merge main into selem/docker-for-all

Author: necrodome

.github/dependabot.yml

@@ -17,4 +17,3 @@ updates:
         update-types: ["version-update:semver-major", "version-update:semver-minor"]
       - dependency-name: "tailwindcss"
         update-types: ["version-update:semver-major", "version-update:semver-minor"]
-#       versions: [">3.4.17"]

actions/base/action.yaml

@@ -12,6 +12,7 @@ runs:
       run: |
         pnpm remove -r playwright-chromium
         pnpm install
+        pnpm dedupe --check
 
     - name: format-check
       shell: bash

cli/build-cmd.test.ts

@@ -35,15 +35,15 @@ it("getVersion emptyString", async () => {
 
 it("should set package version but leave workspace dependencies as-is", async () => {
   const version = new Version("0.0.0-smoke", "^");
-  const { patchedPackageJson } = await patchPackageJson("package.json", version, undefined, mock);
+  const { patchedPackageJson } = await patchPackageJson("package.json", version, { mock });
   expect(patchedPackageJson.version).toBe("0.0.0-smoke");
   // Workspace dependencies are no longer replaced by patchPackageJson - use VersionPinner for that
   expect(patchedPackageJson.dependencies).toHaveProperty("@fireproof/vendor", "workspace:0.0.0");
 });
 
 it("should only use prefix version in dependencies", async () => {
   const version = new Version("0.0.0-smoke", "^");
-  const { patchedPackageJson } = await patchPackageJson("package.json", version, undefined, mock);
+  const { patchedPackageJson } = await patchPackageJson("package.json", version, { mock });
   const originalPackageJson = (await mock.readJSON()) as unknown as PackageJson;
   const jsrConf = await buildJsrConf({ originalPackageJson, patchedPackageJson }, version.prefixedVersion);
   expect(jsrConf.version).toBe("0.0.0-smoke");
@@ -217,6 +217,33 @@ it("sanitizeNpmrc with // lhs", async () => {
   );
 });
 
+it("unmodified dependencies", async () => {
+  const pjson = {
+    version: "0.0.0",
+    scripts: {
+      pack: "core-cli build --doPack x",
+      publish: "core-cli build x",
+    },
+    dependencies: {
+      "@fireproof/vendor": "workspace:*",
+      "xcmd-ts": "^0.13.0",
+      "ycmd-ts": "~0.13.0",
+      "zcmd-ts": "0.13.0",
+    },
+  };
+  const patchedPjson = await patchPackageJson("package.json", new Version("1.2.3", ""), { mock: { readJSON: async () => pjson } });
+  expect(patchedPjson.patchedPackageJson).toEqual({
+    scripts: {},
+    version: "1.2.3",
+    dependencies: {
+      "@fireproof/vendor": "workspace:*",
+      "xcmd-ts": "^0.13.0",
+      "ycmd-ts": "~0.13.0",
+      "zcmd-ts": "0.13.0",
+    },
+  });
+});
+
 it("sanitizeNpmrc with http lhs", async () => {
   const npmrc = [
     "; .npmrc",

cli/build-cmd.ts

@@ -1,5 +1,5 @@
 /* eslint-disable no-console */
-import { array, command, flag, multioption, option, string } from "cmd-ts";
+import { array, command, flag, multioption, option, string, Type } from "cmd-ts";
 import fs from "fs-extra";
 import path from "node:path";
 import { findUp } from "find-up";
@@ -9,6 +9,18 @@ import { SemVer } from "semver";
 import { exception2Result } from "@adviser/cement";
 import { VersionPinner } from "./version-pinner.js";
 
+export type VersionModifier = "~" | "^" | "";
+const allowedVersionModifiers: VersionModifier[] = ["~", "^", ""];
+
+const versionModifier: Type<string, VersionModifier> = {
+  async from(str) {
+    if (allowedVersionModifiers.includes(str as VersionModifier)) {
+      return str as VersionModifier;
+    }
+    throw new Error(`Invalid version modifier: "${str}". Must be one of: "~", "^", or ""`);
+  },
+};
+
 const reVersionAlphaStart = /^[a-z](\d+\.\d+\.\d+.*)$/;
 // const reVersionOptionalAlphaStart = /^[a-z]?(\d+\.\d+\.\d+.*)$/;
 const reScopedVersion = /^[^@]+@(.*)$/;
@@ -112,29 +124,34 @@ export interface PackageJson {
   devDependencies: Record<string, string>;
 }
 
+export interface PatchPackageJsonOptions {
+  changeScope?: string;
+  readonly mock?: {
+    readonly readJSON: typeof fs.readJson;
+  };
+}
+
 export async function patchPackageJson(
   packageJsonPath: string,
   version: Version,
-  changeScope?: string,
-  mock: {
-    readJSON: typeof fs.readJson;
-  } = { readJSON: fs.readJson },
+  opts: PatchPackageJsonOptions = {},
 ): Promise<{
   patchedPackageJson: PackageJson;
   originalPackageJson: PackageJson;
 }> {
-  const originalPackageJson = await mock.readJSON(packageJsonPath);
-  const patchedPackageJson = await mock.readJSON(packageJsonPath);
+  const mock = opts.mock ?? { readJSON: fs.readJson };
+
+  const originalPackageJson = (await mock.readJSON(packageJsonPath)) as PackageJson;
+  const patchedPackageJson = (await mock.readJSON(packageJsonPath)) as PackageJson;
   // ugly double read but this is easier than deep copying
-  if (changeScope) {
-    changeScope = changeScope.replace(/^@/, "");
+  if (opts.changeScope) {
+    opts.changeScope = opts.changeScope.replace(/^@/, "");
     if (originalPackageJson.name.startsWith(`@`)) {
-      patchedPackageJson.name = patchedPackageJson.name.replace(/^@[^/]+\//, `@${changeScope}/`);
+      patchedPackageJson.name = patchedPackageJson.name.replace(/^@[^/]+\//, `@${opts.changeScope}/`);
     } else {
-      patchedPackageJson.name = `@${changeScope}/${patchedPackageJson.name}`;
+      patchedPackageJson.name = `@${opts.changeScope}/${patchedPackageJson.name}`;
     }
   }
-  // patchedPackageJson.name = changeScope ? : patchedPackageJson.name;
   patchedPackageJson.version = version.version;
   delete patchedPackageJson.scripts["pack"];
   delete patchedPackageJson.scripts["publish"];
@@ -359,6 +376,16 @@ export function buildCmd(sthis: SuperThis) {
         short: "t",
         description: "Do not update tsconfig.json in the destination directory.",
       }),
+      patchVersionModify: option({
+        long: "patchVersionModify",
+        description: "Modify patch versions in package.json dependencies. Must be one of: ~, ^, or empty string.",
+        type: versionModifier,
+        defaultValue: () => "~" as VersionModifier,
+      }),
+      noPatchedVersionModify: flag({
+        long: "noPatchedVersionModify",
+        description: "Do not modify patch versions in package.json dependencies.",
+      }),
       noPinned: flag({
         long: "no-pinned",
         description: "Do not pin dependencies in package.json (pinning is enabled by default).",
@@ -519,7 +546,7 @@ export function buildCmd(sthis: SuperThis) {
       $.verbose = true;
       cd(jsrDstDir);
 
-      let packageJson = await patchPackageJson("package.json", version, args.changeScope);
+      let packageJson = await patchPackageJson("package.json", version, { changeScope: args.changeScope });
       if (!args.noPinned) {
         console.log(
           "Prepared package.json with pinning for",
@@ -533,6 +560,7 @@ export function buildCmd(sthis: SuperThis) {
           ...packageJson,
           patchedPackageJson: pinner.pinVersions(packageJson.patchedPackageJson, {
             workspaceVersion: version.prefixedVersion,
+            _3rdPartyVersionModifier: args.noPatchedVersionModify ? undefined : args.patchVersionModify,
           }),
         };
       }
@@ -605,6 +633,8 @@ export function buildCmd(sthis: SuperThis) {
           const semVer = new SemVer(args.version);
           if (semVer.prerelease.find((i) => typeof i === "string" && i.includes("dev"))) {
             tags.push("dev");
+          } else {
+            tags.push("latest"); // override to latest in prod
           }
         } catch (e) {
           console.warn(`Warn parsing version ${args.version}:`, e);

cli/device-id-cmd.ts

@@ -5,11 +5,11 @@ import { DeviceIdKey, DeviceIdCSR, DeviceIdCA } from "@fireproof/core-device-id"
 import { getKeyBag } from "@fireproof/core-keybag";
 import { decodeJwt } from "jose";
 import fs from "fs-extra";
-import { base58btc } from "multiformats/bases/base58";
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
 import open from "open";
 import { Future, timeouted, isSuccess, isTimeout, BuildURI } from "@adviser/cement";
+import { sts } from "@fireproof/core-runtime";
 
 function getStdin(): Promise<string> {
   return new Promise<string>((resolve) => {
@@ -420,11 +420,7 @@ export function deviceIdCmd(sthis: SuperThis) {
 
         // Handle environment variable output format
         if (args.envVars) {
-          // Base58btc encode the private key JSON
-          const privateKeyJson = JSON.stringify(jwkPrivate);
-          const privateKeyBase58 = base58btc.encode(sthis.txt.encode(privateKeyJson));
-
-          console.log(`DEVICE_ID_CA_PRIV_KEY=${privateKeyBase58}`);
+          console.log(`DEVICE_ID_CA_PRIV_KEY=${await sts.jwk2env(jwkPrivate)}`);
           console.log(`DEVICE_ID_CA_CERT=${certificateJWT}`);
         } else if (args.json) {
           // Handle JSON output format

cli/package.json

@@ -39,25 +39,25 @@
     "url": "https://github.com/fireproof-storage/fireproof/issues"
   },
   "dependencies": {
-    "@adviser/cement": "^0.5.8",
+    "@adviser/cement": "^0.5.22",
     "@fireproof/core-device-id": "workspace:0.0.0",
     "@fireproof/core-keybag": "workspace:0.0.0",
     "@fireproof/core-runtime": "workspace:0.0.0",
     "@fireproof/core-types-base": "workspace:0.0.0",
     "@fireproof/vendor": "workspace:0.0.0",
-    "@hono/node-server": "^1.19.7",
+    "@hono/node-server": "^1.19.9",
     "@pnpm/lockfile-file": "^9.1.3",
-    "@typescript/native-preview": "7.0.0-dev.20260104.1",
+    "@typescript/native-preview": "7.0.0-dev.20260124.1",
     "aws4fetch": "^1.0.20",
-    "cmd-ts": "^0.14.3",
+    "cmd-ts": "^0.15.0",
     "find-up": "^8.0.0",
     "fs-extra": "^11.3.3",
-    "hono": "^4.11.3",
+    "hono": "^4.11.9",
     "jose": "^6.1.3",
     "multiformats": "^13.4.2",
     "open": "^11.0.0",
-    "semver": "^7.7.3",
-    "zod": "^4.3.5",
+    "semver": "^7.7.4",
+    "zod": "^4.3.6",
     "zx": "^8.8.5"
   },
   "devDependencies": {

cli/version-pinner.test.ts

@@ -90,18 +90,38 @@ describe("VersionPinner", () => {
   });
 
   describe("pinVersions", () => {
-    it("should pin unpinned dependencies with caret (^)", () => {
-      const pkg: PackageJson = {
-        ...pkgTemplate,
-        dependencies: {
-          "cmd-ts": `^${cmdTsVersion}`,
-        },
-      };
-
-      const result = pinner.pinVersions(pkg);
-
-      // Should pin the version
-      expect(result.dependencies["cmd-ts"]).toBe(cmdTsVersion);
+    describe.each(["0.15.0"])("should pin unpinned dependencies (%s)", (version) => {
+      describe.each(["", "^", "~"])("and in-modifier '%s'", (inModifier) => {
+        it.each(["", "^", "~"])("and modifier '%s'", (modifier) => {
+          const pkg: PackageJson = {
+            ...pkgTemplate,
+            dependencies: {
+              "cmd-ts": `${inModifier}${version}`,
+              my: "workspace:*",
+            },
+          };
+          const result = pinner.pinVersions(pkg, {
+            workspaceVersion: "1.0.0",
+            _3rdPartyVersionModifier: modifier as "~" | "^" | "",
+          });
+          // Should pin the version
+          expect(result.dependencies["cmd-ts"]).toBe(`${modifier}0.15.0`);
+          expect(result.dependencies["my"]).toBe(`1.0.0`);
+        });
+
+        it("and modifier undefined", () => {
+          const pkg: PackageJson = {
+            ...pkgTemplate,
+            dependencies: {
+              "cmd-ts": `${inModifier}${version}`,
+              my: "workspace:*",
+            },
+          };
+          const result = pinner.pinVersions(pkg, { workspaceVersion: "1.0.0" });
+          expect(result.dependencies["cmd-ts"]).toBe(`${inModifier}${version}`);
+          expect(result.dependencies["my"]).toBe(`1.0.0`);
+        });
+      });
     });
 
     it("should pin unpinned dependencies with tilde (~)", () => {
@@ -115,7 +135,7 @@ describe("VersionPinner", () => {
       const result = pinner.pinVersions(pkg);
 
       // Should pin the version
-      expect(result.dependencies["semver"]).toBe(semverVersion);
+      expect(result.dependencies["semver"]).toBe(`~${semverVersion}`);
     });
 
     it("should pin unpinned dependencies with asterisk (*)", () => {
@@ -192,7 +212,7 @@ describe("VersionPinner", () => {
 
       // Only cmd-ts should be in the result, not its transitive dependencies
       expect(Object.keys(result.dependencies)).toEqual(["cmd-ts"]);
-      expect(result.dependencies["cmd-ts"]).toBe(cmdTsVersion);
+      expect(result.dependencies["cmd-ts"]).toBe(`^${cmdTsVersion}`);
     });
 
     it("should sort dependencies alphabetically", async () => {
@@ -230,9 +250,9 @@ describe("VersionPinner", () => {
       const result = pinner.pinVersions(pkg);
 
       expect(result.dependencies["cmd-ts"]).toBe(cmdTsVersion); // kept as-is
-      expect(result.dependencies["semver"]).toBe(semverVersion); // pinned
+      expect(result.dependencies["semver"]).toBe(`^${semverVersion}`); // pinned
       expect(result.dependencies["@fireproof/vendor"]).toBe("2.0.0"); // workspace replaced
-      expect(result.dependencies["multiformats"]).toBe(multiformatsVersion); // pinned
+      expect(result.dependencies["multiformats"]).toBe(`~${multiformatsVersion}`); // pinned
     });
 
     it("should remove devDependencies by default", () => {
@@ -268,7 +288,7 @@ describe("VersionPinner", () => {
 
       expect(result.devDependencies).toBeDefined();
       // devDependencies should also be pinned
-      expect(result.devDependencies?.vitest).toBe(vitestVersion);
+      expect(result.devDependencies?.vitest).toBe(`^${vitestVersion}`);
     });
   });
 

cli/version-pinner.ts

@@ -3,6 +3,7 @@ import { PackageJson } from "./build-cmd.js";
 import { findUp } from "find-up";
 
 interface PinVersionOptions {
+  readonly _3rdPartyVersionModifier?: "~" | "^" | "";
   readonly includeDevDeps?: boolean;
   readonly workspaceVersion?: string;
 }
@@ -29,7 +30,11 @@ export class VersionPinner {
   /**
    * Helper function to pin dependencies
    */
-  private pinDependencies(deps: Record<string, string> | undefined, workspaceVersion: string): Record<string, string> {
+  private pinDependencies(
+    deps: Record<string, string> | undefined,
+    workspaceVersion: string,
+    _3rdPartyVersionModifier: "~" | "^" | "" | undefined,
+  ): Record<string, string> {
     const pinnedDeps: Record<string, string> = {};
 
     if (!deps) {
@@ -39,20 +44,22 @@ export class VersionPinner {
     for (const [name, version] of Object.entries(deps)) {
       // Check if version is not pinned (starts with ^ or ~ or *)
       // Note: Also catch malformed versions like "1-beta" that should be resolved from lockfile
-      if (version.match(/^[\^~*]/) || version.match(/^[0-9]+-/)) {
+      if (version.startsWith("workspace:")) {
+        // Replace workspace dependencies with the workspace version
+        pinnedDeps[name] = workspaceVersion;
+      } else {
         // Look up the exact version in lockfile
         if (this.allDeps[name]) {
           pinnedDeps[name] = this.allDeps[name];
         } else {
           // Keep original version if not found in lockfile
           pinnedDeps[name] = version;
         }
-      } else if (version.startsWith("workspace:")) {
-        // Replace workspace dependencies with the workspace version
-        pinnedDeps[name] = workspaceVersion;
-      } else {
-        // Already pinned, keep as-is
-        pinnedDeps[name] = version;
+        if (typeof _3rdPartyVersionModifier === "string") {
+          pinnedDeps[name] = `${_3rdPartyVersionModifier}${pinnedDeps[name].replace(/^[\^~]/, "")}`;
+        } else {
+          pinnedDeps[name] = version === "*" ? pinnedDeps[name] : version;
+        }
       }
     }
 
@@ -112,7 +119,7 @@ export class VersionPinner {
     const workspaceVersion = options.workspaceVersion ?? pkg.version;
 
     // Pin dependencies
-    const pinnedDeps = this.pinDependencies(pkg.dependencies, workspaceVersion);
+    const pinnedDeps = this.pinDependencies(pkg.dependencies, workspaceVersion, options._3rdPartyVersionModifier);
 
     // Sort dependencies alphabetically
     const sortedDeps: Record<string, string> = {};
@@ -123,7 +130,7 @@ export class VersionPinner {
     // Pin devDependencies if includeDevDeps is true
     let sortedDevDeps: Record<string, string> | undefined;
     if (options.includeDevDeps && pkg.devDependencies) {
-      const pinnedDevDeps = this.pinDependencies(pkg.devDependencies, workspaceVersion);
+      const pinnedDevDeps = this.pinDependencies(pkg.devDependencies, workspaceVersion, options._3rdPartyVersionModifier);
       sortedDevDeps = {};
       for (const name of Object.keys(pinnedDevDeps).sort()) {
         sortedDevDeps[name] = pinnedDevDeps[name];