@fulmenhq/tsfulmen 0.2.10 → 0.3.0

package/CHANGELOG.md

@@ -14,6 +14,32 @@ _No unreleased changes._
 
 ---
 
+## [0.3.0] - 2026-06-06
+
+> **Breaking (majors wave).** Migrates four major dependencies (archiver 8, pino 10, TypeScript 6, commander 15) and **raises the Node engine floor to `>=22.12.0`** (was `>=20.0.0`). No external consumers are affected (the galaxy runs Node 22+). Shipped as four reviewed PRs (#6, #9, #10, #11). Full details in `docs/releases/v0.3.0.md`.
+
+### Breaking
+
+- **Node engine floor `>=20.0.0` → `>=22.12.0`** (`package.json` `engines.node`). Driven by commander 15 (requires `node>=22.12.0` for `require(esm)`); also clears pino 10's Node-18 drop. Consumers must be on Node 22.12+.
+
+### Security
+
+- **archiver 7.0.1 → 8.0.0** — escapes the **unpatchable lodash 4.x advisories** that archiver 7 pulled transitively via `archiver-utils` (GHSA-r5fr-rjxr-66jc `_.template` code injection [high] + two `_.unset`/`_.omit` prototype-pollution advisories [moderate] — none have a fixed lodash 4.x, so dropping lodash was the only remedy). archiver 8 removes `archiver-utils`/`lodash` entirely; its `readdir-glob → minimatch` chain resolves to a patched `minimatch@10.2.x`. Net `bun audit`: **23 → 17** findings (15 → 11 high).
+
+### Changed
+
+- **archiver 8 API migration** (`src/fulpack/core.ts`) — archiver 8 is a ground-up ESM rewrite that replaced the callable `archiver(format, options)` factory with format-specific classes. Updated to `new TarArchive(...)` / `new ZipArchive(...)` and the imported `Archiver` type. No public-API or behavior change for fulpack (`create`/`extract`/`scan` unchanged); all 122 fulpack/test files green.
+- **Local archiver v8 type shim** (`src/fulpack/archiver.d.ts`) — archiver 8 ships no types and `@types/archiver` is frozen on the removed v7 factory API, so `@types/archiver` was dropped in favor of a focused ambient `declare module "archiver"` covering the v8 surface fulpack uses. The shim leaks no `archiver` types into the published `dist` surface. **Remove the shim and restore `@types/archiver` once `@types/archiver@8` lands on DefinitelyTyped.**
+- **pino 9.14.0 → 10.3.1** — clean major bump (no source changes). pino 10's only breaking change is dropping Node 18, satisfied by the wave's engine floor; pino remains CJS with a default export, so the `src/logging/logger.ts` integration is unchanged. tsfulmen uses custom redaction (`logging/middleware.ts`), not pino's `redact`/`censor`, so the v10.1.0 censor type change does not apply. Sinks are custom (not pino transports), so the thread-stream@4 / pino-abstract-transport@3 upgrades have no surface here. Added DEBUG/WARN severity-label coverage to complete the logger output assertions across all four methods.
+- **commander 14.0.3 → 15.0.0** — commander 15 is ESM-only and requires `node>=22.12.0` (drives the engine-floor bump above). No source changes: tsfulmen is already ESM and all three CLIs (`foundry/signals`, `schema`, `telemetry/prometheus`) use the stable `import { Command }` API. The `schema export` command defines **standalone** negated flags (`--no-provenance`, `--no-validate`); commander 15's parsing change affects only **paired** positive+negative option definitions (e.g. both `--foo` and `--no-foo`), which tsfulmen does not use, so standalone `--no-*` behavior is unchanged (verified: `schema export --no-provenance --no-validate` works under v15). Validated by smoke-testing the CLIs under v15 at the parse level (help rendering, subcommands, `--json`, the `--no-*` flags above) plus the existing CLI-logic tests. The CLIs `program.parse()` on import, so commander-level arg-parse unit tests would need an `import.meta.main` guard + extracted `buildProgram()` (tracked as a testability follow-up, not part of this bump). _Note: `telemetry/prometheus` `export`/`validate` actions exercise downstream exporter logic that requires a populated `TelemetryRegistry`; those fail in a bare standalone CLI invocation (pre-existing, unrelated to commander — parsing succeeds, the `RefreshError` originates in `exporter.ts`)._
+- **TypeScript (dev) 5.9.3 → 6.0.3** — compiler bump, no `src/` changes. The `tsconfig.json` already sets all options explicitly (`target`/`module`/`lib` ES2022, `moduleResolution: bundler`, `esModuleInterop: true`, `strict`, `skipLibCheck`) and uses none of the options TS 6 removed (`outFile`, `classic`/`node10` resolution, `importsNotUsedAsValues`, etc.), so the default changes don't apply. **Added `ignoreDeprecations: "6.0"`** to `tsconfig.json`: the `.d.ts` build (tsup 8.5.1) injects `baseUrl: "."` into the declaration compiler options (`rollup-plugin-dts` path), and TS 6 errors on the now-deprecated `baseUrl` (`TS5101`) — `ignoreDeprecations` is the TS-sanctioned 6.x-transition opt-out (remove once tsup stops injecting `baseUrl` or before TS 7). Typecheck, full `tsup` `.d.ts` emit, and the `validate:exports`/`validate:types`/`validate:imports` consumer-surface suite all pass under 6.0.3.
+
+### Fixed
+
+- **Node 25 test teardown** — `src/config/__tests__/loader.test.ts` used the deprecated `fs.rmdir(path, { recursive: true })`, which is a deprecation warning on Node ≤24 but a hard failure on Node 25.x. Switched to `fs.rm(path, { recursive: true, force: true })` (surfaced during the pino 10 review on Node 25.8.0).
+
+---
+
 ## [0.2.10] - 2026-06-05
 
 ### Security

package/README.md

@@ -8,7 +8,7 @@ Every team writes their own HTTP status helpers, exit code enums, and country co
 - **Cross-language parity**: Same exit codes, signals, and schemas as gofulmen, rsfulmen, pyfulmen
 - **Type-safe**: Full TypeScript types with strict mode throughout
 
-**Lifecycle Phase**: `beta` | **Version**: 0.2.10 | **Test Coverage**: 71%
+**Lifecycle Phase**: `beta` | **Version**: 0.3.0 | **Test Coverage**: 71%
 
 **Install**: `bun add @fulmenhq/tsfulmen` (or `npm install @fulmenhq/tsfulmen`)
 

package/dist/fulpack/index.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, statSync, createReadStream, createWriteStream, r
 import { dirname, basename, join } from 'path';
 import { pipeline } from 'stream';
 import { createGunzip, createGzip } from 'zlib';
-import archiver from 'archiver';
+import { TarArchive, ZipArchive } from 'archiver';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
@@ -522,7 +522,7 @@ async function scanGzipFile(archive, options) {
 }
 async function createTarGzArchive(sources, output, options) {
   const writeStream = createWriteStream(output);
-  const archive = archiver("tar", {
+  const archive = new TarArchive({
     gzip: true,
     gzipOptions: {
       level: options.compression_level
@@ -533,14 +533,17 @@ async function createTarGzArchive(sources, output, options) {
   const writePromise = new Promise((resolve, reject) => {
     writeStream.on("close", () => resolve());
     writeStream.on("error", reject);
-  });
-  archive.on("error", (error) => {
-    throw new FulpackOperationError(
-      createFulpackError(
-        ERROR_CODES.EXTRACTION_FAILED,
-        `TAR.GZ creation failed: ${error.message}`,
-        "create" /* CREATE */,
-        { details: { original_error: error } }
+    archive.on(
+      "error",
+      (error) => reject(
+        new FulpackOperationError(
+          createFulpackError(
+            ERROR_CODES.EXTRACTION_FAILED,
+            `TAR.GZ creation failed: ${error.message}`,
+            "create" /* CREATE */,
+            { details: { original_error: error } }
+          )
+        )
       )
     );
   });
@@ -569,7 +572,8 @@ async function createTarGzArchive(sources, output, options) {
       totalSize += stats.size;
     }
   }
-  await archive.finalize();
+  archive.finalize().catch(() => {
+  });
   await writePromise;
   const outputStats = statSync(output);
   return {
@@ -586,7 +590,7 @@ async function createTarGzArchive(sources, output, options) {
 }
 async function createZipArchive(sources, output, options) {
   const writeStream = createWriteStream(output);
-  const archive = archiver("zip", {
+  const archive = new ZipArchive({
     zlib: { level: options.compression_level }
   });
   let entryCount = 0;
@@ -594,14 +598,17 @@ async function createZipArchive(sources, output, options) {
   const writePromise = new Promise((resolve, reject) => {
     writeStream.on("close", () => resolve());
     writeStream.on("error", reject);
-  });
-  archive.on("error", (error) => {
-    throw new FulpackOperationError(
-      createFulpackError(
-        ERROR_CODES.EXTRACTION_FAILED,
-        `ZIP creation failed: ${error.message}`,
-        "create" /* CREATE */,
-        { details: { original_error: error } }
+    archive.on(
+      "error",
+      (error) => reject(
+        new FulpackOperationError(
+          createFulpackError(
+            ERROR_CODES.EXTRACTION_FAILED,
+            `ZIP creation failed: ${error.message}`,
+            "create" /* CREATE */,
+            { details: { original_error: error } }
+          )
+        )
       )
     );
   });
@@ -630,7 +637,8 @@ async function createZipArchive(sources, output, options) {
       totalSize += stats.size;
     }
   }
-  await archive.finalize();
+  archive.finalize().catch(() => {
+  });
   await writePromise;
   const outputStats = statSync(output);
   return {
@@ -675,7 +683,7 @@ async function addDirectoryToTarGzArchive(archive, dirPath, archivePrefix, optio
 }
 async function createTarArchive(sources, output, options) {
   const writeStream = createWriteStream(output);
-  const archive = archiver("tar", {
+  const archive = new TarArchive({
     gzip: false
     // Uncompressed
   });
@@ -684,14 +692,17 @@ async function createTarArchive(sources, output, options) {
   const writePromise = new Promise((resolve, reject) => {
     writeStream.on("close", () => resolve());
     writeStream.on("error", reject);
-  });
-  archive.on("error", (error) => {
-    throw new FulpackOperationError(
-      createFulpackError(
-        ERROR_CODES.EXTRACTION_FAILED,
-        `TAR creation failed: ${error.message}`,
-        "create" /* CREATE */,
-        { details: { original_error: error } }
+    archive.on(
+      "error",
+      (error) => reject(
+        new FulpackOperationError(
+          createFulpackError(
+            ERROR_CODES.EXTRACTION_FAILED,
+            `TAR creation failed: ${error.message}`,
+            "create" /* CREATE */,
+            { details: { original_error: error } }
+          )
+        )
       )
     );
   });
@@ -720,7 +731,8 @@ async function createTarArchive(sources, output, options) {
       totalSize += stats.size;
     }
   }
-  await archive.finalize();
+  archive.finalize().catch(() => {
+  });
   await writePromise;
   const outputStats = statSync(output);
   return {