameters`'s
- * doc in `types.ts`.
+ * Reduces a rule to the fields this reconciler manages, in a fixed key order,
+ * so a live rule and its desired twin compare equal whenever they protect
+ * the same way.
+ *
+ * Two ways GitHub's copy differs from what was sent, both seen live on
+ * 2026-09-27 right after creating `production`:
+ *
+ * - it omits parameters that hold their default, so `update` comes back with
+ *   no `update_allows_fetch_and_merge` (see `UpdateRule.parameters`' doc in
+ *   `types.ts`);
+ * - it adds `pull_request` parameters `desired.ts` never sets
+ *   (`dismissal_restriction`, `require_extra_approval_for_unattributed_changes`,
+ *   `required_reviewers`), in its own key order.
+ *
+ * Without this, every ruleset with a `pull_request` rule planned an update on
+ * every run, so the reconciler never settled.
  */
 function canonicalizeRule(rule) {
     if (rule.type === "update") {
@@ -37,15 +50,36 @@ function canonicalizeRule(rule) {
             },
         };
     }
-    return rule;
+    if (rule.type === "pull_request") {
+        const p = rule.parameters;
+        return {
+            type: "pull_request",
+            parameters: {
+                allowed_merge_methods: [...p.allowed_merge_methods].sort(),
+                dismiss_stale_reviews_on_push: p.dismiss_stale_reviews_on_push,
+                require_code_owner_review: p.require_code_owner_review,
+                require_last_push_approval: p.require_last_push_approval,
+                required_approving_review_count: p.required_approving_review_count,
+                required_review_thread_resolution: p.required_review_thread_resolution,
+            },
+        };
+    }
+    return { type: rule.type };
 }
 function sortRules(rules) {
     return [...rules]
         .map(canonicalizeRule)
         .sort((a, b) => a.type.localeCompare(b.type));
 }
+/** Sorted, and each actor rebuilt in a fixed key order for the same reason as `canonicalizeRule`. */
 function sortActors(actors) {
-    return [...actors].sort((a, b) => a.actor_type.localeCompare(b.actor_type) || a.actor_id - b.actor_id);
+    return [...actors]
+        .sort((a, b) => a.actor_type.localeCompare(b.actor_type) || a.actor_id - b.actor_id)
+        .map((a) => ({
+        actor_id: a.actor_id,
+        actor_type: a.actor_type,
+        bypass_mode: a.bypass_mode,
+    }));
 }
 /**
  * A canonical, order-independent string for one ruleset's PROTECTION shape —

package/dist/repo/peer-redirect-hooks.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Module-loader hooks for `repo/peer-redirect.ts`. Runs on Node's loader
+ * thread, not the main one, so nothing here can import devtools state: the
+ * redirects arrive once, as `initialize()`'s data, and are never updated.
+ */
+import type { InitializeHook, ResolveHook } from "node:module";
+export interface PeerRedirect {
+    /** The exact file URL of the importing module the redirect applies to. */
+    parentURL: string;
+    /** The bare specifier it imports, e.g. `@devdogsuga/env`. */
+    specifier: string;
+    /** Where that specifier should resolve instead. */
+    url: string;
+}
+export declare const initialize: InitializeHook<PeerRedirect[]>;
+export declare const resolve: ResolveHook;

package/dist/repo/peer-redirect-hooks.js

@@ -0,0 +1,10 @@
+let redirects = [];
+export const initialize = (data) => {
+    redirects = data;
+};
+export const resolve = (specifier, context, nextResolve) => {
+    const redirect = redirects.find((r) => r.specifier === specifier && r.parentURL === context.parentURL);
+    if (redirect)
+        return { url: redirect.url, shortCircuit: true };
+    return nextResolve(specifier, context);
+};

package/dist/repo/peer-redirect.d.ts

@@ -0,0 +1,4 @@
+import type { PeerRedirect } from "./peer-redirect-hooks.js";
+/** Registers `redirect`. Hooks cannot be unregistered, so each call adds a
+ *  loader for the rest of the process; call it once per redirect. */
+export declare function redirectPeer(redirect: PeerRedirect): void;

package/dist/repo/peer-redirect.js

@@ -0,0 +1,26 @@
+/**
+ * Points one module's bare import of a peer at the copy the target repo
+ * resolved (`repo/peers.ts`).
+ *
+ * devtools' own `env.ts` manifest imports `@devdogsuga/env` by bare
+ * specifier, and from an installed copy that specifier resolves relative to
+ * the manifest's own location: inside the pnpm store, next to devtools,
+ * where an optional peer is never installed under `pnpm dlx`. The import
+ * failed with ERR_MODULE_NOT_FOUND, and every `env` command with it. Even
+ * where the specifier does resolve (devtools installed as a devDependency),
+ * the only copy that keeps the registry's module identity is the one the
+ * repo's manifests use, so the redirect is applied whenever that copy is
+ * known rather than only as a fallback.
+ *
+ * Node resolve hooks (`module.register`) rather than rewriting the file: the
+ * manifest also imports `zod`, which has to keep resolving from devtools'
+ * own location, and a copy written anywhere else would lose that.
+ */
+import { register } from "node:module";
+/** Registers `redirect`. Hooks cannot be unregistered, so each call adds a
+ *  loader for the rest of the process; call it once per redirect. */
+export function redirectPeer(redirect) {
+    register("./peer-redirect-hooks.js", import.meta.url, {
+        data: [redirect],
+    });
+}

package/dist/repo/peers.d.ts

@@ -1,5 +1,18 @@
 /** Test-only: clears the memoized peer modules so a test can re-resolve with a fresh mock. */
 export declare function resetPeerCacheForTests(): void;
+/**
+ * The file URL `specifier` was loaded from through the target repo, or
+ * undefined if it has not been loaded yet or came from a plain bare-specifier
+ * `import()` (the test-suite and not-in-a-repo fallbacks above).
+ *
+ * For code devtools imports that itself names a peer by bare specifier --
+ * today only devtools' own `env.ts` manifest. From an installed copy that
+ * specifier cannot resolve at all (an optional peer is never installed next
+ * to devtools under `pnpm dlx`), and even where it can, the only copy that
+ * keeps module identity is this one. `repo/peer-redirect.ts` uses it to
+ * point the import here.
+ */
+export declare function repoPeerUrl(specifier: string): string | undefined;
 import type * as EnvModule from "@devdogsuga/env";
 import type * as EnvLoadModule from "@devdogsuga/env/load";
 import type * as EnvSessionModule from "@devdogsuga/env/session";

package/dist/repo/peers.js

@@ -17,6 +17,10 @@ import { pathToFileURL } from "node:url";
 import { findRepoRoot, RepoNotFoundError } from "./root.js";
 import { findDependent, resolveFromRepo } from "./resolve.js";
 const moduleCache = new Map();
+/** The file URL each peer resolved to through the target repo, set only on
+ *  that path (not on either plain bare-specifier fallback). See
+ *  `repoPeerUrl()`. */
+const resolvedUrls = new Map();
 /**
  * Dynamically imports `specifier` as the repo would resolve it, memoized so
  * repeated calls in one process return the SAME module instance (required
@@ -59,7 +63,9 @@ function loadPeer(specifier) {
                 ` or packages/* to declare it (dependencies/devDependencies/peerDependencies).`);
         }
         const { resolvedPath } = resolveFromRepo(repoRoot, resolutionBase, specifier);
-        return import(pathToFileURL(resolvedPath).href);
+        const url = pathToFileURL(resolvedPath).href;
+        resolvedUrls.set(specifier, url);
+        return import(url);
     })();
     moduleCache.set(specifier, promise);
     return promise;
@@ -67,6 +73,22 @@ function loadPeer(specifier) {
 /** Test-only: clears the memoized peer modules so a test can re-resolve with a fresh mock. */
 export function resetPeerCacheForTests() {
     moduleCache.clear();
+    resolvedUrls.clear();
+}
+/**
+ * The file URL `specifier` was loaded from through the target repo, or
+ * undefined if it has not been loaded yet or came from a plain bare-specifier
+ * `import()` (the test-suite and not-in-a-repo fallbacks above).
+ *
+ * For code devtools imports that itself names a peer by bare specifier --
+ * today only devtools' own `env.ts` manifest. From an installed copy that
+ * specifier cannot resolve at all (an optional peer is never installed next
+ * to devtools under `pnpm dlx`), and even where it can, the only copy that
+ * keeps module identity is this one. `repo/peer-redirect.ts` uses it to
+ * point the import here.
+ */
+export function repoPeerUrl(specifier) {
+    return resolvedUrls.get(specifier);
 }
 let resolvedEnvModule;
 export function loadEnv() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/devtools",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "private": false,
   "type": "module",
   "description": "Contributor CLI for a DevDogsUGA checkout: database, env, images, emails, cron, deploy. Ships built JS; run via `pnpm dlx @devdogsuga/devtools` (or the `devtools`/`devtools-ci` bins once installed) from inside a DevDogsUGA clone.",
@@ -62,10 +62,10 @@
     "@vitest/coverage-v8": "^4.1.11",
     "react": "^19.2.8",
     "vitest": "^4.1.11",
-    "@devdogsuga/brand": "0.1.1",
     "@devdogsuga/config": "0.1.1",
     "@devdogsuga/db": "0.1.1",
-    "@devdogsuga/env": "0.1.1"
+    "@devdogsuga/env": "0.1.1",
+    "@devdogsuga/brand": "0.1.1"
   },
   "scripts": {
     "build": "tsc && node scripts/write-build-info.mjs",