@bushizhanghan/dsh-publish-gate 0.1.4 → 0.1.6

package/README.md

@@ -29,7 +29,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 | `publish_gate` | 全量门禁：静态检查 + 网络检查，返回 `safeToPublish` |
 | `publish_gate_patch` | 只查 `cordis.patch.yml`——「插件装了但工具没出现」的第一个怀疑对象 |
 | `publish_gate_market` | 校验市场条目 YAML（url/name/category/description 双语） |
-| `publish_gate_next_version` | 当前版本、是否已被 registry 占用、建议 bump 到多少 |
+| `publish_gate_next_version` | 当前版本、是否已被 registry 占用、建议 bump 到多少（本地比 npm 旧时从 npm 的 latest 往上加，不会推荐一个已被占用的版本） |
 | `publish_gate_doctor` | 扫整个目录，按 blocker 数排序，看哪个插件还不能发 |
 | `publish_gate_commands` | 按顺序列出发布命令，并标出这台机器已经走到哪一步 |
 
@@ -90,7 +90,7 @@ dsh plugin --profile desktop add @bushizhanghan/dsh-publish-gate
 ## 开发
 
 ```sh
-node --test    # 24 个测试（含 4 个真实插件作 fixture）
+node --test    # 27 个测试（含 4 个真实插件作 fixture）
 ```
 
 ## License

package/lib/engine.js

@@ -433,6 +433,33 @@ export function bumpPatch(v) {
   return m ? `${m[1]}.${m[2]}.${Number(m[3]) + 1}` : v
 }
 
+/** -1 / 0 / 1 by semver-ish comparison of the numeric part. */
+export function compareVersions(a, b) {
+  const pa = /^(\d+)\.(\d+)\.(\d+)/.exec(String(a))?.slice(1).map(Number) ?? [0, 0, 0]
+  const pb = /^(\d+)\.(\d+)\.(\d+)/.exec(String(b))?.slice(1).map(Number) ?? [0, 0, 0]
+  for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i] > pb[i] ? 1 : -1
+  return 0
+}
+
+/**
+ * The registry's `dist-tags.latest`, or null when it could not be read.
+ * next_version needs this: a local checkout that is BEHIND npm would otherwise
+ * be told to publish a version that is already taken.
+ */
+export async function latestPublished(name, { registry = 'https://registry.npmjs.org', timeoutMs = 8000 } = {}) {
+  try {
+    const res = await fetch(`${registry.replace(/\/$/, '')}/${name.replace('/', '%2f')}`, {
+      headers: { accept: 'application/vnd.npm.install-v1+json' },
+      signal: AbortSignal.timeout(timeoutMs),
+    })
+    if (!res.ok) return null
+    const json = await res.json()
+    return json?.['dist-tags']?.latest ?? null
+  } catch {
+    return null
+  }
+}
+
 export function checkGitState(dir) {
   const out = []
   const gitDir = join(dir, '.git')
@@ -492,7 +519,10 @@ export function checkEntrySource(dir) {
   if (!/export\s+(?:const|function)\s+apply/.test(text)) out.push(F('no-apply-export', 'error', 'lib/index.js does not export `apply`', 'cordis calls apply(ctx, config); without it nothing happens.', 'Add `export function apply(ctx, config) {}`.'))
   if (!/export\s+const\s+inject/.test(text)) out.push(F('no-inject', 'warn', 'lib/index.js does not export `inject`', 'Without an inject list the service is resolved late and `ctx.tools` may be undefined when apply runs.', 'Add `export const inject = [\'tools\']`.'))
   // require() in ESM blows up at load
-  if (/^\s*const\s+\w+\s*=\s*require\(/m.test(text)) {
+  // Any call form, including destructuring and a member access: `const {a} = require(…)`,
+  // `x = require(…)`, `require('node:fs').readFileSync`. A bare `require(` inside a
+  // string is not matched because the regex requires a call with a quote argument.
+  if (/\brequire\s*\(\s*['"`]/.test(text)) {
     out.push(
       F(
         'require-in-esm',

package/lib/index.js

@@ -18,6 +18,8 @@ import {
   checkPatchYml,
   checkTests,
   checkVersionTaken,
+  compareVersions,
+  latestPublished,
   renderReport,
   runStaticChecks,
 } from './engine.js'
@@ -168,23 +170,36 @@ export function apply(ctx, config = {}) {
         if (!dir) return { ok: false, error: 'no plugin directory given' }
         const json = readJson(join(dir, 'package.json'))
         if (!json?.version) return { ok: false, error: 'no version in package.json' }
-        const taken = (await checkVersionTaken(json.name, json.version, { registry: cfg.registry })).map((f) => f.title)
-        const [a, b, c] = /^(\d+)\.(\d+)\.(\d+)/.exec(json.version)?.slice(1).map(Number) ?? [0, 0, 0]
+        const taken = (await checkVersionTaken(json.name, json.version, { registry: cfg.registry, timeoutMs: cfg.networkTimeoutMs })).map((f) => f.title)
+        const latest = await latestPublished(json.name, { registry: cfg.registry, timeoutMs: cfg.networkTimeoutMs })
+        // A checkout that is behind npm must bump from npm's latest, or the
+        // "suggested" version is one that is already published.
+        const behind = latest && compareVersions(latest, json.version) > 0 ? latest : null
+        const base = behind ?? json.version
+        const [a, b, c] = /^(\d+)\.(\d+)\.(\d+)/.exec(base)?.slice(1).map(Number) ?? [0, 0, 0]
         const bump = args.bump || 'patch'
         const suggested =
           bump === 'major' ? `${a + 1}.0.0` : bump === 'minor' ? `${a}.${b + 1}.0` : `${a}.${b}.${c + 1}`
-        return { ok: true, current: json.version, taken, suggested, suggestedFor: bump }
+        return {
+          ok: true,
+          current: json.version,
+          latest,
+          behind,
+          taken,
+          suggested,
+          suggestedFor: bump,
+          note: behind ? `package.json is behind the registry (${behind} is live); the suggestion bumps from there.` : undefined,
+        }
       },
     },
     {
       name: 'publish_gate_doctor',
       description:
-        'Run the gate over every plugin in a directory tree (e.g. a workspace holding several plugin checkouts) and rank them by blocker count, so you can see which one is not ready to ship before you start a publish session. Returns {ok, plugins:[{dir,blockers,warns,notes,top}], totals}.',
+        'Run the gate over every plugin in a directory tree (e.g. a workspace holding several plugin checkouts) and rank them by blocker count, so you can see which one is not ready to ship before you start a publish session. Static checks only — no registry or GitHub calls, so it is fast and works offline. Returns {ok, plugins:[{dir,blockers,warns,notes,top}], totals}.',
       parameters: {
         type: 'object',
         properties: {
           root: { type: 'string', description: 'Directory containing plugin checkouts.' },
-          skipNetwork: { type: 'boolean', description: 'Skip registry/GitHub checks (default true for a multi-plugin sweep).' },
         },
       },
       async execute(args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bushizhanghan/dsh-publish-gate",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Helps DSH plugin AUTHORS publish their plugins: a one-command gate that turns every silent failure in the publish path into a deterministic check — package.json completeness, BOM, YAML/JSON parseability, junction and patch insert correctness, npm scope permissions, GitHub repo and token state, market entry format, LICENSE/README, test suite. 帮助插件作者一键发布：写完插件后跑一遍门禁，把发布链路上的每个静默坑变成确定性检查，然后 GitHub + npm + 市场一键三连。",
   "type": "module",
   "main": "lib/index.js",