@fulmenhq/tsfulmen 0.2.10 → 0.3.1

package/CHANGELOG.md

@@ -14,6 +14,54 @@ _No unreleased changes._
 
 ---
 
+## [0.3.1] - 2026-06-15
+
+> **Patch — compile-safety.** Makes tsfulmen safe to embed in `bun build --compile` single-file binaries. Fixes two blockers surfaced downstream by `forge-workhorse-tuvan`: the embedded CLIs shadowed the consumer's own program on import, and an eager WASM load crashed compiled binaries at startup. No breaking changes; Node engine floor unchanged (`>=22.12.0`). Shipped as five reviewed PRs (#13, #14, #15, #16, #17). Full details in `docs/releases/v0.3.1.md`.
+
+### Fixed
+
+- **CLI shadowing under `bun build --compile`** (#15) — the schema/signals/prometheus CLIs self-executed on import via the non-compile-safe guard `import.meta.url === \`file://${process.argv[1]}\``; under `--compile` it fired for non-entry modules, so a compiled consumer importing `@fulmenhq/tsfulmen/schema` ran `tsfulmen-schema` instead of its own program. The library modules no longer parse argv on import; executables moved to dedicated bin entries out of the importable graph.
+- **Compiled-binary WASM `ENOENT` crash** (#14) — bump `@3leaps/string-metrics-wasm` 0.3.8 → 0.3.10, fixing the eager top-level WASM load that `--compile` rewrites but does not embed. Consumers no longer need an `overrides` entry.
+
+### Added
+
+- **Package `bin` commands** `tsfulmen-schema`, `tsfulmen-signals`, `tsfulmen-prometheus` (#15) — the previously internal-only developer CLIs are now exposed as dedicated bin entrypoints (separate from the importable library surface). Additive; no existing API changes.
+- **`.fulmen/app.yaml` app identity** (#16) — declares the package's Fulmen app identity (binary `tsfulmen`, vendor `fulmenhq`, category `sdk`) now that it ships executables; fixes the latent `make validate-app-identity` target. Not shipped in `files` (repo-own identity; must not shadow a consumer's discovery).
+
+### Changed
+
+- **`createPrometheusCLI()` pure factory** (#15) — extracted from the prometheus CLI's `main()`; also delivers the v0.3.0 `buildProgram()` testability follow-up.
+- **CI: GitHub Actions off the Node 20 runtime** (#13) — `checkout`/`cache`/`upload-artifact`/`download-artifact` bumped to node24 majors ahead of GitHub's 2026-06-16 cutover; `setup-bun` normalized; invalid `cache:` input dropped.
+- **CI: compiled-binary smoke guard** (#17) — new build-job step + `make verify-compile-smoke` that packs the tarball, compiles a fixture importing the schema (shadow) and similarity (WASM) surfaces, and asserts the consumer owns its CLI and WASM loads. Both 0.3.0 blockers shipped silently because nothing exercised `--compile`.
+
+---
+
+## [0.3.0] - 2026-06-06
+
+> **Breaking (majors wave).** Migrates four major dependencies (archiver 8, pino 10, TypeScript 6, commander 15) and **raises the Node engine floor to `>=22.12.0`** (was `>=20.0.0`). No external consumers are affected (the galaxy runs Node 22+). Shipped as four reviewed PRs (#6, #9, #10, #11). Full details in `docs/releases/v0.3.0.md`.
+
+### Breaking
+
+- **Node engine floor `>=20.0.0` → `>=22.12.0`** (`package.json` `engines.node`). Driven by commander 15 (requires `node>=22.12.0` for `require(esm)`); also clears pino 10's Node-18 drop. Consumers must be on Node 22.12+.
+
+### Security
+
+- **archiver 7.0.1 → 8.0.0** — escapes the **unpatchable lodash 4.x advisories** that archiver 7 pulled transitively via `archiver-utils` (GHSA-r5fr-rjxr-66jc `_.template` code injection [high] + two `_.unset`/`_.omit` prototype-pollution advisories [moderate] — none have a fixed lodash 4.x, so dropping lodash was the only remedy). archiver 8 removes `archiver-utils`/`lodash` entirely; its `readdir-glob → minimatch` chain resolves to a patched `minimatch@10.2.x`. Net `bun audit`: **23 → 17** findings (15 → 11 high).
+
+### Changed
+
+- **archiver 8 API migration** (`src/fulpack/core.ts`) — archiver 8 is a ground-up ESM rewrite that replaced the callable `archiver(format, options)` factory with format-specific classes. Updated to `new TarArchive(...)` / `new ZipArchive(...)` and the imported `Archiver` type. No public-API or behavior change for fulpack (`create`/`extract`/`scan` unchanged); all 122 fulpack/test files green.
+- **Local archiver v8 type shim** (`src/fulpack/archiver.d.ts`) — archiver 8 ships no types and `@types/archiver` is frozen on the removed v7 factory API, so `@types/archiver` was dropped in favor of a focused ambient `declare module "archiver"` covering the v8 surface fulpack uses. The shim leaks no `archiver` types into the published `dist` surface. **Remove the shim and restore `@types/archiver` once `@types/archiver@8` lands on DefinitelyTyped.**
+- **pino 9.14.0 → 10.3.1** — clean major bump (no source changes). pino 10's only breaking change is dropping Node 18, satisfied by the wave's engine floor; pino remains CJS with a default export, so the `src/logging/logger.ts` integration is unchanged. tsfulmen uses custom redaction (`logging/middleware.ts`), not pino's `redact`/`censor`, so the v10.1.0 censor type change does not apply. Sinks are custom (not pino transports), so the thread-stream@4 / pino-abstract-transport@3 upgrades have no surface here. Added DEBUG/WARN severity-label coverage to complete the logger output assertions across all four methods.
+- **commander 14.0.3 → 15.0.0** — commander 15 is ESM-only and requires `node>=22.12.0` (drives the engine-floor bump above). No source changes: tsfulmen is already ESM and all three CLIs (`foundry/signals`, `schema`, `telemetry/prometheus`) use the stable `import { Command }` API. The `schema export` command defines **standalone** negated flags (`--no-provenance`, `--no-validate`); commander 15's parsing change affects only **paired** positive+negative option definitions (e.g. both `--foo` and `--no-foo`), which tsfulmen does not use, so standalone `--no-*` behavior is unchanged (verified: `schema export --no-provenance --no-validate` works under v15). Validated by smoke-testing the CLIs under v15 at the parse level (help rendering, subcommands, `--json`, the `--no-*` flags above) plus the existing CLI-logic tests. The CLIs `program.parse()` on import, so commander-level arg-parse unit tests would need an `import.meta.main` guard + extracted `buildProgram()` (tracked as a testability follow-up, not part of this bump). _Note: `telemetry/prometheus` `export`/`validate` actions exercise downstream exporter logic that requires a populated `TelemetryRegistry`; those fail in a bare standalone CLI invocation (pre-existing, unrelated to commander — parsing succeeds, the `RefreshError` originates in `exporter.ts`)._
+- **TypeScript (dev) 5.9.3 → 6.0.3** — compiler bump, no `src/` changes. The `tsconfig.json` already sets all options explicitly (`target`/`module`/`lib` ES2022, `moduleResolution: bundler`, `esModuleInterop: true`, `strict`, `skipLibCheck`) and uses none of the options TS 6 removed (`outFile`, `classic`/`node10` resolution, `importsNotUsedAsValues`, etc.), so the default changes don't apply. **Added `ignoreDeprecations: "6.0"`** to `tsconfig.json`: the `.d.ts` build (tsup 8.5.1) injects `baseUrl: "."` into the declaration compiler options (`rollup-plugin-dts` path), and TS 6 errors on the now-deprecated `baseUrl` (`TS5101`) — `ignoreDeprecations` is the TS-sanctioned 6.x-transition opt-out (remove once tsup stops injecting `baseUrl` or before TS 7). Typecheck, full `tsup` `.d.ts` emit, and the `validate:exports`/`validate:types`/`validate:imports` consumer-surface suite all pass under 6.0.3.
+
+### Fixed
+
+- **Node 25 test teardown** — `src/config/__tests__/loader.test.ts` used the deprecated `fs.rmdir(path, { recursive: true })`, which is a deprecation warning on Node ≤24 but a hard failure on Node 25.x. Switched to `fs.rm(path, { recursive: true, force: true })` (surfaced during the pino 10 review on Node 25.8.0).
+
+---
+
 ## [0.2.10] - 2026-06-05
 
 ### Security

package/README.md

@@ -8,7 +8,7 @@ Every team writes their own HTTP status helpers, exit code enums, and country co
 - **Cross-language parity**: Same exit codes, signals, and schemas as gofulmen, rsfulmen, pyfulmen
 - **Type-safe**: Full TypeScript types with strict mode throughout
 
-**Lifecycle Phase**: `beta` | **Version**: 0.2.10 | **Test Coverage**: 71%
+**Lifecycle Phase**: `beta` | **Version**: 0.3.0 | **Test Coverage**: 71%
 
 **Install**: `bun add @fulmenhq/tsfulmen` (or `npm install @fulmenhq/tsfulmen`)