@krizaka/config 0.8.0 → 0.8.1

package/README.md

@@ -136,7 +136,7 @@ Every message names the home and ends « Missing function? add it to the package
 to the Krizaka package, never worked around with the library. Run it with `depcruise --output-type err-long <folders>`
 to read the message (`err` prints the rule name only). Beside the domains, the preset owes every repository
 `no-circular`, `not-to-unresolvable` (declare the dependency, or fix the path; set `options.tsConfig` for path aliases)
-and `not-to-dev-dep` (tests, stories, scripts and tool configs may import devDependencies). Run `depcruise` from the
+and `not-to-dev-dep` (tests, stories, scripts and tool configs may import devDependencies; a package that is also a `peerDependency` is installed by the consumer, so production code may import it). Run `depcruise` from the
 workspace that owns the `package.json`.
 
 #### Known violations (they only shrink)

package/dependency-cruiser.cjs

@@ -57,9 +57,10 @@ function createConfig({ exemptFrom = [] } = {}) {
       {
         name: "not-to-dev-dep",
         severity: "error",
-        comment: "Production code imports a devDependency: it is not installed in production. Move the package to `dependencies`, or the import to a test.",
+        comment: "Production code imports a devDependency: it is not installed in production. Move the package to `dependencies` (or `peerDependencies`, for a library whose consumer installs it), or the import to a test.",
         from: { pathNot: [NODE_MODULES, DEV_FILES] },
-        to: { dependencyTypes: ["npm-dev"], dependencyTypesNot: ["type-only"], pathNot: ["node_modules/@types/"] },
+        // a package that is also a peer dependency (the library declares it for its consumer, and keeps a copy to test with) is installed where it is used
+        to: { dependencyTypes: ["npm-dev"], dependencyTypesNot: ["type-only", "npm-peer"], pathNot: ["node_modules/@types/"] },
       },
     ],
     options: {

package/eslint/rules.js

@@ -169,16 +169,7 @@ export function ownProductPrefix(cwd) {
   for (let dir = cwd; ; dir = dirname(dir)) {
     const file = join(dir, "package.json");
     if (existsSync(file)) {
-      try {
-        const name = String(JSON.parse(readFileSync(file, "utf8")).name ?? "");
-        // A product names its packages `<product>-<part>` (acme-monorepo, @org/acme-admin); a one-word package
-        // (@org/realtime, @org/ui) is a building block, not a product, and a context word is never one.
-        const words = name.replace(/^@[^/]+\//, "").split(/[-_.]/).filter(Boolean);
-        const word = words.length > 1 ? words[0].toUpperCase() : "";
-        found = /^[A-Z][A-Z0-9]+$/.test(word) && !ENV_CONTEXT_WORDS.includes(word) ? word : null;
-      } catch {
-        found = null;
-      }
+      found = productPrefixOf(file);
       break;
     }
     if (dirname(dir) === dir) break;
@@ -187,6 +178,24 @@ export function ownProductPrefix(cwd) {
   return found;
 }
 
+/**
+ * The product word of one package.json (see `ownProductPrefix`); null when it cannot be read or is not a product.
+ * @param {string} file
+ * @returns {string | null}
+ */
+function productPrefixOf(file) {
+  try {
+    const name = String(JSON.parse(readFileSync(file, "utf8")).name ?? "");
+    // A product names its packages `<product>-<part>` (acme-monorepo, @org/acme-admin); a one-word package
+    // (@org/realtime, @org/ui) is a building block, not a product, and a context word is never one.
+    const words = name.replace(/^@[^/]+\//, "").split(/[-_.]/).filter(Boolean);
+    const word = words.length > 1 ? words[0].toUpperCase() : "";
+    return /^[A-Z][A-Z0-9]+$/.test(word) && !ENV_CONTEXT_WORDS.includes(word) ? word : null;
+  } catch {
+    return null;
+  }
+}
+
 /** Vendors: a vendor is a value (`MEDIA_STORAGE_PROVIDER=bunny`, `MAIL_PROVIDER=mailgun`), never a name. */
 export const ENV_VENDOR_PREFIXES = Object.freeze([
   "BUNNY", "MAILGUN", "RESEND", "SENDGRID", "POSTMARK", "STRIPE", "CCBILL", "SEGPAY", "NOWPAYMENTS", "PAYPAL",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@krizaka/config",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "The shared configuration of every Krizaka JavaScript repository: ESLint flat configs (base, Next.js, the four UI rules, the stack rules, no locale ternary), the « Krizaka first » covered-domains map and the dependency-cruiser preset generated from it (refused imports, cycles, unresolvable imports, dev dependencies), tsconfig bases, Prettier, EditorConfig, and the krizaka-ratchet and krizaka-known-violations debt counters.",
   "keywords": [
     "krizaka",

package/patterns.js

@@ -102,20 +102,40 @@ export function balancedArguments(source, open) {
   let depth = 0;
   for (let i = open; i < source.length; i += 1) {
     const c = source[i];
-    if (c === '"' || c === "'" || c === "`") {
-      for (i += 1; i < source.length && source[i] !== c; i += 1) if (source[i] === "\\") i += 1;
-    } else if (c === "/" && source[i + 1] === "/") {
-      i = source.indexOf("\n", i);
-      if (i < 0) break;
-    } else if (c === "/" && source[i + 1] === "*") {
-      i = source.indexOf("*/", i + 2) + 1;
-      if (i <= 0) break;
-    } else if (c === "(") depth += 1;
+    const skipped = skipLiteralOrComment(source, i);
+    if (skipped === null) break;
+    if (skipped > i) i = skipped;
+    else if (c === "(") depth += 1;
     else if (c === ")" && --depth === 0) return source.slice(open + 1, i);
   }
   return source.slice(open + 1);
 }
 
+/**
+ * Where a string, template or comment that starts at `i` ends (the index of its last character), `i` itself when none starts
+ * there, null when a line comment or a block comment never ends.
+ * @param {string} source
+ * @param {number} i
+ * @returns {number | null}
+ */
+function skipLiteralOrComment(source, i) {
+  const c = source[i];
+  if (c === '"' || c === "'" || c === "`") {
+    let end = i + 1;
+    while (end < source.length && source[end] !== c) end += source[end] === "\\" ? 2 : 1;
+    return end;
+  }
+  if (c === "/" && source[i + 1] === "/") {
+    const end = source.indexOf("\n", i);
+    return end < 0 ? null : end;
+  }
+  if (c === "/" && source[i + 1] === "*") {
+    const end = source.indexOf("*/", i + 2);
+    return end < 0 ? null : end + 1;
+  }
+  return i;
+}
+
 // ── Selections live in the URL (Oussama, 2026-10-22: « changer les tabs doit changer les routes ») ──────────────────────
 // Read by the ESLint rule krizaka/route-state-selection and by the ratchet.
 

package/ratchet/ratchet.js

@@ -2,7 +2,7 @@
 // Same patterns as the ESLint rules (../patterns.js), applied to the source text: the counter sees every
 // occurrence (a class in a `cn()` argument or a constant too), so it can only be stricter than the rule.
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { relative, resolve } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 
 import { glob } from "tinyglobby";
 
@@ -190,6 +190,25 @@ export class RatchetError extends Error {}
  * @property {boolean} written the ratchet file was created, lowered or completed
  */
 
+/**
+ * Each counter against its recorded value: the report, and the names that went up or down.
+ * @param {Counters} current
+ * @param {Counters} recorded
+ */
+function compareCounters(current, recorded) {
+  /** @type {RatchetResult["counters"]} */
+  const report = /** @type {any} */ ({});
+  /** @type {CounterName[]} */ const increased = [];
+  /** @type {CounterName[]} */ const decreased = [];
+  for (const name of COUNTERS) {
+    const delta = current[name] - recorded[name];
+    report[name] = { recorded: recorded[name], current: current[name], delta };
+    if (delta > 0) increased.push(name);
+    if (delta < 0) decreased.push(name);
+  }
+  return { report, increased, decreased };
+}
+
 /**
  * Runs the ratchet.
  * - `check` (default): fails when a counter is above its recorded value.
@@ -201,6 +220,11 @@ export class RatchetError extends Error {}
  */
 export async function runRatchet({ root, mode = "check", globs, file = RATCHET_FILE }) {
   const path = resolve(root, file);
+  // the ratchet file is read and written: it stays a .json file inside the repository root (no `../`, no absolute path elsewhere)
+  const inside = relative(resolve(root), path);
+  if (!path.endsWith(".json") || inside === "" || inside.startsWith("..") || isAbsolute(inside)) {
+    throw new RatchetError(`${file}: the ratchet file must be a .json file inside ${root}.`);
+  }
   const exists = existsSync(path);
   if (mode === "init" && exists) throw new RatchetError(`${file} already exists: use --update to lower it.`);
   if (mode !== "init" && !exists) throw new RatchetError(`${file} not found in ${root}: run krizaka-ratchet --init first.`);
@@ -222,16 +246,7 @@ export async function runRatchet({ root, mode = "check", globs, file = RATCHET_F
   /** @type {CounterName[]} */ const added = recordedFile ? COUNTERS.filter((n) => recordedFile.counters[n] === undefined) : [];
   const recorded = /** @type {Counters} */ ({ ...current, ...recordedFile?.counters });
 
-  /** @type {RatchetResult["counters"]} */
-  const report = /** @type {any} */ ({});
-  /** @type {CounterName[]} */ const increased = [];
-  /** @type {CounterName[]} */ const decreased = [];
-  for (const name of COUNTERS) {
-    const delta = current[name] - recorded[name];
-    report[name] = { recorded: recorded[name], current: current[name], delta };
-    if (delta > 0) increased.push(name);
-    if (delta < 0) decreased.push(name);
-  }
+  const { report, increased, decreased } = compareCounters(current, recorded);
 
   let written = false;
   if (mode === "init") {