@celilo/cli 0.3.30 → 0.4.0-alpha.1

package/src/cli/commands/publish/consumer-pins.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Consumer-pins planner tests — covers the pure inner that decides
+ * what dep updates a single package.json would receive. The disk-
+ * walking wrapper (`planConsumerPins`) is a thin orchestrator on top
+ * of this; testing the pure layer exercises all the policy.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { bumpUpdatesFor } from './consumer-pins';
+import type { PackageJson } from './types';
+
+function latest(entries: Record<string, string>): Map<string, string> {
+  return new Map(Object.entries(entries));
+}
+
+describe('bumpUpdatesFor', () => {
+  test('empty package returns no updates', () => {
+    expect(bumpUpdatesFor({}, latest({ '@celilo/cli': '0.4.0' }))).toEqual([]);
+  });
+
+  test('skips deps not in the published map (only manages our own)', () => {
+    const pkg: PackageJson = {
+      dependencies: { lodash: '^4.17.21', '@celilo/cli': '^0.3.0' },
+    };
+    const updates = bumpUpdatesFor(pkg, latest({ '@celilo/cli': '0.4.0' }));
+    expect(updates).toHaveLength(1);
+    expect(updates[0].depName).toBe('@celilo/cli');
+    expect(updates[0].newSpec).toBe('^0.4.0');
+  });
+
+  test('preserves caret pin', () => {
+    const pkg: PackageJson = { dependencies: { '@celilo/cli': '^0.3.0' } };
+    expect(bumpUpdatesFor(pkg, latest({ '@celilo/cli': '0.4.0' }))).toEqual([
+      {
+        bucket: 'dependencies',
+        depName: '@celilo/cli',
+        oldSpec: '^0.3.0',
+        newSpec: '^0.4.0',
+      },
+    ]);
+  });
+
+  test('preserves tilde pin', () => {
+    const pkg: PackageJson = { dependencies: { '@celilo/cli': '~0.3.0' } };
+    expect(bumpUpdatesFor(pkg, latest({ '@celilo/cli': '0.4.0' }))).toEqual([
+      {
+        bucket: 'dependencies',
+        depName: '@celilo/cli',
+        oldSpec: '~0.3.0',
+        newSpec: '~0.4.0',
+      },
+    ]);
+  });
+
+  test('preserves exact pin (no operator widening)', () => {
+    const pkg: PackageJson = { dependencies: { '@celilo/cli': '0.3.0' } };
+    expect(bumpUpdatesFor(pkg, latest({ '@celilo/cli': '0.4.0' }))).toEqual([
+      {
+        bucket: 'dependencies',
+        depName: '@celilo/cli',
+        oldSpec: '0.3.0',
+        newSpec: '0.4.0',
+      },
+    ]);
+  });
+
+  test('skips workspace:* protocol specs', () => {
+    const pkg: PackageJson = {
+      dependencies: {
+        '@celilo/cli': 'workspace:^',
+        '@celilo/e2e': 'workspace:*',
+      },
+    };
+    expect(bumpUpdatesFor(pkg, latest({ '@celilo/cli': '0.4.0', '@celilo/e2e': '0.8.0' }))).toEqual(
+      [],
+    );
+  });
+
+  test('skips file: / git: protocol specs (deliberate local pins)', () => {
+    const pkg: PackageJson = {
+      dependencies: {
+        '@celilo/cli': 'file:../celilo',
+        '@celilo/e2e': 'git://github.com/celilo/e2e.git',
+      },
+    };
+    expect(bumpUpdatesFor(pkg, latest({ '@celilo/cli': '0.4.0', '@celilo/e2e': '0.8.0' }))).toEqual(
+      [],
+    );
+  });
+
+  test('bumps npm: protocol specs (those are real npm refs)', () => {
+    const pkg: PackageJson = {
+      dependencies: { '@celilo/cli': 'npm:@celilo/cli@^0.3.0' },
+    };
+    // Edge: the bareVersion strip won't recover "0.3.0" cleanly from
+    // the full npm: spec, so the equality check doesn't fire and we
+    // attempt a withOperator rewrite — but withOperator only strips
+    // operators it knows, leaving the npm:-prefixed spec different
+    // from newSpec, so an update IS emitted. This documents current
+    // behavior; bumping npm:-aliased deps isn't a tested use case.
+    const updates = bumpUpdatesFor(pkg, latest({ '@celilo/cli': '0.4.0' }));
+    expect(updates).toHaveLength(1);
+  });
+
+  test('skips deps already at the target bare version', () => {
+    const pkg: PackageJson = {
+      dependencies: {
+        a: '0.4.0',
+        b: '^0.4.0',
+        c: '~0.4.0',
+      },
+    };
+    expect(bumpUpdatesFor(pkg, latest({ a: '0.4.0', b: '0.4.0', c: '0.4.0' }))).toEqual([]);
+  });
+
+  test('walks every dependency bucket', () => {
+    const pkg: PackageJson = {
+      dependencies: { a: '^1.0.0' },
+      devDependencies: { b: '^1.0.0' },
+      peerDependencies: { c: '^1.0.0' },
+      optionalDependencies: { d: '^1.0.0' },
+    };
+    const updates = bumpUpdatesFor(pkg, latest({ a: '1.1.0', b: '1.1.0', c: '1.1.0', d: '1.1.0' }));
+    expect(updates.map((u) => u.bucket)).toEqual([
+      'dependencies',
+      'devDependencies',
+      'peerDependencies',
+      'optionalDependencies',
+    ]);
+  });
+
+  test('emits multiple updates for multiple changed deps', () => {
+    const pkg: PackageJson = {
+      dependencies: {
+        '@celilo/cli': '^0.3.0',
+        '@celilo/e2e': '^0.7.0',
+        '@celilo/event-bus': '^0.1.0',
+      },
+    };
+    const updates = bumpUpdatesFor(
+      pkg,
+      latest({
+        '@celilo/cli': '0.4.0',
+        '@celilo/e2e': '0.8.0',
+        '@celilo/event-bus': '0.1.5',
+      }),
+    );
+    expect(updates).toHaveLength(3);
+    expect(updates.map((u) => u.depName).sort()).toEqual([
+      '@celilo/cli',
+      '@celilo/e2e',
+      '@celilo/event-bus',
+    ]);
+  });
+});

package/src/cli/commands/publish/consumer-pins.ts

@@ -0,0 +1,149 @@
+/**
+ * Consumer pin bumps — Phase 2 of `celilo publish`.
+ *
+ * Walks the in-repo `modules/`, `apps/`, `packages/` trees and any
+ * external project paths from `.env`'s `EXTERNAL_PROJECT_PATHS`, and
+ * bumps every `@celilo/*` dependency pin to the current npm-latest
+ * version. Preserves the caret/tilde/exact operator each entry already
+ * uses. `workspace:*`/`workspace:^` references are left alone (those
+ * are rewritten at publish time, not consumer-install time).
+ *
+ * Skipped in --alpha mode (consumers opt into @alpha manually). Runs
+ * in --normal and --promote modes.
+ */
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import {
+  REPO_ROOT,
+  bareVersion,
+  fetchLatestVersions,
+  findPackageJsons,
+  readExternalProjectPaths,
+  withOperator,
+} from './helpers';
+import type { ConsumerPinItem, PackageJson } from './types';
+
+// ─── Planner ───────────────────────────────────────────────────────
+
+/**
+ * Build the consumer-pin plan. For each package.json under managed
+ * roots, compute which `@celilo/*` deps would change if we bumped them
+ * to current npm-latest. Returns the file paths + per-bucket update
+ * lists; doesn't write anything.
+ */
+export function planConsumerPins(): ConsumerPinItem[] {
+  const latestMap = fetchLatestVersions();
+  if (latestMap.size === 0) return [];
+
+  const externalPaths = readExternalProjectPaths();
+  const roots = [
+    join(REPO_ROOT, 'modules'),
+    join(REPO_ROOT, 'apps'),
+    join(REPO_ROOT, 'packages'),
+    ...externalPaths,
+  ].filter((p) => existsSync(p));
+
+  const items: ConsumerPinItem[] = [];
+  for (const root of roots) {
+    for (const pkgPath of findPackageJsons(root)) {
+      const updates = computeBumpUpdates(pkgPath, latestMap);
+      if (updates.length > 0) {
+        items.push({ filePath: pkgPath, updates });
+      }
+    }
+  }
+  return items;
+}
+
+/**
+ * Pure dep-bump computation. Given a parsed package.json and a map of
+ * `name → latest-version`, returns the list of pin changes that would
+ * be applied. No I/O. Skips:
+ *   - deps not in the published map (we only manage our own).
+ *   - `workspace:*` / `workspace:^` (those are rewritten at publish
+ *     time, not at consumer-install time).
+ *   - non-npm protocol specs (`file:`, `git:`, etc. — deliberate
+ *     local pins).
+ *   - deps already at the target bare version (operator-class match,
+ *     `^1.0.0` and `1.0.0` both count as "at version 1.0.0").
+ */
+export function bumpUpdatesFor(
+  pkg: PackageJson,
+  published: Map<string, string>,
+): ConsumerPinItem['updates'] {
+  const updates: ConsumerPinItem['updates'] = [];
+  const buckets: Array<ConsumerPinItem['updates'][number]['bucket']> = [
+    'dependencies',
+    'devDependencies',
+    'peerDependencies',
+    'optionalDependencies',
+  ];
+
+  for (const bucket of buckets) {
+    const deps = pkg[bucket] as Record<string, string> | undefined;
+    if (!deps) continue;
+    for (const [name, oldSpec] of Object.entries(deps)) {
+      const newVersion = published.get(name);
+      if (!newVersion) continue;
+      if (oldSpec.startsWith('workspace:')) continue;
+      if (/^[a-z]+:/.test(oldSpec) && !oldSpec.startsWith('npm:')) continue;
+      if (bareVersion(oldSpec) === newVersion) continue;
+      const newSpec = withOperator(oldSpec, newVersion);
+      if (newSpec === oldSpec) continue;
+      updates.push({ bucket, depName: name, oldSpec, newSpec });
+    }
+  }
+  return updates;
+}
+
+/**
+ * Disk wrapper around `bumpUpdatesFor`. Reads the file, delegates,
+ * returns. Exists so the planner doesn't have to do the read itself.
+ */
+function computeBumpUpdates(
+  path: string,
+  published: Map<string, string>,
+): ConsumerPinItem['updates'] {
+  const pkg = JSON.parse(readFileSync(path, 'utf-8')) as PackageJson;
+  return bumpUpdatesFor(pkg, published);
+}
+
+// ─── Executor ──────────────────────────────────────────────────────
+
+/**
+ * Apply a consumer-pin plan. For each item, read the file, splice in
+ * the updates, write back. Preserves 2-space indent + trailing newline.
+ */
+export function executeConsumerPins(items: ConsumerPinItem[]): void {
+  if (items.length === 0) {
+    console.log('All consumer pins already at npm-latest. Nothing to do.');
+    return;
+  }
+
+  console.log('\n──────────────────────────────────────────────');
+  console.log(' Bumping consumer pins to current npm-latest');
+  console.log('──────────────────────────────────────────────');
+
+  for (const item of items) {
+    const original = readFileSync(item.filePath, 'utf-8');
+    const pkg = JSON.parse(original) as PackageJson;
+    for (const u of item.updates) {
+      const deps = pkg[u.bucket] as Record<string, string> | undefined;
+      if (deps) deps[u.depName] = u.newSpec;
+    }
+    const trailingNl = original.endsWith('\n') ? '\n' : '';
+    writeFileSync(item.filePath, JSON.stringify(pkg, null, 2) + trailingNl);
+
+    const display = relative(REPO_ROOT, item.filePath);
+    const shown = display.startsWith('..') ? item.filePath : display;
+    console.log(`✎ ${shown}`);
+    for (const u of item.updates) {
+      console.log(`  ${u.bucket}.${u.depName}: ${u.oldSpec} → ${u.newSpec}`);
+    }
+  }
+
+  console.log(`\nUpdated ${items.length} package.json file(s).`);
+  console.log('Review with `git diff` (and in external project paths) before committing.');
+  console.log('A `bun install` may be needed in each touched project to refresh its lockfile.');
+}

package/src/cli/commands/publish/execute.ts

@@ -0,0 +1,131 @@
+/**
+ * Umbrella executor — runs a `PublishPlan` top to bottom.
+ *
+ * Mirrors the phase gating in plan.ts: if a per-phase items array is
+ * empty, the corresponding execute is skipped. Workspace runs first
+ * (its result feeds Phase 3's force-pin targets); the rest follow the
+ * spec's Phase 2 → 3 → 4 ordering. After the workspace phase succeeds,
+ * the build-bus fan-out emits webhooks to any registered subscribers
+ * — best-effort, doesn't gate phases 2/3/4.
+ */
+
+import {
+  eventsForPublished,
+  fanOut,
+  formatDeliveryResult,
+  loadSubscribers,
+  recordDeliveryOutcome,
+} from '../../../services/build-bus';
+import { executeConsumerPins } from './consumer-pins';
+import { executeGlobalUpdate } from './global-install';
+import { currentGitHead } from './helpers';
+import { executeModulePublish } from './module-registry';
+import type { PublishPlan, PublishResult } from './types';
+import { executeWorkspace } from './workspace';
+
+export interface ExecutePlanInput {
+  plan: PublishPlan;
+  confirm: (question: string) => Promise<boolean>;
+}
+
+export async function executePlan(input: ExecutePlanInput): Promise<PublishResult> {
+  const { plan, confirm } = input;
+
+  // Build the workspace-versions map from the plan's items. The
+  // planner already tightened versions for alpha mode; we just need
+  // the lookup table for cross-package workspace:^ rewrites.
+  const workspaceVersions = new Map<string, string>();
+  for (const item of plan.workspace) {
+    workspaceVersions.set(item.name, item.versionToPublish);
+  }
+
+  const result = await executeWorkspace({
+    items: plan.workspace,
+    workspaceVersions,
+    mode: plan.mode,
+    confirm,
+  });
+
+  // Build-bus fan-out — fires AFTER workspace publish succeeds, BEFORE
+  // the optional follow-on phases. Best-effort: subscribers that fail
+  // delivery don't block phases 2/3/4 from running. Operator sees the
+  // outcome in the printed summary.
+  if (result.published.length > 0) {
+    await emitBuildBusEvents(result.published, plan);
+  }
+
+  if (plan.consumerPins.length > 0) {
+    executeConsumerPins(plan.consumerPins);
+  }
+
+  if (plan.globalUpdate.length > 0) {
+    executeGlobalUpdate(plan.globalUpdate);
+  }
+
+  if (plan.modulePublish.length > 0) {
+    executeModulePublish(plan.modulePublish, { allowStale: plan.options.allowStale });
+  }
+
+  return result;
+}
+
+/**
+ * Best-effort build-bus fan-out. Loads the subscriber list, builds a
+ * PublishEvent per just-published package, fires signed webhooks,
+ * prints a delivery summary. Any failure (config parse, fan-out
+ * error) is logged but doesn't crash the publish — subscribers are
+ * an opt-in cross-machine relay, not a publish prerequisite.
+ */
+async function emitBuildBusEvents(
+  published: PublishResult['published'],
+  plan: PublishPlan,
+): Promise<void> {
+  let subscribers: ReturnType<typeof loadSubscribers>;
+  try {
+    subscribers = loadSubscribers();
+  } catch (err) {
+    console.warn(
+      `\n⚠ build-bus: could not load subscriber config — ${err instanceof Error ? err.message : String(err)}`,
+    );
+    console.warn('  (skipping fan-out; publish itself is unaffected)');
+    return;
+  }
+  if (subscribers.length === 0) return;
+
+  // Mode determines the dist-tag carried on the event. Alpha + promote
+  // both publish under specific tags (alpha → @alpha, promote → @latest
+  // as a real release). Normal mode is @latest.
+  const tag: 'latest' | 'alpha' = plan.mode.kind === 'alpha' ? 'alpha' : 'latest';
+  const gitHead = currentGitHead();
+
+  const events = eventsForPublished({
+    published,
+    tag,
+    gitHead,
+    registry: 'npm',
+  });
+
+  console.log('\n──────────────────────────────────────────────');
+  console.log(' Build-bus fan-out');
+  console.log('──────────────────────────────────────────────');
+
+  for (const event of events) {
+    const results = await fanOut(event, subscribers);
+    if (results.length === 0) {
+      console.log(
+        `  ${event.package.name}@${event.package.version}: no subscribers match (registry=${event.registry}, tag=${event.tag})`,
+      );
+      continue;
+    }
+    console.log(
+      `  ${event.package.name}@${event.package.version} → ${results.length} subscriber(s):`,
+    );
+    for (const r of results) {
+      console.log(`    ${formatDeliveryResult(r)}`);
+      // Persist outcome to the local bus so `celilo subscribers
+      // status` can surface it later. Best-effort — never fails
+      // the publish flow.
+      recordDeliveryOutcome(event, r);
+    }
+  }
+}

package/src/cli/commands/publish/global-install.test.ts

@@ -0,0 +1,154 @@
+/**
+ * Global-install planner tests — covers the pure decision function
+ * that turns "what's installed globally" + "what we're publishing" +
+ * --track-alpha into a list of GlobalUpdateItems for the executor.
+ *
+ * The disk-reading wrapper (`planGlobalUpdate`) is a thin shim on top
+ * of `decideGlobalUpdates`; testing the pure layer exercises all the
+ * policy.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { decideGlobalUpdates } from './global-install';
+
+/** Helper for tests: pretend everything in the map is installed at the listed version. */
+function installedVersionFrom(versions: Record<string, string>): (name: string) => string | null {
+  return (name) => versions[name] ?? null;
+}
+
+describe('decideGlobalUpdates', () => {
+  test('empty installed → empty plan', () => {
+    expect(
+      decideGlobalUpdates({
+        installed: [],
+        justPublished: [],
+        trackAlpha: false,
+        installedVersion: () => null,
+      }),
+    ).toEqual([]);
+  });
+
+  test('normal mode: force-pins just-published, update-pulls the rest', () => {
+    const result = decideGlobalUpdates({
+      installed: ['@celilo/cli', '@celilo/e2e', '@celilo/event-bus'],
+      justPublished: [
+        { name: '@celilo/cli', version: '0.4.0' },
+        { name: '@celilo/e2e', version: '0.8.0' },
+      ],
+      trackAlpha: false,
+      installedVersion: installedVersionFrom({
+        '@celilo/cli': '0.3.0',
+        '@celilo/e2e': '0.7.0',
+        '@celilo/event-bus': '0.1.0',
+      }),
+    });
+
+    expect(result).toEqual([
+      {
+        name: '@celilo/cli',
+        installed: '0.3.0',
+        target: '0.4.0',
+        forcePin: true,
+      },
+      {
+        name: '@celilo/e2e',
+        installed: '0.7.0',
+        target: '0.8.0',
+        forcePin: true,
+      },
+      {
+        name: '@celilo/event-bus',
+        installed: '0.1.0',
+        target: '0.1.0',
+        forcePin: false,
+      },
+    ]);
+  });
+
+  test('--track-alpha filters to just-published only', () => {
+    const result = decideGlobalUpdates({
+      installed: ['@celilo/cli', '@celilo/e2e', '@celilo/event-bus'],
+      justPublished: [{ name: '@celilo/e2e', version: '0.8.0-alpha.0' }],
+      trackAlpha: true,
+      installedVersion: installedVersionFrom({
+        '@celilo/cli': '0.3.0',
+        '@celilo/e2e': '0.7.0',
+        '@celilo/event-bus': '0.1.0',
+      }),
+    });
+
+    // Other globals (@celilo/cli, @celilo/event-bus) are left alone —
+    // they may already be on their own alpha streams.
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({
+      name: '@celilo/e2e',
+      installed: '0.7.0',
+      target: '0.8.0-alpha.0',
+      forcePin: true,
+    });
+  });
+
+  test('--track-alpha + nothing-just-published → empty plan', () => {
+    expect(
+      decideGlobalUpdates({
+        installed: ['@celilo/cli', '@celilo/e2e'],
+        justPublished: [],
+        trackAlpha: true,
+        installedVersion: installedVersionFrom({
+          '@celilo/cli': '0.3.0',
+          '@celilo/e2e': '0.7.0',
+        }),
+      }),
+    ).toEqual([]);
+  });
+
+  test('handles missing installed version gracefully (target falls back to "?")', () => {
+    const result = decideGlobalUpdates({
+      installed: ['@celilo/cli'],
+      justPublished: [],
+      trackAlpha: false,
+      installedVersion: () => null, // bun symlink missing, malformed pkg, etc.
+    });
+
+    expect(result).toEqual([
+      {
+        name: '@celilo/cli',
+        installed: null,
+        target: '?',
+        forcePin: false,
+      },
+    ]);
+  });
+
+  test('preserves installed order', () => {
+    const result = decideGlobalUpdates({
+      installed: ['@celilo/event-bus', '@celilo/cli', '@celilo/e2e'],
+      justPublished: [],
+      trackAlpha: false,
+      installedVersion: installedVersionFrom({
+        '@celilo/event-bus': '0.1.0',
+        '@celilo/cli': '0.3.0',
+        '@celilo/e2e': '0.7.0',
+      }),
+    });
+
+    expect(result.map((i) => i.name)).toEqual(['@celilo/event-bus', '@celilo/cli', '@celilo/e2e']);
+  });
+
+  test('just-published packages NOT in installed are not added (only refreshes existing globals)', () => {
+    // Operator hasn't installed @celilo/cli globally, but the publish
+    // run shipped it. We don't auto-install — we only refresh what's
+    // already there. So @celilo/cli should NOT appear in the plan.
+    const result = decideGlobalUpdates({
+      installed: ['@celilo/e2e'],
+      justPublished: [
+        { name: '@celilo/cli', version: '0.4.0' },
+        { name: '@celilo/e2e', version: '0.8.0' },
+      ],
+      trackAlpha: false,
+      installedVersion: installedVersionFrom({ '@celilo/e2e': '0.7.0' }),
+    });
+
+    expect(result.map((i) => i.name)).toEqual(['@celilo/e2e']);
+  });
+});