@ultimat3/cli 28.0.0 → 29.1.0

package/src/site-config.ts

@@ -1,9 +1,9 @@
-// The public origin and the crawler rules out of `app.config.ts` — `site.origin`,
-// `seo.robots.disallow` and `seo.robots.groups` — and the one resolution of "which origin is this site served on" every
+// The public origin, the app's favicon and the crawler rules out of `app.config.ts` — `site.origin`,
+// `site.favicon`, `seo.robots.disallow` and `seo.robots.groups` — and the one resolution of "which origin is this site served on" every
 // absolute URL a document, a sitemap or a robots file carries is built against. Read off the one
 // loader (`app-config-load.ts`).
 
-import type { Environment, SeoRobotsGroup, SeoSitemapConfig } from '@ultimat3/core';
+import type { Environment, SeoRobotsGroup, SeoSitemapConfig, SiteFavicon } from '@ultimat3/core';
 import { loadAppConfig } from './app-config-load';
 
 export interface SiteSettings {
@@ -18,6 +18,14 @@ export interface SiteSettings {
   readonly robotsGroups?: readonly SeoRobotsGroup[] | undefined;
   /** `seo.sitemap` — public `app/` pages to list, where `<lastmod>` comes from, sections, page size. */
   readonly sitemap: SeoSitemapConfig;
+  /**
+   * `site.favicon` — the app's SVG favicon, named as a site asset path (`assets/brand/icon.svg`).
+   * `undefined` when the app declares none. The boot resolves it ONCE, through the site asset
+   * table (`siteAssetTable(root).resolve(path).url` — the table `/assets/*` serves and `asset()`
+   * answers from), into the content-hashed URL every document carries. Optional so a
+   * `SiteSettings` literal written before it existed still compiles.
+   */
+  readonly favicon?: SiteFavicon | undefined;
 }
 
 export const NO_SITE_SETTINGS: SiteSettings = {
@@ -25,6 +33,7 @@ export const NO_SITE_SETTINGS: SiteSettings = {
   disallow: [],
   robotsGroups: [],
   sitemap: { extra: [], lastmod: 'none', sections: [], pageSize: 50_000 },
+  favicon: undefined,
 };
 
 const trimSlash = (origin: string): string => origin.replace(/\/+$/, '');
@@ -32,12 +41,13 @@ const trimSlash = (origin: string): string => origin.replace(/\/+$/, '');
 export async function loadSiteSettings(root: string): Promise<SiteSettings> {
   const config = await loadAppConfig(root);
   if (config === undefined) return NO_SITE_SETTINGS;
-  const { origin } = config.site;
+  const { origin, favicon } = config.site;
   return {
     origin: origin === null ? null : trimSlash(origin),
     disallow: [...config.seo.robots.disallow],
     robotsGroups: [...(config.seo.robots.groups ?? [])],
     sitemap: config.seo.sitemap,
+    favicon,
   };
 }
 

package/src/templates/scaffold-container.ts

@@ -32,16 +32,16 @@ const dockerfile = (
 # from the file itself, and without it the frozen install cannot find what the lockfile names.
 # The tag names the series for the reader; the digest is what builds — a tag is a pointer its
 # publisher can move. Dependabot's docker ecosystem moves the digest together with the tag.
-# The digest is \`oven/bun:1.4.3-alpine\`'s, the patch the framework that wrote this file was
+# The digest is \`oven/bun:1.4.4-alpine\`'s, the patch the framework that wrote this file was
 # tested on — the same patch as \`engines.bun\` in package.json.
-FROM oven/bun:1.4-alpine@sha256:629e17411f1f129dbec3af78d5af9c9f2a937435c80349437206c6b0b7422373 AS manifests
+FROM oven/bun:1.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a AS manifests
 WORKDIR /app
 COPY . .
 RUN find . ! -type d ! -name package.json ! -name bunfig.toml ! -name '*.tgz' -delete \\
  && find . -type d -empty -delete
 
 # ---------- deps: runtime dependencies only, cached on the lockfile and the manifests ----------
-FROM oven/bun:1.4-alpine@sha256:629e17411f1f129dbec3af78d5af9c9f2a937435c80349437206c6b0b7422373 AS deps
+FROM oven/bun:1.4-alpine@sha256:4cf82f5686b196504fe119db3fcd9185b191f82ece82c40680e597228ec6070a AS deps
 WORKDIR /app
 COPY --from=manifests /app ./
 COPY bun.lock ./

package/src/templates/scaffold-repo.ts

@@ -45,11 +45,11 @@ const TYPESCRIPT_VERSION = '^7.0.2';
 
 /**
  * The Solid runtime every island and `@ultimat3/ui` component renders with, exact for the reason
- * `BIOME_VERSION` is: the CLI compiles islands with `babel-preset-solid ^1.9.15`, and a scaffold
+ * `BIOME_VERSION` is: the CLI compiles islands with `babel-preset-solid ^1.9.16`, and a scaffold
  * that installed an older runtime than the compiler targets drifted as a buried literal (1.9.14
  * beside the repository's 1.9.15). `scaffold-repo.test.ts` holds it equal to the root manifest's.
  */
-const SOLID_VERSION = '1.9.15';
+const SOLID_VERSION = '1.9.17';
 
 // `engines.bun` is `REQUIRED_BUN`, the floor the SHIPPED `x` enforces
 // (`packages/cli/src/app-root.ts`), and not a second literal. It was one: `>=1.3.0`, a whole minor

package/src/workspace-graph.ts

@@ -1,13 +1,16 @@
 // The workspace dependency graph, in the two forms that must agree: the edges every manifest
 // DECLARES, the edges every shipped source file actually IMPORTS, and the gate rule that the
-// second is a subset of the first. An edge that lives only in a tsconfig `paths` entry resolves
-// for `tsc` and is invisible to bun, to `--filter` ordering and to any change-detection tool.
+// second is covered by the first, with no unused framework sibling declarations. A tsconfig-only
+// edge resolves for `tsc` but is invisible to bun, `--filter` ordering and change-detection tools.
 
 import { join } from 'node:path';
 import { ERROR_DOCS_URL, maskLiterals } from '@ultimat3/core';
+import { CATALOG_PACKAGES } from './error-catalog';
 import { scanAllImports } from './import-scan';
 import type { Finding } from './output';
-import { eachSourceFile, isGenerated, isTest, isVendored } from './source-files';
+import { FIXTURE_SUFFIX } from './publish-closure';
+import { quoteArg } from './shell-quote';
+import { eachSourceFile, isGenerated, isTest, isVendored, SOURCE_GLOBS } from './source-files';
 
 export interface WorkspaceNode {
   /** package.json "name". */
@@ -176,7 +179,7 @@ export const undeclaredWorkspaceDepFinding = (
   cause: `${at} imports ${to.name}, which ${from.dir}/package.json does not declare`,
   // The exact line to paste, at the version the target really carries: a `workspace:*` range would
   // resolve and then fail `checkLockstep`, which compares a sibling pin against the version.
-  fix: `add "${to.name}": "${to.version ?? '0.0.0'}" to "dependencies" in ${from.dir}/package.json`,
+  fix: `add "${to.name}": "${to.version ?? '0.0.0'}" to "${at.endsWith(FIXTURE_SUFFIX) ? 'devDependencies' : 'dependencies'}" in ${from.dir}/package.json`,
   docs: ERROR_DOCS_URL,
   at: `${from.dir}/package.json`,
 });
@@ -186,10 +189,9 @@ export const undeclaredWorkspaceDepFinding = (
  * declared none of it — the imports resolved through the root tsconfig's `paths`, so the edges
  * existed only inside `tsc` and every tool that asks what a change affects answered short.
  *
- * Shipped source only. A test file is excluded from the tarball by every package here
- * (`TEST_EXCLUSION`) and resolves its imports through the ROOT manifest's hoisted devDependencies,
- * which is why no `packages/*` in this repo carries a `devDependencies` block of its own —
- * judging test imports would demand 29 of them to describe a resolution that already works.
+ * Tests resolve through the root's hoisted devDependencies and are excluded here. Fixtures still
+ * need forward declarations, but their imports justify only development dependencies: they are
+ * excluded from tarballs and must not keep unused shipped dependency fields alive.
  *
  * One finding per (workspace, dependency) pair, never one per import site: the fix is one line in
  * one manifest, and repeating it per file is noise an author has to deduplicate by hand.
@@ -202,6 +204,8 @@ export async function checkWorkspaceDependencies(root: string): Promise<readonly
   // Deepest directory first: a nested workspace's files are its own, never its parent's.
   const owners = [...graph].sort((left, right) => right.dir.length - left.dir.length);
   const reported = new Set<string>();
+  const used = new Set<string>();
+  const fixtureUsed = new Set<string>();
   for await (const path of eachSourceFile(root)) {
     if (isTest(path) || isGenerated(path)) continue;
     const owner = owners.find((node) => path.startsWith(`${node.dir}/`));
@@ -209,12 +213,55 @@ export async function checkWorkspaceDependencies(root: string): Promise<readonly
     for (const name of importedPackages(await Bun.file(join(root, path)).text(), path)) {
       const target = byName.get(name);
       if (target === undefined || target.name === owner.name) continue;
-      if (owner.dependencies.includes(target.name)) continue;
       const pair = `${owner.dir} ${target.name}`;
+      // Fixtures still owe forward declarations, but never justify a shipped dependency.
+      (path.endsWith(FIXTURE_SUFFIX) ? fixtureUsed : used).add(pair);
+      if (owner.dependencies.includes(target.name)) continue;
       if (reported.has(pair)) continue;
       reported.add(pair);
       findings.push(undeclaredWorkspaceDepFinding(owner, target, path));
     }
   }
+  for (const owner of graph) {
+    // Only infer absence where the source contract scans. Match directory prefixes rather than
+    // observed files so a covered workspace with no source still owes removal of unused siblings.
+    const covered = SOURCE_GLOBS.some((pattern) => {
+      const directories = pattern.split('/').slice(0, -1);
+      return directories.some((_, index) =>
+        new Bun.Glob(directories.slice(0, index + 1).join('/')).match(owner.dir),
+      );
+    });
+    if (!covered || isVendored(owner.dir)) continue;
+    const unused = owner.dependencies.filter(
+      (name) =>
+        name.startsWith('@ultimat3/') &&
+        !used.has(`${owner.dir} ${name}`) &&
+        !(owner.name === '@ultimat3/cli' && CATALOG_PACKAGES.some((root) => root === name)),
+    );
+    if (unused.length === 0) continue;
+    const path = `${owner.dir}/package.json`;
+    const manifest = await readManifest(join(root, path));
+    for (const name of unused) {
+      const fields = DEPENDENCY_FIELDS.filter(
+        (field) =>
+          Object.hasOwn(asRecord(manifest?.[field]) ?? {}, name) &&
+          !(field === 'devDependencies' && fixtureUsed.has(`${owner.dir} ${name}`)),
+      );
+      if (fields.length === 0) continue;
+      // A package-wide remove would also delete a valid fixture-only development declaration.
+      const script =
+        'const [path, name, fields] = Bun.argv.slice(-3); ' +
+        'const manifest = await Bun.file(path).json(); ' +
+        'for (const field of JSON.parse(fields)) delete manifest[field]?.[name]; ' +
+        'await Bun.write(path, JSON.stringify(manifest, null, 2) + "\\n");';
+      findings.push({
+        code: 'X_PACKAGE_SHAPE',
+        cause: `${path} declares ${name} in ${fields.join(', ')}, but no eligible source in ${owner.dir} imports it`,
+        fix: `bun -e ${quoteArg(script)} -- ${quoteArg(path)} ${quoteArg(name)} ${quoteArg(JSON.stringify(fields))}`,
+        docs: ERROR_DOCS_URL,
+        at: path,
+      });
+    }
+  }
   return findings;
 }