@jterrazz/typescript 10.2.0 → 10.2.2

package/bin/commands/check.sh

@@ -625,6 +625,7 @@ run_checks() {
     local checker_status=0
     local checker_dormant=0
     local checker_ratcheted=false
+    local checker_ratchet_broken=false
     if [ "$FIX_MODE" = false ]; then
         local checker_index=0
         while IFS= read -r specs_root; do
@@ -708,12 +709,32 @@ run_checks() {
         if member_checker .; then
             "${CHECKER_COMMAND[@]}" --format json > "$tmp_dir/checker.json" 2>/dev/null || true
             baseline_checker=(--checker "$tmp_dir/checker.json")
-            [ -f "$BASELINE_FILE" ] && checker_ratcheted=true
+            # Zeroing the pass below on the checker's say-so is only honest once
+            # the file actually HOLDS its findings — a baseline with none yet is
+            # not enrolled, and its debt is not the ratchet's to forgive.
+            if [ -f "$BASELINE_FILE" ] && grep -q '"jterrazz-check/' "$BASELINE_FILE"; then
+                checker_ratcheted=true
+            fi
         fi
 
-        node "$PACKAGE_ROOT/lib/check-baseline.js" "$tmp_dir/lint.json" . \
-            "${baseline_checker[@]}" >> "$tmp_dir/lint.log" 2>&1
-        lint_status=$?
+        # In fix mode there is no Test Conventions pass to carry a checker
+        # breach (the checker itself never runs there), so both reporters
+        # still speak through the one verdict this pass already owns. In
+        # check mode each reporter's breach is attributed to the pass that
+        # judges it: the script prints oxlint's refusals on stdout and the
+        # checker's — the enrolment notice among them — on stderr.
+        if [ "$FIX_MODE" = true ]; then
+            node "$PACKAGE_ROOT/lib/check-baseline.js" "$tmp_dir/lint.json" . \
+                "${baseline_checker[@]}" >> "$tmp_dir/lint.log" 2>&1
+            lint_status=$?
+        else
+            node "$PACKAGE_ROOT/lib/check-baseline.js" "$tmp_dir/lint.json" . \
+                "${baseline_checker[@]}" > "$tmp_dir/ratchet-oxlint.log" \
+                2> "$tmp_dir/ratchet-checker.log"
+            [ -s "$tmp_dir/ratchet-oxlint.log" ] && lint_status=1 || lint_status=0
+            cat "$tmp_dir/ratchet-oxlint.log" >> "$tmp_dir/lint.log"
+            [ -s "$tmp_dir/ratchet-checker.log" ] && checker_ratchet_broken=true
+        fi
     fi
 
     [ -n "$format_pid" ] && { wait $format_pid; format_status=$?; }
@@ -748,6 +769,13 @@ run_checks() {
         checker_status=0
     fi
 
+    # But the ratchet still has the last word: a checker id that grew, that
+    # nobody recorded, or that only now enrols, is this pass's debt to name —
+    # never the oxlint pass's, whichever way the loop above just left it.
+    if [ "$checker_ratchet_broken" = true ]; then
+        checker_status=1
+    fi
+
     local publish_failed_logs=()
     index=0
     for pid in "${publish_pids[@]}"; do
@@ -777,6 +805,14 @@ run_checks() {
     join_logs "$tmp_dir/docs.log" "${docs_failed_logs[@]}"
     join_logs "$tmp_dir/publish.log" "${publish_failed_logs[@]}"
 
+    # The checker's own ratchet breach — a grown id, one nobody recorded, or
+    # the enrolment notice — is this pass's log to carry, never the oxlint
+    # pass's; `join_logs` above rebuilds the file from the raw runs alone, so
+    # it is appended after, not folded into the block that just ran.
+    if [ "$checker_ratchet_broken" = true ] && [ -s "$tmp_dir/ratchet-checker.log" ]; then
+        cat "$tmp_dir/ratchet-checker.log" >> "$tmp_dir/checker.log"
+    fi
+
     # Two things this pass says even when it is green, so it asks for its log
     # the way a writer does: which findings the ratchet is holding, and which
     # member resolves a release too old to answer `--member` — a reader left

package/lib/check-baseline.js

@@ -33,6 +33,18 @@
  * rather than read as debts that reached zero: nothing measured them, and the
  * third refusal below would otherwise delete a file the next install needs.
  *
+ * A checker report given against a file that holds NO `jterrazz-check/*` entry
+ * yet is a second reporter joining an oxlint-only file — the upgrade, not new
+ * debt. The ratchet still fails it (a green gate that lies is worse), but
+ * names the gesture in ONE line rather than refusing every finding by rule:
+ * the per-rule refusals return once `typescript baseline` has recorded at
+ * least one `jterrazz-check/*` entry. The oxlint side is judged exactly as
+ * before either way.
+ *
+ * The two reporters' breaches print on two streams, so each is attributed to
+ * the pass that judges it: oxlint's on stdout, the checker's — the per-rule
+ * refusals and the one-line upgrade notice alike — on stderr.
+ *
  * Usage: node check-baseline.js <oxlint-json> [root] [--checker <json>] [--write]
  *
  * `--write` rewrites the file from the current counts — that is `typescript
@@ -42,7 +54,7 @@
 
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { argv, exit, stdout } from 'node:process';
+import { argv, exit, stderr, stdout } from 'node:process';
 
 /** The file, at the project root, tracked beside the config it ratchets. */
 export const BASELINE = 'oxlint.baseline.json';
@@ -50,6 +62,11 @@ export const BASELINE = 'oxlint.baseline.json';
 /** The namespace the conventions checker's ids take in the file. */
 const CHECKER_NAMESPACE = 'jterrazz-check/';
 
+/** A judge() line names its rule first, so the namespace prefix is enough. */
+function isCheckerReason(reason) {
+    return reason.startsWith(CHECKER_NAMESPACE);
+}
+
 /** `eslint(no-debugger)` is how oxlint's JSON spells `eslint/no-debugger`. */
 function ruleOf(code) {
     const match = /^(?<plugin>[\w-]+)\((?<rule>[^)]+)\)$/u.exec(code ?? '');
@@ -208,14 +225,54 @@ if (import.meta.main) {
         exit(rules.length > 0 ? 1 : 0);
     }
 
-    const broken = judge(counts, baseline);
+    /*
+     * A checker report against a file the checker never entered yet is an
+     * upgrade, not a debt list: refusing it rule by rule would print, on a
+     * first install, exactly as many refusals as the checker has findings —
+     * every one of them the same gesture ('typescript baseline') said once.
+     */
+    const enrolling =
+        checkerPath !== undefined &&
+        !Object.keys(baseline).some((rule) => rule.startsWith(CHECKER_NAMESPACE));
+
+    let oxlintBroken;
+    let checkerBroken;
+    let enrolNotice;
 
-    for (const reason of broken) {
+    if (enrolling) {
+        const findings = diagnosticsOf(checkerReport).length;
+        oxlintBroken = judge(countsOf(report), baseline);
+        checkerBroken = [];
+        enrolNotice =
+            findings > 0
+                ? `${BASELINE} records one reporter — run 'typescript baseline' once to enrol @jterrazz/test's ${findings} finding(s)`
+                : undefined;
+    } else {
+        const broken = judge(counts, baseline);
+        oxlintBroken = broken.filter((reason) => !isCheckerReason(reason));
+        checkerBroken = broken.filter((reason) => isCheckerReason(reason));
+        enrolNotice = undefined;
+    }
+
+    for (const reason of oxlintBroken) {
         stdout.write(`baseline-ratchet  ${BASELINE}  ${reason}\n`);
     }
-    if (broken.length > 0) {
+    if (oxlintBroken.length > 0) {
         stdout.write("Run 'typescript baseline' to record where the project actually stands.\n");
     }
 
-    exit(broken.length > 0 ? 1 : 0);
+    for (const reason of checkerBroken) {
+        stderr.write(`baseline-ratchet  ${BASELINE}  ${reason}\n`);
+    }
+    if (checkerBroken.length > 0) {
+        stderr.write("Run 'typescript baseline' to record where the project actually stands.\n");
+    }
+    if (enrolNotice !== undefined) {
+        stderr.write(`${enrolNotice}\n`);
+    }
+
+    const brokenTotal =
+        oxlintBroken.length + checkerBroken.length + (enrolNotice === undefined ? 0 : 1);
+
+    exit(brokenTotal > 0 ? 1 : 0);
 }

package/lib/check-suppressions.js

@@ -75,7 +75,8 @@ const hasReason = (tail) => (tail.split(REASON)[1] ?? '').replace(/\*\/\s*$/u, '
  *
  * A JS plugin's rules never appear in `--print-config`, so a directive naming
  * one is unverifiable — and the gate says nothing rather than calling a live
- * rule dead.
+ * rule dead. The namespaces returned are therefore the ones the printed config
+ * can ANSWER for: the plugins it loaded, and never a JS plugin's.
  */
 function resolveConfig(root, oxlint) {
     let printed;
@@ -89,21 +90,33 @@ function resolveConfig(root, oxlint) {
         return null;
     }
 
-    let rules;
+    let resolved;
     try {
-        const resolved = JSON.parse(printed);
-        rules = { ...resolved.rules };
-        /* A rule armed only in an override — a test-file rule, a layer's
-         * `no-restricted-imports` — is live for the files it names. */
-        for (const override of resolved.overrides ?? []) {
-            for (const [name, level] of Object.entries(override.rules ?? {})) {
-                rules[name] ??= level;
-            }
-        }
+        resolved = JSON.parse(printed);
     } catch {
         return null;
     }
 
+    const rules = { ...resolved.rules };
+    /* A rule armed only in an override — a test-file rule, a layer's
+     * `no-restricted-imports` — is live for the files it names. */
+    for (const override of resolved.overrides ?? []) {
+        for (const [name, level] of Object.entries(override.rules ?? {})) {
+            rules[name] ??= level;
+        }
+    }
+
+    return { namespaces: namespacesOf(resolved, rules), rules };
+}
+
+/**
+ * The namespaces the printed config can ANSWER for. Where it loads a JS plugin,
+ * a namespace outside the plugins it printed is that plugin's, and the map holds
+ * at most the few of its rules a `rules` or `allow` entry happened to name —
+ * never the live ones. Such a namespace is dropped rather than read as evidence
+ * that every OTHER rule of it is off.
+ */
+function namespacesOf(resolved, rules) {
     const namespaces = new Set();
     for (const name of Object.keys(rules)) {
         if (name.includes('/')) {
@@ -111,7 +124,13 @@ function resolveConfig(root, oxlint) {
         }
     }
 
-    return { namespaces, rules };
+    if ((resolved.jsPlugins?.length ?? 0) === 0) {
+        return namespaces;
+    }
+
+    const loaded = new Set(resolved.plugins);
+
+    return new Set([...namespaces].filter((namespace) => loaded.has(namespace)));
 }
 
 /** Where a named rule stands for this project: `live`, `dead`, or `unverifiable`. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@jterrazz/typescript",
-    "version": "10.2.0",
+    "version": "10.2.2",
     "license": "MIT",
     "author": "Jean-Baptiste Terrazzoni <contact@jterrazz.com>",
     "repository": {
@@ -84,7 +84,7 @@
         "typescript": "^6.0.0"
     },
     "devDependencies": {
-        "@jterrazz/test": "^15.0.0",
+        "@jterrazz/test": "^15.3.0",
         "@types/node": "^26.1.1",
         "vitest": "^4.1.10"
     },