@soulbatical/tetra-dev-toolkit 1.20.20 → 1.20.21

package/lib/checks/stability/local-deps.js

@@ -0,0 +1,91 @@
+/**
+ * Detect local file/link dependencies that break Railway/CI deploys.
+ *
+ * Blocks push when package.json contains:
+ * - "file:../..." or "file:../../..." local path references
+ * - "link:..." npm link references
+ * - workspace:* protocol references outside the monorepo
+ *
+ * Also ensures @soulbatical/* packages use the latest published versions.
+ */
+
+import { glob } from 'glob'
+import { readFileSync } from 'fs'
+
+export const meta = {
+  id: 'local-deps',
+  name: 'Local Dependency Detection',
+  category: 'stability',
+  severity: 'critical',
+  description: 'Blocks deploy-breaking file: and link: dependencies in package.json'
+}
+
+const TETRA_PACKAGES = {
+  '@soulbatical/tetra-core': '0.3.5',
+  '@soulbatical/tetra-ui': '0.7.2',
+  '@soulbatical/tetra-dev-toolkit': '1.20.20',
+}
+
+export async function run(config, projectRoot) {
+  const results = {
+    passed: true,
+    findings: [],
+    summary: { total: 0, critical: 0, high: 0, medium: 0, low: 0 }
+  }
+
+  const files = await glob('**/package.json', {
+    cwd: projectRoot,
+    ignore: ['**/node_modules/**', '**/dist/**', '**/.next/**', ...config.ignore]
+  })
+
+  for (const file of files) {
+    try {
+      const content = readFileSync(`${projectRoot}/${file}`, 'utf-8')
+      const pkg = JSON.parse(content)
+      const allDeps = {
+        ...(pkg.dependencies || {}),
+        ...(pkg.devDependencies || {})
+      }
+
+      for (const [name, version] of Object.entries(allDeps)) {
+        const ver = String(version)
+
+        // Block file: and link: references
+        if (ver.startsWith('file:') || ver.startsWith('link:')) {
+          results.findings.push({
+            severity: 'critical',
+            file,
+            line: 0,
+            message: `"${name}": "${ver}" — local dependency will break Railway/CI deploy. Use npm version instead.`,
+            snippet: `${name}: ${ver}`
+          })
+          results.summary.critical++
+          results.summary.total++
+          results.passed = false
+        }
+
+        // Check @soulbatical/* packages are on latest
+        if (TETRA_PACKAGES[name]) {
+          const minVersion = TETRA_PACKAGES[name]
+          // Extract version number from range (^0.3.5 -> 0.3.5)
+          const versionNum = ver.replace(/^[\^~>=<]*/, '')
+          if (ver.startsWith('file:') || ver.startsWith('link:')) {
+            // Already caught above
+          } else if (versionNum && versionNum < minVersion && !ver.includes('||')) {
+            results.findings.push({
+              severity: 'medium',
+              file,
+              line: 0,
+              message: `"${name}": "${ver}" — outdated. Latest: ${minVersion}. Run: npm install ${name}@latest`,
+              snippet: `${name}: ${ver} (latest: ^${minVersion})`
+            })
+            results.summary.medium++
+            results.summary.total++
+          }
+        }
+      }
+    } catch { /* skip unparseable */ }
+  }
+
+  return results
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.20.20",
+  "version": "1.20.21",
   "publishConfig": {
     "access": "restricted"
   },