@micelio/eslint-config 0.2.4 → 0.2.6

package/README.md

@@ -30,3 +30,26 @@ version `AGENTS.md` pins (`` `standard: X.Y` ``), using the SHA-256 hashes in
 `@micelio/eslint-config/standard-hashes.json`. Add it as `"lint:standard": "micelio-lint-standard"`
 and to `npm run check`. A pinned version newer than the installed package knows fails with a message
 that says to upgrade the package.
+
+A repository may also pin its profiles on the same line, comma-separated (`` `standard: 2.0` ``,
+`` `profile: typescript, site-engine` ``; ADR-0001); with no `profile:` pin it is read as
+`typescript`. In `standard-hashes.json` a version maps to one hash (1.4 to 1.8, one file) or to
+`{ "core": "<sha256>", "profiles": { "<profile>": "<sha256>" } }`; for the second form the command
+also compares `docs/standard/<profile>.md` for each pinned profile and names the file that differs.
+A profile the pinned version does not have fails, naming the ones it has (a one-file version has
+`typescript` and `site-engine`).
+
+## `lint:ee`
+
+`micelio-lint-ee [--allow <path>]... [root]` fails when a file git tracks enables Strapi Enterprise
+code, which is not AGPL-compatible (bogd3v/micelio-cms#96). It reads the tracked files with an
+extension of code or configuration (`.js`, `.ts` and their variants, `.json`, `.yml`, `.sh`,
+`.env.example`, `Dockerfile`) line by line and reports `path:line message` for three rules:
+
+- the line names `STRAPI_LICENSE` (sets or reads the Enterprise licence key);
+- the line imports `@strapi/review-workflows` or `@strapi/content-releases`;
+- the line imports Strapi code under `ee/` (`@strapi/<package>/ee`).
+
+`--allow <path>` (repeatable) names a tracked file, relative to the root, that may mention them, such
+as `THIRD-PARTY.md` or `package-lock.json`; nothing else is skipped. A repository without Strapi
+passes. Add it as `"lint:ee": "micelio-lint-ee"` and to `npm run check`.

package/dist/ee.d.ts

@@ -0,0 +1,31 @@
+/** One rule of `micelio-lint-ee`: a line that matches `pattern` fails with `message`. */
+export interface EeRule {
+    /** The text that marks the line as Strapi Enterprise code. */
+    pattern: RegExp;
+    /** What the line does, as it appears in the report. */
+    message: string;
+}
+/**
+ * The three rules of `micelio-cms`'s `scripts/check-no-ee.mjs`, none dropped or narrowed
+ * (Strapi Enterprise code is not AGPL-compatible, bogd3v/micelio-cms#96).
+ */
+export declare const EE_RULES: readonly EeRule[];
+/** What `lintEe` found. */
+export interface EeResult {
+    /** True when no scanned file matches a rule. */
+    ok: boolean;
+    /** One `path:line message` per match. */
+    failures: string[];
+    /** How many files were scanned. */
+    checked: number;
+    /** One line for the terminal. */
+    message: string;
+}
+/**
+ * Scans the files git tracks in `root` for Strapi Enterprise code.
+ *
+ * @param root - The repository directory.
+ * @param allow - The tracked paths, relative to `root`, that may name the patterns (a licence list, the lockfile).
+ * @returns The matches, one per line and rule.
+ */
+export declare function lintEe(root: string, allow?: readonly string[]): EeResult;

package/dist/ee.js

@@ -0,0 +1,52 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * The three rules of `micelio-cms`'s `scripts/check-no-ee.mjs`, none dropped or narrowed
+ * (Strapi Enterprise code is not AGPL-compatible, bogd3v/micelio-cms#96).
+ */
+export const EE_RULES = [
+    {
+        pattern: /STRAPI_LICENSE/,
+        message: 'sets or reads STRAPI_LICENSE (Strapi Enterprise license key)',
+    },
+    {
+        pattern: /['"]@strapi\/(review-workflows|content-releases)['"/]/,
+        message: 'imports a Strapi Enterprise package',
+    },
+    { pattern: /['"]@strapi\/[^'"]+\/ee(\/|['"])/, message: 'imports Strapi code under ee/' },
+];
+/** The tracked files that can hold code or configuration: the ones the script of `micelio-cms` reads. */
+const SCANNED = /\.(m?[jt]sx?|json|ya?ml|sh|env\.example)$|(^|\/)(Dockerfile|\.env\.example)$/;
+/**
+ * Scans the files git tracks in `root` for Strapi Enterprise code.
+ *
+ * @param root - The repository directory.
+ * @param allow - The tracked paths, relative to `root`, that may name the patterns (a licence list, the lockfile).
+ * @returns The matches, one per line and rule.
+ */
+export function lintEe(root, allow = []) {
+    const files = execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8' })
+        .split('\n')
+        .filter((file) => file && !allow.includes(file) && SCANNED.test(file));
+    const failures = [];
+    for (const file of files) {
+        readFileSync(join(root, file), 'utf8')
+            .split('\n')
+            .forEach((line, index) => {
+            for (const rule of EE_RULES) {
+                if (rule.pattern.test(line))
+                    failures.push(`${file}:${index + 1} ${rule.message}`);
+            }
+        });
+    }
+    const ok = failures.length === 0;
+    return {
+        ok,
+        failures,
+        checked: files.length,
+        message: ok
+            ? `No Strapi Enterprise code enabled (${files.length} files checked).`
+            : 'Strapi Enterprise code must stay disabled: see THIRD-PARTY.md.',
+    };
+}

package/dist/lint-ee.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/lint-ee.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import { lintEe } from './ee.js';
+// `micelio-lint-ee [--allow <path>]... [root]`: the `lint:ee` script of a repository born from `template/`.
+const allow = [];
+let root = process.cwd();
+const args = process.argv.slice(2);
+for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--allow') {
+        const path = args[++i];
+        if (path === undefined) {
+            console.error('error: --allow needs a path');
+            process.exit(2);
+        }
+        allow.push(path);
+    }
+    else {
+        root = arg;
+    }
+}
+const result = lintEe(root, allow);
+if (result.ok) {
+    process.stdout.write(`${result.message}\n`);
+}
+else {
+    for (const failure of result.failures)
+        console.error(`error: ${failure}`);
+    console.error(result.message);
+    process.exitCode = 1;
+}

package/dist/standard.d.ts

@@ -1,7 +1,20 @@
 /** Where every Micelio repository keeps its copy of the standard. */
 export declare const STANDARD_PATH = "docs/engineering-standard.md";
-/** The SHA-256 of each released version of the standard, by `major.minor`. */
-export type StandardHashes = Record<string, string>;
+/**
+ * The hashes of a version in the new form (ADR-0001, point 5): the core, at
+ * `docs/engineering-standard.md`, and each profile file, at `docs/standard/<profile>.md`.
+ */
+export interface VersionHashes {
+    /** The SHA-256 of `docs/engineering-standard.md`. */
+    core: string;
+    /** The SHA-256 of `docs/standard/<profile>.md`, by profile name. */
+    profiles: Record<string, string>;
+}
+/**
+ * The hashes of each released version of the standard, by `major.minor`: one string for a version
+ * that is a single file (1.4 to 1.8), or {@link VersionHashes} for a version in the new form.
+ */
+export type StandardHashes = Record<string, string | VersionHashes>;
 /** The SHA-256 of each synced file (agent prompts, skills, pull request template), by path in the repository. */
 export type FileHashes = Record<string, string>;
 /** What `lintStandard` found. */
@@ -16,21 +29,38 @@ export declare function hashOf(content: Buffer | string): string;
 /** Reads the version a repository pins in its `AGENTS.md`, or `null` when there is no pin. */
 export declare function readPin(agents: string): string | null;
 /**
- * Rewrites the pin of an `AGENTS.md`, and the sentence that repeats it, to `version`.
+ * Reads the profiles a repository pins in its `AGENTS.md`, in the order written: the names after
+ * `profile:`, in backticks, comma-separated (`profile: typescript, site-engine`), on the line of the
+ * version pin. A name is returned as written, malformed or not.
+ *
+ * @returns The profile names; `['typescript']` when the line of the version pin has no `profile:`
+ *   pin, or there is no version pin (ADR-0001, point 3).
+ */
+export declare function readProfiles(agents: string): string[];
+/**
+ * Rewrites the pin of an `AGENTS.md`, and the sentence that repeats it, to `version`. A
+ * `profile:` pin is left as it is.
  *
  * @returns The new text, or `null` when `agents` has no pin to rewrite.
  */
 export declare function setPin(agents: string, version: string): string | null;
 /** Reads the version a copy of the standard says it is, or `null` when its header is missing. */
 export declare function standardVersion(standard: string): string | null;
-/** Loads the hash of each released version of the standard bundled in this package. */
-export declare function loadHashes(): StandardHashes;
+/**
+ * Loads the hashes of each released version of the standard bundled in this package. An entry that
+ * is neither one hash nor a version in the new form is left out.
+ *
+ * @param file - The parsed `standard-hashes.json`; the one bundled in this package by default.
+ */
+export declare function loadHashes(file?: Record<string, unknown>): StandardHashes;
 /** Loads the hash of each file the sync carries next to the standard, by path in the repository. */
 export declare function loadFileHashes(): FileHashes;
 /**
  * Checks that the copy of the standard in `root` is the one published for the version its
  * `AGENTS.md` pins (standard, section 16). A repository may pin an older version on purpose:
- * the pinned one is checked, not the latest.
+ * the pinned one is checked, not the latest. For a version in the new form it also checks the file
+ * of each profile `AGENTS.md` pins (`typescript` when it pins none), and fails on a profile that
+ * version does not have.
  *
  * @param root - The repository root.
  * It also checks the synced files the repository has (`.claude/agents/*.md`, the skills, the pull

package/dist/standard.js

@@ -3,8 +3,25 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 /** Where every Micelio repository keeps its copy of the standard. */
 export const STANDARD_PATH = 'docs/engineering-standard.md';
+/** Where a repository keeps the file of each profile it pins: `docs/standard/<profile>.md`. */
+const PROFILE_DIR = 'docs/standard';
+/** The profile a repository with no `profile:` pin is read as (ADR-0001, point 3). */
+const DEFAULT_PROFILE = 'typescript';
 /** The machine-readable pin in `AGENTS.md`: the version in backticks after `standard:`. */
 const PIN = /(`standard:\s*)(\d+\.\d+)(`)/;
+/**
+ * The profile pin in `AGENTS.md`: what follows `profile:` in backticks, on the line of the version
+ * pin (ADR-0001, point 3). The names are taken as written, so a malformed one fails as a profile the
+ * version does not have.
+ */
+const PROFILE_PIN = /`profile:([^`]*)`/;
+/**
+ * The profiles a version in the old form has: its one file holds the rules that the split moves to
+ * `typescript` and `site-engine` (ADR-0001, point 1).
+ */
+const SINGLE_FILE_PROFILES = [DEFAULT_PROFILE, 'site-engine'];
+/** A key of `standard-hashes.json` that names a version, as opposed to `files`. */
+const VERSION_KEY = /^\d+\.\d+$/;
 /** The sentence of `AGENTS.md` that says the same in words, kept in step with the pin. */
 const PIN_IN_WORDS = /(follows standard version )(\d+\.\d+)/;
 /** The version line of the standard itself: `Version 1.4 (2026-10-20).` */
@@ -18,7 +35,21 @@ export function readPin(agents) {
     return PIN.exec(agents)?.[2] ?? null;
 }
 /**
- * Rewrites the pin of an `AGENTS.md`, and the sentence that repeats it, to `version`.
+ * Reads the profiles a repository pins in its `AGENTS.md`, in the order written: the names after
+ * `profile:`, in backticks, comma-separated (`profile: typescript, site-engine`), on the line of the
+ * version pin. A name is returned as written, malformed or not.
+ *
+ * @returns The profile names; `['typescript']` when the line of the version pin has no `profile:`
+ *   pin, or there is no version pin (ADR-0001, point 3).
+ */
+export function readProfiles(agents) {
+    const line = agents.split('\n').find((text) => PIN.test(text)) ?? '';
+    const pin = PROFILE_PIN.exec(line)?.[1];
+    return pin === undefined ? [DEFAULT_PROFILE] : pin.split(',').map((name) => name.trim());
+}
+/**
+ * Rewrites the pin of an `AGENTS.md`, and the sentence that repeats it, to `version`. A
+ * `profile:` pin is left as it is.
  *
  * @returns The new text, or `null` when `agents` has no pin to rewrite.
  */
@@ -36,11 +67,31 @@ function readHashesFile() {
     const file = new URL('../standard-hashes.json', import.meta.url);
     return JSON.parse(readFileSync(file, 'utf8'));
 }
-/** Loads the hash of each released version of the standard bundled in this package. */
-export function loadHashes() {
+/** True when `value` is a map of strings to strings. */
+function isStringMap(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        Object.values(value).every((hash) => typeof hash === 'string'));
+}
+/** True when `value` is the entry of a version in the new form. */
+function isVersionHashes(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const entry = value;
+    return typeof entry.core === 'string' && isStringMap(entry.profiles);
+}
+/**
+ * Loads the hashes of each released version of the standard bundled in this package. An entry that
+ * is neither one hash nor a version in the new form is left out.
+ *
+ * @param file - The parsed `standard-hashes.json`; the one bundled in this package by default.
+ */
+export function loadHashes(file = readHashesFile()) {
     const hashes = {};
-    for (const [key, value] of Object.entries(readHashesFile())) {
-        if (typeof value === 'string')
+    for (const [key, value] of Object.entries(file)) {
+        if (!VERSION_KEY.test(key))
+            continue;
+        if (typeof value === 'string' || isVersionHashes(value))
             hashes[key] = value;
     }
     return hashes;
@@ -64,10 +115,16 @@ function latestVersion(hashes) {
     });
     return latest ?? null;
 }
+/** The path of the file of `profile` in a repository. */
+function profilePath(profile) {
+    return `${PROFILE_DIR}/${profile}.md`;
+}
 /**
  * Checks that the copy of the standard in `root` is the one published for the version its
  * `AGENTS.md` pins (standard, section 16). A repository may pin an older version on purpose:
- * the pinned one is checked, not the latest.
+ * the pinned one is checked, not the latest. For a version in the new form it also checks the file
+ * of each profile `AGENTS.md` pins (`typescript` when it pins none), and fails on a profile that
+ * version does not have.
  *
  * @param root - The repository root.
  * It also checks the synced files the repository has (`.claude/agents/*.md`, the skills, the pull
@@ -85,7 +142,8 @@ export function lintStandard(root, hashes = loadHashes(), fileHashes = loadFileH
             message: 'AGENTS.md is missing: it pins the standard version (`standard: X.Y`).',
         };
     }
-    const pin = readPin(readFileSync(agentsPath, 'utf8'));
+    const agents = readFileSync(agentsPath, 'utf8');
+    const pin = readPin(agents);
     if (!pin) {
         return {
             ok: false,
@@ -104,13 +162,45 @@ export function lintStandard(root, hashes = loadHashes(), fileHashes = loadFileH
             message: `Standard ${pin}, pinned in AGENTS.md, is unknown to this version of @micelio/eslint-config (it knows ${known}): upgrade the package or fix the pin.`,
         };
     }
+    const core = typeof expected === 'string' ? expected : expected.core;
+    const profiles = readProfiles(agents);
+    const known = typeof expected === 'string' ? SINGLE_FILE_PROFILES : Object.keys(expected.profiles);
+    const unknown = profiles.filter((profile) => !known.includes(profile));
+    if (unknown.length > 0) {
+        return {
+            ok: false,
+            message: `AGENTS.md pins profile ${unknown.join(', ')}, which standard ${pin} does not have (it has ${known.join(', ')}): fix the profile pin.`,
+        };
+    }
     const actual = hashOf(readFileSync(copyPath));
-    if (actual !== expected) {
+    if (actual !== core) {
         return {
             ok: false,
-            message: `${STANDARD_PATH} does not match standard ${pin}, the version AGENTS.md pins (sha256 ${actual}, published ${expected}). Restore it, or sync it from bogd3v/micelio-engineering.`,
+            message: `${STANDARD_PATH} does not match standard ${pin}, the version AGENTS.md pins (sha256 ${actual}, published ${core}). Restore it, or sync it from bogd3v/micelio-engineering.`,
         };
     }
+    const checked = [STANDARD_PATH];
+    if (typeof expected !== 'string') {
+        for (const profile of profiles) {
+            const path = profilePath(profile);
+            const file = join(root, path);
+            if (!existsSync(file)) {
+                return {
+                    ok: false,
+                    message: `${path} is missing; AGENTS.md pins standard ${pin} with profile ${profile}.`,
+                };
+            }
+            const published = expected.profiles[profile];
+            const hash = hashOf(readFileSync(file));
+            if (hash !== published) {
+                return {
+                    ok: false,
+                    message: `${path} does not match profile ${profile} of standard ${pin}, the version AGENTS.md pins (sha256 ${hash}, published ${published}). Restore it, or sync it from bogd3v/micelio-engineering.`,
+                };
+            }
+            checked.push(path);
+        }
+    }
     const stale = pin === latestVersion(hashes)
         ? Object.entries(fileHashes)
             .filter(([path, hash]) => {
@@ -125,5 +215,11 @@ export function lintStandard(root, hashes = loadHashes(), fileHashes = loadFileH
             message: `${stale.join(', ')} ${stale.length === 1 ? 'does' : 'do'} not match the published copy of standard ${pin}. Restore ${stale.length === 1 ? 'it' : 'them'} if edited by hand, or, in a sync pull request, upgrade @micelio/eslint-config to the release that publishes the new hashes.`,
         };
     }
-    return { ok: true, message: `Standard ${pin}: ${STANDARD_PATH} matches the published copy.` };
+    if (checked.length === 1) {
+        return { ok: true, message: `Standard ${pin}: ${STANDARD_PATH} matches the published copy.` };
+    }
+    return {
+        ok: true,
+        message: `Standard ${pin} (${profiles.join(', ')}): ${checked.join(', ')} match the published copy.`,
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micelio/eslint-config",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "The ESLint flat config of the Micelio repositories, the licence allowlist behind lint:licenses and lint:standard.",
   "license": "MIT-0",
   "repository": {
@@ -45,6 +45,7 @@
     "provenance": true
   },
   "bin": {
+    "micelio-lint-ee": "./dist/lint-ee.js",
     "micelio-lint-standard": "./dist/lint-standard.js"
   },
   "devDependencies": {

package/standard-hashes.json

@@ -6,14 +6,14 @@
   "1.8": "bbdbd8b0f7d394ba24471a3b65dbcf7a82b9899a221a39e78ffe819ebbc79249",
   "files": {
     ".claude/agents/master.md": "35e9ce4cc637ca814352916dd24e64f25da66f0c3c36fb492e2172c40e6d6416",
-    ".claude/agents/planner.md": "944a55dae33c1f4290c574923d12af1d3b1f24c4cd5dfb75f4e819ca24ecb727",
+    ".claude/agents/planner.md": "7bb5a71f7ff8ebf97a6e775c1e85744d668c7ef2601cd8dc52599b9a60c851e5",
     ".claude/agents/reviewer.md": "8edcd83631b191013217eb9f309b108f54e988708496182877077b65a9b6f1cf",
-    ".claude/agents/verifier.md": "7fc1c73eec7c64ba669ece73075c0f967b316d81c9389a00ae729acf29505ae8",
-    ".claude/agents/worker.md": "3f4dafea2266a752a5aba7f26035bdab1c5a4b6591916f0c2be4fdb68ad924ca",
-    ".claude/skills/ship-pr/SKILL.md": "bd01f1bfcccfef9f50872425f1a2060554a36fa61e6915cfb137e07889c25f25",
+    ".claude/agents/verifier.md": "12af503892295de5da0496344b7760c5a349aa81ab7b61db4e9b9b7e1dd757e8",
+    ".claude/agents/worker.md": "e2faeb86c51418373978a15dd025f7800ad12a053c962fdb0c58b79251fd8290",
+    ".claude/skills/ship-pr/SKILL.md": "ced49dbd6ab9c4513afa2c3afb0350810d3693c4a758612512f9ecadab66f045",
     ".claude/skills/blind-review/SKILL.md": "62f43d0ccd762ad7197bb48e31e7041689cc1d07e16678dffd9c8e2715be7980",
-    ".claude/skills/verify-pr/SKILL.md": "6143ac741580154a3121b0ec77c601bbb8345816f53e4947879365c187a6c6a5",
-    ".github/pull_request_template.md": "10ab5b606b86dc13682387e7a9aed7ce2cf8ef1a227e80cafa1dd8fc50f4481c",
+    ".claude/skills/verify-pr/SKILL.md": "d53466d54e51b1e1ee09c47f3e1629f997163d5ea716c0c860f52492ddc9ce7b",
+    ".github/pull_request_template.md": "8ce62f8b6d59f14562e6d962d87491c2c3b1c9a8f640afe673f23eced6642ba7",
     "CLAUDE.md": "2fe9efbc0c4a6e0cbd446afb506911ba28b0068a42f8686676635986d968cefd"
   }
 }