@xylabs/ts-scripts-yarn3 7.5.11 → 7.5.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xylabs/ts-scripts-yarn3",
-  "version": "7.5.11",
+  "version": "7.5.13",
   "description": "TypeScript project scripts",
   "keywords": [
     "xylabs",
@@ -49,16 +49,18 @@
     "yargs": "~18.0.0"
   },
   "devDependencies": {
+    "@types/node": "^25.5.0",
     "@types/yargs": "~17.0.35",
-    "@xylabs/ts-scripts-common": "~7.5.11",
-    "@xylabs/tsconfig": "~7.5.11",
+    "@xylabs/ts-scripts-common": "~7.5.13",
+    "@xylabs/tsconfig": "~7.5.13",
     "publint": "~0.3.18",
     "tsup": "~8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.1"
+    "vite": "^8.0.3",
+    "vitest": "^4.1.2"
   },
   "peerDependencies": {
-    "@xylabs/ts-scripts-common": "~7.5.11",
+    "@xylabs/ts-scripts-common": "~7.5.13",
     "typescript": "~5"
   },
   "engines": {

package/templates/claude/skills/xylabs-xy-deplint-fix/SKILL.md

@@ -125,8 +125,12 @@ classified error:
 * **Add dep**: insert the entry with the correct version into the appropriate section.
   Resolve the version using this priority order:
 
-  1. **Lock file** (preferred) — search `yarn.lock` or `pnpm-lock.yaml` for the
-     package name. Use the resolved version already present in the repo.
+  1. **Workspace package** (highest priority) — check the `WORKSPACE:name:version` lines
+     emitted at the top of `deplint-scan.sh` output. If the dep name appears there, read
+     its version directly from that line and prefix with `~` (e.g. `5.3.7` → `~5.3.7`).
+     Never use the `workspace:` protocol — use the real semver version from the package.
+
+  2. **Lock file** — for deps not in the workspace, search `yarn.lock` or `pnpm-lock.yaml`.
      * In `yarn.lock`, look for a block starting with `"<pkg>@`:
        ```
        "@xyo-network/payload-model@npm:~5.3.5":
@@ -136,11 +140,11 @@ classified error:
      * In `pnpm-lock.yaml`, find the entry under `packages:` and use its
        specifier (e.g. `~5.3.5`).
 
-  2. **Another package.json in the repo** — if the lock file entry is unclear,
+  3. **Another package.json in the repo** — if the lock file entry is unclear,
      grep other `package.json` files in the monorepo for the dep name and
      copy the version string used there.
 
-  3. **Latest from the registry** — if the dep does not exist anywhere in the
+  4. **Latest from the registry** — if the dep does not exist anywhere in the
      repo yet, it is safe to use `~latest` by running:
      ```bash
      npm view <package-name> version

package/templates/claude/skills/xylabs-xy-deplint-fix/scripts/deplint-install.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# deplint-install.sh
+#
+# Runs a full package install from the repo root using the detected package manager.
+# Always installs from root — never uses scoped/filtered installs (yarn workspaces focus,
+# pnpm --filter) as those strip the root xy script bindings needed for verification.
+set -euo pipefail
+
+find_repo_root() {
+  local dir="$PWD"
+  while [[ "$dir" != "/" ]]; do
+    [[ -f "$dir/yarn.lock" || -f "$dir/pnpm-lock.yaml" ]] && echo "$dir" && return
+    dir="$(dirname "$dir")"
+  done
+  echo "ERROR: repo root not found (no yarn.lock or pnpm-lock.yaml)" >&2
+  exit 1
+}
+
+REPO_ROOT="$(find_repo_root)"
+cd "$REPO_ROOT"
+
+# pnpm takes precedence over yarn — repos mid-migration may have both lock files
+if [[ -f pnpm-lock.yaml ]]; then
+  pnpm install
+else
+  yarn install
+fi

package/templates/claude/skills/xylabs-xy-deplint-fix/scripts/deplint-scan.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# deplint-scan.sh [package-name]
+#
+# Emits:
+#   WORKSPACE:name:version   — for every non-root package in the monorepo
+#   PACKAGE:name             — for each package with deplint errors
+#   ERROR:description:dep    — for each error within that package
+#   PATH:path/to/package.json
+#   STATUS:clean|errors
+#
+# Usage:
+#   bash deplint-scan.sh                          # whole-repo scan
+#   bash deplint-scan.sh @scope/package-name      # single-package scan
+set -euo pipefail
+
+find_repo_root() {
+  local dir="$PWD"
+  while [[ "$dir" != "/" ]]; do
+    [[ -f "$dir/yarn.lock" || -f "$dir/pnpm-lock.yaml" ]] && echo "$dir" && return
+    dir="$(dirname "$dir")"
+  done
+  echo "ERROR: repo root not found (no yarn.lock or pnpm-lock.yaml)" >&2
+  exit 1
+}
+
+REPO_ROOT="$(find_repo_root)"
+cd "$REPO_ROOT"
+
+# pnpm takes precedence over yarn — repos mid-migration may have both lock files
+if [[ -f pnpm-lock.yaml ]]; then PM=pnpm; else PM=yarn; fi
+
+# Emit WORKSPACE:name:version for every non-root package in the monorepo.
+# Used by Step 3 to resolve versions for workspace-local deps without using
+# the workspace: protocol (which npm publish does not rewrite).
+find "$REPO_ROOT" -name "package.json" \
+  -not -path "*/node_modules/*" \
+  -not -path "$REPO_ROOT/package.json" | sort | \
+node -e "
+  const fs = require('fs');
+  const rl = require('readline').createInterface({ input: process.stdin });
+  rl.on('line', f => {
+    try {
+      const p = JSON.parse(fs.readFileSync(f.trim(), 'utf8'));
+      if (p.name && p.version) process.stdout.write('WORKSPACE:' + p.name + ':' + p.version + '\n');
+    } catch(e) {}
+  });
+" || true
+
+# Run deplint — exits non-zero when errors are found, so capture output regardless
+if [[ -n "${1:-}" ]]; then
+  deplint_out="$($PM xy deplint "$1" 2>&1)" || true
+else
+  deplint_out="$($PM xy deplint 2>&1)" || true
+fi
+
+# Parse deplint output into structured lines
+current_pkg=""
+while IFS= read -r line; do
+  if [[ "$line" =~ ^\[([^]]+)\]\ (.+):\ (.+)$ ]]; then
+    pkg="${BASH_REMATCH[1]}"
+    if [[ "$pkg" != "$current_pkg" ]]; then
+      current_pkg="$pkg"
+      echo "PACKAGE:$pkg"
+    fi
+    echo "ERROR:${BASH_REMATCH[2]}:${BASH_REMATCH[3]}"
+  elif [[ "$line" =~ ^[[:space:]]+(.+package\.json)$ ]]; then
+    echo "PATH:${BASH_REMATCH[1]}"
+  fi
+done <<< "$deplint_out"
+
+if echo "$deplint_out" | grep -q "Found no dependency problems"; then
+  echo "STATUS:clean"
+else
+  echo "STATUS:errors"
+fi

package/templates/claude/skills/xylabs-xy-deplint-fix/scripts/deplint-verify.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# deplint-verify.sh <package-name> [package-name ...]
+#
+# Verifies one or more packages pass deplint in a single approved call.
+# Emits:
+#   PASS:name   — package has no deplint errors
+#   FAIL:name   — package still has deplint errors (details follow indented)
+#
+# Exits 0 only if every package passes.
+set -euo pipefail
+
+if [[ $# -eq 0 ]]; then
+  echo "Usage: deplint-verify.sh <package-name> [package-name ...]" >&2
+  exit 1
+fi
+
+find_repo_root() {
+  local dir="$PWD"
+  while [[ "$dir" != "/" ]]; do
+    [[ -f "$dir/yarn.lock" || -f "$dir/pnpm-lock.yaml" ]] && echo "$dir" && return
+    dir="$(dirname "$dir")"
+  done
+  echo "ERROR: repo root not found (no yarn.lock or pnpm-lock.yaml)" >&2
+  exit 1
+}
+
+REPO_ROOT="$(find_repo_root)"
+cd "$REPO_ROOT"
+
+# pnpm takes precedence over yarn — repos mid-migration may have both lock files
+if [[ -f pnpm-lock.yaml ]]; then PM=pnpm; else PM=yarn; fi
+
+all_passed=true
+
+for pkg in "$@"; do
+  output="$($PM xy deplint "$pkg" 2>&1)" || true
+  if echo "$output" | grep -q "Found no dependency problems"; then
+    echo "PASS:$pkg"
+  else
+    echo "FAIL:$pkg"
+    echo "$output" | grep -E "^\[|^[[:space:]]" | sed 's/^/  /' || true
+    all_passed=false
+  fi
+done
+
+$all_passed || exit 1