@uniflowed/config 0.0.0-alpha.13 → 0.0.0-alpha.15

package/index.js

@@ -5,6 +5,7 @@
 export type {
   CapabilityJsHost,
   CoverageThresholds,
+  Permissions,
   RuleLevel,
   TaskDefinition,
   UniflowedConfig,

package/internal/schema.js

@@ -25,6 +25,37 @@ export type TaskDefinition =
 
 export type CapabilityJsHost = "node" | "deno" | "bun";
 
+/**
+ * What the project's own code may reach.
+ *
+ * Absent from `uf.config.js` means no permission model: the toolchain starts
+ * its host the way it always has. Present means **deny by default** — the
+ * project's code gets what is listed and nothing else — and `permissions: {}`
+ * is a legitimate thing to write, meaning "nothing beyond what uf itself needs
+ * to load and transform the project". There is deliberately no way to spell
+ * "everything"; a project that wants everything does not declare a set.
+ *
+ * Every field is a list of literal strings, because `uf.config.js` is read as
+ * text and parsed as JSON5 rather than executed: a computed path or a
+ * `process.env` read here would not parse.
+ *
+ * The set is uf's, not a runtime's. Node.js enforces `read` and `write`, Deno
+ * enforces all five, and Bun has no permission model at all — a host that
+ * cannot enforce what is declared **refuses the run** rather than applying part
+ * of it. `docs/hosts.md` is the table.
+ *
+ * The declared paths are *added to* the ones uf needs to run the project, so
+ * what a set denies is the rest of the machine — `~/.ssh`, the network, the
+ * environment — and not the project's own files.
+ */
+export type Permissions = {
+  readonly read?: $ReadOnlyArray<string>,
+  readonly write?: $ReadOnlyArray<string>,
+  readonly net?: $ReadOnlyArray<string>,
+  readonly env?: $ReadOnlyArray<string>,
+  readonly run?: $ReadOnlyArray<string>,
+};
+
 /**
  * Percentages a coverage gate requires, as whole numbers between 0 and 100.
  *
@@ -93,6 +124,27 @@ export type UniflowedConfig = {
         // faces `uf_assets::font::LOCAL_FACES` knows the metrics of, because
         // the scaling is a ratio against real numbers rather than a guess.
         readonly fallback?: string,
+        // How an imported family is cut down. `"none"` is the default and the
+        // argued position: subsetting is lossy, and a build cannot see the
+        // text a server will render or a user will type. `"ranges"` splits the
+        // font's own coverage into script buckets with exact `unicode-range`
+        // values and loses nothing.
+        readonly subset?: "none" | "ranges",
+        // Whether `Font` preloads the primary face. Exactly one file is ever
+        // preloaded, however many buckets a split produced.
+        readonly preload?: boolean,
+      },
+      readonly icons?: {
+        readonly enabled?: boolean,
+        // Where `uf:icon/<name>` looks for `<name>.svg`, from the project
+        // root. A directory rather than a claim on `.svg`, which stays Vite's.
+        readonly dir?: string,
+      },
+      readonly og?: {
+        readonly enabled?: boolean,
+        // The typeface every `*.og.json` is drawn with unless it names its
+        // own. uf embeds none, so a project that draws cards points at one.
+        readonly font?: string | null,
       },
       readonly motion?: {
         readonly module?: "@uniflowed/motion",
@@ -147,6 +199,10 @@ export type UniflowedConfig = {
       readonly entry?: string,
       readonly root?: string,
       readonly manifest?: string,
+      // Turning the file-system router off is what makes a project a
+      // **library** rather than an application, and `uf build` reads it: see
+      // `build.lib` below and docs/app/reference/config.
+      readonly enabled?: boolean,
     },
     readonly rendering?: {
       readonly modes?: $ReadOnlyArray<"ppr" | "ssr" | "ssg" | "isr">,
@@ -161,8 +217,41 @@ export type UniflowedConfig = {
   readonly build?: {
     readonly entries?: $ReadOnlyArray<string>,
     readonly outDir?: string,
+    // Prerender every route and leave no server bundle behind. Read together
+    // with `app.rendering.modes`; see docs/app/reference/config.
     readonly staticBuild?: boolean,
     readonly sourcemap?: boolean,
+    /**
+     * What a **library** build writes, for a project whose
+     * `app.router.enabled` is false.
+     *
+     * Never the switch. `app.router.enabled` decides which of the two builds
+     * `uf build` runs, and declaring this key in a project whose router is on
+     * is refused where the config is read rather than resolved by precedence.
+     * Every field has a default that builds what `uf new --lib` scaffolds, so
+     * a library ordinarily writes none of this.
+     *
+     * `"umd"` and `"iife"` are deliberately absent from `formats`: each needs
+     * a global name per entry, and what a Flow library's global should be is
+     * not a decision uf has made.
+     */
+    readonly lib?: {
+      // The modules to build, relative to the project root. Each names its own
+      // output by its path — `internal/parse.js` is written to
+      // `dist/internal/parse.js` — so two entries cannot collide.
+      readonly entries?: $ReadOnlyArray<string>,
+      readonly formats?: $ReadOnlyArray<"es" | "cjs">,
+      // Package names to leave as imports *beyond* the ones the manifest
+      // declares. A library build already externalises `dependencies`,
+      // `peerDependencies`, `optionalDependencies` and the host's built-in
+      // modules; this is for what a manifest cannot say.
+      readonly external?: $ReadOnlyArray<string>,
+    },
+  },
+  // Which builder uf drives. Vite is the default, not a dependency: any module
+  // satisfying the contract in docs/architecture.md can be named here.
+  readonly builder?: {
+    readonly module?: string,
   },
   readonly dev?: {
     readonly host?: string,
@@ -216,12 +305,50 @@ export type UniflowedConfig = {
     >,
     readonly typescriptDeclarationsToFlow?: true,
   },
+  readonly permissions?: Permissions,
   readonly pm?: {
     readonly module?: "@uniflowed/pm",
     readonly resolver?: "uf-native",
     readonly lockfile?: "uf.lock",
     readonly storeDir?: string,
     readonly allowLifecycleScripts?: false,
+    /**
+     * The registry uf *reads* from: packuments, provenance attestations, and
+     * the versions `uf update` reports against.
+     *
+     * Unset means `publish.registry`, which is where this lived until it
+     * turned out to be answering two questions with one value. A project that
+     * publishes to a company registry and installs through a read-through
+     * mirror sets both; one that has only ever set `publish.registry` keeps
+     * working and is told, once, which key to move to.
+     */
+    readonly registry?: string,
+    /**
+     * Which registry answers for which scope: `{ "@company": "https://…" }`.
+     *
+     * A scope named here resolves from that registry **and nowhere else**.
+     * There is no fallback to the public registry, deliberately: publishing
+     * `@company/internal-thing` to npmjs and waiting for a resolver to fall
+     * back to it is the dependency-confusion attack, so the fallback is the
+     * vulnerability rather than a recovery from it. A name the bound registry
+     * does not have is an error that names the scope and the registry.
+     *
+     * uf refuses an install whose lockfile resolves a bound scope from
+     * somewhere else. It does not rewrite the project's `.npmrc`: the manager
+     * that resolves is the manager that has to be told, in its own
+     * configuration.
+     */
+    readonly scopes?: { readonly [scope: string]: string },
+    /**
+     * How hard `uf install` looks at npm provenance attestations.
+     *
+     * `"report"`, the default, reads the attestation of every package the
+     * install brought in or moved: an attestation that is not about the
+     * tarball being installed stops the install, and a package with none is a
+     * line in the summary. `"off"` reads none, for a machine with no route to
+     * a registry.
+     */
+    readonly provenance?: "report" | "off",
   },
   readonly rm?: {
     readonly module?: "@uniflowed/rm",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniflowed/config",
-  "version": "0.0.0-alpha.13",
+  "version": "0.0.0-alpha.15",
   "description": "Flow declarations for @uniflowed/config, part of the Unified Toolchain for Flow.",
   "type": "module",
   "license": "MIT",