ts-builds 4.0.1 → 4.0.2

package/dist/cli.js

@@ -894,39 +894,54 @@ async function cleanup() {
 
 // src/cli/pnpm11.ts
 const HOIST_LINE = /^public-hoist-pattern\[\]=(.+)$/;
-const RELEASE_AGE_LINE = /(@?[^\s@/]+(?:\/[^\s@]+)?@[^\s]+)\s+was published.*minimumReleaseAge/;
+const PKG_VERSION = String.raw`@?[^\s@/]+(?:\/[^\s@]+)?@\S+`;
+const RELEASE_AGE_VIOLATION = new RegExp(`(${PKG_VERSION}) was published (?:at \\S+, )?within the minimumReleaseAge`, "g");
+const AUTO_EXCLUDE_HEADER = /^Added \d+ entr\S* to minimumReleaseAgeExclude/;
+const AUTO_EXCLUDE_ENTRY = new RegExp(`^\\s+(${PKG_VERSION})$`);
 /**
 * Pure parser (no I/O): extracts the flagged `pkg@version` tokens from captured
-* pnpm output. Order-preserving and de-duplicated. Returns [] for unrelated or
-* empty output so callers never emit false warnings.
+* pnpm output, in either the strict or the lenient shape. Order-preserving and
+* de-duplicated. Returns [] for unrelated or empty output so callers never emit
+* false warnings.
 */
 function parseReleaseAgeViolations(stdout, stderr) {
-	const tokens = `${stdout}\n${stderr}`.split("\n").map((line) => RELEASE_AGE_LINE.exec(line.trim())?.[1]).filter((token) => token !== void 0);
-	return List(tokens).distinct().toArray();
+	const output = `${stdout}\n${stderr}`;
+	const strict = [...output.replace(/-\r?\n\s+/g, "-").replace(/\s+/g, " ").matchAll(RELEASE_AGE_VIOLATION)].map((match) => match[1]);
+	return List([...strict, ...autoExcludedEntries(output)]).distinct().toArray();
+}
+/** The `pkg@version` lines listed under pnpm's lenient-mode "Added N entries" header. */
+function autoExcludedEntries(output) {
+	const lines = output.split("\n").map((raw) => raw.trimEnd());
+	const start = lines.findIndex((line) => AUTO_EXCLUDE_HEADER.test(line.trim()));
+	if (start === -1) return [];
+	const body = lines.slice(start + 1);
+	const end = body.findIndex((line) => !AUTO_EXCLUDE_ENTRY.test(line));
+	return matchFirstGroups(end === -1 ? body : body.slice(0, end), AUTO_EXCLUDE_ENTRY);
 }
 /** Pure helper: the suggested pnpm-workspace.yaml exclude line for a flagged token. */
 function buildReleaseAgeExcludeLine(pkgVersion) {
 	return `minimumReleaseAgeExclude:\n${renderExcludeEntry(releaseAgeExcludeEntry(pkgVersion))}`;
 }
+/** The command the default probe runs. Exported so warnings and tests name it exactly. */
+const RELEASE_AGE_PROBE_ARGS = ["install", "--lockfile-only"];
 /**
-* Default probe: runs `pnpm install --resolution-only`, which re-runs resolution
-* (re-applying minimumReleaseAge) and captures its output. If pnpm is not on PATH
-* the spawn errors and we return status -1 so detection degrades quietly.
+* Default probe: runs `pnpm install --lockfile-only`, which resolves anything the
+* lockfile does not already pin (re-applying minimumReleaseAge) without installing
+* packages, and captures its output. `--lockfile-only` exists in pnpm 11 and 12;
+* the `--resolution-only` flag this used before was removed in pnpm 12. If pnpm is
+* not on PATH the spawn errors and we return status -1 so detection degrades quietly.
 *
-* SNAPSHOT/RESTORE: `--resolution-only` is NOT non-mutating in general. When the
-* committed `pnpm-lock.yaml` is stale or doesn't match resolution, pnpm REWRITES
-* it to match (it only avoids writing when it ABORTS on a violation). A read-only
-* diagnostic must never touch a consumer's lockfile, so we snapshot the exact
-* bytes before spawning and restore them in a `finally` — putting the file back
-* exactly as found (or removing one the probe created where none existed).
-* `--resolution-only` does not install packages, so node_modules is not a concern.
+* SNAPSHOT/RESTORE: the run is NOT non-mutating. pnpm rewrites `pnpm-lock.yaml`
+* to match resolution, and in lenient mode it also writes the violating packages
+* into `pnpm-workspace.yaml` itself. A read-only diagnostic must never touch a
+* consumer's files, so we snapshot the exact bytes of both files — in `dir` and at
+* the workspace root pnpm resolves from — and restore them in a `finally`, putting
+* each back exactly as found (or removing one the probe created where none existed).
 */
 const defaultReleaseAgeProbe = (dir) => {
-	const lockPath = join(dir, "pnpm-lock.yaml");
-	const lockExisted = existsSync(lockPath);
-	const originalLock = lockExisted ? readFileSync(lockPath) : void 0;
+	const snapshots = probeWrittenFiles(dir).map(snapshotFile);
 	try {
-		const result = spawnSync("pnpm", ["install", "--resolution-only"], {
+		const result = spawnSync("pnpm", [...RELEASE_AGE_PROBE_ARGS], {
 			cwd: dir,
 			encoding: "utf-8",
 			env: process.env
@@ -939,13 +954,46 @@ const defaultReleaseAgeProbe = (dir) => {
 		return {
 			stdout: result.stdout ?? "",
 			stderr: result.stderr ?? "",
-			status: result.status ?? 1
+			status: result.status ?? 1,
+			autoExcluded: snapshots.flatMap(addedExcludeEntries)
 		};
 	} finally {
-		if (lockExisted && originalLock !== void 0) writeFileSync(lockPath, originalLock);
-		else if (!lockExisted && existsSync(lockPath)) rmSync(lockPath, { force: true });
+		snapshots.forEach(restoreFile);
 	}
 };
+/** The `minimumReleaseAgeExclude` entries a `pnpm-workspace.yaml` gained since its snapshot. */
+function addedExcludeEntries({ path, bytes }) {
+	if (basename(path) !== "pnpm-workspace.yaml" || !isFile(path)) return [];
+	const before = readReleaseAgeExcludeEntries(bytes.fold(() => "", (original) => original.toString("utf-8")));
+	return readReleaseAgeExcludeEntries(readFileSync(path, "utf-8")).toArray().filter((entry) => !before.has(entry));
+}
+/**
+* `pnpm-lock.yaml` and `pnpm-workspace.yaml` in `dir` and at its workspace root,
+* if it has one. A path that exists but is not a regular file is left untracked,
+* since pnpm cannot have written it either.
+*/
+function probeWrittenFiles(dir) {
+	const roots = findWorkspaceRoot(dir).fold(() => [dir], (root) => [dir, root]);
+	return List(roots).distinct().toArray().flatMap((root) => [join(root, "pnpm-lock.yaml"), join(root, "pnpm-workspace.yaml")]).filter((path) => !existsSync(path) || isFile(path));
+}
+const isFile = (path) => existsSync(path) && statSync(path).isFile();
+/** The nearest directory at or above `dir` holding a `pnpm-workspace.yaml`. */
+function findWorkspaceRoot(dir) {
+	if (isFile(join(dir, "pnpm-workspace.yaml"))) return Option(dir);
+	const parent = dirname(dir);
+	return parent === dir ? Option.none() : findWorkspaceRoot(parent);
+}
+function snapshotFile(path) {
+	return {
+		path,
+		bytes: existsSync(path) ? Option(readFileSync(path)) : Option.none()
+	};
+}
+function restoreFile({ path, bytes }) {
+	bytes.fold(() => {
+		if (existsSync(path)) rmSync(path, { force: true });
+	}, (original) => writeFileSync(path, original));
+}
 /**
 * Curated set of packages whose build scripts are known to be unnecessary under
 * pnpm 11's strictDepBuilds. Extend ONLY after verification — this list drives
@@ -996,11 +1044,34 @@ function detectAllowBuildsIssues(dir) {
 	}));
 }
 function detectReleaseAgeIssues(dir, probe) {
-	const { stdout, stderr } = probe(dir);
-	return parseReleaseAgeViolations(stdout, stderr).map((pkgVersion) => ({
+	const result = probe(dir);
+	const { stdout, stderr, status } = result;
+	const violations = probeViolations(result);
+	if (violations.length > 0) return violations.map((pkgVersion) => ({
 		severity: "warning",
 		message: `${pkgVersion} is newer than the pnpm minimumReleaseAge cutoff — add to pnpm-workspace.yaml to allow it:\n      ${buildReleaseAgeExcludeLine(pkgVersion)}`
 	}));
+	return probeFailure(stdout, stderr, status).map((message) => [{
+		severity: "warning",
+		message
+	}]).orElse([]);
+}
+/** Every flagged `pkg@version`, from pnpm's output and from the entries it wrote. */
+function probeViolations({ stdout, stderr, autoExcluded = [] }) {
+	return List([...parseReleaseAgeViolations(stdout, stderr), ...autoExcluded]).distinct().toArray();
+}
+/**
+* A message when the probe ran pnpm and pnpm failed without reporting a violation,
+* meaning the release-age check never actually ran. That must not read as "ready".
+* Status -1 (pnpm not installed) stays quiet: there is nothing to check against.
+*/
+function probeFailure(stdout, stderr, status) {
+	if (status <= 0) return Option.none();
+	const lines = `${stderr}\n${stdout}`.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+	const reason = lines.find((line) => line.includes("ERR_PNPM")) ?? lines.at(0);
+	const command = `pnpm ${RELEASE_AGE_PROBE_ARGS.join(" ")}`;
+	const detail = reason === void 0 ? "" : `: ${reason}`;
+	return Option(`Could not check minimumReleaseAge: \`${command}\` exited ${status}${detail}`);
 }
 function readHoistPatterns(npmrc) {
 	return npmrc.split("\n").map((line) => HOIST_LINE.exec(line.trim())).filter((m) => m !== null).map((m) => m[1]);
@@ -1096,11 +1167,14 @@ function renderExcludeEntry(entry) {
 }
 /**
 * Pure parser: returns the set of entries already listed under
-* `minimumReleaseAgeExclude:`, normalized (quotes stripped). Same manual
-* line-by-line style as readAllowBuildsKeys — stops at the next top-level key.
+* `minimumReleaseAgeExclude:`, normalized (quotes stripped). pnpm itself writes
+* scoped entries single-quoted (`- '@scope/name@1.0.0'`); we write them
+* double-quoted. Same manual line-by-line style as readAllowBuildsKeys — stops at
+* the next top-level key.
 */
 function readReleaseAgeExcludeEntries(yaml) {
-	return Set(matchFirstGroups(blockLines(yaml, /^minimumReleaseAgeExclude:/), /^\s*-\s*"?([^"]+?)"?\s*$/));
+	const entryLine = /^\s*-\s*(["']?)([^"'\s#]+)\1\s*(?:#.*)?$/;
+	return Set(blockLines(yaml, /^minimumReleaseAgeExclude:/).map((line) => entryLine.exec(line)?.[2]).filter((entry) => entry !== void 0));
 }
 /**
 * Insert YAML list entries (already rendered as `  - x` lines) into an existing
@@ -1275,8 +1349,26 @@ function migratePackageJsonPnpm(dir, ws) {
 * sourceMutation is needed — it joins the same single ws write.
 */
 function migrateReleaseAgeExcludes(dir, ws, probe) {
-	const { stdout, stderr } = probe(dir);
-	const violations = parseReleaseAgeViolations(stdout, stderr);
+	const result = probe(dir);
+	const { stdout, stderr, status } = result;
+	const violations = probeViolations(result);
+	if (violations.length === 0) return probeFailure(stdout, stderr, status).fold(() => noChange(ws), (message) => ({
+		ws,
+		actions: [{
+			kind: "skipped",
+			message
+		}],
+		sourceMutations: []
+	}));
+	const outerRoot = findWorkspaceRoot(dir).filter((root) => root !== dir);
+	if (outerRoot.isSome()) return outerRoot.fold(() => noChange(ws), (root) => ({
+		ws,
+		actions: [{
+			kind: "manual",
+			message: `${violations.length} package(s) are newer than the minimumReleaseAge cutoff, but this is a workspace package — run 'ts-builds doctor --fix' from the workspace root (${root}) to add them to its pnpm-workspace.yaml`
+		}],
+		sourceMutations: []
+	}));
 	const covered = readReleaseAgeExcludeEntries(ws).map(releaseAgeExcludeEntry);
 	const newEntries = List(violations.map(releaseAgeExcludeEntry)).filter((entry) => !covered.has(entry)).distinct().toArray();
 	if (newEntries.length === 0) return noChange(ws);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ts-builds",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "Shared TypeScript configuration files for library templates. Provides standardized ESLint, Prettier, Vitest, TypeScript, and build configs.",
   "keywords": [
     "typescript",
@@ -115,5 +115,5 @@
   "engines": {
     "node": "^22.12.0 || ^24.0.0 || >=26.0.0"
   },
-  "packageManager": "pnpm@11.27.0+sha512.ad12821463bb143295f1fa3ecde77a6b9b97a7990386da800ff57bffc3964dc64b7b1c7559d5dbe5c337aea659ed9c8937d4370bd198ca2009bc6fa0249808e7"
+  "packageManager": "pnpm@12.15.0+sha512.b3951d6d6ff4a9f13dc7cf56cd28d2b8eb37dbcc9c68e52e1e1191873ea9f82a017287ab50baadc5ccc494f036c67c0e47eb13608c2fa36f47711b61ea128e61"
 }