@limenet-ch/baseline 2.9.0

package/js/dist/support/npmrc.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Parse an .npmrc into a key => value map. Comments (# and ;) and lines without
+ * an `=` are skipped, mirroring AbstractCheck::getNpmrc() in the PHP runner.
+ */
+export declare function parseNpmrc(contents: string | null): Record<string, string>;
+/**
+ * Set each key, updating an existing line in place or appending it, so all other
+ * lines and comments survive.
+ */
+export declare function upsertNpmrc(contents: string | null, entries: Record<string, string>): string;

package/js/dist/support/npmrc.js

@@ -0,0 +1,36 @@
+/**
+ * Parse an .npmrc into a key => value map. Comments (# and ;) and lines without
+ * an `=` are skipped, mirroring AbstractCheck::getNpmrc() in the PHP runner.
+ */
+export function parseNpmrc(contents) {
+    const config = {};
+    for (const rawLine of (contents ?? '').split('\n')) {
+        const line = rawLine.trim();
+        if (line === '' || line.startsWith('#') || line.startsWith(';') || !line.includes('=')) {
+            continue;
+        }
+        const separator = line.indexOf('=');
+        config[line.slice(0, separator).trim()] = line.slice(separator + 1).trim();
+    }
+    return config;
+}
+/**
+ * Set each key, updating an existing line in place or appending it, so all other
+ * lines and comments survive.
+ */
+export function upsertNpmrc(contents, entries) {
+    const existing = contents ?? '';
+    const lines = existing === '' ? [] : existing.replace(/\n+$/, '').split('\n');
+    for (const [key, value] of Object.entries(entries)) {
+        const line = `${key}=${value}`;
+        const index = lines.findIndex((candidate) => new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(candidate));
+        if (index === -1) {
+            lines.push(line);
+        }
+        else {
+            lines[index] = line;
+        }
+    }
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=npmrc.js.map

package/js/dist/support/npmrc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmrc.js","sourceRoot":"","sources":["../../src/support/npmrc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAuB;IAC9C,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAE3B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrF,SAAQ;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAEnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC9E,CAAC;IAED,OAAO,MAAM,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAuB,EAAE,OAA+B;IAChF,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE7E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,KAAK,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CACxC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CACxF,CAAA;QAED,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;aAAM,CAAC;YACJ,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QACvB,CAAC;IACL,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AAClC,CAAC"}

package/js/dist/support/versions.d.ts

@@ -0,0 +1,10 @@
+/**
+ * True when every version the constraint allows is >= the floor — i.e. it never
+ * intersects "< floor". Unparseable input is treated as not guaranteeing it,
+ * matching the PHP runner's handling of Composer\Semver's UnexpectedValueException.
+ */
+export declare function guaranteesAtLeast(constraint: string, floor: string): boolean;
+/** True when the two constraints have at least one version in common. */
+export declare function compatible(a: string, b: string): boolean;
+/** The major of a constraint's lowest allowed version, or null if unparseable. */
+export declare function lowestMajor(constraint: string): string | null;

package/js/dist/support/versions.js

@@ -0,0 +1,34 @@
+import semver from 'semver';
+/**
+ * True when every version the constraint allows is >= the floor — i.e. it never
+ * intersects "< floor". Unparseable input is treated as not guaranteeing it,
+ * matching the PHP runner's handling of Composer\Semver's UnexpectedValueException.
+ */
+export function guaranteesAtLeast(constraint, floor) {
+    try {
+        return !semver.intersects(constraint, `<${floor}`, { loose: true });
+    }
+    catch {
+        return false;
+    }
+}
+/** True when the two constraints have at least one version in common. */
+export function compatible(a, b) {
+    try {
+        return semver.intersects(a, b, { loose: true });
+    }
+    catch {
+        return false;
+    }
+}
+/** The major of a constraint's lowest allowed version, or null if unparseable. */
+export function lowestMajor(constraint) {
+    try {
+        const lowest = semver.minVersion(constraint, { loose: true });
+        return lowest === null ? null : String(lowest.major);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=versions.js.map

package/js/dist/support/versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"versions.js","sourceRoot":"","sources":["../../src/support/versions.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,KAAa;IAC/D,IAAI,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IAChB,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,UAAU,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IAChB,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC1C,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAE7D,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACf,CAAC;AACL,CAAC"}

package/js/skills/creating-a-release/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: creating-a-release
+description: Cut, tag, and publish a new release of this project using release-it. Use when asked to create, cut, tag, or publish a release, or bump the project version.
+---
+
+# Creating a release
+
+This project (per the [@limenet-ch/baseline](https://github.com/limenet/laravel-baseline)
+standards) releases with [release-it](https://github.com/release-it/release-it). Versioning is
+semantic and the canonical version lives in `package.json`.
+
+## When to use this skill
+
+Use this when the task is to create, cut, tag, or publish a new release — or otherwise bump the
+project's version.
+
+## How to release
+
+Run the release script — it drives release-it interactively (choose the next version, then it
+tags, commits, and publishes):
+
+```bash
+npm run release
+```
+
+`release-it` handles the version bump, git tag, commit, and (if configured) the remote release.
+
+## Conventions
+
+- **Semantic versioning.** Pick the next version per semver (patch / minor / major) based on the
+  changes since the last tag.
+- **`package.json` `version` is authoritative.** Do not hand-edit it for a release — let
+  `npm run release` set it.
+- **No `@release-it/bumper`.** release-it already writes `package.json` itself, so the bumper
+  plugin is redundant here. It is only needed when a *different* file holds the canonical version
+  (as in the Laravel projects, where `composer.json` does). The `usesReleaseIt` baseline check
+  fails if it is configured.
+
+## Configuration reference
+
+The relevant config the baseline enforces:
+
+- `package.json` → `scripts.release` = `"release-it"`
+- `package.json` → `devDependencies` includes `release-it`
+- `.release-it.json` → no `plugins['@release-it/bumper']` entry

package/js/skills/updating-dependencies/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: updating-dependencies
+description: Update the project's npm dependencies, review changelogs for their impact on this project, and report majors blocked by semver. Use when asked to update or upgrade dependencies, run the monthly dependency update, or when prompted by the `updatesDependencies` periodic baseline check.
+---
+
+# Updating dependencies
+
+This project (per the [@limenet-ch/baseline](https://github.com/limenet/laravel-baseline)
+standards) keeps its npm dependencies current on a monthly cadence. This skill drives that routine:
+it surveys what is outdated, applies the safe in-constraint updates, reviews each meaningful bump's
+changelog against how this project actually uses the package, and reports the majors that are
+blocked by the version constraints so they can be tackled deliberately.
+
+## When to use this skill
+
+Use this when the task is to update or upgrade dependencies, run the monthly dependency update, or
+bring npm packages current. This is the skill the `updatesDependencies` periodic check points
+developers to — run it when that check prompts you.
+
+The routine is **agent-driven, not interactive**: run the survey commands non-interactively,
+present the findings, and apply only the upgrades the developer approves. Do not run interactive
+TUIs (e.g. `npm-check-updates --interactive`) — you drive the selection yourself.
+
+## How to update
+
+### 1. Survey what is outdated (no changes yet)
+
+Group the available upgrades by patch / minor / major, without changing anything:
+
+```bash
+npx npm-check-updates --format group
+```
+
+### 2. Apply the in-constraint updates
+
+Update everything that fits the existing constraints and refresh the lock file:
+
+```bash
+npm update
+```
+
+If `biome` moved (here or in step 4), sync the `$schema` in `biome.json` to the new version — see
+the Biome convention below.
+
+### 3. Review changelogs against this project
+
+For each package with a meaningful bump (from the survey and from step 2), fetch its changelog or
+GitHub release notes for the version delta and assess the concrete impact on *this* project:
+
+- Call out breaking changes, deprecations, and any required migration steps.
+- Distinguish changes that actually affect this project's usage from cosmetic or internal ones —
+  check how the package is used in the app code before claiming impact.
+
+### 4. Handle the majors blocked by semver
+
+Present the grouped major upgrades from `npm-check-updates` and recommend per package based on the
+changelog review. Apply **only the upgrades the developer approves**, one at a time:
+
+```bash
+npx npm-check-updates -u <package>
+```
+
+```bash
+npm install
+```
+
+Watch for `engines` conflicts: this project sets `engine-strict=true`, so a package requiring a
+newer Node than `engines.node` allows will refuse to install rather than warn.
+
+### 5. Verify (always)
+
+Run the lint suite and fix every issue before considering the update complete:
+
+```bash
+npm run ci-lint
+```
+
+## What to report
+
+Produce a written summary:
+
+- **Updated in-constraint** — packages that moved, each as `old → new`.
+- **Changelog impact** — per package, what changed and whether it affects this project (with the
+  migration step, if any).
+- **Blocked by semver** — the majors / upgrades held back by the constraints, each with a
+  recommendation: bump now, defer, or skip, and why.
+- **Lint fixes** — anything the `ci-lint` run required you to fix.
+
+## Conventions
+
+- **`ci-lint` is the gate.** Always run `npm run ci-lint` after updating, and fix every issue
+  before finishing.
+- **Assess impact against real usage.** Judge changelog impact by how the project actually uses the
+  package — do not assume a change is relevant or irrelevant without looking.
+- **Recommend, then apply approved.** Survey and recommend beyond-constraint bumps; apply only the
+  ones the developer approves. Never cross a version constraint automatically.
+- **Respect the install cooldown.** `.npmrc` sets `min-release-age`, so a version published within
+  that window is deliberately skipped. Do not lower or bypass it to pull in a fresh release.
+- **Keep Biome's `$schema` in sync.** If `biome` is installed and its version changed, update the
+  `$schema` URL in `biome.json` to match the new version (e.g.
+  `https://biomejs.dev/schemas/<new-version>/schema.json`). Skip this if there is no `biome.json` or
+  Biome was not bumped.
+- **Plain commit messages.** If asked to commit, write a plain, descriptive message in the
+  imperative mood (this project does not use Conventional Commits).

package/package.json

@@ -0,0 +1,67 @@
+{
+    "name": "@limenet-ch/baseline",
+    "version": "2.9.0",
+    "description": "A highly opinionated baseline for JS/TS projects.",
+    "keywords": [
+        "baseline",
+        "conformance",
+        "lint",
+        "standards"
+    ],
+    "homepage": "https://github.com/limenet/laravel-baseline",
+    "bugs": "https://github.com/limenet/laravel-baseline/issues",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/limenet/laravel-baseline.git"
+    },
+    "license": "MIT",
+    "author": "Linus Metzler <hi@linusmetzler.me>",
+    "type": "module",
+    "engines": {
+        "node": ">=24"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "bin": {
+        "baseline": "js/dist/bin.js"
+    },
+    "exports": {
+        ".": {
+            "types": "./js/dist/index.d.ts",
+            "default": "./js/dist/index.js"
+        },
+        "./policy.json": "./policy/policy.json",
+        "./package.json": "./package.json"
+    },
+    "files": [
+        "js/dist",
+        "js/skills",
+        "policy"
+    ],
+    "scripts": {
+        "build": "tsc -p tsconfig.build.json",
+        "typecheck": "tsc -p tsconfig.json --noEmit",
+        "lint": "biome check js policy",
+        "format": "biome check --write js policy",
+        "test": "vitest run",
+        "ci-lint": "biome ci js policy && tsc -p tsconfig.json --noEmit",
+        "prepack": "npm run build",
+        "release": "GITHUB_TOKEN=$(gh auth token) release-it"
+    },
+    "dependencies": {
+        "semver": "^7.8.5",
+        "yaml": "^2.9.0"
+    },
+    "devDependencies": {
+        "@biomejs/biome": "^2.5.10",
+        "@release-it/bumper": "^8.0.0",
+        "@release-it/conventional-changelog": "^12.0.0",
+        "@types/node": "^24.10.1",
+        "@types/semver": "^7.8.0",
+        "conventional-changelog-conventionalcommits": "^10.4.0",
+        "release-it": "^21.0.2",
+        "typescript": "^7.0.2",
+        "vitest": "^4.1.11"
+    }
+}

package/policy/policy.json

@@ -0,0 +1,131 @@
+{
+    "$schema": "./policy.schema.json",
+    "node": {
+        "minMajor": "24"
+    },
+    "npm": {
+        "minMajor": "12",
+        "constraint": "^12",
+        "minReleaseAgeDays": 7,
+        "engineStrict": true
+    },
+    "biome": {
+        "configFile": "biome.json",
+        "schema": "./node_modules/@biomejs/biome/configuration_schema.json"
+    },
+    "editorconfig": {
+        "template": "editorconfig",
+        "requiredProperties": [
+            "root = true",
+            "charset = utf-8",
+            "end_of_line = lf",
+            "indent_style = space",
+            "insert_final_newline = true",
+            "trim_trailing_whitespace = true"
+        ]
+    },
+    "agentFiles": {
+        "forbidden": {
+            "AGENTS.md": "it is generated for the Copilot/Junie Boost agents, which are no longer required",
+            ".junie": "it is the Junie Boost agent's directory, which is no longer required",
+            ".github/skills": "it is the Copilot Boost agent's skills directory, which is no longer required"
+        }
+    },
+    "claude": {
+        "allow": {
+            "shared": [
+                "Bash(npm info:*)",
+                "Bash(npm view:*)",
+                "Bash(npm ls:*)",
+                "Bash(npm outdated:*)",
+                "Skill(code-review)",
+                "Skill(code-review:*)"
+            ],
+            "php": [
+                "Bash(ddev composer run ci-lint:*)",
+                "Bash(ddev composer test:*)",
+                "Bash(ddev artisan test:*)",
+                "Bash(ddev artisan make:*)",
+                "Bash(ddev artisan route:list:*)",
+                "Bash(ddev artisan about:*)",
+                "Bash(ddev artisan config:show:*)",
+                "Bash(ddev artisan ide-helper:*)",
+                "Bash(ddev artisan optimize:clear:*)",
+                "Bash(ddev artisan cache:clear:*)",
+                "Bash(ddev artisan config:clear:*)",
+                "Bash(ddev artisan route:clear:*)",
+                "Bash(ddev artisan view:clear:*)",
+                "Bash(ddev composer show:*)",
+                "Bash(ddev composer outdated:*)",
+                "Bash(ddev composer why:*)"
+            ]
+        },
+        "deny": {
+            "shared": ["Read(./.env)"]
+        },
+        "ask": {
+            "php": [
+                "Bash(ddev artisan migrate:fresh:*)",
+                "Bash(php artisan migrate:fresh:*)",
+                "Bash(ddev artisan migrate:refresh:*)",
+                "Bash(php artisan migrate:refresh:*)",
+                "Bash(ddev artisan migrate:reset:*)",
+                "Bash(php artisan migrate:reset:*)",
+                "Bash(ddev artisan migrate:rollback:*)",
+                "Bash(php artisan migrate:rollback:*)",
+                "Bash(ddev artisan db:wipe:*)",
+                "Bash(php artisan db:wipe:*)"
+            ]
+        },
+        "ciLintHookCommand": {
+            "php": "ddev composer run ci-lint",
+            "js": "npm run ci-lint"
+        }
+    },
+    "ci": {
+        "nodeVersionVariable": {
+            "name": "NODE_VERSION",
+            "value": "latest"
+        },
+        "requiredJobs": {
+            "php": {
+                "build": ".build",
+                "php": ".lint_php",
+                "js": ".lint_js",
+                "test": [".test", ".test_db"]
+            },
+            "js": {
+                "build": ".build",
+                "js": ".lint_js",
+                "test": [".test", ".test_db"]
+            }
+        }
+    },
+    "ciLint": {
+        "required": {
+            "php": ["pint --parallel", "phpstan"],
+            "js": ["biome", "tsc"]
+        },
+        "baselineCommand": {
+            "js": "baseline check"
+        }
+    },
+    "trivy": {
+        "template": "trivy.yaml",
+        "configFile": "trivy.yaml",
+        "ignoreFile": ".trivyignore.yaml",
+        "gitignoreEntry": ".trivycache/",
+        "forbiddenKeys": ["severity"],
+        "ciJob": { "security": ".lint_security" }
+    },
+    "baseline": {
+        "composerPackage": "limenet/laravel-baseline",
+        "npmPackage": "@limenet-ch/baseline"
+    },
+    "npmScripts": {
+        "required": ["ci-lint", "production"]
+    },
+    "periodic": {
+        "defaultIntervalDays": 30
+    }
+}