fix(pnpm-policy): generate without a lockfile when scopes alone define the exemptions

Author: pyramation

packages/pnpm-policy/README.md

@@ -172,7 +172,7 @@ Two rules govern how it compresses:
 
 **Unscoped names are listed individually**, which is exact: they come from your own maintainer query.
 
-**Intersection.** By default only names this workspace actually resolves (read from `pnpm-lock.yaml`) are written out — 1104 published packages becomes the ~85 that appear in this repo. Scope globs are never intersected: nobody else can publish into a scope you own, so the glob stays correct when a new package lands there tomorrow. Pass `--no-intersect` to emit everything.
+**Intersection.** By default only names this workspace actually resolves (read from `pnpm-lock.yaml`) are written out — 1104 published packages becomes the ~85 that appear in this repo. Scope globs are never intersected: nobody else can publish into a scope you own, so the glob stays correct when a new package lands there tomorrow. Pass `--no-intersect` to emit everything. A config with no `inventory:` has no individual names to narrow, so it needs no lockfile at all — which is what lets a freshly scaffolded workspace generate its policy before its first install.
 
 Commit the inventory and review its diffs. It is an exemption list, so a name appearing in it is a name that stops being quarantined — worth one human glance, which is also why refreshing it should open a pull request rather than run silently in an install hook.
 

packages/pnpm-policy/__tests__/generate.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync, readFileSync, writeFileSync } from 'fs';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
 
@@ -84,6 +84,12 @@ describe('generate', () => {
     expect(readFileSync(result.file, 'utf-8')).toContain('never-used');
   });
 
+  it('needs no lockfile when scopes alone define the exemptions', () => {
+    const dir = workspace('minimumReleaseAge: 14d\nscopes:\n  - "@acme"\n');
+    rmSync(join(dir, 'pnpm-lock.yaml'));
+    expect(readFileSync(generate({ cwd: dir }).file, 'utf-8')).toContain('"@acme/*"');
+  });
+
   it('reports no change on a second run', () => {
     const dir = workspace(CONFIG);
     generate({ cwd: dir });

packages/pnpm-policy/src/generate.ts

@@ -73,10 +73,16 @@ function load(options: RunOptions): Loaded {
     );
   }
 
+  // Intersection only ever narrows individual inventory names, so a workspace
+  // with no inventory (scopes alone, which are never intersected) has nothing to
+  // read a lockfile for — and demanding one would fail a freshly scaffolded
+  // project that has not installed yet.
+  const needsLockfile = intersect && inventory != null;
+
   const policy = resolvePolicy({
     config: { ...config, intersect },
     inventory,
-    resolved: intersect ? readWorkspacePackages(workspaceDir) : undefined,
+    resolved: needsLockfile ? readWorkspacePackages(workspaceDir) : undefined,
     buildsKey: options.buildsKey,
     now: options.now
   });

packages/pnpm-policy/src/policy.ts

@@ -107,7 +107,9 @@ function buildComments(
           ? `First-party membership comes from what ${config.maintainers.join(', ')} ${
               config.maintainers.length === 1 ? 'publishes' : 'publish'
             } on npm — waiting on your own release protects nothing.`
-          : 'First-party membership comes from the inventory.'
+          : report.firstPartyPackages.length
+            ? 'First-party membership comes from the inventory.'
+            : 'First-party membership comes from the scopes claimed in pnpm-policy.yaml.'
       ].join('\n')
     ]);
   }