@decohere/ci-tools 0.0.1-dev.9 → 0.0.1-dev.90

package/src/github/publish-verify.mjs

@@ -0,0 +1,209 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/**
+ * Workspace packages that `forge publish` will upload (not `"private": true`).
+ * @param {string} root
+ */
+export function listPublishablePackages(root) {
+	const projectsDir = join(root, "projects");
+	const packages = [];
+	for (const dir of readdirSync(projectsDir)) {
+		const pkgPath = join(projectsDir, dir, "package.json");
+		if (!existsSync(pkgPath)) {
+			continue;
+		}
+		const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+		if (typeof pkg.name !== "string" || pkg.private === true) {
+			continue;
+		}
+		packages.push({
+			name: pkg.name,
+			version: pkg.version,
+			dir,
+		});
+	}
+	return packages.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export function dockerRepositories(root) {
+	const create = JSON.parse(readFileSync(join(root, "projects/create/package.json"), "utf8"));
+	const devcontainer = JSON.parse(
+		readFileSync(join(root, "projects/devcontainer/package.json"), "utf8"),
+	);
+	return {
+		create: create.decohere?.dockerImageRepository ?? "ghcr.io/typesmiths/decohere/create",
+		devcontainer:
+			devcontainer.decohere?.dockerImageRepository ??
+			"ghcr.io/typesmiths/decohere/devcontainer",
+		createVersion: create.version,
+		workspaceVersion: JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version,
+	};
+}
+
+/**
+ * @param {string} spec package or package@version
+ * @param {{ spawnSync?: typeof spawnSync }} [io]
+ */
+export function npmNameExists(spec, io = {}) {
+	const spawn = io.spawnSync ?? spawnSync;
+	const result = spawn("npm", ["view", spec, "name"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+	});
+	return result.status === 0;
+}
+
+/**
+ * @param {string} spec package@version
+ * @param {{ spawnSync?: typeof spawnSync }} [io]
+ */
+export function npmVersionExists(spec, io = {}) {
+	const spawn = io.spawnSync ?? spawnSync;
+	const result = spawn("npm", ["view", spec, "version"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+	});
+	return result.status === 0;
+}
+
+/**
+ * Parse `ghcr.io/org/name/image` into GitHub packages API coordinates.
+ * @param {string} repository
+ */
+export function parseGhcrRepository(repository) {
+	const withoutHost = repository.replace(/^ghcr\.io\//, "");
+	const slash = withoutHost.indexOf("/");
+	if (slash < 0) {
+		throw new Error(`Not a GHCR repository: ${repository}`);
+	}
+	return {
+		org: withoutHost.slice(0, slash),
+		packageName: withoutHost.slice(slash + 1),
+	};
+}
+
+/**
+ * @param {string} repository ghcr.io/org/pkg
+ * @param {string} tag
+ * @param {{ token: string, fetch?: typeof fetch }} io
+ */
+export async function ghcrTagExists(repository, tag, io) {
+	const { org, packageName } = parseGhcrRepository(repository);
+	const encoded = encodeURIComponent(packageName);
+	const headers = {
+		Authorization: `Bearer ${io.token}`,
+		Accept: "application/vnd.github+json",
+		"X-GitHub-Api-Version": "2022-11-28",
+	};
+	const fetchImpl = io.fetch ?? fetch;
+	for (let page = 1; page <= 20; page += 1) {
+		const url = `https://api.github.com/orgs/${org}/packages/container/${encoded}/versions?per_page=100&page=${page}`;
+		const response = await fetchImpl(url, { headers });
+		if (response.status === 404) {
+			return false;
+		}
+		if (!response.ok) {
+			throw new Error(`GHCR versions ${response.status} for ${repository}`);
+		}
+		const versions = await response.json();
+		if (!Array.isArray(versions) || versions.length === 0) {
+			return false;
+		}
+		for (const version of versions) {
+			const tags = version.metadata?.container?.tags ?? [];
+			if (tags.includes(tag)) {
+				return true;
+			}
+		}
+		if (versions.length < 100) {
+			return false;
+		}
+	}
+	return false;
+}
+
+/**
+ * @param {{
+ *   root: string,
+ *   spawnSync?: typeof spawnSync,
+ *   fetch?: typeof fetch,
+ *   githubToken?: string,
+ * }} options
+ */
+export async function collectPublishVerify(options) {
+	const packages = listPublishablePackages(options.root);
+	const unpublished = [];
+	let publishedVersions = 0;
+	for (const pkg of packages) {
+		if (!npmNameExists(pkg.name, options)) {
+			unpublished.push(pkg.name);
+			continue;
+		}
+		if (npmVersionExists(`${pkg.name}@${pkg.version}`, options)) {
+			publishedVersions += 1;
+		}
+	}
+
+	const images = dockerRepositories(options.root);
+	const token = options.githubToken ?? "";
+	let skipDocker = false;
+	if (token) {
+		const createExists = await ghcrTagExists(images.create, images.workspaceVersion, {
+			token,
+			fetch: options.fetch,
+		});
+		const devExists = await ghcrTagExists(images.devcontainer, images.workspaceVersion, {
+			token,
+			fetch: options.fetch,
+		});
+		skipDocker = createExists && devExists;
+	}
+
+	return {
+		unpublished,
+		skipNpm: packages.length > 0 && publishedVersions === packages.length,
+		skipDocker,
+		imageTag: images.workspaceVersion,
+		createVersion: images.createVersion,
+		repository: images.create,
+		devcontainerRepository: images.devcontainer,
+		packageCount: packages.length,
+		publishedVersions,
+	};
+}
+
+export function formatGithubOutput(result) {
+	return [
+		`unpublished=${result.unpublished.join(" ")}`,
+		`skip_npm=${result.skipNpm ? "true" : "false"}`,
+		`skip_docker=${result.skipDocker ? "true" : "false"}`,
+		`image_tag=${result.imageTag}`,
+		`create_version=${result.createVersion}`,
+		`repository=${result.repository}`,
+		`devcontainer_repository=${result.devcontainerRepository}`,
+	].join("\n");
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	const result = await collectPublishVerify({
+		root: process.cwd(),
+		githubToken: process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN,
+	});
+	const body = formatGithubOutput(result);
+	process.stdout.write(`${body}\n`);
+	if (process.env.GITHUB_OUTPUT) {
+		const { appendFileSync } = await import("node:fs");
+		appendFileSync(process.env.GITHUB_OUTPUT, `${body}\n`);
+	}
+	if (result.unpublished.length) {
+		process.stderr.write(
+			`Never-published packages (bootstrap OIDC before PUT): ${result.unpublished.join(", ")}\n`,
+		);
+	}
+}

package/src/github/smoke-create-launcher.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/**
+ * Run `npx @decohere/create@version --help` from an empty temp directory.
+ * Must not use the repo cwd — after `@decohere/cli` is pinned, pnpm installs
+ * `@decohere/create` into the workspace tree and npm's npx misses the bin.
+ *
+ * @param {{
+ *   createVersion: string,
+ *   authToken: string,
+ *   mkdtempSync?: typeof mkdtempSync,
+ *   writeFileSync?: typeof writeFileSync,
+ *   spawnSync?: typeof spawnSync,
+ *   tmpdir?: () => string,
+ *   stdio?: import("node:child_process").StdioOptions,
+ * }} options
+ */
+export function runCreateLauncherSmoke(options) {
+	const version = options.createVersion?.trim() ?? "";
+	const token = options.authToken?.trim() ?? "";
+	if (!version) {
+		throw new Error("CREATE_VERSION is required");
+	}
+	if (!token) {
+		throw new Error("NODE_AUTH_TOKEN is required");
+	}
+
+	const mkdtemp = options.mkdtempSync ?? mkdtempSync;
+	const writeFile = options.writeFileSync ?? writeFileSync;
+	const spawn = options.spawnSync ?? spawnSync;
+	const tmp = options.tmpdir ?? tmpdir;
+
+	const workDir = mkdtemp(join(tmp(), "decohere-create-smoke-"));
+	const npmrc = join(workDir, ".npmrc");
+	writeFile(
+		npmrc,
+		`@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`,
+	);
+
+	const result = spawn("npx", ["--yes", `@decohere/create@${version}`, "--help"], {
+		cwd: workDir,
+		env: {
+			...process.env,
+			NPM_CONFIG_USERCONFIG: npmrc,
+			NODE_AUTH_TOKEN: token,
+		},
+		stdio: options.stdio ?? "inherit",
+	});
+
+	return {
+		workDir,
+		status: result.status ?? 1,
+	};
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	const { status } = runCreateLauncherSmoke({
+		createVersion: process.env.CREATE_VERSION ?? "",
+		authToken: process.env.NODE_AUTH_TOKEN ?? "",
+	});
+	process.exit(status);
+}

package/src/release/sync-dependencies.mjs

@@ -7,10 +7,9 @@
 import { execSync } from "node:child_process";
 
 const DRY_RUN = process.env.DRY_RUN === "true";
-const TERMINAL_CLI = process.env.TERMINAL_CLI || "dist/debug/projects/terminal/src/cli.js";
 const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
 
-const baseCmd = `node "${TERMINAL_CLI}" --log-level trace --config-file "${DECOHERE_CONFIG}" forge dependencies --configuration release sync`;
+const baseCmd = `pnpm forge --log-level info --config-file "${DECOHERE_CONFIG}" dependencies --configuration release sync`;
 
 try {
 	if (DRY_RUN) {

package/tests/audit/format.test.mjs

@@ -0,0 +1,115 @@
+import { describe, expect, it } from "vitest";
+import {
+	formatLog,
+	formatMarkdown,
+	highCritical,
+	parseAudit,
+} from "../../src/audit/format.mjs";
+
+const fixture = {
+	metadata: {
+		vulnerabilities: { info: 0, low: 1, moderate: 0, high: 1, critical: 0, total: 2 },
+	},
+	advisories: {
+		1: {
+			id: 1,
+			module_name: "nanoid",
+			severity: "high",
+			title: "nanoid: custom generators can loop indefinitely when size is zero",
+			url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+			vulnerable_versions: "<3.3.18",
+			patched_versions: ">=3.3.18",
+			cves: [],
+			findings: [{ version: "3.3.17", paths: [". > vite > postcss > nanoid@3.3.17"] }],
+		},
+		2: {
+			id: 2,
+			module_name: "esbuild",
+			severity: "low",
+			title: "esbuild Windows file read",
+			url: "https://github.com/advisories/GHSA-g7r4-m6w7-qqqr",
+			vulnerable_versions: "<0.28.1",
+			patched_versions: ">=0.28.1",
+			cves: [],
+			findings: [{ version: "0.27.3", paths: [". > vite > esbuild"] }],
+		},
+	},
+};
+
+describe("parseAudit", () => {
+	it("reads severity counts and sorts advisories critical/high first", () => {
+		const parsed = parseAudit(fixture);
+		expect(parsed.total).toBe(2);
+		expect(parsed.high).toBe(1);
+		expect(parsed.low).toBe(1);
+		expect(parsed.advisories.map((a) => a.module)).toEqual(["nanoid", "esbuild"]);
+		expect(parsed.advisories[0]?.severity).toBe("high");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("formatLog", () => {
+	it("prints severity counts and advisory lines including GHSA", () => {
+		const log = formatLog(parseAudit(fixture));
+		expect(log).toContain("high=1");
+		expect(log).toContain("[high] nanoid GHSA-2v37-7h3g-55p8");
+		expect(log).toContain("[low] esbuild");
+	});
+});
+
+describe("formatMarkdown", () => {
+	it("includes a severity table and linked advisories", () => {
+		const md = formatMarkdown(parseAudit(fixture));
+		expect(md).toContain("| High | 1 |");
+		expect(md).toContain("**high** `nanoid`");
+		expect(md).toContain("GHSA-2v37-7h3g-55p8");
+	});
+});
+
+describe("highCritical", () => {
+	it("filters to high and critical only", () => {
+		expect(highCritical(parseAudit(fixture)).map((a) => a.module)).toEqual(["nanoid"]);
+	});
+});
+
+describe("parseAudit npm v2", () => {
+	it("dedupes GHSA rows from package via objects", () => {
+		const v2 = {
+			auditReportVersion: 2,
+			metadata: {
+				vulnerabilities: { info: 0, low: 0, moderate: 0, high: 1, critical: 0, total: 1 },
+			},
+			vulnerabilities: {
+				nanoid: {
+					name: "nanoid",
+					severity: "high",
+					via: [
+						{
+							source: 1103848,
+							name: "nanoid",
+							title: "nanoid infinite loop",
+							url: "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
+							severity: "high",
+							range: "<3.3.18",
+						},
+					],
+					range: "<3.3.18",
+					nodes: ["node_modules/.pnpm/nanoid@3.3.17/node_modules/nanoid"],
+				},
+				postcss: {
+					name: "postcss",
+					severity: "high",
+					via: ["nanoid"],
+					effects: [],
+					range: "*",
+					nodes: ["node_modules/.pnpm/postcss@8.5.26/node_modules/postcss"],
+				},
+			},
+		};
+		const parsed = parseAudit(v2);
+		expect(parsed.advisories).toHaveLength(1);
+		expect(parsed.advisories[0]?.module).toBe("nanoid");
+		expect(parsed.advisories[0]?.ghsa).toBe("GHSA-2v37-7h3g-55p8");
+		expect(parsed.advisories[0]?.vulnerable).toBe("<3.3.18");
+	});
+});

package/tests/github/credential-nudge.test.mjs

@@ -0,0 +1,65 @@
+import { describe, expect, it } from "vitest";
+import {
+	assessTokenLifetime,
+	buildDescription,
+	CREDENTIALS,
+	credentialProfile,
+	ghScopeFlags,
+	parseExpiresAt,
+	rotationCommands,
+	suggestedNextExpiry,
+	taskName,
+} from "../../src/github/credential-nudge.mjs";
+
+describe("credential-nudge", () => {
+	it("parses YYYY-MM-DD as a UTC day", () => {
+		expect(parseExpiresAt("2026-11-19")).toBe(Date.UTC(2026, 10, 19));
+		expect(parseExpiresAt("")).toBeNull();
+	});
+
+	it("is ok more than 14 days out, warns inside the window, expires on the day", () => {
+		const expiresAtMs = Date.UTC(2026, 10, 19);
+		const now = (day) => Date.UTC(2026, 10, day, 15);
+		expect(assessTokenLifetime({ now: now(1), expiresAtMs }).kind).toBe("ok");
+		expect(assessTokenLifetime({ now: now(5), expiresAtMs })).toEqual({
+			kind: "warn",
+			daysLeft: 14,
+		});
+		expect(assessTokenLifetime({ now: now(18), expiresAtMs }).kind).toBe("warn");
+		expect(assessTokenLifetime({ now: now(19), expiresAtMs })).toEqual({
+			kind: "expired",
+			daysLeft: 0,
+		});
+		expect(assessTokenLifetime({ now: now(20), expiresAtMs }).kind).toBe("expired");
+		expect(assessTokenLifetime({ expiresAtMs: null }).kind).toBe("missing");
+	});
+
+	it("parameterizes GHCR vs npm rotate commands without duplicating date logic", () => {
+		const ghcr = credentialProfile("ghcr");
+		const npm = credentialProfile("npm");
+		expect(ghScopeFlags(ghcr)).toBe("--env ghcr-publish ");
+		expect(ghScopeFlags(npm)).toBe("");
+		expect(rotationCommands(ghcr, "2027-02-17", "typesmiths/decohere")).toContain(
+			"gh secret set GHCR_PUSH_TOKEN --env ghcr-publish --repo typesmiths/decohere",
+		);
+		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
+			"gh secret set NODE_AUTH_TOKEN --repo typesmiths/decohere",
+		);
+		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
+			"gh variable set NODE_AUTH_TOKEN_EXPIRES_AT --repo typesmiths/decohere --body 2027-02-17",
+		);
+		expect(taskName(npm, "2026-11-19")).toBe(
+			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
+		);
+		const body = buildDescription(ghcr, {
+			kind: "warn",
+			expiresYmd: "2026-11-19",
+			daysLeft: 14,
+			rejected: false,
+		});
+		expect(body).toContain("Docker login/push and the `v*` tag will **fail**");
+		expect(CREDENTIALS.npm.secret).toBe("NODE_AUTH_TOKEN");
+		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
+		expect(() => credentialProfile("nope")).toThrow(/Unknown NUDGE_CREDENTIAL/);
+	});
+});

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -0,0 +1,104 @@
+import { describe, expect, it } from "vitest";
+import {
+	bootstrapTaskNames,
+	buildDescription,
+	extractGitHubReviewerLogins,
+	firstPublishCommands,
+	mapLoginsToClickUpIds,
+	needsPrereleaseTag,
+	parseAssigneeIds,
+	parseUnpublished,
+	runNudge,
+	taskName,
+} from "../../src/github/oidc-bootstrap-nudge.mjs";
+
+describe("oidc-bootstrap-nudge", () => {
+	it("parses unpublished names and assignee ids", () => {
+		expect(parseUnpublished(" @decohere/scaffold  @decohere/cli ")).toEqual([
+			"@decohere/scaffold",
+			"@decohere/cli",
+		]);
+		expect(parseAssigneeIds("308432336, 99")).toEqual([308432336, 99]);
+		expect(parseAssigneeIds("")).toEqual([]);
+		expect(taskName()).toBe("deploy(publish): OIDC bootstrap unpublished packages");
+		expect(bootstrapTaskNames()).toContain(
+			"chore(publish): OIDC bootstrap unpublished packages",
+		);
+	});
+
+	it("extracts GitHub user reviewers and maps login to ClickUp email local-part", () => {
+		expect(
+			extractGitHubReviewerLogins({
+				protection_rules: [
+					{ type: "branch_policy", reviewers: [] },
+					{
+						type: "required_reviewers",
+						reviewers: [
+							{ type: "User", reviewer: { login: "das974" } },
+							{ type: "Team", reviewer: { slug: "publishers", login: "should-skip" } },
+						],
+					},
+				],
+			}),
+		).toEqual(["das974"]);
+		expect(
+			mapLoginsToClickUpIds(
+				["das974"],
+				[{ id: 308432336, username: "Daniel Scalamogna", email: "das974@gmail.com" }],
+			),
+		).toEqual([308432336]);
+		expect(mapLoginsToClickUpIds(["other"], [{ id: 1, email: "das974@gmail.com" }])).toEqual(
+			[],
+		);
+	});
+
+	it("puts first-publish commands and Trusted Publisher fields in the task body", () => {
+		const pkg = { name: "@decohere/scaffold", dir: "scaffold", version: "0.0.1-dev.18" };
+		const body = buildDescription({
+			unpublished: ["@decohere/scaffold"],
+			packages: [pkg],
+			repo: "typesmiths/decohere",
+			runUrl: "https://github.com/typesmiths/decohere/actions/runs/9",
+			channel: "dev",
+		});
+		expect(needsPrereleaseTag("0.0.1-dev.18")).toBe(true);
+		expect(needsPrereleaseTag("1.2.3")).toBe(false);
+		expect(firstPublishCommands([pkg], "dev")).toEqual([
+			"npm publish ./projects/scaffold --tag dev",
+		]);
+		expect(firstPublishCommands([{ ...pkg, version: "1.0.0" }], "dev")).toEqual([
+			"npm publish ./projects/scaffold",
+		]);
+		expect(body).toContain("npm publish ./projects/scaffold --tag dev");
+		expect(body).not.toMatch(/# @decohere\/scaffold/);
+		expect(body).toContain("do **not** pass `--access public`");
+		expect(firstPublishCommands([pkg], "dev").join("\n")).not.toContain("--access public");
+		expect(body).toContain("Workflow filename: `publish.yml`");
+		expect(body).toContain("Environment: `npm-publish`");
+		expect(body).toContain("gh run rerun --failed");
+		expect(body).toContain("https://github.com/typesmiths/decohere/actions/runs/9");
+	});
+
+	it("assigns mapped GitHub reviewers when upserting the ClickUp task", async () => {
+		/** @type {object[]} */
+		const upserts = [];
+		const code = await runNudge(
+			{ UNPUBLISHED: "@decohere/scaffold", GITHUB_REPOSITORY: "typesmiths/decohere" },
+			{
+				listPackages: () => [{ name: "@decohere/scaffold", dir: "scaffold" }],
+				githubReviewers: async () => ["das974"],
+				clickupMembers: async () => [
+					{ id: 308432336, username: "Daniel Scalamogna", email: "das974@gmail.com" },
+				],
+				upsert: async (options) => {
+					upserts.push(options);
+					return { id: "abc", url: "https://app.clickup.com/t/abc", created: true };
+				},
+				runUrl: "https://github.com/typesmiths/decohere/actions/runs/1",
+			},
+		);
+		expect(code).toBe(0);
+		expect(upserts[0].assigneeIds).toEqual([308432336]);
+		expect(upserts[0].unpublished).toEqual(["@decohere/scaffold"]);
+	});
+});

package/tests/github/publish-verify.test.mjs

@@ -0,0 +1,95 @@
+import { vol } from "memfs";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	collectPublishVerify,
+	formatGithubOutput,
+	listPublishablePackages,
+	parseGhcrRepository,
+} from "../../src/github/publish-verify.mjs";
+
+function seedWorkspace() {
+	const root = "/workspace";
+	vol.fromJSON({
+		[`${root}/package.json`]: JSON.stringify({ version: "0.0.1-dev.79" }),
+		[`${root}/projects/cli/package.json`]: JSON.stringify({
+			name: "@decohere/cli",
+			version: "0.0.1-dev.79",
+		}),
+		[`${root}/projects/scaffold/package.json`]: JSON.stringify({
+			name: "@decohere/scaffold",
+			version: "0.0.1-dev.79",
+			private: true,
+		}),
+		[`${root}/projects/create/package.json`]: JSON.stringify({
+			name: "@decohere/create",
+			version: "0.0.1-dev.79",
+			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/create" },
+		}),
+		[`${root}/projects/devcontainer/package.json`]: JSON.stringify({
+			name: "@decohere/devcontainer",
+			private: true,
+			decohere: { dockerImageRepository: "ghcr.io/typesmiths/decohere/devcontainer" },
+		}),
+	});
+	return root;
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+describe("publish-verify", () => {
+	it("lists non-private workspace packages", () => {
+		const root = seedWorkspace();
+		expect(listPublishablePackages(root).map((pkg) => pkg.name)).toEqual([
+			"@decohere/cli",
+			"@decohere/create",
+		]);
+	});
+
+	it("parses GHCR repository coordinates", () => {
+		expect(parseGhcrRepository("ghcr.io/typesmiths/decohere/create")).toEqual({
+			org: "typesmiths",
+			packageName: "decohere/create",
+		});
+	});
+
+	it("marks names missing from npm as unpublished and skip_npm when every version exists", async () => {
+		const root = seedWorkspace();
+		const views = [];
+		const spawnSync = (_cmd, args) => {
+			views.push(args[1]);
+			if (args[1] === "@decohere/cli") {
+				return { status: 1 };
+			}
+			return { status: 0 };
+		};
+		const result = await collectPublishVerify({
+			root,
+			spawnSync,
+			githubToken: "",
+		});
+		expect(result.unpublished).toEqual(["@decohere/cli"]);
+		expect(result.skipNpm).toBe(false);
+		expect(views).toContain("@decohere/cli");
+		expect(views).toContain("@decohere/create");
+		expect(views).toContain("@decohere/create@0.0.1-dev.79");
+	});
+
+	it("sets skip_docker when both GHCR tags exist", async () => {
+		const root = seedWorkspace();
+		const fetch = async () => ({
+			ok: true,
+			status: 200,
+			json: async () => [{ metadata: { container: { tags: ["0.0.1-dev.79"] } } }],
+		});
+		const result = await collectPublishVerify({
+			root,
+			spawnSync: () => ({ status: 0 }),
+			githubToken: "ghs_test",
+			fetch,
+		});
+		expect(result.skipDocker).toBe(true);
+		expect(formatGithubOutput(result)).toContain("skip_docker=true");
+	});
+});