cursedops 0.5.2 → 0.5.3

package/README.md

@@ -176,8 +176,13 @@ after `%h/` or `$HOME/` — never the generation's name.
 ```jsonc
 "paths": "forge-paths"                                 // check-paths + check-doc-citations
 "paths": "forge-paths --also check-gate-graph.ts"      // cursedbelt's extra law, as an OPTION
+"gate":  "forge-paths --only gate.ts"                  // 0.5.3: the shared gate runner, and ONLY it
 ```
 
+`--only <law>` (0.5.3, task 474) replaces the default laws instead of adding to them, so a repo's
+`gate` reaches `$FORGE/tools/gate.ts` through the same walk without running `check-paths` a
+second time or handing it `--force`. A law it names that is missing from `tools/` exits 1.
+
 Rule 1, eighteen times: `scripts/paths.ts` was in every app, `autopilot` and every library,
 sixteen byte-identical and three already forked (`cursedbelt` +`check-gate-graph.ts`, `station`
 +`check-no-clock.ts`, `autopilot` split into its own `generation.ts`). `check-copies` prices
@@ -185,7 +190,7 @@ exported definitions and this file exports nothing, so eighteen copies read as z
 wrapper exists because `bun ../../tools/check-paths.ts .` died on its first step in every
 worktree (2026-09-17). The walk and the worktree follow-back are the copies' own; **no
 generation is still no pass** — a lone clone exits 1 saying which walk came back empty. Every
-argument that is not `--also` passes through to the laws (`bun run paths --prune`).
+argument that is not `--also`/`--only` passes through to the laws (`bun run paths --prune`).
 
 🔴 **Until the roster rule can read the bin, the wrapper is two lines that NAME the laws.**
 `check-doc-citations`' `pathsRunsThis` proves a repo runs it by reading the `paths` command or

package/package.json

@@ -1,15 +1,16 @@
 {
 	"name": "cursedops",
-	"version": "0.5.2",
+	"version": "0.5.3",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof), and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {
 		"typecheck": "tsc -p tsconfig.json --noEmit",
-		"lint": "biome check .",
-		"test": "bun test src",
+		"lint": "biome check --error-on-warnings .",
+		"test": "bun test --timeout 60000 --parallel=4 src",
 		"paths": "bun run scripts/paths.ts",
-		"verify": "bun run paths && bun run typecheck && bun run lint && bun run test",
-		"prepublishOnly": "bun run verify"
+		"verify": "bun run gate",
+		"prepublishOnly": "bun run gate --force",
+		"gate": "bun src/paths.ts --only gate.ts"
 	},
 	"exports": {
 		"./roots": {
@@ -122,5 +123,21 @@
 	"publishConfig": {
 		"access": "public"
 	},
-	"license": "MIT"
+	"license": "MIT",
+	"gate": {
+		"stages": [
+			{
+				"script": "paths"
+			},
+			{
+				"script": "typecheck"
+			},
+			{
+				"script": "lint"
+			},
+			{
+				"script": "test"
+			}
+		]
+	}
 }

package/src/paths.ts

@@ -7,6 +7,7 @@
  * // package.json — the whole wiring; no scripts/paths.ts at all
  * "paths": "forge-paths"                                  // check-paths + check-doc-citations
  * "paths": "forge-paths --also check-gate-graph.ts"       // cursedbelt's extra law, as an OPTION
+ * "gate":  "forge-paths --only gate.ts"                   // ONE tool, never the defaults
  * ```
  *
  * ```ts
@@ -150,24 +151,41 @@ export function runGenerationLaws(from: string, options: LawsOptions = {}): numb
 }
 
 /**
- * The bin's arguments: `--also <law>` / `--also=<law>` (repeatable) are this wrapper's; every
- * other argument goes through to the laws untouched, so `bun run paths --prune` still prunes.
+ * The bin's arguments: `--also <law>` and `--only <law>` (both repeatable, both also spelled
+ * `--flag=<law>`) are this wrapper's; every other argument goes through to the laws untouched,
+ * so `bun run paths --prune` still prunes and `bun run gate --force` still forces.
+ *
+ * 🔴 `--only` REPLACES {@link DEFAULT_LAWS}, it does not add to them. It exists for
+ * `"gate": "forge-paths --only gate.ts"` — the generation's shared gate runner, located the same
+ * way the laws are (task 474, 2026-09-23). Twelve apps had grown the same flag in their copied
+ * `scripts/paths.ts` rather than copy a thirteenth wrapper; this is the one place it lives now.
+ * A gate that ran `check-paths` before scheduling its own `paths` stage would run it twice, and
+ * would pass `--force` to a law that has no idea what it means.
  */
-export function parseLawsArgv(argv: readonly string[]): { also: string[]; argv: string[] } {
+export function parseLawsArgv(argv: readonly string[]): { also: string[]; only: string[]; argv: string[] } {
 	const also: string[] = [];
+	const only: string[] = [];
 	const rest: string[] = [];
 	for (let i = 0; i < argv.length; i++) {
 		const arg = argv[i] as string;
-		if (arg === "--also") {
+		const flag = arg === "--also" ? also : arg === "--only" ? only : null;
+		if (flag) {
 			const next = argv[i + 1];
-			if (next !== undefined) also.push(next);
+			if (next !== undefined) flag.push(next);
 			i++;
 		} else if (arg.startsWith("--also=")) also.push(arg.slice("--also=".length));
+		else if (arg.startsWith("--only=")) only.push(arg.slice("--only=".length));
 		else rest.push(arg);
 	}
-	return { also, argv: rest };
+	return { also, only, argv: rest };
+}
+
+/** {@link parseLawsArgv}'s result as {@link LawsOptions}: `--only` becomes the whole list. */
+export function lawsOptionsFromArgv(argv: readonly string[]): LawsOptions {
+	const { also, only, argv: rest } = parseLawsArgv(argv);
+	return { also, argv: rest, ...(only.length > 0 ? { laws: only } : {}) };
 }
 
 if (import.meta.main) {
-	process.exit(runGenerationLaws(process.cwd(), parseLawsArgv(process.argv.slice(2))));
+	process.exit(runGenerationLaws(process.cwd(), lawsOptionsFromArgv(process.argv.slice(2))));
 }