ci: guard extension wildcard reexports

scripts/check-changed.mjs

@@ -55,6 +55,7 @@ export function createChangedCheckPlan(result, options = {}) {
 
   add("conflict markers", ["check:no-conflict-markers"]);
   add("changelog attributions", ["check:changelog-attributions"]);
+  add("guarded extension wildcard re-exports", ["lint:extensions:no-guarded-wildcard-reexports"]);
   add("plugin-sdk wildcard re-exports", ["lint:extensions:no-plugin-sdk-wildcard-reexports"]);
 
   if (result.docsOnly) {

scripts/check-extension-wildcard-reexports.mjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+const GUARDED_PUBLIC_API_BARRELS = [
+  "extensions/discord/api.ts",
+  "extensions/slack/api.ts",
+  "extensions/telegram/api.ts",
+  "extensions/whatsapp/api.ts",
+];
+
+const LOCAL_WILDCARD_REEXPORT_PATTERN = /^\s*export\s+(?:type\s+)?\*\s+from\s+["'](?:\.{1,2}\/)/u;
+
+async function walkFiles(rootDir, predicate) {
+  const files = [];
+  async function visit(dir) {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name === "node_modules" || entry.name === ".git" || entry.name === "dist") {
+        continue;
+      }
+      const filePath = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await visit(filePath);
+        continue;
+      }
+      if (entry.isFile() && predicate(filePath)) {
+        files.push(filePath);
+      }
+    }
+  }
+  await visit(rootDir);
+  return files.toSorted((left, right) => left.localeCompare(right));
+}
+
+async function listGuardedFiles(rootDir = repoRoot) {
+  const runtimeApiFiles = await walkFiles(path.join(rootDir, "extensions"), (filePath) =>
+    filePath.endsWith(`${path.sep}runtime-api.ts`),
+  );
+  const files = new Set(runtimeApiFiles);
+  for (const relativePath of GUARDED_PUBLIC_API_BARRELS) {
+    const filePath = path.join(rootDir, relativePath);
+    try {
+      const stat = await fs.stat(filePath);
+      if (stat.isFile()) {
+        files.add(filePath);
+      }
+    } catch (error) {
+      if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+  return [...files].toSorted((left, right) => left.localeCompare(right));
+}
+
+export function findLocalWildcardReexports(source) {
+  return source
+    .split(/\r?\n/u)
+    .map((text, index) => ({ line: index + 1, text }))
+    .filter(({ text }) => LOCAL_WILDCARD_REEXPORT_PATTERN.test(text));
+}
+
+export async function collectExtensionWildcardReexports(rootDir = repoRoot) {
+  const files = await listGuardedFiles(rootDir);
+  const violations = [];
+  for (const filePath of files) {
+    const source = await fs.readFile(filePath, "utf8");
+    for (const match of findLocalWildcardReexports(source)) {
+      violations.push({
+        file: path.relative(rootDir, filePath).split(path.sep).join("/"),
+        line: match.line,
+        text: match.text.trim(),
+      });
+    }
+  }
+  return violations;
+}
+
+export async function main(argv = process.argv.slice(2), io = process) {
+  const json = argv.includes("--json");
+  const violations = await collectExtensionWildcardReexports();
+
+  if (json) {
+    io.stdout.write(`${JSON.stringify(violations, null, 2)}\n`);
+    return violations.length === 0 ? 0 : 1;
+  }
+
+  if (violations.length === 0) {
+    io.stdout.write("No guarded extension wildcard re-exports found.\n");
+    return 0;
+  }
+
+  io.stderr.write("Found guarded extension wildcard re-exports:\n");
+  for (const violation of violations) {
+    io.stderr.write(`- ${violation.file}:${violation.line} ${violation.text}\n`);
+  }
+  io.stderr.write("Use explicit named exports so runtime and public API barrels stay pinned.\n");
+  return 1;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const exitCode = await main();
+  process.exit(exitCode);
+}

scripts/check.mjs

@@ -31,6 +31,10 @@ export async function main(argv = process.argv.slice(2)) {
       commands: [
         { name: "conflict markers", args: ["check:no-conflict-markers"] },
         { name: "changelog attributions", args: ["check:changelog-attributions"] },
+        {
+          name: "guarded extension wildcard re-exports",
+          args: ["lint:extensions:no-guarded-wildcard-reexports"],
+        },
         {
           name: "plugin-sdk wildcard re-exports",
           args: ["lint:extensions:no-plugin-sdk-wildcard-reexports"],