@uxf/scripts 11.111.0-canary.1 → 11.111.1

package/README.md

@@ -67,7 +67,7 @@ notify-push:
 
 All-in-one dependency health check for projects using `@uxf/*` packages. Runs two checks:
 
-1. **Version conflict detection** — parses the lock file and reports dependencies of `@uxf/*` packages that resolve to multiple versions
+1. **Version conflict detection** — reports dependencies where the project and/or `@uxf/*` packages themselves resolve to different versions. Transitive-only duplicates (a dep pulled in by unrelated third-party packages at a different version) are ignored, since they don't affect `@uxf/*` compatibility.
 2. **Peer dependency check** — verifies that all `peerDependencies` of installed `@uxf/*` packages are present and version-matched
 
 Supports **yarn**, **npm**, **pnpm**, and **bun**. The package manager is auto-detected from the lock file.
@@ -103,13 +103,15 @@ npx uxf-dependencies-check --exclude lodash dayjs
 
 ### Ignoring known conflicts
 
-Some version conflicts are caused by third-party packages and cannot be resolved (e.g. `@udecode/plate-floating` pulling an old `@floating-ui/react`). Each `@uxf/*` package can declare known conflicts in its own `package.json`:
+Transitive-only duplicates (caused by unrelated third-party packages, e.g. `@udecode/plate-floating` pulling an old `@floating-ui/react` alongside a newer one declared by an `@uxf/*` package) are filtered out automatically and do not need to be ignored.
+
+For genuine declarer conflicts that you've consciously accepted — e.g. two `@uxf/*` packages that temporarily pin different versions of the same dep — each `@uxf/*` package can declare known conflicts in its own `package.json`:
 
 ```json
 {
   "name": "@uxf/wysiwyg",
   "uxf": {
-    "ignoredConflicts": ["@floating-ui/react"]
+    "ignoredConflicts": ["some-shared-dep"]
   }
 }
 ```
@@ -118,7 +120,8 @@ Ignored conflicts are still printed as informational output but do **not** cause
 
 ### What it checks
 
-- Parses the lock file (yarn.lock / package-lock.json / pnpm-lock.yaml / bun.lock) to detect version conflicts
+- Parses the lock file (yarn.lock / package-lock.json / pnpm-lock.yaml / bun.lock) to find dependencies with multiple installed versions
+- For each candidate, resolves the version actually seen by each *declarer* (the project itself and any `@uxf/*` package that directly declares the dep). A conflict is reported only when these declarers land on different versions — transitive-only duplicates from unrelated third-party packages are filtered out
 - Scans all `@uxf/*` packages in your `dependencies` / `devDependencies`
 - Reads each package's `peerDependencies` from `node_modules`
 - Skips `@uxf/*`, `react`, `react-dom`, and `next` (you manage these yourself)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@uxf/scripts",
-    "version": "11.111.0-canary.1",
+    "version": "11.111.1",
     "description": "",
     "main": "index.js",
     "bin": {
@@ -48,6 +48,6 @@
         "@types/react": "18.3.27",
         "@types/react-dom": "18.3.7",
         "@uxf/core": "11.110.0",
-        "@uxf/ui": "11.111.0-canary.1"
+        "@uxf/ui": "11.111.0"
     }
 }

package/src/uxf-dependencies-check/conflict-check.d.ts

@@ -1,4 +1,4 @@
-import type { Conflict, LockData } from "./types";
+import type { Conflict, LockData, PackageJson } from "./types";
 export interface UxfDepsInfo {
     depNames: Set<string>;
     ignoredConflicts: Set<string>;
@@ -13,3 +13,14 @@ export interface ConflictCheckResult {
     ignoredConflicts: Conflict[];
 }
 export declare function checkMultipleVersions(lockData: LockData, relevantPackages: Set<string>, excludedPackages?: Set<string>, ignoredPackages?: Set<string>): ConflictCheckResult;
+/**
+ * For each candidate conflict, collect the set of versions actually resolved by the *declarers* —
+ * i.e. the project itself and any @uxf/* package that directly declares `name` in its
+ * `dependencies` or `peerDependencies`. Transitive-only duplicates (a package pulled in by a
+ * non-@uxf, non-project dependency at an unrelated version) are ignored.
+ *
+ * A conflict is kept only when declarers disagree on the resolved version. This narrows the check
+ * to what the tool actually cares about: compatibility between the project and @uxf/* packages,
+ * and between @uxf/* packages themselves.
+ */
+export declare function filterToDeclarerConflicts(conflicts: Conflict[], projectPkg: PackageJson, uxfPackages: string[], nodeModulesPath: string): Conflict[];

package/src/uxf-dependencies-check/conflict-check.js

@@ -5,8 +5,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectUxfDepsInfo = collectUxfDepsInfo;
 exports.checkMultipleVersions = checkMultipleVersions;
+exports.filterToDeclarerConflicts = filterToDeclarerConflicts;
 const path_1 = __importDefault(require("path"));
-const types_1 = require("./types");
+const package_json_1 = require("./package-json");
 /** Build-time / CLI-only dependencies that cannot cause runtime conflicts */
 const IGNORED_PACKAGES = new Set(["yargs", "fast-glob"]);
 /**
@@ -19,7 +20,7 @@ function collectUxfDepsInfo(uxfPackages, nodeModulesPath) {
     const ignoredConflicts = new Set();
     for (const uxfPkg of uxfPackages) {
         const pkgJsonPath = path_1.default.join(nodeModulesPath, uxfPkg, "package.json");
-        const pkgJson = (0, types_1.readPackageJson)(pkgJsonPath);
+        const pkgJson = (0, package_json_1.readPackageJson)(pkgJsonPath);
         if (!pkgJson) {
             continue;
         }
@@ -59,3 +60,80 @@ function checkMultipleVersions(lockData, relevantPackages, excludedPackages = ne
     }
     return { conflicts, ignoredConflicts };
 }
+/**
+ * Resolve the version of `depName` as seen by a given declarer package. First checks the declarer's
+ * own nested `node_modules` (non-hoisted install), then falls back to the project-root `node_modules`
+ * (hoisted install). Returns null if neither location has the package installed.
+ */
+function resolveDeclarerVersion(nodeModulesPath, declarerPkg, depName) {
+    const candidatePaths = [];
+    if (declarerPkg) {
+        candidatePaths.push(path_1.default.join(nodeModulesPath, declarerPkg, "node_modules", depName, "package.json"));
+    }
+    candidatePaths.push(path_1.default.join(nodeModulesPath, depName, "package.json"));
+    for (const p of candidatePaths) {
+        const pkg = (0, package_json_1.readPackageJson)(p);
+        if (pkg && typeof pkg.version === "string") {
+            return pkg.version;
+        }
+    }
+    return null;
+}
+/**
+ * For each candidate conflict, collect the set of versions actually resolved by the *declarers* —
+ * i.e. the project itself and any @uxf/* package that directly declares `name` in its
+ * `dependencies` or `peerDependencies`. Transitive-only duplicates (a package pulled in by a
+ * non-@uxf, non-project dependency at an unrelated version) are ignored.
+ *
+ * A conflict is kept only when declarers disagree on the resolved version. This narrows the check
+ * to what the tool actually cares about: compatibility between the project and @uxf/* packages,
+ * and between @uxf/* packages themselves.
+ */
+function filterToDeclarerConflicts(conflicts, projectPkg, uxfPackages, nodeModulesPath) {
+    var _a, _b, _c;
+    if (conflicts.length === 0) {
+        return [];
+    }
+    const projectDeclared = {
+        ...projectPkg.dependencies,
+        ...projectPkg.devDependencies,
+        ...projectPkg.peerDependencies,
+    };
+    const uxfPkgJsons = new Map();
+    for (const uxfPkg of uxfPackages) {
+        const pkgJson = (0, package_json_1.readPackageJson)(path_1.default.join(nodeModulesPath, uxfPkg, "package.json"));
+        if (pkgJson) {
+            uxfPkgJsons.set(uxfPkg, pkgJson);
+        }
+    }
+    const result = [];
+    for (const conflict of conflicts) {
+        const { name } = conflict;
+        const resolvedVersions = new Set();
+        if (projectDeclared[name]) {
+            const resolved = resolveDeclarerVersion(nodeModulesPath, null, name);
+            if (resolved) {
+                resolvedVersions.add(resolved);
+            }
+        }
+        for (const [uxfPkg, pkgJson] of uxfPkgJsons) {
+            const declared = (_b = (_a = pkgJson.dependencies) === null || _a === void 0 ? void 0 : _a[name]) !== null && _b !== void 0 ? _b : (_c = pkgJson.peerDependencies) === null || _c === void 0 ? void 0 : _c[name];
+            if (!declared) {
+                continue;
+            }
+            const resolved = resolveDeclarerVersion(nodeModulesPath, uxfPkg, name);
+            if (resolved) {
+                resolvedVersions.add(resolved);
+            }
+        }
+        if (resolvedVersions.size === 0) {
+            // Could not resolve any declarer (edge case: non-node_modules install layout).
+            // Fall back to original lockfile versions rather than silently hiding the conflict.
+            result.push(conflict);
+        }
+        else if (resolvedVersions.size > 1) {
+            result.push({ name, versions: Array.from(resolvedVersions) });
+        }
+    }
+    return result;
+}

package/src/uxf-dependencies-check/index.js

@@ -43,8 +43,13 @@ async function checkUxfDependencies(options) {
     // Only check dependencies of @uxf/* packages, not the entire lock file
     try {
         const lockData = await (0, lock_parsers_1.parseLockFile)(pm, cwd);
-        const { depNames, ignoredConflicts: packageIgnored } = (0, conflict_check_1.collectUxfDepsInfo)(uxfPackages, nodeModulesPath);
-        const { conflicts, ignoredConflicts } = (0, conflict_check_1.checkMultipleVersions)(lockData, depNames, new Set(options.exclude), packageIgnored);
+        const uxfDepsInfo = (0, conflict_check_1.collectUxfDepsInfo)(uxfPackages, nodeModulesPath);
+        const conflictCheckResult = (0, conflict_check_1.checkMultipleVersions)(lockData, uxfDepsInfo.depNames, new Set(options.exclude), uxfDepsInfo.ignoredConflicts);
+        // Filter to real conflicts between declarers (project + @uxf packages). Transitive-only
+        // duplicates (e.g. `qs` pulled in by express at a different version than @uxf/core's qs)
+        // are ignored — they are not compatibility issues for @uxf/* packages.
+        const conflicts = (0, conflict_check_1.filterToDeclarerConflicts)(conflictCheckResult.conflicts, projectPkg, uxfPackages, nodeModulesPath);
+        const ignoredConflicts = (0, conflict_check_1.filterToDeclarerConflicts)(conflictCheckResult.ignoredConflicts, projectPkg, uxfPackages, nodeModulesPath);
         if (conflicts.length > 0) {
             console.log("Dependency version conflicts in @uxf/* packages:"); // eslint-disable-line no-console
             for (const { name, versions } of conflicts) {

package/src/uxf-dependencies-check/package-json.d.ts

@@ -0,0 +1,2 @@
+import type { PackageJson } from "./types";
+export declare function readPackageJson(filePath: string): PackageJson | null;

package/src/uxf-dependencies-check/package-json.js

@@ -0,0 +1,15 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPackageJson = readPackageJson;
+const fs_1 = __importDefault(require("fs"));
+function readPackageJson(filePath) {
+    try {
+        return JSON.parse(fs_1.default.readFileSync(filePath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}

package/src/uxf-dependencies-check/peer-deps.js

@@ -12,7 +12,7 @@ exports.installDeps = installDeps;
 const child_process_1 = require("child_process");
 const path_1 = __importDefault(require("path"));
 const detect_package_manager_1 = require("./detect-package-manager");
-const types_1 = require("./types");
+const package_json_1 = require("./package-json");
 /** Packages that consumers always install themselves — skip these in suggestions */
 const CONSUMER_PROVIDED = new Set(["react", "react-dom", "next"]);
 function findInstalledUxfPackages(projectPkg) {
@@ -25,7 +25,7 @@ function collectRequiredPeerDeps(uxfPackages, nodeModulesPath, projectPkg) {
     const peerDeps = new Map();
     for (const uxfPkg of uxfPackages) {
         const pkgJsonPath = path_1.default.join(nodeModulesPath, uxfPkg, "package.json");
-        const pkgJson = (0, types_1.readPackageJson)(pkgJsonPath);
+        const pkgJson = (0, package_json_1.readPackageJson)(pkgJsonPath);
         if (!(pkgJson === null || pkgJson === void 0 ? void 0 : pkgJson.peerDependencies)) {
             continue;
         }

package/src/uxf-dependencies-check/types.d.ts

@@ -6,6 +6,7 @@ export interface PackageJson {
     uxf?: {
         ignoredConflicts?: string[];
     };
+    version?: string;
 }
 export interface DepInfo {
     isDev: boolean;
@@ -27,4 +28,3 @@ export interface Conflict {
  * Every lock file parser must return this shape.
  */
 export type LockData = Map<string, Set<string>>;
-export declare function readPackageJson(filePath: string): PackageJson | null;

package/src/uxf-dependencies-check/types.js

@@ -1,15 +1,2 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readPackageJson = readPackageJson;
-const fs_1 = __importDefault(require("fs"));
-function readPackageJson(filePath) {
-    try {
-        return JSON.parse(fs_1.default.readFileSync(filePath, "utf8"));
-    }
-    catch {
-        return null;
-    }
-}