create-bw-app 0.27.3 → 0.27.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-bw-app",
   "private": false,
-  "version": "0.27.3",
+  "version": "0.27.4",
   "type": "module",
   "bin": {
     "create-bw-app": "bin/create-bw-app.mjs",

package/src/add.mjs

@@ -6,7 +6,7 @@ import { SELECTABLE_MODULES } from "./constants.mjs";
 import { TEMPLATE_ROOT, createDbInstallPlan, createManagedPlatformFiles, getDbModuleRegistry, getVersionMap, pathExists, readJsonIfPresent } from "./generator.mjs";
 import { collectScaffoldFiles, findWorkspaceRoot, loadModuleCatalog, MODULE_PACKAGES, readAppManifest, resolveModuleClosure, satisfiesVersion, writeAppManifest } from "./app-manifest.mjs";
 import { assertNoUntrackedScaffoldWrites, scaffoldDrift } from "./scaffold.mjs";
-import { applyMigrationWrites, planMigrationAppends } from "./migrations.mjs";
+import { assertMigrationMutationTargets, applyMigrationWrites, planMigrationAppends } from "./migrations.mjs";
 
 const HELP = `Usage: bw add <moduleKey> [options]\n\nOptions:\n  --target-dir <path>       App directory (defaults to cwd)\n  --workspace-root <path>   BrightWeb workspace root\n  --dry-run                 Print the install plan without writing\n  --help                    Show this help`;
 
@@ -109,7 +109,8 @@ export async function addBrightwebModule(moduleKey, argvOptions = {}, runtimeOpt
     }
   }
 
-  await assertMutationTargets(targetDir, ["package.json", ".brightweb/app-manifest.json", ...Object.keys(managedWrites), ...overlayFiles, ...migrationPlan.writes.map((write) => path.relative(targetDir, write.targetPath))]);
+  await assertMutationTargets(targetDir, ["package.json", ".brightweb/app-manifest.json", ...Object.keys(managedWrites), ...overlayFiles]);
+  await assertMigrationMutationTargets(targetDir, migrationPlan.writes);
 
   const summary = [
     "bw add",

package/src/constants.mjs

@@ -187,14 +187,14 @@ export const PLATFORM_STARTER_FILES = [
 ];
 
 export const APP_DEPENDENCY_DEFAULTS = {
-  "@brightweblabs/app-shell": "^0.16.3",
+  "@brightweblabs/app-shell": "^0.16.4",
   "@brightweblabs/core-auth": "^0.12.2",
   "@brightweblabs/infra": "^0.7.0",
-  "@brightweblabs/module-admin": "^0.9.7",
-  "@brightweblabs/module-crm": "^0.18.4",
-  "@brightweblabs/module-marketing": "^0.5.2",
-  "@brightweblabs/module-orgs": "^0.7.3",
-  "@brightweblabs/module-projects": "^0.19.3",
+  "@brightweblabs/module-admin": "^0.9.8",
+  "@brightweblabs/module-crm": "^0.18.5",
+  "@brightweblabs/module-marketing": "^0.5.3",
+  "@brightweblabs/module-orgs": "^0.7.4",
+  "@brightweblabs/module-projects": "^0.19.4",
   "@brightweblabs/theme": "^0.8.4",
   "@brightweblabs/ui": "^1.5.6",
   "geist": "1.7.2",

package/src/migrations.mjs

@@ -1,4 +1,5 @@
 import semver from "semver";
+import { assertMutationTargets } from "./mutation-paths.mjs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
@@ -16,6 +17,33 @@ export async function findAppMigrationsDirectory(targetDir) {
   }
 }
 
+// Database migrations may belong to the containing consumer workspace, while
+// app files remain bounded to the app itself. Never realpath the migration
+// directory: that would hide links below the legitimate workspace boundary.
+export async function assertMigrationMutationTargets(targetDir, writes) {
+  if (writes.length === 0) return;
+  const appRoot = await fs.realpath(path.resolve(targetDir));
+  let boundary = appRoot;
+  let current = appRoot;
+  while (true) {
+    if (await pathExists(path.join(current, "pnpm-workspace.yaml"))
+      || await pathExists(path.join(current, ".git"))) {
+      boundary = current;
+      break;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  const migrationsDir = await findAppMigrationsDirectory(appRoot);
+  for (const write of writes) {
+    if (path.dirname(write.targetPath) !== migrationsDir) {
+      throw new Error("Migration write must target the app's discovered migrations directory.");
+    }
+  }
+  await assertMutationTargets(boundary, writes.map((write) => path.relative(boundary, write.targetPath)));
+}
+
 export async function getModuleMigrations(moduleKey, catalogEntry = {}) {
   const candidates = [];
   const configuredPath = catalogEntry.manifest?.database?.migrations;

package/src/upgrade.mjs

@@ -4,7 +4,7 @@ import path from "node:path";
 import { stdout as output } from "node:process";
 import { hashFile, findWorkspaceRoot, loadModuleCatalog, readAppManifest, writeAppManifest, cleanVersion } from "./app-manifest.mjs";
 import { pathExists, runInstall } from "./generator.mjs";
-import { applyMigrationWrites, getModuleMigrations, planMigrationAppends } from "./migrations.mjs";
+import { assertMigrationMutationTargets, applyMigrationWrites, getModuleMigrations, planMigrationAppends } from "./migrations.mjs";
 import { buildBrightwebAppUpdatePlan } from "./update.mjs";
 import { resolveSafeRelativePath } from "./safe-path.mjs";
 import { scaffoldDrift } from "./scaffold.mjs";
@@ -102,7 +102,8 @@ export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOp
     migrationCursor: appManifest.migrationCursor,
     migrationUpperBounds,
   });
-  await assertMutationTargets(targetDir, [".brightweb/app-manifest.json", ...plan.fileWrites.map((write) => write.relativePath), ...plan.fileDeletes.map((entry) => entry.relativePath), ...migrationPlan.writes.map((write) => path.relative(targetDir, write.targetPath))]);
+  await assertMutationTargets(targetDir, [".brightweb/app-manifest.json", ...plan.fileWrites.map((write) => write.relativePath), ...plan.fileDeletes.map((entry) => entry.relativePath)]);
+  await assertMigrationMutationTargets(targetDir, migrationPlan.writes);
   output.write(`bw upgrade\nPackages to update: ${plan.packageUpdates.length}\nManaged files to write: ${plan.fileWrites.length}\nObsolete managed files to remove: ${plan.fileDeletes.length}\nMigrations to append: ${migrationPlan.appends.length}\n`);
   if (throughMigration) output.write(`Migration cutoff: ${moduleKey} through ${throughMigration}\n`);
   for (const boundary of safetyBoundaries) {