@xemahq/repo-build-tooling 0.2.1 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM with zero dependencies so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -17,7 +17,6 @@
   },
   "type": "module",
   "files": [
-    "src",
     "README.md"
   ],
   "bin": {

package/src/check-workspace-range-matches-local.mjs

@@ -29,7 +29,7 @@
 // examined.
 // ═══════════════════════════════════════════════════════════════════════════
 import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { join, relative } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
@@ -173,6 +173,42 @@ function main() {
 
 // Importing this module must not run the scan — the test suite imports it for
 // `satisfies` alone.
-if (import.meta.url === pathToFileURL(process.argv[1] ?? '.').href) {
+//
+// COMPARE REALPATHS. `import.meta.url` is the RESOLVED path of this file;
+// `process.argv[1]` is the path the shell was handed. Inside the xema-monorepo
+// aggregator those are different strings for the same file, because
+// `node_modules/@xemahq/repo-build-tooling` is a symlink into the workspace and
+// pnpm's bin shim execs THROUGH it:
+//
+//   argv[1]  …/node_modules/@xemahq/repo-build-tooling/src/check-…mjs
+//   resolved …/repos/xema-runtime-core/packages/sdks/repo-build-tooling/src/check-…mjs
+//
+// So the guard was false, `main()` never ran, and the bin printed NOTHING and
+// exited 0 — the check reporting green while executing nothing, which is this
+// fleet's most-repeated defect and the one it has the most machinery against.
+//
+// Measured 2026-08-21: `repos/xema-biome-sdk` carried two `workspace:^6.1.0`
+// declarations against a local `@xemahq/biome-sdk@7.0.0` — the exact dropped
+// build edge this file exists to catch, and a range pnpm refuses outright with
+// ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE. `xema-check-workspace-ranges`
+// exited 0 in silence; the same file run by its real path exited 1 and named
+// both. Every carved repo's `pnpm check` and every pre-push hook in this
+// checkout invoked it the silent way.
+//
+// A carved repo's own CI installs the PUBLISHED tarball, so there argv[1] is
+// already a real path and the guard held. That is why the hole survived: it is
+// invisible in exactly the lane people point at as proof.
+const invokedPath = process.argv[1];
+let invokedRealPath = null;
+if (typeof invokedPath === 'string' && invokedPath.length > 0) {
+  try {
+    invokedRealPath = realpathSync(invokedPath);
+  } catch {
+    // Not a path on disk (a `node -e` entry, say). Nothing was invoked, so
+    // nothing should run — fall through as a plain import.
+    invokedRealPath = null;
+  }
+}
+if (invokedRealPath !== null && import.meta.url === pathToFileURL(invokedRealPath).href) {
   process.exit(main());
 }

package/src/scrub-swagger-plugin-paths.mjs

@@ -303,7 +303,6 @@ function reExportsReach(entry, target, depth = 6, seen = new Set()) {
   } catch {
     return false;
   }
-  const dir = dirname(entry);
   for (const m of src.matchAll(/require\("(\.[^"]*)"\)/g)) {
     let next;
     try {
@@ -499,7 +498,7 @@ async function assertScannable(dir) {
   }
   if (!s.isDirectory()) throw new ScrubFailure(`not a directory: ${dir}`);
 
-  for await (const _file of walk(dir)) return; // eslint-disable-line no-unused-vars
+  for await (const _file of walk(dir)) return;
   throw new ScrubFailure(
     `output directory holds no compiled .js: ${dir}\n` +
       `  Same failure as a missing directory: nothing was scrubbed and nothing was verified.`,

package/src/check-workspace-range-matches-local.test.mjs

@@ -1,54 +0,0 @@
-/**
- * The whole check rests on ONE predicate — `satisfies` — so that is what these
- * tests attack.
- *
- * The failure this guard exists to prevent is subtle in exactly one place: npm's
- * `^0.y.z` rule pins the MINOR, not the major. A `satisfies` that treats `^` as
- * "same major" uniformly would call `0.3.0` a match for `^0.2.0` and report a
- * clean scan over all 58 real violations — a check that reports green while
- * examining everything and concluding nothing. Every 0.x case below is aimed at
- * that specific wrong implementation.
- */
-import assert from 'node:assert/strict';
-import test from 'node:test';
-
-import { satisfies } from './check-workspace-range-matches-local.mjs';
-
-test('^0.y.z pins the MINOR — the rule the whole check turns on', () => {
-  // The real defect: a client moved 0.2.0 -> 0.3.0 and fell out of every
-  // consumer's range, silently dropping the build edge.
-  assert.equal(satisfies('0.3.0', '^0.2.0'), false);
-  assert.equal(satisfies('0.2.9', '^0.2.0'), true);
-  assert.equal(satisfies('0.2.0', '^0.2.1'), false); // below the floor
-  assert.equal(satisfies('1.0.0', '^0.2.0'), false);
-});
-
-test('^x.y.z (x > 0) pins the MAJOR', () => {
-  assert.equal(satisfies('1.9.3', '^1.2.0'), true);
-  assert.equal(satisfies('2.0.0', '^1.2.0'), false);
-  assert.equal(satisfies('1.1.0', '^1.2.0'), false); // below the floor
-});
-
-test('~ pins the minor at every major', () => {
-  assert.equal(satisfies('1.2.9', '~1.2.0'), true);
-  assert.equal(satisfies('1.3.0', '~1.2.0'), false);
-  assert.equal(satisfies('0.2.9', '~0.2.0'), true);
-  assert.equal(satisfies('0.3.0', '~0.2.0'), false);
-});
-
-test('>= is a floor with no ceiling', () => {
-  assert.equal(satisfies('7.5.0', '>=0.14.0'), true);
-  assert.equal(satisfies('0.13.0', '>=0.14.0'), false);
-});
-
-test('an exact range means exactly that version', () => {
-  assert.equal(satisfies('1.2.3', '1.2.3'), true);
-  assert.equal(satisfies('1.2.4', '1.2.3'), false);
-});
-
-test('a prerelease is compared on its release part, never string-wise', () => {
-  // `0.3.0-rc.1` must not read as "less than 0.3.0 therefore outside ^0.2.0
-  // is fine" — the range check has to reach the same verdict as `0.3.0`.
-  assert.equal(satisfies('0.3.0-rc.1', '^0.2.0'), false);
-  assert.equal(satisfies('0.2.5-rc.1', '^0.2.0'), true);
-});