@devdogsuga/devtools 0.1.26 → 0.1.28

package/dist/gh/environments.js

@@ -1,178 +0,0 @@
-/**
- * The GitHub environments, and which BWS project (if any) backs each.
- *
- * GitHub environments and BWS projects are NOT the same set, and conflating
- * them is the mistake this file exists to prevent. There are FOUR GitHub
- * environments and THREE BWS projects:
- *
- *   | GitHub environment | BWS project  | Receives                     |
- *   |--------------------|--------------|------------------------------|
- *   | `preflight`        | `preflight`  | everything in the project    |
- *   | `staging`          | `staging`    | everything in the project    |
- *   | `production`       | `production` | everything EXCEPT apply-only |
- *   | `production-apply` | `production` | everything, apply-only too   |
- *
- * The last two split one project between two GitHub environments, and that
- * split IS the reviewer gate. `production` deploys on a push with nothing in
- * front of it; `production-apply` has required reviewers. A write-capable
- * credential reaching the first makes the second decorative, so the routing is
- * enforced here rather than left to whoever last edited a file.
- *
- * ⚠️ THE GATE IS ONE-DIRECTIONAL, and reading it as symmetric is the mistake
- * this file made until 2026-08-17. What the gate asserts, through
- * `production.excludeKeys`, is that apply-tier credentials never reach the
- * UNREVIEWED environment, and nothing more. What the reviewed environment also
- * holds buys no privilege: it is the same Bitwarden project, and
- * `production-apply` is the strictly MORE trusted of the two. Withholding
- * ordinary keys from it broke every job that runs there: the config push wanted
- * deploy-tier OAuth secrets, and the orphan prune wanted a deploy-tier API
- * token. So `production-apply` now receives a SUPERSET of `production`.
- */
-import { assertRegistryLoaded } from "../env/discovery.js";
-import { getEnvSync } from "../repo/peers.js";
-export const GITHUB_ENVIRONMENTS = [
-    "preflight",
-    "staging",
-    "production",
-    "production-apply",
-];
-export function isGithubEnvironment(v) {
-    return GITHUB_ENVIRONMENTS.includes(v);
-}
-/**
- * The apply-only set, derived from the env manifests (`tier: "apply"` on the
- * declarations in `packages/devtools/env.ts`) rather than listed here.
- *
- * Read at ACCESS time, not module load: this module is imported by the CLI
- * before any manifest is, so a snapshot taken now would be empty, and an empty
- * apply set routes the write-capable credentials to the unreviewed
- * `production` environment, which is the exact failure the split exists to
- * prevent. The guard turns "forgot to loadRegistry()" into a crash instead.
- */
-function applyOnly() {
-    assertRegistryLoaded();
-    return getEnvSync().applyOnlyKeys();
-}
-/**
- * The plan-tier set, same shape and same load-time caveat as `applyOnly()`.
- * Read by `main-plan` (preflight) and `production-plan` (production); a copy
- * anywhere else is a credential nothing reads, so `staging` excludes it.
- */
-function planOnly() {
-    assertRegistryLoaded();
-    return getEnvSync().planOnlyKeys();
-}
-export const GITHUB_ENVIRONMENT_SPECS = {
-    preflight: {
-        bwsProject: "preflight",
-        branch: "main",
-        onlyKeys: null,
-        excludeKeys: [],
-        guarded: false,
-    },
-    staging: {
-        bwsProject: "staging",
-        branch: "main",
-        onlyKeys: null,
-        // Both narrow tiers: no staging job plans, and none may apply.
-        get excludeKeys() {
-            return [...applyOnly(), ...planOnly()];
-        },
-        guarded: false,
-    },
-    // ⚠️ THE REVIEWER GATE, in one property. `excludeKeys` here is the only
-    // thing keeping the apply-tier credentials out of an environment that
-    // deploys on a push to `production` with nobody in front of it. Widening it
-    // to `[]` hands a write-capable token to an unreviewed deploy, and so does
-    // letting `applyOnly()` answer empty, which is what `assertRegistryLoaded()`
-    // exists to prevent. `environments.test.ts` asserts both apply keys by name
-    // against exactly this.
-    production: {
-        bwsProject: "production",
-        branch: "production",
-        onlyKeys: null,
-        get excludeKeys() {
-            return applyOnly();
-        },
-        guarded: true,
-    },
-    // A SUPERSET of `production`, deliberately: everything that environment
-    // receives, plus the apply-tier credential it may not have.
-    //
-    // Not a relaxation of the gate. This is the same Bitwarden project behind
-    // required reviewers, the more trusted half of the split, so withholding a
-    // key from it protects nothing and only starves the jobs that run here
-    // (`production-config`, `prune-orphans`, both of which needed a deploy-tier
-    // secret and got none). The gate is what `production` may NOT have, one row
-    // above.
-    "production-apply": {
-        bwsProject: "production",
-        branch: "production",
-        onlyKeys: null,
-        excludeKeys: [],
-        guarded: true,
-    },
-};
-// ── Routing ──────────────────────────────────────────────────────────────────
-//
-// One Bitwarden project can feed more than one GitHub environment; production
-// feeds two. So a push has to know which key goes where. Derived from the table
-// above rather than written out a second time: the split IS the reviewer gate,
-// and a hardcoded copy of it is a copy that can disagree.
-/** The GitHub environments fed by one Bitwarden project, in precedence order. */
-export function githubTargets(bwsProject) {
-    return GITHUB_ENVIRONMENTS.filter((e) => GITHUB_ENVIRONMENT_SPECS[e].bwsProject === bwsProject);
-}
-/** Whether one environment takes a given key. */
-export function accepts(environment, key) {
-    const spec = GITHUB_ENVIRONMENT_SPECS[environment];
-    return spec.onlyKeys
-        ? spec.onlyKeys.includes(key)
-        : !spec.excludeKeys.includes(key);
-}
-/**
- * The PRIMARY environment a key belongs in, or `null` for "nowhere here".
- *
- * `null` is not an error. Pushing `staging` with an apply-only credential in
- * the file is the ordinary case: that key belongs to production and has no home
- * in the staging environment.
- *
- * ⚠️ "Primary", not "only". Since `production-apply` became a superset, an
- * ordinary production key legitimately lives in TWO environments and this
- * returns the first, the unreviewed one, where the deploy reads it. A caller
- * asking "is this copy misplaced?" wants `acceptedBy()` instead; answering that
- * question with this function reports every correctly-pushed copy in
- * `production-apply` as a stray that somebody should delete.
- */
-export function routeTo(bwsProject, key) {
-    return acceptedBy(bwsProject, key)[0] ?? null;
-}
-/**
- * EVERY environment of a project that takes a key, in precedence order.
- *
- * The set-shaped question, for callers that compare against what a push
- * actually wrote rather than against one destination. `routeTo()` is this with
- * `[0]` taken, and the difference is only ever visible for `production`, the
- * one project that fans out to two environments.
- */
-export function acceptedBy(bwsProject, key) {
-    return githubTargets(bwsProject).filter((e) => accepts(e, key));
-}
-/**
- * `accepts()` for an environment name that has not been narrowed yet, in the
- * argument order `AuditInput.accepted` wants.
- *
- * Exists so that the predicate `env audit` hands the audit is a NAME rather
- * than a lambda written at the call site: `runEnvAudit` cannot be unit-tested
- * without mocking Bitwarden, GitHub and Cloudflare at once, so anything spelled
- * out there is untested by construction.
- *
- * ⚠️ An unrecognised environment is REFUSED, not accepted. The string comes
- * from whatever `gh` listed, and the audit uses this to decide whether a found
- * copy is a stray. Failing open here would silence the finding for a copy
- * sitting in an environment this repository has never heard of, which is
- * exactly the case worth hearing about.
- */
-export function acceptsKey(key, environment) {
-    return isGithubEnvironment(environment) && accepts(environment, key);
-}

package/dist/gh/rulesets/actors.d.ts

@@ -1,14 +0,0 @@
-/** `GET /orgs/{org}/teams/{slug}` -> the team's numeric id. */
-export declare function resolveTeamId(org: string, slug: string): Promise<number>;
-/**
- * `GET /orgs/{org}/installations` -> the id of the App installation whose
- * `app_slug` matches, e.g. `devdogs-platform` (production) or
- * `devdogs-platform-staging`.
- *
- * `orgs/{org}/installations` rather than the App's own `/app` endpoint: the
- * latter needs App-JWT auth this CLI has no path to, while the installations
- * list is a plain org-admin GET — the exact command DevDogsUGA's own
- * `docs/platform/guides/identity/github-app.md` already tells an operator to
- * run to verify the App's permission grant.
- */
-export declare function resolveAppId(org: string, appSlug: string): Promise<number>;

package/dist/gh/rulesets/actors.js

@@ -1,69 +0,0 @@
-/**
- * Resolves the numeric ids `desired.ts`'s bypass actors need, by NAME —
- * never hardcoded, because a team or App id is only stable until somebody
- * deletes and recreates it, and a stale id in a bypass actor is the
- * dangerous failure: the ruleset then blocks the team or App it is named
- * for while letting whoever inherited the old id through (the same
- * reasoning `teamSync.ts`'s `ensureTeamRuleset` gives for always re-writing
- * rather than skipping on an existing ruleset).
- *
- * Both come from plain, read-only `gh api` GETs — no Octokit, same as every
- * other GitHub call in this package.
- */
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { GhRulesetsError } from "./api.js";
-const run = promisify(execFile);
-function describe(err) {
-    const e = err;
-    const stderr = (e.stderr ?? "").trim();
-    const message = e.message ?? "";
-    return stderr || message || "gh failed with no output.";
-}
-/** `GET /orgs/{org}/teams/{slug}` -> the team's numeric id. */
-export async function resolveTeamId(org, slug) {
-    try {
-        const { stdout } = await run("gh", ["api", `orgs/${org}/teams/${slug}`], {
-            shell: false,
-        });
-        const data = JSON.parse(stdout);
-        if (typeof data.id !== "number") {
-            throw new GhRulesetsError(`orgs/${org}/teams/${slug} returned no numeric id`);
-        }
-        return data.id;
-    }
-    catch (err) {
-        if (err instanceof GhRulesetsError)
-            throw err;
-        throw new GhRulesetsError(`resolving team "${slug}" in ${org}: ${describe(err)}`);
-    }
-}
-/**
- * `GET /orgs/{org}/installations` -> the id of the App installation whose
- * `app_slug` matches, e.g. `devdogs-platform` (production) or
- * `devdogs-platform-staging`.
- *
- * `orgs/{org}/installations` rather than the App's own `/app` endpoint: the
- * latter needs App-JWT auth this CLI has no path to, while the installations
- * list is a plain org-admin GET — the exact command DevDogsUGA's own
- * `docs/platform/guides/identity/github-app.md` already tells an operator to
- * run to verify the App's permission grant.
- */
-export async function resolveAppId(org, appSlug) {
-    try {
-        const { stdout } = await run("gh", ["api", `orgs/${org}/installations`], {
-            shell: false,
-        });
-        const data = JSON.parse(stdout);
-        const match = (data.installations ?? []).find((i) => i.app_slug === appSlug);
-        if (!match) {
-            throw new GhRulesetsError(`no installation with app_slug "${appSlug}" found in orgs/${org}/installations`);
-        }
-        return match.app_id;
-    }
-    catch (err) {
-        if (err instanceof GhRulesetsError)
-            throw err;
-        throw new GhRulesetsError(`resolving App "${appSlug}" in ${org}: ${describe(err)}`);
-    }
-}

package/dist/gh/rulesets/api.d.ts

@@ -1,15 +0,0 @@
-import type { DesiredRuleset, LiveRuleset, LiveRulesetSummary } from "./types.js";
-export declare class GhRulesetsError extends Error {
-}
-/** `owner/repo`, e.g. `DevDogsUGA/DevDogsUGA`. */
-export interface Repo {
-    owner: string;
-    repo: string;
-}
-/** `GET /repos/{owner}/{repo}/rulesets` — id, name and target only. */
-export declare function listRulesets(r: Repo): Promise<LiveRulesetSummary[]>;
-/** `GET /repos/{owner}/{repo}/rulesets/{id}` — the full ruleset. */
-export declare function getRuleset(r: Repo, id: number): Promise<LiveRuleset>;
-export declare function createRuleset(r: Repo, desired: DesiredRuleset): Promise<LiveRuleset>;
-export declare function updateRuleset(r: Repo, id: number, desired: DesiredRuleset): Promise<LiveRuleset>;
-export declare function deleteRuleset(r: Repo, id: number): Promise<void>;

package/dist/gh/rulesets/api.js

@@ -1,104 +0,0 @@
-/**
- * `gh api` calls this reconciler needs: listing and reading rulesets, and
- * writing them (create/update/delete).
- *
- * `gh`, not Octokit — devtools has no Octokit dependency, and every other
- * GitHub call in this package (`../client.ts`) already goes through the
- * `gh` CLI for the same reason `bws` goes through its own CLI: `gh` already
- * owns authentication (a contributor's `gh auth login`, or `GH_TOKEN` in
- * CI), and re-deriving that here would mean a second credential path to
- * keep in step with the first.
- *
- * Reads (`listRulesets`, `getRuleset`) run unauthenticated-safe GETs and are
- * always allowed. Writes (`createRuleset`, `updateRuleset`, `deleteRuleset`)
- * need `admin` on the repository — the same requirement `gh api
- * .../rulesets -X POST` has always had — and `commands.ts` is the only
- * caller that reaches them, gated behind `--apply`.
- */
-import { execFile, spawn } from "node:child_process";
-import { promisify } from "node:util";
-const run = promisify(execFile);
-const MAX_BUFFER = 16 * 1024 * 1024;
-export class GhRulesetsError extends Error {
-}
-function describe(err) {
-    const e = err;
-    const stderr = (e.stderr ?? "").trim();
-    const message = e.message ?? "";
-    return stderr || message || "gh failed with no output.";
-}
-function path(r, suffix = "") {
-    return `repos/${r.owner}/${r.repo}/rulesets${suffix}`;
-}
-/** `GET /repos/{owner}/{repo}/rulesets` — id, name and target only. */
-export async function listRulesets(r) {
-    try {
-        const { stdout } = await run("gh", ["api", path(r), "--paginate"], {
-            maxBuffer: MAX_BUFFER,
-            shell: false,
-        });
-        return stdout.trim() === ""
-            ? []
-            : JSON.parse(stdout);
-    }
-    catch (err) {
-        throw new GhRulesetsError(describe(err));
-    }
-}
-/** `GET /repos/{owner}/{repo}/rulesets/{id}` — the full ruleset. */
-export async function getRuleset(r, id) {
-    try {
-        const { stdout } = await run("gh", ["api", path(r, `/${id}`)], {
-            maxBuffer: MAX_BUFFER,
-            shell: false,
-        });
-        return JSON.parse(stdout);
-    }
-    catch (err) {
-        throw new GhRulesetsError(describe(err));
-    }
-}
-/**
- * Runs `gh api <path> -X <method> --input -`, writing `body` on stdin (JSON)
- * and returning the parsed JSON response.
- *
- * stdin, not `-f`/`-F` field flags: this reconciler always sends the WHOLE
- * ruleset payload as one JSON document (the shape `desired.ts` already
- * builds), and `gh api`'s field flags exist for building that document one
- * key at a time from shell arguments — a worse fit than handing over the
- * object this code already has. Not `-X POST --input path` via a temp file
- * either: stdin needs no cleanup and cannot be left behind by a crash.
- */
-async function writeJson(method, apiPath, body) {
-    return new Promise((resolve, reject) => {
-        const child = spawn("gh", ["api", apiPath, "-X", method, "--input", "-"], {
-            stdio: ["pipe", "pipe", "pipe"],
-            shell: false,
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.on("data", (c) => (stdout += c.toString()));
-        child.stderr.on("data", (c) => (stderr += c.toString()));
-        child.on("error", (err) => reject(new GhRulesetsError(describe(err))));
-        child.on("close", (code) => {
-            if (code !== 0) {
-                reject(new GhRulesetsError(describe({ stderr })));
-                return;
-            }
-            const trimmed = stdout.trim();
-            resolve(trimmed === "" ? {} : JSON.parse(trimmed));
-        });
-        child.stdin.end(JSON.stringify(body));
-    });
-}
-export async function createRuleset(r, desired) {
-    return writeJson("POST", path(r), desired);
-}
-export async function updateRuleset(r, id, desired) {
-    // PUT, not PATCH: GitHub's rulesets API has no PATCH route and answers one
-    // with a 404, which reads like a missing ruleset rather than a wrong verb.
-    return writeJson("PUT", path(r, `/${id}`), desired);
-}
-export async function deleteRuleset(r, id) {
-    await writeJson("DELETE", path(r, `/${id}`), {});
-}

package/dist/gh/rulesets/commands.d.ts

@@ -1,3 +0,0 @@
-import { type RulesetPlan } from "./diff.js";
-export declare function renderPlan(plan: RulesetPlan): string;
-export declare function runGithubRulesets(argv: readonly string[]): Promise<number>;

package/dist/gh/rulesets/commands.js

@@ -1,203 +0,0 @@
-/**
- * `devtools github rulesets` — TASK-322.
- *
- * Prints the diff between the five fixed rulesets DevDogsUGA's
- * `apps/platform/src/server/github/rulesets.ts` has always assumed exist
- * (`main`, `production`, `~ALL`, `team/**`, and the tag ruleset — see
- * `desired.ts`'s header) and what `gh api .../rulesets` actually reports.
- * Defaults to a dry-run plan; `--apply` writes it, gated behind a
- * confirmation unless `--yes`.
- *
- * Never touches a per-team ruleset (`teamRulesetName()`'s `team/<slug>`) —
- * those are `teamSync.ts`'s, not this command's — and never deletes or
- * creates anything outside `desired.ts`'s five names plus the one explicit
- * deletion (`comp-branches`). See `diff.ts`'s header for the full
- * classification.
- */
-import { confirm } from "@clack/prompts";
-import { resolveAppId, resolveTeamId } from "./actors.js";
-import { createRuleset, deleteRuleset, getRuleset, listRulesets, updateRuleset, } from "./api.js";
-import { buildDesiredRulesets, isPerTeamRulesetName } from "./desired.js";
-import { planHasChanges, planRulesets } from "./diff.js";
-import { unwrap } from "../../ui.js";
-const DEFAULT_ORG = "DevDogsUGA";
-const DEFAULT_REPO = "DevDogsUGA";
-const DEFAULT_APP_SLUG = "devdogs-platform";
-const DEFAULT_DEVOPS_SLUG = "devops";
-const DEFAULT_ADMINS_SLUG = "admins";
-/** TASK-299 — installed separately from the platform App; may not exist yet. */
-const DEFAULT_RENOVATE_SLUG = "renovate";
-function parseOptions(argv) {
-    const opts = {
-        org: DEFAULT_ORG,
-        repo: DEFAULT_REPO,
-        appSlug: DEFAULT_APP_SLUG,
-        apply: false,
-        yes: false,
-        json: false,
-    };
-    for (let i = 0; i < argv.length; i++) {
-        const arg = argv[i];
-        if (arg === "--org")
-            opts.org = argv[++i] ?? opts.org;
-        else if (arg === "--repo")
-            opts.repo = argv[++i] ?? opts.repo;
-        else if (arg === "--app-slug")
-            opts.appSlug = argv[++i] ?? opts.appSlug;
-        else if (arg === "--apply")
-            opts.apply = true;
-        else if (arg === "--yes")
-            opts.yes = true;
-        else if (arg === "--json")
-            opts.json = true;
-    }
-    return opts;
-}
-/**
- * Fetches full detail for every live ruleset EXCEPT per-team ones —
- * `diff.ts`'s `planRulesets` never reads past a per-team ruleset's name, and
- * there can be up to ~70 of them, so fetching each would be up to ~70 extra
- * GETs this reconciler has no use for.
- */
-async function fetchDetails(r, summaries) {
-    const details = new Map();
-    for (const s of summaries) {
-        if (isPerTeamRulesetName(s.name))
-            continue;
-        details.set(s.id, await getRuleset(r, s.id));
-    }
-    return details;
-}
-function renderRuleLine(rule) {
-    return rule.type;
-}
-function renderDesired(desired) {
-    return [
-        `    rules:   ${desired.rules.map(renderRuleLine).join(", ")}`,
-        `    bypass:  ${desired.bypass_actors.length === 0
-            ? "(none)"
-            : desired.bypass_actors
-                .map((a) => `${a.actor_type}#${a.actor_id} (${a.bypass_mode})`)
-                .join(", ")}`,
-    ];
-}
-export function renderPlan(plan) {
-    const lines = [];
-    for (const create of plan.creates) {
-        lines.push(`+ create   "${create.desired.name}"`);
-        lines.push(...renderDesired(create.desired));
-    }
-    for (const update of plan.updates) {
-        const renameNote = update.liveName !== update.desired.name
-            ? ` (renamed from "${update.liveName}")`
-            : "";
-        lines.push(`~ update   "${update.desired.name}"${renameNote} [id ${update.id}]`);
-        lines.push(...renderDesired(update.desired));
-    }
-    for (const del of plan.deletes) {
-        lines.push(`- delete   "${del.name}" [id ${del.id}]`);
-    }
-    for (const noop of plan.noops) {
-        lines.push(`= ok       "${noop.name}" [id ${noop.id}] — already matches`);
-    }
-    if (plan.perTeamSkipped.length > 0) {
-        lines.push(`  skipped  ${plan.perTeamSkipped.length} per-team ruleset(s), owned by teamSync.ts: ` +
-            plan.perTeamSkipped.join(", "));
-    }
-    if (plan.unmanaged.length > 0) {
-        lines.push(`  unmanaged  ${plan.unmanaged.join(", ")} — not a fixed ruleset or a deletion target, left alone`);
-    }
-    if (lines.length === 0)
-        return "(nothing to report)";
-    return lines.join("\n");
-}
-async function confirmApply(yes) {
-    if (yes)
-        return true;
-    if (!process.stdin.isTTY) {
-        process.stderr.write("devtools github rulesets: --yes is required to apply with no terminal available.\n");
-        return false;
-    }
-    return unwrap(await confirm({
-        message: "Apply this ruleset plan?",
-        initialValue: false,
-    }));
-}
-export async function runGithubRulesets(argv) {
-    const opts = parseOptions(argv);
-    const r = { owner: opts.org, repo: opts.repo };
-    let devopsTeamId;
-    let adminsTeamId;
-    let appId;
-    try {
-        [devopsTeamId, adminsTeamId, appId] = await Promise.all([
-            resolveTeamId(opts.org, DEFAULT_DEVOPS_SLUG),
-            resolveTeamId(opts.org, DEFAULT_ADMINS_SLUG),
-            resolveAppId(opts.org, opts.appSlug),
-        ]);
-    }
-    catch (err) {
-        process.stderr.write(`devtools github rulesets: ${err instanceof Error ? err.message : String(err)}\n`);
-        return 1;
-    }
-    // Renovate (TASK-299) is resolved SEPARATELY and is allowed to fail: Sloan
-    // may not have installed it yet, and that must not block reconciling
-    // everything else. A failure here prints a warning and the plan simply
-    // omits it from `~ALL`'s bypass list — re-running after the App is
-    // installed picks it up with no further action.
-    let renovateAppId;
-    try {
-        renovateAppId = await resolveAppId(opts.org, DEFAULT_RENOVATE_SLUG);
-    }
-    catch (err) {
-        process.stderr.write(`devtools github rulesets: warning: could not resolve the Renovate App ` +
-            `("${DEFAULT_RENOVATE_SLUG}") — ~ALL's plan omits it as a bypass actor ` +
-            `until it is installed (TASK-299). ${err instanceof Error ? err.message : String(err)}\n`);
-    }
-    const actors = { devopsTeamId, adminsTeamId, appId, renovateAppId };
-    const desired = buildDesiredRulesets(actors);
-    let summaries;
-    let details;
-    try {
-        summaries = await listRulesets(r);
-        details = await fetchDetails(r, summaries);
-    }
-    catch (err) {
-        process.stderr.write(`devtools github rulesets: ${err instanceof Error ? err.message : String(err)}\n`);
-        return 1;
-    }
-    const plan = planRulesets(summaries, details, actors, desired);
-    if (opts.json) {
-        console.log(JSON.stringify(plan, null, 2));
-    }
-    else {
-        console.log(renderPlan(plan));
-    }
-    if (!opts.apply) {
-        if (!opts.json && planHasChanges(plan)) {
-            console.log("\n(dry run — pass --apply to write this plan)");
-        }
-        return 0;
-    }
-    if (!planHasChanges(plan))
-        return 0;
-    if (!(await confirmApply(opts.yes)))
-        return 1;
-    try {
-        for (const create of plan.creates) {
-            await createRuleset(r, create.desired);
-        }
-        for (const update of plan.updates) {
-            await updateRuleset(r, update.id, update.desired);
-        }
-        for (const del of plan.deletes) {
-            await deleteRuleset(r, del.id);
-        }
-    }
-    catch (err) {
-        process.stderr.write(`devtools github rulesets: apply failed: ${err instanceof Error ? err.message : String(err)}\n`);
-        return 1;
-    }
-    console.log("Applied.");
-    return 0;
-}