@xemahq/repo-build-tooling 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM with zero dependencies so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -17,7 +17,6 @@
   },
   "type": "module",
   "files": [
-    "src",
     "README.md"
   ],
   "bin": {

package/src/scrub-swagger-plugin-paths.mjs

@@ -322,8 +322,16 @@ function reExportsReach(entry, target, depth = 6, seen = new Set()) {
  * @param {string} subpath  physical path inside the package, e.g. `dist/agent-composition/lib/x`
  * @param {string} original the full leaked specifier, for the proof and the error
  */
+// NUL is the separator in the cache key because it cannot occur in a package
+// name or a subpath, so no two distinct specifiers can collide on a
+// concatenation. It MUST stay spelled as the unicode ESCAPE, never as a raw NUL
+// byte in the source: one raw byte makes every binary-skipping search tool
+// (ugrep, ripgrep, `grep -I`) classify the WHOLE file as binary and skip it
+// silently, and a file no search can read is a file no audit, no review and no
+// boundary check covers. Enforced by the aggregator boundary gate
+// `grep-readable-sources`.
 function publicSpecifierFor(resolveFrom, pkg, subpath, original) {
-  const cacheKey = `${pkg}${subpath}`;
+  const cacheKey = `${pkg}\u0000${subpath}`;
   if (specifierCache.has(cacheKey)) return specifierCache.get(cacheKey);
 
   let target;

package/src/check-workspace-range-matches-local.test.mjs

@@ -1,54 +0,0 @@
-/**
- * The whole check rests on ONE predicate — `satisfies` — so that is what these
- * tests attack.
- *
- * The failure this guard exists to prevent is subtle in exactly one place: npm's
- * `^0.y.z` rule pins the MINOR, not the major. A `satisfies` that treats `^` as
- * "same major" uniformly would call `0.3.0` a match for `^0.2.0` and report a
- * clean scan over all 58 real violations — a check that reports green while
- * examining everything and concluding nothing. Every 0.x case below is aimed at
- * that specific wrong implementation.
- */
-import assert from 'node:assert/strict';
-import test from 'node:test';
-
-import { satisfies } from './check-workspace-range-matches-local.mjs';
-
-test('^0.y.z pins the MINOR — the rule the whole check turns on', () => {
-  // The real defect: a client moved 0.2.0 -> 0.3.0 and fell out of every
-  // consumer's range, silently dropping the build edge.
-  assert.equal(satisfies('0.3.0', '^0.2.0'), false);
-  assert.equal(satisfies('0.2.9', '^0.2.0'), true);
-  assert.equal(satisfies('0.2.0', '^0.2.1'), false); // below the floor
-  assert.equal(satisfies('1.0.0', '^0.2.0'), false);
-});
-
-test('^x.y.z (x > 0) pins the MAJOR', () => {
-  assert.equal(satisfies('1.9.3', '^1.2.0'), true);
-  assert.equal(satisfies('2.0.0', '^1.2.0'), false);
-  assert.equal(satisfies('1.1.0', '^1.2.0'), false); // below the floor
-});
-
-test('~ pins the minor at every major', () => {
-  assert.equal(satisfies('1.2.9', '~1.2.0'), true);
-  assert.equal(satisfies('1.3.0', '~1.2.0'), false);
-  assert.equal(satisfies('0.2.9', '~0.2.0'), true);
-  assert.equal(satisfies('0.3.0', '~0.2.0'), false);
-});
-
-test('>= is a floor with no ceiling', () => {
-  assert.equal(satisfies('7.5.0', '>=0.14.0'), true);
-  assert.equal(satisfies('0.13.0', '>=0.14.0'), false);
-});
-
-test('an exact range means exactly that version', () => {
-  assert.equal(satisfies('1.2.3', '1.2.3'), true);
-  assert.equal(satisfies('1.2.4', '1.2.3'), false);
-});
-
-test('a prerelease is compared on its release part, never string-wise', () => {
-  // `0.3.0-rc.1` must not read as "less than 0.3.0 therefore outside ^0.2.0
-  // is fine" — the range check has to reach the same verdict as `0.3.0`.
-  assert.equal(satisfies('0.3.0-rc.1', '^0.2.0'), false);
-  assert.equal(satisfies('0.2.5-rc.1', '^0.2.0'), true);
-});