@rtorcato/repo-tooling 3.31.1 → 3.32.0

package/dist/cli/commands/doctor.js

@@ -232,9 +232,11 @@ async function runBaseChecks(dir, lock, opts) {
     results.push(await checkAiSetup(dir));
     // User-global, not repo state — see checkClaudeSkills on why it never returns drift.
     results.push(await checkClaudeSkills(opts.skillsDir));
-    // #533: gated on `aiLoop`, which is already the "this repo uses the pipeline"
+    // #533: gated on `aiLoop.agentUser`, which is the "this repo uses the pipeline"
     // signal, so a repo that doesn't gets no line at all rather than an empty one.
-    if (lock?.rules?.aiLoop && lock.rules.requiredSkills?.length) {
+    // The key itself no longer says that — since #571 every repo is scaffolded with
+    // an empty `aiLoop`, and the skills have always read the login, not the key.
+    if (lock?.rules?.aiLoop?.agentUser && lock.rules.requiredSkills?.length) {
         results.push(await checkRequiredSkills(lock.rules.requiredSkills, opts.skillsDir));
     }
     // #534: advisory. Absent `mcp.recommended` means the repo has nothing to say

package/dist/cli/generators/claude-skills.js

@@ -11,6 +11,7 @@ import fs from 'fs-extra';
 import { realGitExec } from '../../base/git-identity.js';
 import { getPackageRoot } from '../utils/copy-preset.js';
 import { shellQuote } from '../utils/shell.js';
+import { isNewerVersion, resolveShippedVersion } from '../utils/version.js';
 /**
  * Skills this package owns the content of and keeps up to date. The loop first —
  * it is the pipeline; the other three are its drivers (burst, on-ramp, status).
@@ -115,47 +116,6 @@ export function classifySkillContent(installed, shipped) {
         return 'unknown';
     return recorded === hashSkillContent(installed) ? 'pristine' : 'modified';
 }
-function versionParts(version) {
-    return version.split('.').map((n) => Number.parseInt(n, 10) || 0);
-}
-/** True when `a` is a strictly higher version than `b`. Prerelease tags are ignored. */
-export function isNewerVersion(a, b) {
-    const [left, right] = [versionParts(a), versionParts(b)];
-    for (let i = 0; i < 3; i++) {
-        const [x, y] = [left[i] ?? 0, right[i] ?? 0];
-        if (x !== y)
-            return x > y;
-    }
-    return false;
-}
-/**
- * The version to stamp, given what `package.json` claims.
- *
- * In a published tarball that field is authoritative — `@semantic-release/npm`
- * rewrites it before packing. In a *git checkout* it is not: this repo runs
- * semantic-release without `@semantic-release/git` (#417), so nothing ever
- * writes the released version back and the field sits at whatever it was last
- * hand-set to. Observed 2026-08-22: `package.json` 3.11.0 against npm 3.21.1,
- * ten minor versions of drift.
- *
- * That mattered because the stamp feeds the downgrade guard below: a skill
- * installed from npm could not be updated from a local checkout, and the
- * refusal claimed the installed copy was "newer" when only its *label* was.
- *
- * So when the package root is a git checkout, take the nearest tag as well and
- * keep whichever is higher. Monotonic on purpose — this can only ever raise the
- * answer, so a tagless, shallow, or git-less environment keeps today's
- * behaviour rather than silently stamping something lower.
- */
-export async function resolveShippedVersion(root, pkgVersion, git = realGitExec) {
-    if (!(await fs.pathExists(path.join(root, '.git'))))
-        return pkgVersion;
-    const described = await git(['describe', '--tags', '--abbrev=0'], root);
-    const tag = described?.trim().replace(/^v/, '');
-    if (!tag || !/^\d+\.\d+/.test(tag))
-        return pkgVersion;
-    return isNewerVersion(tag, pkgVersion) ? tag : pkgVersion;
-}
 /** The skill source and the package version that will be stamped into it. */
 export async function readShippedSkill(name = SHIPPED_SKILL, git = realGitExec) {
     const root = getPackageRoot();

package/dist/cli/generators/index.js

@@ -91,7 +91,14 @@ export async function generateConfigs(config, targetDir) {
     await ensureBuildApprovals(config, targetDir);
     // Family-wide pnpm settings (#314). Runs last of the workspace writers so it
     // merges into whatever they wrote rather than racing them for the file.
-    await ensurePnpmSettings(targetDir, bundlerNeedsEsbuild(config), familyGlob(config.projectName));
+    //
+    // The scope is read back off the emitted package.json rather than taken from
+    // config.projectName: under `--preset` that name is only the directory
+    // basename, while generatePackageJson preserves an existing scoped `name`.
+    // doctor derives the glob from that same field, so reading the basename left
+    // the two disagreeing on every scoped repo (#573).
+    const { name } = (await fs.readJson(path.join(targetDir, 'package.json')));
+    await ensurePnpmSettings(targetDir, bundlerNeedsEsbuild(config), familyGlob(name));
     // Turborepo task pipeline (pnpm-workspace monorepos, when opted-in)
     if (config.turborepo) {
         await generateTurborepo(targetDir);

package/dist/cli/generators/package-json.js

@@ -1,3 +1,4 @@
+import chalk from 'chalk';
 import fs from 'fs-extra';
 import path from 'node:path';
 import { PNPM_FALLBACK_VERSION, detectPnpmVersion } from './misc.js';
@@ -8,6 +9,8 @@ export async function generatePackageJson(config, targetDir) {
         existingPackageJson = await fs.readJson(packageJsonPath);
     }
     const includeTreeshake = Boolean(config.treeshakeCheck && config.projectType === 'library');
+    const generatedScripts = getScripts(config, { includeTreeshake });
+    const existingScripts = existingPackageJson?.scripts ?? {};
     const packageJson = {
         name: config.projectName,
         version: '0.1.0',
@@ -17,10 +20,7 @@ export async function generatePackageJson(config, targetDir) {
         // generated workflows carry no `version:` input (#364).
         packageManager: `pnpm@${detectPnpmVersion() ?? PNPM_FALLBACK_VERSION}`,
         ...existingPackageJson,
-        scripts: {
-            ...getScripts(config, { includeTreeshake }),
-            ...existingPackageJson?.scripts,
-        },
+        scripts: resolveScripts(config, generatedScripts, existingScripts),
         dependencies: {
             ...existingPackageJson?.dependencies,
         },
@@ -66,6 +66,30 @@ export async function generatePackageJson(config, targetDir) {
     // (see ensureBuildApprovals in build.ts).
     await fs.writeJson(packageJsonPath, packageJson, { spaces: 2 });
 }
+/**
+ * Merge the generated scripts with what the package.json already had. Existing
+ * values win — that merge-don't-clobber policy is what makes re-running `setup`
+ * on a live repo safe.
+ *
+ * `build` on a library is the one exception. The library branch of
+ * generatePackageJson overwrites the whole publish contract
+ * (main/module/types/exports) unconditionally, and that contract names files
+ * only the preset's bundler emits: a preserved `build: tsc` produces
+ * dist/index.js + dist/index.d.ts and never the ./dist/index.cjs that `main`
+ * and every `require` condition point at, so `pnpm build && npm publish` ships
+ * a package whose CJS entry points 404 (#570). Owning the contract means owning
+ * its producer; the replacement is announced rather than silent.
+ */
+function resolveScripts(config, generated, existing) {
+    const scripts = { ...generated, ...existing };
+    if (config.projectType !== 'library' || !generated.build)
+        return scripts;
+    if (existing.build && existing.build !== generated.build) {
+        console.warn(chalk.yellow(`⚠️  Replaced "build": "${existing.build}" with "${generated.build}" — the library exports map names files only ${config.bundler} emits.`));
+    }
+    scripts.build = generated.build;
+    return scripts;
+}
 function getScripts(config, opts = {}) {
     const scripts = {};
     // TypeScript scripts

package/dist/cli/generators/pnpm-workspace.js

@@ -24,10 +24,16 @@ export const WORKSPACE_FILE = 'pnpm-workspace.yaml';
  *
  * One glob covers a whole scope: pnpm matches these entries with
  * `@pnpm/config.matcher`, so there's no package list to keep in sync.
+ *
+ * The scope is matched against npm's own name charset, not just "anything up
+ * to the slash": the name comes verbatim from a pre-existing `package.json`
+ * and is never validated as an npm name on the way here, so a scope of a lone
+ * wildcard would otherwise be taken as a glob and exempt every scoped package
+ * from the release-age delay. An unparseable scope gets no setting at all.
  */
 export function familyGlob(packageName) {
     const name = typeof packageName === 'string' ? packageName : '';
-    const scope = /^(@[^/]+)\//.exec(name)?.[1];
+    const scope = /^(@[a-z0-9-][a-z0-9._-]*)\//i.exec(name)?.[1];
     return scope ? `${scope}/*` : null;
 }
 /** Bundlers that pull in esbuild, whose install script pnpm 11 refuses to run unapproved. */

package/dist/cli/index.js

@@ -3,12 +3,12 @@ import path from 'node:path';
 import chalk from 'chalk';
 import { Command } from 'commander';
 import fs from 'fs-extra';
-import packageJson from '../../package.json' with { type: 'json' };
 import { doctorCommand } from './commands/doctor.js';
 import { fixCommand } from './commands/fix.js';
 import { loopGuardCommand } from './commands/loop-guard.js';
 import { setupProject } from './commands/setup.js';
 import { copyPreset, PRESETS } from './utils/copy-preset.js';
+import { getToolVersion } from './utils/version.js';
 async function isSelfRepo(dir) {
     try {
         const pkg = await fs.readJson(path.join(dir, 'package.json'));
@@ -22,7 +22,7 @@ const program = new Command();
 program
     .name('@rtorcato/repo-tooling')
     .description('🛠️  JavaScript and TypeScript tooling setup for modern projects')
-    .version(packageJson.version);
+    .version(await getToolVersion());
 program
     .command('setup')
     .alias('init')

package/dist/cli/utils/lockfile.js

@@ -1,8 +1,8 @@
 import path from 'node:path';
 import fs from 'fs-extra';
-import packageJson from '../../../package.json' with { type: 'json' };
 import { CONFIG_SCHEMA, validateProjectConfig } from '../commands/setup-presets.js';
 import { SHIPPED_SKILLS } from '../generators/claude-skills.js';
+import { getToolVersion } from './version.js';
 export const LOCKFILE_NAME = '.repo-tooling.json';
 // Package and bin name used before the js-tooling→repo-tooling rename (#272).
 // The bin no longer exists and the package is 404 on the registry, so any
@@ -27,6 +27,21 @@ const LOCKFILE_SCHEMA_URL = 'https://rtorcato.github.io/repo-tooling/schemas/loc
  * branches on it beyond printing it.
  */
 export const MCP_IMPORTANCE = ['nice-to-have', 'important', 'critical'];
+/**
+ * The empty ruleset a repo with no stated rules gets (#571). `rules` used to
+ * appear only via v1–v3 migration, so the repos this tool creates were exactly
+ * the ones with nothing to edit and nothing to compare. Writing the containers
+ * — with `$schema` stamped alongside — makes the file teach its own shape.
+ *
+ * Values, never defaults: every entry is empty, because a populated one would
+ * be this tool asserting a rule on a repo whose humans have not stated any.
+ */
+export const DEFAULT_RULES = {
+    aiLoop: {},
+    requiredSkills: [],
+    mcp: { recommended: [] },
+    exceptions: {},
+};
 /**
  * JSON Schema for the lockfile, published with the docs site at the exact URL
  * every written lockfile's `$schema` points to (#529). The `satisfies` clauses
@@ -243,10 +258,11 @@ export async function writeLockfile(dir, config, assets) {
         record: {
             config,
             ...(carried && Object.keys(carried).length > 0 ? { assets: carried } : {}),
-            writtenBy: `@rtorcato/repo-tooling@${packageJson.version}`,
+            writtenBy: `@rtorcato/repo-tooling@${await getToolVersion()}`,
             writtenAt: new Date().toISOString(),
         },
-        ...(existing?.rules ? { rules: existing.rules } : {}),
+        // A repo that has stated no rules gets the empty scaffold, not nothing (#571).
+        rules: existing?.rules ?? DEFAULT_RULES,
     };
     await fs.writeJson(filepath, lockfile, { spaces: 2 });
     // Migrate a pre-rename repo to the new name: now that the canonical file is

package/dist/cli/utils/version.js

@@ -0,0 +1,68 @@
+/**
+ * The one answer to "what version of this package is running" (#572).
+ *
+ * There were two. `--version` and the lockfile's `writtenBy` read the imported
+ * `package.json` directly; the Claude-skills stamp went through
+ * `resolveShippedVersion`, which corrects for the drift documented below. A
+ * single `doctor` run could report both — the skills check saying 3.31.0 while
+ * `writtenBy` in the same run said 3.11.0. Everything now calls
+ * `getToolVersion()`.
+ */
+import path from 'node:path';
+import fs from 'fs-extra';
+import packageJson from '../../../package.json' with { type: 'json' };
+import { realGitExec } from '../../base/git-identity.js';
+import { getPackageRoot } from './copy-preset.js';
+function versionParts(version) {
+    return version.split('.').map((n) => Number.parseInt(n, 10) || 0);
+}
+/** True when `a` is a strictly higher version than `b`. Prerelease tags are ignored. */
+export function isNewerVersion(a, b) {
+    const [left, right] = [versionParts(a), versionParts(b)];
+    for (let i = 0; i < 3; i++) {
+        const [x, y] = [left[i] ?? 0, right[i] ?? 0];
+        if (x !== y)
+            return x > y;
+    }
+    return false;
+}
+/**
+ * The version to report, given what `package.json` claims.
+ *
+ * In a published tarball that field is authoritative — `@semantic-release/npm`
+ * rewrites it before packing. In a *git checkout* it is not: this repo runs
+ * semantic-release without `@semantic-release/git` (#417), so nothing ever
+ * writes the released version back and the field sits at whatever it was last
+ * hand-set to. Observed 2026-08-22: `package.json` 3.11.0 against npm 3.21.1,
+ * ten minor versions of drift.
+ *
+ * That mattered first because the stamp feeds the skills downgrade guard: a
+ * skill installed from npm could not be updated from a local checkout, and the
+ * refusal claimed the installed copy was "newer" when only its *label* was.
+ *
+ * So when the package root is a git checkout, take the nearest tag as well and
+ * keep whichever is higher. Monotonic on purpose — this can only ever raise the
+ * answer, so a tagless, shallow, or git-less environment keeps today's
+ * behaviour rather than silently reporting something lower.
+ */
+export async function resolveShippedVersion(root, pkgVersion, git = realGitExec) {
+    if (!(await fs.pathExists(path.join(root, '.git'))))
+        return pkgVersion;
+    const described = await git(['describe', '--tags', '--abbrev=0'], root);
+    const tag = described?.trim().replace(/^v/, '');
+    if (!tag || !/^\d+\.\d+/.test(tag))
+        return pkgVersion;
+    return isNewerVersion(tag, pkgVersion) ? tag : pkgVersion;
+}
+let cached;
+/**
+ * This package's version, for `--version`, `writtenBy`, and the skill stamps.
+ *
+ * Memoized: in a checkout `resolveShippedVersion` spawns `git describe`, and
+ * nothing about the answer changes mid-process. An npm install has no `.git`
+ * under the package root, so that path costs one `pathExists` and no subprocess.
+ */
+export function getToolVersion() {
+    cached ??= resolveShippedVersion(getPackageRoot(), String(packageJson.version));
+    return cached;
+}

package/dist/languages/swift/scaffold.js

@@ -18,7 +18,7 @@ import { generateEditorConfig } from '../../cli/generators/misc.js';
 import { generateCodeQLWorkflow, generateDependabotConfig } from '../../cli/generators/security.js';
 import { copyPreset } from '../../cli/utils/copy-preset.js';
 import { LANGUAGES } from '../registry.js';
-import { readSwiftPackage, renderSwiftReleaseWorkflow, renderSwiftWorkflow } from './ci.js';
+import { parsePackageSwift, readSwiftPackage, renderSwiftReleaseWorkflow, renderSwiftWorkflow, } from './ci.js';
 import { SWIFT_HOOKS_DIR, installSwiftGitHooks } from './git-hooks.js';
 import { ensureSwiftGitignore } from './gitignore.js';
 /**
@@ -196,6 +196,10 @@ git tag 1.0.0 && git push origin 1.0.0
 /**
  * Relative paths `setup --dry-run` reports for a Swift config, in write order.
  * Kept beside the writer so the two can't drift.
+ *
+ * This is the greenfield list. Against a directory that already has a
+ * Package.swift the writer preserves it and skips the target scaffolding, so the
+ * preview over-reports there — the safe direction for a dry run.
  */
 export function swiftFileList(config) {
     const module = swiftModuleName(config.projectName);
@@ -225,12 +229,29 @@ export function swiftFileList(config) {
     files.push('README.md');
     return files;
 }
-/** Scaffold a SwiftPM library. The Swift arm of `generateConfigs`. */
+/**
+ * Scaffold a SwiftPM library. The Swift arm of `generateConfigs`.
+ *
+ * Package.swift is source, not config (#574): rewriting one that already exists
+ * renames the package after the *directory* and leaves the real `Sources/<Target>/`
+ * declared by no target — and `swift build` still exits 0, because SwiftPM just
+ * ignores the orphaned directory. So an existing manifest is left byte-identical
+ * and the module name is read back off it rather than derived from the directory,
+ * the same way the JS presets merge into a package.json instead of replacing it.
+ */
 export async function generateSwiftProject(config, targetDir) {
-    const module = swiftModuleName(config.projectName);
-    await fs.writeFile(path.join(targetDir, 'Package.swift'), packageSwift(module));
-    await fs.outputFile(path.join(targetDir, 'Sources', module, `${module}.swift`), sourceFile(module));
-    await fs.outputFile(path.join(targetDir, 'Tests', `${module}Tests`, `${module}Tests.swift`), testFile(module));
+    const manifestPath = path.join(targetDir, 'Package.swift');
+    const existingManifest = (await fs.pathExists(manifestPath))
+        ? parsePackageSwift(await fs.readFile(manifestPath, 'utf-8'))
+        : null;
+    const module = existingManifest?.products[0] ?? swiftModuleName(config.projectName);
+    // Nothing is scaffolded under Sources/ or Tests/ either: those would be
+    // directories for a target the existing manifest doesn't declare.
+    if (!existingManifest) {
+        await fs.writeFile(manifestPath, packageSwift(module));
+        await fs.outputFile(path.join(targetDir, 'Sources', module, `${module}.swift`), sourceFile(module));
+        await fs.outputFile(path.join(targetDir, 'Tests', `${module}Tests`, `${module}Tests.swift`), testFile(module));
+    }
     await copyPreset('swiftlint', targetDir);
     await copyPreset('periphery', targetDir);
     await ensureSwiftGitignore(targetDir);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.31.1",
+	"version": "3.32.0",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [