@dbx-tools/projen 0.9.32 → 0.9.37

package/tasks/publish-npm.ts

@@ -1,367 +1,6 @@
 #!/usr/bin/env -S bun
-/** Idempotent npm archive publication for release recovery. */
-import { createHash } from "node:crypto";
-import {
-  chmodSync,
-  lstatSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  readlinkSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join, relative, resolve } from "node:path";
-import * as exec from "@dbx-tools/core/exec";
-import { log } from "@dbx-tools/shared-core";
-import { Command } from "commander";
-import { runTaskCommand } from "../src/_task-command.ts";
+import { main } from "./lib/publish-npm.ts";
 
-const DEFAULT_REGISTRY = "https://registry.npmjs.org";
-const logger = log.logger("projen:publish-npm");
+export * from "./lib/publish-npm.ts";
 
-export interface NpmReleaseIdentity {
-  readonly access?: "public" | "restricted";
-  readonly contentDigest?: string;
-  readonly integrity?: string;
-  readonly name: string;
-  readonly repository?: unknown;
-  readonly version: string;
-}
-
-interface NpmArchiveManifest {
-  readonly [key: string]: unknown;
-  readonly dependencies?: Readonly<Record<string, string>>;
-  readonly optionalDependencies?: Readonly<Record<string, string>>;
-  readonly name?: string;
-  readonly publishConfig?: { readonly access?: unknown };
-  readonly repository?: unknown;
-  readonly version?: string;
-}
-
-export type NpmArchiveManifestTransform = (
-  manifest: NpmArchiveManifest,
-) => Readonly<Record<string, unknown>>;
-
-function archiveFileEntries(directory: string, prefix = ""): string[] {
-  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
-    const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
-    return entry.isDirectory()
-      ? archiveFileEntries(join(directory, entry.name), relativePath)
-      : [relativePath];
-  });
-}
-
-function normalizedRepository(value: unknown): string | undefined {
-  const url =
-    typeof value === "string"
-      ? value
-      : value && typeof value === "object" && "url" in value
-        ? String(value.url)
-        : undefined;
-  return url
-    ?.replace(/^git\+/, "")
-    .replace(/\.git$/, "")
-    .replace(/\/$/, "");
-}
-
-function registryUrl(registry: string, name: string, version: string): string {
-  return `${registry.replace(/\/$/, "")}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
-}
-
-export function npmReleaseMatches(
-  local: NpmReleaseIdentity,
-  published: NpmReleaseIdentity | undefined,
-): boolean {
-  if (!published) return false;
-  if (published.name !== local.name || published.version !== local.version) {
-    throw new Error(`Published npm identity does not match ${local.name}@${local.version}`);
-  }
-  const localRepository = normalizedRepository(local.repository);
-  const publishedRepository = normalizedRepository(published.repository);
-  if (localRepository && publishedRepository && localRepository !== publishedRepository) {
-    throw new Error(`Published npm repository does not match ${local.name}@${local.version}`);
-  }
-  if (
-    local.contentDigest &&
-    published.contentDigest &&
-    local.contentDigest !== published.contentDigest
-  ) {
-    throw new Error(`Published npm content does not match ${local.name}@${local.version}`);
-  }
-  if (
-    !(local.contentDigest && published.contentDigest) &&
-    local.integrity &&
-    published.integrity !== local.integrity
-  ) {
-    throw new Error(`Published npm integrity does not match ${local.name}@${local.version}`);
-  }
-  return true;
-}
-
-export async function publishedNpmRelease(
-  name: string,
-  version: string,
-  registry = process.env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY,
-): Promise<NpmReleaseIdentity | undefined> {
-  const response = await fetch(registryUrl(registry, name, version), {
-    headers: { accept: "application/json" },
-  });
-  if (response.status === 404) return undefined;
-  if (!response.ok) {
-    throw new Error(`npm registry lookup failed for ${name}@${version}: ${response.status}`);
-  }
-  const metadata = (await response.json()) as {
-    dist?: { integrity?: string; tarball?: string };
-    name?: string;
-    repository?: unknown;
-    version?: string;
-  };
-  if (!metadata.name || !metadata.version) {
-    throw new Error(`npm registry returned an incomplete identity for ${name}@${version}`);
-  }
-  let contentDigest: string | undefined;
-  if (metadata.dist?.tarball) {
-    const archive = await fetch(metadata.dist.tarball);
-    if (!archive.ok) {
-      throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
-    }
-    const temp = mkdtempSync(join(tmpdir(), "projen-published-npm-"));
-    const path = join(temp, "package.tgz");
-    try {
-      writeFileSync(path, Buffer.from(await archive.arrayBuffer()));
-      contentDigest = npmArchiveContentDigest(path);
-    } finally {
-      rmSync(temp, { recursive: true, force: true });
-    }
-  }
-  return {
-    ...(contentDigest ? { contentDigest } : {}),
-    integrity: metadata.dist?.integrity,
-    name: metadata.name,
-    repository: metadata.repository,
-    version: metadata.version,
-  };
-}
-
-function readNpmArchiveManifest(path: string): NpmArchiveManifest {
-  const result = exec.spawnSync("tar", ["-xOf", path, "package/package.json"], {
-    cwd: process.cwd(),
-    stdout: "capture",
-    stderr: "capture",
-    stdin: "ignore",
-    check: false,
-  });
-  if (result.exitCode !== 0 || !result.stdout) {
-    throw new Error(`Cannot read npm package manifest from ${path}: ${result.stderr}`);
-  }
-  return JSON.parse(result.stdout) as NpmArchiveManifest;
-}
-
-export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
-  const manifest = readNpmArchiveManifest(path);
-  if (!manifest.name || !manifest.version) {
-    throw new Error(`npm archive has no package name or version: ${path}`);
-  }
-  const access = manifest.publishConfig?.access;
-  if (access !== undefined && access !== "public" && access !== "restricted") {
-    throw new Error(`npm archive has invalid publishConfig.access: ${String(access)}`);
-  }
-  return {
-    ...(access ? { access } : {}),
-    contentDigest: npmArchiveContentDigest(path),
-    integrity: `sha512-${createHash("sha512").update(readFileSync(path)).digest("base64")}`,
-    name: manifest.name,
-    repository: manifest.repository,
-    version: manifest.version,
-  };
-}
-
-function orderNpmArchives(archives: readonly string[]): string[] {
-  const byName = new Map(
-    archives.map((archive) => {
-      const manifest = readNpmArchiveManifest(archive);
-      if (!manifest.name) throw new Error(`npm archive has no package name: ${archive}`);
-      return [manifest.name, { archive, manifest }] as const;
-    }),
-  );
-  if (byName.size !== archives.length) throw new Error("Release contains duplicate npm packages");
-  const remaining = new Map(
-    [...byName].map(([name, value]) => [
-      name,
-      new Set(
-        [
-          ...Object.keys(value.manifest.dependencies ?? {}),
-          ...Object.keys(value.manifest.optionalDependencies ?? {}),
-        ].filter((dependency) => byName.has(dependency)),
-      ),
-    ]),
-  );
-  const ordered: string[] = [];
-  while (remaining.size > 0) {
-    const ready = [...remaining]
-      .filter(([, dependencies]) => dependencies.size === 0)
-      .map(([name]) => name)
-      .sort();
-    if (ready.length === 0) {
-      throw new Error(
-        `Cyclic npm release dependencies: ${[...remaining.keys()].sort().join(", ")}`,
-      );
-    }
-    for (const name of ready) {
-      ordered.push(byName.get(name)!.archive);
-      remaining.delete(name);
-    }
-    for (const dependencies of remaining.values()) {
-      for (const name of ready) dependencies.delete(name);
-    }
-  }
-  return ordered;
-}
-
-/** Hash paths, executable bits, symlink targets, and bytes while ignoring tar metadata. */
-export function npmArchiveContentDigest(path: string): string {
-  const temp = mkdtempSync(join(tmpdir(), "projen-npm-content-"));
-  try {
-    exec.spawnSync("tar", ["-xzf", path, "-C", temp], {
-      cwd: process.cwd(),
-      stdout: "ignore",
-      stderr: "capture",
-      stdin: "ignore",
-      check: true,
-    });
-    const hash = createHash("sha512");
-    const visit = (directory: string): void => {
-      for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) =>
-        a.name.localeCompare(b.name),
-      )) {
-        const entryPath = join(directory, entry.name);
-        const name = relative(temp, entryPath).split("\\").join("/");
-        const stat = lstatSync(entryPath);
-        hash.update(`${entry.isDirectory() ? "D" : entry.isSymbolicLink() ? "L" : "F"}\0`);
-        hash.update(`${name}\0${stat.mode & 0o111}\0`);
-        if (entry.isDirectory()) visit(entryPath);
-        else if (entry.isSymbolicLink()) hash.update(readlinkSync(entryPath));
-        else hash.update(readFileSync(entryPath));
-      }
-    };
-    visit(temp);
-    return `sha512-${hash.digest("base64")}`;
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-}
-
-export function packNpmPackage(
-  directory: string,
-  destination: string,
-  path = process.env.PATH ?? "",
-  transformManifest?: NpmArchiveManifestTransform,
-): string {
-  const executable = process.versions.bun ? process.execPath : "bun";
-  const manifest = join(directory, "package.json");
-  const manifestMode = lstatSync(manifest).mode & 0o777;
-  const restoreManifestMode = (manifestMode & 0o200) === 0;
-  if (restoreManifestMode) chmodSync(manifest, manifestMode | 0o200);
-  try {
-    exec.spawnSync(
-      executable,
-      ["pm", "pack", "--destination", destination, "--ignore-scripts", "--quiet"],
-      {
-        cwd: directory,
-        env: { ...process.env, PATH: path },
-        stdout: "inherit",
-        stderr: "inherit",
-        stdin: "ignore",
-        check: true,
-      },
-    );
-  } finally {
-    if (restoreManifestMode) chmodSync(manifest, manifestMode);
-  }
-  const archives = readdirSync(destination).filter((file) => file.endsWith(".tgz"));
-  if (archives.length !== 1) {
-    throw new Error(`Expected one packed npm archive, found ${archives.length}`);
-  }
-  const archive = join(destination, archives[0]);
-  if (!transformManifest) return archive;
-
-  const temp = mkdtempSync(join(tmpdir(), "projen-npm-project-"));
-  try {
-    exec.spawnSync("tar", ["-xzf", archive, "-C", temp], {
-      cwd: process.cwd(),
-      stdout: "ignore",
-      stderr: "inherit",
-      stdin: "ignore",
-      check: true,
-    });
-    const manifestPath = join(temp, "package", "package.json");
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as NpmArchiveManifest;
-    writeFileSync(manifestPath, `${JSON.stringify(transformManifest(manifest), null, 2)}\n`);
-    rmSync(archive, { force: true });
-    exec.spawnSync("tar", ["-czf", archive, "-C", temp, ...archiveFileEntries(temp)], {
-      cwd: process.cwd(),
-      stdout: "ignore",
-      stderr: "inherit",
-      stdin: "ignore",
-      check: true,
-    });
-    return archive;
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-}
-
-export async function publishNpmArchives(options: {
-  readonly directory: string;
-  readonly dryRun?: boolean;
-  readonly registry?: string;
-  readonly version?: string;
-}): Promise<void> {
-  const directory = resolve(options.directory);
-  const archives = orderNpmArchives(
-    readdirSync(directory)
-      .filter((file) => file.endsWith(".tgz"))
-      .sort()
-      .map((file) => join(directory, file)),
-  );
-  if (archives.length === 0) throw new Error(`No npm archives found in ${directory}`);
-
-  for (const archive of archives) {
-    const local = readNpmArchiveIdentity(archive);
-    if (options.version && local.version !== options.version) {
-      throw new Error(
-        `npm archive ${archive} carries ${local.version}, expected ${options.version}`,
-      );
-    }
-    if (!options.dryRun) {
-      const published = await publishedNpmRelease(local.name, local.version, options.registry);
-      if (npmReleaseMatches(local, published)) {
-        logger.info(`skip published ${local.name}@${local.version}`);
-        continue;
-      }
-    }
-    runTaskCommand(process.cwd(), "npm", [
-      "publish",
-      archive,
-      ...(local.access ? ["--access", local.access] : []),
-      ...(options.registry ? ["--registry", options.registry] : []),
-      ...(options.dryRun ? ["--dry-run"] : []),
-    ]);
-  }
-}
-
-if (import.meta.main) {
-  const program = new Command();
-  program
-    .requiredOption("--directory <path>", "Directory containing npm archives")
-    .option("--version <version>", "Expected npm release version")
-    .option("--registry <url>", "npm registry URL")
-    .option("--dry-run", "Validate archives without publishing")
-    .action(
-      (options: { directory: string; dryRun?: boolean; registry?: string; version?: string }) =>
-        publishNpmArchives(options),
-    );
-  await program.parseAsync();
-}
+if (import.meta.main) await main();

package/tasks/publish-python.ts

@@ -1,187 +1,6 @@
 #!/usr/bin/env -S bun
-import {
-  chmodSync,
-  cpSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, dirname, join, resolve } from "node:path";
-import { Command } from "commander";
-import { parse, stringify } from "smol-toml";
-import { preparePythonProjectForPublication, pythonProjectInfo } from "./python-release.ts";
-import { runTaskCommand } from "../src/_task-command.ts";
+import { main } from "./lib/publish-python.ts";
 
-interface PythonProjectFile {
-  readonly directory: string;
-  readonly name: string;
-  readonly version: string;
-  readonly path: string;
-  readonly private: boolean;
-  readonly source: string;
-}
+export * from "./lib/publish-python.ts";
 
-/** Python wheel and source archives accepted by Twine and package indexes. */
-export function pythonDistributionPaths(directory: string): string[] {
-  return readdirSync(directory)
-    .filter((file) => file.endsWith(".whl") || file.endsWith(".tar.gz"))
-    .sort()
-    .map((file) => join(directory, file));
-}
-
-function pythonProjects(root: string): PythonProjectFile[] {
-  const packageFiles = readdirSync(root, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .map((entry) => resolve(root, entry.name, "pyproject.toml"))
-    .filter(existsSync)
-    .sort();
-  const allProjects: PythonProjectFile[] = packageFiles.map((path) => {
-    const source = readFileSync(path, "utf8");
-    const info = pythonProjectInfo(source, { parse });
-    return {
-      directory: basename(resolve(path, "..")),
-      name: info.name,
-      version: info.version,
-      path,
-      private: info.private,
-      source,
-    };
-  });
-  return allProjects;
-}
-
-export function publishPythonProjects(options: {
-  readonly dryRun?: boolean;
-  readonly indexUrl: string;
-  readonly publishUrl: string;
-  readonly root: string;
-  readonly version: string;
-}): void {
-  const output = mkdtempSync(join(tmpdir(), "projen-python-publish-"));
-  try {
-    buildPythonProjects({ ...options, output });
-    runTaskCommand(
-      process.cwd(),
-      "uvx",
-      [
-        "--from",
-        "devpi-client",
-        "devpi",
-        "upload",
-        "--index",
-        options.publishUrl,
-        "--from-dir",
-        ...(options.dryRun ? ["--dry-run"] : []),
-        output,
-      ],
-      { env: { ...process.env, UV_DEFAULT_INDEX: options.indexUrl } },
-    );
-  } finally {
-    rmSync(output, { recursive: true, force: true });
-  }
-}
-
-/** Build the exact Python release distributions without publishing them. */
-export function buildPythonProjects(options: {
-  readonly allowEmpty?: boolean;
-  readonly output: string;
-  readonly packages?: readonly string[];
-  readonly root: string;
-  readonly version: string;
-}): void {
-  const root = resolve(options.root);
-  const output = resolve(options.output);
-  rmSync(output, { recursive: true, force: true });
-  const allProjects = pythonProjects(root);
-  const requested = new Set(options.packages ?? []);
-  const missing = [...requested].filter(
-    (directory) => !allProjects.some((project) => project.directory === directory),
-  );
-  if (missing.length > 0) throw new Error(`Unknown Python packages: ${missing.join(", ")}`);
-  const projects = allProjects.filter(
-    (project) => !project.private && (requested.size === 0 || requested.has(project.directory)),
-  );
-  if (projects.length === 0 && options.allowEmpty) {
-    mkdirSync(output, { recursive: true });
-    return;
-  }
-  if (projects.length === 0) throw new Error(`No Python packages found under ${root}`);
-
-  const temporaryRoot = mkdtempSync(join(tmpdir(), "projen-python-release-"));
-  try {
-    mkdirSync(output, { recursive: true });
-    for (const project of projects) {
-      const packageRoot = join(temporaryRoot, project.directory);
-      cpSync(dirname(project.path), packageRoot, { recursive: true });
-      const manifestPath = join(packageRoot, "pyproject.toml");
-      chmodSync(manifestPath, 0o644);
-      writeFileSync(
-        manifestPath,
-        preparePythonProjectForPublication(project.source, {
-          packages: allProjects,
-          toml: { parse, stringify },
-          version: options.version,
-        }),
-      );
-      runTaskCommand(root, "uv", ["build", "--out-dir", output, packageRoot]);
-    }
-    const distributions = pythonDistributionPaths(output);
-    if (distributions.length === 0) {
-      throw new Error(`No Python distributions found in ${output}`);
-    }
-    runTaskCommand(process.cwd(), "uvx", ["twine", "check", ...distributions]);
-  } finally {
-    rmSync(temporaryRoot, { recursive: true, force: true });
-  }
-}
-
-if (import.meta.main) {
-  const program = new Command();
-  program
-    .argument("<version>", "Python package version")
-    .option("--index-url <url>", "devpi Simple API URL")
-    .option("--publish-url <url>", "devpi writable index URL")
-    .option("--root <path>", "Python workspace package root", "packages/py")
-    .option("--package <directory...>", "Build only selected package directories")
-    .option("--output <path>", "Build distributions into a directory without publishing")
-    .option("--dry-run", "build and inspect distributions without uploading")
-    .action(
-      (
-        version: string,
-        options: {
-          dryRun?: boolean;
-          indexUrl?: string;
-          package?: string[];
-          publishUrl?: string;
-          root: string;
-          output?: string;
-        },
-      ) => {
-        if (options.output) {
-          buildPythonProjects({
-            output: options.output,
-            packages: options.package,
-            root: options.root,
-            version,
-          });
-        } else {
-          if (!options.indexUrl || !options.publishUrl) {
-            throw new Error("--index-url and --publish-url are required when publishing");
-          }
-          publishPythonProjects({
-            dryRun: options.dryRun,
-            indexUrl: options.indexUrl,
-            publishUrl: options.publishUrl,
-            root: options.root,
-            version,
-          });
-        }
-      },
-    );
-  await program.parseAsync();
-}
+if (import.meta.main) await main();