@_linked/cli 1.17.0 → 1.19.0

package/lib/esm/commands/publish-app.d.ts

@@ -0,0 +1,18 @@
+import type { IFileStore } from '@_linked/core/interfaces/IFileStore';
+export interface PublishAppOptions {
+    appRoot?: string;
+    manifestPath?: string;
+    /** An already-resolved store (the `build-app --publish` path). */
+    store?: IFileStore;
+    /**
+     * Resolve the store lazily. Used instead of `store` so the release manifest
+     * is read and validated first: a Capacitor (non-publishable) manifest then
+     * fails with "only publishable web release manifests may be uploaded"
+     * instead of a confusing storage-configuration error.
+     */
+    resolveStore?: () => Promise<IFileStore>;
+    yes?: boolean;
+}
+export declare const redactPublishError: (error: unknown) => Error;
+export declare const publishApp: (options: PublishAppOptions) => Promise<import("../index.js").PublishResult>;
+//# sourceMappingURL=publish-app.d.ts.map

package/lib/esm/commands/publish-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-app.d.ts","sourceRoot":"","sources":["../../../src/commands/publish-app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,qCAAqC,CAAC;AAapE,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAWD,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,KAcnD,CAAC;AAaF,eAAO,MAAM,UAAU,GAAU,SAAS,iBAAiB,iDAsF1D,CAAC"}

package/lib/esm/commands/publish-app.js

@@ -0,0 +1,124 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { loadReleaseManifest, planReleasePublish, publishRelease, } from '../app-release/publisher.js';
+const secretEnvironmentKeys = [
+    'AWS_SECRET_ACCESS_KEY',
+    'STATIC_AWS_SECRET_ACCESS_KEY',
+    'UPLOADS_AWS_SECRET_ACCESS_KEY',
+    'AWS_ACCESS_KEY_ID',
+    'STATIC_AWS_ACCESS_KEY_ID',
+    'UPLOADS_AWS_ACCESS_KEY_ID',
+];
+export const redactPublishError = (error) => {
+    const source = error instanceof Error ? error : new Error(String(error));
+    let message = source.message;
+    let stack = source.stack;
+    for (const key of secretEnvironmentKeys) {
+        const value = process.env[key];
+        if (value) {
+            message = message.split(value).join('[REDACTED]');
+            stack = stack === null || stack === void 0 ? void 0 : stack.split(value).join('[REDACTED]');
+        }
+    }
+    source.message = message;
+    if (stack)
+        source.stack = stack;
+    return source;
+};
+const resolveStore = (options) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!options.resolveStore) {
+        throw new Error('publishApp needs either a store or a resolveStore function to reach one');
+    }
+    return options.resolveStore();
+});
+export const publishApp = (options) => __awaiter(void 0, void 0, void 0, function* () {
+    const appRoot = options.appRoot || process.cwd();
+    let progressSpinner;
+    try {
+        // This command reuses a completed build. It validates the manifest and
+        // destination before dry-run output or any confirmed upload.
+        console.log('🔄 Validating release manifest and destination...');
+        // Read the manifest before touching storage config, so a manifest that can
+        // never be published says so before a store is resolved.
+        loadReleaseManifest(appRoot, options.manifestPath);
+        const store = options.store || (yield resolveStore(options));
+        const plan = planReleasePublish({
+            appRoot,
+            manifestPath: options.manifestPath,
+            store,
+        });
+        console.log(`Release: ${plan.releaseId}`);
+        console.log(`Destination: ${plan.destination.accessURL || '(no accessURL)'} under ${plan.destination.releasePrefix}/`);
+        console.log(`Artifacts: ${plan.files.length} (${plan.totalBytes} bytes)`);
+        if (!options.yes) {
+            console.log('Dry run only; pass --yes to upload this release.');
+        }
+        console.log('✅ Release plan validated');
+        if (options.yes) {
+            console.log('🔄 Uploading and verifying release artifacts...');
+            const total = plan.files.length + 1;
+            if (process.stdout.isTTY) {
+                // ora is ESM-only, so load it only for an interactive terminal. CI and
+                // PM2 use the periodic plain-text progress branch below.
+                const { default: ora } = yield import('ora');
+                progressSpinner = ora({
+                    discardStdin: true,
+                    text: `Publishing 0/${total} files`,
+                }).start();
+            }
+        }
+        let lastLoggedProgress = 0;
+        const result = yield publishRelease({
+            appRoot,
+            manifestPath: options.manifestPath,
+            store,
+            yes: options.yes,
+            onWarning: (message) => {
+                // Printed once per run, not once per file.
+                if (progressSpinner) {
+                    progressSpinner.text = message;
+                }
+                console.warn(`⚠️  ${message}`);
+            },
+            onProgress: ({ completed, total }) => {
+                const message = `Publishing ${completed}/${total} files`;
+                if (progressSpinner) {
+                    progressSpinner.text = message;
+                }
+                else if (completed === total || completed - lastLoggedProgress >= 25) {
+                    console.log(message);
+                    lastLoggedProgress = completed;
+                }
+            },
+        });
+        if (result.dryRun) {
+            console.log('✅ Dry run complete; no files uploaded');
+        }
+        else {
+            const completedMessage = `Release ${result.releaseId} uploaded: ${result.uploadedFiles} files, ${result.uploadedBytes} bytes`;
+            progressSpinner === null || progressSpinner === void 0 ? void 0 : progressSpinner.succeed(completedMessage);
+            if (!progressSpinner)
+                console.log(`✅ ${completedMessage}`);
+            progressSpinner = undefined;
+            if (result.unverified.length) {
+                console.warn(`⚠️  ${result.unverified.length} of ${result.uploadedFiles} objects could not be verified against a store hash.`);
+            }
+        }
+        return result;
+    }
+    catch (error) {
+        const reported = redactPublishError(error);
+        // The spinner line is the last thing on screen, so it carries the real
+        // reason rather than a bare "Release upload failed".
+        progressSpinner === null || progressSpinner === void 0 ? void 0 : progressSpinner.fail(reported.message);
+        throw reported;
+    }
+});
+//# sourceMappingURL=publish-app.js.map

package/lib/esm/commands/publish-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-app.js","sourceRoot":"","sources":["../../../src/commands/publish-app.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GACf,MAAM,6BAA6B,CAAC;AAuBrC,MAAM,qBAAqB,GAAG;IAC5B,uBAAuB;IACvB,8BAA8B;IAC9B,+BAA+B;IAC/B,mBAAmB;IACnB,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAS,EAAE;IAC1D,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7B,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClD,KAAK,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,OAA0B,EACL,EAAE;IACvB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC;AAChC,CAAC,CAAA,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAO,OAA0B,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACjD,IAAI,eAA4C,CAAC;IACjD,IAAI,CAAC;QACH,uEAAuE;QACvE,6DAA6D;QAC7D,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,2EAA2E;QAC3E,yDAAyD;QACzD,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,kBAAkB,CAAC;YAC9B,OAAO;YACP,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CACT,gBAAgB,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,gBAAgB,UAC5D,IAAI,CAAC,WAAW,CAAC,aACnB,GAAG,CACJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACzB,uEAAuE;gBACvE,yDAAyD;gBACzD,MAAM,EAAC,OAAO,EAAE,GAAG,EAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3C,eAAe,GAAG,GAAG,CAAC;oBACpB,YAAY,EAAE,IAAI;oBAClB,IAAI,EAAE,gBAAgB,KAAK,QAAQ;iBACpC,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,kBAAkB,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,OAAO;YACP,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrB,2CAA2C;gBAC3C,IAAI,eAAe,EAAE,CAAC;oBACpB,eAAe,CAAC,IAAI,GAAG,OAAO,CAAC;gBACjC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YACjC,CAAC;YACD,UAAU,EAAE,CAAC,EAAC,SAAS,EAAE,KAAK,EAAC,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,cAAc,SAAS,IAAI,KAAK,QAAQ,CAAC;gBACzD,IAAI,eAAe,EAAE,CAAC;oBACpB,eAAe,CAAC,IAAI,GAAG,OAAO,CAAC;gBACjC,CAAC;qBAAM,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,GAAG,kBAAkB,IAAI,EAAE,EAAE,CAAC;oBACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACrB,kBAAkB,GAAG,SAAS,CAAC;gBACjC,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,GAAG,WAAW,MAAM,CAAC,SAAS,cAAc,MAAM,CAAC,aAAa,WAAW,MAAM,CAAC,aAAa,QAAQ,CAAC;YAC9H,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC3C,IAAI,CAAC,eAAe;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC;YAC3D,eAAe,GAAG,SAAS,CAAC;YAC5B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CACV,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,OAAO,MAAM,CAAC,aAAa,sDAAsD,CACjH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3C,uEAAuE;QACvE,qDAAqD;QACrD,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,CAAC;IACjB,CAAC;AACH,CAAC,CAAA,CAAC"}

package/lib/esm/commands/serve-app.d.ts

@@ -0,0 +1,14 @@
+export interface ServeAppOptions {
+    appRoot?: string;
+    allowDevelopment?: boolean;
+    /** Profiles from `--env a,b`, passed on to the environment loader. */
+    environmentNames?: string[];
+}
+export interface ServeAppDependencies {
+    loadEnvironment?: () => Promise<void>;
+    startCompiledServer?: () => Promise<unknown>;
+}
+export declare const validateCompiledAppArtifacts: (appRoot: string) => void;
+/** Start a compiled Linked backend without creating a Vite server or watcher. */
+export declare const serveCompiledApp: (options?: ServeAppOptions, dependencies?: ServeAppDependencies) => Promise<unknown>;
+//# sourceMappingURL=serve-app.d.ts.map

package/lib/esm/commands/serve-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-app.d.ts","sourceRoot":"","sources":["../../../src/commands/serve-app.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C;AASD,eAAO,MAAM,4BAA4B,GAAI,SAAS,MAAM,KAAG,IAoB9D,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,GAC3B,UAAS,eAAoB,EAC7B,eAAc,oBAAyB,KACtC,OAAO,CAAC,OAAO,CAsBjB,CAAC"}

package/lib/esm/commands/serve-app.js

@@ -0,0 +1,49 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import fs from 'fs';
+import path from 'path';
+import { ensureEnvironmentLoaded } from '../lifecycle.js';
+const requiredBuildArtifacts = [
+    'lib/App.js',
+    'lib/routes.js',
+    'lib/backend.js',
+    'public/bundles/.vite/manifest.json',
+];
+export const validateCompiledAppArtifacts = (appRoot) => {
+    for (const relativePath of requiredBuildArtifacts) {
+        const absolutePath = path.join(appRoot, relativePath);
+        if (!fs.existsSync(absolutePath)) {
+            throw new Error(`Compiled app artifact is missing: ${relativePath}. Run linked build-app before linked serve-app.`);
+        }
+    }
+    const manifestPath = path.join(appRoot, 'public/bundles/.vite/manifest.json');
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    if (!manifest || typeof manifest !== 'object' || Object.keys(manifest).length === 0) {
+        throw new Error('Compiled app artifact is invalid: public/bundles/.vite/manifest.json is empty');
+    }
+};
+/** Start a compiled Linked backend without creating a Vite server or watcher. */
+export const serveCompiledApp = (...args_1) => __awaiter(void 0, [...args_1], void 0, function* (options = {}, dependencies = {}) {
+    const appRoot = options.appRoot || process.cwd();
+    const loadEnvironment = dependencies.loadEnvironment ||
+        (() => ensureEnvironmentLoaded(options.environmentNames));
+    const startCompiledServer = dependencies.startCompiledServer ||
+        (() => __awaiter(void 0, void 0, void 0, function* () {
+            const { startServer } = yield import('../cli-methods.js');
+            return startServer(false);
+        }));
+    yield loadEnvironment();
+    if (process.env.NODE_ENV === 'development' && !options.allowDevelopment) {
+        throw new Error('linked serve-app only runs compiled non-development builds. Use linked start for development.');
+    }
+    validateCompiledAppArtifacts(appRoot);
+    return startCompiledServer();
+});
+//# sourceMappingURL=serve-app.js.map

package/lib/esm/commands/serve-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-app.js","sourceRoot":"","sources":["../../../src/commands/serve-app.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAC,uBAAuB,EAAC,MAAM,iBAAiB,CAAC;AAcxD,MAAM,sBAAsB,GAAG;IAC7B,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,oCAAoC;CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,OAAe,EAAQ,EAAE;IACpE,KAAK,MAAM,YAAY,IAAI,sBAAsB,EAAE,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,qCAAqC,YAAY,iDAAiD,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,OAAO,EACP,oCAAoC,CACrC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAGZ,EAAE,mDAFpB,UAA2B,EAAE,EAC7B,eAAqC,EAAE;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACjD,MAAM,eAAe,GACnB,YAAY,CAAC,eAAe;QAC5B,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC5D,MAAM,mBAAmB,GACvB,YAAY,CAAC,mBAAmB;QAChC,CAAC,GAAS,EAAE;YACV,MAAM,EAAC,WAAW,EAAC,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACxD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAA,CAAC,CAAC;IAEL,MAAM,eAAe,EAAE,CAAC;IAExB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,mBAAmB,EAAE,CAAC;AAC/B,CAAC,CAAA,CAAC"}

package/lib/esm/commands/setup-publish.d.ts

@@ -1,14 +1,47 @@
+export declare const WORKFLOW_FILES: readonly ["pr.yml", "publish.yml"];
+/**
+ * The uniform branch-protection profile every `@_linked` repo runs on `main`.
+ *
+ * The required check is `checks / Build & Test`, not `Build & Test`: GitHub reports a job invoked
+ * through `workflow_call` as `<caller-job-id> / <job name>`, and the caller job in pr.yml is
+ * `checks`. A repo pinning the bare name waits forever on a check that never reports.
+ */
+export declare function buildBranchProtectionPayload(): {
+    required_status_checks: {
+        strict: boolean;
+        contexts: string[];
+    };
+    enforce_admins: boolean;
+    required_pull_request_reviews: {
+        required_approving_review_count: number;
+        dismiss_stale_reviews: boolean;
+        require_code_owner_reviews: boolean;
+    };
+    restrictions: any;
+    allow_force_pushes: boolean;
+    allow_deletions: boolean;
+};
 export type SetupPublishOptions = {
     configureGithub?: boolean;
     scope?: 'core' | 'community';
+    /**
+     * @deprecated The dual-branch (`main` + `dev`) flow and its `@next` prereleases are retired —
+     * every package repo is `main`-only. Kept as an accepted no-op rather than removed because
+     * commander aborts the whole command on an unknown option, so a stale script or copied
+     * command line would fail to set the repo up at all instead of setting it up correctly.
+     */
     dualBranch?: boolean;
     grantTeam?: string;
 };
 /**
- * Set up a single-branch changesets publish workflow in the current package repo.
+ * Set up the changesets publish pipeline in the current package repo.
+ *
+ * The workflows are thin callers of the shared reusable workflows in `linked-fw/.github`
+ * (pinned `@v1`, a deliberately moving tag) — one edit there changes every package's pipeline,
+ * which is why nothing about the build or publish steps is scaffolded per repo any more.
  *
  * Installs:
- * - .github/workflows/{ci,publish,changeset-check}.yml
+ * - .github/workflows/{pr,publish}.yml — caller stubs, nothing else
  * - .changeset/config.json + README.md
  * - .changeset/initial-release.md
  * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts
@@ -16,8 +49,10 @@ export type SetupPublishOptions = {
  *   publishConfig: {access: public}
  * - package-lock.json generated via npm install --package-lock-only
  *
- * With --configure-github: if `gh` CLI is available and authenticated, also sets
- * branch protection on main (strict + required "Build & Test" check).
+ * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform
+ * branch-protection profile on main and enables auto-merge.
  */
 export declare function setupPublish(opts?: SetupPublishOptions): Promise<void>;
+/** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */
+export declare function applyPackageJsonPatches(pkgJson: any, repoSlug: string): boolean;
 //# sourceMappingURL=setup-publish.d.ts.map

package/lib/esm/commands/setup-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-publish.d.ts","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDhF"}
+{"version":3,"file":"setup-publish.d.ts","sourceRoot":"","sources":["../../../src/commands/setup-publish.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,oCAAqC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,4BAA4B;;;;;;;;;;;;;;EAkB3C;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DhF;AAwHD,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAkD/E"}

package/lib/esm/commands/setup-publish.js

@@ -19,11 +19,45 @@ const dirname__ = typeof __dirname !== 'undefined'
 // This file compiles to lib/{esm,cjs}/commands/setup-publish.js — go up three
 // levels to reach the package root, then into defaults/setup-publish.
 const TEMPLATE_ROOT = path.resolve(dirname__, '..', '..', '..', 'defaults', 'setup-publish');
+// Both are callers of the shared reusable workflows. `publish.yml` in particular cannot be
+// renamed: npm's trusted-publisher check validates the calling workflow's filename, and a
+// mismatch only shows up as releases quietly needing manual approval again.
+export const WORKFLOW_FILES = ['pr.yml', 'publish.yml'];
 /**
- * Set up a single-branch changesets publish workflow in the current package repo.
+ * The uniform branch-protection profile every `@_linked` repo runs on `main`.
+ *
+ * The required check is `checks / Build & Test`, not `Build & Test`: GitHub reports a job invoked
+ * through `workflow_call` as `<caller-job-id> / <job name>`, and the caller job in pr.yml is
+ * `checks`. A repo pinning the bare name waits forever on a check that never reports.
+ */
+export function buildBranchProtectionPayload() {
+    return {
+        required_status_checks: { strict: false, contexts: ['checks / Build & Test'] },
+        // Admins included: the point of the gate is that no release skips the build, and the people
+        // most likely to push straight to main are the admins.
+        enforce_admins: true,
+        // Reviews enabled but zero approvals required. The publish workflow direct-merges the version
+        // PR (GitHub's auto-merge queue does not honor review-bypass allowances), so a non-zero count
+        // would stall every release; the block itself still has to exist for the profile to match.
+        required_pull_request_reviews: {
+            required_approving_review_count: 0,
+            dismiss_stale_reviews: false,
+            require_code_owner_reviews: false,
+        },
+        restrictions: null,
+        allow_force_pushes: false,
+        allow_deletions: false,
+    };
+}
+/**
+ * Set up the changesets publish pipeline in the current package repo.
+ *
+ * The workflows are thin callers of the shared reusable workflows in `linked-fw/.github`
+ * (pinned `@v1`, a deliberately moving tag) — one edit there changes every package's pipeline,
+ * which is why nothing about the build or publish steps is scaffolded per repo any more.
  *
  * Installs:
- * - .github/workflows/{ci,publish,changeset-check}.yml
+ * - .github/workflows/{pr,publish}.yml — caller stubs, nothing else
  * - .changeset/config.json + README.md
  * - .changeset/initial-release.md
  * - .gitignore entries for node_modules, lib, yarn.lock, src-compiled-artifacts
@@ -31,18 +65,18 @@ const TEMPLATE_ROOT = path.resolve(dirname__, '..', '..', '..', 'defaults', 'set
  *   publishConfig: {access: public}
  * - package-lock.json generated via npm install --package-lock-only
  *
- * With --configure-github: if `gh` CLI is available and authenticated, also sets
- * branch protection on main (strict + required "Build & Test" check).
+ * With --configure-github: if `gh` CLI is available and authenticated, also applies the uniform
+ * branch-protection profile on main and enables auto-merge.
  */
 export function setupPublish() {
     return __awaiter(this, arguments, void 0, function* (opts = {}) {
         const cwd = process.cwd();
         const scope = opts.scope || 'core';
         const npmSecretName = scope === 'community' ? 'NPM_AUTH_TOKEN_CM' : 'NPM_AUTH_TOKEN';
-        const templateDir = opts.dualBranch
-            ? path.join(TEMPLATE_ROOT, 'dual-branch')
-            : TEMPLATE_ROOT;
-        console.log(chalk.magenta(`Setting up ${opts.dualBranch ? 'dual-branch (main + dev)' : 'single-branch (main only)'} publish workflow...`));
+        console.log(chalk.magenta('Setting up the publish pipeline (main only)...'));
+        if (opts.dualBranch) {
+            console.log(chalk.yellow('  ⚠ --dual-branch is deprecated and ignored: the main + dev flow and its @next prereleases are retired.'));
+        }
         console.log(`  target: ${cwd}`);
         console.log(`  npm secret: ${npmSecretName} (${scope})`);
         const pkgJsonPath = path.join(cwd, 'package.json');
@@ -55,9 +89,9 @@ export function setupPublish() {
         console.log(`  repo: ${repoSlug}`);
         console.log('');
         // 1. Workflow files (with {{NPM_SECRET_NAME}} substitution in publish.yml)
-        yield copyWorkflows(cwd, npmSecretName, templateDir);
+        yield copyWorkflows(cwd, npmSecretName);
         // 2. Changesets config + README
-        yield copyChangesetConfig(cwd, repoSlug, templateDir);
+        yield copyChangesetConfig(cwd, repoSlug);
         // 3. Initial changeset
         yield writeInitialChangeset(cwd, pkgJson.name);
         // 4. .gitignore
@@ -106,22 +140,33 @@ function resolveRepoSlug(cwd, pkgJson) {
         return 'OWNER/REPO';
     });
 }
-function copyWorkflows(cwd, npmSecretName, templateDir) {
+function copyWorkflows(cwd, npmSecretName) {
     return __awaiter(this, void 0, void 0, function* () {
-        const srcDir = path.join(templateDir, 'github', 'workflows');
+        const srcDir = path.join(TEMPLATE_ROOT, 'github', 'workflows');
         const dstDir = path.join(cwd, '.github', 'workflows');
         fs.mkdirpSync(dstDir);
-        for (const file of ['ci.yml', 'publish.yml', 'changeset-check.yml']) {
+        for (const file of WORKFLOW_FILES) {
             let content = fs.readFileSync(path.join(srcDir, file), 'utf8');
             content = content.replace(/\{\{NPM_SECRET_NAME\}\}/g, npmSecretName);
             fs.writeFileSync(path.join(dstDir, file), content);
             console.log(chalk.green('  ✓') + ` .github/workflows/${file}`);
         }
+        // ci.yml and changeset-check.yml became the two jobs of the shared pr.yml. Left behind on a
+        // repo that was set up before the consolidation they keep running, so the old bare
+        // `Build & Test` check reports alongside `checks / Build & Test` and re-setting a repo up
+        // looks like it worked while the duplicate gate quietly stays.
+        for (const stale of ['ci.yml', 'changeset-check.yml']) {
+            const stalePath = path.join(dstDir, stale);
+            if (fs.existsSync(stalePath)) {
+                fs.removeSync(stalePath);
+                console.log(chalk.green('  ✓') + ` removed superseded .github/workflows/${stale}`);
+            }
+        }
     });
 }
-function copyChangesetConfig(cwd, repoSlug, templateDir) {
+function copyChangesetConfig(cwd, repoSlug) {
     return __awaiter(this, void 0, void 0, function* () {
-        const srcDir = path.join(templateDir, 'changeset');
+        const srcDir = path.join(TEMPLATE_ROOT, 'changeset');
         const dstDir = path.join(cwd, '.changeset');
         fs.mkdirpSync(dstDir);
         let configContent = fs.readFileSync(path.join(srcDir, 'config.json'), 'utf8');
@@ -180,55 +225,7 @@ function updateGitignore(cwd) {
 }
 function patchPackageJson(pkgJsonPath, pkgJson, repoSlug) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        let modified = false;
-        // `repository.url` must be set, and must match the repo the workflow builds in.
-        //
-        // `create-package` scaffolds it EMPTY, and npm rejects a provenance-signed publish whose
-        // attestation cannot be matched against it:
-        //
-        //   422 Error verifying sigstore provenance bundle: Failed to validate repository
-        //   information: package.json "repository.url" is "", expected to match <repo>
-        //
-        // The slug is already resolved from `git remote` above, so there is no reason to leave a
-        // package to discover this at its first release.
-        if (repoSlug !== 'OWNER/REPO') {
-            const url = `git+https://github.com/${repoSlug}.git`;
-            const current = typeof pkgJson.repository === 'string'
-                ? pkgJson.repository
-                : (_a = pkgJson.repository) === null || _a === void 0 ? void 0 : _a.url;
-            if (!current) {
-                pkgJson.repository = { type: 'git', url };
-                modified = true;
-            }
-        }
-        if (!pkgJson.publishConfig) {
-            pkgJson.publishConfig = { access: 'public' };
-            modified = true;
-        }
-        else {
-            if (pkgJson.publishConfig.access !== 'public') {
-                pkgJson.publishConfig.access = 'public';
-                modified = true;
-            }
-            // Strip provenance: true — it requires OIDC (id-token: write permission +
-            // npm Trusted Publisher config), which conflicts with our NPM_AUTH_TOKEN
-            // flow. Users who want provenance should use OIDC separately.
-            if (pkgJson.publishConfig.provenance) {
-                delete pkgJson.publishConfig.provenance;
-                modified = true;
-            }
-        }
-        pkgJson.devDependencies = pkgJson.devDependencies || {};
-        if (!pkgJson.devDependencies['@changesets/cli']) {
-            pkgJson.devDependencies['@changesets/cli'] = '^2.29.8';
-            modified = true;
-        }
-        if (!pkgJson.devDependencies['@changesets/changelog-github']) {
-            pkgJson.devDependencies['@changesets/changelog-github'] = '^0.5.2';
-            modified = true;
-        }
-        if (modified) {
+        if (applyPackageJsonPatches(pkgJson, repoSlug)) {
             fs.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\n');
             console.log(chalk.green('  ✓') + ' package.json (publishConfig + changesets devDeps)');
         }
@@ -237,6 +234,55 @@ function patchPackageJson(pkgJsonPath, pkgJson, repoSlug) {
         }
     });
 }
+/** Mutates `pkgJson` in place; returns whether anything changed. Pure enough to test. */
+export function applyPackageJsonPatches(pkgJson, repoSlug) {
+    var _a;
+    let modified = false;
+    // `repository.url` must be set, and must match the repo the workflow builds in.
+    //
+    // `create-package` scaffolds it EMPTY, and npm rejects a provenance-signed publish whose
+    // attestation cannot be matched against it:
+    //
+    //   422 Error verifying sigstore provenance bundle: Failed to validate repository
+    //   information: package.json "repository.url" is "", expected to match <repo>
+    //
+    // The slug is already resolved from `git remote` above, so there is no reason to leave a
+    // package to discover this at its first release.
+    if (repoSlug !== 'OWNER/REPO') {
+        const url = `git+https://github.com/${repoSlug}.git`;
+        const current = typeof pkgJson.repository === 'string'
+            ? pkgJson.repository
+            : (_a = pkgJson.repository) === null || _a === void 0 ? void 0 : _a.url;
+        if (!current) {
+            pkgJson.repository = { type: 'git', url };
+            modified = true;
+        }
+    }
+    if (!pkgJson.publishConfig) {
+        pkgJson.publishConfig = { access: 'public' };
+        modified = true;
+    }
+    else {
+        if (pkgJson.publishConfig.access !== 'public') {
+            pkgJson.publishConfig.access = 'public';
+            modified = true;
+        }
+        // `provenance` is deliberately left alone. It used to be stripped because publishing went
+        // through NPM_AUTH_TOKEN only; the shared workflow now publishes with OIDC trusted publishing
+        // first (`npm publish --provenance`, id-token: write on both caller and reusable workflow) and
+        // falls back to the staged token release, so provenance is wanted, not a conflict.
+    }
+    pkgJson.devDependencies = pkgJson.devDependencies || {};
+    if (!pkgJson.devDependencies['@changesets/cli']) {
+        pkgJson.devDependencies['@changesets/cli'] = '^2.29.8';
+        modified = true;
+    }
+    if (!pkgJson.devDependencies['@changesets/changelog-github']) {
+        pkgJson.devDependencies['@changesets/changelog-github'] = '^0.5.2';
+        modified = true;
+    }
+    return modified;
+}
 function ensureLockfile(cwd) {
     return __awaiter(this, void 0, void 0, function* () {
         // Always regenerate — package.json has just been patched (new devDeps etc.),
@@ -294,27 +340,23 @@ function configureGithub(repoSlug) {
             console.warn(chalk.yellow('  ⚠ `gh` CLI is not authenticated. Run `gh auth login` and retry.'));
             return;
         }
-        const payload = JSON.stringify({
-            required_status_checks: { strict: true, contexts: ['Build & Test'] },
-            enforce_admins: false,
-            required_pull_request_reviews: null,
-            restrictions: null,
-            allow_force_pushes: false,
-            allow_deletions: false,
-        });
+        const payload = JSON.stringify(buildBranchProtectionPayload());
         try {
             // Use --input - to pass the JSON payload via stdin
             yield execPromise(`echo '${payload.replace(/'/g, "'\\''")}' | gh api -X PUT /repos/${repoSlug}/branches/main/protection --input -`, false, false);
             console.log(chalk.green('  ✓') + ` branch protection enabled on ${repoSlug}/main`);
+            // A repo can pin a required check in a *ruleset* as well as in classic branch protection, and
+            // the two are stored separately — this call only writes the classic one, so a leftover ruleset
+            // keeps blocking merges on a check name that no longer reports.
+            console.log(chalk.gray(`  · check for a competing ruleset: gh api /repos/${repoSlug}/rulesets`));
         }
         catch (err) {
             console.warn(chalk.yellow('  ⚠ Failed to set branch protection. Do it manually:'));
             console.warn(chalk.yellow(`    https://github.com/${repoSlug}/settings/branches`));
         }
-        // Enable "Allow auto-merge" so the post-release back-merge PR (dual-branch) self-merges once
-        // checks pass. Harmless for single-branch repos. The publish workflow authors release/back-merge
-        // PRs via the org App token (org secrets RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY) so their CI
-        // runs without a manual approval gate.
+        // Enable "Allow auto-merge" so a PR can be queued to merge itself once checks pass. The publish
+        // workflow authors the Release PR via the org App token (org secrets RELEASE_APP_ID /
+        // RELEASE_APP_PRIVATE_KEY) so its CI runs without a manual approval gate.
         try {
             yield execPromise(`gh api -X PATCH /repos/${repoSlug} -F allow_auto_merge=true`, false, false);
             console.log(chalk.green('  ✓') + ` auto-merge enabled on ${repoSlug}`);
@@ -356,24 +398,41 @@ function printNextSteps(repoSlug, npmSecretName, configuredGithub, grantedTeam)
     console.log('');
     console.log(chalk.bold('Next steps:'));
     console.log('');
+    const [owner, repo] = repoSlug.split('/');
     console.log(`  1. Review the generated files, adjust as needed.`);
     console.log(`  2. Commit:`);
-    console.log(chalk.cyan('       git add . && git commit -m "set up single-branch publish workflow"'));
+    console.log(chalk.cyan('       git add . && git commit -m "set up the publish pipeline"'));
     console.log(`  3. Push to main — the publish workflow will trigger.`);
     console.log('');
-    console.log(chalk.bold('One-time org-level setup (if not already done):'));
+    console.log(chalk.bold('Register the trusted publisher on npmjs.com (before the first release):'));
+    console.log('');
+    console.log(`  package → Settings → Trusted Publisher, matching the caller workflow exactly:`);
+    console.log(`    organization: ${chalk.cyan(owner)}   repository: ${chalk.cyan(repo)}`);
+    console.log(`    workflow filename: ${chalk.cyan('publish.yml')}   environment: ${chalk.cyan('(empty)')}`);
+    console.log(`    "Allow npm publish": ${chalk.cyan('ticked')}`);
+    console.log('');
+    console.log(chalk.gray(`  Without it the release still ships — the workflow falls back to a staged`));
+    console.log(chalk.gray(`  npm release that a maintainer approves with 2FA. A typo in the organization`));
+    console.log(chalk.gray(`  field looks exactly the same, so check that field first if a package that`));
+    console.log(chalk.gray(`  should publish directly keeps staging instead.`));
+    console.log('');
+    // No per-repo secret grant step: NPM_AUTH_TOKEN, RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY are
+    // "All repositories" org secrets, which is the whole reason first-party and community packages
+    // live in separate orgs. Only mention what is genuinely still one-time-per-org.
+    console.log(chalk.bold('One-time org-level setup (already done on linked-fw):'));
     console.log('');
-    console.log(`  a. Create an org secret ${chalk.cyan(npmSecretName)} with a granular npm token`);
-    console.log(`     (2FA-bypass, write access to the @_linked* scope).`);
-    console.log(`     → https://github.com/organizations/${repoSlug.split('/')[0]}/settings/secrets/actions`);
+    console.log(`  a. Org secrets ${chalk.cyan(npmSecretName)}, ${chalk.cyan('RELEASE_APP_ID')} and ${chalk.cyan('RELEASE_APP_PRIVATE_KEY')},`);
+    console.log(`     visible to ${chalk.cyan('All repositories')} — there is no per-repo grant step.`);
+    console.log(`     → https://github.com/organizations/${owner}/settings/secrets/actions`);
     console.log('');
     console.log(`  b. Enable "Allow GitHub Actions to create and approve pull requests":`);
-    console.log(`     → https://github.com/organizations/${repoSlug.split('/')[0]}/settings/actions`);
+    console.log(`     → https://github.com/organizations/${owner}/settings/actions`);
     if (!configuredGithub) {
         console.log('');
         console.log(chalk.bold('Branch protection:'));
         console.log(`  Rerun with ${chalk.cyan('linked setup-publish --configure-github')} to configure automatically,`);
-        console.log(`  or set manually at https://github.com/${repoSlug}/settings/branches`);
+        console.log(`  or set manually at https://github.com/${repoSlug}/settings/branches —`);
+        console.log(`  the required check is ${chalk.cyan('checks / Build & Test')}, not ${chalk.cyan('Build & Test')}.`);
     }
     console.log('');
 }