release: v3.22.0 - type the composed api, self, and slothlet() from each…

.configs/eslint.config.mjs

@@ -72,6 +72,16 @@ export default defineConfig([
 		}
 	},
 	{ files: ["**/*.js"], languageOptions: { sourceType: "commonjs" } },
+	// ESM-syntax `.js` fixtures for #521 (a "type": "module" package and a package with no type field,
+	// which Node loads as ESM by syntax detection), and the `.js` ES module a CommonJS leaf requires (#534).
+	{
+		files: [
+			"api_tests/api_test_cjs_js/esm/**/*.js",
+			"api_tests/api_test_cjs_js/untypedesm/**/*.js",
+			"api_tests/api_test_helper_imports/__mixed/lib/esm-plain.js"
+		],
+		languageOptions: { sourceType: "module" }
+	},
 	{ files: ["**/*.{js,mjs,cjs}"], languageOptions: { globals: { ...globals.node, ...globals.browser } } },
 	{
 		files: ["**/test/**/*test.js"],

.configs/vitest.config.mjs

@@ -15,7 +15,7 @@ import { defineConfig } from "vitest/config";
 import { DefaultReporter } from "vitest/node";
 import { existsSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -94,7 +94,17 @@ const workerNodeOptions = useSourceCondition
 	? [`--conditions=${slothletCondition}`, "--import=./tests/vitests/setup/env-preload.mjs"]
 	: ["--import=./tests/vitests/setup/env-preload.mjs"];
 
+// Leaves load through this config's vite module graph (slothlet's source is inlined here, so its
+// `import()` of a leaf is vite's), where Node's resolve hooks never see a leaf's imports. The
+// plugin gives a leaf's relative helpers the leaf's per-instance query inside that graph (#518) —
+// the same step a consumer takes when loading leaves through slothlet's `import` hook.
+// A computed file URL (not a literal specifier) so the config bundler leaves the import to runtime.
+const { slothletInstanceImports } = await import(
+	pathToFileURL(path.resolve(__dirname, srcExists ? "../src" : "../dist", "lib/helpers/instance-imports.mjs")).href
+);
+
 export default defineConfig({
+	plugins: [slothletInstanceImports()],
 	pool: "forks",
 	// pool: "threads",
 	resolve: {

.github/dependabot.yml

@@ -67,12 +67,6 @@ updates:
       open-pull-requests-limit: 5
       commit-message:
           prefix: "deps"
-      ignore:
-          # ABI-locked rolldown native binding (npm #4828 workaround): it must track the exact
-          # rolldown version vite ships (vite exact-pins rolldown, e.g. 1.0.3), not be bumped
-          # independently. The #149 bump to 1.1.0 had no rolldown consumer and shipped an unused
-          # ~21MB duplicate; keep this pinned in lockstep with vite's rolldown instead.
-          - dependency-name: "@rolldown/binding-linux-x64-gnu"
       groups:
           # vitest and @vitest/coverage-v8 (and other @vitest/* packages) peer
           # each other EXACTLY, so a partial bump (e.g. vitest to 5.0.0 while

.github/workflows/bundle-size.yml

@@ -35,7 +35,8 @@ jobs:
         uses: CLDMV/.github/.github/workflows/reusable-bundle-size.yml@v4
         with:
             build_command: "npm run build:ci"
-            dist_paths: "dist/**"
+            # Every pattern starts with `*` on purpose: the v4.29.2 measure action matches nothing for a bare top-level file and double-counts files when patterns have different roots.
+            dist_paths: "*.mjs,*.cjs,*dist/**/*.mjs,*bin/**"
             # warning_pct: 5
             # warning_bytes: 500
             # comment_mode: "update"

.github/workflows/ci.yml

@@ -54,10 +54,10 @@ on:
                 required: false
                 default: "lts/*"
             min_node_version:
-                description: "Minimum Node.js version for matrix testing (default: 22.12.0 — the floor vitest 5 actually runs on)"
+                description: "Minimum Node.js version for matrix testing (default: 22.15.0 — slothlet's engines floor (in-thread module.registerHooks))"
                 type: string
                 required: false
-                default: "22.12.0"
+                default: "22.15.0"
             max_node_major:
                 description: "Max Node.js major version for the test matrix. Leave blank (the default) to inherit the CLDMV/.github reusable workflow's default; set a value only to pin/override for a specific run."
                 type: string
@@ -220,7 +220,7 @@ jobs:
               .gitignore
             debug: ${{ github.event.inputs.debug == 'true' }}
             node_version: ${{ github.event.inputs.node_version || 'lts/*' }}
-            min_node_version: ${{ github.event.inputs.min_node_version || '22.12.0' }}
+            min_node_version: ${{ github.event.inputs.min_node_version || '22.15.0' }}
             max_node_major: ${{ github.event.inputs.max_node_major || '' }} # blank ⇒ inherit the CLDMV/.github reusable default
             # LTS-only matrix (even majors: 20, 22, 24, …) on every event. Odd majors
             # (21, 23, …) are non-LTS interim releases, and the native-binding test
@@ -300,23 +300,37 @@ jobs:
     # automatically — no `pull_request` round-trip needed for non-fork
     # non-release PRs.
     required-check:
-        name: ✅ Required PR Check
-        needs: ci
-        # Mirror the `ci` job's gating exactly. The four cases that run:
+        # Which name this job reports under is the whole point of it.
+        #
+        # The ruleset gates merges on `✅ Required PR Check`, so a check with that
+        # name must only ever exist on a head SHA after the full test matrix for
+        # that SHA has finished, mirroring its result. `needs: ci` guarantees the
+        # timing: the job is only created once every Build & Test leg and the
+        # coverage job are done.
+        #
+        # On an in-repo feature PR the `pull_request` run does not own the status
+        # (the push run on the head branch does), so it must not post
+        # `✅ Required PR Check` at all. Two traps rule out the obvious shapes:
+        #   - A job SKIPPED by `if:` still posts a check run under its name, and
+        #     GitHub treats a skipped required check as satisfied. Under the real
+        #     name that let PRs merge mid-test (CLDMV/slothlet#553).
+        #   - GitHub does not evaluate the `name:` of a skipped job, so a
+        #     conditional name on a skippable job shows up as the raw expression
+        #     text (#350).
+        # So the job never skips: it runs on every path, the name expression is
+        # always evaluated, and the in-repo PR path lands on a readable,
+        # non-required name and passes as a no-op. The condition below is
+        # repeated in the step's OWNS_STATUS and must stay identical. The paths
+        # that own the status:
         #   1. push events                                            (job needs CI run)
         #   2. fork PRs                                               (push doesn't cover forks)
         #   3. release PRs from `next` → master/main                  (push covers SHA but commit-gate skips chore-bump)
         #   4. release PRs from `hotfixes` → master/main              (same reason)
-        # In-repo feature PRs targeting `next` / `hotfixes` skip on
-        # pull_request — push on the head branch already posted the status
-        # on the SHA, and mirroring here would overwrite it.
-        if: |
-          always() && (
-            github.event_name != 'pull_request' ||
-            github.event.pull_request.head.repo.fork == true ||
-            github.event.pull_request.head.ref == 'next' ||
-            github.event.pull_request.head.ref == 'hotfixes'
-          )
+        name: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == true || github.event.pull_request.head.ref == 'next' || github.event.pull_request.head.ref == 'hotfixes') && '✅ Required PR Check' || '⏭️ Required PR Check (reported by the push run)' }}
+        needs: ci
+        # always(): run even when `ci` is skipped (the in-repo PR path) or failed
+        # (so the mirror can report red).
+        if: always()
         # Match the reusable's runner routing (workflow-ci.yml): private CLDMV
         # repos run on self-hosted cldmv-runners (GitHub-hosted Actions budget is
         # private-metered and exhausted), public repos use free GitHub-hosted, and
@@ -330,10 +344,19 @@ jobs:
         steps:
             - name: Mirror reusable result
               env:
+                  OWNS_STATUS: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == true || github.event.pull_request.head.ref == 'next' || github.event.pull_request.head.ref == 'hotfixes' }}
                   IS_MASTER_SYNC: ${{ needs.ci.outputs.is_master_sync }}
                   DOCS_ONLY: ${{ needs.ci.outputs.docs_only }}
                   CI_RESULT: ${{ needs.ci.result }}
               run: |
+                # In-repo feature PR: the push run on the head branch reports
+                # `✅ Required PR Check`. This job runs under the
+                # `⏭️ Required PR Check (reported by the push run)` name and
+                # must not gate anything.
+                if [ "$OWNS_STATUS" != "true" ]; then
+                  echo "In-repo PR event — the push run reports ✅ Required PR Check for this SHA."
+                  exit 0
+                fi
                 echo "ci.result=$CI_RESULT  docs_only=$DOCS_ONLY  is_master_sync=$IS_MASTER_SYNC"
                 # next/hotfixes was force-synced to master — head SHA matches the
                 # default branch, nothing new to test, green-light without running CI.

.github/workflows/publish.yml

@@ -60,10 +60,10 @@ on:
                 required: false
                 default: true
             min_node_version:
-                description: "Minimum Node.js version for matrix testing (enables matrix when set; default: 22.12.0 — the floor vitest 5 actually runs on)"
+                description: "Minimum Node.js version for matrix testing (enables matrix when set; default: 22.15.0 — slothlet's engines floor (in-thread module.registerHooks))"
                 type: string
                 required: false
-                default: "22.12.0"
+                default: "22.15.0"
             max_node_major:
                 description: "Max Node.js major version for the test matrix. Leave blank (the default) to inherit the CLDMV/.github reusable workflow's default; set a value only to pin/override for a specific run."
                 type: string
@@ -104,7 +104,7 @@ jobs:
             publish_to_github_packages: ${{ github.event.inputs.publish_to_github_packages != 'false' }}
             publish_command: ""
             github_packages_publish_command: ""
-            min_node_version: ${{ github.event.inputs.min_node_version || '22.12.0' }}
+            min_node_version: ${{ github.event.inputs.min_node_version || '22.15.0' }}
             max_node_major: ${{ github.event.inputs.max_node_major || '' }} # blank ⇒ inherit the CLDMV/.github reusable default
             test_command: "npm test" # Use defaults: NODE_ENV=development, NODE_OPTIONS=--conditions=development
             # test_command: "NODE_OPTIONS='--conditions=slothlet-dev' npm test"  # Override NODE_OPTIONS only

.github/workflows/release-merge.yml

@@ -30,13 +30,17 @@
 # merge check, because check_suite silently never fired for that case at all.
 # `workflow_run` is GitHub's documented replacement for exactly this pattern.
 #
-# IMPORTANT: `workflows:` below must list the exact `name:` of THIS repo's own
-# ci.yml (matched by literal workflow name, not filename) — update it if you
-# renamed that workflow. If more than one top-level workflow in your repo can
-# plausibly be the last to finish (e.g. a separately-scheduled CodeQL run that
-# sometimes outlasts ci.yml), list all of them; a workflow that finishes and
-# isn't listed here won't re-arm the merge check, though the manual
-# workflow_dispatch fallback below always will.
+# IMPORTANT: the merge gate waits on EVERY check-run on the release PR's head
+# commit, from any workflow — so `workflows:` below must name every workflow in
+# your repo that puts a check on that commit, not just ci.yml. Only the one that
+# finishes LAST can see a fully green head; if it isn't listed, nothing re-fires
+# and the PR sits approved + green until you dispatch this workflow by hand.
+# CodeQL in particular routinely outlasts ci.yml (CLDMV/.github PR #322 stuck
+# exactly this way). The list below covers the standard v4 template set by their
+# template `name:`s — names are matched literally (not by filename), so fix any
+# you renamed, and add any extra PR-triggered workflow your repo has. Listing a
+# workflow your repo doesn't have is harmless. `branches:` limits re-fires to
+# runs on the integration branches, so feature-branch CI doesn't wake this up.
 #
 # Thin caller: all logic lives in the reusable, pinned at @v4.
 # NOTE: pull_request_review / workflow_run events run the copy of this file on
@@ -46,13 +50,32 @@ name: 🚦 Release Merge (v4)
 on:
     pull_request_review:
         types: [submitted] # your approval arms it
-    workflow_run:
-        workflows: ["🧪 CI Tests & Build"] # ← match your ci.yml's `name:` — see #318
+    workflow_run: # re-evaluate as each check-producing workflow finishes — see #318
+        workflows: # ← must match your workflows' `name:`s — see IMPORTANT above
+            - "🧪 CI Tests & Build"
+            - "🔍 CodeQL"
+            - "🔒 Dependency Review"
+            - "📊 Bundle Size"
+            - "🚀 Next Release (v4)"
+            - "🚑 Hotfixes Release (v4)"
+            - "🌿 Branch Retention"
+            - "🏷️ PR Labeler"
+            - "🏷️ PR Title Normalizer"
+            - "👋 Welcome Contributor"
+            - "🔀 Hotfix PR Redirector (v4)"
+            - "🚀 Member Auto-Enable Auto-Merge"
+            - "🤖 Dependabot Auto-Merge"
+            - "🔁 Dependabot Auto-Recreate"
+            - "📜 CLA"
+            - "📥 PR Notify"
         types: [completed]
+        branches: [next, hotfixes]
     workflow_dispatch: # manual re-evaluation
 
 # Serialize per repo: each run re-resolves the release PR + re-gates the head,
 # so queue (don't cancel) to avoid racing a merge that's already in flight.
+# GitHub keeps one pending run per group and a newer arrival replaces it — that
+# is harmless, since every run re-reads approval + check state from the API.
 concurrency:
     group: release-merge-${{ github.repository }}
     cancel-in-progress: false