@orkestrel/scaffold 0.0.41 → 0.0.42

package/dist/host/guides/scaffold.md

@@ -102,8 +102,9 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `ENGINES_PATTERN`                 | const | The minimum-Node engine syntax a blueprint declares.                                             |
 | `ENVIRONMENTS`                    | const | The three `Environment` values, frozen.                                                          |
 | `EXECUTABLE_PATHS`                | const | The vendored paths a target receives with its executable bit set, frozen.                        |
-| `EXTRA_NAME_PATTERN`              | const | The development extra name syntax: any valid npm package name.                                   |
 | `EXTRA_RANGE_PATTERN`             | const | The registry-only semver subset accepted for a development extra's range.                        |
+| `FLOOR_RANGE_PATTERN`             | const | The exact three-component floor accepted for a foreign peer's range.                             |
+| `FOREIGN_NAME_PATTERN`            | const | The package name syntax for a dependency this package does not publish.                          |
 | `GLOBAL_SETUP_PATH`               | const | The shared Vitest global-setup module whose presence makes a workspace `global`.                 |
 | `GROUPS`                          | const | The seven `Group` values in plan order, frozen.                                                  |
 | `GUIDES_TEST_PATH`                | const | The guide-parity proof whose presence selects the planned `guides` project.                      |
@@ -587,8 +588,14 @@ blueprint.engines // '>=22.12.0'
 
 `src` selects published library environments and `app` selects private application environments.
 The two axes are independent, so a library-only, an application-only, and a mixed workspace are all
-first class. `dependencies` and `peers` are runtime `@orkestrel/*` packages; `extras` are
-development dependencies and may carry any valid npm name.
+first class. `dependencies` are runtime `@orkestrel/*` packages. A peer in the `@orkestrel` scope is
+a fleet pin; every other peer is a floor. `extras` are development dependencies and may carry any
+valid npm name. A peer reaches the generated workspace through two representations:
+`Blueprint.peers` validates the scope rule and compiles the manifest declarations, while the
+`peers` binding in the generated `vite.config.ts` derives from the target's live
+`peerDependencies`. Each published build face — core, browser, server, and `bin` — externalizes
+every name in that binding, so a peer the workspace declares by hand, such as `vitest`, is left as
+an import in the emitted bundle rather than inlined into it.
 
 One published environment owns the package root directly. Several published environments require
 `core`, which owns that root while each other environment keeps its subpath. A multi-environment

package/dist/host/tests/config.test.ts

@@ -12,6 +12,7 @@ import {
 	rmSync,
 	writeFileSync,
 } from 'node:fs'
+import { createRequire } from 'node:module'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 import { build, loadConfigFromFile } from 'vite'
@@ -588,16 +589,37 @@ describe('policy plugin', () => {
 				].join('\n'),
 			)
 
-			const binary = resolve(root, 'node_modules/.bin/oxlint')
+			// Run oxlint's real Node entry through the current interpreter rather than the
+			// `node_modules/.bin/oxlint` shim. That shim is a POSIX `sh` script — a symlink to one on
+			// Linux, a `.cmd`/`.ps1` pair on Windows — and Windows `CreateProcess` cannot execute the
+			// extensionless form; spawning the `.cmd` would need `shell: true`, which breaks on paths
+			// containing spaces. Resolving through `createRequire` reads oxlint's own `bin` field, so
+			// the entry survives hoisting, a nested `node_modules` layout, and a future rename.
+			const manifestPath = createRequire(join(root, 'package.json')).resolve('oxlint/package.json')
+			const manifest: unknown = JSON.parse(readFileSync(manifestPath, 'utf8'))
+			if (typeof manifest !== 'object' || manifest === null) {
+				throw new Error('The oxlint package manifest is not an object')
+			}
+			const bin: unknown = Object.getOwnPropertyDescriptor(manifest, 'bin')?.value
+			const entry: unknown =
+				typeof bin === 'string'
+					? bin
+					: typeof bin === 'object' && bin !== null
+						? Object.getOwnPropertyDescriptor(bin, 'oxlint')?.value
+						: undefined
+			if (typeof entry !== 'string') {
+				throw new Error('The oxlint package declares no bin.oxlint entry')
+			}
+			const binary = resolve(dirname(manifestPath), entry)
 			const config = resolve(root, '.oxlintrc.json')
 			const violations = spawnSync(
-				binary,
-				['--config', config, '--format', 'json', resolve(scratch.path, 'violations')],
+				process.execPath,
+				[binary, '--config', config, '--format', 'json', resolve(scratch.path, 'violations')],
 				{ cwd: root, encoding: 'utf8', timeout: 15_000 },
 			)
 			const clean = spawnSync(
-				binary,
-				['--config', config, '--format', 'json', resolve(scratch.path, 'clean')],
+				process.execPath,
+				[binary, '--config', config, '--format', 'json', resolve(scratch.path, 'clean')],
 				{ cwd: root, encoding: 'utf8', timeout: 15_000 },
 			)
 			const reports: string[][] = []

package/dist/src/core/index.cjs

@@ -235,16 +235,16 @@ var NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
 */
 var DEPENDENCY_NAME_PATTERN = /^@orkestrel\/[a-z][a-z0-9-]*$/;
 /**
-* The development extra name syntax: any valid npm package name.
+* The package name syntax for a dependency this package does not publish.
 *
 * @remarks
-* Wider than a runtime dependency name on purpose. An extra is manifest content
-* and never reaches a path, so it may carry any scope or no scope at all. The
-* single optional `/` is still fixed to the one scope boundary, and neither `..`
-* nor a backslash is admitted, so the shape cannot express a traversal even
-* though it accepts far more names.
+* A foreign package is one this package does not publish, so its name reaches
+* no path. It may carry any scope or no scope at all. Each name segment begins
+* with an alphanumeric character after an optional leading `@`, and the name
+* carries at most one `/`. No segment can therefore be `..`, and no backslash
+* is admitted, so the shape cannot express a traversal.
 */
-var EXTRA_NAME_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+var FOREIGN_NAME_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
 /** The exact three-component version syntax a blueprint declares. */
 var VERSION_PATTERN = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 /**
@@ -259,6 +259,15 @@ var VERSION_PATTERN = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 var ORKESTREL_RANGE_PATTERN = /^\^0\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 /** The registry-only semver subset accepted for a development extra's range. */
 var EXTRA_RANGE_PATTERN = /^(?:\^|~)?(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?$/;
+/**
+* The exact three-component floor accepted for a foreign peer's range.
+*
+* @remarks
+* This is independent from {@link ENGINES_PATTERN}. An engine floors the Node
+* runtime a workspace supports, while a peer floors a tool the consumer
+* supplies. Either obligation may change without changing the other.
+*/
+var FLOOR_RANGE_PATTERN = /^>=(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 /** The minimum-Node engine syntax a blueprint declares. */
 var ENGINES_PATTERN = /^>=(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 /** Exact lowercase hexadecimal bytes: two digits per byte, and empty content is valid. */
@@ -3017,7 +3026,10 @@ function srcToExports(src) {
 * each declared axis adds the set its host needs. A declared extra or peer is
 * applied after those, so a workspace that pins a range for a package the
 * conditional sets also name gets the range it declared. An extra that restates
-* a shared toolchain pin never reaches here, because the gate refuses it.
+* a shared toolchain pin never reaches here, because the gate refuses it. A peer
+* that names a development tool already selected keeps that tool's pin, because
+* the peer's floor states what consumers may supply rather than what this workspace
+* develops against.
 *
 * A peer is declared here as well as under `peerDependencies`, because a peer is
 * not installed by the workspace that declares it and developing against one
@@ -3050,7 +3062,7 @@ function blueprintToDevDependencies(blueprint) {
 		...blueprint.app.includes("server") ? APP_SERVER_DEV_DEPENDENCIES : {}
 	};
 	for (const extra of blueprint.extras) merged[extra.name] = extra.range;
-	for (const peer of blueprint.peers) merged[peer.name] = peer.range;
+	for (const peer of blueprint.peers) if (!Object.hasOwn(merged, peer.name)) merged[peer.name] = peer.range;
 	const own = blueprint.src.length > 0 ? `@orkestrel/${blueprint.name}` : blueprint.name;
 	const runtime = new Set(blueprint.dependencies.map((dependency) => dependency.name));
 	return Object.fromEntries(Object.entries(merged).filter(([name]) => name !== own && !runtime.has(name)).sort(([left], [right]) => (0, _orkestrel_contract.compareValues)(left, right)));
@@ -4139,11 +4151,11 @@ function planToFindings(plan, current) {
 * range, in list order.
 *
 * @remarks
-* The three declared lists differ only in the two syntaxes they accept, so the
-* rules live here once and each caller supplies its own patterns. A runtime
-* dependency name reaches a path through its guide mirror and is fixed to the
-* `@orkestrel` scope; a development extra never reaches a path and admits any
-* valid npm name.
+* The declared lists and peer partitions differ only in the two syntaxes they
+* accept, so the rules live here once and each caller supplies its own patterns.
+* A runtime dependency name reaches a path through its guide mirror and is
+* fixed to the `@orkestrel` scope. A foreign peer or development extra reaches
+* no path and admits any valid npm name.
 *
 * Both patterns must be stateless. A global or sticky pattern carries a
 * `lastIndex` between calls, so it would answer differently for the same input
@@ -4301,7 +4313,7 @@ function blueprintToQuestions(blueprint) {
 		message: "showcase projects a browser app, and this workspace declares none, so it emits nothing.",
 		blocking: false
 	});
-	questions.push(...dependenciesToQuestions(blueprint.dependencies, "dependencies", DEPENDENCY_NAME_PATTERN, ORKESTREL_RANGE_PATTERN), ...dependenciesToQuestions(blueprint.peers, "peers", DEPENDENCY_NAME_PATTERN, ORKESTREL_RANGE_PATTERN), ...dependenciesToQuestions(blueprint.extras, "extras", EXTRA_NAME_PATTERN, EXTRA_RANGE_PATTERN));
+	questions.push(...dependenciesToQuestions(blueprint.dependencies, "dependencies", DEPENDENCY_NAME_PATTERN, ORKESTREL_RANGE_PATTERN), ...dependenciesToQuestions(blueprint.peers.filter((peer) => peer.name.startsWith("@orkestrel/")), "peers", DEPENDENCY_NAME_PATTERN, ORKESTREL_RANGE_PATTERN), ...dependenciesToQuestions(blueprint.peers.filter((peer) => !peer.name.startsWith("@orkestrel/")), "peers", FOREIGN_NAME_PATTERN, FLOOR_RANGE_PATTERN), ...dependenciesToQuestions(blueprint.extras, "extras", FOREIGN_NAME_PATTERN, EXTRA_RANGE_PATTERN));
 	const lists = [
 		["dependencies", blueprint.dependencies],
 		["peers", blueprint.peers],
@@ -4857,8 +4869,9 @@ exports.DISTRIBUTION_TEST_PATH = DISTRIBUTION_TEST_PATH;
 exports.ENGINES_PATTERN = ENGINES_PATTERN;
 exports.ENVIRONMENTS = ENVIRONMENTS;
 exports.EXECUTABLE_PATHS = EXECUTABLE_PATHS;
-exports.EXTRA_NAME_PATTERN = EXTRA_NAME_PATTERN;
 exports.EXTRA_RANGE_PATTERN = EXTRA_RANGE_PATTERN;
+exports.FLOOR_RANGE_PATTERN = FLOOR_RANGE_PATTERN;
+exports.FOREIGN_NAME_PATTERN = FOREIGN_NAME_PATTERN;
 exports.GLOBAL_SETUP_PATH = GLOBAL_SETUP_PATH;
 exports.GROUPS = GROUPS;
 exports.GUIDES_TEST_PATH = GUIDES_TEST_PATH;