workspace-conformance 1.6.0 → 1.7.0

package/dist/index.cjs

@@ -5,8 +5,9 @@ let tinyglobby = require("tinyglobby");
 let ts_morph = require("ts-morph");
 let cosmiconfig_extends = require("cosmiconfig-extends");
 let node_fs_promises = require("node:fs/promises");
-let node_module = require("node:module");
+let semver = require("semver");
 let yaml = require("yaml");
+let node_module = require("node:module");
 let node_child_process = require("node:child_process");
 let jsonc_parser = require("jsonc-parser");
 let smol_toml = require("smol-toml");
@@ -782,6 +783,301 @@ const dockerfilePackageManager = async ({ cwd, options }) => {
 	return violations;
 };
 //#endregion
+//#region src/workspace/packages.ts
+function segmentsOf(path) {
+	return path.split("/").filter((segment) => segment !== "" && segment !== ".");
+}
+function groupRoot(group) {
+	return segmentsOf(group.path ?? group.name);
+}
+function startsWithSegments(segments, prefix) {
+	return prefix.every((segment, index) => segments[index] === segment);
+}
+/**
+* The group whose root is the longest prefix of `dir`; the first declared wins a tie. `undefined` when no group owns the directory.
+*/
+function owningGroup(dir, groups) {
+	const segments = segmentsOf(dir);
+	let best;
+	let bestLength = -1;
+	for (const group of groups) {
+		const root = groupRoot(group);
+		if (root.length > bestLength && startsWithSegments(segments, root)) {
+			best = group;
+			bestLength = root.length;
+		}
+	}
+	return best;
+}
+function rankOf(name, group, layout) {
+	if (name !== void 0) {
+		const rule = layout.nameRanks?.find((candidate) => new RegExp(candidate.pattern, "u").test(name));
+		if (rule !== void 0) return rule.rank;
+	}
+	return group.rank ?? layout.defaultRank;
+}
+/**
+* The name without its npm scope: `@scope/store-cli` gives `store-cli`.
+*/
+function unscoped(name) {
+	return name.replace(/^@[^/]+\//u, "");
+}
+/**
+* The longest slice value that is the whole unscoped name or its prefix up to a `-`.
+*/
+function sliceByNamePrefix(name, known) {
+	const bare = unscoped(name);
+	return [...known].filter((candidate) => bare === candidate || bare.startsWith(`${candidate}-`)).sort((a, b) => b.length - a.length)[0];
+}
+/**
+* Classify discovered packages by the layout: group, rank and slice. Pure.
+*
+* A package no group owns is a configuration error, because every check would otherwise skip it without saying so. Nested package directories are one too: the checks attribute a file to the package whose directory is its prefix, which is ambiguous for a package inside another. A `namePrefix` slice takes the longest slice value that a `segment` group produced and that prefixes the package's unscoped name; a package without a name has no such slice.
+*/
+function classifyPackages(discovered, layout) {
+	const owned = discovered.map((found) => {
+		const group = owningGroup(found.dir, layout.groups);
+		if (group === void 0) throw new ConformanceError(`the package directory '${found.dir}' is not under any layout group's path; add a group whose path prefixes it, or narrow the workspace package globs`);
+		return {
+			found,
+			group
+		};
+	});
+	const knownSlices = /* @__PURE__ */ new Set();
+	for (const { found, group } of owned) if (group.slice !== void 0 && "segment" in group.slice) {
+		const value = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
+		if (value !== void 0) knownSlices.add(value);
+	}
+	const packages = owned.map(({ found, group }) => {
+		let slice;
+		if (group.slice !== void 0 && "segment" in group.slice) slice = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
+		else if (group.slice !== void 0 && found.name !== void 0) slice = sliceByNamePrefix(found.name, knownSlices);
+		return {
+			...found,
+			group: group.name,
+			rank: rankOf(found.name, group, layout),
+			slice
+		};
+	});
+	for (const outer of packages) {
+		const nested = packages.find((inner) => inner.dir !== outer.dir && inner.dir.startsWith(`${outer.dir}/`));
+		if (nested !== void 0) throw new ConformanceError(`the package directory '${nested.dir}' is inside the package directory '${outer.dir}'; workspace packages must not nest`);
+	}
+	return packages;
+}
+/**
+* The workspace root: `layout.root` resolved against `cwd`, or `cwd` itself.
+*/
+function workspaceRoot(cwd, layout) {
+	return layout.root === void 0 ? cwd : (0, node_path.resolve)(cwd, layout.root);
+}
+const PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
+/**
+* The `packages` list of `pnpm-workspace.yaml` in `root`, or `undefined` when there is no such file. A file that exists but cannot be read, or has no list of strings under `packages`, is a configuration error.
+*/
+async function pnpmWorkspacePatterns(root) {
+	const file = (0, node_path.join)(root, PNPM_WORKSPACE_FILE);
+	if (!(0, node_fs.existsSync)(file)) return;
+	let source;
+	try {
+		source = await (0, node_fs_promises.readFile)(file, "utf8");
+	} catch (error) {
+		throw new ConformanceError(`${file} cannot be read`, { cause: error });
+	}
+	const document = (0, yaml.parse)(source);
+	if (typeof document !== "object" || document === null || !("packages" in document) || !Array.isArray(document.packages)) throw new ConformanceError(`${file} has no 'packages' list`);
+	const patterns = document.packages;
+	if (!patterns.every((pattern) => typeof pattern === "string")) throw new ConformanceError(`${file}: every entry of 'packages' must be a string`);
+	return patterns;
+}
+/**
+* The package globs: `layout.packages`, else the `packages` list of `pnpm-workspace.yaml` in `root`.
+*/
+async function workspacePatterns(root, layout) {
+	if (layout.packages !== void 0) return layout.packages;
+	const patterns = await pnpmWorkspacePatterns(root);
+	if (patterns === void 0) throw new ConformanceError(`the layout has no 'packages' and ${(0, node_path.join)(root, PNPM_WORKSPACE_FILE)} does not exist`);
+	return patterns;
+}
+async function readName(manifest) {
+	let content;
+	try {
+		content = JSON.parse(await (0, node_fs_promises.readFile)(manifest, "utf8"));
+	} catch (error) {
+		throw new ConformanceError(`${manifest} cannot be read as JSON`, { cause: error });
+	}
+	if (typeof content === "object" && content !== null && "name" in content && typeof content.name === "string") return content.name;
+}
+/**
+* The directories under `root` that the pnpm-style `patterns` select and that hold a `package.json`, sorted. A `!` pattern excludes. The root package itself (`.`) is not a member of any group and is left out.
+*/
+async function discoverPackages(root, patterns) {
+	const manifests = patterns.map((pattern) => pattern.startsWith("!") ? `!${pattern.slice(1)}/**` : `${pattern}/package.json`);
+	const dirs = (await (0, tinyglobby.glob)(manifests, {
+		cwd: root,
+		dot: true,
+		ignore: [INSTALLED_DEPENDENCIES_GLOB],
+		onlyFiles: true
+	})).map((manifest) => manifest.replace(/\/?package\.json$/u, "")).filter((dir) => dir !== "");
+	return Promise.all([...new Set(dirs)].sort().map(async (dir) => ({
+		dir,
+		name: await readName((0, node_path.join)(root, dir, "package.json"))
+	})));
+}
+/**
+* The layout's packages found under the workspace root.
+*/
+async function readWorkspacePackages(cwd, layout) {
+	const root = workspaceRoot(cwd, layout);
+	return classifyPackages(await discoverPackages(root, await workspacePatterns(root, layout)), layout);
+}
+//#endregion
+//#region src/checks/engines-floor.ts
+/**
+* The pattern that selects the root package, the `package.json` in the directory the checks run in.
+*/
+const ROOT_PACKAGE = ".";
+const MANIFEST = "package.json";
+const ANY_INSTALLED_COPY = {};
+const DEPENDENCY_FIELDS = [
+	{
+		field: "dependencies",
+		noun: "dependency",
+		mayBeAbsent: () => false,
+		judgedCopy: () => ANY_INSTALLED_COPY
+	},
+	{
+		field: "optionalDependencies",
+		noun: "optional dependency",
+		mayBeAbsent: () => true,
+		judgedCopy: () => ANY_INSTALLED_COPY
+	},
+	{
+		field: "peerDependencies",
+		noun: "peer dependency",
+		mayBeAbsent: (manifest, name) => {
+			const meta = manifest["peerDependenciesMeta"];
+			const entry = isRecord(meta) ? meta[name] : void 0;
+			return isRecord(entry) && entry["optional"] === true;
+		},
+		judgedCopy: (spec) => {
+			const version = onlyAdmittedVersion(spec);
+			return version === null ? void 0 : { version };
+		}
+	}
+];
+/**
+* The one version `spec` admits, when it is a semver range of a single comparator naming an exact version (`1.2.3` or `=1.2.3`); `null`, as semver gives for no version, for any other range, including one of a single major, and for a spec that is not a semver range (`workspace:^`, a tag or a URL).
+*/
+function onlyAdmittedVersion(spec) {
+	if ((0, semver.validRange)(spec) === null) return null;
+	const [comparators, ...others] = new semver.Range(spec).set;
+	if (comparators === void 0 || others.length > 0 || comparators.length !== 1) return null;
+	const [comparator] = comparators;
+	if (comparator?.operator !== "") return null;
+	return (0, semver.valid)(comparator.value);
+}
+async function readManifest(cwd, file) {
+	let content;
+	try {
+		content = JSON.parse(await (0, node_fs_promises.readFile)((0, node_path.resolve)(cwd, file), "utf8"));
+	} catch (error) {
+		throw new ConformanceError(`${file} cannot be read as JSON`, { cause: error });
+	}
+	if (!isRecord(content)) throw new ConformanceError(`${file} is not a JSON object`);
+	return content;
+}
+/**
+* The `engines.node` range the manifest at `file` declares, or `undefined` when it declares none. A range semver cannot parse is a configuration error, since nothing can be said about the versions it admits.
+*/
+function nodeRange(manifest, file) {
+	const engines = manifest["engines"];
+	if (engines === void 0) return;
+	if (!isRecord(engines)) throw new ConformanceError(`${file}: engines must be an object`);
+	const node = engines["node"];
+	if (node === void 0) return;
+	if (typeof node !== "string") throw new ConformanceError(`${file}: engines.node must be a string, not ${JSON.stringify(node)}`);
+	if ((0, semver.validRange)(node) === null) throw new ConformanceError(`${file}: engines.node '${node}' is not a valid semver range`);
+	return node;
+}
+/**
+* The name and version spec of each dependency a dependency field of the manifest at `file` lists, sorted by name; none when the field is absent.
+*/
+function dependencyEntries(manifest, field, file) {
+	const listed = manifest[field];
+	if (listed === void 0) return [];
+	if (!isRecord(listed)) throw new ConformanceError(`${file}: ${field} must be an object`);
+	return Object.keys(listed).sort().map((name) => {
+		const spec = listed[name];
+		if (typeof spec !== "string") throw new ConformanceError(`${file}: ${field}.${name} must be a string, not ${JSON.stringify(spec)}`);
+		return [name, spec];
+	});
+}
+/**
+* The `package.json` of the dependency `name` as installed for the package in `packageDirectory`, found the way Node finds a package directory: in `node_modules` of the package's own directory, then of each directory above it, stopping at the working directory, since a copy above the workspace is not one its install put there. A symbolic link, as pnpm installs every dependency, is followed. `undefined` when no directory has it.
+*/
+function installedManifest(cwd, packageDirectory, name) {
+	const top = (0, node_path.resolve)(cwd);
+	for (let directory = (0, node_path.resolve)(cwd, packageDirectory);; directory = (0, node_path.dirname)(directory)) {
+		const candidate = (0, node_path.join)(directory, "node_modules", name, MANIFEST);
+		if ((0, node_fs.existsSync)(candidate)) return relativePosix(cwd, candidate);
+		if (directory === top) return;
+	}
+}
+/**
+* The directories of the packages to judge: those `packages` selects, else the root package and the `packages` of `pnpm-workspace.yaml`. Selecting none is a configuration error, so a pattern that matches nothing never reads as a pass.
+*/
+async function packageDirectories(cwd, options) {
+	const patterns = options.packages ?? [ROOT_PACKAGE, ...await pnpmWorkspacePatterns(cwd) ?? []];
+	const members = await discoverPackages(cwd, patterns.filter((pattern) => pattern !== ROOT_PACKAGE));
+	const directories = [...patterns.includes(ROOT_PACKAGE) ? [ROOT_PACKAGE] : [], ...members.map((member) => member.dir)];
+	if (directories.length === 0) throw new ConformanceError(`no package.json is selected by ${patterns.join(", ")}`);
+	return directories;
+}
+/**
+* The `engines.node` range of each package is a subset of the `engines.node` range of each dependency and optional dependency it lists, and of each peer dependency whose range admits a single version, as installed in `node_modules`, so the package admits no Node version that something it needs at run time rejects. A package that declares no range admits every version, so it is reported for each dependency that declares one. A dependency that declares no range constrains nothing and is ignored.
+*
+* The comparison is `semver.subset(package, dependency)`: every version the package's range admits satisfies the dependency's range. A floor alone is not enough, because a range of several lines (`^20.19.0 || ^22.13.0 || >=24`) also rejects the versions between them, which `>=20.19.0` admits. semver compares a range of several comparator sets set by set, so each set of the package's range must lie within one set of the dependency's; a set that only two adjacent dependency sets cover together (`>=22` against `^22.0.0 || >=23`) is reported, and splitting it the same way (`^22.0.0 || >=23`) satisfies the check.
+*
+* A peer dependency is judged only when its range admits a single version (`1.2.3` or `=1.2.3`), and then by the copy installed, which must be that version. The consumer chooses which admitted version to install, so the package's range holds when each Node version in it is accepted by some admitted version; one installed copy that rejects a Node version does not show that every admitted version does, and the others are not on disk.
+*
+* A dependency that is not installed fails the run: its range cannot be read, and passing it unjudged would read as a pass. An optional dependency and a peer dependency marked optional in `peerDependenciesMeta` may be absent and are then skipped.
+*/
+const enginesFloor = async ({ cwd, options }) => {
+	const violations = [];
+	for (const directory of await packageDirectories(cwd, options)) {
+		const file = node_path.posix.join(directory, MANIFEST);
+		const manifest = await readManifest(cwd, file);
+		const own = nodeRange(manifest, file);
+		const seen = /* @__PURE__ */ new Set();
+		for (const { field, noun, mayBeAbsent, judgedCopy } of DEPENDENCY_FIELDS) for (const [name, spec] of dependencyEntries(manifest, field, file).filter(([candidate]) => !seen.has(candidate))) {
+			seen.add(name);
+			const copy = judgedCopy(spec);
+			if (copy === void 0) continue;
+			const installed = installedManifest(cwd, directory, name);
+			if (installed === void 0) {
+				if (mayBeAbsent(manifest, name)) continue;
+				throw new ConformanceError(`${file}: the ${noun} '${name}' is not installed (no node_modules/${name}/package.json in its directory or any directory above it up to the working directory); install the workspace before running engines-floor`);
+			}
+			const dependency = await readManifest(cwd, installed);
+			if (copy.version !== void 0 && dependency["version"] !== copy.version) throw new ConformanceError(`${file}: the ${noun} '${name}' admits only version ${copy.version}, but ${installed} is version ${String(dependency["version"])}; install the workspace before running engines-floor`);
+			const theirs = nodeRange(dependency, installed);
+			if (theirs === void 0) continue;
+			if (own === void 0) violations.push({
+				code: "engines-floor/no-engines",
+				message: `no engines.node is declared, so every Node version is admitted, but the ${noun} '${name}' requires engines.node '${theirs}'; declare a subset of that range`,
+				file
+			});
+			else if (!(0, semver.subset)(own, theirs)) violations.push({
+				code: "engines-floor/wider-than-dependency",
+				message: `engines.node '${own}' admits Node versions that the ${noun} '${name}' rejects with engines.node '${theirs}'; narrow it to a subset of that range`,
+				file
+			});
+		}
+	}
+	return violations;
+};
+//#endregion
 //#region src/checks/eslint.ts
 /**
 * The patterns the full level lints when the options name none.
@@ -1110,145 +1406,6 @@ function unresolvedNameImportRule(packages) {
 	};
 }
 //#endregion
-//#region src/workspace/packages.ts
-function segmentsOf(path) {
-	return path.split("/").filter((segment) => segment !== "" && segment !== ".");
-}
-function groupRoot(group) {
-	return segmentsOf(group.path ?? group.name);
-}
-function startsWithSegments(segments, prefix) {
-	return prefix.every((segment, index) => segments[index] === segment);
-}
-/**
-* The group whose root is the longest prefix of `dir`; the first declared wins a tie. `undefined` when no group owns the directory.
-*/
-function owningGroup(dir, groups) {
-	const segments = segmentsOf(dir);
-	let best;
-	let bestLength = -1;
-	for (const group of groups) {
-		const root = groupRoot(group);
-		if (root.length > bestLength && startsWithSegments(segments, root)) {
-			best = group;
-			bestLength = root.length;
-		}
-	}
-	return best;
-}
-function rankOf(name, group, layout) {
-	if (name !== void 0) {
-		const rule = layout.nameRanks?.find((candidate) => new RegExp(candidate.pattern, "u").test(name));
-		if (rule !== void 0) return rule.rank;
-	}
-	return group.rank ?? layout.defaultRank;
-}
-/**
-* The name without its npm scope: `@scope/store-cli` gives `store-cli`.
-*/
-function unscoped(name) {
-	return name.replace(/^@[^/]+\//u, "");
-}
-/**
-* The longest slice value that is the whole unscoped name or its prefix up to a `-`.
-*/
-function sliceByNamePrefix(name, known) {
-	const bare = unscoped(name);
-	return [...known].filter((candidate) => bare === candidate || bare.startsWith(`${candidate}-`)).sort((a, b) => b.length - a.length)[0];
-}
-/**
-* Classify discovered packages by the layout: group, rank and slice. Pure.
-*
-* A package no group owns is a configuration error, because every check would otherwise skip it without saying so. Nested package directories are one too: the checks attribute a file to the package whose directory is its prefix, which is ambiguous for a package inside another. A `namePrefix` slice takes the longest slice value that a `segment` group produced and that prefixes the package's unscoped name; a package without a name has no such slice.
-*/
-function classifyPackages(discovered, layout) {
-	const owned = discovered.map((found) => {
-		const group = owningGroup(found.dir, layout.groups);
-		if (group === void 0) throw new ConformanceError(`the package directory '${found.dir}' is not under any layout group's path; add a group whose path prefixes it, or narrow the workspace package globs`);
-		return {
-			found,
-			group
-		};
-	});
-	const knownSlices = /* @__PURE__ */ new Set();
-	for (const { found, group } of owned) if (group.slice !== void 0 && "segment" in group.slice) {
-		const value = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
-		if (value !== void 0) knownSlices.add(value);
-	}
-	const packages = owned.map(({ found, group }) => {
-		let slice;
-		if (group.slice !== void 0 && "segment" in group.slice) slice = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
-		else if (group.slice !== void 0 && found.name !== void 0) slice = sliceByNamePrefix(found.name, knownSlices);
-		return {
-			...found,
-			group: group.name,
-			rank: rankOf(found.name, group, layout),
-			slice
-		};
-	});
-	for (const outer of packages) {
-		const nested = packages.find((inner) => inner.dir !== outer.dir && inner.dir.startsWith(`${outer.dir}/`));
-		if (nested !== void 0) throw new ConformanceError(`the package directory '${nested.dir}' is inside the package directory '${outer.dir}'; workspace packages must not nest`);
-	}
-	return packages;
-}
-/**
-* The workspace root: `layout.root` resolved against `cwd`, or `cwd` itself.
-*/
-function workspaceRoot(cwd, layout) {
-	return layout.root === void 0 ? cwd : (0, node_path.resolve)(cwd, layout.root);
-}
-/**
-* The package globs: `layout.packages`, else the `packages` list of `pnpm-workspace.yaml` in `root`.
-*/
-async function workspacePatterns(root, layout) {
-	if (layout.packages !== void 0) return layout.packages;
-	const file = (0, node_path.join)(root, "pnpm-workspace.yaml");
-	let source;
-	try {
-		source = await (0, node_fs_promises.readFile)(file, "utf8");
-	} catch (error) {
-		throw new ConformanceError(`the layout has no 'packages' and ${file} cannot be read`, { cause: error });
-	}
-	const document = (0, yaml.parse)(source);
-	if (typeof document !== "object" || document === null || !("packages" in document) || !Array.isArray(document.packages)) throw new ConformanceError(`${file} has no 'packages' list`);
-	const patterns = document.packages;
-	if (!patterns.every((pattern) => typeof pattern === "string")) throw new ConformanceError(`${file}: every entry of 'packages' must be a string`);
-	return patterns;
-}
-async function readName(manifest) {
-	let content;
-	try {
-		content = JSON.parse(await (0, node_fs_promises.readFile)(manifest, "utf8"));
-	} catch (error) {
-		throw new ConformanceError(`${manifest} cannot be read as JSON`, { cause: error });
-	}
-	if (typeof content === "object" && content !== null && "name" in content && typeof content.name === "string") return content.name;
-}
-/**
-* The directories under `root` that the pnpm-style `patterns` select and that hold a `package.json`, sorted. A `!` pattern excludes. The root package itself (`.`) is not a member of any group and is left out.
-*/
-async function discoverPackages(root, patterns) {
-	const manifests = patterns.map((pattern) => pattern.startsWith("!") ? `!${pattern.slice(1)}/**` : `${pattern}/package.json`);
-	const dirs = (await (0, tinyglobby.glob)(manifests, {
-		cwd: root,
-		dot: true,
-		ignore: [INSTALLED_DEPENDENCIES_GLOB],
-		onlyFiles: true
-	})).map((manifest) => manifest.replace(/\/?package\.json$/u, "")).filter((dir) => dir !== "");
-	return Promise.all([...new Set(dirs)].sort().map(async (dir) => ({
-		dir,
-		name: await readName((0, node_path.join)(root, dir, "package.json"))
-	})));
-}
-/**
-* The layout's packages found under the workspace root.
-*/
-async function readWorkspacePackages(cwd, layout) {
-	const root = workspaceRoot(cwd, layout);
-	return classifyPackages(await discoverPackages(root, await workspacePatterns(root, layout)), layout);
-}
-//#endregion
 //#region src/checks/import-graph.ts
 /**
 * Paths left out of the import graph unless the options say otherwise: a package's own installed dependencies.
@@ -3331,6 +3488,7 @@ const checks = zod.z.strictObject({
 		commitlint: zod.z.exactOptional(path),
 		release: zod.z.exactOptional(path)
 	}))),
+	"engines-floor": zod.z.exactOptional(enabled(zod.z.strictObject({ packages: zod.z.exactOptional(paths) }))),
 	"dockerfile-package-manager": zod.z.exactOptional(enabled(zod.z.strictObject({
 		dockerfiles: zod.z.exactOptional(paths),
 		exclude: zod.z.exactOptional(paths),
@@ -3624,6 +3782,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["commit-types"]),
 		check: commitTypes
 	}),
+	"engines-floor": plain({
+		name: "engines-floor",
+		description: "A package's engines.node range admits no Node version that one of its installed dependencies rejects",
+		select: (checks) => enabledOptions(checks["engines-floor"]),
+		check: enginesFloor
+	}),
 	"dockerfile-package-manager": plain({
 		name: "dockerfile-package-manager",
 		description: "A package manager version pinned in a Dockerfile is the version packageManager names",
@@ -3953,6 +4117,7 @@ exports.derivedTypes = derivedTypes;
 exports.dockerfilePackageManager = dockerfilePackageManager;
 exports.effectiveEnv = effectiveEnv;
 exports.effectivePermissions = effectivePermissions;
+exports.enginesFloor = enginesFloor;
 exports.eslint = eslint;
 exports.generators = generators;
 exports.handlerCases = handlerCases;

package/dist/index.d.cts

@@ -524,6 +524,15 @@ interface CommitTypesOptions {
    */
   readonly release?: string;
 }
+/**
+ * Options of the `engines-floor` check: the `engines.node` range of a package is a subset of the `engines.node` range of each of its installed dependencies.
+ */
+interface EnginesFloorOptions {
+  /**
+   * Globs of the package directories to judge, in the form of the `packages` list of `pnpm-workspace.yaml` (a `!` pattern excludes), relative to the directory the checks run in; `.` is the root package. The root package and the `packages` of `pnpm-workspace.yaml`, when that file exists, when omitted.
+   */
+  readonly packages?: readonly string[];
+}
 /**
  * Options of the `dockerfile-package-manager` check: a package manager version pinned in a Dockerfile is the one `packageManager` names.
  */
@@ -790,6 +799,7 @@ interface CheckOptionsByName {
   readonly "instruction-symlinks": InstructionSymlinksOptions;
   readonly "single-storybook": SingleStorybookOptions;
   readonly "commit-types": CommitTypesOptions;
+  readonly "engines-floor": EnginesFloorOptions;
   readonly "dockerfile-package-manager": DockerfilePackageManagerOptions;
   readonly "migrations-directory": MigrationsDirectoryOptions;
   readonly eslint: EslintOptions;
@@ -872,6 +882,18 @@ export declare const derivedTypes: CheckFunction<DerivedTypesOptions>;
  */
 export declare const dockerfilePackageManager: CheckFunction<DockerfilePackageManagerOptions>;
 //#endregion
+//#region src/checks/engines-floor.d.ts
+/**
+ * The `engines.node` range of each package is a subset of the `engines.node` range of each dependency and optional dependency it lists, and of each peer dependency whose range admits a single version, as installed in `node_modules`, so the package admits no Node version that something it needs at run time rejects. A package that declares no range admits every version, so it is reported for each dependency that declares one. A dependency that declares no range constrains nothing and is ignored.
+ *
+ * The comparison is `semver.subset(package, dependency)`: every version the package's range admits satisfies the dependency's range. A floor alone is not enough, because a range of several lines (`^20.19.0 || ^22.13.0 || >=24`) also rejects the versions between them, which `>=20.19.0` admits. semver compares a range of several comparator sets set by set, so each set of the package's range must lie within one set of the dependency's; a set that only two adjacent dependency sets cover together (`>=22` against `^22.0.0 || >=23`) is reported, and splitting it the same way (`^22.0.0 || >=23`) satisfies the check.
+ *
+ * A peer dependency is judged only when its range admits a single version (`1.2.3` or `=1.2.3`), and then by the copy installed, which must be that version. The consumer chooses which admitted version to install, so the package's range holds when each Node version in it is accepted by some admitted version; one installed copy that rejects a Node version does not show that every admitted version does, and the others are not on disk.
+ *
+ * A dependency that is not installed fails the run: its range cannot be read, and passing it unjudged would read as a pass. An optional dependency and a peer dependency marked optional in `peerDependenciesMeta` may be absent and are then skipped.
+ */
+export declare const enginesFloor: CheckFunction<EnginesFloorOptions>;
+//#endregion
 //#region src/checks/eslint.d.ts
 /**
  * Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
@@ -1386,4 +1408,4 @@ export declare function proveExhaustive(input: {
   readonly compilerOptions?: CompilerOptions;
 }): ExhaustivenessProof;
 //#endregion
-export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CodecPairsOptions, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowReleaseJobOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };
+export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CodecPairsOptions, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EnginesFloorOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowReleaseJobOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };

package/dist/index.d.ts

@@ -524,6 +524,15 @@ interface CommitTypesOptions {
    */
   readonly release?: string;
 }
+/**
+ * Options of the `engines-floor` check: the `engines.node` range of a package is a subset of the `engines.node` range of each of its installed dependencies.
+ */
+interface EnginesFloorOptions {
+  /**
+   * Globs of the package directories to judge, in the form of the `packages` list of `pnpm-workspace.yaml` (a `!` pattern excludes), relative to the directory the checks run in; `.` is the root package. The root package and the `packages` of `pnpm-workspace.yaml`, when that file exists, when omitted.
+   */
+  readonly packages?: readonly string[];
+}
 /**
  * Options of the `dockerfile-package-manager` check: a package manager version pinned in a Dockerfile is the one `packageManager` names.
  */
@@ -790,6 +799,7 @@ interface CheckOptionsByName {
   readonly "instruction-symlinks": InstructionSymlinksOptions;
   readonly "single-storybook": SingleStorybookOptions;
   readonly "commit-types": CommitTypesOptions;
+  readonly "engines-floor": EnginesFloorOptions;
   readonly "dockerfile-package-manager": DockerfilePackageManagerOptions;
   readonly "migrations-directory": MigrationsDirectoryOptions;
   readonly eslint: EslintOptions;
@@ -872,6 +882,18 @@ export declare const derivedTypes: CheckFunction<DerivedTypesOptions>;
  */
 export declare const dockerfilePackageManager: CheckFunction<DockerfilePackageManagerOptions>;
 //#endregion
+//#region src/checks/engines-floor.d.ts
+/**
+ * The `engines.node` range of each package is a subset of the `engines.node` range of each dependency and optional dependency it lists, and of each peer dependency whose range admits a single version, as installed in `node_modules`, so the package admits no Node version that something it needs at run time rejects. A package that declares no range admits every version, so it is reported for each dependency that declares one. A dependency that declares no range constrains nothing and is ignored.
+ *
+ * The comparison is `semver.subset(package, dependency)`: every version the package's range admits satisfies the dependency's range. A floor alone is not enough, because a range of several lines (`^20.19.0 || ^22.13.0 || >=24`) also rejects the versions between them, which `>=20.19.0` admits. semver compares a range of several comparator sets set by set, so each set of the package's range must lie within one set of the dependency's; a set that only two adjacent dependency sets cover together (`>=22` against `^22.0.0 || >=23`) is reported, and splitting it the same way (`^22.0.0 || >=23`) satisfies the check.
+ *
+ * A peer dependency is judged only when its range admits a single version (`1.2.3` or `=1.2.3`), and then by the copy installed, which must be that version. The consumer chooses which admitted version to install, so the package's range holds when each Node version in it is accepted by some admitted version; one installed copy that rejects a Node version does not show that every admitted version does, and the others are not on disk.
+ *
+ * A dependency that is not installed fails the run: its range cannot be read, and passing it unjudged would read as a pass. An optional dependency and a peer dependency marked optional in `peerDependenciesMeta` may be absent and are then skipped.
+ */
+export declare const enginesFloor: CheckFunction<EnginesFloorOptions>;
+//#endregion
 //#region src/checks/eslint.d.ts
 /**
  * Proves the repository's own ESLint is applied, which no check that runs inside ESLint can notice: a config that dropped a shared preset, switched its rules off or narrowed `ignores` until nothing is linted still passes its own lint.
@@ -1386,4 +1408,4 @@ export declare function proveExhaustive(input: {
   readonly compilerOptions?: CompilerOptions;
 }): ExhaustivenessProof;
 //#endregion
-export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CodecPairsOptions, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowReleaseJobOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };
+export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CodecPairsOptions, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EnginesFloorOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowReleaseJobOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };