@bensandee/tooling 0.63.0 → 0.64.1

package/dist/bin.mjs

@@ -7,7 +7,7 @@ import path from "node:path";
 import { appendFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { execFileSync, execSync } from "node:child_process";
 import JSON5 from "json5";
-import { parse } from "jsonc-parser";
+import { applyEdits, modify, parse } from "jsonc-parser";
 import { z } from "zod";
 import { FatalError, TransientError, UnexpectedError } from "@bensandee/common";
 import { isMap, isScalar, isSeq, parse as parse$1, parseDocument, stringify, visit } from "yaml";
@@ -2006,23 +2006,149 @@ function diagnoseCheckScriptForwardingAt(targetDir) {
 //#endregion
 //#region src/generators/package-json.ts
 /**
-* Node major pinned for the dev/CI runtime via `devEngines.runtime`.
+* Single source of truth for the supported Node floor. `engines.node` is the
+* honest minimum (`>=<floor>`); `devEngines.runtime.version` is the caret form
+* (`^<floor>` = `>=floor <nextmajor>`), which serves two masters at once:
 *
-* `actions/setup-node` reads `devEngines.runtime` (for `name: "node"`) before
-* `engines.node`, and a bounded `<major>.x` resolves to the latest patch of that
-* one major. Without it, a `>=`-range `engines.node` makes setup-node install the
-* newest available major (e.g. Node 26), silently drifting CI off the LTS line.
-* `engines.node` stays the honest minimum-supported floor; this is the version CI
-* actually runs. `onFail: "warn"` keeps a local Node mismatch non-fatal.
+*  - `actions/setup-node` reads `devEngines.runtime` (for `name: "node"`) before
+*    `engines.node`. The `<nextmajor>` upper bound keeps it on the pinned LTS
+*    major (resolving to the latest patch within it) instead of floating to the
+*    newest released major (e.g. Node 26) the way a bare `>=` range would.
+*  - pnpm resolves `devEngines.runtime.version` to its floor and checks it
+*    against `engines.node`. The caret's floor equals the engines floor, so the
+*    two never contradict — a `<major>.x` floor of `<major>.0.0` sits below
+*    `>=<floor>` and makes `pnpm install` emit a spurious "Unsupported engine"
+*    warning. The floor MUST track `engines.node`, so it is derived from it
+*    rather than hard-coded.
+*
+* `onFail: "warn"` keeps a local Node mismatch non-fatal.
 */
-const DEV_NODE_VERSION = "24.x";
+const NODE_ENGINES_FLOOR = "24.13.0";
+const ENGINES_NODE = `>=${NODE_ENGINES_FLOOR}`;
+/** The `^<floor>` runtime range whose floor satisfies a `>=<floor>` engines range. */
+function caretRange(floor) {
+	return `^${floor}`;
+}
 function devEnginesRuntime() {
 	return { runtime: {
 		name: "node",
-		version: DEV_NODE_VERSION,
+		version: caretRange(NODE_ENGINES_FLOOR),
 		onFail: "warn"
 	} };
 }
+function versionPart(s) {
+	return s && s !== "x" && s !== "*" ? Number(s) : 0;
+}
+function compareTuples(a, b) {
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] - b[i];
+	return 0;
+}
+/**
+* Effective lower bound of a single conjunction (space-separated comparators like
+* `>=24.14.0 <25.0.0`). Upper bounds (`<`, `<=`) don't raise the floor and are
+* ignored; the floor is the **max** of the remaining lower-bound tokens (`>=`,
+* `>`, `^`, `~`, `=`, bare, `<major>.x`). Missing/wildcard positions read as 0.
+* `undefined` when no token carries a numeric lower bound.
+*/
+function conjunctionFloor(conjunction) {
+	let floor;
+	for (const token of conjunction.trim().split(/\s+/)) {
+		if (!token || token.startsWith("<")) continue;
+		const match = /(\d+)(?:\.(\d+|x|\*))?(?:\.(\d+|x|\*))?/.exec(token);
+		if (!match) continue;
+		const candidate = [
+			Number(match[1]),
+			versionPart(match[2]),
+			versionPart(match[3])
+		];
+		if (!floor || compareTuples(candidate, floor) > 0) floor = candidate;
+	}
+	return floor;
+}
+/**
+* Lowest version a semver range permits, as a `[major, minor, patch]` tuple —
+* what pnpm resolves a `devEngines.runtime.version` to when cross-checking
+* `engines.node`. Handles floor-first forms (`>=24.14.0`, `^24.13.0`, `24.x`,
+* `24`), compound ranges in any order (`>=24.14.0 <25.0.0`, `<25 >=24.14.0` →
+* `24.14.0`), and `||` alternation (the minimum across alternatives).
+*
+* Returns `undefined` when no floor can be determined (e.g. `*`, `latest`, an
+* alternative with only an upper bound) — callers must warn rather than guess.
+*/
+function minVersionTuple(range) {
+	let min;
+	for (const alternative of range.split("||")) {
+		const floor = conjunctionFloor(alternative);
+		if (!floor) return void 0;
+		if (!min || compareTuples(floor, min) < 0) min = floor;
+	}
+	return min;
+}
+/** True when `range`'s floor is >= `enginesNode`'s floor (i.e. pnpm won't warn). */
+function runtimeFloorSatisfies(range, enginesNode) {
+	const dev = minVersionTuple(range);
+	const eng = minVersionTuple(enginesNode);
+	if (!dev || !eng) return true;
+	return compareTuples(dev, eng) >= 0;
+}
+/**
+* Decide how to reconcile a package's `devEngines.runtime` (node entries) with
+* its `engines.node` floor, without mutating anything. The caret form `^<floor>`
+* keeps pnpm quiet (its floor equals the engines floor) while staying bounded to
+* the same major for `setup-node`.
+*
+*  - `noop`  — no node runtime declared, or every node runtime already satisfies
+*    the engines floor (a deliberate higher pin is left alone). Never adds a
+*    `devEngines.runtime` that isn't already there.
+*  - `warn`  — a node runtime is declared but `engines.node` has no determinable
+*    floor; leave it unchanged rather than guess.
+*  - `fix`   — `staleIndices` index the node runtimes (in array order, or `[0]`
+*    for the single-object form) whose `version` must become `desired`.
+*/
+function planDevEnginesFix(pkg, enginesNode) {
+	const runtimeField = pkg["devEngines"]?.runtime;
+	if (!runtimeField) return { kind: "noop" };
+	const nodeEntries = (Array.isArray(runtimeField) ? runtimeField : [runtimeField]).map((runtime, index) => ({
+		runtime,
+		index
+	})).filter(({ runtime }) => runtime.name === "node" && typeof runtime.version === "string");
+	if (nodeEntries.length === 0) return { kind: "noop" };
+	const floor = minVersionTuple(enginesNode);
+	if (!floor) return {
+		kind: "warn",
+		message: `could not determine a floor from engines.node "${enginesNode}"`
+	};
+	const desired = caretRange(`${floor[0]}.${floor[1]}.${floor[2]}`);
+	const staleIndices = nodeEntries.filter(({ runtime }) => !runtimeFloorSatisfies(runtime.version ?? "", enginesNode)).map(({ index }) => index);
+	if (staleIndices.length === 0) return { kind: "noop" };
+	return {
+		kind: "fix",
+		desired,
+		staleIndices
+	};
+}
+/**
+* Correct an existing `devEngines.runtime` (node) in place so its floor matches
+* `engines.node` — only the `version` changes; `name` and `onFail` are
+* preserved. Never adds `devEngines.runtime` to a package that lacks it.
+*/
+function ensureDevEnginesConsistent(pkg, enginesNode, changes) {
+	const plan = planDevEnginesFix(pkg, enginesNode);
+	if (plan.kind === "warn") {
+		log.warn(`package.json: ${plan.message}; leaving devEngines.runtime unchanged`);
+		return;
+	}
+	if (plan.kind !== "fix") return;
+	const runtimeField = pkg["devEngines"]?.runtime;
+	const runtimes = Array.isArray(runtimeField) ? runtimeField : runtimeField ? [runtimeField] : [];
+	for (const index of plan.staleIndices) {
+		const runtime = runtimes[index];
+		if (!runtime) continue;
+		const previous = runtime.version;
+		runtime.version = plan.desired;
+		changes.push(`bumped devEngines.runtime node ${previous} → ${plan.desired}`);
+	}
+}
 const STANDARD_SCRIPTS_SINGLE = {
 	build: "tsdown",
 	dev: "tsdown --watch",
@@ -2332,13 +2458,11 @@ function applyMetadataDefaults(pkg, ctx, changes) {
 		}
 	}
 	if (!pkg["engines"]) {
-		pkg["engines"] = { node: ">=24.13.0" };
-		changes.push("set engines.node >= 24.13.0");
-	}
-	if (!pkg["devEngines"]) {
-		pkg["devEngines"] = devEnginesRuntime();
-		changes.push(`set devEngines.runtime node ${DEV_NODE_VERSION}`);
+		pkg["engines"] = { node: ENGINES_NODE };
+		changes.push(`set engines.node ${ENGINES_NODE}`);
 	}
+	const enginesNode = pkg["engines"]?.["node"];
+	if (typeof enginesNode === "string") ensureDevEnginesConsistent(pkg, enginesNode, changes);
 	const pinnedPnpm = {
 		"@changesets/cli": "2.31.0",
 		"@release-it/bumper": "7.0.6",
@@ -2392,7 +2516,7 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.12.0";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.63.0";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.64.1";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.13.1";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.31.0",
@@ -2472,7 +2596,7 @@ async function generatePackageJson(ctx) {
 		type: "module",
 		scripts: allScripts,
 		devDependencies: devDeps,
-		engines: { node: ">=24.13.0" },
+		engines: { node: ENGINES_NODE },
 		devEngines: devEnginesRuntime(),
 		packageManager: `pnpm@${{
 			"@changesets/cli": "2.31.0",
@@ -2498,6 +2622,63 @@ async function generatePackageJson(ctx) {
 		description: "Generated package.json"
 	};
 }
+/**
+* Reconcile `devEngines.runtime` against `engines.node` in nested workspace
+* packages — pnpm's "Unsupported engine" warning fires per-package, so a
+* subpackage that declares both fields can warn even when the root is clean.
+*
+* Unlike the root `package.json` (a fully managed file), a subpackage's
+* `package.json` is otherwise owned by the user, so this edits *only* the stale
+* `version` string via `jsonc-parser` rather than reserialising the whole file
+* (which would reorder keys and produce a large surprising diff). It never adds
+* `engines.node` or `devEngines.runtime` — it touches a package only when both
+* already exist and a node runtime's floor is below the engines floor.
+*
+* Scans `packages/*` (the same convention as the rest of the tool); other
+* workspace layouts (`apps/*`, custom globs) are out of scope.
+*/
+async function generateWorkspaceEngines(ctx) {
+	if (ctx.config.structure !== "monorepo") return [];
+	const results = [];
+	for (const member of getMonorepoPackages(ctx.targetDir)) {
+		const result = reconcileWorkspaceDevEngines(ctx, path.join(path.relative(ctx.targetDir, member.dir), "package.json"));
+		if (result) results.push(result);
+	}
+	return results;
+}
+/** Surgically fix a single nested package.json's devEngines, preserving its formatting. */
+function reconcileWorkspaceDevEngines(ctx, relPath) {
+	const raw = ctx.read(relPath);
+	if (!raw) return void 0;
+	const pkg = parsePackageJson(raw);
+	if (!pkg) return void 0;
+	const enginesNode = pkg["engines"]?.["node"];
+	if (typeof enginesNode !== "string") return void 0;
+	const plan = planDevEnginesFix(pkg, enginesNode);
+	if (plan.kind === "warn") {
+		log.warn(`${relPath}: ${plan.message}; leaving devEngines.runtime unchanged`);
+		return;
+	}
+	if (plan.kind !== "fix") return void 0;
+	const isArray = Array.isArray(pkg["devEngines"]?.runtime);
+	let text = raw;
+	for (const index of plan.staleIndices) text = applyEdits(text, modify(text, isArray ? [
+		"devEngines",
+		"runtime",
+		index,
+		"version"
+	] : [
+		"devEngines",
+		"runtime",
+		"version"
+	], plan.desired, {}));
+	ctx.write(relPath, text);
+	return {
+		filePath: relPath,
+		action: "updated",
+		description: `bumped devEngines.runtime node → ${plan.desired}`
+	};
+}
 //#endregion
 //#region src/generators/tsconfig.ts
 async function generateTsconfig(ctx) {
@@ -3301,8 +3482,12 @@ async function generateTsdown(ctx) {
 }
 //#endregion
 //#region src/release/forgejo.ts
-const RETRY_ATTEMPTS = 3;
-const RETRY_BASE_DELAY_MS = 1e3;
+/** Patient-repair attempts (delete frozen release, wait, retry) before escalating. */
+const SETTLE_ATTEMPTS = 4;
+/** Base backoff between patient-repair attempts; doubles each attempt. */
+const SETTLE_BASE_DELAY_MS = 2e3;
+/** Cap on a single patient-repair backoff. */
+const SETTLE_MAX_DELAY_MS = 16e3;
 /** Safely read response body text for inclusion in error messages. */
 async function responseBodyText(res) {
 	try {
@@ -3510,20 +3695,29 @@ async function getReleaseByTag(executor, conn, tag) {
 	if (!parsed.success) throw new UnexpectedError(`Unexpected release response: ${parsed.error.message}`);
 	return parsed.data;
 }
-/** Create a Forgejo release for a given tag. */
-async function createRelease(executor, conn, tag) {
+/**
+* Create a Forgejo release for a given tag.
+*
+* When `options.target` (a commit SHA or branch) is provided and the tag does
+* not yet exist, Forgejo **creates the tag itself** from that commitish and
+* stamps `created_unix = now` synchronously — sidestepping the buggy async
+* stamping of a pushed tag. The created tag is lightweight.
+*/
+async function createRelease(executor, conn, tag, options = {}) {
 	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases`;
+	const payload = {
+		tag_name: tag,
+		name: tag,
+		body: `Published ${tag}`
+	};
+	if (options.target) payload["target_commitish"] = options.target;
 	const res = await executor.fetch(url, {
 		method: "POST",
 		headers: {
 			Authorization: `token ${conn.token}`,
 			"Content-Type": "application/json"
 		},
-		body: JSON.stringify({
-			tag_name: tag,
-			name: tag,
-			body: `Published ${tag}`
-		})
+		body: JSON.stringify(payload)
 	});
 	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
 		verb: "create release",
@@ -3531,6 +3725,26 @@ async function createRelease(executor, conn, tag) {
 	}));
 }
 /**
+* Delete a git tag from the repository (`DELETE /repos/{repo}/tags/{tag}`).
+*
+* Used by {@link ensureRelease} to take tag ownership away from the buggy
+* push-ingestion path: once the tag is gone, recreating the release with a
+* `target_commitish` makes Forgejo create the tag fresh with a real date. A 404
+* (already gone) is treated as success.
+*/
+async function deleteTag(executor, conn, tag) {
+	const encodedTag = encodeURIComponent(tag);
+	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/tags/${encodedTag}`;
+	const res = await executor.fetch(url, {
+		method: "DELETE",
+		headers: { Authorization: `token ${conn.token}` }
+	});
+	if (!res.ok && res.status !== 404) throw new TransientError(await forgejoErrorMessage(res, {
+		verb: "delete tag",
+		resource: tag
+	}));
+}
+/**
 * Delete a Forgejo release by id. Does **not** delete the underlying git tag
 * (no `delete_tag` query param) — the tag is the source of truth, and a
 * subsequent `POST /releases` relies on it still existing to insert a fresh
@@ -3550,62 +3764,83 @@ async function deleteRelease(executor, conn, releaseId) {
 /**
 * Ensure a Forgejo release exists for a tag **with a real created date**.
 *
-* The tag is pushed before this runs, so Forgejo may have already auto-created
-* a tag-placeholder release. A naive create can leave the release stuck at the
-* Unix epoch (see {@link isEpochReleaseDate}) — a published-but-invisible
-* release, because `/releases/latest` sorts by date. This function guarantees a
-* real date or throws:
+* Forgejo stamps a pushed annotated tag's date *asynchronously*; a release
+* creation that races that stamp freezes the row at the Unix epoch (see
+* {@link isEpochReleaseDate}) — a published-but-invisible release, because
+* `/releases/latest` sorts by date. The failure is intermittent. The repair:
 *
-* 1. A real-dated release already exists → return `"exists"`.
-* 2. An epoch-dated release/placeholder exists → delete it first.
-* 3. Create the release, then **read it back**. Forgejo returns 2xx even when it
-*    promotes a placeholder in place (keeping `created_unix = 0`), so a 2xx does
-*    not prove a real date. If the read-back is epoch-dated, delete and retry.
-* 4. The date stays epoch after all retries → throw (fail the job loudly rather
-*    than silently ship an invisible release).
+* 1. A real-dated release already exists → `"exists"`.
+* 2. Otherwise create the release and read it back. On epoch, delete the frozen
+*    release and wait (increasing backoff) for Forgejo to settle the tag's date,
+*    then retry — **preserving the pushed (annotated) tag**. The frozen release
+*    is never deleted-and-left-empty.
+* 3. If the date still never settles and a `target` commit is known, delete the
+*    tag and recreate the release with `target_commitish` so **Forgejo creates
+*    the tag itself**, stamped `now`. The tag becomes lightweight. → `"repaired"`.
+* 4. If nothing yields a real date, leave a visible release row (rather than only
+*    an invisible tag) and throw loudly.
 *
-* Retries on transient errors with exponential backoff. Returns
-* `"created" | "exists" | "race" | "repaired"`.
+* Returns `"created" | "exists" | "race" | "repaired"`.
 */
-async function ensureRelease(executor, conn, tag) {
+async function ensureRelease(executor, conn, tag, options = {}) {
+	const attempts = options.attempts ?? SETTLE_ATTEMPTS;
+	const baseDelayMs = options.baseDelayMs ?? SETTLE_BASE_DELAY_MS;
 	const existing = await getReleaseByTag(executor, conn, tag);
 	if (existing && !isEpochReleaseDate(existing.created_at)) return "exists";
+	let current = existing;
 	let repairing = false;
-	if (existing) {
-		log.warn(`Release for ${tag} has an epoch (1969/1970) date — deleting and recreating to fix the timestamp`);
-		await deleteRelease(executor, conn, existing.id);
-		repairing = true;
-	}
-	for (let attempt = 1; attempt <= RETRY_ATTEMPTS; attempt++) {
+	for (let attempt = 1; attempt <= attempts; attempt++) {
+		if (current && isEpochReleaseDate(current.created_at)) {
+			await deleteRelease(executor, conn, current.id);
+			current = null;
+			repairing = true;
+			await settleBackoff(attempt, baseDelayMs);
+		}
 		try {
 			await createRelease(executor, conn, tag);
 		} catch (error) {
 			const raced = await getReleaseByTag(executor, conn, tag);
 			if (raced && !isEpochReleaseDate(raced.created_at)) return "race";
-			if (raced) {
-				await deleteRelease(executor, conn, raced.id);
-				repairing = true;
-			}
-			if (attempt >= RETRY_ATTEMPTS) throw error;
-			log.warn(`Release creation attempt ${String(attempt)}/${String(RETRY_ATTEMPTS)} failed: ${error instanceof Error ? error.message : String(error)}`);
-			await backoff(attempt);
+			current = raced;
+			if (attempt >= attempts) break;
+			log.warn(`Release creation attempt ${String(attempt)}/${String(attempts)} failed: ${error instanceof Error ? error.message : String(error)}`);
+			await settleBackoff(attempt, baseDelayMs);
 			continue;
 		}
-		const created = await getReleaseByTag(executor, conn, tag);
-		if (created && !isEpochReleaseDate(created.created_at)) return repairing ? "repaired" : "created";
-		if (created) {
-			await deleteRelease(executor, conn, created.id);
-			repairing = true;
+		current = await getReleaseByTag(executor, conn, tag);
+		if (current && !isEpochReleaseDate(current.created_at)) return repairing ? "repaired" : "created";
+		if (attempt < attempts) log.warn(`Release for ${tag} came back epoch-dated (attempt ${String(attempt)}/${String(attempts)}) — waiting for Forgejo to settle the tag's date before retrying`);
+	}
+	if (options.target && await recreateTagViaApi(executor, conn, tag, {
+		target: options.target,
+		current,
+		attempts,
+		baseDelayMs
+	})) return "repaired";
+	throw new TransientError(`Release for ${tag} never got a real (non-epoch) created date after ${String(attempts)} attempts. This is an intermittent Forgejo bug: a pushed tag's date settles asynchronously and a racing release creation freezes it at the Unix epoch (1969/1970). ` + (options.target ? `Recreating the tag via the API did not help — investigate the server or upgrade Forgejo.` : `Pass the release tag's target commit so the tag can be recreated, or retry the release.`));
+}
+async function recreateTagViaApi(executor, conn, tag, opts) {
+	const { target, current, attempts, baseDelayMs } = opts;
+	log.warn(`Release for ${tag} stayed epoch-dated — recreating the tag via the API so Forgejo stamps a real date (the tag becomes lightweight)`);
+	if (current) await deleteRelease(executor, conn, current.id);
+	await deleteTag(executor, conn, tag);
+	for (let attempt = 1; attempt <= attempts; attempt++) {
+		try {
+			await createRelease(executor, conn, tag, { target });
+		} catch (error) {
+			if (attempt >= attempts) throw new TransientError(`Release for ${tag} was deleted to repair its epoch date, but recreating it from ${target} failed: ${error instanceof Error ? error.message : String(error)}. The tag no longer exists on the server — re-push it (or re-run the release) to restore it.`);
+			await settleBackoff(attempt, baseDelayMs);
+			continue;
 		}
-		if (attempt >= RETRY_ATTEMPTS) throw new TransientError(`Release for ${tag} still has an epoch (1969/1970) created date after ${String(RETRY_ATTEMPTS)} attempts — Forgejo keeps promoting a tag placeholder. The git tag exists but the release row cannot get a real timestamp; investigate the server.`);
-		log.warn(`Release for ${tag} came back epoch-dated (attempt ${String(attempt)}/${String(RETRY_ATTEMPTS)}) — deleting and recreating`);
-		await backoff(attempt);
+		const recreated = await getReleaseByTag(executor, conn, tag);
+		return Boolean(recreated && !isEpochReleaseDate(recreated.created_at));
 	}
-	throw new TransientError(`Failed to create release for ${tag} after ${String(RETRY_ATTEMPTS)} attempts`);
+	return false;
 }
-/** Exponential backoff between release-creation attempts. */
-async function backoff(attempt) {
-	const delay = RETRY_BASE_DELAY_MS * 2 ** (attempt - 1);
+/** Exponential backoff (capped) between patient-repair attempts; a non-positive base is a no-op. */
+async function settleBackoff(attempt, baseDelayMs) {
+	if (baseDelayMs <= 0) return;
+	const delay = Math.min(baseDelayMs * 2 ** (attempt - 1), SETTLE_MAX_DELAY_MS);
 	await new Promise((resolve) => setTimeout(resolve, delay));
 }
 /** Upload an asset file to a Forgejo release. */
@@ -5701,6 +5936,7 @@ async function generateVersionrc(ctx) {
 async function runGenerators(ctx) {
 	const results = [];
 	results.push(await generatePackageJson(ctx));
+	results.push(...await generateWorkspaceEngines(ctx));
 	results.push(await generatePnpmWorkspace(ctx));
 	results.push(...await generateTsconfig(ctx));
 	results.push(await generateTsdown(ctx));
@@ -5734,7 +5970,7 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.63.0 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.64.1 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -6214,6 +6450,17 @@ function computeSlidingTags(version) {
 		"latest"
 	];
 }
+/**
+* Resolve the commit SHA a tag points at (`git rev-parse <tag>^{commit}`), or
+* `undefined` if it can't be resolved. Used to pass a `target` to
+* {@link ensureRelease} so it can recreate a tag through Forgejo's API when the
+* pushed tag's release date never settles.
+*/
+function resolveTagCommit(executor, cwd, tag) {
+	const result = executor.exec("git", ["rev-parse", `${tag}^{commit}`], { cwd });
+	const sha = result.stdout.trim();
+	return result.exitCode === 0 && sha ? sha : void 0;
+}
 /** Parse "New tag:" lines from changeset publish output. */
 function parseNewTags(output) {
 	const tags = [];
@@ -6532,7 +6779,7 @@ async function runPublishMode(executor, config) {
 	for (const tag of allTags) try {
 		pushTagToRemote(executor, config, auth, tag, remoteSet);
 		debug(config, `Ensuring Forgejo release for ${tag}`);
-		if (await ensureRelease(executor, conn, tag) === "exists") log.warn(`Release for ${tag} already exists — skipping`);
+		if (await ensureRelease(executor, conn, tag, { target: resolveTagCommit(executor, config.cwd, tag) }) === "exists") log.warn(`Release for ${tag} already exists — skipping`);
 		else log.info(`Created release for ${tag}`);
 	} catch (error) {
 		errors.push({
@@ -6869,7 +7116,8 @@ const createForgejoReleaseCommand = defineCommand({
 		if (resolved.type !== "forgejo") throw new FatalError("forgejo:create-release requires a Forgejo repository");
 		const executor = createRealExecutor();
 		const conn = resolved.conn;
-		if (await ensureRelease(executor, conn, args.tag) === "exists") log.info(`Release for ${args.tag} already exists — skipping`);
+		const target = resolveTagCommit(executor, process.cwd(), args.tag);
+		if (await ensureRelease(executor, conn, args.tag, { target }) === "exists") log.info(`Release for ${args.tag} already exists — skipping`);
 		else log.info(`Created Forgejo release for ${args.tag}`);
 	}
 });
@@ -7148,7 +7396,8 @@ async function runSimpleRelease(executor, config) {
 async function createPlatformRelease(executor, config, tag) {
 	if (!config.platform) return false;
 	if (config.platform.type === "forgejo") {
-		if (await ensureRelease(executor, config.platform.conn, tag) === "exists") {
+		const target = resolveTagCommit(executor, config.cwd, tag);
+		if (await ensureRelease(executor, config.platform.conn, tag, { target }) === "exists") {
 			debug(config, `Release for ${tag} already exists, skipping`);
 			return false;
 		}
@@ -10214,7 +10463,7 @@ const out = (msg) => console.log(msg);
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.63.0",
+		version: "0.64.1",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -10286,7 +10535,7 @@ const main = defineCommand({
 		})
 	}
 });
-console.log(`@bensandee/tooling v0.63.0`);
+console.log(`@bensandee/tooling v0.64.1`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.63.0",
+  "version": "0.64.1",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {