create-ailk 0.23.0 → 0.24.0

package/templates/tools/lint-architecture.ts

@@ -13,7 +13,17 @@
  *   - the global and per-app `forbidden_patterns` (with `paths_excluded`);
  *   - the `namespaces` boundaries inside `database/`, when declared:
  *     cross-namespace relative imports and cross-namespace Prisma `@relation`
- *     directives.
+ *     directives;
+ *   - the `upgradeable_consumer` rules, when declared — this site builds on
+ *     the published `@working-theory/*` packages and never forks them:
+ *     every `pnpm-workspace.yaml` glob is inside the declared `workspaces`;
+ *     no `package.json` outside `node_modules` takes an in-scope name the
+ *     scaffold did not create (`scaffold_packages`); no `patchedDependencies`
+ *     entry (root `package.json` `pnpm` block or `pnpm-workspace.yaml`)
+ *     patches an in-scope package; and every declaration of one in-scope
+ *     package (dependencies, devDependencies, peerDependencies,
+ *     optionalDependencies, `pnpm.overrides`, `resolutions`, workspace
+ *     `overrides`) uses the same caret range.
  *
  * An import target is checked only when it is a workspace present in this
  * repo (`apps/*`, `database`); `@working-theory/*` libraries install from npm
@@ -45,10 +55,17 @@ interface AppRule {
   forbidden_patterns?: ForbiddenPattern[];
 }
 
+interface UpgradeableConsumer {
+  package_scope?: string;
+  workspaces?: string[];
+  scaffold_packages?: string[];
+}
+
 interface ArchConfig {
   apps?: Record<string, AppRule>;
   forbidden_patterns?: ForbiddenPattern[];
   namespaces?: { members?: Record<string, { path: string }> };
+  upgradeable_consumer?: UpgradeableConsumer;
 }
 
 interface Violation {
@@ -60,6 +77,9 @@ interface Violation {
 
 const ROOT = resolve(dirname(process.argv[1] ?? "."), "..");
 const SKIP_DIRS = new Set([
+  ".git",
+  ".pnpm-store",
+  ".vercel",
   "node_modules",
   "dist",
   ".next",
@@ -266,6 +286,189 @@ function checkNamespaces(cfg: ArchConfig): Violation[] {
   return out;
 }
 
+// ── Upgradeable consumer (#9191) ─────────────────────────────────────────
+//
+// A copied, patched or pinned-off package stops taking upstream fixes, and
+// whoever made the copy believes it is harmless. These rules refuse each form.
+
+interface PackageJson {
+  name?: unknown;
+  pnpm?: { patchedDependencies?: unknown; overrides?: unknown };
+  resolutions?: unknown;
+  [field: string]: unknown;
+}
+
+interface Declaration {
+  file: string;
+  line: number;
+  name: string;
+  range: string;
+  field: string;
+}
+
+const DEP_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies",
+] as const;
+const CARET_RANGE = /^\^\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?$/;
+
+/** The 1-based line of the first line containing `needle`, else 1. */
+function lineOfText(text: string, needle: string): number {
+  const i = text.split("\n").findIndex((line) => line.includes(needle));
+  return i === -1 ? 1 : i + 1;
+}
+
+/**
+ * The 1-based line of `key` as a map key at or after the first line holding
+ * `section` (a field label), so a package declared in two fields of one file
+ * reports each at its own line. Falls back to the first mention of `key`.
+ */
+function lineOfKey(text: string, section: string, key: string): number {
+  const lines = text.split("\n");
+  const start = Math.max(0, lines.findIndex((line) => line.includes(section)));
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const keyRe = new RegExp(`(?:^|[\\s{,])["']?${escaped}["']?\\s*:`);
+  const i = lines.findIndex((line, n) => n >= start && keyRe.test(line));
+  return i === -1 ? lineOfText(text, key) : i + 1;
+}
+
+/** A map-valued field as string entries, or none. */
+function stringEntries(value: unknown): [string, string][] {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return [];
+  return Object.entries(value).filter(
+    (e): e is [string, string] => typeof e[1] === "string",
+  );
+}
+
+/** A patch or override key (`@s/p@1.2.3`, `a>@s/p@^1`) → the package it targets. */
+function packageOfKey(key: string): string {
+  const target = key.slice(key.lastIndexOf(">") + 1);
+  const at = target.lastIndexOf("@");
+  return at > 0 ? target.slice(0, at) : target;
+}
+
+/** True when `glob` reaches nothing outside one of the `allowed` workspace globs. */
+function insideWorkspaces(glob: string, allowed: string[]): boolean {
+  const g = glob.replace(/^\.\//, "").replace(/\/$/, "");
+  return allowed.some((a) => {
+    if (g === a) return true;
+    if (!a.endsWith("/*")) return false;
+    const prefix = a.slice(0, -1);
+    const rest = g.slice(prefix.length);
+    return g.startsWith(prefix) && rest !== "" && !rest.includes("/") && !rest.includes("**");
+  });
+}
+
+function checkUpgradeableConsumer(cfg: ArchConfig): Violation[] {
+  const uc = cfg.upgradeable_consumer;
+  if (!uc) return [];
+  const scope = uc.package_scope ?? "@working-theory/";
+  const workspaces = uc.workspaces ?? [];
+  const created = new Set(uc.scaffold_packages ?? []);
+  const inScope = (name: string) => name.startsWith(scope);
+  const out: Violation[] = [];
+  const decls: Declaration[] = [];
+
+  const patches = (file: string, text: string, value: unknown) => {
+    for (const [key] of stringEntries(value)) {
+      if (!inScope(packageOfKey(key))) continue;
+      out.push({
+        file,
+        line: lineOfKey(text, "patchedDependencies", key),
+        rule: `patchedDependencies patches "${key}"`,
+        reason:
+          "Fix: remove the patch — a patched package stops taking upstream fixes. Wrap or configure it from your app, or report the defect upstream.",
+      });
+    }
+  };
+  const declare = (file: string, text: string, field: string, value: unknown, byKey: boolean) => {
+    for (const [key, range] of stringEntries(value)) {
+      const name = byKey ? packageOfKey(key) : key;
+      if (!inScope(name)) continue;
+      // A scaffold's own workspace may be linked locally; anything else may not.
+      if (created.has(name) && range.startsWith("workspace:")) continue;
+      const line = lineOfKey(text, field.slice(field.lastIndexOf(".") + 1), key);
+      decls.push({ file, line, name, range, field });
+    }
+  };
+
+  const wsPath = join(ROOT, "pnpm-workspace.yaml");
+  if (existsSync(wsPath)) {
+    const text = readFileSync(wsPath, "utf8");
+    const ws = (parseYaml(text) ?? {}) as {
+      packages?: unknown;
+      patchedDependencies?: unknown;
+      overrides?: unknown;
+    };
+    for (const glob of Array.isArray(ws.packages) ? ws.packages : []) {
+      if (typeof glob !== "string" || glob.startsWith("!")) continue;
+      if (insideWorkspaces(glob, workspaces)) continue;
+      out.push({
+        file: wsPath,
+        line: lineOfText(text, glob),
+        rule: `workspace glob "${glob}" is outside this site's workspaces (${workspaces.join(", ")})`,
+        reason: `Fix: remove it. A site consumes ${scope}* from npm — compose, wrap or configure the published package from an app instead of keeping a local package tree.`,
+      });
+    }
+    patches(wsPath, text, ws.patchedDependencies);
+    declare(wsPath, text, "overrides", ws.overrides, true);
+  }
+
+  for (const file of walk(ROOT, /^package\.json$/)) {
+    const text = readFileSync(file, "utf8");
+    let pkg: PackageJson;
+    try {
+      pkg = JSON.parse(text) as PackageJson;
+    } catch {
+      continue; // pnpm itself refuses an unparseable manifest
+    }
+    if (typeof pkg.name === "string" && inScope(pkg.name) && !created.has(pkg.name)) {
+      out.push({
+        file,
+        line: lineOfText(text, `"${pkg.name}"`),
+        rule: `local package named "${pkg.name}" — not a package this scaffold created (${[...created].join(", ")})`,
+        reason: `Fix: delete the local copy and depend on the published ${pkg.name}; build on it by composing, wrapping or configuring it through its documented extension points — never copy it out of node_modules.`,
+      });
+    }
+    for (const field of DEP_FIELDS) declare(file, text, field, pkg[field], false);
+    declare(file, text, "pnpm.overrides", pkg.pnpm?.overrides, true);
+    declare(file, text, "resolutions", pkg.resolutions, true);
+    patches(file, text, pkg.pnpm?.patchedDependencies);
+  }
+
+  const byName = new Map<string, Declaration[]>();
+  for (const d of decls) {
+    if (!CARET_RANGE.test(d.range)) {
+      const example = /^\d/.test(d.range) ? `^${d.range}` : "^<version>";
+      out.push({
+        file: d.file,
+        line: d.line,
+        rule: `${d.name} is "${d.range}" in ${d.field}, not a caret range`,
+        reason: `Fix: declare it as a caret range (e.g. "${example}") so upgrades flow; never pin it, link it or point it at a local copy.`,
+      });
+      continue;
+    }
+    const list = byName.get(d.name) ?? [];
+    list.push(d);
+    byName.set(d.name, list);
+  }
+  for (const [name, list] of byName) {
+    if (new Set(list.map((d) => d.range)).size < 2) continue;
+    const where = list.map((d) => `${rel(d.file)} ${d.field} "${d.range}"`).join(", ");
+    for (const d of list) {
+      out.push({
+        file: d.file,
+        line: d.line,
+        rule: `${name} is declared on different ranges: ${where}`,
+        reason: `Fix: align every declaration of ${name} on one caret range.`,
+      });
+    }
+  }
+  return out;
+}
+
 function main(): void {
   const yamlPath = join(ROOT, "architecture.yaml");
   if (!existsSync(yamlPath)) {
@@ -297,6 +500,7 @@ function main(): void {
     }
   }
   violations.push(...checkNamespaces(cfg));
+  violations.push(...checkUpgradeableConsumer(cfg));
 
   if (violations.length === 0) {
     console.log("architecture: OK");

package/versions.json

@@ -1,53 +1,53 @@
 {
-  "@working-theory/admin-ui": "0.44.0",
-  "@working-theory/aeo": "0.44.0",
-  "@working-theory/agent-context": "0.44.0",
+  "@working-theory/admin-ui": "0.45.0",
+  "@working-theory/aeo": "0.45.0",
+  "@working-theory/agent-context": "0.45.0",
   "@working-theory/agent-contract": "0.1.0",
   "@working-theory/agent-memory": "0.0.0",
   "@working-theory/ai": "0.1.0",
-  "@working-theory/analytics": "0.44.0",
-  "@working-theory/api-client": "0.44.0",
+  "@working-theory/analytics": "0.45.0",
+  "@working-theory/api-client": "0.45.0",
   "@working-theory/cda-filesystem": "0.0.0",
-  "@working-theory/cli": "0.44.0",
-  "@working-theory/common": "0.44.0",
+  "@working-theory/cli": "0.45.0",
+  "@working-theory/common": "0.45.0",
   "@working-theory/consent": "0.1.0",
-  "@working-theory/content-adapters": "0.44.0",
-  "@working-theory/content-projection": "0.44.0",
-  "@working-theory/email": "0.44.0",
+  "@working-theory/content-adapters": "0.45.0",
+  "@working-theory/content-projection": "0.45.0",
+  "@working-theory/email": "0.45.0",
   "@working-theory/env": "0.0.0",
-  "@working-theory/eslint-config": "0.44.0",
-  "@working-theory/fumadocs-schema": "0.44.0",
+  "@working-theory/eslint-config": "0.45.0",
+  "@working-theory/fumadocs-schema": "0.45.0",
   "@working-theory/ids": "0.15.0",
-  "@working-theory/jsonld": "0.44.0",
-  "@working-theory/license": "0.44.0",
-  "@working-theory/metadata": "0.44.0",
-  "@working-theory/observability": "0.44.0",
-  "@working-theory/page-renderer": "0.44.0",
+  "@working-theory/jsonld": "0.45.0",
+  "@working-theory/license": "0.45.0",
+  "@working-theory/metadata": "0.45.0",
+  "@working-theory/observability": "0.45.0",
+  "@working-theory/page-renderer": "0.45.0",
   "@working-theory/plugin-mcp": "0.1.3",
-  "@working-theory/schema": "0.44.0",
-  "@working-theory/schema-pack-registry": "0.44.0",
-  "@working-theory/schema-validator": "0.44.0",
-  "@working-theory/sections-registry": "0.44.0",
-  "@working-theory/site-config": "0.44.0",
-  "@working-theory/spoke-checkout": "0.7.0",
-  "@working-theory/stripe-client": "0.44.0",
-  "@working-theory/templates": "0.44.0",
-  "@working-theory/theme": "0.44.0",
-  "@working-theory/ui": "0.44.0",
-  "@working-theory/validation": "0.44.0",
-  "@working-theory/web-i18n": "0.44.0",
+  "@working-theory/schema": "0.45.0",
+  "@working-theory/schema-pack-registry": "0.45.0",
+  "@working-theory/schema-validator": "0.45.0",
+  "@working-theory/sections-registry": "0.45.0",
+  "@working-theory/site-config": "0.45.0",
+  "@working-theory/spoke-checkout": "0.7.1",
+  "@working-theory/stripe-client": "0.45.0",
+  "@working-theory/templates": "0.45.0",
+  "@working-theory/theme": "0.45.0",
+  "@working-theory/ui": "0.45.0",
+  "@working-theory/validation": "0.45.0",
+  "@working-theory/web-i18n": "0.45.0",
   "@working-theory/billing-client": "0.0.0",
   "@working-theory/branding": "0.0.0",
   "@working-theory/license-client": "0.0.0",
   "@working-theory/license-manifest": "0.0.0",
   "@working-theory/partner-session": "0.0.0",
   "@working-theory/preview-protocol": "0.0.0",
-  "@working-theory/ui-commerce": "0.23.22",
-  "@working-theory/ui-docs-blog": "0.23.22",
-  "@working-theory/ui-scheduling": "0.24.2",
-  "@working-theory/ui-signal-collectors": "0.27.0",
+  "@working-theory/ui-commerce": "0.23.23",
+  "@working-theory/ui-docs-blog": "0.23.23",
+  "@working-theory/ui-scheduling": "0.24.3",
+  "@working-theory/ui-signal-collectors": "0.27.1",
   "@working-theory/web": "0.0.0",
   "@working-theory/api": "1.0.0",
   "@working-theory/mcp": "0.0.0",
-  "@working-theory/database": "0.44.0"
+  "@working-theory/database": "0.45.0"
 }

package/templates/apps/api/src/routes/content/slug.ts

@@ -1,9 +0,0 @@
-/**
- * Slug allowlist for D14a content-write routes.
- *
- * Re-exported from `@working-theory/content-adapters` (single source of truth, per
- * issue #398). The adapter sanitizes slug + type before any path
- * construction or git argument; this regex is the route-layer fail-fast
- * mirror so malformed input gets a 400 before reaching the adapter.
- */
-export { SLUG_PATTERN } from "@working-theory/content-adapters";