@zgeoff/chex 0.0.4 → 0.0.5

package/README.md

@@ -52,14 +52,14 @@ The docs checks read the repo's READMEs, its `docs/` tree and its skills:
 
 The repo checks read the branch, the pushed commits and the repo's config:
 
-| Check              | Fails on                                                                    | Arguments       |
-| ------------------ | --------------------------------------------------------------------------- | --------------- |
-| `commits`          | a pushed commit whose message fails `@zgeoff/commitlint-config`             | `--pushed-refs` |
-| `local-paths`      | a line a pushed commit adds that holds the home folder or the host name     | `--pushed-refs` |
-| `test-timeouts`    | a `bun test` timeout above its lane's limit, in a script or a `bunfig.toml` | none            |
-| `workflows`        | nothing: it warns on each fault of the shared workflow lint, and passes     | the paths       |
-| `dependency-gates` | a stale age-gate exclude, an override or an audit ignore that nothing needs | none            |
-| `uncommitted`      | a file the branch changes that holds a change the push does not send        | none            |
+| Check              | Fails on                                                                                                                       | Arguments       |
+| ------------------ | ------------------------------------------------------------------------------------------------------------------------------ | --------------- |
+| `commits`          | a pushed commit whose message fails `@zgeoff/commitlint-config`                                                                | `--pushed-refs` |
+| `local-paths`      | a line a pushed commit adds that holds the home folder or the host name                                                        | `--pushed-refs` |
+| `test-timeouts`    | a `bun test` timeout above its lane's limit, in a script or a `bunfig.toml`                                                    | none            |
+| `workflows`        | nothing: it warns on each fault of the shared workflow lint, and passes                                                        | the paths       |
+| `dependency-gates` | a stale age-gate exclude, an override or an audit ignore that nothing needs, or a first-party package with no age-gate exclude | none            |
+| `uncommitted`      | a file the branch changes that holds a change the push does not send                                                           | none            |
 
 With no path, `prose` and `links` read every README outside `.claude/` and `.agents/`, every file
 under `docs/`, each spike's `results.md`, and the Markdown under `.agents/skills/`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/chex",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Run each shared docs and repo check as one subcommand, with the lefthook pre-push baseline that calls them",
   "keywords": [
     "checks",

package/src/dependency-gates/collect-missing-first-party-excludes.ts

@@ -0,0 +1,24 @@
+import { firstPartyScopes } from './first-party-scopes.ts';
+import type { AgeGate } from './parse-age-gate.ts';
+import type { DependencyGateFinding } from './types.ts';
+
+// An exclude with a version, such as `@zgeoff/std@1.0.0`, lets only that release through, so it
+// does not count.
+export function collectMissingFirstPartyExcludes(
+  ageGate: AgeGate,
+  registryNames: readonly string[],
+): DependencyGateFinding[] {
+  if (!ageGate.isOn) {
+    return [];
+  }
+
+  return registryNames
+    .filter((name) => firstPartyScopes.some((scope) => name.startsWith(scope)))
+    .filter((name) => !ageGate.excludes.includes(name))
+    .map((name) => ({
+      path: 'bunfig.toml',
+      entry: name,
+      problem:
+        'the first-party package has no age-gate exclude, so bun install refuses each release younger than the gate',
+    }));
+}

package/src/dependency-gates/collect-stale-age-gate-excludes.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { firstPartyScopes } from './first-party-scopes.ts';
-import { isRecord } from './is-record.ts';
+import { parseAgeGate } from './parse-age-gate.ts';
 import type { DependencyGateFinding } from './types.ts';
 
 export function collectStaleAgeGateExcludes(
@@ -9,8 +9,8 @@ export function collectStaleAgeGateExcludes(
 ): DependencyGateFinding[] {
   const removalDates = collectRemovalDates(bunfig);
 
-  return parseAgeGateExcludes(bunfig)
-    .filter((name) => !firstPartyScopes.some((scope) => name.startsWith(scope)))
+  return parseAgeGate(bunfig)
+    .excludes.filter((name) => !firstPartyScopes.some((scope) => name.startsWith(scope)))
     .flatMap((name) => {
       const removalDate = removalDates.get(name);
 
@@ -61,23 +61,3 @@ function collectRemovalDates(bunfig: string): Map<string, string> {
 
   return removalDates;
 }
-
-function parseAgeGateExcludes(bunfig: string): string[] {
-  const parsed: unknown = Bun.TOML.parse(bunfig);
-  const install = isRecord(parsed) ? parsed['install'] : undefined;
-  const excludes = isRecord(install) ? install['minimumReleaseAgeExcludes'] : undefined;
-
-  if (excludes === undefined) {
-    return [];
-  }
-
-  if (!isStringList(excludes)) {
-    throw new TypeError('bunfig.toml sets a minimumReleaseAgeExcludes that is not a list of names');
-  }
-
-  return excludes;
-}
-
-function isStringList(value: unknown): value is string[] {
-  return Array.isArray(value) && value.every((item: unknown) => typeof item === 'string');
-}

package/src/dependency-gates/first-party-scopes.ts

@@ -1 +1 @@
-export const firstPartyScopes = ['@zgeoff/', '@impz/'] as const;
+export const firstPartyScopes = ['@zgeoff/', '@impz/', '@wringer/'] as const;

package/src/dependency-gates/parse-age-gate.ts

@@ -0,0 +1,26 @@
+import { isRecord } from './is-record.ts';
+
+export interface AgeGate {
+  readonly isOn: boolean;
+  readonly excludes: readonly string[];
+}
+
+export function parseAgeGate(bunfig: string): AgeGate {
+  const parsed: unknown = Bun.TOML.parse(bunfig);
+  const install = isRecord(parsed) ? parsed['install'] : undefined;
+  const minimumReleaseAge = isRecord(install) ? install['minimumReleaseAge'] : undefined;
+  const excludes = isRecord(install) ? install['minimumReleaseAgeExcludes'] : undefined;
+
+  if (excludes !== undefined && !isStringList(excludes)) {
+    throw new TypeError('bunfig.toml sets a minimumReleaseAgeExcludes that is not a list of names');
+  }
+
+  return {
+    isOn: minimumReleaseAge !== undefined && minimumReleaseAge !== 0 && minimumReleaseAge !== '0',
+    excludes: excludes ?? [],
+  };
+}
+
+function isStringList(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((item: unknown) => typeof item === 'string');
+}

package/src/dependency-gates/parse-lockfile-registry-names.ts

@@ -0,0 +1,27 @@
+import { isRecord } from './is-record.ts';
+
+// An entry's id is `<name>@<version>`. A workspace, link, file or git entry carries a protocol in
+// its version, such as `workspace:packages/std`, and bun never puts it through the age gate.
+export function parseLockfileRegistryNames(lockfile: string): string[] {
+  const parsed: unknown = Bun.JSONC.parse(lockfile);
+  const packages = isRecord(parsed) ? parsed['packages'] : undefined;
+
+  if (!isRecord(packages)) {
+    throw new TypeError('bun.lock has no packages object');
+  }
+
+  const names = Object.values(packages).flatMap((entry) => {
+    const id: unknown = Array.isArray(entry) ? entry[0] : undefined;
+
+    if (typeof id !== 'string') {
+      throw new TypeError('bun.lock has a package entry that does not start with its id');
+    }
+
+    const versionStart = id.indexOf('@', 1);
+    const version = id.slice(versionStart + 1);
+
+    return versionStart > 0 && !version.includes(':') ? [id.slice(0, versionStart)] : [];
+  });
+
+  return [...new Set(names)].toSorted();
+}

package/src/dependency-gates/read-dependency-gate-findings.ts

@@ -1,11 +1,14 @@
 import type { RunProgram } from '../run-program.ts';
+import { collectMissingFirstPartyExcludes } from './collect-missing-first-party-excludes.ts';
 import { collectStaleAgeGateExcludes } from './collect-stale-age-gate-excludes.ts';
 import { collectUnneededAuditIgnores } from './collect-unneeded-audit-ignores.ts';
 import { collectUnneededOverrides } from './collect-unneeded-overrides.ts';
+import { parseAgeGate } from './parse-age-gate.ts';
 import { parseAuditAdvisories } from './parse-audit-advisories.ts';
 import { parseAuditIgnoreIDs } from './parse-audit-ignore-ids.ts';
 import { parseFixablePackages } from './parse-fixable-packages.ts';
 import { parseLockfileDependents } from './parse-lockfile-dependents.ts';
+import { parseLockfileRegistryNames } from './parse-lockfile-registry-names.ts';
 import type { RootManifest } from './parse-root-manifest.ts';
 import { parseRootManifest } from './parse-root-manifest.ts';
 import type { DependencyGateFinding } from './types.ts';
@@ -36,24 +39,30 @@ export function readDependencyGateFindings(
 
   const manifest = parseRootManifest(manifestText);
   const ignoreIDs = parseAuditIgnoreIDs(manifest.auditScript);
+  const bunfig = sources.readRepoFile('bunfig.toml') ?? '';
+  const lockfile = sources.readRepoFile('bun.lock');
 
   return [
-    ...collectStaleAgeGateExcludes(sources.readRepoFile('bunfig.toml') ?? '', sources.today),
-    ...readOverrideFindings(sources, manifest),
+    ...collectStaleAgeGateExcludes(bunfig, sources.today),
+    ...(lockfile === null
+      ? []
+      : collectMissingFirstPartyExcludes(
+          parseAgeGate(bunfig),
+          parseLockfileRegistryNames(lockfile),
+        )),
+    ...collectOverrideFindings(manifest, lockfile),
     ...(ignoreIDs.length === 0 ? [] : readIgnoreFindings(sources, ignoreIDs)),
   ];
 }
 
-function readOverrideFindings(
-  sources: Readonly<DependencyGateSources>,
+function collectOverrideFindings(
   manifest: RootManifest,
+  lockfile: string | null,
 ): DependencyGateFinding[] {
   if (Object.keys(manifest.overrides).length === 0) {
     return [];
   }
 
-  const lockfile = sources.readRepoFile('bun.lock');
-
   if (lockfile === null) {
     throw new Error('package.json sets overrides, and the repo has no bun.lock');
   }