pmsec 0.5.2 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmsec",
-  "version": "0.5.2",
+  "version": "0.7.0",
   "publishConfig": {
     "access": "public"
   },

package/src/cli.mjs

@@ -105,8 +105,8 @@ function renderHuman(rows, min) {
     const tail = r.warn ? `\n       ⚠ ${r.warn}` : "";
     lines.push(`${status} ${r.tool.padEnd(4)} ${r.key} = ${value}  [${r.path}]${tail}`);
     for (const e of r.extras) {
-      const exStatus = e.configured === null ? "MISSING" : e.ok ? "OK     " : "STALE  ";
-      const exValue = e.configured ?? "(unset)";
+      const exStatus = e.ok ? "OK     " : e.configured === null ? "MISSING" : "STALE  ";
+      const exValue = e.defaultEnforced ? `(default — runtime enforces ${e.expected})` : (e.configured ?? "(unset)");
       lines.push(`${exStatus} ${r.tool.padEnd(4)} ${e.key} = ${exValue}  [${r.path}]`);
     }
   }

package/src/tools/pnpm.mjs

@@ -8,15 +8,23 @@ export const name = "pnpm";
 export const key = "minimum-release-age";
 export const docs = "https://pnpm.io/settings#minimumreleaseage";
 export const minBin = [10, 6, 0];
+// `defaultSinceMajor`: pnpm major version where the value became the default.
+// Once detected, an absent line in `.npmrc` is still effectively in force, so
+// `read()` reports it as ok with `defaultEnforced: true`.
 export const extras = [
   { key: "trust-policy", expected: "no-downgrade", line: "trust-policy=no-downgrade" },
-  { key: "block-exotic-subdeps", expected: "true", line: "block-exotic-subdeps=true" }
+  { key: "block-exotic-subdeps", expected: "true", line: "block-exotic-subdeps=true", defaultSinceMajor: 11 },
+  { key: "strict-dep-builds", expected: "true", line: "strict-dep-builds=true" }
 ];
 
 export function path(env, home) { return npmrcPath(env, home); }
 
-export function preflight() {
-  const v = detectVersion("pnpm");
+function pnpmVersion(env) {
+  return detectVersion("pnpm", ["--version"], { env, overrideKey: "PMSEC_PNPM_VERSION" });
+}
+
+export function preflight(env) {
+  const v = pnpmVersion(env);
   if (v === null) return { ok: true, message: null };
   if (gte(v, minBin)) return { ok: true, version: v.raw, message: null };
   return { ok: true, warn: true, version: v.raw, message: `pnpm ${v.raw} < ${minBin.join(".")}: minimum-release-age is silently ignored. Upgrade pnpm to enforce the cooldown.` };
@@ -27,10 +35,19 @@ export async function read(env, home) {
   const raw = await readSafe(p);
   const value = readKey(raw, key);
   const minutes = value === null ? null : Number(value);
+  const v = pnpmVersion(env);
+  const defaults = new Map(extras.filter(x => x.defaultSinceMajor).map(x => [x.key, x.defaultSinceMajor]));
+  const evaluated = readExtras(raw, extras).map(e => {
+    const def = defaults.get(e.key);
+    if (e.configured === null && def && v && v.major >= def) {
+      return { ...e, ok: true, defaultEnforced: true };
+    }
+    return e;
+  });
   return {
     path: p, configured: value,
     days: minutes === null || Number.isNaN(minutes) ? null : Math.floor(minutes / (60 * 24)),
-    extras: readExtras(raw, extras)
+    extras: evaluated
   };
 }
 

package/src/util/version.mjs

@@ -1,12 +1,27 @@
 import { spawnSync } from "node:child_process";
 
-export function detectVersion(bin, args = ["--version"]) {
+function parseSemver(s) {
+  const m = String(s || "").match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!m) return null;
+  return { major: +m[1], minor: +m[2], patch: +m[3], raw: m[0] };
+}
+
+// `env[overrideKey]` ("X.Y.Z" or "none") forces the result without spawning the
+// real binary — used by tests to make pnpm 11 default-enforcement behavior
+// deterministic regardless of what's installed locally.
+export function detectVersion(bin, args = ["--version"], { env, overrideKey } = {}) {
+  if (env && overrideKey) {
+    const o = env[overrideKey];
+    if (o === "none") return null;
+    if (o) {
+      const p = parseSemver(o);
+      if (p) return p;
+    }
+  }
   try {
     const res = spawnSync(bin, args, { encoding: "utf8" });
     if (res.status !== 0) return null;
-    const m = (res.stdout || "").match(/(\d+)\.(\d+)\.(\d+)/);
-    if (!m) return null;
-    return { major: +m[1], minor: +m[2], patch: +m[3], raw: m[0] };
+    return parseSemver(res.stdout);
   } catch { return null; }
 }