@smoothbricks/cli 0.10.3 → 0.10.5

package/src/monorepo/runtime.test.ts

@@ -1,11 +1,12 @@
 import { describe, expect, test } from 'bun:test';
-import { runtimeTypesRangeForPublishedVersions } from './runtime.js';
+import type { PackageJson } from '../lib/json.js';
+import { runtimeTypesRangeForPublishedVersions, validateRuntimePins } from './runtime.js';
 
 describe('runtimeTypesRangeForPublishedVersions', () => {
-  test('uses the installed Node major when @types/node has published it', () => {
+  test('uses the newest published minor within the installed Node major, never the ~major.0.0 floor', () => {
     expect(
       runtimeTypesRangeForPublishedVersions('@types/node', '24.12.0', 'major', ['24.0.0', '24.12.4', '25.9.1']),
-    ).toBe('~24.0.0');
+    ).toBe('~24.12.4');
   });
 
   test('falls back to latest published @types/node when the Node major is unpublished', () => {
@@ -28,3 +29,41 @@ describe('runtimeTypesRangeForPublishedVersions', () => {
     );
   });
 });
+
+describe('validateRuntimePins', () => {
+  const runtime = { node: '24.16.0', bun: '1.3.14' };
+  const aligned = () => ({
+    engines: { node: '>=24.0.0' },
+    packageManager: 'bun@1.3.14',
+    devDependencies: { '@types/node': '~24.13.0' },
+  });
+
+  test('passes when every pin agrees with the PATH runtimes', () => {
+    expect(validateRuntimePins(aligned(), runtime)).toBe(0);
+  });
+
+  test('fails when @types/node tracks a different major than the PATH node', () => {
+    const pkg = aligned();
+    pkg.devDependencies['@types/node'] = '~26.1.1';
+    expect(validateRuntimePins(pkg, runtime)).toBe(1);
+  });
+
+  test('fails the ~major.0.0 floor pin even when the major matches', () => {
+    const pkg = aligned();
+    pkg.devDependencies['@types/node'] = '~24.0.0';
+    expect(validateRuntimePins(pkg, runtime)).toBe(1);
+  });
+
+  test('fails engines.node and packageManager drift against the PATH runtimes', () => {
+    const pkg = aligned();
+    pkg.engines.node = '>=22.0.0';
+    pkg.packageManager = 'bun@1.2.0';
+    expect(validateRuntimePins(pkg, runtime)).toBe(2);
+  });
+
+  test('fails a missing @types/node pin', () => {
+    const pkg: PackageJson = aligned();
+    pkg.devDependencies = {};
+    expect(validateRuntimePins(pkg, runtime)).toBe(1);
+  });
+});

package/src/monorepo/runtime.ts

@@ -1,7 +1,31 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { $ } from 'bun';
-import { getOrCreateRecord, readJsonObject, setStringProperty, writeJsonObject } from '../lib/json.js';
+import {
+  ensureDependencyMap,
+  ensureEngines,
+  type PackageJson,
+  parseStringArrayText,
+  readJsonObject,
+  setPackageStringField,
+  setStringProperty,
+  writeJsonObject,
+} from '../lib/json.js';
+
+export interface RuntimeVersions {
+  node: string;
+  bun: string;
+}
+
+/** Live runtime versions from the shell PATH — the single source sync AND validate derive from. */
+export async function runtimeVersionsFromPath(root: string): Promise<RuntimeVersions> {
+  const node = runtimeCommand(root, 'node');
+  const bun = runtimeCommand(root, 'bun');
+  return {
+    node: (await $`${node} --version`.cwd(root).text()).trim().replace(/^v/, ''),
+    bun: (await $`${bun} --version`.cwd(root).text()).trim(),
+  };
+}
 
 export async function syncRootRuntimeVersions(root: string): Promise<void> {
   const packageJsonPath = join(root, 'package.json');
@@ -9,20 +33,17 @@ export async function syncRootRuntimeVersions(root: string): Promise<void> {
   if (!packageJson) {
     throw new Error('package.json not found or invalid');
   }
-  const node = runtimeCommand(root, 'node');
-  const bun = runtimeCommand(root, 'bun');
-  const nodeVersion = (await $`${node} --version`.cwd(root).text()).trim().replace(/^v/, '');
-  const bunVersion = (await $`${bun} --version`.cwd(root).text()).trim();
+  const { node: nodeVersion, bun: bunVersion } = await runtimeVersionsFromPath(root);
   const nodeMajor = nodeVersion.split('.', 1)[0];
   if (!nodeMajor) {
     throw new Error(`Unable to derive Node major version from ${nodeVersion}`);
   }
 
   let changed = false;
-  const engines = getOrCreateRecord(packageJson, 'engines');
+  const engines = ensureEngines(packageJson);
   changed = setStringProperty(engines, 'node', `>=${nodeMajor}.0.0`) || changed;
-  changed = setStringProperty(packageJson, 'packageManager', `bun@${bunVersion}`) || changed;
-  const devDependencies = getOrCreateRecord(packageJson, 'devDependencies');
+  changed = setPackageStringField(packageJson, 'packageManager', `bun@${bunVersion}`) || changed;
+  const devDependencies = ensureDependencyMap(packageJson, 'devDependencies');
   changed =
     setStringProperty(
       devDependencies,
@@ -42,6 +63,58 @@ export async function syncRootRuntimeVersions(root: string): Promise<void> {
   }
 }
 
+/**
+ * Validate that package.json runtime pins agree with the LIVE PATH runtimes,
+ * never a stored template. Offline by design: structural alignment only
+ * (majors, exact bun pin, no `~major.0.0` floor) — the registry is not
+ * consulted. Repair: `smoo monorepo init --runtime-only` inside the devenv shell.
+ */
+export async function validateRootRuntimeVersions(root: string): Promise<number> {
+  const packageJson = readJsonObject(join(root, 'package.json'));
+  if (!packageJson) {
+    console.error('package.json not found or invalid');
+    return 1;
+  }
+  return validateRuntimePins(packageJson, await runtimeVersionsFromPath(root));
+}
+
+export function validateRuntimePins(packageJson: PackageJson, runtime: RuntimeVersions): number {
+  const nodeMajor = runtime.node.split('.', 1)[0];
+  if (!nodeMajor) {
+    throw new Error(`Unable to derive Node major version from ${runtime.node}`);
+  }
+  let failures = 0;
+  const repair = 'run `smoo monorepo init --runtime-only` inside the devenv shell';
+  const enginesNode = packageJson.engines?.node ?? null;
+  if (enginesNode !== `>=${nodeMajor}.0.0`) {
+    console.error(
+      `package.json engines.node is ${enginesNode ?? 'missing'} but the PATH node is v${runtime.node} — expected >=${nodeMajor}.0.0; ${repair}`,
+    );
+    failures++;
+  }
+  const packageManager = packageJson.packageManager ?? null;
+  if (packageManager !== `bun@${runtime.bun}`) {
+    console.error(
+      `package.json packageManager is ${packageManager ?? 'missing'} but the PATH bun is ${runtime.bun} — expected bun@${runtime.bun}; ${repair}`,
+    );
+    failures++;
+  }
+  const typesNode = packageJson.devDependencies?.['@types/node'] ?? null;
+  const typesNodeParts = typesNode ? /^~(\d+)\.(\d+)\.(\d+)$/.exec(typesNode) : null;
+  if (!typesNodeParts || typesNodeParts[1] !== nodeMajor) {
+    console.error(
+      `package.json @types/node is ${typesNode ?? 'missing'} but the PATH node is v${runtime.node} — types track the runtime major (~${nodeMajor}.x.y, newest published minor); ${repair}`,
+    );
+    failures++;
+  } else if (typesNodeParts[2] === '0' && typesNodeParts[3] === '0') {
+    console.error(
+      `package.json @types/node is pinned to the ~${nodeMajor}.0.0 floor — tilde locks the first patch line and strands the repo on early broken releases; ${repair} to repin to the newest published ${nodeMajor}.x`,
+    );
+    failures++;
+  }
+  return failures;
+}
+
 type RuntimeTypesPinMode = 'major' | 'exact';
 
 async function runtimeTypesRange(
@@ -51,8 +124,8 @@ async function runtimeTypesRange(
   pinMode: RuntimeTypesPinMode,
 ): Promise<string> {
   const versionsText = await $`bun pm view ${packageName} versions --json`.cwd(root).text();
-  const versions = JSON.parse(versionsText) as unknown;
-  if (!Array.isArray(versions) || !versions.every((version) => typeof version === 'string')) {
+  const versions = parseStringArrayText(versionsText);
+  if (!versions) {
     throw new Error(`Unable to read published ${packageName} versions`);
   }
   return runtimeTypesRangeForPublishedVersions(packageName, runtimeVersion, pinMode, versions);
@@ -71,8 +144,13 @@ export function runtimeTypesRangeForPublishedVersions(
 
   if (pinMode === 'major') {
     const runtimeMajor = parsedRuntimeVersion[0].toString();
-    if (latestVersion(versions.filter((version) => versionMajor(version) === runtimeMajor))) {
-      return `~${runtimeMajor}.0.0`;
+    // Newest published types WITHIN the runtime major — never the `~major.0.0`
+    // floor: tilde locks the patch line, so the floor can strand consumers on a
+    // broken early release (e.g. @types/node 24.0.x's URLPattern/DOM TS2403
+    // conflict, fixed in 24.13) with no path to the repaired minors.
+    const latestInMajor = latestVersion(versions.filter((version) => versionMajor(version) === runtimeMajor));
+    if (latestInMajor) {
+      return `~${latestInMajor}`;
     }
   } else if (versions.includes(runtimeVersion)) {
     return runtimeVersion;

package/src/monorepo/tool-validation.test.ts

@@ -13,13 +13,20 @@ import {
 const registryVersions: Record<string, string[]> = {
   '@biomejs/biome': ['2.3.5'],
   '@nx/js': ['23.1.0'],
+  '@smoothbricks/cli': ['0.10.3', '0.10.4'],
   '@smoothbricks/nx-plugin': ['0.3.0'],
   eslint: ['9.39.1'],
   'eslint-stdout': ['1.1.1', '1.1.2'],
   nx: ['23.1.0'],
   prettier: ['3.6.1'],
-  ttsc: ['0.18.4'],
-  typescript: ['5.9.3'],
+  ttsc: ['0.19.3'],
+  typescript: ['6.0.3'],
+  // alias package is not fetched from registry under this name when using fallback
+  '@typescript/native': ['7.0.2'],
+};
+
+const registryLatestTags: Record<string, string> = {
+  '@smoothbricks/cli': '0.10.4',
 };
 
 const realFetch = globalThis.fetch;
@@ -58,9 +65,9 @@ describe('tool configuration validation', () => {
 `,
       );
 
-      expect(validateToolConfig(root)).toBeGreaterThan(0);
+      expect(await validateToolConfig(root)).toBeGreaterThan(0);
       await applyToolConfigDefaults(root);
-      expect(validateToolConfig(root)).toBe(0);
+      expect(await validateToolConfig(root)).toBe(0);
 
       const rootPackage = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
       const toolingPackage = JSON.parse(await readFile(join(root, 'tooling/package.json'), 'utf8'));
@@ -69,6 +76,10 @@ describe('tool configuration validation', () => {
       expect(rootPackage.devDependencies['@smoothbricks/nx-plugin']).toBe('workspace:*');
       expect(rootPackage.devDependencies['eslint-stdout']).toBe('workspace:*');
       expect(rootPackage.devDependencies.nx).toBe('23.1.0');
+      expect(rootPackage.devDependencies.ttsc).toBe('0.19.3');
+      expect(rootPackage.devDependencies.typescript).toBe('^6.0.3');
+      expect(rootPackage.devDependencies['@typescript/native']).toBe('npm:typescript@^7.0.2');
+      expect(rootPackage.patchedDependencies['ttsc@0.19.3']).toBe('patches/ttsc@0.19.3.patch');
       expect(rootPackage.workspaces).toContain('tooling');
       expect(toolingPackage.name).toBe('@smoothbricks/tooling');
       expect(toolingPackage.dependencies['@smoothbricks/cli']).toBe('workspace:*');
@@ -97,8 +108,12 @@ describe('tool configuration validation', () => {
           'eslint-stdout': await currentEslintStdoutRange(),
           nx: '24.0.0',
           prettier: '^3.7.0',
-          ttsc: '^0.19.0',
+          ttsc: '0.19.3',
           typescript: '^6.0.0',
+          '@typescript/native': 'npm:typescript@^7.0.2',
+        },
+        patchedDependencies: {
+          'ttsc@0.19.3': 'patches/ttsc@0.19.3.patch',
         },
       });
       await writeJson(join(root, 'tooling/package.json'), {
@@ -128,18 +143,17 @@ describe('tool configuration validation', () => {
 `,
       );
 
-      expect(validateToolConfig(root)).toBe(0);
+      expect(await validateToolConfig(root)).toBe(0);
     } finally {
       await rm(root, { recursive: true, force: true });
     }
   });
 
-  it('preserves an installable CLI range when the running CLI is a linked prerelease', async () => {
+  it('bumps consumer CLI pin to npm latest even when the running CLI is a linked prerelease', async () => {
     const root = await mkdtemp(join(tmpdir(), 'smoo-tool-validation-'));
     try {
       const configuredRange = '^0.10.1';
-      const runningRange = await currentCliRange();
-      const expectedRange = runningRange.includes('-') ? configuredRange : runningRange;
+      const expectedRange = `^${registryLatestTags['@smoothbricks/cli']}`;
       await writeJson(join(root, 'package.json'), {
         name: '@fixture/app',
         version: '0.0.0',
@@ -152,7 +166,7 @@ describe('tool configuration validation', () => {
         dependencies: { '@smoothbricks/cli': configuredRange },
       });
 
-      const context = readToolContext(root);
+      const context = await readToolContext(root);
       expect(context.policy.cliDependencyRange).toBe(expectedRange);
       applyToolingPackageDefaults(root, context.policy);
 
@@ -172,7 +186,7 @@ describe('tool configuration validation', () => {
         private: true,
         workspaces: ['packages/*', 'tooling'],
       });
-      applyToolingPackageDefaults(root, readToolContext(root).policy);
+      applyToolingPackageDefaults(root, (await readToolContext(root)).policy);
 
       const toolingPackage = JSON.parse(await readFile(join(root, 'tooling/package.json'), 'utf8'));
       expect(toolingPackage.name).toBe('@smoothbricks/tooling');
@@ -196,12 +210,12 @@ describe('tool configuration validation', () => {
           eslint: '^10.0.0',
           nx: '24.0.0',
           prettier: '^3.7.0',
-          ttsc: '^0.19.0',
+          ttsc: '0.19.3',
           typescript: '^6.0.0',
         },
       });
 
-      const context = readToolContext(root);
+      const context = await readToolContext(root);
       await applyRootDevDependencyDefaults(root, context);
       applyToolingPackageDefaults(root, context.policy);
 
@@ -209,6 +223,8 @@ describe('tool configuration validation', () => {
       const toolingPackage = JSON.parse(await readFile(join(root, 'tooling/package.json'), 'utf8'));
       expect(rootPackage.devDependencies['eslint-stdout']).toBe(await currentEslintStdoutRange());
       expect(rootPackage.devDependencies['@smoothbricks/nx-plugin']).toBe(await currentNxPluginRange());
+      expect(rootPackage.devDependencies['@typescript/native']).toBe('npm:typescript@^7.0.2');
+      expect(rootPackage.patchedDependencies?.['ttsc@0.19.3']).toBe('patches/ttsc@0.19.3.patch');
       expect(toolingPackage.name).toBe('@fixture/tooling');
       expect(toolingPackage.dependencies['@smoothbricks/cli']).toBe(await currentCliRange());
     } finally {
@@ -218,8 +234,7 @@ describe('tool configuration validation', () => {
 });
 
 async function currentCliRange(): Promise<string> {
-  const pkg = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8'));
-  return `^${pkg.version}`;
+  return `^${registryLatestTags['@smoothbricks/cli']}`;
 }
 
 async function currentEslintStdoutRange(): Promise<string> {
@@ -235,8 +250,15 @@ const mockRegistryFetch = Object.assign(
     if (!versions) {
       return Promise.resolve(new Response('{}', { status: 404 }));
     }
+    const body: Record<string, unknown> = {
+      versions: Object.fromEntries(versions.map((version) => [version, {}])),
+    };
+    const latest = registryLatestTags[packageName];
+    if (latest) {
+      body['dist-tags'] = { latest };
+    }
     return Promise.resolve(
-      new Response(JSON.stringify({ versions: Object.fromEntries(versions.map((version) => [version, {}])) }), {
+      new Response(JSON.stringify(body), {
         status: 200,
         headers: { 'content-type': 'application/json' },
       }),