@cosmicdrift/kumiko-guards 0.318.0 → 0.320.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.318.0",
+  "version": "0.320.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.318.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.320.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/run-guards.ts

@@ -17,6 +17,7 @@ import {
   reportResults,
   runGuards,
 } from "./_lib/guard-kit";
+import type { RepoRoot } from "./_lib/roots";
 import { writeSecurityBaselines } from "./_lib/security-baseline-cli";
 import { guard as asCasts } from "./check-as-casts";
 import { guard as complexity } from "./check-complexity";
@@ -103,10 +104,14 @@ export const GUARD_FLAGS = [
 
 const GUARD_NAME_PREFIX = "--guard=";
 
+export type RunGuardsCliDeps = {
+  readonly writeBaselineRoots?: readonly RepoRoot[];
+};
+
 // Shared by the direct `bun run-guards.ts` invocation below and by the
 // `guards` subcommand in cli.ts — one place for the flag behavior so the
 // two entry points can never drift.
-export function runGuardsCli(argv: readonly string[]): number {
+export function runGuardsCli(argv: readonly string[], deps: RunGuardsCliDeps = {}): number {
   const guardNameArg = argv.find((arg) => arg.startsWith(GUARD_NAME_PREFIX));
   const flags = guardNameArg === undefined ? argv : argv.filter((arg) => arg !== guardNameArg);
   const flagsError = cliFlagsError("guards", flags, GUARD_FLAGS);
@@ -148,8 +153,8 @@ export function runGuardsCli(argv: readonly string[]): number {
       console.error(`Guard "${guardName}" has no ratchet baseline to write.`);
       return 1;
     }
-    const project = buildSharedProject([target]);
-    target.writeBaseline(filesForGuard(project, target));
+    const project = buildSharedProject([target], deps.writeBaselineRoots);
+    target.writeBaseline(filesForGuard(project, target, deps.writeBaselineRoots));
     return 0;
   }
   const strictSecurityBaseline = flags.includes("--strict-security-baseline");