perf(create-cedar-rsc-app): parallelize package.json updates in upgradeToLatestCanary

[lisa-assistant]

Summary

In packages/create-cedar-rsc-app/src/upgradeToLatestCanary.ts, the updatePackageJsons function updates multiple package.json files sequentially using synchronous file I/O:

// TODO: await Promise.all(packageJsons.map(async (path) => {
for (const path of packageJsons) {
  const contents = fs.readFileSync(path, 'utf8')
  // ... mutate package.json ...
  fs.writeFileSync(path, JSON.stringify(packageJson, null, 2))
}

The TODO comment already suggests the intended fix: convert to Promise.all for parallel I/O.

Fix

1. Make updatePackageJsons async
2. Switch from fs.readFileSync/fs.writeFileSync to fs.promises.readFile/fs.promises.writeFile
3. Wrap in Promise.all

async function updatePackageJsons(
  config: Config,
  packageJsons: string[],
  latestRwCanary: string,
) {
  await Promise.all(
    packageJsons.map(async (path) => {
      const contents = await fs.promises.readFile(path, 'utf8')
      const packageJson = JSON.parse(contents)

      const { dependencies, devDependencies } = packageJson

      if (dependencies) {
        for (const name of Object.keys(dependencies)) {
          if (name.startsWith('@cedarjs/')) {
            dependencies[name] = latestRwCanary
          }
        }
      }

      if (devDependencies) {
        for (const name of Object.keys(devDependencies)) {
          if (name.startsWith('@cedarjs/')) {
            devDependencies[name] = latestRwCanary
          }
        }
      }

      await fs.promises.writeFile(path, JSON.stringify(packageJson, null, 2))
    }),
  )
}

The writes are to different files so there are no ordering dependencies — parallel execution is safe.

The call site in the same file will also need to await the now-async function.

Files

• packages/create-cedar-rsc-app/src/upgradeToLatestCanary.ts — updatePackageJsons function and its call site

[lisa-assistant]

Self-fix confidence: 8/10

The conversion from sync sequential to async parallel is mechanical — swap the fs calls, add async/await, wrap in Promise.all. The 2-point deduction is for (1) the need to find and update the call site(s) to await the now-async function, and (2) the slim risk that verbose logging order becomes non-deterministic with parallel execution (cosmetic only, since logs are interleaved). The core file mutation logic is unchanged and the files written are independent.

[lisa-assistant]

Implementation Plan

Goal: Convert the sequential synchronous file I/O loop in updatePackageJsons to parallel async I/O using Promise.all, as the existing TODO comment suggests.

---

File to change

packages/create-cedar-rsc-app/src/upgradeToLatestCanary.ts

---

Step 1 — Make updatePackageJsons async and switch to async fs

// Before
function updatePackageJsons(
  config: Config,
  packageJsons: string[],
  latestRwCanary: string,
) {
  for (const path of packageJsons) {
    if (config.verbose) {
      console.log('Updating', path, 'to use latest RW canary version')
    }

    const contents = fs.readFileSync(path, 'utf8')
    const packageJson = JSON.parse(contents)
    // ... mutate ...
    fs.writeFileSync(path, JSON.stringify(packageJson, null, 2))
  }
}

// After
async function updatePackageJsons(
  config: Config,
  packageJsons: string[],
  latestRwCanary: string,
) {
  await Promise.all(
    packageJsons.map(async (pkgPath) => {
      if (config.verbose) {
        console.log('Updating', pkgPath, 'to use latest RW canary version')
      }

      const contents = await fs.promises.readFile(pkgPath, 'utf8')
      const packageJson = JSON.parse(contents)

      const { dependencies, devDependencies } = packageJson

      if (config.verbose) {
        console.log('dependencies', dependencies)
        console.log('devDependencies', devDependencies)
      }

      if (dependencies) {
        for (const name of Object.keys(dependencies)) {
          if (name.startsWith('@cedarjs/')) {
            dependencies[name] = latestRwCanary
          }
        }
      }

      if (devDependencies) {
        for (const name of Object.keys(devDependencies)) {
          if (name.startsWith('@cedarjs/')) {
            devDependencies[name] = latestRwCanary
          }
        }
      }

      if (config.verbose) {
        console.log('package.json', JSON.stringify(packageJson, null, 2))
      }

      await fs.promises.writeFile(pkgPath, JSON.stringify(packageJson, null, 2))
    }),
  )
}

Note: rename the loop variable from path to pkgPath to avoid shadowing Node's built-in path module imported at the top of the file.

---

Step 2 — Update the call site to await

// Before (in upgradeToLatestCanary)
updatePackageJsons(config, packageJsons, latestCanary)

// After
await updatePackageJsons(config, packageJsons, latestCanary)

upgradeToLatestCanary is already async, so no signature change needed there.

---

Edge cases

1. Variable name shadowing: The current loop variable is named path, which shadows the import path from 'node:path' at the top of the file. Rename it to pkgPath (or filePath) in the map callback to eliminate the shadow. TypeScript will catch this if noShadow is enabled.

2. Partial failure: With Promise.all, if one readFile or writeFile rejects, the whole Promise.all rejects immediately. This is acceptable — a partially-updated set of package.json files is worse than a clean failure. The caller already propagates thrown errors.

3. File count: There are exactly 3 package.json files (root, api, web) — a small fixed set. The parallelism gain is modest but real, and the code becomes cleaner regardless.

4. No new dependencies: fs.promises is part of Node's built-in fs module — no import changes needed since fs is already imported as import fs from 'node:fs'.

5. Verbose log ordering: With parallel execution the console.log lines for different files may interleave. This is fine for a verbose debug flag.

[lisa-assistant]

Self-fix confidence: 9/10

This is a mechanical async conversion: swap two fs calls, add async/await, wrap in Promise.all, fix the shadowed path variable, and update the one call site. The logic inside the loop doesn't change at all. The 1-point deduction is for the slim chance that the verbose log interleaving in parallel mode causes confusion in practice, or that a missed call site exists elsewhere.