fg-devkit 1.17.0 → 1.17.2

package/.cursor/rules/core-coding-standards.mdc

@@ -49,6 +49,14 @@ alwaysApply: true
 - Centralize HTTP and endpoint wiring in a dedicated API layer (for example `src/api/endpoints/*` or the convention used in the repo).
 - Consume server state through query/mutation hooks (for example `src/queries/*` or equivalent), not ad-hoc fetches in UI code.
 
+## Query strings
+
+- Build query strings with `URLSearchParams` (or a shared helper that wraps it).
+- Do not concatenate `key=value` fragments with `&`.
+- Let `URLSearchParams` encode values. Do not interpolate untrusted or user-entered values into URLs.
+- `toString()` has no leading `?`. Prefix it when appending to a path, and skip empty values instead of emitting empty keys.
+- For list views, derive the query string in the view from route filter state (`requestQueryParams` computed). The API layer should accept the query string, not reconstruct filters.
+
 ## State-management boundaries
 
 - Use TanStack Query for server state and caching. Do not add Vuex for new work.
@@ -85,6 +93,11 @@ alwaysApply: true
 - Prefer named-route navigation for internal flows (`{ name, params, query }`) and reserve raw path pushes for simple/static redirects.
 - Preserve existing query params intentionally when updating filters, pagination, or tab state.
 - Lazy-load route components with dynamic imports to keep initial bundles smaller.
+- Name organisation route params by domain meaning, not generic `id`:
+  - top org: `:topClientNumber`
+  - unit/sub-org: `:unitClientNumber`
+  - Prefer `/organisations/:topClientNumber/units/:unitClientNumber` over `:id` / `:clino`.
+- Keep route param names aligned with component props when using `props: true`.
 
 ## Vue and UI expectations
 

package/README.md

@@ -152,11 +152,12 @@ Fix one or more vulnerability overrides interactively, prune unused overrides, a
 pnpm exec fgd audit-override-commit
 ```
 
-Report or remove workspace overrides that no longer change `pnpm audit`:
+Report, remove, or remove and auto-commit workspace overrides that no longer change `pnpm audit`:
 
 ```bash
 pnpm exec fgd prune-overrides
 pnpm exec fgd prune-overrides --fix
+pnpm exec fgd prune-overrides --commit
 ```
 
 ## tsconfig in consuming repos

package/configs/dependency-policy.vue-workspace.json

@@ -1,6 +1,6 @@
 {
   "toolchain": {
-    "packageManager": "pnpm@11.25.0",
+    "packageManager": "pnpm@12.4.2",
     "node": {
       "nvmrc": "22",
       "engines": ">=22.13.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",

package/scaffold/vue/.gitignore

@@ -0,0 +1,13 @@
+.DS_Store
+node_modules
+/dist
+pnpm-debug.log*
+
+.env.local
+.env.*.local
+*env.local
+
+.idea
+*.sw?
+
+tsconfig.tsbuildinfo

package/scaffold/vue/package.json

@@ -32,14 +32,14 @@
     "@intlify/unplugin-vue-i18n": "11.2.5",
     "@tanstack/vue-query-devtools": "6.1.48",
     "@types/node": "22.16.5",
-    "fg-devkit": "1.17.0",
+    "fg-devkit": "1.17.2",
     "@vitejs/plugin-vue": "6.0.9",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.13",
     "vite": "7.3.5",
     "vite-plugin-vue-inspector": "7.0.0"
   },
-  "packageManager": "pnpm@11.25.0",
+  "packageManager": "pnpm@12.4.2",
   "engines": {
     "node": ">=22.13.0"
   }

package/scripts/fg-devkit.mjs

@@ -17,7 +17,7 @@
  *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
  *   pnpm exec fg-devkit policy-upgrade-commit [--prune-overrides] [ncu-args...]
  *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
- *   pnpm exec fg-devkit prune-overrides [--fix]
+ *   pnpm exec fg-devkit prune-overrides [--fix] [--commit]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
  *   pnpm exec fg-devkit sync-vscode-settings
@@ -539,7 +539,8 @@ Commands:
                                  --prune-overrides also drops unused workspace overrides in a second commit
   audit-override-commit [pnpm-audit-args...]
                                  Fix vulnerability overrides via pnpm audit, prune unused ones, auto-commit
-  prune-overrides [--fix]        Report (or --fix remove) workspace overrides that no longer affect pnpm audit
+  prune-overrides [--fix] [--commit]
+                                 Report unused workspace overrides; --fix removes them; --commit also auto-commits
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
@@ -818,7 +819,7 @@ async function runInteractiveMenu() {
           { name: 'Upgrade package.json packages and auto-commit', value: 'upgrade-commit' },
           { name: 'Upgrade package.json packages, prune overrides, and auto-commit', value: 'upgrade-commit-prune' },
           { name: 'Fix vulnerability overrides and auto-commit', value: 'audit-override-commit' },
-          { name: 'Prune unused vulnerability overrides', value: 'prune-overrides' },
+          { name: 'Prune unused vulnerability overrides and auto-commit', value: 'prune-overrides' },
           { name: 'Cancel', value: 'cancel' },
         ],
         default: 'check',
@@ -839,7 +840,7 @@ async function runInteractiveMenu() {
         return runSelectedAction(() => runNode('audit-override-commit.mjs'))
       }
       if (choice === 'prune-overrides') {
-        return runSelectedAction(() => runNode('prune-overrides.mjs', ['--fix']))
+        return runSelectedAction(() => runNode('prune-overrides.mjs', ['--commit']))
       }
       return 1
     }

package/scripts/prune-overrides.mjs

@@ -8,8 +8,9 @@
  * dropped just because each is redundant while the others exist.
  *
  * Usage:
- *   pnpm exec fg-devkit prune-overrides          # report only
- *   pnpm exec fg-devkit prune-overrides --fix    # drop the prunable entries
+ *   pnpm exec fg-devkit prune-overrides           # report only
+ *   pnpm exec fg-devkit prune-overrides --fix     # drop the prunable entries
+ *   pnpm exec fg-devkit prune-overrides --commit  # drop them and auto-commit
  */
 
 import { mkdtempSync, rmSync, cpSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
@@ -17,6 +18,12 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { parseArgs } from 'node:util'
+import {
+  buildOverrideCommitMessage,
+  collectOverrideChanges,
+  collectOverrides,
+  formatOverrideValue,
+} from './override-changes.mjs'
 
 const ROOT = process.cwd()
 const WORKSPACE_FILE = 'pnpm-workspace.yaml'
@@ -25,19 +32,71 @@ const COPIED_FILES = ['package.json', 'pnpm-lock.yaml', WORKSPACE_FILE, '.npmrc'
 const { values: args } = parseArgs({
   options: {
     fix: { type: 'boolean', default: false },
+    commit: { type: 'boolean', default: false },
     help: { type: 'boolean', short: 'h', default: false },
   },
   strict: true,
 })
 
 if (args.help) {
-  console.log(`Usage: pnpm exec fg-devkit prune-overrides [--fix]
+  console.log(`Usage: pnpm exec fg-devkit prune-overrides [--fix] [--commit]
 
 Reports workspace overrides that can be removed without introducing new
-pnpm audit findings. Pass --fix to delete those entries in place.`)
+pnpm audit findings. Pass --fix to delete those entries in place.
+Pass --commit to apply the deletions and auto-commit.`)
   process.exit(0)
 }
 
+const shouldFix = args.fix || args.commit
+
+function runGit(gitArgs) {
+  const result = spawnSync('git', gitArgs, {
+    stdio: 'inherit',
+    cwd: ROOT,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[prune-overrides]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function commitOverrideChanges(beforeOverrides, afterOverrides) {
+  const changed = collectOverrideChanges(beforeOverrides, afterOverrides)
+  if (changed.length === 0) {
+    console.log('[prune-overrides] No override changes to commit.')
+    return 0
+  }
+
+  console.log('[prune-overrides] Override changes detected:')
+  for (const item of changed) {
+    const fromLabel = item.from ?? '(missing)'
+    console.log(`  - ${item.name}: ${fromLabel} -> ${formatOverrideValue(item.to)}`)
+  }
+
+  const files = ['package.json', 'pnpm-lock.yaml', WORKSPACE_FILE].filter((file) =>
+    existsSync(join(ROOT, file)),
+  )
+  if (files.length === 0) {
+    console.error('[prune-overrides] No files to stage.')
+    return 1
+  }
+
+  const stageExitCode = runGit(['add', '--', ...files])
+  if (stageExitCode !== 0) {
+    return stageExitCode
+  }
+
+  const { subject, body } = buildOverrideCommitMessage(changed)
+  console.log(`[prune-overrides] Auto-committing: ${subject}`)
+  if (body) {
+    console.log(body)
+  }
+  const commitArgs = body ? ['commit', '-m', subject, '-m', body] : ['commit', '-m', subject]
+  return runGit(commitArgs)
+}
+
 function runPnpm(cwd, pnpmArgs, { allowFailure = false } = {}) {
   const result = spawnSync('pnpm', pnpmArgs, {
     cwd,
@@ -252,16 +311,22 @@ function main() {
       console.log(`  - ${key}`)
     }
 
-    if (!args.fix) {
-      console.log('\nRe-run with --fix to remove them from pnpm-workspace.yaml.')
+    if (!shouldFix) {
+      console.log('\nRe-run with --fix to remove them, or --commit to remove and auto-commit.')
       return 0
     }
 
+    const beforeOverrides = collectOverrides(ROOT)
     writeFileSync(workspacePath, writeOverrides(original, remaining.keys()))
     console.log('\nUpdated pnpm-workspace.yaml. Refreshing lockfile…')
     runPnpm(ROOT, ['install', '--no-frozen-lockfile', '--ignore-scripts'])
-    console.log('Done.')
-    return 0
+
+    if (!args.commit) {
+      console.log('Done.')
+      return 0
+    }
+
+    return commitOverrideChanges(beforeOverrides, collectOverrides(ROOT))
   } finally {
     rmSync(tempDir, { recursive: true, force: true })
   }