@rtorcato/repo-tooling 3.2.0 → 3.2.1

package/dist/cli/generators/index.js

@@ -4,7 +4,7 @@ import { fileURLToPath } from 'node:url';
 import { generateSwiftProject } from '../../languages/swift/scaffold.js';
 import { installAiSetup } from './agent-rules.js';
 import { bundlerNeedsEsbuild, ensureBuildApprovals, generateBuildConfigs } from './build.js';
-import { ensurePnpmSettings } from './pnpm-workspace.js';
+import { ensurePnpmSettings, familyGlob } from './pnpm-workspace.js';
 import { generateGitConfigs } from './git.js';
 import { generateGitHubActions } from './github-actions.js';
 import { generateLintingConfigs } from './linting.js';
@@ -84,7 +84,7 @@ export async function generateConfigs(config, targetDir) {
     await ensureBuildApprovals(config, targetDir);
     // Family-wide pnpm settings (#314). Runs last of the workspace writers so it
     // merges into whatever they wrote rather than racing them for the file.
-    await ensurePnpmSettings(targetDir, bundlerNeedsEsbuild(config));
+    await ensurePnpmSettings(targetDir, bundlerNeedsEsbuild(config), familyGlob(config.projectName));
     // Turborepo task pipeline (pnpm-workspace monorepos, when opted-in)
     if (config.turborepo) {
         await generateTurborepo(targetDir);

package/dist/cli/generators/pnpm-workspace.js

@@ -12,12 +12,24 @@ import fs from 'fs-extra';
 export const WORKSPACE_FILE = 'pnpm-workspace.yaml';
 /**
  * pnpm's `minimumReleaseAge` cutoff holds back freshly published versions —
- * good against a typosquat-hijack, but it also stalls every consumer of a
- * same-day `@rtorcato/*` fix for 24h. One glob covers the whole family: pnpm
- * matches these entries with `@pnpm/config.matcher`, so there's no package list
- * to keep in sync with `@rtorcato/shared-docs`'s `FAMILY`.
+ * good against a typosquat or a hijacked account, but it also stalls every
+ * consumer of a same-day fix in a sibling package for 24h. Exempting the
+ * repo's *own* scope trades that off only for packages it already publishes.
+ *
+ * Derived from the consuming package's name rather than hardcoded: this is a
+ * public CLI, and writing one organisation's scope into a stranger's config
+ * would loosen a supply-chain guard for packages they neither use nor chose.
+ * An unscoped package gets no such setting at all — there is no "family" to
+ * infer, and guessing one would be worse than leaving it alone.
+ *
+ * One glob covers a whole scope: pnpm matches these entries with
+ * `@pnpm/config.matcher`, so there's no package list to keep in sync.
  */
-const FAMILY_GLOB = '@rtorcato/*';
+export function familyGlob(packageName) {
+    const name = typeof packageName === 'string' ? packageName : '';
+    const scope = /^(@[^/]+)\//.exec(name)?.[1];
+    return scope ? `${scope}/*` : null;
+}
 /** Bundlers that pull in esbuild, whose install script pnpm 11 refuses to run unapproved. */
 const ESBUILD_BUNDLERS = ['esbuild', 'tsup', 'vite'];
 /** True when the repo depends on a bundler that drags esbuild in. */
@@ -43,7 +55,29 @@ function section(yaml, key) {
     }
     return body;
 }
-const SETTINGS = [
+/**
+ * The managed settings for one repo. A function rather than a constant because
+ * the release-age exemption is scope-derived, and a repo with no scope to
+ * derive doesn't get that setting at all.
+ */
+function settingsFor(glob) {
+    return glob ? [...BASE_SETTINGS, releaseAgeSetting(glob)] : BASE_SETTINGS;
+}
+function releaseAgeSetting(glob) {
+    return {
+        label: `minimumReleaseAgeExclude: ${glob}`,
+        applies: () => true,
+        satisfied: (yaml) => (section(yaml, 'minimumReleaseAgeExclude') ?? []).some((l) => l.includes(glob)),
+        key: 'minimumReleaseAgeExclude',
+        block: `# Exempt this package's own scope from pnpm's minimumReleaseAge cutoff, so a
+# same-day fix in a sibling package is installable today rather than tomorrow.
+minimumReleaseAgeExclude:
+  - '${glob}'
+`,
+        item: `  - '${glob}'`,
+    };
+}
+const BASE_SETTINGS = [
     {
         label: 'verifyDepsBeforeRun: false',
         applies: () => true,
@@ -57,18 +91,6 @@ verifyDepsBeforeRun: false
 `,
         item: '',
     },
-    {
-        label: `minimumReleaseAgeExclude: ${FAMILY_GLOB}`,
-        applies: () => true,
-        satisfied: (yaml) => (section(yaml, 'minimumReleaseAgeExclude') ?? []).some(hasFamilyGlob),
-        key: 'minimumReleaseAgeExclude',
-        block: `# Exempt the @rtorcato family from pnpm's minimumReleaseAge cutoff, so a
-# same-day fix in a sibling package is installable today rather than tomorrow.
-minimumReleaseAgeExclude:
-  - '${FAMILY_GLOB}'
-`,
-        item: `  - '${FAMILY_GLOB}'`,
-    },
     {
         label: 'allowBuilds: esbuild',
         applies: (needsEsbuild) => needsEsbuild,
@@ -82,12 +104,11 @@ allowBuilds:
         item: '  esbuild: true',
     },
 ];
-function hasFamilyGlob(line) {
-    return line.includes(FAMILY_GLOB);
-}
 /** Managed settings absent from `yaml`, named as doctor reports them. */
-export function missingPnpmSettings(yaml, needsEsbuild) {
-    return SETTINGS.filter((s) => s.applies(needsEsbuild) && !s.satisfied(yaml)).map((s) => s.label);
+export function missingPnpmSettings(yaml, needsEsbuild, glob) {
+    return settingsFor(glob)
+        .filter((s) => s.applies(needsEsbuild) && !s.satisfied(yaml))
+        .map((s) => s.label);
 }
 /** Insert `item` directly under an existing `key:` line, keeping the rest untouched. */
 function insertUnder(yaml, key, item) {
@@ -97,9 +118,9 @@ function insertUnder(yaml, key, item) {
     return lines.join('\n');
 }
 /** Merge every missing managed setting into `yaml` and return the new contents. */
-export function upsertPnpmSettings(yaml, needsEsbuild) {
+export function upsertPnpmSettings(yaml, needsEsbuild, glob) {
     let next = yaml;
-    for (const setting of SETTINGS) {
+    for (const setting of settingsFor(glob)) {
         if (!setting.applies(needsEsbuild) || setting.satisfied(next))
             continue;
         if (setting.item && section(next, setting.key)) {
@@ -115,10 +136,10 @@ export function upsertPnpmSettings(yaml, needsEsbuild) {
  * Merge the managed pnpm settings into `pnpm-workspace.yaml`, creating it when
  * absent. Returns the relative path if anything changed, else null.
  */
-export async function ensurePnpmSettings(targetDir, needsEsbuild) {
+export async function ensurePnpmSettings(targetDir, needsEsbuild, glob) {
     const file = path.join(targetDir, WORKSPACE_FILE);
     const current = (await fs.pathExists(file)) ? await fs.readFile(file, 'utf-8') : '';
-    const next = upsertPnpmSettings(current, needsEsbuild);
+    const next = upsertPnpmSettings(current, needsEsbuild, glob);
     if (next === current)
         return null;
     await fs.writeFile(file, next.replace(/^\n+/, ''));

package/dist/languages/js/checks.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import fs from 'fs-extra';
 import { hookHasUncommented } from '../../base/checks.js';
-import { WORKSPACE_FILE, dependsOnEsbuild, missingPnpmSettings, } from '../../cli/generators/pnpm-workspace.js';
+import { WORKSPACE_FILE, dependsOnEsbuild, familyGlob, missingPnpmSettings, } from '../../cli/generators/pnpm-workspace.js';
 const PACKAGE = '@rtorcato/repo-tooling';
 const NODE_MIN_MAJOR = 22;
 const NODE_LTS_REQUIREMENTS = {
@@ -849,7 +849,7 @@ export async function checkPnpmWorkspace(dir, pkg) {
         return { check, status: 'ok', detail: 'not a pnpm repo' };
     }
     const yaml = exists ? await fs.readFile(file, 'utf-8') : '';
-    const missing = missingPnpmSettings(yaml, dependsOnEsbuild(allDeps(pkg)));
+    const missing = missingPnpmSettings(yaml, dependsOnEsbuild(allDeps(pkg)), familyGlob(pkg?.name));
     if (missing.length === 0) {
         return { check, status: 'ok', detail: `${WORKSPACE_FILE} carries the managed settings` };
     }

package/dist/languages/js/fixers.js

@@ -10,7 +10,7 @@ import { GH_WORKFLOWS, generateGhWorkflow } from '../../cli/generators/github-wo
 import { generateESLintConfig, generatePrettierConfig } from '../../cli/generators/linting.js';
 import { alignNodeVersion, ensureEnginesNode, generateKnipConfig, generateNvmrc, generateSizeLimitConfig, generateVscodeExtensions, } from '../../cli/generators/misc.js';
 import { composeVerifyScriptFromPkg } from '../../cli/generators/package-json.js';
-import { WORKSPACE_FILE, dependsOnEsbuild, ensurePnpmSettings, } from '../../cli/generators/pnpm-workspace.js';
+import { WORKSPACE_FILE, dependsOnEsbuild, ensurePnpmSettings, familyGlob, } from '../../cli/generators/pnpm-workspace.js';
 import { generatePostcss } from '../../cli/generators/postcss.js';
 import { generateCypressConfig, generateVitestConfig } from '../../cli/generators/testing.js';
 import { generateTreeshakeCheck, inferSubpathsFromExports } from '../../cli/generators/treeshake.js';
@@ -351,7 +351,7 @@ export const FIXERS = [
                 ...(pkg?.dependencies ?? {}),
                 ...(pkg?.devDependencies ?? {}),
             };
-            const written = await ensurePnpmSettings(targetDir, dependsOnEsbuild(deps));
+            const written = await ensurePnpmSettings(targetDir, dependsOnEsbuild(deps), familyGlob(pkg?.name));
             return { filesWritten: written ? [written] : [] };
         },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.2.0",
+	"version": "3.2.1",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [