@fougere/cli 0.7.0-alpha.0 → 0.8.1-alpha.0

package/app/commands/NewCommand.ts

@@ -44,7 +44,9 @@ export default class NewCommand {
       }
       pw.createFlat(dir, name);
       pw.addRootFrond(dir, template);
-      if (raw.local) pw.linkLocal(dir);
+      // `--local` points every dependency at this monorepo, so a version would be dead
+      // weight; without it, the version that wrote the files is the one they were written for.
+      if (raw.local) pw.linkLocal(dir); else pw.pinVersions(dir);
       this.ui.info(`${template} at the root`);
       this.ui.note([`cd ${name}`, INSTALL, `pnpm dev`].join('\n'), `${name} — one frond, at the root`);
       this.ui.outro('Ready.');
@@ -54,7 +56,7 @@ export default class NewCommand {
     pw.createWorkspace(dir, name);
 
     if (raw.bare) {
-      if (raw.local) pw.linkLocal(dir);
+      if (raw.local) pw.linkLocal(dir); else pw.pinVersions(dir);
       this.ui.note([`cd ${name}`, `fougere new   # compose it (guided)`].join('\n'), `${name} — empty workspace`);
       this.ui.outro('Ready.');
       return;
@@ -72,7 +74,7 @@ export default class NewCommand {
 
     // Every app depends on every frond — stated here, where both names are known.
     pw.linkFronds(dir);
-    if (raw.local) pw.linkLocal(dir);
+    if (raw.local) pw.linkLocal(dir); else pw.pinVersions(dir);
     this.ui.note([`cd ${name}`, INSTALL, `pnpm dev`].join('\n'), `${name} — ${fronds} frond(s), ${apps} app(s)`);
     this.ui.outro('Ready.');
   }

package/fronds/analysis/handlers/CheckHandler.ts

@@ -1,3 +1,5 @@
+import { Shapes } from '@fougere/schema';
+import safeRegex from 'safe-regex';
 import {
   buildGraph,
   clusterEntities,
@@ -116,6 +118,34 @@ export default class CheckHandler {
       }
     }
 
+    /**
+     * A `pattern` that backtracks super-linearly. The pattern is fixed at declaration and
+     * the string tested against it is not: whoever calls the door chooses it, so the cost
+     * of one match is theirs to set. Judged HERE because a regex says the same thing on
+     * every run — checking it per row would pay for a verdict that never changes.
+     *
+     * `safe-regex` reads the star height, which is the common shape and not every one:
+     * `(a|a)*b` backtracks too and passes. Reported as a suspicion, never as a refusal.
+     */
+    for (const frond of fronds) {
+      for (const entity of frond.entities) {
+        for (const [key, field] of Object.entries(entity.entityClass.getFields())) {
+          for (const pattern of Shapes.patterns(field.shape)) {
+            if (safeRegex(pattern)) continue;
+            findings.push({
+              severity: 'warning',
+              code: 'super-linear-pattern',
+              filePath: entity.filePath,
+              subject: `${entity.name}.${key}`,
+              message: `states \`pattern: ${JSON.stringify(pattern)}\`, whose nested repetition `
+                + 'backtracks super-linearly. A value a caller chooses can hold the event loop '
+                + 'for seconds — rewrite the repeated group, or bound the field with `max`.',
+            });
+          }
+        }
+      }
+    }
+
     /**
      * A warning, not a refusal: it resolves today and the app runs. What it costs is
      * paid once, late — the day the frond it reaches into is deployed on its own.

package/fronds/analysis/handlers/MigrateHandler.ts

@@ -39,7 +39,9 @@ export default class MigrateHandler {
     if (steps.length === 0) return { chain: [], changes: [], refusals: [], ran: [] };
 
     const config = await loadConfig(scan.root);
-    const storage = resolveStorage(config.db ?? {});
+    // `fougere migrate --root ../app` read that project's config and planned against a
+    // database beside the CLI's own directory — the loudest form of this bug.
+    const storage = resolveStorage(config.db ?? {}, undefined, scan.root);
     if (!storage.db) {
       return {
         chain: versionsOf(steps),

package/fronds/scaffold/services/ProjectWriter.ts

@@ -30,6 +30,11 @@ function monorepoPackages(): string | undefined {
  */
 const TEMPLATES = fileURLToPath(new URL('../../../templates/', import.meta.url));
 
+/** The version that scaffolds is the version the templates were written for. */
+const scaffoldVersion = (): string =>
+  (JSON.parse(readFileSync(fileURLToPath(new URL('../../../package.json', import.meta.url)), 'utf8')) as
+    { version: string }).version;
+
 // npm strips a literal .gitignore from published packages — it ships as
 // _gitignore and the name is restored on copy.
 function restoreGitignore(dir: string): void {
@@ -146,6 +151,44 @@ export default class ProjectWriter {
     }
   }
 
+  /**
+   * Every `@fougere/*` dependency, pinned to the version that scaffolded it.
+   *
+   * The templates say `latest`, which reads as "whatever is current" and is not: pnpm
+   * answers from a metadata cache, and a fresh project installed 0.6 while the registry
+   * said 0.7 — measured. A version is also what makes an install reproducible, which
+   * `latest` never was.
+   *
+   * Read off this CLI's own package, because the scaffold and the packages it names ship
+   * together: the version that wrote the file is the one it was written for.
+   */
+  pinVersions(wsDir: string, conventions: Conventions = DEFAULT_CONVENTIONS): void {
+    const version = scaffoldVersion();
+    const manifests = [
+      join(wsDir, 'package.json'),
+      ...['apps', conventions.fronds].flatMap((kind) => {
+        const dir = join(wsDir, kind);
+        if (!existsSync(dir)) return [];
+
+        return readdirSync(dir, { withFileTypes: true })
+          .filter((e) => e.isDirectory())
+          .map((e) => join(dir, e.name, 'package.json'));
+      }),
+    ];
+
+    for (const path of manifests) {
+      if (!existsSync(path)) continue;
+      const pkg = JSON.parse(readFileSync(path, 'utf8')) as { dependencies?: Record<string, string> };
+      let moved = false;
+      for (const [name, range] of Object.entries(pkg.dependencies ?? {})) {
+        if (!name.startsWith('@fougere/') || range !== 'latest') continue;
+        pkg.dependencies![name] = version;
+        moved = true;
+      }
+      if (moved) writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n');
+    }
+  }
+
   /**
    * Dev mode: rewrite every `@fougere/*` dependency in the workspace to a
    * `link:` into this monorepo, so `pnpm install` resolves offline (the

package/fronds/shims.d.ts

@@ -0,0 +1,9 @@
+// `safe-regex` ships no types, and `@types/safe-regex` describes its version 1 while the
+// package here is version 2. The exported signature did not move between the two, so the
+// shim states it rather than pinning a types package a major behind.
+declare module 'safe-regex' {
+  export default function safeRegex(
+    pattern: string | RegExp,
+    options?: { limit?: number },
+  ): boolean;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fougere/cli",
-  "version": "0.7.0-alpha.0",
+  "version": "0.8.1-alpha.0",
   "description": "The Fougere CLI — compose a workspace, serve a frond, call an operation.",
   "keywords": [
     "fougere",
@@ -41,12 +41,13 @@
     "consola": "^3.4.2",
     "jiti": "^2.4.2",
     "picocolors": "^1.1.1",
-    "@fougere/container": "0.7.0-alpha.0",
-    "@fougere/core": "0.7.0-alpha.0",
-    "@fougere/adapter-sql": "0.7.0-alpha.0",
-    "@fougere/transport-http": "0.7.0-alpha.0",
-    "@fougere/schema": "0.7.0-alpha.0",
-    "@fougere/defaults": "0.7.0-alpha.0"
+    "safe-regex": "^2.1.1",
+    "@fougere/adapter-sql": "0.8.1-alpha.0",
+    "@fougere/defaults": "0.8.1-alpha.0",
+    "@fougere/core": "0.8.1-alpha.0",
+    "@fougere/transport-http": "0.8.1-alpha.0",
+    "@fougere/container": "0.8.1-alpha.0",
+    "@fougere/schema": "0.8.1-alpha.0"
   },
   "devDependencies": {
     "vitest": "^4.1.0"