@weft-js/cli 0.1.0 → 0.1.2

package/src/trust.mjs

@@ -3,23 +3,36 @@
 // already run by the time any of this looks at a plugin, and the audit reads source, which code can hide from.
 
 import { createHash } from 'node:crypto'
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
-import { builtinModules } from 'node:module'
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  writeFileSync,
+} from 'node:fs'
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
-import ts from 'typescript'
 import { diagnostic, locate } from './diag.mjs'
+import { scanFile } from './trust/scan.mjs'
 
 export const lockFile = '.weft/plugins.lock.json'
 
-const refused = message => Object.assign(new Error(message), { code: 'E_TRUST' })
-const posix = p => p.split(sep).join('/')
+const refused = (message) => Object.assign(new Error(message), { code: 'E_TRUST' })
+const posix = (p) => p.split(sep).join('/')
 /** @param {string[]} list */
-const sorted = list => [...new Set(list)].sort()
+const sorted = (list) => [...new Set(list)].sort()
 
 /** Permissions as flat strings, one per grant, so a lock diff reads line by line: `fs.read:fonts/**`, `native`. */
 export function grants(p = {}) {
-  const each = (kind, list) => (list ?? []).map(v => `${kind}:${v}`)
-  return sorted([...each('fs.read', p.fs?.read), ...each('fs.write', p.fs?.write), ...each('net', p.net), ...each('env', p.env), ...each('spawn', p.spawn), ...(p.native ? ['native'] : [])])
+  const each = (kind, list) => (list ?? []).map((v) => `${kind}:${v}`)
+  return sorted([
+    ...each('fs.read', p.fs?.read),
+    ...each('fs.write', p.fs?.write),
+    ...each('net', p.net),
+    ...each('env', p.env),
+    ...each('spawn', p.spawn),
+    ...(p.native ? ['native'] : []),
+  ])
 }
 
 /** The lockfile, or `broken` when it can't be read: an unresolved merge shouldn't read as "nothing approved". */
@@ -28,7 +41,8 @@ function readLock(root) {
   if (!existsSync(file)) return { found: false, plugins: {} }
   try {
     const data = JSON.parse(readFileSync(file, 'utf8'))
-    if (data?.version !== 1 || typeof data.plugins !== 'object' || data.plugins === null) return { found: true, plugins: {}, broken: 'it is not a version 1 lockfile' }
+    if (data?.version !== 1 || typeof data.plugins !== 'object' || data.plugins === null)
+      return { found: true, plugins: {}, broken: 'it is not a version 1 lockfile' }
     return { found: true, plugins: data.plugins }
   } catch (error) {
     return { found: true, plugins: {}, broken: String(error.message).split('\n')[0] }
@@ -36,7 +50,11 @@ function readLock(root) {
 }
 
 /** The package a plugin name is in: `@weft-js/db/mongo` is a subpath of `@weft-js/db`. */
-export const packageOf = name => name.split('/').slice(0, name.startsWith('@') ? 2 : 1).join('/')
+export const packageOf = (name) =>
+  name
+    .split('/')
+    .slice(0, name.startsWith('@') ? 2 : 1)
+    .join('/')
 
 /** Where a plugin is installed: the nearest `node_modules/<package>`, through its symlink. Null for one defined in the config. */
 function packageDir(root, name) {
@@ -51,8 +69,8 @@ function packageDir(root, name) {
 function hashPackage(dir) {
   const hash = createHash('sha512')
   const files = readdirSync(dir, { recursive: true, withFileTypes: true })
-    .filter(f => f.isFile() && !relative(dir, f.parentPath).split(sep).includes('node_modules'))
-    .map(f => join(f.parentPath, f.name))
+    .filter((f) => f.isFile() && !relative(dir, f.parentPath).split(sep).includes('node_modules'))
+    .map((f) => join(f.parentPath, f.name))
     .sort()
   for (const file of files) {
     const bytes = readFileSync(file)
@@ -61,50 +79,21 @@ function hashPackage(dir) {
   return `sha512-${hash.digest('base64')}`
 }
 
-const builtins = new Set(builtinModules)
-const NEEDS = { fs: 'fs', 'fs/promises': 'fs', child_process: 'spawn', cluster: 'spawn', net: 'net', tls: 'net', dgram: 'net', dns: 'net', 'dns/promises': 'net', http: 'net', https: 'net', http2: 'net' }
-const NET_GLOBALS = new Set(['fetch', 'WebSocket', 'EventSource'])
-/** Bundlers inline it, and it says nothing about the machine. */
-const AMBIENT_ENV = new Set(['NODE_ENV'])
-
-/** What one file does directly, and what it imports. */
-function scanFile(text, file) {
-  const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, /\.[cm]?tsx?$/.test(file) ? ts.ScriptKind.TSX : ts.ScriptKind.JSX)
-  const uses = []
-  const imports = []
-  const use = (need, node) => uses.push({ need, line: sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1 })
-  const specifier = (name, node) => {
-    const bare = name.replace(/^node:/, '')
-    if (name.endsWith('.node')) use('native', node)
-    else if (builtins.has(bare)) NEEDS[bare] && use(NEEDS[bare], node)
-    else imports.push(name)
-  }
-  const isProcess = node => ts.isIdentifier(node) && node.text === 'process'
-  const visit = node => {
-    if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) {
-      if (!(node.importClause?.isTypeOnly || node.isTypeOnly)) specifier(node.moduleSpecifier.text, node)
-    } else if (ts.isCallExpression(node)) {
-      const callee = node.expression
-      const [first] = node.arguments
-      if ((callee.kind === ts.SyntaxKind.ImportKeyword || (ts.isIdentifier(callee) && callee.text === 'require')) && first && ts.isStringLiteralLike(first)) specifier(first.text, node)
-      else if (ts.isIdentifier(callee) && NET_GLOBALS.has(callee.text)) use('net', node)
-      else if (ts.isPropertyAccessExpression(callee) && isProcess(callee.expression) && callee.name.text === 'dlopen') use('native', node)
-    } else if (ts.isNewExpression(node) && ts.isIdentifier(node.expression) && NET_GLOBALS.has(node.expression.text)) use('net', node)
-    else if (ts.isPropertyAccessExpression(node) && isProcess(node.expression) && node.name.text === 'env') {
-      const parent = node.parent
-      if (ts.isPropertyAccessExpression(parent) && parent.expression === node) AMBIENT_ENV.has(parent.name.text) || use(`env:${parent.name.text}`, node)
-      else if (ts.isElementAccessExpression(parent) && parent.expression === node && ts.isStringLiteralLike(parent.argumentExpression)) AMBIENT_ENV.has(parent.argumentExpression.text) || use(`env:${parent.argumentExpression.text}`, node)
-      else use('env:*', node)
-    }
-    ts.forEachChild(node, visit)
-  }
-  visit(sf)
-  return { uses, imports }
-}
-
-const EXTENSIONS = ['', '.mjs', '.js', '.cjs', '.ts', '.tsx', '.mts', '/index.mjs', '/index.js', '/index.ts']
+const EXTENSIONS = [
+  '',
+  '.mjs',
+  '.js',
+  '.cjs',
+  '.ts',
+  '.tsx',
+  '.mts',
+  '/index.mjs',
+  '/index.js',
+  '/index.ts',
+]
 const sourceFile = /\.(?:[cm]?[jt]s|[jt]sx)$/
-const onDisk = path => EXTENSIONS.map(e => path + e).find(p => sourceFile.test(p) && existsSync(p)) ?? null
+const onDisk = (path) =>
+  EXTENSIONS.map((e) => path + e).find((p) => sourceFile.test(p) && existsSync(p)) ?? null
 
 /** A package export's file for this runtime. */
 function exportTarget(value) {
@@ -115,9 +104,13 @@ function exportTarget(value) {
 
 function entryFile(dir, pkg, subpath) {
   const map = pkg.exports
-  const keyed = map && typeof map === 'object' && Object.keys(map).some(k => k.startsWith('.'))
-  const target = exportTarget(keyed ? map[subpath] : subpath === '.' ? (map ?? pkg.main ?? 'index.js') : null)
-  return (target && onDisk(join(dir, target))) ?? (subpath === '.' ? null : onDisk(join(dir, subpath)))
+  const keyed = map && typeof map === 'object' && Object.keys(map).some((k) => k.startsWith('.'))
+  const target = exportTarget(
+    keyed ? map[subpath] : subpath === '.' ? (map ?? pkg.main ?? 'index.js') : null,
+  )
+  return (
+    (target && onDisk(join(dir, target))) ?? (subpath === '.' ? null : onDisk(join(dir, subpath)))
+  )
 }
 
 /**
@@ -127,17 +120,21 @@ function entryFile(dir, pkg, subpath) {
 export function audit(root, dir, contribution) {
   const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'))
   // A package can hold several plugins, `<package>/<sub>/plugin`, and each answers for its own files.
-  const sub = contribution.name?.startsWith(`${pkg.name}/`) ? contribution.name.slice(pkg.name.length) : ''
+  const sub = contribution.name?.startsWith(`${pkg.name}/`)
+    ? contribution.name.slice(pkg.name.length)
+    : ''
   const roots = [entryFile(dir, pkg, `.${sub}/plugin`) ?? entryFile(dir, pkg, `.${sub}`)]
   for (const ref of contribution.manifest.provides ?? []) {
     for (const [side, { module }] of Object.entries(ref.sides ?? {})) {
       if (side === 'client') continue
-      if (module === pkg.name || module.startsWith(`${pkg.name}/`)) roots.push(entryFile(dir, pkg, `.${module.slice(pkg.name.length)}`))
-      else if (isAbsolute(module) || module.startsWith('.')) roots.push(onDisk(isAbsolute(module) ? module : resolve(root, module)))
+      if (module === pkg.name || module.startsWith(`${pkg.name}/`))
+        roots.push(entryFile(dir, pkg, `.${module.slice(pkg.name.length)}`))
+      else if (isAbsolute(module) || module.startsWith('.'))
+        roots.push(onDisk(isAbsolute(module) ? module : resolve(root, module)))
     }
   }
   const seen = new Set()
-  const queue = roots.filter(f => f && !relative(dir, f).startsWith('..'))
+  const queue = roots.filter((f) => f && !relative(dir, f).startsWith('..'))
   const uses = []
   /** @type {Set<string>} */
   const dependencies = new Set()
@@ -149,7 +146,13 @@ export function audit(root, dir, contribution) {
     for (const u of found.uses) uses.push({ ...u, file: posix(relative(dir, file)) })
     for (const name of found.imports) {
       if (!name.startsWith('.')) {
-        if (name !== pkg.name && !name.startsWith(`${pkg.name}/`)) dependencies.add(name.split('/').slice(0, name.startsWith('@') ? 2 : 1).join('/'))
+        if (name !== pkg.name && !name.startsWith(`${pkg.name}/`))
+          dependencies.add(
+            name
+              .split('/')
+              .slice(0, name.startsWith('@') ? 2 : 1)
+              .join('/'),
+          )
         continue
       }
       const next = onDisk(resolve(dirname(file), name))
@@ -158,19 +161,21 @@ export function audit(root, dir, contribution) {
   }
   const granted = grants(contribution.permissions)
   return {
-    uses: uses.sort((a, b) => a.need.localeCompare(b.need) || a.file.localeCompare(b.file) || a.line - b.line),
-    undeclared: sorted(uses.map(u => u.need).filter(need => !declared(need, granted))),
+    uses: uses.sort(
+      (a, b) => a.need.localeCompare(b.need) || a.file.localeCompare(b.file) || a.line - b.line,
+    ),
+    undeclared: sorted(uses.map((u) => u.need).filter((need) => !declared(need, granted))),
     dependencies: [...dependencies].sort(),
   }
 }
 
 /** Is `need` from the audit covered by what the plugin declared? */
 function declared(need, granted) {
-  if (need === 'env:*') return granted.some(g => g.startsWith('env:'))
+  if (need === 'env:*') return granted.some((g) => g.startsWith('env:'))
   if (need.startsWith('env:')) return granted.includes(need) || granted.includes('env:*')
   if (need === 'native') return granted.includes('native')
   const kind = { fs: 'fs.', net: 'net:', spawn: 'spawn:' }[need]
-  return granted.some(g => g.startsWith(kind))
+  return granted.some((g) => g.startsWith(kind))
 }
 
 /**
@@ -180,28 +185,62 @@ function declared(need, granted) {
  */
 export function trustStatus(root, loaded, { full = false } = {}) {
   const lock = readLock(root)
-  const plugins = loaded.contributions.map(c => {
+  const plugins = loaded.contributions.map((c) => {
     const entry = lock.plugins[c.name] ?? null
     const dir = packageDir(root, c.name)
-    const source = !dir ? 'config' : dir.split(sep).includes('node_modules') ? 'package' : 'workspace'
+    const source = !dir
+      ? 'config'
+      : dir.split(sep).includes('node_modules')
+        ? 'package'
+        : 'workspace'
     const integrity = source === 'package' ? hashPackage(dir) : null
     const permissions = grants(c.permissions)
-    const provides = sorted((c.manifest.provides ?? []).map(p => (p.key ? `${p.slot.id}[${p.key}]` : p.slot.id)))
+    const provides = sorted(
+      (c.manifest.provides ?? []).map((p) => (p.key ? `${p.slot.id}[${p.key}]` : p.slot.id)),
+    )
     // A scaffold approves permissions before there's an install to hash (`integrity: null`), and that's filled in by `approve`.
-    const changed = !!entry && (entry.integrity ?? null) !== integrity && !(entry.integrity == null && source === 'package')
-    const scanned = dir && (full || !entry || !integrity || !entry.integrity || changed) ? audit(root, dir, c) : null
+    const changed =
+      !!entry &&
+      (entry.integrity ?? null) !== integrity &&
+      !(entry.integrity == null && source === 'package')
+    const scanned =
+      dir && (full || !entry || !integrity || !entry.integrity || changed)
+        ? audit(root, dir, c)
+        : null
     const uses = scanned?.uses ?? []
     // Without a scan the lock's own record stands: those are the same files.
     const undeclared = scanned?.undeclared ?? entry?.undeclared ?? []
-    const added = permissions.filter(g => !entry?.permissions?.includes(g))
-    const removed = (entry?.permissions ?? []).filter(g => !permissions.includes(g))
-    const hidden = undeclared.filter(need => !entry?.undeclared?.includes(need))
+    const added = permissions.filter((g) => !entry?.permissions?.includes(g))
+    const removed = (entry?.permissions ?? []).filter((g) => !permissions.includes(g))
+    const hidden = undeclared.filter((need) => !entry?.undeclared?.includes(need))
     return {
-      name: c.name, version: c.version ?? null, source, integrity, permissions, provides, uses, undeclared, dependencies: scanned?.dependencies ?? [],
-      locked: !!entry, lockedVersion: entry?.version ?? null, added, removed, hidden, integrityChanged: changed, blocked: added.length > 0 || hidden.length > 0 || changed,
+      name: c.name,
+      version: c.version ?? null,
+      source,
+      integrity,
+      permissions,
+      provides,
+      uses,
+      undeclared,
+      dependencies: scanned?.dependencies ?? [],
+      locked: !!entry,
+      lockedVersion: entry?.version ?? null,
+      added,
+      removed,
+      hidden,
+      integrityChanged: changed,
+      blocked: added.length > 0 || hidden.length > 0 || changed,
     }
   })
-  return { lock: lockFile, found: lock.found, broken: lock.broken, plugins, stale: Object.keys(lock.plugins).filter(name => !plugins.some(p => p.name === name)).sort() }
+  return {
+    lock: lockFile,
+    found: lock.found,
+    broken: lock.broken,
+    plugins,
+    stale: Object.keys(lock.plugins)
+      .filter((name) => !plugins.some((p) => p.name === name))
+      .sort(),
+  }
 }
 
 /** P109 and P110 for what the lock doesn't cover. `trust: 'warn'` in the config makes them warnings. */
@@ -210,29 +249,64 @@ export function trustDiagnostics(root, loaded, status = trustStatus(root, loaded
   const rel = loaded.file ? posix(relative(root, loaded.file)) : 'weft.config.ts'
   const text = loaded.file ? readFileSync(loaded.file, 'utf8') : ''
   const out = []
-  const report = (code, name, why, help) => out.push(diagnostic({ code, severity, owner: name, file: rel, why, help, ...locate(text, name) }))
-  if (status.broken) out.push(diagnostic({ code: 'P110', severity, file: lockFile, why: `${lockFile} can't be read: ${status.broken}.`, help: 'Fix it, or delete it and approve each plugin again.' }))
+  const report = (code, name, why, help) =>
+    out.push(
+      diagnostic({ code, severity, owner: name, file: rel, why, help, ...locate(text, name) }),
+    )
+  if (status.broken)
+    out.push(
+      diagnostic({
+        code: 'P110',
+        severity,
+        file: lockFile,
+        why: `${lockFile} can't be read: ${status.broken}.`,
+        help: 'Fix it, or delete it and approve each plugin again.',
+      }),
+    )
   for (const p of status.plugins) {
     const approve = `Review it, then run \`weft plugins approve ${p.name}\`.`
-    if (p.added.length) report('P109', p.name, `\`${p.name}\` asks for permissions the lock doesn't give it: ${p.added.join(', ')}.`, approve)
-    if (p.hidden.length) report('P109', p.name, `\`${p.name}\` uses ${p.hidden.join(', ')} without declaring it (${p.uses.find(u => p.hidden.includes(u.need))?.file ?? 'see `weft plugins audit`'}).`, `Have it declared, or review it and run \`weft plugins approve ${p.name}\`.`)
-    if (p.integrityChanged) report('P110', p.name, `\`${p.name}\`${p.lockedVersion && p.lockedVersion !== p.version ? ` went from ${p.lockedVersion} to ${p.version} and its` : `'s installed`} code isn't what the lock recorded.`, `Reinstall the locked version, or review the update and run \`weft plugins approve ${p.name}\`.`)
+    if (p.added.length)
+      report(
+        'P109',
+        p.name,
+        `\`${p.name}\` asks for permissions the lock doesn't give it: ${p.added.join(', ')}.`,
+        approve,
+      )
+    if (p.hidden.length)
+      report(
+        'P109',
+        p.name,
+        `\`${p.name}\` uses ${p.hidden.join(', ')} without declaring it (${p.uses.find((u) => p.hidden.includes(u.need))?.file ?? 'see `weft plugins audit`'}).`,
+        `Have it declared, or review it and run \`weft plugins approve ${p.name}\`.`,
+      )
+    if (p.integrityChanged)
+      report(
+        'P110',
+        p.name,
+        `\`${p.name}\`${p.lockedVersion && p.lockedVersion !== p.version ? ` went from ${p.lockedVersion} to ${p.version} and its` : `'s installed`} code isn't what the lock recorded.`,
+        `Reinstall the locked version, or review the update and run \`weft plugins approve ${p.name}\`.`,
+      )
   }
   return out
 }
 
 /** Stops `weft dev` and `weft build` before a blocked plugin's build hooks run. */
 export function requireTrust(root, loaded) {
-  if (loaded.diagnostics.some(d => d.code === 'P007')) return
-  const blocked = trustDiagnostics(root, loaded).filter(d => d.severity === 'error')
-  if (blocked.length) throw refused(blocked.map(d => `${d.code} ${d.why} ${d.fix.text}`).join('\n'))
+  if (loaded.diagnostics.some((d) => d.code === 'P007')) return
+  const blocked = trustDiagnostics(root, loaded).filter((d) => d.severity === 'error')
+  if (blocked.length)
+    throw refused(blocked.map((d) => `${d.code} ${d.why} ${d.fix.text}`).join('\n'))
 }
 
 /** `weft plugins audit --json`. */
 export function auditCommand(root, loaded) {
   const status = trustStatus(root, loaded, { full: true })
   const diagnostics = trustDiagnostics(root, loaded, status)
-  return { ok: !diagnostics.some(d => d.severity === 'error'), ...status, diagnostics: [...loaded.diagnostics, ...diagnostics] }
+  return {
+    ok: !diagnostics.some((d) => d.severity === 'error'),
+    ...status,
+    diagnostics: [...loaded.diagnostics, ...diagnostics],
+  }
 }
 
 /** `.weft/` in a .gitignore hides the lock, and a lock nobody commits protects nobody. */
@@ -251,32 +325,70 @@ function unignoreLock(root) {
  * said out loud, one plugin at a time or all at once.
  */
 export function approveCommand(root, loaded, { names = [], all = false } = {}) {
-  const failed = loaded.diagnostics.find(d => d.code === 'P007')
+  const failed = loaded.diagnostics.find((d) => d.code === 'P007')
   if (failed) throw refused(`The config doesn't load, so nothing can be approved: ${failed.why}`)
   const status = trustStatus(root, loaded, { full: true })
-  if (status.broken) throw refused(`${lockFile} can't be read: ${status.broken}. Fix it, or delete it and approve each plugin again.`)
-  const pending = status.plugins.filter(p => p.blocked)
-  const unknown = names.filter(n => !status.plugins.some(p => p.name === n))
-  if (unknown.length) throw Object.assign(new Error(`not in \`plugins\`: ${unknown.join(', ')}`), { code: 'E_USAGE' })
-  if (!all && !names.length) return { ok: !pending.length, written: false, lock: lockFile, approved: [], pending, stale: status.stale }
+  if (status.broken)
+    throw refused(
+      `${lockFile} can't be read: ${status.broken}. Fix it, or delete it and approve each plugin again.`,
+    )
+  const pending = status.plugins.filter((p) => p.blocked)
+  const unknown = names.filter((n) => !status.plugins.some((p) => p.name === n))
+  if (unknown.length)
+    throw Object.assign(new Error(`not in \`plugins\`: ${unknown.join(', ')}`), { code: 'E_USAGE' })
+  if (!all && !names.length)
+    return {
+      ok: !pending.length,
+      written: false,
+      lock: lockFile,
+      approved: [],
+      pending,
+      stale: status.stale,
+    }
 
-  const chosen = status.plugins.filter(p => all || names.includes(p.name))
+  const chosen = status.plugins.filter((p) => all || names.includes(p.name))
   const entries = { ...readLock(root).plugins }
   if (all) for (const name of status.stale) delete entries[name]
-  for (const p of chosen) entries[p.name] = { version: p.version, integrity: p.integrity, permissions: p.permissions, provides: p.provides, undeclared: p.undeclared }
-  const ordered = Object.fromEntries(Object.keys(entries).sort().map(name => [name, entries[name]]))
+  for (const p of chosen)
+    entries[p.name] = {
+      version: p.version,
+      integrity: p.integrity,
+      permissions: p.permissions,
+      provides: p.provides,
+      undeclared: p.undeclared,
+    }
+  const ordered = Object.fromEntries(
+    Object.keys(entries)
+      .sort()
+      .map((name) => [name, entries[name]]),
+  )
   mkdirSync(join(root, '.weft'), { recursive: true })
-  writeFileSync(join(root, lockFile), `${JSON.stringify({ version: 1, plugins: ordered }, null, 2)}\n`)
-  return { ok: true, written: true, lock: lockFile, approved: chosen, pending: pending.filter(p => !chosen.includes(p)), stale: all ? [] : status.stale, gitignore: unignoreLock(root) }
+  writeFileSync(
+    join(root, lockFile),
+    `${JSON.stringify({ version: 1, plugins: ordered }, null, 2)}\n`,
+  )
+  return {
+    ok: true,
+    written: true,
+    lock: lockFile,
+    approved: chosen,
+    pending: pending.filter((p) => !chosen.includes(p)),
+    stale: all ? [] : status.stale,
+    gitignore: unignoreLock(root),
+  }
 }
 
 /** One line per plugin for the terminal. */
 export function formatTrust(p) {
   const parts = [
-    ...p.added.map(g => `+${g}`),
-    ...p.removed.map(g => `-${g}`),
-    ...p.hidden.map(n => `undeclared ${n}`),
-    ...(p.integrityChanged ? [`code changed${p.lockedVersion && p.lockedVersion !== p.version ? ` (${p.lockedVersion} → ${p.version})` : ''}`] : []),
+    ...p.added.map((g) => `+${g}`),
+    ...p.removed.map((g) => `-${g}`),
+    ...p.hidden.map((n) => `undeclared ${n}`),
+    ...(p.integrityChanged
+      ? [
+          `code changed${p.lockedVersion && p.lockedVersion !== p.version ? ` (${p.lockedVersion} → ${p.version})` : ''}`,
+        ]
+      : []),
   ]
   return `${p.blocked ? '!' : ' '} ${p.name}@${p.version ?? '?'}  ${parts.join('  ') || (p.locked ? 'approved' : 'not locked, asks for nothing')}`
 }

package/src/weft.mjs

@@ -9,7 +9,10 @@ const own = createRequire(import.meta.url)
 
 /** The project's own weft wins; the CLI's weft (its dev/peer dependency) is the fallback. */
 export function resolveWeft(root) {
-  const tries = [() => createRequire(join(root, 'package.json')).resolve('@weft-js/core/compiler'), () => own.resolve('@weft-js/core/compiler')]
+  const tries = [
+    () => createRequire(join(root, 'package.json')).resolve('@weft-js/core/compiler'),
+    () => own.resolve('@weft-js/core/compiler'),
+  ]
   for (const [i, attempt] of tries.entries()) {
     let path
     try {
@@ -22,7 +25,12 @@ export function resolveWeft(root) {
     const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'))
     return { from: i === 0 ? 'project' : 'cli', dir, version: pkg.version, pkg, compilerPath: path }
   }
-  throw Object.assign(new Error('weft is not installed: `@weft-js/core/compiler` resolves neither from the project nor from @weft-js/cli'), { code: 'E_NO_WEFT' })
+  throw Object.assign(
+    new Error(
+      'weft is not installed: `@weft-js/core/compiler` resolves neither from the project nor from @weft-js/cli',
+    ),
+    { code: 'E_NO_WEFT' },
+  )
 }
 
 const compilers = new Map()
@@ -34,7 +42,19 @@ export function loadCompiler(weft) {
 }
 
 /** Exported names per public subpath, read from the installed package's entry files (no execution). */
-export function exportsOf(weft, subpaths = ['.', './dom', './ssr', './test', './browser', './interaction', './style', './surface']) {
+export function exportsOf(
+  weft,
+  subpaths = [
+    '.',
+    './dom',
+    './ssr',
+    './test',
+    './browser',
+    './interaction',
+    './style',
+    './surface',
+  ],
+) {
   const out = {}
   for (const sub of subpaths) {
     const target = weft.pkg.exports?.[sub]
@@ -42,20 +62,32 @@ export function exportsOf(weft, subpaths = ['.', './dom', './ssr', './test', './
     if (!file || !/\.[mc]?[jt]sx?$/.test(file) || !existsSync(file)) continue
     /** @type {Set<string>} */
     const names = new Set()
-    const read = path => {
+    const read = (path) => {
       const sf = ts.createSourceFile(path, readFileSync(path, 'utf8'), ts.ScriptTarget.Latest, true)
       for (const node of sf.statements) {
-        const exported = ts.canHaveModifiers(node) && ts.getModifiers(node)?.some(m => m.kind === ts.SyntaxKind.ExportKeyword)
+        const exported =
+          ts.canHaveModifiers(node) &&
+          ts.getModifiers(node)?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword)
         if (ts.isExportDeclaration(node) && !node.exportClause && !node.isTypeOnly) {
           // `export * from './index'`: the `weft` entry is a thin one over the runtime.
           const next = join(dirname(path), `${node.moduleSpecifier.text}.ts`)
           if (existsSync(next)) read(next)
-        } else if (ts.isExportDeclaration(node) && node.exportClause && ts.isNamedExports(node.exportClause)) {
-          if (!node.isTypeOnly) for (const el of node.exportClause.elements) if (!el.isTypeOnly) names.add(el.name.text)
-        } else if (exported && (ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node)) && node.name) {
+        } else if (
+          ts.isExportDeclaration(node) &&
+          node.exportClause &&
+          ts.isNamedExports(node.exportClause)
+        ) {
+          if (!node.isTypeOnly)
+            for (const el of node.exportClause.elements) if (!el.isTypeOnly) names.add(el.name.text)
+        } else if (
+          exported &&
+          (ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node)) &&
+          node.name
+        ) {
           names.add(node.name.text)
         } else if (exported && ts.isVariableStatement(node)) {
-          for (const d of node.declarationList.declarations) if (ts.isIdentifier(d.name)) names.add(d.name.text)
+          for (const d of node.declarationList.declarations)
+            if (ts.isIdentifier(d.name)) names.add(d.name.text)
         }
       }
     }