@cavulsqa/create 2.4.0 → 2.5.0

package/README.md

@@ -44,7 +44,7 @@ The `f7-app` template: a tabbed shell, a `domains` / `modules` / `shared` layout
 sales demo over a six-table schema — dashboard aggregates, search, an order sheet, swipe actions,
 a detail screen — with tests against real SQLite.
 
-Underneath it, the data layer this repository publishes: `@cavulsqa/mobile-db` for Capacitor SQLite
+Underneath it, the data layer this repository publishes: `@cavulsqa/mobile-db` for OPFS SQLite
 under Kysely, `@cavulsqa/reactive-db` for the change bus, and `@cavulsqa/reactive-vue` for
 `useReactiveQuery`. A write announces the tables it touched and every query watching them refetches;
 nothing in a screen asks for a refresh.

package/lib/publishedVersions.mjs

@@ -0,0 +1,40 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Every publishable package under `packages/`, mapped to the version it currently declares. */
+export function publishedVersions(repoRoot) {
+  const versions = new Map();
+  for (const dir of readdirSync(join(repoRoot, "packages")).sort()) {
+    const manifest = join(repoRoot, "packages", dir, "package.json");
+    if (!existsSync(manifest)) continue;
+    const pkg = JSON.parse(readFileSync(manifest, "utf8"));
+    if (!pkg.private) versions.set(pkg.name, pkg.version);
+  }
+  return versions;
+}
+
+/**
+ * The sibling packages the templates declare as `workspace:` deps, in the order they are named.
+ *
+ * These are the ones the bundler rewrites to a concrete `^` range, so they are the ones whose
+ * versions change what a published creator scaffolds.
+ */
+export function workspaceDependencies(repoRoot) {
+  const names = new Set();
+  const templates = join(repoRoot, "templates");
+  if (!existsSync(templates)) return [];
+
+  for (const name of readdirSync(templates).sort()) {
+    const manifest = join(templates, name, "package.json");
+    if (!existsSync(manifest)) continue;
+    const pkg = JSON.parse(readFileSync(manifest, "utf8"));
+    for (const group of [pkg.dependencies, pkg.devDependencies]) {
+      for (const [dep, range] of Object.entries(group ?? {})) {
+        if (typeof range === "string" && range.startsWith("workspace:")) names.add(dep);
+      }
+    }
+  }
+  // Codepoint order, not locale order: this list is hashed, and the hash has to match on every
+  // machine that computes it.
+  return [...names].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}

package/lib/templateFingerprint.mjs

@@ -1,19 +1,28 @@
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
+import { publishedVersions, workspaceDependencies } from "./publishedVersions.mjs";
 
 /**
- * A content hash of every tracked file under `templates/`, used to prove that `@cavulsqa/create`
- * was republished after the templates changed.
+ * A content hash of everything a published creator would bundle, used to prove that
+ * `@cavulsqa/create` was republished after any of it changed.
  *
  * The creator bundles the templates at pack time, so a template fix reaches nobody until a new
  * version of the creator goes out. Nothing about that is visible in a diff, which is exactly the
  * kind of coupling that gets forgotten - so it is checked rather than remembered.
  *
- * It asks git rather than walking the directory. Walking gave two different answers on a Windows
- * working copy and on a CI checkout, because the disk holds whatever each machine happens to have:
- * ignored files, build leftovers, and CRLF where the runner has LF. `git ls-files -s` reports the
- * blob hash recorded in the index, which is normalised, platform-independent, and - the point -
- * describes exactly what a `git clone` of this repository would produce.
+ * Two inputs, because the bundle has two:
+ *
+ *   - The tracked files under `templates/`. It asks git rather than walking the directory. Walking
+ *     gave two different answers on a Windows working copy and on a CI checkout, because the disk
+ *     holds whatever each machine happens to have: ignored files, build leftovers, and CRLF where
+ *     the runner has LF. `git ls-files -s` reports the blob hash recorded in the index, which is
+ *     normalised, platform-independent, and - the point - describes exactly what a `git clone` of
+ *     this repository would produce.
+ *   - The sibling versions the bundler pins those templates to. A template declares
+ *     `workspace:*` and the bundler rewrites it to `^<current version>`, so bumping a library
+ *     changes what the creator scaffolds while leaving every tracked file byte-identical. Hashing
+ *     the files alone said "unchanged" and let the creator keep shipping ranges that no longer
+ *     admitted the packages it was meant to install.
  */
 export function fingerprintTemplates(repoRoot) {
   const listing = execFileSync("git", ["ls-files", "-s", "--", "templates"], {
@@ -25,5 +34,10 @@ export function fingerprintTemplates(repoRoot) {
   const lines = listing.split("\n").filter(Boolean).sort();
   if (!lines.length) throw new Error("git reports no tracked files under templates/");
 
-  return `sha256-${createHash("sha256").update(lines.join("\n")).digest("base64")}`;
+  const versions = publishedVersions(repoRoot);
+  const pins = workspaceDependencies(repoRoot).map((name) => `${name}@${versions.get(name)}`);
+
+  return `sha256-${createHash("sha256")
+    .update([...lines, ...pins].join("\n"))
+    .digest("base64")}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cavulsqa/create",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Create a Vue + Framework7 + Capacitor + SQLite app from the cavulsqa templates.",
   "keywords": [
     "capacitor",
@@ -52,7 +52,7 @@
       }
     ]
   },
-  "templatesFingerprint": "sha256-tG0kS6m1X1FkrDBDpzezvdSxTxaLazPunAi3a0xab7o=",
+  "templatesFingerprint": "sha256-cV0g/O7hz2eNNshfgmpNGWq7pcYKH/DRDVaeqkqVgjg=",
   "scripts": {
     "build": "node scripts/bundleTemplates.mjs",
     "check": "vp check",

package/templates/f7-app/CLAUDE.md

@@ -10,15 +10,15 @@ SQLite — it does not become the thing screens read.
 ## Stack
 
 Vue 3.5 `<script setup lang="ts">` · Framework7 9 (+ framework7-vue 8) · Capacitor 8 (Android
-first) · Kysely over `@capacitor-community/sqlite` · vue-i18n · Tailwind 4 · Vite+ (`vp`).
+first) · Kysely over SQLite in an OPFS worker · vue-i18n · Tailwind 4 · Vite+ (`vp`).
 
 Data layer comes from three published packages, not from this repo:
 
-| Package                  | What it gives you                                                  |
-| ------------------------ | ------------------------------------------------------------------ |
-| `@cavulsqa/mobile-db`    | The Capacitor SQLite dialect, migrations, transaction-aware writes |
-| `@cavulsqa/reactive-db`  | Change bus, result cache, visibility gate, query metrics           |
-| `@cavulsqa/reactive-vue` | `useReactiveQuery` and the Framework7 page-visibility adapter      |
+| Package                  | What it gives you                                             |
+| ------------------------ | ------------------------------------------------------------- |
+| `@cavulsqa/mobile-db`    | The OPFS worker dialect, migrations, transaction-aware writes |
+| `@cavulsqa/reactive-db`  | Change bus, result cache, visibility gate, query metrics      |
+| `@cavulsqa/reactive-vue` | `useReactiveQuery` and the Framework7 page-visibility adapter |
 
 Do not vendor or fork them. If one is wrong, fix it there and bump the version.
 

package/templates/f7-app/package.json

@@ -19,9 +19,9 @@
     "@capacitor/preferences": "^8.0.0",
     "@capacitor/splash-screen": "^8.0.0",
     "@capacitor/status-bar": "^8.0.0",
-    "@cavulsqa/mobile-db": "^0.6.0",
-    "@cavulsqa/reactive-db": "^0.3.0",
-    "@cavulsqa/reactive-vue": "^0.3.0",
+    "@cavulsqa/mobile-db": "^1.0.0",
+    "@cavulsqa/reactive-db": "^1.0.0",
+    "@cavulsqa/reactive-vue": "^1.0.0",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@tailwindcss/vite": "^4.3.3",
     "@vueuse/core": "^14.4.0",