fg-devkit 1.0.0

package/scripts/sync-project-configs.mjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/**
+ * Runs all local DX config sync steps: VS Code settings, then Prettier / ESLint / tsconfig (see sync-tooling-configs.mjs).
+ *
+ * Usage:
+ *   node node_modules/fg-devkit/scripts/sync-project-configs.mjs
+ *   pnpm exec fg-devkit sync-project-configs
+ */
+
+import { spawnSync } from 'node:child_process'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+
+function runScript(name) {
+  const r = spawnSync(process.execPath, [path.join(scriptDir, name)], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+    env: process.env,
+  })
+  if (r.error) {
+    console.error('[sync-project]', r.error.message)
+    process.exit(1)
+  }
+  if (r.status !== 0 && r.status !== null) {
+    process.exit(r.status)
+  }
+}
+
+runScript('sync-vscode-settings.mjs')
+runScript('sync-tooling-configs.mjs')

package/scripts/sync-tooling-configs.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/**
+ * Syncs shared tooling files from fg-devkit into the repo root:
+ * - prettier.config.js — full copy from fg-devkit
+ * - eslint.config.js — copy of the minimal eslint.sync-stub.js (flat config + createBaseConfig)
+ * - tsconfig.json — full copy of tsconfig.app.sync.json (Vue app defaults: include/exclude,
+ *   compilerOptions, vueCompilerOptions, extends fg-devkit/tsconfig.base.json)
+ *
+ * Requires fg-devkit on disk (direct dependency or via fds-vue-core).
+ *
+ * Usage:
+ *   node node_modules/fg-devkit/scripts/sync-tooling-configs.mjs
+ *   pnpm exec fg-devkit sync-tooling-configs
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+const projectRoot = process.cwd()
+
+function findFgDevkitPackageRoot() {
+  const candidates = [
+    path.join(projectRoot, 'node_modules', 'fg-devkit'),
+    path.join(projectRoot, 'node_modules', 'fds-vue-core', 'node_modules', 'fg-devkit'),
+  ]
+  for (const p of candidates) {
+    if (fs.existsSync(path.join(p, 'package.json'))) {
+      return p
+    }
+  }
+  return null
+}
+
+const fgRoot = findFgDevkitPackageRoot()
+if (!fgRoot) {
+  console.error(
+    '[sync-tooling] Could not find fg-devkit (install fg-devkit or a package that bundles it, e.g. fds-vue-core).',
+  )
+  process.exit(1)
+}
+
+const prettierSrc = path.join(fgRoot, 'configs', 'prettier.config.js')
+const eslintStubSrc = path.join(fgRoot, 'configs', 'eslint.sync-stub.js')
+const tsconfigSrc = path.join(fgRoot, 'configs', 'tsconfig.app.sync.json')
+
+if (!fs.existsSync(prettierSrc) || !fs.existsSync(eslintStubSrc) || !fs.existsSync(tsconfigSrc)) {
+  console.error(
+    '[sync-tooling] Missing prettier.config.js, eslint.sync-stub.js, or tsconfig.app.sync.json inside fg-devkit package.',
+  )
+  process.exit(1)
+}
+
+try {
+  fs.copyFileSync(prettierSrc, path.join(projectRoot, 'prettier.config.js'))
+  fs.copyFileSync(eslintStubSrc, path.join(projectRoot, 'eslint.config.js'))
+  fs.copyFileSync(tsconfigSrc, path.join(projectRoot, 'tsconfig.json'))
+} catch (err) {
+  console.error(`[sync-tooling] ${err.message}`)
+  process.exit(1)
+}
+
+console.log('[sync-tooling] Updated prettier.config.js, eslint.config.js, and tsconfig.json.')

package/scripts/sync-vscode-settings.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+
+/**
+ * Copies the shared VS Code settings file from fg-devkit (or a fallback) into the repo’s
+ * .vscode/settings.json so editors pick up team defaults after install.
+ *
+ * If no template is found (e.g. fg-devkit not installed), exits 0 without error.
+ *
+ * Usage:
+ *   node node_modules/fg-devkit/scripts/sync-vscode-settings.mjs
+ *   # or add an npm script that runs this file
+ */
+
+import { copyFileSync, existsSync, mkdirSync } from 'fs'
+import { dirname, join } from 'path'
+
+const projectRoot = process.cwd()
+
+/** Search order: linked fg-devkit, legacy fds-vue-core path, or local configs/ in the repo. */
+const candidates = [
+  join(projectRoot, 'node_modules', 'fg-devkit', 'configs', 'vscode-settings.json'),
+  join(projectRoot, 'node_modules', 'fds-vue-core', 'configs', 'vscode-settings.json'),
+  join(projectRoot, 'configs', 'vscode-settings.json'),
+]
+
+const baseSettingsPath = candidates.find((p) => existsSync(p)) ?? null
+const localSettingsPath = join(projectRoot, '.vscode', 'settings.json')
+
+if (!baseSettingsPath) {
+  process.exit(0)
+}
+
+try {
+  mkdirSync(dirname(localSettingsPath), { recursive: true })
+  copyFileSync(baseSettingsPath, localSettingsPath)
+} catch (error) {
+  console.error('Error syncing VS Code settings:', error.message)
+  process.exit(1)
+}

package/scripts/vuln-commit.mjs

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+
+/**
+ * Git helper for security bumps: inspects staged package.json files, detects dependency
+ * version changes vs HEAD, and creates a conventional commit with a vuln() message.
+ *
+ * Intended for use as a bin (fg-vuln-commit / fds-vuln-commit) or from a git hook after
+ * staging lockfile/package.json changes. Requires a clean git invocation with staged changes.
+ */
+
+import { execSync } from "node:child_process";
+
+/** Run a shell command and return stdout, or empty string on failure. */
+function run(command) {
+  try {
+    return execSync(command, { encoding: "utf8" }).trim();
+  } catch {
+    return "";
+  }
+}
+
+/** Run a shell command; throws on non-zero exit (stdio inherited). */
+function runOrThrow(command) {
+  return execSync(command, { encoding: "utf8", stdio: "inherit" });
+}
+
+function out(text = "") {
+  process.stdout.write(`${text}\n`);
+}
+
+/** Load JSON from a git object path (e.g. HEAD:package.json or :path for index). */
+function parseJsonAtRef(refPath) {
+  const raw = run(`git show ${refPath}`);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function readStagedFile(path) {
+  return parseJsonAtRef(`:${path}`);
+}
+
+function readHeadFile(path) {
+  return parseJsonAtRef(`HEAD:${path}`);
+}
+
+/** Flatten all version-bearing sections from a package.json for diffing. */
+function collectDeps(pkgJson) {
+  if (!pkgJson) return {};
+  return {
+    ...(pkgJson.dependencies || {}),
+    ...(pkgJson.devDependencies || {}),
+    ...(pkgJson.peerDependencies || {}),
+    ...(pkgJson.optionalDependencies || {}),
+    ...(pkgJson.overrides || {}),
+    ...((pkgJson.pnpm && pkgJson.pnpm.overrides) || {}),
+  };
+}
+
+function normalize(version) {
+  if (typeof version !== "string") return version;
+  return version.trim();
+}
+
+function semverFrom(value) {
+  if (typeof value !== "string") return null;
+  const match = value.match(/(\d+\.\d+\.\d+)/);
+  return match ? match[1] : null;
+}
+
+/** Entry: diff staged package.json files against HEAD, then commit with a vuln-prefixed message. */
+function main() {
+  const stagedFiles = run("git diff --cached --name-only")
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  const packageJsonPaths = stagedFiles.filter((p) => p.endsWith("package.json"));
+  if (packageJsonPaths.length === 0) {
+    out("No staged package.json changes found.");
+    process.exit(0);
+  }
+
+  const updates = [];
+
+  for (const path of packageJsonPaths) {
+    const stagedPkg = readStagedFile(path);
+    const headPkg = readHeadFile(path) || {};
+    if (!stagedPkg) continue;
+
+    const before = collectDeps(headPkg);
+    const after = collectDeps(stagedPkg);
+    const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+
+    for (const name of keys) {
+      const oldV = normalize(before[name]);
+      const newV = normalize(after[name]);
+      if (oldV && newV && oldV !== newV) {
+        updates.push({ name, from: oldV, to: newV, path });
+      }
+    }
+  }
+
+  if (updates.length === 0) {
+    out("No staged dependency version changes found in package.json.");
+    process.exit(0);
+  }
+
+  out("Detected staged dependency updates:\n");
+  for (const u of updates) {
+    out(`- ${u.name}: ${u.from} -> ${u.to} (${u.path})`);
+  }
+
+  const commitMessage =
+    updates.length === 1
+      ? `vuln(${updates[0].name}@${semverFrom(updates[0].from) || updates[0].from}): bump to ${semverFrom(updates[0].to) || updates[0].to}`
+      : "vuln(): updated dependencies";
+  const commitBody =
+    updates.length > 1
+      ? `updated dependencies\n${updates.map((u) => `- ${u.name}: ${u.from} -> ${u.to}`).join("\n")}`
+      : "";
+
+  const hasStagedChanges = run("git diff --cached --name-only");
+  if (!hasStagedChanges) {
+    out("\nNo staged changes to commit.");
+    process.exit(1);
+  }
+
+  const escapedMessage = commitMessage.replace(/"/g, '\\"');
+  const escapedBody = commitBody.replace(/"/g, '\\"');
+  const commitCommand = commitBody
+    ? `git commit -m "${escapedMessage}" -m "${escapedBody}"`
+    : `git commit -m "${escapedMessage}"`;
+
+  out(`\nCreating commit:\n${commitMessage}\n`);
+  runOrThrow(commitCommand);
+}
+
+main();