poe-code 3.0.448 → 3.0.449

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.448",
+  "version": "3.0.449",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",

package/packages/package-lint/dist/rules/imported-workspace-dep-unresolvable.d.ts

@@ -3,7 +3,9 @@ import { type Rule } from "../model.js";
  * Import-driven vendoring check: for each genuinely-published package, every
  * workspace package its shipped source actually imports (by bare name, at
  * runtime — type-only and test imports excluded) must be vendored into its
- * tarball (`bundledDependencies`) or itself reach npm. Otherwise the published
- * package ships an import that resolves to nothing.
+ * tarball (`bundledDependencies`), compiled into its entrypoint, or itself
+ * reach npm AND be declared in the importer's dependencies. A published-but-
+ * undeclared import is a phantom dependency that resolves only through
+ * hoisting luck and breaks the moment the tree layout changes.
  */
 export declare const importedWorkspaceDepUnresolvable: Rule;

package/packages/package-lint/dist/rules/imported-workspace-dep-unresolvable.js

@@ -1,11 +1,13 @@
-import { isPublishedNpm, releaseTargetDirs } from "../model.js";
+import { dependencyEdges, isPublishedNpm, releaseTargetDirs } from "../model.js";
 const id = "imported-workspace-dep-unresolvable";
 /**
  * Import-driven vendoring check: for each genuinely-published package, every
  * workspace package its shipped source actually imports (by bare name, at
  * runtime — type-only and test imports excluded) must be vendored into its
- * tarball (`bundledDependencies`) or itself reach npm. Otherwise the published
- * package ships an import that resolves to nothing.
+ * tarball (`bundledDependencies`), compiled into its entrypoint, or itself
+ * reach npm AND be declared in the importer's dependencies. A published-but-
+ * undeclared import is a phantom dependency that resolves only through
+ * hoisting luck and breaks the moment the tree layout changes.
  */
 export const importedWorkspaceDepUnresolvable = {
     id,
@@ -17,6 +19,7 @@ export const importedWorkspaceDepUnresolvable = {
                 continue;
             const bundled = new Set(pkg.bundledDependencies);
             const inlined = new Set(pkg.inlinedDependencies);
+            const declared = new Set(dependencyEdges(pkg).map((edge) => edge.name));
             const unresolvable = new Map();
             for (const ref of model.sourceImports.get(pkg.dir) ?? []) {
                 if (ref.isTest || ref.typeOnly || ref.kind !== "bare" || !ref.packageName)
@@ -28,8 +31,9 @@ export const importedWorkspaceDepUnresolvable = {
                     continue; // vendored into the tarball
                 if (inlined.has(dep.name))
                     continue; // compiled into the published entrypoint
-                if (isPublishedNpm(dep) && released.has(dep.dir))
-                    continue; // dep itself reaches npm
+                // dep itself reaches npm — but only helps when the importer declares it
+                if (isPublishedNpm(dep) && released.has(dep.dir) && declared.has(dep.name))
+                    continue;
                 const files = unresolvable.get(dep.name) ?? new Set();
                 files.add(ref.file);
                 unresolvable.set(dep.name, files);
@@ -48,8 +52,8 @@ export const importedWorkspaceDepUnresolvable = {
                         files: [...(unresolvable.get(d) ?? [])].sort()
                     }))
                 },
-                message: `${pkg.name} imports workspace packages that are neither bundled nor published: ${deps.join(", ")}`,
-                fix: `Vendor them via bundledDependencies, publish them, or stop importing them: ${deps.join(", ")}.`
+                message: `${pkg.name} imports workspace packages that are neither bundled nor declared published dependencies: ${deps.join(", ")}`,
+                fix: `Vendor them via bundledDependencies, or declare them in dependencies (publishing alone leaves a phantom import): ${deps.join(", ")}.`
             });
         }
         return violations;