@dsh-workbench/module-tools 1.0.0-beta.0 → 1.0.0

package/src/release.mjs

@@ -1,8 +1,8 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { homedir, tmpdir } from 'node:os';
-import { dirname, join, relative, resolve, sep } from 'node:path';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { isDeepStrictEqual } from 'node:util';
+import semver from 'semver';
 
 import { DESIGN_FILE, acceptanceOf } from './design.mjs';
 import {
@@ -18,10 +18,38 @@ import {
 } from './release-journal.mjs';
 import { emit, installOf, marketInstallOf, stateOf } from './release-report.mjs';
 import { authorChangeOf, changelogGateOf } from './release-changelog.mjs';
-import { NeedsUser, ReleaseError, ResumableError, defaultExec, tailOf } from './release-util.mjs';
+import {
+  NeedsUser,
+  ReleaseError,
+  ResumableError,
+  argValue,
+  defaultExec,
+  dshHomeOf,
+  hasFlag,
+  tailOf,
+} from './release-util.mjs';
+import {
+  TARGETS,
+  checkLogin,
+  licenseOf,
+  repositoryOf,
+  targetInfoOf,
+  targetOf,
+} from './release-target.mjs';
+import {
+  checkGitFiles,
+  checkPublished,
+  localFiles,
+  packTarball,
+  publishRegistry,
+  registryExists,
+  verifyRegistry,
+} from './release-publish.mjs';
 import {
   MarketIndexError,
+  identityOf,
   marketVersionExists,
+  refreshMarketEntry,
   resolveIndexPlan,
   updateMarketIndex,
   verifyMarketArtifact,
@@ -31,35 +59,6 @@ export { NeedsUser, ReleaseError, ResumableError };
 
 const CLI = fileURLToPath(new URL('../bin/dsh-wb-module.mjs', import.meta.url));
 const SCRIPTS = ['typecheck', 'test', 'selfcheck'];
-const TARGETS = ['team', 'public', 'tarball', 'git', 'market', 'local'];
-const PUBLIC_REGISTRIES = ['https://registry.npmjs.org/', 'https://registry.npmmirror.com/'];
-const SEMVER = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
-const REQUIRED_FILES = ['dist/host.js', 'client.js', 'cordis.patch.yml', 'package.json', 'CHANGELOG.md'];
-
-function argValue(args, flag) {
-  const at = args.indexOf(flag);
-  return at === -1 ? undefined : args[at + 1];
-}
-
-function hasFlag(args, flag) {
-  return args.includes(flag);
-}
-
-function parseJson(text) {
-  const raw = String(text ?? '');
-  const start = raw.search(/[[{]/);
-  if (start === -1) return undefined;
-  try {
-    return JSON.parse(raw.slice(start));
-  } catch {
-    return undefined;
-  }
-}
-
-function quote(value) {
-  const text = String(value);
-  return /[\s"'$`\\]/.test(text) ? `'${text.replace(/'/g, `'\\''`)}'` : text;
-}
 
 function readManifest(root) {
   const file = join(root, 'package.json');
@@ -80,130 +79,16 @@ function writeManifest(root, manifest) {
   writeFileSync(join(root, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`);
 }
 
-function dshHomeOf(home) {
-  return home ?? process.env.DSH_HOME?.trim() ?? join(homedir(), '.dsh');
-}
-
-function artifactsDirOf(home, unit) {
-  return join(dshHomeOf(home), 'workbench', 'artifacts', unit);
-}
-
-function normalizeRegistry(url) {
-  const value = String(url ?? '').trim();
-  if (value === '') return '';
-  return value.endsWith('/') ? value : `${value}/`;
-}
-
-function isPublicRegistry(registry) {
-  return PUBLIC_REGISTRIES.includes(normalizeRegistry(registry));
-}
-
-function findNpmrc(root) {
-  let dir = resolve(root);
-  for (;;) {
-    const file = join(dir, '.npmrc');
-    if (existsSync(file)) return file;
-    const parent = dirname(dir);
-    if (parent === dir) return undefined;
-    dir = parent;
-  }
-}
-
-function hasAuth(file) {
-  if (file === undefined) return false;
-  try {
-    return /(_authToken|_auth\s*=|always-auth)/i.test(readFileSync(file, 'utf8'));
-  } catch {
-    return false;
-  }
-}
-
-function registryInNpmrc(file, name) {
-  if (file === undefined) return '';
-  let general = '';
-  const scope = name.startsWith('@') ? name.slice(0, name.indexOf('/')) : '';
-  for (const raw of readFileSync(file, 'utf8').split('\n')) {
-    const line = raw.trim();
-    if (line === '' || line.startsWith('#') || line.startsWith(';')) continue;
-    const at = line.indexOf('=');
-    if (at === -1) continue;
-    const key = line.slice(0, at).trim();
-    const value = normalizeRegistry(line.slice(at + 1).trim());
-    if (value === '') continue;
-    if (scope !== '' && key === `${scope}:registry`) return value;
-    if (key === 'registry') general = value;
-  }
-  return general;
-}
-
-function configuredRegistry(root, manifest) {
-  const npmrc = findNpmrc(root);
-  return (
-    normalizeRegistry(process.env.DSH_WB_PUBLISH_REGISTRY) ||
-    normalizeRegistry(manifest.publishConfig?.registry) ||
-    registryInNpmrc(npmrc, String(manifest.name ?? ''))
-  );
-}
-
-function targetOf(root, manifest, args, indexPlan) {
-  const asked = argValue(args, '--target');
-  if (asked !== undefined) {
-    if (!TARGETS.includes(asked)) throw new ReleaseError(`--target 只认 ${TARGETS.join(' / ')}`);
-    return asked;
-  }
-  if (hasFlag(args, '--public')) return 'public';
-  if (hasFlag(args, '--git') || argValue(args, '--git') !== undefined) return 'git';
-  if (argValue(args, '--out') !== undefined) return 'tarball';
-  const flagged = normalizeRegistry(argValue(args, '--registry'));
-  if (flagged !== '') return isPublicRegistry(flagged) ? 'public' : 'team';
-  if (indexPlan?.policy === 'artifacts-in-repo') return 'market';
-  const configured = configuredRegistry(root, manifest);
-  if (configured !== '') return isPublicRegistry(configured) ? 'public' : 'team';
-  return 'tarball';
-}
-
-function licenseFileOf(root) {
-  for (const name of ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING']) {
-    if (existsSync(join(root, name))) return name;
-  }
-  return undefined;
-}
-
-function licenseOf(root, manifest, target, args) {
-  const given = argValue(args, '--license') ?? manifest.license;
-  if (typeof given === 'string' && given.trim() !== '') return given.trim();
-  const file = licenseFileOf(root);
-  if (file !== undefined) return `SEE LICENSE IN ${file}`;
-  if (target === 'public') {
-    throw new NeedsUser('license', '公开发布需要一个许可证。用 MIT、Apache-2.0，还是仓库里已有的 LICENSE？', undefined, {
-      target,
-    });
-  }
-  if (target === 'team') return 'UNLICENSED';
-  return undefined;
-}
-
-function repositoryOf(root, exec) {
-  const result = exec('git', ['-C', root, 'remote', 'get-url', 'origin'], { capture: true, allowFailure: true });
-  const url = result.status === 0 ? result.stdout.trim() : '';
-  return url === '' ? undefined : { type: 'git', url };
-}
-
 function bumpVersion(version, kind) {
-  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(String(version));
-  if (match === null) throw new ReleaseError(`当前版本号读不出来：${String(version)}`);
-  const major = Number(match[1]);
-  const minor = Number(match[2]);
-  const patch = Number(match[3]);
-  if (kind === 'major') return `${major + 1}.0.0`;
-  if (kind === 'minor') return `${major}.${minor + 1}.0`;
-  return `${major}.${minor}.${patch + 1}`;
+  const next = semver.inc(String(version), kind);
+  if (next === null) throw new ReleaseError(`当前版本号读不出来：${String(version)}`);
+  return next;
 }
 
 function nextVersion(current, asked, exists) {
   if (asked !== undefined) {
     const version = /^(major|minor|patch)$/.test(asked) ? bumpVersion(current, asked) : asked;
-    if (!SEMVER.test(version)) {
+    if (semver.valid(version) === null) {
       throw new ReleaseError(`--version 只认 patch / minor / major / x.y.z（收到「${asked}」）`);
     }
     if (exists(version)) throw new ReleaseError(`${version} 已经被占了 —— 换一个版本`);
@@ -217,160 +102,6 @@ function nextVersion(current, asked, exists) {
   throw new ReleaseError('版本号没法自动加 —— 手动给 --version');
 }
 
-function loginCommandOf(registry) {
-  return `npm login --registry ${registry}`;
-}
-
-function npmrcArgs(npmrc) {
-  return npmrc === undefined ? [] : ['--userconfig', npmrc];
-}
-
-function checkLogin(exec, info) {
-  const argv = ['whoami', '--registry', info.registry, ...npmrcArgs(info.npmrc)];
-  const result = exec('npm', argv, { capture: true, allowFailure: true });
-  if (result.status === 0) return;
-  const text = `${result.stdout}\n${result.stderr}`;
-  if (/E404|404|not found/i.test(text)) return;
-  if (/ENEEDAUTH|not logged in|401|Unauthorized|E401|E403|403/i.test(text)) {
-    throw new NeedsUser(
-      'login',
-      `${info.target === 'public' ? 'npm' : '团队源'}还没登录。请在终端跑 \`${loginCommandOf(info.registry)}\`，走完登录/验证器再跟我说「好了」，我接着发。`,
-      loginCommandOf(info.registry),
-      { target: info.target, registry: info.registry },
-    );
-  }
-  throw new ReleaseError(`连不上源（${info.registry}）：${tailOf(text)}`);
-}
-
-function registryInfoOf(root, manifest, args, target, fallbackRegistry) {
-  const name = String(manifest.name ?? '');
-  const askedNpmrc = argValue(args, '--npmrc');
-  const sourceNpmrc = askedNpmrc === undefined ? findNpmrc(root) : resolve(askedNpmrc);
-  if (askedNpmrc !== undefined && !existsSync(sourceNpmrc)) {
-    throw new ReleaseError(`--npmrc 指的文件不存在：${sourceNpmrc}`);
-  }
-  const npmrc = askedNpmrc !== undefined ? sourceNpmrc : hasAuth(sourceNpmrc) ? sourceNpmrc : undefined;
-  const flagged = normalizeRegistry(argValue(args, '--registry'));
-  let registry;
-  if (target === 'public') {
-    registry = flagged || 'https://registry.npmjs.org/';
-    if (!isPublicRegistry(registry)) {
-      throw new ReleaseError('public 目标要公网源；团队私有源用 --target team');
-    }
-  } else {
-    registry =
-      flagged ||
-      normalizeRegistry(process.env.DSH_WB_PUBLISH_REGISTRY) ||
-      normalizeRegistry(manifest.publishConfig?.registry) ||
-      normalizeRegistry(fallbackRegistry) ||
-      registryInNpmrc(sourceNpmrc, name);
-    if (registry === '') {
-      throw new NeedsUser(
-        'registry',
-        '这个工坊还没配团队源。让公司把 registry 和 token 写进 `.npmrc`；或者我先给你打一个安装包。',
-        undefined,
-        { target },
-      );
-    }
-    if (isPublicRegistry(registry)) {
-      throw new ReleaseError('这个源是公共 npm —— 用 --target public 明确公开发布');
-    }
-  }
-  const access = argValue(args, '--access') ?? manifest.publishConfig?.access ?? (target === 'public' ? 'public' : 'restricted');
-  if (access !== 'restricted' && access !== 'public') {
-    throw new ReleaseError(`--access 只认 restricted / public（收到「${access}」）`);
-  }
-  if (target === 'public' && access !== 'public') throw new ReleaseError('public 目标只接受 --access public');
-  return { target, kind: 'registry', name, registry, access, npmrc };
-}
-
-function tarballInfoOf(root, manifest, args, home) {
-  const out = resolve(argValue(args, '--out') ?? artifactsDirOf(home, String(manifest.dsh?.workbench?.unit ?? '')));
-  const fileNameOf = (version) => `${String(manifest.name).replace(/^@/, '').replace(/[/\\]/g, '-')}-${version}.tgz`;
-  const fileOf = (version) => join(out, fileNameOf(version));
-  return {
-    target: 'tarball',
-    kind: 'tarball',
-    out,
-    fileNameOf,
-    fileOf,
-    exists: (version) => existsSync(fileOf(version)),
-  };
-}
-
-function gitInfoOf(root, manifest, args, exec) {
-  const unit = String(manifest.dsh?.workbench?.unit ?? '');
-  const top = exec('git', ['-C', root, 'rev-parse', '--show-toplevel'], { capture: true, allowFailure: true });
-  if (top.status !== 0) {
-    throw new NeedsUser(
-      'git-remote',
-      '这个模块目录还不是 git 仓库。先给它一个仓库/配好权限，或改打一个安装包。',
-      undefined,
-      { target: 'git' },
-    );
-  }
-  const toplevel = top.stdout.trim();
-  const branchResult = exec('git', ['-C', toplevel, 'rev-parse', '--abbrev-ref', 'HEAD'], {
-    capture: true,
-    allowFailure: true,
-  });
-  const branch = branchResult.status === 0 ? branchResult.stdout.trim() : '';
-  if (branch === '' || branch === 'HEAD') {
-    throw new NeedsUser('git-branch', '这个仓库现在不在一个分支上（detached HEAD）。先切回一个分支，再发。', undefined, {
-      target: 'git',
-    });
-  }
-  const remote = argValue(args, '--git') ?? 'origin';
-  const remoteResult = exec('git', ['-C', toplevel, 'remote', 'get-url', remote], { capture: true, allowFailure: true });
-  if (remoteResult.status !== 0 || remoteResult.stdout.trim() === '') {
-    throw new NeedsUser('git-remote', `这个仓库没有可推送的远端 ${remote}。先加一个远端，或改打一个安装包。`, undefined, {
-      target: 'git',
-      remote,
-    });
-  }
-  const url = remoteResult.stdout.trim();
-  const packagePath = relative(toplevel, root).split(sep).join('/') || '.';
-  const status = exec('git', ['-C', toplevel, 'status', '--porcelain', '--untracked-files=all'], {
-    capture: true,
-    allowFailure: true,
-  });
-  if (status.status !== 0) throw new ReleaseError(`读不了 git 状态：${tailOf(status.stderr)}`);
-  const prefix = packagePath === '.' ? '' : `${packagePath}/`;
-  const allowed = ['dist', 'client.js', 'cordis.patch.yml', 'package.json', 'README.md', 'CHANGELOG.md', 'design.json'];
-  const dirty = status.stdout
-    .trim()
-    .split('\n')
-    .filter((line) => line.trim() !== '')
-    .map((line) => line.slice(3).trim())
-    .filter((path) => {
-      if (!path.startsWith(prefix)) return true;
-      const rel = path.slice(prefix.length);
-      return !allowed.some((one) => rel === one || rel.startsWith(`${one}/`));
-    });
-  if (dirty.length > 0) {
-    throw new NeedsUser(
-      'git-dirty',
-      `工作区还有别的未提交改动（${dirty.slice(0, 3).join('、')}）。先提交/暂存，再发；或改用安装包。`,
-      undefined,
-      { target: 'git', paths: dirty.slice(0, 3) },
-    );
-  }
-  const tagOf = (version) => `${unit}@${version}`;
-  const exists = (version) =>
-    exec('git', ['-C', toplevel, 'rev-parse', '-q', '--verify', `refs/tags/${tagOf(version)}`], {
-      capture: true,
-      allowFailure: true,
-    }).status === 0;
-  return { target: 'git', kind: 'git', toplevel, branch, remote, url, packagePath, tagOf, exists };
-}
-
-function targetInfoOf(root, manifest, args, home, exec, target, fallbackRegistry) {
-  if (target === 'team' || target === 'public') return registryInfoOf(root, manifest, args, target, fallbackRegistry);
-  if (target === 'tarball') return tarballInfoOf(root, manifest, args, home);
-  if (target === 'git') return gitInfoOf(root, manifest, args, exec);
-  return { target: 'local', kind: 'local' };
-}
-
 function stage(exec, command, argv, { cwd, capture, err, label }) {
   const result = exec(command, argv, { cwd, capture, allowFailure: true });
   if (result.status === 0) return result;
@@ -397,163 +128,55 @@ function runGate(exec, root, options) {
   for (const script of SCRIPTS) runScriptStage(exec, root, script, options);
 }
 
-function localFiles(exec, root) {
-  const result = exec(
-    'npm',
-    ['pack', '--dry-run', '--json', '--ignore-scripts', '--cache', join(tmpdir(), 'dsh-wb-npm-cache')],
-    { cwd: root, capture: true, allowFailure: true },
-  );
-  if (result.status !== 0) throw new ReleaseError(`核不了本地包内容：${tailOf(`${result.stdout}\n${result.stderr}`)}`);
-  const parsed = parseJson(result.stdout);
-  const first = Array.isArray(parsed) ? parsed[0] : parsed;
-  const files = Array.isArray(first?.files) ? first.files.map((one) => String(one.path ?? one)) : [];
-  if (files.length === 0) throw new ReleaseError('npm pack 没列出包内容');
-  return files;
-}
-
-function checkPublished(files) {
-  const missing = REQUIRED_FILES.filter((one) => !files.includes(one));
-  if (missing.length > 0) throw new ReleaseError(`包里少了 ${missing.join(' / ')} —— 装上会起不来`);
-  const leaked = files.filter(
-    (one) => one.startsWith('src/') || one.endsWith('.npmrc') || one.startsWith('template') || one.includes('.env'),
-  );
-  if (leaked.length > 0) throw new ReleaseError(`包里混进了不该发的：${leaked.slice(0, 3).join('、')}`);
-}
-
-function checkGitFiles(files) {
-  const missing = REQUIRED_FILES.filter((one) => !files.includes(one));
-  if (missing.length > 0) throw new ReleaseError(`tag 里少了 ${missing.join(' / ')} —— 装上会起不来`);
-  const leaked = files.filter((one) => one.endsWith('.npmrc') || one.includes('.env'));
-  if (leaked.length > 0) throw new ReleaseError(`tag 里混进了凭据文件：${leaked.slice(0, 3).join('、')}`);
+function gitPathsOf(info) {
+  const prefix = info.packagePath === '.' ? '' : `${info.packagePath}/`;
+  return ['dist', 'client.js', 'cordis.patch.yml', 'package.json', 'README.md', 'CHANGELOG.md', 'design.json']
+    .map((one) => `${prefix}${one}`)
+    .filter((one) => existsSync(join(info.toplevel, one)));
 }
 
-function registryExists(exec, info, name, version) {
-  const argv = ['view', `${name}@${version}`, 'version', '--json', '--registry', info.registry, ...npmrcArgs(info.npmrc)];
-  const result = exec('npm', argv, { capture: true, allowFailure: true });
-  if (result.status === 0) return true;
-  const text = `${result.stdout}\n${result.stderr}`;
-  if (/E404|404|No matching version|not found|不存在/i.test(text)) return false;
-  throw new ReleaseError(`查团队源失败（${info.registry}）：${tailOf(text)}`);
-}
+const MESSAGE_FILES = ['src/messages.ts', 'src/messages.tsx', 'src/messages.mjs', 'src/messages.js'];
 
-function publishArgsOf(info) {
-  return [
-    'publish',
-    '--registry',
-    info.registry,
-    '--access',
-    info.access,
-    '--ignore-scripts',
-    ...npmrcArgs(info.npmrc),
-  ];
+function titleIn(segment, key) {
+  const quoted = `['"\`]${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}['"\`]`;
+  const match = new RegExp(`${quoted}\\s*:\\s*['"\`]([^'"\`]*)['"\`]`).exec(segment);
+  return match === null ? '' : match[1].trim();
 }
 
-function otpCommandOf(root, info) {
-  return [
-    `cd ${quote(root)}`,
-    '&&',
-    'npm',
-    'publish',
-    '--registry',
-    info.registry,
-    '--access',
-    info.access,
-    '--ignore-scripts',
-    ...npmrcArgs(info.npmrc),
-  ].join(' ');
-}
-
-function publishRegistry(exec, root, info, manifest, version) {
-  const result = exec('npm', publishArgsOf(info), { cwd: root, capture: true, allowFailure: true });
-  if (result.status === 0) return;
-  const text = `${result.stdout}\n${result.stderr}`;
-  if (/EOTP|one-time password|OTP/i.test(text)) {
-    throw new NeedsUser(
-      'otp',
-      '源要求一次性验证码。构建和门禁都过了，请在终端跑下面这条，按提示输入验证码；完了跟我说「好了」，我来核对。',
-      otpCommandOf(root, info),
-      { target: info.target, name: manifest.name, version, registry: info.registry },
-    );
-  }
-  if (info.target === 'public' && /E403|403|taken|already exists|Forbidden|cannot publish over/i.test(text)) {
-    throw new NeedsUser('name', '这个名字在 npm 上已经被占了。换一个：`@<user>/<name>` 或加一个后缀？', undefined, {
-      target: info.target,
-      name: manifest.name,
-      version,
-    });
-  }
-  if (/E403|403|already exists|Forbidden/i.test(text)) {
-    throw new NeedsUser('scope', '团队源不让发这个包名（可能被占了，或没有权限）。让管理员确认 scope / 权限后跟我说。', undefined, {
-      target: info.target,
-      name: manifest.name,
-      version,
-    });
-  }
-  if (/E402|402|E404|404|scope|payment|not found/i.test(text)) {
-    throw new NeedsUser('scope', '团队源要求包名带 scope。用 `@<scope>/<name>` 吗？', undefined, {
-      target: info.target,
-      name: manifest.name,
-      version,
-    });
-  }
-  throw new ReleaseError(`npm publish 没过：${tailOf(text)}`);
-}
-
-function verifyRegistry(exec, info, name, version) {
-  const view = exec(
-    'npm',
-    ['view', `${name}@${version}`, 'version', 'dist.tarball', '--json', '--registry', info.registry, ...npmrcArgs(info.npmrc)],
-    { capture: true, allowFailure: true },
-  );
-  if (view.status !== 0) {
-    throw new ReleaseError(`发完了，但在源上查不到 ${name}@${version} —— 去 registry 确认一下`);
+export function cardTitleFromMessages(root, unit) {
+  if (unit === '') return undefined;
+  const key = `${unit}.cardTitle`;
+  for (const file of MESSAGE_FILES) {
+    let text;
+    try {
+      text = readFileSync(join(root, file), 'utf8');
+    } catch {
+      continue;
+    }
+    const zhAt = text.search(/\bzh\s*:/);
+    const enAt = text.search(/\ben\s*:/);
+    const zh = zhAt === -1 ? '' : titleIn(text.slice(zhAt, enAt === -1 ? text.length : enAt), key);
+    const en = enAt === -1 ? '' : titleIn(text.slice(enAt), key);
+    if (zh === '' && en === '') continue;
+    return { ...(zh === '' ? {} : { zh }), ...(en === '' ? {} : { en }) };
   }
-  const packed = exec(
-    'npm',
-    ['pack', `${name}@${version}`, '--dry-run', '--json', '--ignore-scripts', '--registry', info.registry, ...npmrcArgs(info.npmrc)],
-    { capture: true, allowFailure: true },
-  );
-  if (packed.status !== 0) throw new ReleaseError(`发完了，但核不了包：${tailOf(`${packed.stdout}\n${packed.stderr}`)}`);
-  const parsed = parseJson(packed.stdout);
-  const first = Array.isArray(parsed) ? parsed[0] : parsed;
-  const files = Array.isArray(first?.files) ? first.files.map((one) => String(one.path ?? one)) : [];
-  if (files.length === 0) throw new ReleaseError('发完了，但 npm pack 没列出包内容');
-  checkPublished(files);
-  return files;
-}
-
-function packTarball(exec, info, version) {
-  mkdirSync(info.out, { recursive: true });
-  const result = exec(
-    'npm',
-    ['pack', '--json', '--ignore-scripts', '--pack-destination', info.out],
-    { capture: true, allowFailure: true },
-  );
-  if (result.status !== 0) throw new ReleaseError(`npm pack 没过：${tailOf(`${result.stdout}\n${result.stderr}`)}`);
-  const parsed = parseJson(result.stdout);
-  const first = Array.isArray(parsed) ? parsed[0] : parsed;
-  const filename = typeof first?.filename === 'string' ? first.filename : info.fileNameOf(version);
-  const file = join(info.out, filename);
-  if (!existsSync(file)) throw new ReleaseError(`npm pack 说生成了 ${filename}，但文件不在 ${info.out}`);
-  return file;
-}
-
-function gitPathsOf(info) {
-  const prefix = info.packagePath === '.' ? '' : `${info.packagePath}/`;
-  return ['dist', 'client.js', 'cordis.patch.yml', 'package.json', 'README.md', 'CHANGELOG.md', 'design.json']
-    .map((one) => `${prefix}${one}`)
-    .filter((one) => existsSync(join(info.toplevel, one)));
+  return undefined;
 }
 
-function gitCommitOf(exec, info, version, capture, progress = {}) {
+function gitCommitOf(exec, info, version, capture, progress = {}, identity) {
   const add = exec('git', ['-C', info.toplevel, 'add', '-f', '--', ...gitPathsOf(info)], {
     capture,
     allowFailure: true,
   });
   if (add.status !== 0) throw new ReleaseError(`git add 没过：${tailOf(`${add.stdout}\n${add.stderr}`)}`);
+  const who = [];
+  if (identity !== undefined) {
+    who.push('-c', `user.name=${identity.name}`);
+    if (identity.email !== undefined) who.push('-c', `user.email=${identity.email}`);
+  }
   const commit = exec(
     'git',
-    ['-C', info.toplevel, 'commit', '-m', `chore(release): ${info.tagOf(version)}`],
+    ['-C', info.toplevel, ...who, 'commit', '-m', `chore(release): ${info.tagOf(version)}`],
     { capture, allowFailure: true },
   );
   if (commit.status !== 0) throw new ReleaseError(`git commit 没过：${tailOf(`${commit.stdout}\n${commit.stderr}`)}`);
@@ -682,6 +305,40 @@ export async function runRelease({
       throw new ReleaseError('这个索引源是 catalog-only：它只收目录、不放产物。用 --index-policy artifacts-in-repo 或换一个可写仓库');
     }
   }
+  if (hasFlag(args, '--refresh')) {
+    if (dryRun) throw new ReleaseError('--refresh 没有预览：它只改索引里的标题 / 作者 / 说明');
+    if (target !== 'market') throw new ReleaseError('--refresh 只对市场索引有意义（--target market）');
+    if (indexPlan === undefined) {
+      throw new ReleaseError('没有可写的 git 索引源 —— 用 --index <仓库> 指定，或先在「模块市场 → 发现」里初始化索引');
+    }
+    const cardTitle = cardTitleFromMessages(root, unit);
+    const titled = cardTitle === undefined ? manifest : { ...manifest, title: cardTitle };
+    const result = refreshMarketEntry({ plan: indexPlan, exec, home, manifest: titled });
+    if (result.updated !== true && result.reason !== undefined) {
+      throw new ReleaseError(`刷新市集元数据没走通：${result.reason}`);
+    }
+    const summary = {
+      ok: true,
+      target: 'market',
+      refresh: true,
+      name: manifest.name,
+      version: result.version ?? manifest.version,
+      refreshed: result.updated === true,
+      market: {
+        url: indexPlan.source.url,
+        ...(result.branch === undefined ? {} : { branch: result.branch }),
+        ...(result.commit === undefined ? {} : { commit: result.commit }),
+      },
+      changes: result.updated === true ? ['市集元数据已刷新'] : [],
+      install: '',
+      text:
+        result.updated === true
+          ? `已刷新 ${manifest.name} 的市集元数据（版本 ${result.version ?? manifest.version} 不变）`
+          : `${manifest.name} 的市集元数据本来就是这样，没动`,
+    };
+    emit(out, json, summary);
+    return summary;
+  }
   const authored = authorChangeOf(root, manifest, exec);
   const authorChange = authored.change;
   if (!verify && !dryRun && authored.author !== undefined) {
@@ -972,10 +629,12 @@ export async function runRelease({
     if (!resumeMatchesTree) runCliStage(exec, root, ['check'], stageOptions);
     if (tracking) advanceRun(home, unit, { phase: 'version', version });
     const next = { ...manifest, version };
+    const cardTitle = cardTitleFromMessages(root, unit);
+    const titled = cardTitle === undefined ? next : { ...next, title: cardTitle };
     const index = updateMarketIndex({
       plan: indexPlan,
       root,
-      manifest: next,
+      manifest: titled,
       unit,
       version,
       publish: {},
@@ -1103,7 +762,7 @@ export async function runRelease({
     writeState(home, unit, stateOf(info, next, version, 'intent'));
     const progress = { committed: false };
     try {
-      const commit = gitCommitOf(exec, info, version, capture, progress);
+      const commit = gitCommitOf(exec, info, version, capture, progress, identityOf(next));
       writeState(home, unit, { ...stateOf(info, next, version, 'committed'), commit });
       gitPushOf(exec, info, version, capture);
       const checked = verifyGit(exec, info, version);