@casomoltd/tooling 0.29.0 → 0.30.0

package/README.md

@@ -30,8 +30,8 @@ Shared linting, formatting, commit config, and CLI tools for Casomo Ltd's repos.
 | `build-report` | Compile a Typst client report to PDF with the house template |
 | `render-figures` | Pre-render a design spec's mermaid figures to static SVG |
 | `spec-check` | Check a design spec's anchors, contents, figures and numbering |
-| `check-private-refs` | In a public repo, refuse a private tracker link or a name listed in `check-private-refs.config.mjs` |
-| `check-personal-data` | Refuse an email, National Insurance number, UK mobile number, date of birth or locally denylisted name; per-repo allowances in `check-personal-data.config.mjs` |
+| `check-private-refs` | In a public repo, refuse a private tracker link or a name listed under `privateRefs` in `casomo.config.mjs` |
+| `check-personal-data` | Refuse an email, National Insurance number, UK mobile number, date of birth or locally denylisted name; per-repo allowances under `personalData` in `casomo.config.mjs` |
 
 ## Install
 

package/bin/check-personal-data.mjs

@@ -16,16 +16,18 @@
  *
  * Deliberately configurable, because this file ships in a public package and
  * cannot name anybody's domains or reference formats. A consuming repo adds
- * its own in `check-personal-data.config.mjs`:
+ * its own under `personalData` in its `casomo.config.mjs`:
  *
  *   export default {
- *     allowEmail: [/@example-org\.com$/i],   // addresses that are not people
- *     rules: [                               // repo-specific identifiers
- *       {name: "case reference", re: /\bCASE-\d{4,}\b/g,
- *        allow: (m) => m === "CASE-0000"},
- *     ],
- *     denylist: ".personal-data-denylist",   // the default; gitignore it
- *     allow: [/\.test\.mjs$/],               // paths exempted, with care
+ *     personalData: {
+ *       allowEmail: [/@example-org\.com$/i], // addresses that are not people
+ *       rules: [                             // repo-specific identifiers
+ *         {name: "case reference", re: /\bCASE-\d{4,}\b/g,
+ *          allow: (m) => m === "CASE-0000"},
+ *       ],
+ *       denylist: ".personal-data-denylist", // the default; gitignore it
+ *       allow: [/\.test\.mjs$/],             // paths exempted, with care
+ *     },
  *   };
  *
  * Usage:
@@ -35,7 +37,7 @@
 import {execFileSync} from "node:child_process";
 import {existsSync, readFileSync, realpathSync, statSync} from "node:fs";
 import {pathToFileURL} from "node:url";
-import {loadConfig} from "./utils.mjs";
+import {CASOMO_CONFIG_KEYS, loadCasomoConfig} from "./utils.mjs";
 
 /** Addresses in every repo's own tooling that name no person. */
 const ALLOWED_EMAIL = [
@@ -217,9 +219,7 @@ export function scan(fileList, read, rules, names) {
 }
 
 async function main() {
-  const mod = await loadConfig("check-personal-data.config.mjs");
-  // `loadConfig` returns the module, so the config is its default export.
-  const config = mod?.default ?? {};
+  const config = await loadCasomoConfig(CASOMO_CONFIG_KEYS.personalData);
   const denylist = config.denylist ?? ".personal-data-denylist";
   const rules = [...identityRules(config.allowEmail), ...(config.rules ?? [])];
   const names = denied(denylist);

package/bin/check-private-refs.mjs

@@ -21,21 +21,24 @@
  * a public package, so it cannot itself name anybody's private repos,
  * boards or hosts — that would be the disclosure it exists to prevent.
  * The defaults cover hosted trackers that are private by default; a
- * consuming repo adds its own names in `check-private-refs.config.mjs`:
+ * consuming repo adds its own names under `privateRefs` in its
+ * `casomo.config.mjs`:
  *
  *   export default {
- *     visibility: 'public',        // optional; skips the gh lookup
- *     forbidden: [                 // strings or RegExp
- *       {pattern: /internal\.example\.net/, why: 'internal hostname'},
- *     ],
- *     allow: [/CHANGELOG\.md$/],   // paths exempted, with care
+ *     privateRefs: {
+ *       visibility: 'public',        // optional; skips the gh lookup
+ *       forbidden: [                 // strings or RegExp
+ *         {pattern: /internal\.example\.net/, why: 'internal hostname'},
+ *       ],
+ *       allow: [/CHANGELOG\.md$/],   // paths exempted, with care
+ *     },
  *   };
  */
 
 import {execFileSync} from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import {loadConfig} from "./utils.mjs";
+import {CASOMO_CONFIG_KEYS, loadCasomoConfig} from "./utils.mjs";
 
 /**
  * Hosted trackers whose links are private by default.
@@ -95,11 +98,7 @@ function toMatchers(entries) {
 }
 
 async function main() {
-  const mod = await loadConfig("check-private-refs.config.mjs");
-  // `loadConfig` returns the MODULE, so the config is its default
-  // export. Reading the module object itself silently found no
-  // patterns and reported a clean repo.
-  const config = mod?.default ?? {};
+  const config = await loadCasomoConfig(CASOMO_CONFIG_KEYS.privateRefs);
   const visibility = repoVisibility(config.visibility);
 
   if (visibility === null) {
@@ -109,7 +108,7 @@ async function main() {
     console.warn(
       "check-private-refs: SKIPPED — could not determine repo "
       + "visibility (is `gh` installed and authenticated?). Set "
-      + "`visibility` in check-private-refs.config.mjs to be explicit.",
+      + "`privateRefs.visibility` in casomo.config.mjs to be explicit.",
     );
     return;
   }

package/bin/utils.mjs

@@ -39,13 +39,55 @@ export function openPath(target) {
 }
 
 /**
- * Load an optional per-repo config file from cwd.
- *
- * Each CLI tool looks for `<tool>.config.mjs` (e.g.
- * `readability.config.mjs`) in the consumer's project root.
+ * Load an optional per-repo config file from `dir` (the working directory by
+ * default): the module, or `{}` where there is no file. The file-level loader
+ * under `loadCasomoConfig`, which is where a gate's settings belong; a tool
+ * still reading its own `<tool>.config.mjs` (`readability`) calls this.
  */
-export async function loadConfig(filename) {
-  const cfgPath = path.join(process.cwd(), filename);
+export async function loadConfig(filename, dir = process.cwd()) {
+  const cfgPath = path.join(dir, filename);
   if (!fs.existsSync(cfgPath)) return {};
   return import(pathToFileURL(cfgPath).href);
 }
+
+/** The keys a repo's `casomo.config.mjs` may hold, one per gate. */
+export const CASOMO_CONFIG_KEYS = {
+  personalData: "personalData",
+  privateRefs: "privateRefs",
+};
+
+/** The files each gate read before `casomo.config.mjs`, by the key their
+ *  settings now go under. A repo still holding one would have its settings
+ *  ignored, so their presence fails the run. */
+const RETIRED_CONFIGS = {
+  "check-personal-data.config.mjs": CASOMO_CONFIG_KEYS.personalData,
+  "check-private-refs.config.mjs": CASOMO_CONFIG_KEYS.privateRefs,
+};
+
+/**
+ * One gate's settings from the repo's `casomo.config.mjs`, by the key it
+ * reads: every gate a repo configures is configured in that one file, so a
+ * repo carries one config rather than one per tool. An absent file or key
+ * reads as no settings; a retired per-tool file, or a key no gate reads, is
+ * refused, because either would otherwise read as no settings too and a
+ * gate would pass on less than it was given.
+ */
+export async function loadCasomoConfig(key, dir = process.cwd()) {
+  for (const [file, moveTo] of Object.entries(RETIRED_CONFIGS)) {
+    if (fs.existsSync(path.join(dir, file))) {
+      throw new Error(`${file} is no longer read: move its settings under `
+        + `\`${moveTo}\` in casomo.config.mjs and delete it`);
+    }
+  }
+  const mod = await loadConfig("casomo.config.mjs", dir);
+  // The settings are the module's default export; the module object itself
+  // holds no gate key and would read as no settings.
+  const config = mod?.default ?? {};
+  const known = Object.values(CASOMO_CONFIG_KEYS);
+  const unknown = Object.keys(config).filter((k) => !known.includes(k));
+  if (unknown.length) {
+    throw new Error(`casomo.config.mjs holds ${unknown.join(", ")}, which no `
+      + `gate reads; the keys are ${known.join(", ")}`);
+  }
+  return config[key] ?? {};
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casomoltd/tooling",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Casomo's shared dev config: ESLint, Prettier, commitlint, knip & jscpd presets and dev CLIs (git hooks, readability, screenshots, design specs)",
   "license": "MIT",
   "repository": {
@@ -23,7 +23,7 @@
   "scripts": {
     "check": "node bin/check-gates.mjs && node bin/verify-pack.mjs && npm run check:private-refs && npm run check:personal-data && npm run typecheck && npm run test && npm run lint:md",
     "typecheck": "tsc --noEmit -p hooks/tsconfig.json",
-    "test": "node hooks/test.mts && node bin/check-gates.test.mjs && node bin/check-personal-data.test.mjs && node commitlint/index.test.mjs",
+    "test": "node hooks/test.mts && node bin/check-gates.test.mjs && node bin/check-personal-data.test.mjs && node bin/casomo-config.test.mjs && node commitlint/index.test.mjs",
     "lint:md": "remark --frail --quiet --no-stdout --rc-path bin/skills-lint.config.mjs skills agents docs",
     "build": "echo 'no-op: source-only repo, nothing to build'",
     "prepare": "husky || true",