Version Packages

[NSchatz]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@cosyte/eslint-config@0.0.6

Changelog

All notable changes to @cosyte/eslint-config are documented here, following
Keep a Changelog. Versions are managed with Changesets;
this file is hand-maintained (Changesets' own changelog generation is disabled). The package stays on
the 0.0.x-until-first-alpha ladder.

Because the generator is disabled, [Unreleased] is promoted to a version heading BY HAND, in
the pull request that adds the changeset. Nothing does it automatically. Until 2026-08-04 nothing
did it at all, so shipped content stayed under [Unreleased] and every release republished it.

[Unreleased]

Changed

• The sections below were relabelled: content that had already shipped was still sitting under
  [Unreleased], so each release republished it. Every section now carries the version it shipped
  in. No rule, option, or behaviour change; the CHANGELOG.md inside the published tarball is the
  only thing that differs.

[0.0.5] - 2026-07-31

Changed

• Documentation and source comments no longer use em dashes, in line with the cosyte brand
  voice. No rule, option, or behaviour change.

[0.0.4] - 2026-06-26

Added

• Application mode: cosyte(rootDir, { library: false }) drops the JSDoc + @example gate and
  no-console while keeping every type-safety rule (no any, no unjustified casts, exhaustiveness,
  strict imports). Libraries (the default, library: true) are unchanged. This makes applications,
  like the pathways engine, first-class consumers of the one shared config instead of forking it:
  an app has no published API surface to document and legitimately logs.

[0.0.3] - 2026-06-25

Changed

• ESLint 10 baseline: @eslint/js ^10, eslint-plugin-jsdoc ^63, typescript-eslint ^8.62,
  eslint-config-prettier ^10.1. The eslint peer accepts ^9 || ^10 during the suite's migration
  window; it will tighten to ^10 once every repo is on ESLint 10.

Added

• typescript is now a declared peer dependency (the type-checked rules require it).

[0.0.2] - 2026-06-24

Added

• Initial release of the ESLint 9 flat config: recommendedTypeChecked + the cosyte guardrails (no any,
  no unjustified casts, JSDoc + @example gate on public exports, no-console in library code).

  (0.0.1 was never published.)

@cosyte/prettier-config@0.0.4

Changelog

All notable changes to @cosyte/prettier-config are documented here, following
Keep a Changelog. Versions are managed with Changesets;
this file is hand-maintained (Changesets' own changelog generation is disabled). The package stays on
the 0.0.x-until-first-alpha ladder.

Because the generator is disabled, [Unreleased] is promoted to a version heading BY HAND, in
the pull request that adds the changeset. Nothing does it automatically. Until 2026-08-04 nothing
did it at all, so shipped content stayed under [Unreleased] and every release republished it.

[Unreleased]

Changed

• The sections below were relabelled: content that had already shipped was still sitting under
  [Unreleased], so each release republished it. Every section now carries the version it shipped
  in. No setting change; the CHANGELOG.md inside the published tarball is the only thing that
  differs.

[0.0.3] - 2026-07-31

Changed

• Documentation no longer uses em dashes, in line with the cosyte brand voice. No setting
  change.

[0.0.2] - 2026-06-25

Added

• Package README.md and this CHANGELOG.md (now shipped in the published tarball).

[0.0.1] - 2026-06-24

Added

• Initial release: the shared Prettier settings (printWidth 100, double quotes, semicolons, trailing
  commas, arrowParens: always, LF) with *.md / JSON / YAML overrides.

@cosyte/test-utils@0.0.3

Changelog

All notable changes to @cosyte/test-utils are documented here, following
Keep a Changelog. Versions are managed with Changesets;
this file is hand-maintained (Changesets' own changelog generation is disabled). The package stays on
the 0.0.x-until-first-alpha ladder.

Because the generator is disabled, [Unreleased] is promoted to a version heading BY HAND, in
the pull request that adds the changeset. Nothing does it automatically. Until 2026-08-04 nothing
did it at all, so shipped content stayed under [Unreleased] and every release republished it.

[Unreleased]

Changed

• The sections below were relabelled: content that had already shipped was still sitting under
  [Unreleased], so each release republished it. Every section now carries the version it shipped
  in. No runner or API change; the CHANGELOG.md inside the published tarball is the only thing that
  differs.

[0.0.2] - 2026-07-31

Added

• assertNoDiagnosticPhiLeak, a runner proving that consumer-controlled input does not echo into a
  diagnostic surface. For every slot the caller declares it sweeps each diagnostic message, the
  whole diagnostic rendered as JSON, as util.inspect, and by a walk of the object graph,
  err.message, err.stack, the thrown value itself, and every structural identifier the caller
  enumerates on the model. The walk is what reaches a nested toString, raw bytes attached as
  context, and entries past inspect's truncation ceilings, none of which either summary rendering
  shows. Matching is case-insensitive, so a value upper-cased on conformance grounds still fails.
  What it proves, stated narrowly: no verbatim echo of four or more bytes of a planted value, on
  a slot that provably reached the diagnostic it names. It does not prove the absence of a
  re-encoded echo, an echo shorter than four bytes, or a leak through an undeclared slot.
• Each slot must name the diagnostic code it expects, and the runner asserts that code appeared in
  lenient mode. Counting diagnostics is not enough: an unrelated warning can otherwise stand in for
  the one the slot exists to trigger, leaving the leaking branch unentered and the suite green. The
  assertion is lenient-only because a strict mode throws on the first deviation, so only one slot
  could ever satisfy its own code there. Strict mode keeps its sweep.
• getDiagnostics, getModelIdentifiers and parseStrict are required rather than defaulted.
  () => [] and null are legitimate answers; silence is not, and a silent default reading only
  .warnings would report green on a model it had half-read.
• Opt-in checkLengthInvariance catches a re-encoded echo by comparing diagnostic sizes across a
  short and a long planted value. Off by default because a diagnostic carrying an input-derived
  number, such as a position column gaining digits or a byte count, grows the same way and is
  correct.
• Exercised by constructed positive controls, each isolating the one surface it names, and by
  controls asserting the runner stays green where a correct parser would otherwise be failed.

Changed

• Documentation, source comments, the npm package description, and seven assertion-failure
  message strings no longer use em dashes, in line with the cosyte brand voice. No API, type, or
  behaviour change: the message strings are the diagnostics a failing conformance run prints.

[0.0.1] - 2026-06-26

Added

• First real release of the conformance kit: the first built (publishable) package in config.
  Framework-agnostic, fast-check-powered (peer dep ^3), throws on failure so any runner catches
  it. Public API:
  • roundTripProperty: parse(serialize(x)) equals x (deep-equal default or custom equals)
    plus serialize-idempotency.
  • lenientNeverThrowsProperty: parse throws only on sanctioned fatals; every recovered warning
    carries a registered code and (optionally) positional context.
  • immutabilityProperty: a mutation attempt throws or returns a new instance; the original is
    never edited in place.
  • sortedCodeSet: sorted warning/fatal code values for a snapshot stability tripwire.
  • assertNoSecretLeak: the PHI-leak matrix across JSON.stringify, String(), template-literal
    interpolation, and util.inspect, naming the leaking channel on failure.
• Dual ESM + CJS build via @cosyte/tsup-config with per-condition types (.d.ts / .d.cts),
  attw as a publish gate.

@cosyte/tsconfig@0.0.4

Changelog

All notable changes to @cosyte/tsconfig are documented here, following
Keep a Changelog. Versions are managed with Changesets;
this file is hand-maintained (Changesets' own changelog generation is disabled). The package stays on
the 0.0.x-until-first-alpha ladder.

Because the generator is disabled, [Unreleased] is promoted to a version heading BY HAND, in
the pull request that adds the changeset. Nothing does it automatically. Until 2026-08-04 nothing
did it at all, so shipped content stayed under [Unreleased] and every release republished it.

[Unreleased]

Changed

• The sections below were relabelled: content that had already shipped was still sitting under
  [Unreleased], so each release republished it. Every section now carries the version it shipped
  in. No compiler-option change; the CHANGELOG.md inside the published tarball is the only thing
  that differs.

[0.0.3] - 2026-07-31

Changed

• Documentation no longer uses em dashes, in line with the cosyte brand voice. No
  compiler-option change.

[0.0.2] - 2026-06-25

Changed

• target and lib raised from ES2022 to ES2023 (the suite's Node ≥ 22 floor supports it).

[0.0.1] - 2026-06-24

Added

• Initial release: base.json (strict type-check baseline) and library.json (base.json + emit).

@cosyte/tsup-config@0.0.3

Changelog

All notable changes to @cosyte/tsup-config are documented here, following
Keep a Changelog. Versions are managed with Changesets;
this file is hand-maintained (Changesets' own changelog generation is disabled). The package stays on
the 0.0.x-until-first-alpha ladder.

Because the generator is disabled, [Unreleased] is promoted to a version heading BY HAND, in
the pull request that adds the changeset. Nothing does it automatically. Until 2026-08-04 nothing
did it at all, so shipped content stayed under [Unreleased] and every release republished it.

[Unreleased]

Changed

• The sections below were relabelled: content that had already shipped was still sitting under
  [Unreleased], so each release republished it. Every section now carries the version it shipped
  in. No build-option change; the CHANGELOG.md inside the published tarball is the only thing that
  differs.

[0.0.2] - 2026-07-31

Changed

• Documentation no longer uses em dashes, in line with the cosyte brand voice. No build-option
  change.

[0.0.1] - 2026-06-25

Added

• Initial release of cosyteTsup(overrides): the standard dual ESM + CJS, ES2023, Node-platform tsup
  build config for @cosyte/* libraries.

@cosyte/vitest-config@0.0.4

Changelog

All notable changes to @cosyte/vitest-config are documented here, following
Keep a Changelog. Versions are managed with Changesets;
this file is hand-maintained (Changesets' own changelog generation is disabled). The package stays on
the 0.0.x-until-first-alpha ladder.

Because the generator is disabled, [Unreleased] is promoted to a version heading BY HAND, in
the pull request that adds the changeset. Nothing does it automatically. Until 2026-08-04 nothing
did it at all, so shipped content stayed under [Unreleased] and every release republished it.

[Unreleased]

Changed

• The sections below were relabelled: content that had already shipped was still sitting under
  [Unreleased], so each release republished it. Every section now carries the version it shipped
  in. No config or behaviour change; the CHANGELOG.md inside the published tarball is the only
  thing that differs.

[0.0.3] - 2026-07-31

Changed

• Documentation and source comments no longer use em dashes, in line with the cosyte brand
  voice. No config or behaviour change.

[0.0.2] - 2026-07-15

Added

• Declared vite (^6 || ^7 || ^8) as a peer dependency. Vitest 4 requires vite >= 6, and the
  resolver otherwise keeps an incompatible vite 5 (missing the ./module-runner export).
• Doc/code-agreement harness on a new @cosyte/vitest-config/snippets subpath: docSnippetSuite()
  plus the factored primitives (extractRunnableSnippets, rewriteAssertions, remapImports,
  runSnippet). It extracts every fenced ```ts runnable block from a package's docs-content/,
  compiles it, executes it against the package, and asserts its inline // => value results: the
  documentation analog of the conformance runners, so a green docs build can never carry a snippet
  that silently disagrees with the code. devDep-only; Vitest is already a peer, so no new dependency.

[0.0.1] - 2026-06-25

Added

• Initial release of cosyteVitest(opts): v8 coverage, standard excludes, and enabled, gating
  per-directory thresholds at >= 90.

[NSchatz]

Do not merge this yet. release-dry-run is red on a PRE-EXISTING defect, and merging would burn five versions to publish nothing useful.

What is red

release-dry-run fails inside pnpm -r publish --dry-run, which invokes @cosyte/test-utils's prepublishOnly (clean && typecheck && lint && test && build). Seven cases in packages/test-utils/test/attw-gate.test.ts fail with:

ENOENT: no such file or directory, open 'attw-gate-fixture-unpacked-1.0.0.tgz'

This is the exact defect RELEASING.md already documents, back through a new vector

RELEASING.md § "Keep packing tools out of prepublishOnly" says it plainly: attw --pack . packs a tarball of its own, and run from inside pnpm publish's staging context that pack lands somewhere attw cannot find. f32e7dd (#40) fixed it by taking pnpm attw out of prepublishOnly.

attw-gate.test.ts arrived later, in 7461b0e (#42), and shells out to the real attw --pack from the test suite. prepublishOnly still runs pnpm test. So the same defect is back, one level down: not the prepublishOnly tail, but a test the tail runs.

Why it surfaced only now, and why it is not this PR's doing

publish --dry-run skips a version already on npm, so the whole prepublishOnly chain only runs when a version bumps. #42 landed with no changeset, so nothing bumped, so nothing ran it. This is the first version bump since, which is the only reason it is visible. 2f3e70c..89cc33f touches nothing in packages/test-utils/ except CHANGELOG.md, and attw-gate.test.ts passes under pnpm test in verify (22) and verify (24) on this very PR.

Why merging is worse than waiting

changeset publish runs prepublishOnly too, so the real publish fails the same way. @cosyte/test-utils is the only one of the six with any scripts block, so the other five would publish and it would not: five versions burned for a partial release. The Every bumped package must be published, tagged and released step added in #45 would then correctly tag those five, name @cosyte/test-utils as bumped-but-never-published, and red the run. That is the designed behaviour working, and it is still not an outcome worth causing on purpose.

What it needs

Its own slice, because the fix is a design choice on the shared toolchain rather than a typo, and every parser's prepublishOnly is minted from the same template shape. The candidates are to keep pnpm test out of prepublishOnly, or to make the attw gate's fixtures pack somewhere absolute rather than CWD-relative. The second looks right and generalises, but it is a change to a gate with its own refuter history and it should be graded on its own.

This PR can merge unchanged once that lands.