fg-devkit 1.22.0 → 1.24.0

package/scripts/audit-override-commit.mjs

@@ -8,7 +8,11 @@
  *   3. Audit again. Remaining findings with a patched version that a parent's range blocks
  *      get a tight override (`name@>=installed <patched`: lowest patched version) in
  *      pnpm-workspace.yaml. Findings with no patch, a patch in another major, a patch
- *      younger than minimumReleaseAge, or on a direct dependency are reported, not overridden.
+ *      younger than minimumReleaseAge, or on a direct dependency are not fixed automatically:
+ *      in a terminal you are asked per package whether to force it (override across the
+ *      major, allow the young release via minimumReleaseAgeExclude, bump the direct
+ *      dependency in package.json). Without a terminal they are reported unless the matching
+ *      --allow-major / --allow-young / --bump-direct flag is passed.
  *   4. Prune overrides that no longer change the audit (prune-overrides --fix).
  *   5. Prune minimumReleaseAgeExclude entries that are no longer needed
  *      (prune-release-age-exclude --fix). Runs even when the audit is clean.
@@ -16,11 +20,12 @@
  *      shared dependency-check-suppressions.xml, write the repo's copy with only those
  *      entries, so OWASP Dependency-Check accepts exactly the risks this repo has.
  *   7. Install and run the repo's checks (lint-check, lint:ts, test, test:unit, build).
- *   8. Commit the refresh, the overrides, the release-age excludes and the suppressions
- *      file separately.
+ *   8. Commit the refresh, the direct bumps, the overrides, the release-age excludes and
+ *      the suppressions file separately.
  *
  * Usage:
  *   pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
+ *     [--allow-major] [--allow-young] [--bump-direct]
  */
 
 import fs from 'node:fs'
@@ -31,23 +36,27 @@ import { parseArgs } from 'node:util'
 import {
   DEFAULT_MINIMUM_RELEASE_AGE_MINUTES,
   activeSuppressedGhsas,
+  addReleaseAgeExcludes,
   buildRefreshCommitMessage,
+  bumpDependencySpec,
   filterSuppressions,
   diffLockfileVersions,
   isReleaseAgeExcluded,
+  isSameReleaseLine,
   normalizeAdvisories,
   parseAuditJson,
   parseReleaseAgeExcludeEntry,
   planOverrides,
   readWorkspaceList,
   upsertWorkspaceOverrides,
-} from './audit-fix-plan.mjs'
+} from './lib/audit-fix-plan.mjs'
 import {
   buildOverrideCommitMessage,
   collectOverrideChanges,
   collectOverrides,
   formatOverrideValue,
-} from './override-changes.mjs'
+} from './lib/override-changes.mjs'
+import { fgDevkitRoot } from './lib/common.mjs'
 
 const TAG = '[audit-override-commit]'
 const cwd = process.cwd()
@@ -62,6 +71,9 @@ const { values: args } = parseArgs({
   options: {
     'no-verify': { type: 'boolean', default: false },
     'no-commit': { type: 'boolean', default: false },
+    'allow-major': { type: 'boolean', default: false },
+    'allow-young': { type: 'boolean', default: false },
+    'bump-direct': { type: 'boolean', default: false },
     help: { type: 'boolean', short: 'h', default: false },
   },
   strict: true,
@@ -69,14 +81,21 @@ const { values: args } = parseArgs({
 
 if (args.help) {
   console.log(`Usage: pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
+         [--allow-major] [--allow-young] [--bump-direct]
 
 Refreshes vulnerable packages in the lockfile within their existing ranges, adds a
 tight override only where a parent's range blocks the patched version, prunes unused
 overrides, syncs dependency-check-suppressions.xml when a remaining finding is
 suppressed there, runs the repo's checks, and commits each kind of change separately.
 
-  --no-verify   Skip lint/typecheck/test/build (git hooks still run on commit)
-  --no-commit   Leave the changes in the working tree`)
+Findings that need a decision are asked about one package at a time in a terminal.
+Without a terminal they are only reported, unless a flag below says yes for them.
+
+  --no-verify     Skip lint/typecheck/test/build (git hooks still run on commit)
+  --no-commit     Leave the changes in the working tree
+  --allow-major   Override even when the patch is only in a new major
+  --allow-young   Allow patches younger than minimumReleaseAge (adds minimumReleaseAgeExclude)
+  --bump-direct   Bump vulnerable direct dependencies in package.json`)
   process.exit(0)
 }
 
@@ -151,11 +170,11 @@ function publishTimes(name) {
   }
 }
 
+const DEPENDENCY_SECTIONS = ['dependencies', 'devDependencies', 'optionalDependencies']
+
 function directDependencies() {
   const pkg = JSON.parse(readFile('package.json'))
-  return new Set(
-    ['dependencies', 'devDependencies', 'optionalDependencies'].flatMap((section) => Object.keys(pkg[section] ?? {})),
-  )
+  return new Set(DEPENDENCY_SECTIONS.flatMap((section) => Object.keys(pkg[section] ?? {})))
 }
 
 // ---------------------------------------------------------------------------
@@ -215,7 +234,7 @@ function refreshLockfile(advisories) {
   runOrFail('pnpm', ['update', ...recursive, ...names, '--lockfile-only'])
 }
 
-/** Split planned overrides into ones we apply and ones held back by minimumReleaseAge. */
+/** Split planned changes (`{ name, value }`) into allowed ones and ones held back by minimumReleaseAge. */
 function applyReleaseAgeGate(overrides) {
   const config = readPnpmConfig()
   const minutes = Number(config.minimumReleaseAge ?? DEFAULT_MINIMUM_RELEASE_AGE_MINUTES)
@@ -241,6 +260,92 @@ function applyReleaseAgeGate(overrides) {
   return { allowed, heldBack }
 }
 
+/** Yes when the flag is passed, else ask in a terminal, else no. */
+let confirmPrompt
+async function decide(message, flag) {
+  if (args[flag]) return true
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false
+  confirmPrompt ??= (await import('@inquirer/confirm')).default
+  return confirmPrompt({ message, default: false })
+}
+
+/** First few advisory ids, so prompts stay on one line. */
+const ghsaList = (item) =>
+  item.ghsas.length > 3 ? `${item.ghsas.slice(0, 3).join(', ')} +${item.ghsas.length - 3} more` : item.ghsas.join(', ')
+
+/**
+ * Ask about the findings the automatic pass will not fix. Returns what to force:
+ * overrides across a major, bumps of direct dependencies, and which of the young
+ * releases to allow via minimumReleaseAgeExclude.
+ */
+async function chooseForcedFixes(plan) {
+  const blocked = [...plan.crossMajor, ...plan.direct.filter((item) => item.to)]
+  if (blocked.length === 0) return { overrides: [], bumps: [] }
+  if (process.stdin.isTTY) console.log(`\n${TAG} Remaining findings that need a decision:`)
+
+  const overrides = []
+  for (const item of plan.crossMajor) {
+    const message = `${item.name} ${item.from} → ${item.to} (new major, ${ghsaList(item)}). Override?`
+    if (await decide(message, 'allow-major')) {
+      overrides.push({ ...item, key: `${item.name}@>=${item.from} <${item.to}`, value: item.to, forced: true })
+    }
+  }
+
+  const pkg = JSON.parse(readFile('package.json'))
+  const bumps = []
+  for (const item of plan.direct) {
+    if (!item.to) continue
+    const sections = DEPENDENCY_SECTIONS.filter((section) => pkg[section]?.[item.name])
+    const specs = sections.map((section) => bumpDependencySpec(pkg[section][item.name], item.to))
+    if (sections.length === 0 || specs.includes(null)) continue
+    const major = item.versions.some((version) => !isSameReleaseLine(version, item.to)) ? 'new major, ' : ''
+    const message = `${item.name} ${item.versions.join(', ')} → ${item.to} (direct dependency, ${major}${ghsaList(item)}). Bump in package.json?`
+    if (await decide(message, 'bump-direct')) bumps.push({ ...item, value: item.to, kind: 'bump' })
+  }
+  return { overrides, bumps }
+}
+
+/** Ask, per release held back by minimumReleaseAge, whether to allow it anyway. */
+async function chooseYoungReleases(heldBack) {
+  const allowed = []
+  const declined = []
+  for (const item of heldBack) {
+    const message = `${item.name} ${item.value} is younger than minimumReleaseAge (~${item.waitHours}h left, ${ghsaList(item)}). Allow it via minimumReleaseAgeExclude?`
+    if (await decide(message, 'allow-young')) allowed.push({ ...item, excluded: true })
+    else declined.push(item)
+  }
+  return { allowed, declined }
+}
+
+function writeReleaseAgeExcludes(items) {
+  if (items.length === 0) return
+  const file = path.join(cwd, 'pnpm-workspace.yaml')
+  const before = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : ''
+  fs.writeFileSync(file, addReleaseAgeExcludes(before, items.map(({ name, value }) => ({ name, version: value }))))
+  for (const item of items) console.log(`${TAG} minimumReleaseAgeExclude += ${item.name}@${item.value}`)
+}
+
+function writeDirectBumps(bumps) {
+  const file = path.join(cwd, 'package.json')
+  const pkg = JSON.parse(fs.readFileSync(file, 'utf8'))
+  for (const bump of bumps) {
+    for (const section of DEPENDENCY_SECTIONS) {
+      if (!pkg[section]?.[bump.name]) continue
+      pkg[section][bump.name] = bumpDependencySpec(pkg[section][bump.name], bump.value)
+    }
+    console.log(`${TAG} Bump ${bump.name} -> ${bump.value} (${ghsaList(bump)})`)
+  }
+  const indent = fs.readFileSync(file, 'utf8').match(/^\{\n([ \t]+)/)?.[1] ?? '  '
+  fs.writeFileSync(file, `${JSON.stringify(pkg, null, indent)}\n`)
+  runOrFail('pnpm', ['install', '--lockfile-only', '--ignore-scripts', '--no-frozen-lockfile'])
+}
+
+function buildBumpCommitMessage(bumps) {
+  const describe = (bump) => `- ${bump.name}: ${bump.versions.join(', ')} -> ${bump.value}`
+  if (bumps.length === 1) return { subject: `vuln(${bumps[0].name}): bump to ${bumps[0].value}`, body: describe(bumps[0]) }
+  return { subject: `vuln(): bump ${bumps.length} dependencies`, body: bumps.map(describe).join('\n') }
+}
+
 function writeOverrides(overrides) {
   const file = path.join(cwd, 'pnpm-workspace.yaml')
   const before = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : ''
@@ -300,7 +405,7 @@ function pruneOverrides() {
  * shared file that match a finding still reported here. Untouched when nothing matches.
  */
 function syncSuppressions(remaining) {
-  const sourcePath = path.resolve(scriptDir, '..', 'configs', SUPPRESSIONS_FILE)
+  const sourcePath = path.join(fgDevkitRoot, 'configs', SUPPRESSIONS_FILE)
   if (!fs.existsSync(sourcePath)) return { covered: [], uncovered: remaining }
   const shared = fs.readFileSync(sourcePath, 'utf8')
   const active = activeSuppressedGhsas(shared)
@@ -337,7 +442,7 @@ function verify() {
   }
 }
 
-function printSummary({ fixedByRefresh, plan, heldBack, applied, remaining, suppressions, excludeChanges }) {
+function printSummary({ fixedByRefresh, plan, forced, heldBack, applied, remaining, suppressions, excludeChanges }) {
   const suppressed = new Set(suppressions.covered.map((advisory) => advisory.ghsa))
   const unique = (items) => [...new Set(items)]
   const lines = []
@@ -346,21 +451,40 @@ function printSummary({ fixedByRefresh, plan, heldBack, applied, remaining, supp
     lines.push(title, ...items.map((item) => `  - ${item}`))
   }
   section('Fixed by lockfile refresh:', fixedByRefresh)
+  const youngNote = (item) => (item.excluded ? ', young release allowed via minimumReleaseAgeExclude' : '')
   section(
     'Overridden (parent range blocked the patch):',
-    applied.map((item) => `${item.key} -> ${item.value} (${item.ghsas.join(', ')})`),
+    applied
+      .filter((item) => !item.forced)
+      .map((item) => `${item.key} -> ${item.value} (${item.ghsas.join(', ')}${youngNote(item)})`),
+  )
+  section(
+    'Overridden across a major (forced, verify covers it):',
+    applied
+      .filter((item) => item.forced)
+      .map((item) => `${item.key} -> ${item.value} (${item.ghsas.join(', ')}${youngNote(item)})`),
   )
   section(
-    'Held back by minimumReleaseAge (re-run later, or add to minimumReleaseAgeExclude):',
+    'Bumped in package.json:',
+    forced.bumps.map(
+      (item) => `${item.name} ${item.versions.join(', ')} -> ${item.value} (${item.ghsas.join(', ')}${youngNote(item)})`,
+    ),
+  )
+  section(
+    'Held back by minimumReleaseAge (re-run later, or pass --allow-young):',
     heldBack.map((item) => `${item.name}@${item.value}, ~${item.waitHours}h left (${item.ghsas.join(', ')})`),
   )
   section(
-    'Direct dependency, bump it in package.json (policy-upgrade-commit):',
-    plan.direct.map((item) => `${item.name} ${item.versions.join(', ')} (${item.ghsas.join(', ')})`),
+    'Direct dependency, not bumped (pass --bump-direct, or use policy-upgrade-commit):',
+    plan.direct
+      .filter((item) => !forced.bumps.some((bump) => bump.name === item.name))
+      .map((item) => `${item.name} ${item.versions.join(', ')} (${item.ghsas.join(', ')})`),
   )
   section(
-    'Patch only in a new major, upgrade the parent instead:',
-    plan.crossMajor.map((item) => `${item.name} ${item.from} -> ${item.to} (${item.ghsas.join(', ')})`),
+    'Patch only in a new major, not overridden (pass --allow-major, or upgrade the parent):',
+    plan.crossMajor
+      .filter((item) => !forced.overrides.some((override) => override.name === item.name && override.from === item.from))
+      .map((item) => `${item.name} ${item.from} -> ${item.to} (${item.ghsas.join(', ')})`),
   )
   section(
     'No patched version and not suppressed, add a <suppress> entry to fg-devkit configs/dependency-check-suppressions.xml if the risk is accepted:',
@@ -393,7 +517,7 @@ function printSummary({ fixedByRefresh, plan, heldBack, applied, remaining, supp
 // Main
 // ---------------------------------------------------------------------------
 
-function main() {
+async function main() {
   if (!readFile('package.json')) throw new Error(`package.json not found in ${cwd}`)
   if (!readFile('pnpm-lock.yaml')) throw new Error(`pnpm-lock.yaml not found in ${cwd}`)
   const shouldCommit = !args['no-commit']
@@ -408,9 +532,11 @@ function main() {
   let refreshChanges = []
   let fixedByRefresh = []
   let plan = { overrides: [], noPatch: [], crossMajor: [], direct: [], unparseable: [] }
+  let forced = { overrides: [], bumps: [] }
   let heldBack = []
   let allowed = []
   let remaining = []
+  let afterBumps
 
   if (initial.length === 0) {
     console.log(`${TAG} pnpm audit is clean.`)
@@ -429,19 +555,33 @@ function main() {
       ...new Set(initial.filter((advisory) => !remainingIds.has(advisory.id)).map((a) => `${a.name} (${a.ghsa})`)),
     ]
     plan = planOverrides(afterRefresh, { directDependencies: directDependencies() })
-    ;({ allowed, heldBack } = applyReleaseAgeGate(plan.overrides))
+    forced = await chooseForcedFixes(plan)
+    const gated = applyReleaseAgeGate([...plan.overrides, ...forced.overrides, ...forced.bumps])
+    const young = await chooseYoungReleases(gated.heldBack)
+    heldBack = young.declined
+    const passed = [...gated.allowed, ...young.allowed]
+    forced.bumps = passed.filter((item) => item.kind === 'bump')
+    allowed = passed.filter((item) => item.kind !== 'bump')
+
+    // Direct bumps first, in their own commit.
+    if (forced.bumps.length > 0) {
+      writeReleaseAgeExcludes(forced.bumps.filter((item) => item.excluded))
+      writeDirectBumps(forced.bumps)
+      afterBumps = snapshot()
+    }
+    writeReleaseAgeExcludes(allowed.filter((item) => item.excluded))
     if (allowed.length > 0) writeOverrides(allowed)
 
     // 4. Prune overrides.
     pruneOverrides()
-    remaining = allowed.length > 0 ? audit() : afterRefresh
+    remaining = allowed.length > 0 || forced.bumps.length > 0 ? audit() : afterRefresh
   }
   const afterOverrides = snapshot()
 
   // 5. Release-age excludes, 6. suppressions, 7. verify.
   const excludeChanges = pruneReleaseAgeExclude()
   const suppressions = syncSuppressions(remaining)
-  printSummary({ fixedByRefresh, plan, heldBack, applied: allowed, remaining, suppressions, excludeChanges })
+  printSummary({ fixedByRefresh, plan, forced, heldBack, applied: allowed, remaining, suppressions, excludeChanges })
 
   const final = snapshot()
   const nothingChanged = !suppressionsWritten && TRACKED_FILES.every((file) => final[file] === original[file])
@@ -460,6 +600,9 @@ function main() {
   if (refreshChanges.length > 0 && stageContents(refreshed) > 0) {
     commit(buildRefreshCommitMessage(refreshChanges))
   }
+  if (afterBumps && stageContents(afterBumps) > 0) {
+    commit(buildBumpCommitMessage(forced.bumps))
+  }
   for (const item of overrideChanges) {
     console.log(`  - ${item.name}: ${item.from ?? '(missing)'} -> ${formatOverrideValue(item.to)}`)
   }
@@ -487,7 +630,7 @@ function main() {
 }
 
 try {
-  process.exit(main())
+  process.exit(await main())
 } catch (error) {
   console.error(`${TAG} ${error instanceof Error ? error.message : error}`)
   console.error(

package/scripts/bump-node-toolchain.mjs

@@ -31,22 +31,20 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
 
-import { collectFleetProjectRepos, toolchainExclude } from './fleet-project-repos.mjs'
-import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
+import { collectFleetProjectRepos, toolchainExclude } from './lib/fleet-project-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './lib/fleet-repo-picker.mjs'
 import {
   formatNodeNvmrc,
   readFgDevkitNodePolicy,
   resolveExpectedNodePolicy,
-} from './dependency-policy-toolchain.mjs'
-import { syncNodeToolchainInRepo } from './node-toolchain-sync.mjs'
-import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+} from './lib/dependency-policy-toolchain.mjs'
+import { syncNodeToolchainInRepo } from './lib/node-toolchain-sync.mjs'
+import { resolveDependencyPolicyPath } from './lib/resolve-dependency-policy-path.mjs'
+import { assertFgDevkitMaintainerContext, fgDevkitRoot, readJson } from './lib/common.mjs'
 
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-const fgDevkitRoot = path.resolve(scriptDir, '..')
 const fgDevkitPkgPath = path.join(fgDevkitRoot, 'package.json')
-const policyPath = resolveDependencyPolicyPath(scriptDir, fgDevkitRoot, [])
+const policyPath = resolveDependencyPolicyPath(fgDevkitRoot, [])
 
 const cliArgs = process.argv.slice(2)
 const dryRun = cliArgs.includes('--dry-run')
@@ -55,27 +53,6 @@ const noEngines = cliArgs.includes('--no-engines')
 const enginesArg = cliArgs.find((a) => a.startsWith('--engines='))?.slice('--engines='.length)
 const { pick, all, only, filteredArgs: positionalArgs } = parseFleetSelectionFlags(cliArgs)
 
-function readJson(jsonPath) {
-  return JSON.parse(fs.readFileSync(jsonPath, 'utf8'))
-}
-
-function assertFgDevkitMaintainerContext() {
-  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
-    console.error('[bump-node-toolchain] Run from the fg-devkit repository root.')
-    process.exit(1)
-  }
-  try {
-    const pkg = readJson(fgDevkitPkgPath)
-    if (pkg?.name !== 'fg-devkit') {
-      console.error('[bump-node-toolchain] package.json name must be fg-devkit.')
-      process.exit(1)
-    }
-  } catch {
-    console.error('[bump-node-toolchain] Could not read fg-devkit package.json.')
-    process.exit(1)
-  }
-}
-
 function runStep(label, fn) {
   console.log(`\n[bump-node-toolchain] ${label}`)
   return fn()
@@ -185,7 +162,7 @@ function syncFleetRepo(repoDir, projectsRoot, policy) {
 }
 
 async function main() {
-  assertFgDevkitMaintainerContext()
+  assertFgDevkitMaintainerContext('[bump-node-toolchain]')
 
   const nvmrcArg = positionalArgs.find((a) => /^\d/.test(a))
   const projectsRootArg = positionalArgs.find((a) => a !== nvmrcArg)

package/scripts/bump-pnpm-toolchain.mjs

@@ -35,20 +35,20 @@ import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 
-import { formatPnpmPackageManager } from './dependency-policy-toolchain.mjs'
-import { collectFleetPnpmRepos } from './fleet-project-repos.mjs'
-import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
+import { formatPnpmPackageManager } from './lib/dependency-policy-toolchain.mjs'
+import { collectFleetPnpmRepos } from './lib/fleet-project-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './lib/fleet-repo-picker.mjs'
 import {
   isVueFgDevkitConsumerRepo,
   syncPnpmToolchainInRepo,
-} from './pnpm-toolchain-sync.mjs'
-import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+} from './lib/pnpm-toolchain-sync.mjs'
+import { resolveDependencyPolicyPath } from './lib/resolve-dependency-policy-path.mjs'
 import { syncScaffoldVueDepsFromPolicy } from './sync-scaffold-vue-deps.mjs'
+import { assertFgDevkitMaintainerContext, fgDevkitRoot, readJson } from './lib/common.mjs'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-const fgDevkitRoot = path.resolve(scriptDir, '..')
 const fgDevkitPkgPath = path.join(fgDevkitRoot, 'package.json')
-const policyPath = resolveDependencyPolicyPath(scriptDir, fgDevkitRoot, [])
+const policyPath = resolveDependencyPolicyPath(fgDevkitRoot, [])
 
 const cliArgs = process.argv.slice(2)
 const dryRun = cliArgs.includes('--dry-run')
@@ -57,27 +57,6 @@ const skipInstall = cliArgs.includes('--skip-install')
 const { pick, all, only, filteredArgs: positionalArgs } = parseFleetSelectionFlags(cliArgs)
 let projectsRoot = path.resolve(fgDevkitRoot, '..')
 
-function readJson(jsonPath) {
-  return JSON.parse(fs.readFileSync(jsonPath, 'utf8'))
-}
-
-function assertFgDevkitMaintainerContext() {
-  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
-    console.error('[bump-pnpm-toolchain] Run from the fg-devkit repository root.')
-    process.exit(1)
-  }
-  try {
-    const pkg = readJson(fgDevkitPkgPath)
-    if (pkg?.name !== 'fg-devkit') {
-      console.error('[bump-pnpm-toolchain] package.json name must be fg-devkit.')
-      process.exit(1)
-    }
-  } catch {
-    console.error('[bump-pnpm-toolchain] Could not read fg-devkit package.json.')
-    process.exit(1)
-  }
-}
-
 function resolveTargetVersion(versionArg) {
   if (versionArg) {
     return formatPnpmPackageManager(versionArg)
@@ -218,7 +197,7 @@ function syncFleetRepo(repoDir, repoName, packageManager) {
 }
 
 async function main() {
-  assertFgDevkitMaintainerContext()
+  assertFgDevkitMaintainerContext('[bump-pnpm-toolchain]')
 
   const versionArg = positionalArgs.find((a) => /^(pnpm@)?\d/.test(a))
   const projectsRootArg = positionalArgs.find((a) => a !== versionArg)

package/scripts/check-dependency-policy.mjs

@@ -15,22 +15,22 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
 
-import { collectPinViolations, isPinnedDependencyVersion } from './dependency-policy-pins.mjs'
+import { collectPinViolations, isPinnedDependencyVersion } from './lib/dependency-policy-pins.mjs'
 import {
   collectToolchainPolicyViolations,
   resolveExpectedPackageManager,
-} from './dependency-policy-toolchain.mjs'
-import { findPnpmVersionMismatchesInRepo } from './pnpm-toolchain-sync.mjs'
-import { collectNodeToolchainViolations } from './node-toolchain-sync.mjs'
-import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+} from './lib/dependency-policy-toolchain.mjs'
+import { findPnpmVersionMismatchesInRepo } from './lib/pnpm-toolchain-sync.mjs'
+import { collectNodeToolchainViolations } from './lib/node-toolchain-sync.mjs'
+import { resolveDependencyPolicyPath } from './lib/resolve-dependency-policy-path.mjs'
+import { getRelevantPolicyOverrides } from './lib/override-changes.mjs'
+import { fgDevkitRoot } from './lib/common.mjs'
 
 const cwd = process.cwd()
 const pkgPath = path.resolve(cwd, 'package.json')
 const lockfilePath = path.resolve(cwd, 'pnpm-lock.yaml')
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-const policyPath = resolveDependencyPolicyPath(scriptDir, cwd, process.argv)
+const policyPath = resolveDependencyPolicyPath(cwd, process.argv)
 
 if (!fs.existsSync(pkgPath)) {
   console.error('[check-deps] Could not find package.json in current working directory')
@@ -50,30 +50,6 @@ const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
 const policy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
 const mismatches = []
 
-function getOverridePackageName(overrideKey) {
-  const match = overrideKey.match(/^(@[^/]+\/[^@]+|[^@]+)@/)
-  return match ? match[1] : overrideKey
-}
-
-function getRelevantPolicyOverrides(policyOverrides) {
-  const entries = Object.entries(policyOverrides ?? {})
-  if (entries.length === 0) {
-    return {}
-  }
-  if (!fs.existsSync(lockfilePath)) {
-    return Object.fromEntries(entries)
-  }
-  const lockfile = fs.readFileSync(lockfilePath, 'utf8')
-  const relevant = {}
-  for (const [name, version] of entries) {
-    const pkgName = getOverridePackageName(name)
-    if (lockfile.includes(`${pkgName}@`) || lockfile.includes(`/${pkgName}/`)) {
-      relevant[name] = version
-    }
-  }
-  return relevant
-}
-
 /** True if this package+section is governed by the policy (so global pin checks skip it). */
 function isPolicyManagedInSection(section, name) {
   if (policy.managedAnywhere?.[name] !== undefined) {
@@ -90,7 +66,7 @@ for (const [section, dependencies] of Object.entries(policy.managedDependencies
 mismatches.push(...collectPinViolations('[policy] managedAnywhere.', policy.managedAnywhere ?? {}))
 mismatches.push(...collectToolchainPolicyViolations(policy))
 
-const expectedPackageManager = resolveExpectedPackageManager(policy, path.resolve(scriptDir, '..'))
+const expectedPackageManager = resolveExpectedPackageManager(policy, fgDevkitRoot)
 if (expectedPackageManager !== undefined) {
   const actualPackageManager = pkg.packageManager
   if (actualPackageManager !== expectedPackageManager) {
@@ -100,7 +76,6 @@ if (expectedPackageManager !== undefined) {
   }
 }
 
-const fgDevkitRoot = path.resolve(scriptDir, '..')
 mismatches.push(...collectNodeToolchainViolations(cwd, policy, fgDevkitRoot))
 if (expectedPackageManager !== undefined) {
   mismatches.push(...findPnpmVersionMismatchesInRepo(cwd, expectedPackageManager))
@@ -146,7 +121,7 @@ for (const [name, expected] of Object.entries(policy.managedAnywhere ?? {})) {
 
 // Optional: policy may define pnpm.overrides entries the consumer must mirror.
 const overrides = pkg.pnpm?.overrides ?? {}
-for (const [name, expected] of Object.entries(getRelevantPolicyOverrides(policy.overrides ?? {}))) {
+for (const [name, expected] of Object.entries(getRelevantPolicyOverrides(policy.overrides, lockfilePath))) {
   const actual = overrides[name]
   if (actual !== expected) {
     mismatches.push(`pnpm.overrides.${name}: expected ${expected}, got ${actual ?? '(missing)'}`)