@devdogsuga/devtools 0.1.26 → 0.1.27

package/dist/planner/commands.js

@@ -1,367 +0,0 @@
-/**
- * `pnpm devtools db planner <status|create|reset-password|drop>`, the operator
- * side of the `migration_planner` role.
- *
- * Four commands because the role has exactly four lifecycle moments:
- *
- *   status          does it exist, can it log in, does it hold the two
- *                   validated grants and nothing that reaches further
- *   create          mint it: role + grants + a generated password, verified
- *                   live, written into .env.preflight
- *   reset-password  new password on the existing role, same verification,
- *                   same write
- *   drop            remove it: the recovery path for a role in a shape
- *                   create refuses to repair, and the retirement path if
- *                   the tier is ever redesigned
- *
- * There is no `retrieve`. A Postgres password is not retrievable, the server
- * holds a hash, and the composed DB_URL's home is `.env.preflight`, synced
- * outward by `env push --target preflight` and back by `env pull`. Losing the
- * local copy is what `pull` is for; losing every copy is what
- * `reset-password` is for. Printing it here would put a live credential in a
- * terminal scrollback for no state those two do not already cover.
- *
- * ## Where the admin connection comes from
- *
- * Creating a role needs a privileged connection to the PRODUCTION database.
- * The planner exists so `main` can ask "what would these migrations do to
- * production". That connection is read from `.env.production`'s `DB_URL`
- * (fetch it with `env pull --target production`), or passed as `--db-url` for
- * the bootstrap case where that file is not populated yet. Both paths write to
- * production, so both confirm first: `production` is a guarded target, and a
- * role created by reflex is a credential nobody meant to mint.
- *
- * ## Verified live
- *
- * `create` and `reset-password` end by opening a SECOND connection as the
- * planner and running the same three checks CI's `deploy require-planner`
- * runs. "The role works and cannot overreach" is observed before the command
- * says done: the property the security plan records as "validated working",
- * re-established on every mint instead of remembered from one.
- */
-import { readFile, writeFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { confirm, log, note } from "@clack/prompts";
-import { fingerprint } from "../fingerprint.js";
-import { findRepoRoot } from "../repo/root.js";
-import { loadEnv } from "../repo/peers.js";
-import { bail, unwrap } from "../ui.js";
-import { EnvDocument } from "../env/document.js";
-import { checkPlanner } from "./checks.js";
-import { connectDb } from "./db.js";
-import { PLANNER_ROLE, createRoleSql, generatePassword, plannerUrlFrom, resetPasswordSql, } from "./role.js";
-/** Constants, like `checks.ts`: `PlannerDb.run` never sees a composed string. */
-const QUERY_ROLE = `select rolcanlogin from pg_roles where rolname = '${PLANNER_ROLE}'`;
-/**
- * The schema the grants attach to. The Supabase CLI creates it the first time
- * it records migration history on a database, so on a database that has never
- * been CLI-migrated, or baselined with `supabase migration repair`, there is
- * nothing to grant on. `create` has to say that BEFORE issuing CREATE ROLE, or
- * it strands a grant-less role behind a refusal to re-run.
- */
-const QUERY_SCHEMA = "select 1 from pg_namespace where nspname = 'supabase_migrations'";
-const QUERY_GRANTS = `select has_schema_privilege('${PLANNER_ROLE}', 'supabase_migrations', 'usage') as schema_usage, ` +
-    `has_table_privilege('${PLANNER_ROLE}', 'supabase_migrations.schema_migrations', 'select') as table_select`;
-/**
- * Membership is the quiet way a "narrow" role widens: `grant postgres to
- * migration_planner` leaves both privilege queries above looking correct.
- */
-const QUERY_MEMBERSHIPS = "select r.rolname from pg_auth_members m " +
-    "join pg_roles r on r.oid = m.roleid " +
-    "join pg_roles g on g.oid = m.member " +
-    `where g.rolname = '${PLANNER_ROLE}' order by r.rolname`;
-/**
- * The schemas a dry run has no business seeing. `public` is absent on
- * purpose: PUBLIC-role defaults give every login usage there, so listing it
- * would make this red on a correctly minted role.
- */
-const QUERY_OVERREACH = "select nspname from pg_namespace " +
-    "where nspname in ('platform', 'schedule_builder', 'study_group_finder', 'auth', 'storage') " +
-    `and has_schema_privilege('${PLANNER_ROLE}', nspname, 'usage') order by nspname`;
-async function preflightPath() {
-    const { fileFor } = await loadEnv();
-    return resolve(findRepoRoot(), fileFor("preflight"));
-}
-/**
- * The admin connection string: `--db-url`, else `.env.production`'s `DB_URL`.
- *
- * Read from the FILE rather than `process.env` so that running this under
- * `with-env` (which loads the development `.env`) cannot silently point a
- * CREATE ROLE at the shared dev database. The wrong database succeeding is
- * worse than the right one refusing.
- */
-async function adminUrl(options) {
-    if (options.dbUrl)
-        return options.dbUrl;
-    const path = resolve(findRepoRoot(), (await loadEnv()).fileFor("production"));
-    let doc;
-    try {
-        doc = EnvDocument.parse(await readFile(path, "utf8"));
-    }
-    catch {
-        doc = EnvDocument.empty();
-    }
-    const url = doc.get("DB_URL");
-    if (!url) {
-        bail("No DB_URL in .env.production. The planner lives on the production " +
-            "database, so this needs its full connection string: run " +
-            "`pnpm devtools env pull --target production`, or pass --db-url.");
-    }
-    return url;
-}
-async function withDb(connect, url, body) {
-    const db = connect(url);
-    try {
-        return await body(db);
-    }
-    finally {
-        await db.end();
-    }
-}
-async function roleExists(db) {
-    return (await db.run(QUERY_ROLE)).length > 0;
-}
-async function migrationSchemaExists(db) {
-    return (await db.run(QUERY_SCHEMA)).length > 0;
-}
-/** Postgres 42501 (insufficient_privilege), with a text fallback. */
-function isPermissionDenied(error) {
-    const e = error;
-    return e.code === "42501" || /permission denied/i.test(e.message ?? "");
-}
-function errorText(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-function bailMissingSchema() {
-    bail("The supabase_migrations schema does not exist on this database, so " +
-        "there is nothing to grant on — and nothing for the §3.5 dry run to " +
-        "plan against. The Supabase CLI creates it the first time it records " +
-        "migration history here: `supabase db push` on a fresh database, or " +
-        "`supabase migration repair` to baseline one that already has its " +
-        "objects. Initialize the history first, then re-run this command.");
-}
-export async function runPlannerStatus(options = {}) {
-    const connect = options.connect ?? connectDb;
-    await withDb(connect, await adminUrl(options), async (db) => {
-        // First, because it recolors everything after it: on a database with no
-        // migration history, the story is the missing history, not the grants.
-        const schemaReady = await migrationSchemaExists(db);
-        const [role] = await db.run(QUERY_ROLE);
-        if (!role) {
-            log.warn(schemaReady
-                ? `${PLANNER_ROLE} does not exist. Mint it with \`pnpm devtools db planner create\`.`
-                : `${PLANNER_ROLE} does not exist — and neither does the ` +
-                    "supabase_migrations schema, so `planner create` would refuse: " +
-                    "initialize this database's migration history first " +
-                    "(`supabase db push`, or `supabase migration repair` to " +
-                    "baseline an existing database).");
-            process.exitCode = 1;
-            return;
-        }
-        const lines = [
-            `exists, ${role.rolcanlogin ? "can log in" : "⚠️ CANNOT log in (nologin)"}`,
-        ];
-        if (!schemaReady) {
-            lines.push("⚠️ the supabase_migrations schema DOES NOT EXIST on this database " +
-                "— the grants below cannot hold and the dry run cannot plan. " +
-                "Initialize the migration history, then `planner reset-password` " +
-                "will re-verify (or `planner drop` and re-run `planner create`).");
-        }
-        // Skipped when the schema is absent: has_schema_privilege raises on a
-        // name that does not exist, and the schema line above already carries
-        // the diagnosis.
-        if (schemaReady) {
-            const [grants] = await db.run(QUERY_GRANTS);
-            lines.push(grants?.schema_usage
-                ? "has usage on supabase_migrations"
-                : "⚠️ MISSING usage on supabase_migrations", grants?.table_select
-                ? "has select on supabase_migrations.schema_migrations"
-                : "⚠️ MISSING select on supabase_migrations.schema_migrations");
-        }
-        const memberships = await db.run(QUERY_MEMBERSHIPS);
-        lines.push(memberships.length === 0
-            ? "member of no other role"
-            : `⚠️ MEMBER OF: ${memberships.map((m) => String(m.rolname)).join(", ")} — inherited privileges reach past the validated pair`);
-        const overreach = await db.run(QUERY_OVERREACH);
-        lines.push(overreach.length === 0
-            ? "no usage on any application schema (platform, schedule_builder, study_group_finder, auth, storage)"
-            : `⚠️ CAN REACH: ${overreach.map((s) => String(s.nspname)).join(", ")} — \`planner drop\`, then \`planner create\``);
-        const healthy = !lines.some((l) => l.includes("⚠️"));
-        note(lines.map((l) => `• ${l}`).join("\n"), PLANNER_ROLE);
-        if (!healthy) {
-            log.error("The role does not match the validated shape. `planner create` " +
-                "refuses to touch an existing role — `planner drop` and re-run " +
-                "create, or repair the grants by hand (planner/role.ts holds the " +
-                "pair).");
-            process.exitCode = 1;
-        }
-    });
-}
-/** Shared tail of create and reset-password: verify live, write the file. */
-async function verifyAndStore(connect, adminDbUrl, password) {
-    const { fileFor } = await loadEnv();
-    const url = plannerUrlFrom(adminDbUrl, password);
-    // The same three checks `deploy require-planner` runs in CI. Observed here,
-    // at minting time, so the first workflow run is a repeat rather than a
-    // premiere.
-    const verdict = await withDb(connect, url, (db) => checkPlanner(db));
-    for (const line of verdict.lines)
-        log.info(line);
-    if (!verdict.ok) {
-        bail(`The freshly minted credential failed verification: ${verdict.problem}`);
-    }
-    const path = await preflightPath();
-    let doc;
-    try {
-        doc = EnvDocument.parse(await readFile(path, "utf8"));
-    }
-    catch {
-        doc = EnvDocument.empty();
-    }
-    doc.set("DB_URL", url);
-    await writeFile(path, doc.toString());
-    log.success(`Wrote DB_URL (${fingerprint(url)}) to ${fileFor("preflight")}. ` +
-        "Next: `pnpm devtools env push --target preflight`.");
-}
-export async function runPlannerCreate(options = {}) {
-    const connect = options.connect ?? connectDb;
-    const admin = await adminUrl(options);
-    const go = unwrap(await confirm({
-        message: `Create role ${PLANNER_ROLE} on the PRODUCTION database, with its ` +
-            "two grants and a generated password?",
-        initialValue: false,
-    }));
-    if (!go)
-        bail();
-    await withDb(connect, admin, async (db) => {
-        // Before CREATE ROLE, so a database with no migration history refuses
-        // cleanly instead of stranding a grant-less role behind the
-        // already-exists refusal below. That happened the first time this ran
-        // against a database the CLI had never migrated.
-        if (!(await migrationSchemaExists(db)))
-            bailMissingSchema();
-        if (await roleExists(db)) {
-            // Refused rather than repaired: an existing role may hold grants this
-            // command did not give it, and layering the validated pair on top would
-            // report success over an unvalidated whole. `status` shows the shape;
-            // `reset-password` rotates the credential without touching grants.
-            bail(`${PLANNER_ROLE} already exists. Run \`planner status\` to check its ` +
-                "shape, `planner reset-password` to rotate it — or, for a " +
-                "from-scratch mint, `planner drop` and re-run create.");
-        }
-        const password = generatePassword();
-        // One transaction: the role and its grants exist together or not at all.
-        // A mid-flight failure used to leave the role behind with no grants,
-        // which the already-exists refusal then protected like a real one.
-        await db.run("begin");
-        try {
-            for (const statement of createRoleSql(password)) {
-                await db.run(statement);
-            }
-            await db.run("commit");
-        }
-        catch (error) {
-            await db.run("rollback").catch(() => undefined);
-            throw error;
-        }
-        log.success(`Created ${PLANNER_ROLE} with the two validated grants.`);
-        await verifyAndStore(connect, admin, password);
-    });
-}
-export async function runPlannerDrop(options = {}) {
-    const { fileFor } = await loadEnv();
-    const connect = options.connect ?? connectDb;
-    const admin = await adminUrl(options);
-    const go = unwrap(await confirm({
-        message: `Drop role ${PLANNER_ROLE} from the PRODUCTION database? The ` +
-            "preflight credential stops working the moment this runs.",
-        initialValue: false,
-    }));
-    if (!go)
-        bail();
-    await withDb(connect, admin, async (db) => {
-        if (!(await roleExists(db))) {
-            bail(`${PLANNER_ROLE} does not exist — nothing to drop.`);
-        }
-        // Three statements, one transaction, and the order is load-bearing twice:
-        //
-        //   * DROP OWNED before DROP ROLE. DROP ROLE alone fails on a role that
-        //     still holds grants ("some objects depend on it"), and a role being
-        //     dropped for the WRONG shape is exactly the one whose grants this
-        //     command cannot enumerate: stranded grants, or an overreaching grant
-        //     somebody added by hand. The role owns no objects by design, so DROP
-        //     OWNED only revokes; if somebody ever made it own something,
-        //     dropping that too is what "drop" has to mean for a from-scratch
-        //     re-mint.
-        //   * GRANT before DROP OWNED. Supabase's `postgres` is CREATEROLE, not
-        //     superuser, and DROP OWNED requires MEMBERSHIP in the role. Having
-        //     created it, which confers ADMIN on the role and the right to drop
-        //     it, is not enough: the first real run failed here with "permission
-        //     denied". Granting the role to ourselves is what a non-superuser
-        //     admin has to do, it is idempotent (a re-grant is a NOTICE), and the
-        //     membership vanishes with the role two statements later, or with the
-        //     rollback.
-        await db.run("begin");
-        try {
-            await db.run(`grant ${PLANNER_ROLE} to current_user`);
-            await db.run(`drop owned by ${PLANNER_ROLE}`);
-            await db.run(`drop role ${PLANNER_ROLE}`);
-            await db.run("commit");
-        }
-        catch (error) {
-            await db.run("rollback").catch(() => undefined);
-            if (isPermissionDenied(error)) {
-                bail(`Postgres refused: ${errorText(error)}. Dropping ${PLANNER_ROLE} ` +
-                    "needs a connection that can administer it — on Supabase that " +
-                    "is the `postgres` user's own connection string (what " +
-                    "`.env.production`'s DB_URL should hold), not a lesser role. " +
-                    "If postgres itself is refused, the role was created by " +
-                    "somebody else's admin role; drop it from the dashboard's SQL " +
-                    "editor, which runs as postgres.");
-            }
-            throw error;
-        }
-        log.success(`Dropped ${PLANNER_ROLE}.`);
-    });
-    // The stored credential died with the role, and a dead value left in place
-    // would push cleanly and audit green. Blanked rather than deleted, because a
-    // blank line is the file's "fill me in" convention. Only when the value is
-    // actually the planner's: a hand-set URL under this key is somebody's
-    // deliberate state.
-    const path = await preflightPath();
-    let doc;
-    try {
-        doc = EnvDocument.parse(await readFile(path, "utf8"));
-    }
-    catch {
-        return;
-    }
-    const stored = doc.get("DB_URL");
-    if (stored?.includes(PLANNER_ROLE)) {
-        doc.set("DB_URL", "");
-        await writeFile(path, doc.toString());
-        log.info(`Blanked the dead DB_URL in ${fileFor("preflight")}. After the next ` +
-            "`planner create`, push it with `env push --target preflight`.");
-    }
-}
-export async function runPlannerResetPassword(options = {}) {
-    const connect = options.connect ?? connectDb;
-    const admin = await adminUrl(options);
-    const go = unwrap(await confirm({
-        message: `Reset ${PLANNER_ROLE}'s password on the PRODUCTION database? The ` +
-            "old connection string stops working the moment this runs.",
-        initialValue: false,
-    }));
-    if (!go)
-        bail();
-    await withDb(connect, admin, async (db) => {
-        if (!(await roleExists(db))) {
-            bail(`${PLANNER_ROLE} does not exist — nothing to reset. Mint it with ` +
-                "`pnpm devtools db planner create`.");
-        }
-        const password = generatePassword();
-        await db.run(resetPasswordSql(password));
-        log.success(`Reset ${PLANNER_ROLE}'s password.`);
-        await verifyAndStore(connect, admin, password);
-    });
-}

package/dist/planner/db.d.ts

@@ -1,15 +0,0 @@
-export interface PlannerDb {
-    run(query: string): Promise<Record<string, unknown>[]>;
-    end(): Promise<void>;
-}
-/** How a caller opens one; injectable so tests never touch the network. */
-export type Connect = (url: string) => PlannerDb;
-/**
- * Opens the single connection the planner commands run through.
- *
- * `max: 1` because every use here is a handful of sequential statements, and
- * `prepare: false` because the session pooler tolerates prepared statements
- * but gains nothing from them for one-shot queries. The timeout keeps a
- * wrong-host URL from hanging a CI job for its full step timeout.
- */
-export declare function connectDb(url: string): PlannerDb;

package/dist/planner/db.js

@@ -1,33 +0,0 @@
-/**
- * The one seam between the planner commands and a real Postgres.
- *
- * Deliberately tiny: a runner of constant SQL strings and an `end()`. Every
- * query in this feature is a string literal. Nothing user-shaped is ever
- * interpolated except the generated password, whose alphabet `role.ts`
- * constrains. That lets the interface stay `run(text)`, and lets tests hand in
- * a map from query to rows instead of mocking a client library.
- */
-import postgres from "postgres";
-/**
- * Opens the single connection the planner commands run through.
- *
- * `max: 1` because every use here is a handful of sequential statements, and
- * `prepare: false` because the session pooler tolerates prepared statements
- * but gains nothing from them for one-shot queries. The timeout keeps a
- * wrong-host URL from hanging a CI job for its full step timeout.
- */
-export function connectDb(url) {
-    const sql = postgres(url, {
-        max: 1,
-        prepare: false,
-        connect_timeout: 15,
-    });
-    return {
-        async run(query) {
-            return await sql.unsafe(query);
-        },
-        async end() {
-            await sql.end({ timeout: 5 });
-        },
-    };
-}

package/dist/planner/role.d.ts

@@ -1,33 +0,0 @@
-export declare const PLANNER_ROLE = "migration_planner";
-/**
- * The statements `planner create` runs, in order. Exported so the test can
- * assert the grants byte-for-byte against the security plan's validated pair.
- * A paraphrase here would be a second copy that can drift.
- *
- * The password is interpolated rather than bound because Postgres accepts no
- * bind parameters in a utility statement like CREATE ROLE. That is safe here
- * ONLY because `generatePassword()` emits the base64url alphabet: no quote,
- * no backslash, nothing needing escape. Do not widen the alphabet without
- * revisiting this.
- */
-export declare function createRoleSql(password: string): string[];
-/** ALTER ROLE, same interpolation contract as `createRoleSql`. */
-export declare function resetPasswordSql(password: string): string;
-/**
- * 192 bits, base64url. The alphabet is load-bearing twice over: it needs no
- * escaping inside the SQL literal above, and no percent-encoding inside the
- * userinfo of the connection URL the password ends up in.
- */
-export declare function generatePassword(): string;
-/**
- * The preflight `DB_URL`, derived from the admin one.
- *
- * Everything but the identity is kept, including host, port, and database,
- * because the planner connects to the same place as everyone else. Only the userinfo
- * changes, and the username's shape depends on the route in a way worth
- * spelling out: through Supabase's session pooler the username is
- * `<role>.<project-ref>`, so the ref (everything after the first dot of the
- * admin username) survives the swap; on a direct connection the username is
- * the bare role.
- */
-export declare function plannerUrlFrom(adminUrl: string, password: string): string;

package/dist/planner/role.js

@@ -1,68 +0,0 @@
-/**
- * The `migration_planner` role: the one Postgres credential `main` may hold.
- *
- * §3.5's stage-1 dry run answers "what would these migrations do to
- * production" from `main`, so whatever it authenticates with is reachable
- * from the `main` trust tier. The plan refuses even a general read-only role
- * there, because that puts every row of production data behind that boundary.
- * What is left is a role that can read the migrations-history table and
- * nothing else. Two grants are the whole of it:
- *
- *   grant usage  on schema supabase_migrations            to migration_planner;
- *   grant select on supabase_migrations.schema_migrations to migration_planner;
- *
- * This module is the pure half: names, SQL text, password generation, URL
- * derivation. Everything that talks to a database lives beside it.
- */
-import { randomBytes } from "node:crypto";
-export const PLANNER_ROLE = "migration_planner";
-/**
- * The statements `planner create` runs, in order. Exported so the test can
- * assert the grants byte-for-byte against the security plan's validated pair.
- * A paraphrase here would be a second copy that can drift.
- *
- * The password is interpolated rather than bound because Postgres accepts no
- * bind parameters in a utility statement like CREATE ROLE. That is safe here
- * ONLY because `generatePassword()` emits the base64url alphabet: no quote,
- * no backslash, nothing needing escape. Do not widen the alphabet without
- * revisiting this.
- */
-export function createRoleSql(password) {
-    return [
-        `create role ${PLANNER_ROLE} login password '${password}'`,
-        `grant usage on schema supabase_migrations to ${PLANNER_ROLE}`,
-        `grant select on supabase_migrations.schema_migrations to ${PLANNER_ROLE}`,
-    ];
-}
-/** ALTER ROLE, same interpolation contract as `createRoleSql`. */
-export function resetPasswordSql(password) {
-    return `alter role ${PLANNER_ROLE} password '${password}'`;
-}
-/**
- * 192 bits, base64url. The alphabet is load-bearing twice over: it needs no
- * escaping inside the SQL literal above, and no percent-encoding inside the
- * userinfo of the connection URL the password ends up in.
- */
-export function generatePassword() {
-    return randomBytes(24).toString("base64url");
-}
-/**
- * The preflight `DB_URL`, derived from the admin one.
- *
- * Everything but the identity is kept, including host, port, and database,
- * because the planner connects to the same place as everyone else. Only the userinfo
- * changes, and the username's shape depends on the route in a way worth
- * spelling out: through Supabase's session pooler the username is
- * `<role>.<project-ref>`, so the ref (everything after the first dot of the
- * admin username) survives the swap; on a direct connection the username is
- * the bare role.
- */
-export function plannerUrlFrom(adminUrl, password) {
-    const url = new URL(adminUrl);
-    const ref = url.username.includes(".")
-        ? url.username.slice(url.username.indexOf("."))
-        : "";
-    url.username = `${PLANNER_ROLE}${ref}`;
-    url.password = password;
-    return url.toString();
-}

package/dist/repo/peer-redirect-hooks.d.ts

@@ -1,16 +0,0 @@
-/**
- * Module-loader hooks for `repo/peer-redirect.ts`. Runs on Node's loader
- * thread, not the main one, so nothing here can import devtools state: the
- * redirects arrive once, as `initialize()`'s data, and are never updated.
- */
-import type { InitializeHook, ResolveHook } from "node:module";
-export interface PeerRedirect {
-    /** The exact file URL of the importing module the redirect applies to. */
-    parentURL: string;
-    /** The bare specifier it imports, e.g. `@devdogsuga/env`. */
-    specifier: string;
-    /** Where that specifier should resolve instead. */
-    url: string;
-}
-export declare const initialize: InitializeHook<PeerRedirect[]>;
-export declare const resolve: ResolveHook;

package/dist/repo/peer-redirect-hooks.js

@@ -1,10 +0,0 @@
-let redirects = [];
-export const initialize = (data) => {
-    redirects = data;
-};
-export const resolve = (specifier, context, nextResolve) => {
-    const redirect = redirects.find((r) => r.specifier === specifier && r.parentURL === context.parentURL);
-    if (redirect)
-        return { url: redirect.url, shortCircuit: true };
-    return nextResolve(specifier, context);
-};

package/dist/repo/peer-redirect.d.ts

@@ -1,4 +0,0 @@
-import type { PeerRedirect } from "./peer-redirect-hooks.js";
-/** Registers `redirect`. Hooks cannot be unregistered, so each call adds a
- *  loader for the rest of the process; call it once per redirect. */
-export declare function redirectPeer(redirect: PeerRedirect): void;

package/dist/repo/peer-redirect.js

@@ -1,26 +0,0 @@
-/**
- * Points one module's bare import of a peer at the copy the target repo
- * resolved (`repo/peers.ts`).
- *
- * devtools' own `env.ts` manifest imports `@devdogsuga/env` by bare
- * specifier, and from an installed copy that specifier resolves relative to
- * the manifest's own location: inside the pnpm store, next to devtools,
- * where an optional peer is never installed under `pnpm dlx`. The import
- * failed with ERR_MODULE_NOT_FOUND, and every `env` command with it. Even
- * where the specifier does resolve (devtools installed as a devDependency),
- * the only copy that keeps the registry's module identity is the one the
- * repo's manifests use, so the redirect is applied whenever that copy is
- * known rather than only as a fallback.
- *
- * Node resolve hooks (`module.register`) rather than rewriting the file: the
- * manifest also imports `zod`, which has to keep resolving from devtools'
- * own location, and a copy written anywhere else would lose that.
- */
-import { register } from "node:module";
-/** Registers `redirect`. Hooks cannot be unregistered, so each call adds a
- *  loader for the rest of the process; call it once per redirect. */
-export function redirectPeer(redirect) {
-    register("./peer-redirect-hooks.js", import.meta.url, {
-        data: [redirect],
-    });
-}

package/dist/repo/peers.d.ts

@@ -1,39 +0,0 @@
-/** Test-only: clears the memoized peer modules so a test can re-resolve with a fresh mock. */
-export declare function resetPeerCacheForTests(): void;
-/**
- * The file URL `specifier` was loaded from through the target repo, or
- * undefined if it has not been loaded yet or came from a plain bare-specifier
- * `import()` (the test-suite and not-in-a-repo fallbacks above).
- *
- * For code devtools imports that itself names a peer by bare specifier --
- * today only devtools' own `env.ts` manifest. From an installed copy that
- * specifier cannot resolve at all (an optional peer is never installed next
- * to devtools under `pnpm dlx`), and even where it can, the only copy that
- * keeps module identity is this one. `repo/peer-redirect.ts` uses it to
- * point the import here.
- */
-export declare function repoPeerUrl(specifier: string): string | undefined;
-import type * as EnvModule from "@devdogsuga/env";
-import type * as EnvLoadModule from "@devdogsuga/env/load";
-import type * as EnvSessionModule from "@devdogsuga/env/session";
-export declare function loadEnv(): Promise<typeof EnvModule>;
-/**
- * The synchronous companion to `loadEnv()`, for the handful of call sites
- * (`gh/environments.ts`'s `GITHUB_ENVIRONMENT_SPECS` getters) that cannot
- * become async without changing their own callers' contract — they read a
- * plain array off a getter, not a Promise. Safe ONLY after `loadEnv()` has
- * resolved at least once; every caller of these getters already requires
- * `env/discovery.ts`'s `loadRegistry()` (which calls `loadEnv()` itself) to
- * have run first, via `assertRegistryLoaded()`'s own guard.
- */
-export declare function getEnvSync(): typeof EnvModule;
-/** Test-only: clears the sync cache alongside `resetPeerCacheForTests()`. */
-export declare function resetEnvSyncCacheForTests(): void;
-export declare function loadEnvLoad(): Promise<typeof EnvLoadModule>;
-export declare function loadEnvSession(): Promise<typeof EnvSessionModule>;
-import type * as DbTypegenModule from "@devdogsuga/db/typegen";
-export declare function loadDbTypegen(): Promise<typeof DbTypegenModule>;
-import type * as BrandEventModule from "@devdogsuga/brand/event";
-export declare function loadBrandEvent(): Promise<typeof BrandEventModule>;
-import type * as EventsModule from "@devdogsuga/events";
-export declare function loadEvents(): Promise<typeof EventsModule>;