ts-builds 4.0.0 → 4.0.2

package/dist/cli.js

@@ -9,7 +9,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { createInterface } from "node:readline";
 import { gzipSync } from "node:zlib";
 
-//#region src/cli/config.ts
+// src/cli/config.ts
 const targetDir = process.cwd();
 /**
 * Returns true when `cwd` resolves outside `baseDir`. Used to reject the
@@ -65,8 +65,7 @@ function loadConfig() {
 	};
 }
 
-//#endregion
-//#region src/cli/lint-report.ts
+// src/cli/lint-report.ts
 /**
 * Current sidecar schema version. Bump when the shape changes incompatibly so
 * `lint:summary` can detect and skip reports it can't read.
@@ -147,8 +146,7 @@ async function writeLintReport(report, dir = targetDir) {
 	}
 }
 
-//#endregion
-//#region src/cli/process.ts
+// src/cli/process.ts
 function resolveCwd(cwd) {
 	return cwd ? join(targetDir, cwd) : targetDir;
 }
@@ -193,8 +191,7 @@ function runShellCommand(shellCmd, options = {}) {
 	});
 }
 
-//#endregion
-//#region src/cli/commands/build.ts
+// src/cli/commands/build.ts
 const TRANSIENT_RM_ERRORS = Set.of("EBUSY", "EPERM", "ENOTEMPTY", "EMFILE");
 const RETRY_DELAYS_MS = [
 	100,
@@ -537,8 +534,7 @@ async function runDev() {
 	return loadConfig().buildMode === "vite" ? runCommand("vite", []) : runCommand("tsdown", ["--watch"]);
 }
 
-//#endregion
-//#region src/cli/commands/changelog.ts
+// src/cli/commands/changelog.ts
 const defaultTypeMap = {
 	feat: "Features",
 	fix: "Bug Fixes",
@@ -709,8 +705,7 @@ function runChangelog(args) {
 	return 0;
 }
 
-//#endregion
-//#region src/cli/commands/info.ts
+// src/cli/commands/info.ts
 const bundledPackages = [
 	"@eslint/js",
 	"@vitest/coverage-v8",
@@ -846,8 +841,7 @@ Example minimal package.json for SPAs/React apps:
 `);
 }
 
-//#endregion
-//#region src/cli/commands/cleanup.ts
+// src/cli/commands/cleanup.ts
 async function cleanup() {
 	const packageJsonPath = join(targetDir, "package.json");
 	if (!existsSync(packageJsonPath)) {
@@ -898,42 +892,56 @@ async function cleanup() {
 	console.log("\nRun 'pnpm install' to update your lockfile.");
 }
 
-//#endregion
-//#region src/cli/pnpm11.ts
+// src/cli/pnpm11.ts
 const HOIST_LINE = /^public-hoist-pattern\[\]=(.+)$/;
-const RELEASE_AGE_LINE = /(@?[^\s@/]+(?:\/[^\s@]+)?@[^\s]+)\s+was published.*minimumReleaseAge/;
+const PKG_VERSION = String.raw`@?[^\s@/]+(?:\/[^\s@]+)?@\S+`;
+const RELEASE_AGE_VIOLATION = new RegExp(`(${PKG_VERSION}) was published (?:at \\S+, )?within the minimumReleaseAge`, "g");
+const AUTO_EXCLUDE_HEADER = /^Added \d+ entr\S* to minimumReleaseAgeExclude/;
+const AUTO_EXCLUDE_ENTRY = new RegExp(`^\\s+(${PKG_VERSION})$`);
 /**
 * Pure parser (no I/O): extracts the flagged `pkg@version` tokens from captured
-* pnpm output. Order-preserving and de-duplicated. Returns [] for unrelated or
-* empty output so callers never emit false warnings.
+* pnpm output, in either the strict or the lenient shape. Order-preserving and
+* de-duplicated. Returns [] for unrelated or empty output so callers never emit
+* false warnings.
 */
 function parseReleaseAgeViolations(stdout, stderr) {
-	const tokens = `${stdout}\n${stderr}`.split("\n").map((line) => RELEASE_AGE_LINE.exec(line.trim())?.[1]).filter((token) => token !== void 0);
-	return List(tokens).distinct().toArray();
+	const output = `${stdout}\n${stderr}`;
+	const strict = [...output.replace(/-\r?\n\s+/g, "-").replace(/\s+/g, " ").matchAll(RELEASE_AGE_VIOLATION)].map((match) => match[1]);
+	return List([...strict, ...autoExcludedEntries(output)]).distinct().toArray();
+}
+/** The `pkg@version` lines listed under pnpm's lenient-mode "Added N entries" header. */
+function autoExcludedEntries(output) {
+	const lines = output.split("\n").map((raw) => raw.trimEnd());
+	const start = lines.findIndex((line) => AUTO_EXCLUDE_HEADER.test(line.trim()));
+	if (start === -1) return [];
+	const body = lines.slice(start + 1);
+	const end = body.findIndex((line) => !AUTO_EXCLUDE_ENTRY.test(line));
+	return matchFirstGroups(end === -1 ? body : body.slice(0, end), AUTO_EXCLUDE_ENTRY);
 }
 /** Pure helper: the suggested pnpm-workspace.yaml exclude line for a flagged token. */
 function buildReleaseAgeExcludeLine(pkgVersion) {
 	return `minimumReleaseAgeExclude:\n${renderExcludeEntry(releaseAgeExcludeEntry(pkgVersion))}`;
 }
+/** The command the default probe runs. Exported so warnings and tests name it exactly. */
+const RELEASE_AGE_PROBE_ARGS = ["install", "--lockfile-only"];
 /**
-* Default probe: runs `pnpm install --resolution-only`, which re-runs resolution
-* (re-applying minimumReleaseAge) and captures its output. If pnpm is not on PATH
-* the spawn errors and we return status -1 so detection degrades quietly.
+* Default probe: runs `pnpm install --lockfile-only`, which resolves anything the
+* lockfile does not already pin (re-applying minimumReleaseAge) without installing
+* packages, and captures its output. `--lockfile-only` exists in pnpm 11 and 12;
+* the `--resolution-only` flag this used before was removed in pnpm 12. If pnpm is
+* not on PATH the spawn errors and we return status -1 so detection degrades quietly.
 *
-* SNAPSHOT/RESTORE: `--resolution-only` is NOT non-mutating in general. When the
-* committed `pnpm-lock.yaml` is stale or doesn't match resolution, pnpm REWRITES
-* it to match (it only avoids writing when it ABORTS on a violation). A read-only
-* diagnostic must never touch a consumer's lockfile, so we snapshot the exact
-* bytes before spawning and restore them in a `finally` — putting the file back
-* exactly as found (or removing one the probe created where none existed).
-* `--resolution-only` does not install packages, so node_modules is not a concern.
+* SNAPSHOT/RESTORE: the run is NOT non-mutating. pnpm rewrites `pnpm-lock.yaml`
+* to match resolution, and in lenient mode it also writes the violating packages
+* into `pnpm-workspace.yaml` itself. A read-only diagnostic must never touch a
+* consumer's files, so we snapshot the exact bytes of both files — in `dir` and at
+* the workspace root pnpm resolves from — and restore them in a `finally`, putting
+* each back exactly as found (or removing one the probe created where none existed).
 */
 const defaultReleaseAgeProbe = (dir) => {
-	const lockPath = join(dir, "pnpm-lock.yaml");
-	const lockExisted = existsSync(lockPath);
-	const originalLock = lockExisted ? readFileSync(lockPath) : void 0;
+	const snapshots = probeWrittenFiles(dir).map(snapshotFile);
 	try {
-		const result = spawnSync("pnpm", ["install", "--resolution-only"], {
+		const result = spawnSync("pnpm", [...RELEASE_AGE_PROBE_ARGS], {
 			cwd: dir,
 			encoding: "utf-8",
 			env: process.env
@@ -946,13 +954,46 @@ const defaultReleaseAgeProbe = (dir) => {
 		return {
 			stdout: result.stdout ?? "",
 			stderr: result.stderr ?? "",
-			status: result.status ?? 1
+			status: result.status ?? 1,
+			autoExcluded: snapshots.flatMap(addedExcludeEntries)
 		};
 	} finally {
-		if (lockExisted && originalLock !== void 0) writeFileSync(lockPath, originalLock);
-		else if (!lockExisted && existsSync(lockPath)) rmSync(lockPath, { force: true });
+		snapshots.forEach(restoreFile);
 	}
 };
+/** The `minimumReleaseAgeExclude` entries a `pnpm-workspace.yaml` gained since its snapshot. */
+function addedExcludeEntries({ path, bytes }) {
+	if (basename(path) !== "pnpm-workspace.yaml" || !isFile(path)) return [];
+	const before = readReleaseAgeExcludeEntries(bytes.fold(() => "", (original) => original.toString("utf-8")));
+	return readReleaseAgeExcludeEntries(readFileSync(path, "utf-8")).toArray().filter((entry) => !before.has(entry));
+}
+/**
+* `pnpm-lock.yaml` and `pnpm-workspace.yaml` in `dir` and at its workspace root,
+* if it has one. A path that exists but is not a regular file is left untracked,
+* since pnpm cannot have written it either.
+*/
+function probeWrittenFiles(dir) {
+	const roots = findWorkspaceRoot(dir).fold(() => [dir], (root) => [dir, root]);
+	return List(roots).distinct().toArray().flatMap((root) => [join(root, "pnpm-lock.yaml"), join(root, "pnpm-workspace.yaml")]).filter((path) => !existsSync(path) || isFile(path));
+}
+const isFile = (path) => existsSync(path) && statSync(path).isFile();
+/** The nearest directory at or above `dir` holding a `pnpm-workspace.yaml`. */
+function findWorkspaceRoot(dir) {
+	if (isFile(join(dir, "pnpm-workspace.yaml"))) return Option(dir);
+	const parent = dirname(dir);
+	return parent === dir ? Option.none() : findWorkspaceRoot(parent);
+}
+function snapshotFile(path) {
+	return {
+		path,
+		bytes: existsSync(path) ? Option(readFileSync(path)) : Option.none()
+	};
+}
+function restoreFile({ path, bytes }) {
+	bytes.fold(() => {
+		if (existsSync(path)) rmSync(path, { force: true });
+	}, (original) => writeFileSync(path, original));
+}
 /**
 * Curated set of packages whose build scripts are known to be unnecessary under
 * pnpm 11's strictDepBuilds. Extend ONLY after verification — this list drives
@@ -1003,11 +1044,34 @@ function detectAllowBuildsIssues(dir) {
 	}));
 }
 function detectReleaseAgeIssues(dir, probe) {
-	const { stdout, stderr } = probe(dir);
-	return parseReleaseAgeViolations(stdout, stderr).map((pkgVersion) => ({
+	const result = probe(dir);
+	const { stdout, stderr, status } = result;
+	const violations = probeViolations(result);
+	if (violations.length > 0) return violations.map((pkgVersion) => ({
 		severity: "warning",
 		message: `${pkgVersion} is newer than the pnpm minimumReleaseAge cutoff — add to pnpm-workspace.yaml to allow it:\n      ${buildReleaseAgeExcludeLine(pkgVersion)}`
 	}));
+	return probeFailure(stdout, stderr, status).map((message) => [{
+		severity: "warning",
+		message
+	}]).orElse([]);
+}
+/** Every flagged `pkg@version`, from pnpm's output and from the entries it wrote. */
+function probeViolations({ stdout, stderr, autoExcluded = [] }) {
+	return List([...parseReleaseAgeViolations(stdout, stderr), ...autoExcluded]).distinct().toArray();
+}
+/**
+* A message when the probe ran pnpm and pnpm failed without reporting a violation,
+* meaning the release-age check never actually ran. That must not read as "ready".
+* Status -1 (pnpm not installed) stays quiet: there is nothing to check against.
+*/
+function probeFailure(stdout, stderr, status) {
+	if (status <= 0) return Option.none();
+	const lines = `${stderr}\n${stdout}`.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+	const reason = lines.find((line) => line.includes("ERR_PNPM")) ?? lines.at(0);
+	const command = `pnpm ${RELEASE_AGE_PROBE_ARGS.join(" ")}`;
+	const detail = reason === void 0 ? "" : `: ${reason}`;
+	return Option(`Could not check minimumReleaseAge: \`${command}\` exited ${status}${detail}`);
 }
 function readHoistPatterns(npmrc) {
 	return npmrc.split("\n").map((line) => HOIST_LINE.exec(line.trim())).filter((m) => m !== null).map((m) => m[1]);
@@ -1103,11 +1167,14 @@ function renderExcludeEntry(entry) {
 }
 /**
 * Pure parser: returns the set of entries already listed under
-* `minimumReleaseAgeExclude:`, normalized (quotes stripped). Same manual
-* line-by-line style as readAllowBuildsKeys — stops at the next top-level key.
+* `minimumReleaseAgeExclude:`, normalized (quotes stripped). pnpm itself writes
+* scoped entries single-quoted (`- '@scope/name@1.0.0'`); we write them
+* double-quoted. Same manual line-by-line style as readAllowBuildsKeys — stops at
+* the next top-level key.
 */
 function readReleaseAgeExcludeEntries(yaml) {
-	return Set(matchFirstGroups(blockLines(yaml, /^minimumReleaseAgeExclude:/), /^\s*-\s*"?([^"]+?)"?\s*$/));
+	const entryLine = /^\s*-\s*(["']?)([^"'\s#]+)\1\s*(?:#.*)?$/;
+	return Set(blockLines(yaml, /^minimumReleaseAgeExclude:/).map((line) => entryLine.exec(line)?.[2]).filter((entry) => entry !== void 0));
 }
 /**
 * Insert YAML list entries (already rendered as `  - x` lines) into an existing
@@ -1282,8 +1349,26 @@ function migratePackageJsonPnpm(dir, ws) {
 * sourceMutation is needed — it joins the same single ws write.
 */
 function migrateReleaseAgeExcludes(dir, ws, probe) {
-	const { stdout, stderr } = probe(dir);
-	const violations = parseReleaseAgeViolations(stdout, stderr);
+	const result = probe(dir);
+	const { stdout, stderr, status } = result;
+	const violations = probeViolations(result);
+	if (violations.length === 0) return probeFailure(stdout, stderr, status).fold(() => noChange(ws), (message) => ({
+		ws,
+		actions: [{
+			kind: "skipped",
+			message
+		}],
+		sourceMutations: []
+	}));
+	const outerRoot = findWorkspaceRoot(dir).filter((root) => root !== dir);
+	if (outerRoot.isSome()) return outerRoot.fold(() => noChange(ws), (root) => ({
+		ws,
+		actions: [{
+			kind: "manual",
+			message: `${violations.length} package(s) are newer than the minimumReleaseAge cutoff, but this is a workspace package — run 'ts-builds doctor --fix' from the workspace root (${root}) to add them to its pnpm-workspace.yaml`
+		}],
+		sourceMutations: []
+	}));
 	const covered = readReleaseAgeExcludeEntries(ws).map(releaseAgeExcludeEntry);
 	const newEntries = List(violations.map(releaseAgeExcludeEntry)).filter((entry) => !covered.has(entry)).distinct().toArray();
 	if (newEntries.length === 0) return noChange(ws);
@@ -1346,8 +1431,7 @@ function migratePnpm11(dir = targetDir, releaseAgeProbe = defaultReleaseAgeProbe
 	};
 }
 
-//#endregion
-//#region src/cli/commands/doctor.ts
+// src/cli/commands/doctor.ts
 function resolveExportValue(value) {
 	if (typeof value === "string") return List([value]);
 	if (typeof value === "object" && value !== null) return List(Object.values(value)).flatMap((v) => resolveExportValue(v));
@@ -1569,8 +1653,7 @@ function runDoctor(fix = false) {
 	});
 }
 
-//#endregion
-//#region src/cli/commands/init.ts
+// src/cli/commands/init.ts
 const hoistPatterns = [
 	"*eslint*",
 	"*prettier*",
@@ -1651,8 +1734,7 @@ For cross-package orchestration in a monorepo, use Turbo, nx, or
 `);
 }
 
-//#endregion
-//#region src/cli/commands/lint-summary.ts
+// src/cli/commands/lint-summary.ts
 /** node_modules is always skipped: huge, and never a workspace package itself. */
 const ALWAYS_SKIP = Set.of("node_modules");
 /** Skipped ONLY when the dir is not itself a package — a workspace package literally
@@ -1797,8 +1879,7 @@ async function runLintSummary(args) {
 	return lintSummaryExitCode(totals);
 }
 
-//#endregion
-//#region src/cli/commands/size.ts
+// src/cli/commands/size.ts
 function measureEntry(dir, entry, absDir) {
 	const fullPath = join(absDir, entry);
 	return Do(function* () {
@@ -1911,8 +1992,7 @@ function runSize(args) {
 	return totalTooBig || !oversized.isEmpty ? 1 : 0;
 }
 
-//#endregion
-//#region src/cli/runner.ts
+// src/cli/runner.ts
 /**
 * Type guard for the internal `runFn` step shape. A plain `"runFn" in cmd`
 * check leaves `cmd.runFn` typed `unknown` (CommandDef has no such key), so we
@@ -1985,8 +2065,7 @@ async function runValidate(chainName = "validate") {
 	return runChain(chainName, loadConfig());
 }
 
-//#endregion
-//#region src/cli.ts
+// src/cli.ts
 const command = process.argv[2] || "init";
 const subCommand = process.argv[3];
 switch (command) {
@@ -2085,5 +2164,4 @@ switch (command) {
 	}
 }
 
-//#endregion
 export {  };

package/dist/tsdown.config.base.d.ts

@@ -1,4 +1,2 @@
 import { UserConfig } from "tsdown";
-//#region src/tsdown.config.base.d.ts
-export declare const tsdown: UserConfig;
-//#endregion
+export declare const tsdown: UserConfig;

package/dist/tsdown.config.base.js

@@ -1,6 +1,6 @@
 import { resolve } from "node:path";
 
-//#region src/tsdown.config.base.ts
+// src/tsdown.config.base.ts
 const env = process.env.NODE_ENV;
 const tsdown = {
 	sourcemap: true,
@@ -18,5 +18,4 @@ const tsdown = {
 	})
 };
 
-//#endregion
 export { tsdown };

package/dist/vite.config.base.d.ts

@@ -1,6 +1,4 @@
 import { UserConfig } from "vite";
-//#region src/vite.config.base.d.ts
 /** Base Vite config for SPAs */
 export declare const vite: UserConfig;
-//#endregion
 export { vite as default };

package/dist/vite.config.base.js

@@ -1,6 +1,6 @@
 import { resolve } from "node:path";
 
-//#region src/vite.config.base.ts
+// src/vite.config.base.ts
 /** Base Vite config for SPAs */
 const vite = {
 	build: {
@@ -12,5 +12,4 @@ const vite = {
 	resolve: { alias: { "@": resolve(process.cwd(), "src") } }
 };
 
-//#endregion
 export { vite as default, vite };

package/dist/vitest.config.base.d.ts

@@ -1,4 +1,2 @@
-//#region src/vitest.config.base.d.ts
 declare const _default: import("vite").UserConfig;
-//#endregion
 export { _default as default };

package/dist/vitest.config.base.js

@@ -1,6 +1,6 @@
 import { defineConfig } from "vitest/config";
 
-//#region src/vitest.config.base.ts
+// src/vitest.config.base.ts
 var vitest_config_base_default = defineConfig({ test: {
 	globals: true,
 	environment: "node",
@@ -22,5 +22,4 @@ var vitest_config_base_default = defineConfig({ test: {
 	}
 } });
 
-//#endregion
 export { vitest_config_base_default as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ts-builds",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "Shared TypeScript configuration files for library templates. Provides standardized ESLint, Prettier, Vitest, TypeScript, and build configs.",
   "keywords": [
     "typescript",
@@ -115,5 +115,5 @@
   "engines": {
     "node": "^22.12.0 || ^24.0.0 || >=26.0.0"
   },
-  "packageManager": "pnpm@11.27.0+sha512.ad12821463bb143295f1fa3ecde77a6b9b97a7990386da800ff57bffc3964dc64b7b1c7559d5dbe5c337aea659ed9c8937d4370bd198ca2009bc6fa0249808e7"
+  "packageManager": "pnpm@12.15.0+sha512.b3951d6d6ff4a9f13dc7cf56cd28d2b8eb37dbcc9c68e52e1e1191873ea9f82a017287ab50baadc5ccc494f036c67c0e47eb13608c2fa36f47711b61ea128e61"
 }