@mercury-fw/cli 0.28.0 → 0.28.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @mercury-fw/cli
 
+## 0.28.2
+
+### Patch Changes
+
+- 0c5bb5b: Dependencies at their latest minor: `ai` 7.0.126, `ai-sdk-ollama` 4.4.0, `zod` 4.6.5, `yaml` 2.9.1, `shell-quote` 1.11.0. A new app from `mfw create` runs Qdrant on its `v1` tag, which follows every 1.x release, instead of a fixed 1.19.0, and gets `@types/bun` `^1.4.2`.
+- Updated dependencies [0c5bb5b]
+  - @mercury-fw/core@0.28.2
+
+## 0.28.1
+
+### Patch Changes
+
+- ab52977: An app created with the Google Chat channel trusts `protobufjs` in `trustedDependencies`, so its install no longer reports that package's postinstall as blocked. The channel's README says to do the same when adding it by hand.
+  - @mercury-fw/core@0.28.1
+
 ## 0.28.0
 
 ### Minor Changes

package/dist/src/catalog.d.ts

@@ -22,6 +22,9 @@ export type CatalogEntry = {
     env: EnvVar[];
     formatter?: FormatterExample;
     credentials?: CliCredentials;
+    /** Dependencies whose install scripts Bun must run for this entry (Bun runs
+     * none it isn't told to trust), on top of a tool plugin's own package. */
+    trusts?: string[];
 };
 /** Where a tool plugin's CLI keeps its login: `folder` under the CLI user's
  * `~/.config`, and the env variable that carries that folder into the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mercury-fw/cli",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -36,18 +36,18 @@
   "comment:shape": "The Mercury CLI (`mfw`). `mfw create <dir>` writes a new Mercury app from the template. The framework packages move in lockstep with it, so a new app gets them at the CLI's own version; plugins and channels at the registry's latest. The plugin and channel packages are devDependencies only for the catalog test. `main(argv)` is exported for create-mercury-agent.",
   "dependencies": {
     "@clack/prompts": "^1.8.1",
-    "@mercury-fw/core": "0.28.0",
+    "@mercury-fw/core": "0.28.2",
     "commander": "^15.0.0"
   },
   "devDependencies": {
-    "@mercury-fw/channel-google-chat": "0.1.1",
+    "@mercury-fw/channel-google-chat": "0.1.2",
     "@mercury-fw/channel-http": "0.1.0",
-    "@mercury-fw/formatter": "0.28.0",
+    "@mercury-fw/formatter": "0.28.2",
     "@mercury-fw/plugin-atlassian-admin": "0.1.0",
     "@mercury-fw/plugin-bitbucket": "0.1.0",
-    "@mercury-fw/plugin-jira": "0.1.0",
+    "@mercury-fw/plugin-jira": "0.1.1",
     "@mercury-fw/typescript-config": "*",
-    "@types/bun": "^1.4.0",
+    "@types/bun": "^1.4.2",
     "typescript": "^6.0.3"
   }
 }

package/src/catalog.ts

@@ -20,6 +20,9 @@ export type CatalogEntry = {
   env: EnvVar[];
   formatter?: FormatterExample;
   credentials?: CliCredentials;
+  /** Dependencies whose install scripts Bun must run for this entry (Bun runs
+   * none it isn't told to trust), on top of a tool plugin's own package. */
+  trusts?: string[];
 };
 
 /** Where a tool plugin's CLI keeps its login: `folder` under the CLI user's
@@ -41,6 +44,9 @@ export const CATALOG: CatalogEntry[] = [
     kind: "channel",
     package: "@mercury-fw/channel-google-chat",
     exportName: "googleChatChannel",
+    // Pulled in by @google-cloud/pubsub; its postinstall only checks how
+    // dependents spell its version range.
+    trusts: ["protobufjs"],
     env: [
       {
         name: "GOOGLE_CHAT_PUBSUB_SUBSCRIPTION",

package/src/render.ts

@@ -277,10 +277,11 @@ function renderPackageJson(
     dependencies,
     // The CLI in the app itself, so `bunx mfw` runs the version that matches
     // the framework the app depends on.
-    devDependencies: { "@mercury-fw/cli": `^${cli}`, "@types/bun": "^1.4.0", typescript: "^6.0.3" },
+    devDependencies: { "@mercury-fw/cli": `^${cli}`, "@types/bun": "^1.4.2", typescript: "^6.0.3" },
   };
-  if (tools.length > 0) {
-    manifest.trustedDependencies = tools.map((t) => t.package).sort();
+  const trusted = [...new Set([...tools.map((t) => t.package), ...[...channels, ...tools].flatMap((e) => e.trusts ?? [])])];
+  if (trusted.length > 0) {
+    manifest.trustedDependencies = trusted.sort();
   }
   return `${JSON.stringify(manifest, null, 2)}\n`;
 }
@@ -345,7 +346,7 @@ function renderCompose(name: string, hasTools: boolean): string {
     "      - qdrant",
     "",
     "  qdrant:",
-    "    image: qdrant/qdrant:v1.19.0",
+    "    image: qdrant/qdrant:v1",
     "    volumes:",
     "      - qdrant-data:/qdrant/storage",
     "",