workspace-conformance 1.6.0 → 1.7.0

package/README.md

@@ -159,6 +159,8 @@ Code: `derived-types/not-derived`, reported at the type's declaration. Limits: a
 
 **`commit-types`** verifies that the commit types commitlint accepts are accounted for in the semantic-release config. Options: `commitlint` (`commitlint.config.ts`) and `release` (`release.config.ts`). Both files are evaluated through the shared jiti loader, so a list derived from one shared constant compares as its values. The `alias` and `fsCache` of `runChecks`' `configFiles` apply to them as to the sections; `trust` and `merge` are for `extends` and do not. A commit type that no conventional preset knows (`PRESET_COMMIT_TYPES` lists the ones that do) must have a `releaseRules` entry in the `@semantic-release/commit-analyzer` options and, when `presetConfig.types` of `@semantic-release/release-notes-generator` is set, a changelog section. Every `releaseRules` type and every changelog type must be a commit type, or it can never apply. A preset type may be left out of either list, which is how a release rule list normally omits the types that do not release. Codes: `commit-types/no-release-rule`, `release-rule-not-a-commit-type`, `no-changelog-section`, `changelog-section-not-a-commit-type`, `no-type-enum` (a type no preset knows is listed but commitlint sets no `type-enum`, so the commit types cannot be read) and `missing-config`. Without `presetConfig.types` (or without a release notes generator) no changelog sections are listed, so none is required. Limits: `type-enum` is read as `[level, 'always', [types]]`, the only accepted types; `'never'` forbids the types it lists (a release rule or section for one is reported) and enumerates none, so nothing is required of any other type, and level 0 accepts every type; any other shape of the rule fails the check; `releaseRules` given as a module path (a string, which semantic-release supports) is not read and fails the check; types that come only from an extended preset are not read; rules that name no type (`{ breaking: true }`) are ignored; a changelog list that omits a preset type is not reported; the configs are executed, so they must be trusted.
 
+**`engines-floor`** verifies that the `engines.node` range of each package is a subset of the `engines.node` range of each dependency and optional dependency it lists, and of each peer dependency whose range admits a single version, as installed, so the package admits no Node version that something it needs at run time rejects. A floor comparison is not enough: a package declaring `>=20` over a dependency requiring `^20.19.0 || ^22.13.0 || >=24` admits 20.0 to 20.18, 21 and 23, which the dependency rejects, so the test is `semver.subset(package, dependency)`. Option: `packages`, globs of the package directories in the form of the `packages` list of `pnpm-workspace.yaml` (a `!` pattern excludes, `.` is the root package); the root package and the `packages` of `pnpm-workspace.yaml`, when it exists, when omitted. Codes: `engines-floor/wider-than-dependency` (the range admits a version the dependency rejects) and `no-engines` (the package declares no range, so admits every version, while a dependency declares one), each reported at the package's `package.json` and naming the dependency and both ranges. A dependency that declares no range constrains nothing and is ignored. `devDependencies` are not judged: a consumer never installs them, and the Node the development toolchain needs is the repository's own concern, not a claim the published package makes. A dependency is found the way Node finds a package directory, in `node_modules` of the package's directory and then of each directory above it up to the working directory, following the symbolic links pnpm installs; it reads the dependency's `package.json` directly rather than resolving an entry point, since an `exports` map need not expose `package.json`. A peer dependency is judged only when its range is a single version (`1.2.3` or `=1.2.3`), by the installed copy, which must be that version or the run fails. The consumer, not the package, chooses which version of a peer to install, so the package's range holds when each Node version in it is accepted by some version the peer range admits. The copy installed in the workspace is one of those versions: if it rejects a Node version the package admits, another admitted version may accept it (`^9.0.0 || ^10.0.0` with cosmiconfig 10 requiring `^22.18 || >= 24` while cosmiconfig 9 accepts 22.13, and equally an earlier minor of a single major), and the versions that are not installed cannot be read without the registry, so judging the range by that copy reports packages that are correct. A range of one version leaves the consumer no choice, so its installed copy decides; a peer that is not judged need not be installed. A dependency that is not installed fails the run with a configuration error, because its range cannot be read; an optional dependency, or a peer dependency marked optional in `peerDependenciesMeta`, may be absent and is then skipped. A range semver cannot parse, in the package or a dependency, and options that select no package also fail the run. Limits: semver compares a range of several comparator sets set by set, so each set of the package's range must lie within one set of the dependency's, and a set that two adjacent dependency sets only cover together (`>=22` against `^22.0.0 || >=23`) is reported until it is split the same way; a peer dependency whose range admits more than one version is not judged at all, so a package can claim a Node version that no admitted version of a peer accepts; prerelease Node versions are not considered.
+
 **`dockerfile-package-manager`** verifies that a package manager version pinned in a Dockerfile is the one `packageManager` names, ignoring a `+sha` suffix on either side. Options: `dockerfiles` (`Dockerfile`, `Dockerfile.*` and `*.Dockerfile` at any depth), `exclude` (globs left out of the search) and `packageJson` (`package.json`). Only pins of the package manager `packageManager` names are compared: `pnpm@12.4.1` on a `RUN` line is compared, `npm@latest` is not. Codes: `dockerfile-package-manager/version-mismatch` (with line and column) and `no-package-manager`. A version that refers to a variable (`pnpm@${PNPM_VERSION}` or `pnpm@$PNPM_VERSION`) is compared with the value an `ARG` or `ENV` earlier in the same file gives it. Limits: it reads `<manager>@<version>` as written on a line that is not a comment; a variable the file gives no value (an `ARG` without a default, whose value the build supplies) or whose value refers to another variable is not compared; the value in effect is the latest one set before the pin, whichever build stage set it; and an unpinned `pnpm@latest` is a mismatch.
 
 **`migrations-directory`** verifies that the directory a schema generator writes migrations to is the directory the deploy tool applies them from, and that no `package.json` script applies them with the generator in place of the deploy tool. It is tool specific, so the generator and the deploy tool are named in the options, each has an adapter that knows its config file names and where in the config the directory is, and the supported pair is `drizzle-kit` (`out` of `drizzle.config.ts`, `.js` or `.json`, `drizzle` when unset) with `wrangler` (`migrations_dir` of a `d1_databases` entry of `wrangler.json`, `.jsonc` or `.toml`, `migrations` when unset). Both directories are resolved against the directory of the file that sets them, and `..` segments and trailing separators are normalised. Adapters are two small interfaces (`GeneratorAdapter` and `DeployToolAdapter`, with `generators` and `deployTools` as the registries), so another tool is one object and an entry in `generatorNames` or `deployToolNames`.
@@ -311,7 +313,7 @@ it('conforms to the workspace layout', async () => {
 });
 ```
 
-Every check is also exported as a function taking `{ cwd, options }` (and `layout` for the import checks): `aggregateMappers`, `codecPairs`, `commandTypes`, `derivedTypes`, `importUphill`, `importRankSkip`, `importCrossSlice`, `importIsolatedGroups`, `importCycles`, `instructionSymlinks`, `singleStorybook`, `commitTypes`, `dockerfilePackageManager`, `migrationsDirectory`, `eslint`, the workflow checks (`workflowJobOrdering`, `workflowSkippableJobs`, `workflowRunnerResolution`, `workflowVersionSingleSource`, `workflowCredentials`, `workflowReleaseJob`, `workflowRepositoryDispatch`, `workflowUpdateBotCooldown`, `workflowMergeGroup` and `workflowActionPinning`) and, taking `{ cwd, options, github }`, the settings checks (`settingsMergeMethods`, `settingsRequiredChecks` and `settingsReviewThreadResolution`). These take options and a layout as already validated and do not check them again; go through `runChecks` for validation. `parseWorkflow` and `loadWorkflows` expose the workflow model the workflow checks read. A check is a function that returns `Promise<readonly Violation[]>`, where a `Violation` is `{ code, message, file, location? }`.
+Every check is also exported as a function taking `{ cwd, options }` (and `layout` for the import checks): `aggregateMappers`, `codecPairs`, `commandTypes`, `derivedTypes`, `importUphill`, `importRankSkip`, `importCrossSlice`, `importIsolatedGroups`, `importCycles`, `instructionSymlinks`, `singleStorybook`, `commitTypes`, `enginesFloor`, `dockerfilePackageManager`, `migrationsDirectory`, `eslint`, the workflow checks (`workflowJobOrdering`, `workflowSkippableJobs`, `workflowRunnerResolution`, `workflowVersionSingleSource`, `workflowCredentials`, `workflowReleaseJob`, `workflowRepositoryDispatch`, `workflowUpdateBotCooldown`, `workflowMergeGroup` and `workflowActionPinning`) and, taking `{ cwd, options, github }`, the settings checks (`settingsMergeMethods`, `settingsRequiredChecks` and `settingsReviewThreadResolution`). These take options and a layout as already validated and do not check them again; go through `runChecks` for validation. `parseWorkflow` and `loadWorkflows` expose the workflow model the workflow checks read. A check is a function that returns `Promise<readonly Violation[]>`, where a `Violation` is `{ code, message, file, location? }`.
 
 ### Proving a handler map is exhaustive
 

package/dist/cli.js

@@ -8,8 +8,9 @@ import { escapePath, glob, isDynamicPattern } from "tinyglobby";
 import { Node, Project, SyntaxKind } from "ts-morph";
 import { createJitiLoader, validateStandard } from "cosmiconfig-extends";
 import { readFile, realpath } from "node:fs/promises";
-import { execFile } from "node:child_process";
+import { Range, subset, valid, validRange } from "semver";
 import { LineCounter, isMap, isNode, isScalar, isSeq, parse, parseDocument } from "yaml";
+import { execFile } from "node:child_process";
 import { findNodeAtLocation, parse as parse$1, parseTree, printParseErrorCode } from "jsonc-parser";
 import { parse as parse$2 } from "smol-toml";
 import { defineSection, layoutSection, loadSection } from "@exadev/config";
@@ -852,6 +853,301 @@ const dockerfilePackageManager = async ({ cwd, options }) => {
 	}
 	return violations;
 };
+//#endregion
+//#region src/workspace/packages.ts
+function segmentsOf(path) {
+	return path.split("/").filter((segment) => segment !== "" && segment !== ".");
+}
+function groupRoot(group) {
+	return segmentsOf(group.path ?? group.name);
+}
+function startsWithSegments(segments, prefix) {
+	return prefix.every((segment, index) => segments[index] === segment);
+}
+/**
+* The group whose root is the longest prefix of `dir`; the first declared wins a tie. `undefined` when no group owns the directory.
+*/
+function owningGroup(dir, groups) {
+	const segments = segmentsOf(dir);
+	let best;
+	let bestLength = -1;
+	for (const group of groups) {
+		const root = groupRoot(group);
+		if (root.length > bestLength && startsWithSegments(segments, root)) {
+			best = group;
+			bestLength = root.length;
+		}
+	}
+	return best;
+}
+function rankOf(name, group, layout) {
+	if (name !== void 0) {
+		const rule = layout.nameRanks?.find((candidate) => new RegExp(candidate.pattern, "u").test(name));
+		if (rule !== void 0) return rule.rank;
+	}
+	return group.rank ?? layout.defaultRank;
+}
+/**
+* The name without its npm scope: `@scope/store-cli` gives `store-cli`.
+*/
+function unscoped(name) {
+	return name.replace(/^@[^/]+\//u, "");
+}
+/**
+* The longest slice value that is the whole unscoped name or its prefix up to a `-`.
+*/
+function sliceByNamePrefix(name, known) {
+	const bare = unscoped(name);
+	return [...known].filter((candidate) => bare === candidate || bare.startsWith(`${candidate}-`)).sort((a, b) => b.length - a.length)[0];
+}
+/**
+* Classify discovered packages by the layout: group, rank and slice. Pure.
+*
+* A package no group owns is a configuration error, because every check would otherwise skip it without saying so. Nested package directories are one too: the checks attribute a file to the package whose directory is its prefix, which is ambiguous for a package inside another. A `namePrefix` slice takes the longest slice value that a `segment` group produced and that prefixes the package's unscoped name; a package without a name has no such slice.
+*/
+function classifyPackages(discovered, layout) {
+	const owned = discovered.map((found) => {
+		const group = owningGroup(found.dir, layout.groups);
+		if (group === void 0) throw new ConformanceError(`the package directory '${found.dir}' is not under any layout group's path; add a group whose path prefixes it, or narrow the workspace package globs`);
+		return {
+			found,
+			group
+		};
+	});
+	const knownSlices = /* @__PURE__ */ new Set();
+	for (const { found, group } of owned) if (group.slice !== void 0 && "segment" in group.slice) {
+		const value = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
+		if (value !== void 0) knownSlices.add(value);
+	}
+	const packages = owned.map(({ found, group }) => {
+		let slice;
+		if (group.slice !== void 0 && "segment" in group.slice) slice = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
+		else if (group.slice !== void 0 && found.name !== void 0) slice = sliceByNamePrefix(found.name, knownSlices);
+		return {
+			...found,
+			group: group.name,
+			rank: rankOf(found.name, group, layout),
+			slice
+		};
+	});
+	for (const outer of packages) {
+		const nested = packages.find((inner) => inner.dir !== outer.dir && inner.dir.startsWith(`${outer.dir}/`));
+		if (nested !== void 0) throw new ConformanceError(`the package directory '${nested.dir}' is inside the package directory '${outer.dir}'; workspace packages must not nest`);
+	}
+	return packages;
+}
+/**
+* The workspace root: `layout.root` resolved against `cwd`, or `cwd` itself.
+*/
+function workspaceRoot(cwd, layout) {
+	return layout.root === void 0 ? cwd : resolve(cwd, layout.root);
+}
+const PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
+/**
+* The `packages` list of `pnpm-workspace.yaml` in `root`, or `undefined` when there is no such file. A file that exists but cannot be read, or has no list of strings under `packages`, is a configuration error.
+*/
+async function pnpmWorkspacePatterns(root) {
+	const file = join(root, PNPM_WORKSPACE_FILE);
+	if (!existsSync(file)) return;
+	let source;
+	try {
+		source = await readFile(file, "utf8");
+	} catch (error) {
+		throw new ConformanceError(`${file} cannot be read`, { cause: error });
+	}
+	const document = parse(source);
+	if (typeof document !== "object" || document === null || !("packages" in document) || !Array.isArray(document.packages)) throw new ConformanceError(`${file} has no 'packages' list`);
+	const patterns = document.packages;
+	if (!patterns.every((pattern) => typeof pattern === "string")) throw new ConformanceError(`${file}: every entry of 'packages' must be a string`);
+	return patterns;
+}
+/**
+* The package globs: `layout.packages`, else the `packages` list of `pnpm-workspace.yaml` in `root`.
+*/
+async function workspacePatterns(root, layout) {
+	if (layout.packages !== void 0) return layout.packages;
+	const patterns = await pnpmWorkspacePatterns(root);
+	if (patterns === void 0) throw new ConformanceError(`the layout has no 'packages' and ${join(root, PNPM_WORKSPACE_FILE)} does not exist`);
+	return patterns;
+}
+async function readName(manifest) {
+	let content;
+	try {
+		content = JSON.parse(await readFile(manifest, "utf8"));
+	} catch (error) {
+		throw new ConformanceError(`${manifest} cannot be read as JSON`, { cause: error });
+	}
+	if (typeof content === "object" && content !== null && "name" in content && typeof content.name === "string") return content.name;
+}
+/**
+* The directories under `root` that the pnpm-style `patterns` select and that hold a `package.json`, sorted. A `!` pattern excludes. The root package itself (`.`) is not a member of any group and is left out.
+*/
+async function discoverPackages(root, patterns) {
+	const manifests = patterns.map((pattern) => pattern.startsWith("!") ? `!${pattern.slice(1)}/**` : `${pattern}/package.json`);
+	const dirs = (await glob(manifests, {
+		cwd: root,
+		dot: true,
+		ignore: [INSTALLED_DEPENDENCIES_GLOB],
+		onlyFiles: true
+	})).map((manifest) => manifest.replace(/\/?package\.json$/u, "")).filter((dir) => dir !== "");
+	return Promise.all([...new Set(dirs)].sort().map(async (dir) => ({
+		dir,
+		name: await readName(join(root, dir, "package.json"))
+	})));
+}
+/**
+* The layout's packages found under the workspace root.
+*/
+async function readWorkspacePackages(cwd, layout) {
+	const root = workspaceRoot(cwd, layout);
+	return classifyPackages(await discoverPackages(root, await workspacePatterns(root, layout)), layout);
+}
+//#endregion
+//#region src/checks/engines-floor.ts
+/**
+* The pattern that selects the root package, the `package.json` in the directory the checks run in.
+*/
+const ROOT_PACKAGE = ".";
+const MANIFEST = "package.json";
+const ANY_INSTALLED_COPY = {};
+const DEPENDENCY_FIELDS = [
+	{
+		field: "dependencies",
+		noun: "dependency",
+		mayBeAbsent: () => false,
+		judgedCopy: () => ANY_INSTALLED_COPY
+	},
+	{
+		field: "optionalDependencies",
+		noun: "optional dependency",
+		mayBeAbsent: () => true,
+		judgedCopy: () => ANY_INSTALLED_COPY
+	},
+	{
+		field: "peerDependencies",
+		noun: "peer dependency",
+		mayBeAbsent: (manifest, name) => {
+			const meta = manifest["peerDependenciesMeta"];
+			const entry = isRecord(meta) ? meta[name] : void 0;
+			return isRecord(entry) && entry["optional"] === true;
+		},
+		judgedCopy: (spec) => {
+			const version = onlyAdmittedVersion(spec);
+			return version === null ? void 0 : { version };
+		}
+	}
+];
+/**
+* The one version `spec` admits, when it is a semver range of a single comparator naming an exact version (`1.2.3` or `=1.2.3`); `null`, as semver gives for no version, for any other range, including one of a single major, and for a spec that is not a semver range (`workspace:^`, a tag or a URL).
+*/
+function onlyAdmittedVersion(spec) {
+	if (validRange(spec) === null) return null;
+	const [comparators, ...others] = new Range(spec).set;
+	if (comparators === void 0 || others.length > 0 || comparators.length !== 1) return null;
+	const [comparator] = comparators;
+	if (comparator?.operator !== "") return null;
+	return valid(comparator.value);
+}
+async function readManifest(cwd, file) {
+	let content;
+	try {
+		content = JSON.parse(await readFile(resolve(cwd, file), "utf8"));
+	} catch (error) {
+		throw new ConformanceError(`${file} cannot be read as JSON`, { cause: error });
+	}
+	if (!isRecord(content)) throw new ConformanceError(`${file} is not a JSON object`);
+	return content;
+}
+/**
+* The `engines.node` range the manifest at `file` declares, or `undefined` when it declares none. A range semver cannot parse is a configuration error, since nothing can be said about the versions it admits.
+*/
+function nodeRange(manifest, file) {
+	const engines = manifest["engines"];
+	if (engines === void 0) return;
+	if (!isRecord(engines)) throw new ConformanceError(`${file}: engines must be an object`);
+	const node = engines["node"];
+	if (node === void 0) return;
+	if (typeof node !== "string") throw new ConformanceError(`${file}: engines.node must be a string, not ${JSON.stringify(node)}`);
+	if (validRange(node) === null) throw new ConformanceError(`${file}: engines.node '${node}' is not a valid semver range`);
+	return node;
+}
+/**
+* The name and version spec of each dependency a dependency field of the manifest at `file` lists, sorted by name; none when the field is absent.
+*/
+function dependencyEntries(manifest, field, file) {
+	const listed = manifest[field];
+	if (listed === void 0) return [];
+	if (!isRecord(listed)) throw new ConformanceError(`${file}: ${field} must be an object`);
+	return Object.keys(listed).sort().map((name) => {
+		const spec = listed[name];
+		if (typeof spec !== "string") throw new ConformanceError(`${file}: ${field}.${name} must be a string, not ${JSON.stringify(spec)}`);
+		return [name, spec];
+	});
+}
+/**
+* The `package.json` of the dependency `name` as installed for the package in `packageDirectory`, found the way Node finds a package directory: in `node_modules` of the package's own directory, then of each directory above it, stopping at the working directory, since a copy above the workspace is not one its install put there. A symbolic link, as pnpm installs every dependency, is followed. `undefined` when no directory has it.
+*/
+function installedManifest(cwd, packageDirectory, name) {
+	const top = resolve(cwd);
+	for (let directory = resolve(cwd, packageDirectory);; directory = dirname(directory)) {
+		const candidate = join(directory, "node_modules", name, MANIFEST);
+		if (existsSync(candidate)) return relativePosix(cwd, candidate);
+		if (directory === top) return;
+	}
+}
+/**
+* The directories of the packages to judge: those `packages` selects, else the root package and the `packages` of `pnpm-workspace.yaml`. Selecting none is a configuration error, so a pattern that matches nothing never reads as a pass.
+*/
+async function packageDirectories(cwd, options) {
+	const patterns = options.packages ?? [ROOT_PACKAGE, ...await pnpmWorkspacePatterns(cwd) ?? []];
+	const members = await discoverPackages(cwd, patterns.filter((pattern) => pattern !== ROOT_PACKAGE));
+	const directories = [...patterns.includes(ROOT_PACKAGE) ? [ROOT_PACKAGE] : [], ...members.map((member) => member.dir)];
+	if (directories.length === 0) throw new ConformanceError(`no package.json is selected by ${patterns.join(", ")}`);
+	return directories;
+}
+/**
+* The `engines.node` range of each package is a subset of the `engines.node` range of each dependency and optional dependency it lists, and of each peer dependency whose range admits a single version, as installed in `node_modules`, so the package admits no Node version that something it needs at run time rejects. A package that declares no range admits every version, so it is reported for each dependency that declares one. A dependency that declares no range constrains nothing and is ignored.
+*
+* The comparison is `semver.subset(package, dependency)`: every version the package's range admits satisfies the dependency's range. A floor alone is not enough, because a range of several lines (`^20.19.0 || ^22.13.0 || >=24`) also rejects the versions between them, which `>=20.19.0` admits. semver compares a range of several comparator sets set by set, so each set of the package's range must lie within one set of the dependency's; a set that only two adjacent dependency sets cover together (`>=22` against `^22.0.0 || >=23`) is reported, and splitting it the same way (`^22.0.0 || >=23`) satisfies the check.
+*
+* A peer dependency is judged only when its range admits a single version (`1.2.3` or `=1.2.3`), and then by the copy installed, which must be that version. The consumer chooses which admitted version to install, so the package's range holds when each Node version in it is accepted by some admitted version; one installed copy that rejects a Node version does not show that every admitted version does, and the others are not on disk.
+*
+* A dependency that is not installed fails the run: its range cannot be read, and passing it unjudged would read as a pass. An optional dependency and a peer dependency marked optional in `peerDependenciesMeta` may be absent and are then skipped.
+*/
+const enginesFloor = async ({ cwd, options }) => {
+	const violations = [];
+	for (const directory of await packageDirectories(cwd, options)) {
+		const file = posix.join(directory, MANIFEST);
+		const manifest = await readManifest(cwd, file);
+		const own = nodeRange(manifest, file);
+		const seen = /* @__PURE__ */ new Set();
+		for (const { field, noun, mayBeAbsent, judgedCopy } of DEPENDENCY_FIELDS) for (const [name, spec] of dependencyEntries(manifest, field, file).filter(([candidate]) => !seen.has(candidate))) {
+			seen.add(name);
+			const copy = judgedCopy(spec);
+			if (copy === void 0) continue;
+			const installed = installedManifest(cwd, directory, name);
+			if (installed === void 0) {
+				if (mayBeAbsent(manifest, name)) continue;
+				throw new ConformanceError(`${file}: the ${noun} '${name}' is not installed (no node_modules/${name}/package.json in its directory or any directory above it up to the working directory); install the workspace before running engines-floor`);
+			}
+			const dependency = await readManifest(cwd, installed);
+			if (copy.version !== void 0 && dependency["version"] !== copy.version) throw new ConformanceError(`${file}: the ${noun} '${name}' admits only version ${copy.version}, but ${installed} is version ${String(dependency["version"])}; install the workspace before running engines-floor`);
+			const theirs = nodeRange(dependency, installed);
+			if (theirs === void 0) continue;
+			if (own === void 0) violations.push({
+				code: "engines-floor/no-engines",
+				message: `no engines.node is declared, so every Node version is admitted, but the ${noun} '${name}' requires engines.node '${theirs}'; declare a subset of that range`,
+				file
+			});
+			else if (!subset(own, theirs)) violations.push({
+				code: "engines-floor/wider-than-dependency",
+				message: `engines.node '${own}' admits Node versions that the ${noun} '${name}' rejects with engines.node '${theirs}'; narrow it to a subset of that range`,
+				file
+			});
+		}
+	}
+	return violations;
+};
 async function git(cwd, args) {
 	return new Promise((resolve, reject) => {
 		execFile("git", [...args], {
@@ -2345,145 +2641,6 @@ function unresolvedNameImportRule(packages) {
 	};
 }
 //#endregion
-//#region src/workspace/packages.ts
-function segmentsOf(path) {
-	return path.split("/").filter((segment) => segment !== "" && segment !== ".");
-}
-function groupRoot(group) {
-	return segmentsOf(group.path ?? group.name);
-}
-function startsWithSegments(segments, prefix) {
-	return prefix.every((segment, index) => segments[index] === segment);
-}
-/**
-* The group whose root is the longest prefix of `dir`; the first declared wins a tie. `undefined` when no group owns the directory.
-*/
-function owningGroup(dir, groups) {
-	const segments = segmentsOf(dir);
-	let best;
-	let bestLength = -1;
-	for (const group of groups) {
-		const root = groupRoot(group);
-		if (root.length > bestLength && startsWithSegments(segments, root)) {
-			best = group;
-			bestLength = root.length;
-		}
-	}
-	return best;
-}
-function rankOf(name, group, layout) {
-	if (name !== void 0) {
-		const rule = layout.nameRanks?.find((candidate) => new RegExp(candidate.pattern, "u").test(name));
-		if (rule !== void 0) return rule.rank;
-	}
-	return group.rank ?? layout.defaultRank;
-}
-/**
-* The name without its npm scope: `@scope/store-cli` gives `store-cli`.
-*/
-function unscoped(name) {
-	return name.replace(/^@[^/]+\//u, "");
-}
-/**
-* The longest slice value that is the whole unscoped name or its prefix up to a `-`.
-*/
-function sliceByNamePrefix(name, known) {
-	const bare = unscoped(name);
-	return [...known].filter((candidate) => bare === candidate || bare.startsWith(`${candidate}-`)).sort((a, b) => b.length - a.length)[0];
-}
-/**
-* Classify discovered packages by the layout: group, rank and slice. Pure.
-*
-* A package no group owns is a configuration error, because every check would otherwise skip it without saying so. Nested package directories are one too: the checks attribute a file to the package whose directory is its prefix, which is ambiguous for a package inside another. A `namePrefix` slice takes the longest slice value that a `segment` group produced and that prefixes the package's unscoped name; a package without a name has no such slice.
-*/
-function classifyPackages(discovered, layout) {
-	const owned = discovered.map((found) => {
-		const group = owningGroup(found.dir, layout.groups);
-		if (group === void 0) throw new ConformanceError(`the package directory '${found.dir}' is not under any layout group's path; add a group whose path prefixes it, or narrow the workspace package globs`);
-		return {
-			found,
-			group
-		};
-	});
-	const knownSlices = /* @__PURE__ */ new Set();
-	for (const { found, group } of owned) if (group.slice !== void 0 && "segment" in group.slice) {
-		const value = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
-		if (value !== void 0) knownSlices.add(value);
-	}
-	const packages = owned.map(({ found, group }) => {
-		let slice;
-		if (group.slice !== void 0 && "segment" in group.slice) slice = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
-		else if (group.slice !== void 0 && found.name !== void 0) slice = sliceByNamePrefix(found.name, knownSlices);
-		return {
-			...found,
-			group: group.name,
-			rank: rankOf(found.name, group, layout),
-			slice
-		};
-	});
-	for (const outer of packages) {
-		const nested = packages.find((inner) => inner.dir !== outer.dir && inner.dir.startsWith(`${outer.dir}/`));
-		if (nested !== void 0) throw new ConformanceError(`the package directory '${nested.dir}' is inside the package directory '${outer.dir}'; workspace packages must not nest`);
-	}
-	return packages;
-}
-/**
-* The workspace root: `layout.root` resolved against `cwd`, or `cwd` itself.
-*/
-function workspaceRoot(cwd, layout) {
-	return layout.root === void 0 ? cwd : resolve(cwd, layout.root);
-}
-/**
-* The package globs: `layout.packages`, else the `packages` list of `pnpm-workspace.yaml` in `root`.
-*/
-async function workspacePatterns(root, layout) {
-	if (layout.packages !== void 0) return layout.packages;
-	const file = join(root, "pnpm-workspace.yaml");
-	let source;
-	try {
-		source = await readFile(file, "utf8");
-	} catch (error) {
-		throw new ConformanceError(`the layout has no 'packages' and ${file} cannot be read`, { cause: error });
-	}
-	const document = parse(source);
-	if (typeof document !== "object" || document === null || !("packages" in document) || !Array.isArray(document.packages)) throw new ConformanceError(`${file} has no 'packages' list`);
-	const patterns = document.packages;
-	if (!patterns.every((pattern) => typeof pattern === "string")) throw new ConformanceError(`${file}: every entry of 'packages' must be a string`);
-	return patterns;
-}
-async function readName(manifest) {
-	let content;
-	try {
-		content = JSON.parse(await readFile(manifest, "utf8"));
-	} catch (error) {
-		throw new ConformanceError(`${manifest} cannot be read as JSON`, { cause: error });
-	}
-	if (typeof content === "object" && content !== null && "name" in content && typeof content.name === "string") return content.name;
-}
-/**
-* The directories under `root` that the pnpm-style `patterns` select and that hold a `package.json`, sorted. A `!` pattern excludes. The root package itself (`.`) is not a member of any group and is left out.
-*/
-async function discoverPackages(root, patterns) {
-	const manifests = patterns.map((pattern) => pattern.startsWith("!") ? `!${pattern.slice(1)}/**` : `${pattern}/package.json`);
-	const dirs = (await glob(manifests, {
-		cwd: root,
-		dot: true,
-		ignore: [INSTALLED_DEPENDENCIES_GLOB],
-		onlyFiles: true
-	})).map((manifest) => manifest.replace(/\/?package\.json$/u, "")).filter((dir) => dir !== "");
-	return Promise.all([...new Set(dirs)].sort().map(async (dir) => ({
-		dir,
-		name: await readName(join(root, dir, "package.json"))
-	})));
-}
-/**
-* The layout's packages found under the workspace root.
-*/
-async function readWorkspacePackages(cwd, layout) {
-	const root = workspaceRoot(cwd, layout);
-	return classifyPackages(await discoverPackages(root, await workspacePatterns(root, layout)), layout);
-}
-//#endregion
 //#region src/checks/import-graph.ts
 /**
 * Paths left out of the import graph unless the options say otherwise: a package's own installed dependencies.
@@ -3405,6 +3562,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["commit-types"]),
 		check: commitTypes
 	}),
+	"engines-floor": plain({
+		name: "engines-floor",
+		description: "A package's engines.node range admits no Node version that one of its installed dependencies rejects",
+		select: (checks) => enabledOptions(checks["engines-floor"]),
+		check: enginesFloor
+	}),
 	"dockerfile-package-manager": plain({
 		name: "dockerfile-package-manager",
 		description: "A package manager version pinned in a Dockerfile is the version packageManager names",
@@ -3609,6 +3772,7 @@ const checks = z.strictObject({
 		commitlint: z.exactOptional(path),
 		release: z.exactOptional(path)
 	}))),
+	"engines-floor": z.exactOptional(enabled(z.strictObject({ packages: z.exactOptional(paths) }))),
 	"dockerfile-package-manager": z.exactOptional(enabled(z.strictObject({
 		dockerfiles: z.exactOptional(paths),
 		exclude: z.exactOptional(paths),