@flytedesk/app-kit 3.2.2 → 4.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flytedesk/app-kit",
-  "version": "3.2.2",
+  "version": "4.0.0",
   "description": "Shared platform kit for flytedesk apps: flytedesk-id auth (BFF/OIDC client) and a Postgres-native trace/audit layer.",
   "type": "module",
   "license": "UNLICENSED",
@@ -25,7 +25,7 @@
   "files": [
     "dist",
     "prisma",
-    "scripts"
+    "scripts/postinstall-eslint-ts6-shim.cjs"
   ],
   "bin": {
     "trace-sync": "./dist/cli/trace-sync.js",
@@ -77,6 +77,10 @@
     "./spa-server": {
       "types": "./dist/spa-server/index.d.ts",
       "import": "./dist/spa-server/index.js"
+    },
+    "./postgres": {
+      "types": "./dist/postgres/index.d.ts",
+      "import": "./dist/postgres/index.js"
     }
   },
   "scripts": {
@@ -116,10 +120,12 @@
     "@arethetypeswrong/cli": "^0.18.5",
     "@changesets/changelog-github": "^1.0.0",
     "@changesets/cli": "^3.0.1",
+    "@google-cloud/bigquery": "^9.1.0",
     "@prisma/client": "^7.10.0",
     "@testcontainers/postgresql": "^12.1.0",
     "@testing-library/react": "^16.3.3",
     "@types/cross-spawn": "^6.0.6",
+    "@types/jsdom": "^30.0.0",
     "@types/node": "^24.0.0",
     "@types/pg": "^8.23.1",
     "@types/react": "^19.3.0",

package/scripts/pending-release-count.mjs

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-// Prints how many package releases the changesets committed in the current
-// directory would produce. scripts/release.sh uses it to decide between
-// "version + publish" and "no-op".
-//
-// It counts every changeset on disk. It deliberately does NOT pass
-// `--since=origin/main`: a release runs from a clone of main, where the
-// pending changesets are already on origin/main, so `--since` always
-// reports zero. That is exactly how the first real release run failed
-// (AK-13, 2026-09-24).
-import { spawnSync } from "node:child_process";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { createRequire } from "node:module";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-const require = createRequire(import.meta.url);
-const changesetBin = require.resolve("@changesets/cli/bin.js");
-
-const outDir = mkdtempSync(join(tmpdir(), "changeset-status-"));
-const outFile = join(outDir, "status.json");
-
-try {
-  const result = spawnSync(
-    process.execPath,
-    [changesetBin, "status", `--output=${outFile}`],
-    { cwd: process.cwd(), encoding: "utf8" },
-  );
-  if (result.status !== 0) {
-    process.stderr.write(result.stderr || result.stdout);
-    process.exit(result.status ?? 1);
-  }
-  const status = JSON.parse(readFileSync(outFile, "utf8"));
-  process.stdout.write(String(status.releases.length));
-} finally {
-  rmSync(outDir, { recursive: true, force: true });
-}

package/scripts/release.sh

@@ -1,126 +0,0 @@
-#!/usr/bin/env bash
-#
-# app-kit release script.
-#
-# GitHub Actions no longer starts jobs for the Flytedesk org (billing
-# refusal), so this script replaces .github/workflows/ci.yml + release.yml.
-# It runs the exact gates CI used to run, then versions/publishes/tags
-# exactly like the old two-stage changesets/action flow did — but from a
-# human-triggered local run in a dedicated deploy clone, instead of GitHub.
-#
-# Usage:
-#   bash scripts/release.sh [<commit-or-ref>]
-#
-# <commit-or-ref> defaults to origin/main's tip. It must be reachable from
-# origin/main (i.e. already merged) — this script never releases unmerged
-# work.
-#
-# Run this ONLY from the sanctioned deploy clone at
-# C:/Users/newms/deploy/app-kit (see .danxbot/config/workflow.md
-# "Publishing" for one-time setup). It refuses to run anywhere else.
-set -euo pipefail
-
-log() { printf '[release] %s\n' "$1"; }
-die() { printf '[release] ERROR: %s\n' "$1" >&2; exit 1; }
-
-# --- Guard 1: this must be the sanctioned deploy clone ---------------------
-REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" \
-  || die "not inside a git repository"
-
-MARKER="$REPO_ROOT/.deploy-clone-marker"
-[[ -f "$MARKER" ]] \
-  || die "missing $MARKER — this is not the sanctioned deploy clone. \
-Release runs only happen from a dedicated clone at C:/Users/newms/deploy/app-kit; \
-see .danxbot/config/workflow.md 'Publishing' for one-time setup."
-
-cd "$REPO_ROOT"
-
-# --- Guard 2: refuse a dirty tree ------------------------------------------
-if [[ -n "$(git status --porcelain)" ]]; then
-  die "working tree is dirty — refusing to release from an unclean clone. \
-Run 'git status' in $REPO_ROOT and clean it up first."
-fi
-
-# --- Guard 3: take the lock -------------------------------------------------
-LOCKFILE="$REPO_ROOT/.release.lock"
-if ! ( set -o noclobber; printf '%s\n' "$$" > "$LOCKFILE" ) 2>/dev/null; then
-  die "lock file $LOCKFILE already exists — another release run is in \
-progress (or a previous run crashed without cleaning up; if you're sure \
-none is running, delete the lock file and retry)."
-fi
-trap 'rm -f "$LOCKFILE"' EXIT
-
-# --- Fetch + resolve the target commit --------------------------------------
-log "fetching origin..."
-git fetch origin
-
-TARGET_REF="${1:-origin/main}"
-TARGET_SHA="$(git rev-parse "$TARGET_REF")" \
-  || die "could not resolve '$TARGET_REF' to a commit"
-
-git merge-base --is-ancestor "$TARGET_SHA" origin/main \
-  || die "$TARGET_REF ($TARGET_SHA) is not reachable from origin/main — \
-refusing to release unmerged work."
-
-log "target commit: $TARGET_SHA"
-
-# Move local main onto the target commit so a version-bump commit (if any)
-# lands on top of it and can be pushed straight to origin/main.
-git checkout -B main "$TARGET_SHA"
-
-# --- Install + gates ---------------------------------------------------------
-log "npm ci..."
-npm ci
-
-log "running gates (npm run check: lint, typecheck, build, test, test:integration, check:exports)..."
-npm run check
-
-log "gates passed."
-
-# --- Version / publish ------------------------------------------------------
-PENDING_COUNT="$(node scripts/pending-release-count.mjs)"
-
-CURRENT_VERSION="$(node -p "require('./package.json').version")"
-
-if [[ "$PENDING_COUNT" -eq 0 ]]; then
-  PUBLISHED_VERSION="$(npm view @flytedesk/app-kit version)"
-  if [[ "$PUBLISHED_VERSION" == "$CURRENT_VERSION" ]]; then
-    log "no changesets pending and $CURRENT_VERSION is already on npm — no-op."
-    printf 'RESULT: sha=%s version=%s status=no-op\n' "$TARGET_SHA" "$CURRENT_VERSION"
-    exit 0
-  else
-    die "no changesets pending, but package.json ($CURRENT_VERSION) does not \
-match the published npm version ($PUBLISHED_VERSION) — refusing to guess \
-what to do; this needs a human to reconcile versions."
-  fi
-fi
-
-log "$PENDING_COUNT changeset(s) pending — versioning..."
-# @changesets/changelog-github looks up each changeset's commit and author on
-# GitHub, so `changeset version` needs a token. Take it from gh-as for this one
-# command only: it is never written to disk or exported to later steps.
-CHANGELOG_TOKEN="$(gh-as auth token)" \
-  || die "could not get a GitHub token from gh-as for the changelog step."
-[[ -n "$CHANGELOG_TOKEN" ]] \
-  || die "gh-as returned an empty GitHub token for the changelog step."
-GITHUB_TOKEN="$CHANGELOG_TOKEN" npx changeset version
-unset CHANGELOG_TOKEN
-
-NEW_VERSION="$(node -p "require('./package.json').version")"
-[[ "$NEW_VERSION" != "$CURRENT_VERSION" ]] \
-  || die "changeset version did not bump the version — aborting before publish."
-
-log "bumped to $NEW_VERSION. Committing..."
-git add -A
-git commit -m "chore(release): v$NEW_VERSION"
-
-log "pushing version-bump commit to origin/main (fails on non-fast-forward)..."
-git push origin main
-
-log "publishing to npm (account flytedan, token from ~/.npmrc)..."
-npx changeset publish
-
-log "pushing tag v$NEW_VERSION..."
-git push origin "v$NEW_VERSION"
-
-printf 'RESULT: sha=%s version=%s status=published\n' "$(git rev-parse HEAD)" "$NEW_VERSION"

package/scripts/release.test.ts

@@ -1,205 +0,0 @@
-import { describe, expect, it, beforeAll } from "vitest";
-import { spawnSync } from "node:child_process";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-
-// scripts/release.sh refuses to do anything except from the sanctioned
-// deploy clone, with a clean tree, without a live lock, and only for a
-// commit reachable from origin/main. Those guards run before npm ci / the
-// gates, so they're cheap and fully testable against throwaway git repos
-// (no Docker, no network, no real npm publish).
-
-const SCRIPT_PATH = resolve(__dirname, "release.sh");
-
-// On Windows, a bare `bash` on PATH can resolve to the WSL launcher in
-// System32 instead of Git Bash, which can't reliably run against a
-// C:/Users/... working tree. Find Git Bash explicitly when it exists;
-// fall back to `bash` (e.g. on Linux CI, where `bash` is unambiguous).
-function resolveBash(): string {
-  const candidates = [
-    "C:\\Program Files\\Git\\bin\\bash.exe",
-    "C:\\Program Files\\Git\\usr\\bin\\bash.exe",
-  ];
-  for (const c of candidates) {
-    if (existsSync(c)) return c;
-  }
-  return "bash";
-}
-
-const BASH = resolveBash();
-
-function run(cwd: string, args: string[] = []) {
-  const result = spawnSync(BASH, [SCRIPT_PATH, ...args], {
-    cwd,
-    encoding: "utf8",
-    env: { ...process.env },
-  });
-  return result;
-}
-
-function git(cwd: string, args: string[]) {
-  const result = spawnSync("git", args, { cwd, encoding: "utf8" });
-  if (result.status !== 0) {
-    throw new Error(
-      `git ${args.join(" ")} failed in ${cwd}: ${result.stderr}${result.stdout}`,
-    );
-  }
-  return result.stdout;
-}
-
-function initRepoWithCommit(dir: string) {
-  git(dir, ["init", "-q", "-b", "main"]);
-  git(dir, ["config", "user.email", "test@example.com"]);
-  git(dir, ["config", "user.name", "Test"]);
-  // Ignore the script's own local-only marker/lock files so creating them
-  // doesn't itself count as "dirty" in these throwaway repos.
-  writeFileSync(join(dir, ".gitignore"), ".deploy-clone-marker\n.release.lock\n");
-  writeFileSync(join(dir, "README.md"), "test repo\n");
-  git(dir, ["add", "."]);
-  git(dir, ["commit", "-q", "-m", "initial commit"]);
-}
-
-function addMarker(dir: string) {
-  writeFileSync(join(dir, ".deploy-clone-marker"), "test marker\n");
-}
-
-describe("scripts/release.sh guards", () => {
-  let workDir: string;
-
-  beforeAll(() => {
-    workDir = mkdtempSync(join(tmpdir(), "release-sh-test-"));
-  });
-
-  it("refuses to run outside the deploy clone (no marker file)", () => {
-    const dir = mkdtempSync(join(workDir, "no-marker-"));
-    initRepoWithCommit(dir);
-    // deliberately no .deploy-clone-marker
-
-    const result = run(dir);
-
-    expect(result.status).not.toBe(0);
-    expect(result.stderr).toMatch(/not the sanctioned deploy clone/i);
-  });
-
-  it("refuses a dirty working tree even with the marker present", () => {
-    const dir = mkdtempSync(join(workDir, "dirty-"));
-    initRepoWithCommit(dir);
-    addMarker(dir);
-    // Make an uncommitted, non-ignored change.
-    writeFileSync(join(dir, "README.md"), "modified, uncommitted\n");
-
-    const result = run(dir);
-
-    expect(result.status).not.toBe(0);
-    expect(result.stderr).toMatch(/dirty/i);
-  });
-
-  it("refuses to run when the lock file is already held", () => {
-    const dir = mkdtempSync(join(workDir, "locked-"));
-    initRepoWithCommit(dir);
-    addMarker(dir);
-    writeFileSync(join(dir, ".release.lock"), "99999\n");
-
-    const result = run(dir);
-
-    expect(result.status).not.toBe(0);
-    expect(result.stderr).toMatch(/lock file .* already exists/i);
-    // The guard must not have deleted a lock file it didn't create itself
-    // (the trap only fires once *this* run successfully takes the lock).
-    expect(existsSync(join(dir, ".release.lock"))).toBe(true);
-    rmSync(join(dir, ".release.lock"));
-  });
-
-  it("refuses a target commit that is not reachable from origin/main", () => {
-    // A bare "origin" with just the initial commit on main.
-    const originDir = mkdtempSync(join(workDir, "origin-"));
-    git(originDir, ["init", "-q", "--bare", "-b", "main"]);
-
-    const seedDir = mkdtempSync(join(workDir, "seed-"));
-    initRepoWithCommit(seedDir);
-    git(seedDir, ["remote", "add", "origin", originDir]);
-    git(seedDir, ["push", "-q", "origin", "main"]);
-
-    // The deploy clone: clone of origin, plus a local commit on a throwaway
-    // branch that is never pushed, so it is not an ancestor of origin/main.
-    // main itself stays exactly at origin/main's tip, so the tree the
-    // guards see is clean.
-    const cloneDir = join(workDir, "clone-unreachable");
-    git(workDir, ["clone", "-q", originDir, cloneDir]);
-    addMarker(cloneDir);
-    git(cloneDir, ["checkout", "-q", "-b", "throwaway"]);
-    writeFileSync(join(cloneDir, "unmerged.txt"), "local-only change\n");
-    git(cloneDir, ["add", "unmerged.txt"]);
-    git(cloneDir, ["commit", "-q", "-m", "unmerged local commit"]);
-    const unmergedSha = git(cloneDir, ["rev-parse", "HEAD"]).trim();
-    git(cloneDir, ["checkout", "-q", "main"]);
-
-    const result = run(cloneDir, [unmergedSha]);
-
-    expect(result.status).not.toBe(0);
-    expect(result.stderr).toMatch(/not reachable from origin\/main/i);
-  });
-});
-
-// scripts/pending-release-count.mjs decides "version + publish" vs "no-op".
-// A release runs from a clone of main, so pending changesets are already on
-// origin/main. The first real release (AK-13, 2026-09-24) counted zero because
-// it asked `changeset status --since=origin/main`; these tests pin the fix by
-// reproducing that exact shape: changesets committed AND pushed.
-describe("scripts/pending-release-count.mjs", () => {
-  const COUNT_SCRIPT = resolve(__dirname, "pending-release-count.mjs");
-  let workDir: string;
-
-  beforeAll(() => {
-    workDir = mkdtempSync(join(tmpdir(), "pending-count-test-"));
-  });
-
-  function cloneOfPushedPackage(name: string, changesets: Record<string, string>) {
-    const originDir = mkdtempSync(join(workDir, `${name}-origin-`));
-    git(originDir, ["init", "-q", "--bare", "-b", "main"]);
-
-    const seedDir = mkdtempSync(join(workDir, `${name}-seed-`));
-    initRepoWithCommit(seedDir);
-    writeFileSync(
-      join(seedDir, "package.json"),
-      JSON.stringify({ name: "@test/pkg", version: "0.3.2" }, null, 2),
-    );
-    mkdirSync(join(seedDir, ".changeset"));
-    writeFileSync(
-      join(seedDir, ".changeset", "config.json"),
-      JSON.stringify({ changelog: false, commit: false, baseBranch: "main", access: "public" }),
-    );
-    for (const [file, body] of Object.entries(changesets)) {
-      writeFileSync(join(seedDir, ".changeset", file), body);
-    }
-    git(seedDir, ["add", "."]);
-    git(seedDir, ["commit", "-q", "-m", "package with changesets"]);
-    git(seedDir, ["remote", "add", "origin", originDir]);
-    git(seedDir, ["push", "-q", "origin", "main"]);
-
-    const cloneDir = join(workDir, `${name}-clone`);
-    git(workDir, ["clone", "-q", originDir, cloneDir]);
-    return cloneDir;
-  }
-
-  function count(cwd: string) {
-    const result = spawnSync(process.execPath, [COUNT_SCRIPT], { cwd, encoding: "utf8" });
-    if (result.status !== 0) throw new Error(result.stderr || result.stdout);
-    return result.stdout;
-  }
-
-  it("counts changesets that are already on origin/main", () => {
-    const clone = cloneOfPushedPackage("pending", {
-      "minor-feature.md": '---\n"@test/pkg": minor\n---\n\nA feature.\n',
-    });
-
-    expect(count(clone)).toBe("1");
-  });
-
-  it("reports zero when no changesets are pending", () => {
-    const clone = cloneOfPushedPackage("none", {});
-
-    expect(count(clone)).toBe("0");
-  });
-});