@dsh-workbench/module-tools 1.0.0-beta.1 → 1.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-workbench/module-tools",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.1",
   "description": "模块包的构建与门禁工具：build（单文件 ESM 宿主侧 + 套 loader 壳的浏览器侧）、check（契约/产物边界/源码边界/卡片渲染）。模块包不再各带一份构建脚本。",
   "license": "MIT",
   "type": "module",
@@ -33,7 +33,7 @@
     "semver": "^7.8.5",
     "typescript": "5.9.3",
     "typescript-eslint": "^8.71.0",
-    "@dsh-workbench/shared": "1.0.0-beta.1"
+    "@dsh-workbench/shared": "1.0.1"
   },
   "repository": {
     "type": "git",

package/src/market-index.mjs

@@ -1,5 +1,6 @@
 import { cpSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 
 import {
   MARKET_INDEX_README_LINES,
@@ -69,6 +70,22 @@ export function sanitizeManifest(manifest) {
   return next;
 }
 
+function authorParts(manifest) {
+  const author = manifest?.author;
+  const raw =
+    typeof author === 'string'
+      ? author.trim()
+      : author !== null && typeof author === 'object' && typeof author.name === 'string'
+        ? author.name.trim()
+        : '';
+  const declaredEmail =
+    author !== null && typeof author === 'object' && typeof author.email === 'string' ? author.email.trim() : '';
+  const match = /^(.*?)\s*<([^>]*)>/.exec(raw);
+  const name = (match === null ? raw : match[1]).trim();
+  const email = match === null ? declaredEmail : match[2].trim() || declaredEmail;
+  return { name, email };
+}
+
 function authorOf(manifest) {
   const author = manifest.author;
   if (typeof author === 'string') return author.trim();
@@ -76,23 +93,41 @@ function authorOf(manifest) {
   return '';
 }
 
+export function identityOf(manifest) {
+  const { name, email } = authorParts(manifest);
+  if (name === '') return undefined;
+  return email === '' ? { name } : { name, email };
+}
+
 function descriptionOf(manifest) {
   const description = typeof manifest.description === 'string' ? manifest.description.trim() : '';
   return description === '' ? undefined : { zh: description };
 }
 
-export function indexEntryOf(input) {
-  const manifest = input.manifest;
+function titleOf(manifest) {
+  const title = manifest.title;
+  if (typeof title === 'string') {
+    const text = title.trim();
+    return text === '' ? undefined : { zh: text };
+  }
+  if (title === null || typeof title !== 'object' || Array.isArray(title)) return undefined;
+  const zh = typeof title.zh === 'string' ? title.zh.trim() : '';
+  const en = typeof title.en === 'string' ? title.en.trim() : '';
+  if (zh === '' && en === '') return undefined;
+  return { ...(zh === '' ? {} : { zh }), ...(en === '' ? {} : { en }) };
+}
+
+export function entryMetaOf(manifest) {
   const author = authorOf(manifest);
   const homepage = typeof manifest.homepage === 'string' ? manifest.homepage.trim() : '';
   const keywords = Array.isArray(manifest.keywords)
     ? manifest.keywords.flatMap((one) => (typeof one === 'string' && one.trim() !== '' ? [one.trim()] : []))
     : [];
   const order = manifest.dsh?.workbench?.card?.order;
-  const dsh = manifest.engines?.dsh;
+  const title = titleOf(manifest);
   const description = descriptionOf(manifest);
   return {
-    name: manifest.name,
+    ...(title === undefined ? {} : { title }),
     ...(description === undefined ? {} : { description }),
     ...(author === '' ? {} : { author }),
     ...(homepage === '' ? {} : { homepage }),
@@ -102,6 +137,15 @@ export function indexEntryOf(input) {
       ...(keywords.length === 0 ? {} : { keywords }),
       ...(typeof order === 'number' ? { sortKeys: { order } } : {}),
     },
+  };
+}
+
+export function indexEntryOf(input) {
+  const manifest = input.manifest;
+  const dsh = manifest.engines?.dsh;
+  return {
+    name: manifest.name,
+    ...entryMetaOf(manifest),
     versions: [
       {
         version: input.version,
@@ -253,10 +297,15 @@ function assertClean(exec, workdir) {
   }
 }
 
-function commitOf(exec, workdir, message) {
+function commitOf(exec, workdir, message, identity) {
   const added = runGit(exec, workdir, ['add', '-A'], { allowFailure: true });
   if (added.status !== 0) throw new MarketIndexError(`git add 没过：${tailOf(`${added.stdout}\n${added.stderr}`)}`);
-  const committed = runGit(exec, workdir, ['commit', '-m', message], { allowFailure: true });
+  const who = [];
+  if (identity !== undefined) {
+    who.push('-c', `user.name=${identity.name}`);
+    if (identity.email !== undefined) who.push('-c', `user.email=${identity.email}`);
+  }
+  const committed = runGit(exec, workdir, [...who, 'commit', '-m', message], { allowFailure: true });
   const text = `${committed.stdout}\n${committed.stderr}`;
   if (committed.status !== 0 && !/nothing to commit|no changes added|无文件要提交/i.test(text)) {
     throw new MarketIndexError(`git commit 没过：${tailOf(text)}`);
@@ -379,7 +428,7 @@ export function updateMarketIndex(options) {
       report({ phase: 'artifacts' });
       artifactPath = copyArtifacts(root, workdir, unit, manifest);
       report({ phase: 'artifacts-copied' });
-      const sha = commitOf(exec, workdir, `chore(release): ${entryName}`);
+      const sha = commitOf(exec, workdir, `chore(release): ${entryName}`, identityOf(manifest));
       report({ phase: 'artifacts-committed', artifactCommit: sha });
       const pushed = pushOf(exec, workdir, branch);
       if (pushed.status !== 0) {
@@ -400,7 +449,7 @@ export function updateMarketIndex(options) {
     const entry = indexEntryOf({ manifest, version, source, at: now() });
     report({ phase: 'index' });
     writeEntry(workdir, indexPath, entry);
-    let indexSha = commitOf(exec, workdir, `chore(market): ${entryName}`);
+    let indexSha = commitOf(exec, workdir, `chore(market): ${entryName}`, identityOf(manifest));
     report({ phase: 'index-committed', indexCommit: indexSha });
     const pushed = pushOf(exec, workdir, branch);
     if (pushed.status !== 0) {
@@ -412,7 +461,7 @@ export function updateMarketIndex(options) {
         );
       }
       writeEntry(workdir, indexPath, entry);
-      indexSha = commitOf(exec, workdir, `chore(market): ${entryName}`);
+      indexSha = commitOf(exec, workdir, `chore(market): ${entryName}`, identityOf(manifest));
       report({ phase: 'index-committed', indexCommit: indexSha });
       const retried = pushOf(exec, workdir, branch);
       if (retried.status !== 0) {
@@ -451,6 +500,76 @@ export function updateMarketIndex(options) {
   }
 }
 
+export function refreshMarketEntry(options) {
+  const { plan, exec, home, manifest } = options;
+  let base = { kind: 'git', url: plan.source.url, entry: manifest.name };
+  let phase = 'start';
+  try {
+    const workdir = worktreeOf(plan, exec, home);
+    const indexPath = plan.source.path ?? MARKET_FILE;
+    assertClean(exec, workdir);
+    const branch = plan.source.ref ?? currentBranch(exec, workdir);
+    base = { ...base, branch };
+    const file = join(workdir, indexPath);
+    if (!existsSync(file)) throw new MarketIndexError(`索引里还没有 ${indexPath} —— 先正常发一版`, 'index-write');
+    const parsed = parseMarketIndexJson(readFileSync(file, 'utf8'));
+    if (!parsed.ok) {
+      throw new MarketIndexError(
+        `${indexPath} 不是 format 1：${parsed.problems.map((one) => one.detail).join('；')}`,
+        'index-write',
+      );
+    }
+    const existing = parsed.index.plugins.find((one) => one.name === manifest.name);
+    if (existing === undefined) {
+      throw new MarketIndexError(`${manifest.name} 还不在索引里 —— 先正常发一版`, 'index-write');
+    }
+    const latest = existing.versions[0]?.version ?? '';
+    const meta = entryMetaOf(manifest);
+    const next = { ...existing };
+    for (const key of ['title', 'description', 'author', 'homepage', 'metadata']) {
+      if (Object.hasOwn(meta, key)) next[key] = meta[key];
+      else delete next[key];
+    }
+    if (isDeepStrictEqual(next, existing)) {
+      return { ...base, updated: false, unchanged: true, version: latest, phase: 'done' };
+    }
+    writeEntry(workdir, indexPath, next);
+    let indexSha = commitOf(exec, workdir, `chore(market): refresh ${manifest.name}`, identityOf(manifest));
+    const pushed = pushOf(exec, workdir, branch);
+    if (pushed.status !== 0) {
+      const replayed = resetToRemote(exec, workdir, branch);
+      if (!replayed) {
+        throw new MarketIndexError(`元数据没推上去（本地 commit ${indexSha}）：${tailOf(pushed.stderr)}`, 'index-write');
+      }
+      writeEntry(workdir, indexPath, next);
+      indexSha = commitOf(exec, workdir, `chore(market): refresh ${manifest.name}`, identityOf(manifest));
+      const retried = pushOf(exec, workdir, branch);
+      if (retried.status !== 0) {
+        throw new MarketIndexError(`元数据没推上去：${tailOf(retried.stderr)}`, 'index-write');
+      }
+    }
+    const head = runGit(exec, workdir, ['rev-parse', 'HEAD']);
+    const headSha = head.status === 0 ? head.stdout.trim() : '';
+    const remoteHead = remoteHeadOf(exec, workdir, branch);
+    if (headSha === '' || remoteHead !== headSha) {
+      phase = 'remote-check';
+      throw new MarketIndexError(
+        `索引没推上去：远端 ${branch} 是 ${shortOf(remoteHead)}，本地是 ${shortOf(headSha)}`,
+        'git-market-pushed',
+      );
+    }
+    return { ...base, updated: true, version: latest, commit: indexSha, phase: 'done' };
+  } catch (error) {
+    return {
+      ...base,
+      updated: false,
+      phase,
+      code: error instanceof MarketIndexError ? error.step : undefined,
+      reason: messageOf(error),
+    };
+  }
+}
+
 function hasHead(exec, workdir) {
   return runGit(exec, workdir, ['rev-parse', '--verify', 'HEAD'], { allowFailure: true }).status === 0;
 }

package/src/release-publish.mjs

@@ -0,0 +1,169 @@
+import { existsSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { NeedsUser, ReleaseError, publishTagOf, tailOf } from './release-util.mjs';
+import { npmrcArgs } from './release-target.mjs';
+
+const REQUIRED_FILES = ['dist/host.js', 'client.js', 'cordis.patch.yml', 'package.json', 'CHANGELOG.md'];
+
+function parseJson(text) {
+  const raw = String(text ?? '');
+  const start = raw.search(/[[{]/);
+  if (start === -1) return undefined;
+  try {
+    return JSON.parse(raw.slice(start));
+  } catch {
+    return undefined;
+  }
+}
+
+function quote(value) {
+  const text = String(value);
+  return /[\s"'$`\\]/.test(text) ? `'${text.replace(/'/g, `'\\''`)}'` : text;
+}
+
+export function localFiles(exec, root) {
+  const result = exec(
+    'npm',
+    ['pack', '--dry-run', '--json', '--ignore-scripts', '--cache', join(tmpdir(), 'dsh-wb-npm-cache')],
+    { cwd: root, capture: true, allowFailure: true },
+  );
+  if (result.status !== 0) throw new ReleaseError(`核不了本地包内容：${tailOf(`${result.stdout}\n${result.stderr}`)}`);
+  const parsed = parseJson(result.stdout);
+  const first = Array.isArray(parsed) ? parsed[0] : parsed;
+  const files = Array.isArray(first?.files) ? first.files.map((one) => String(one.path ?? one)) : [];
+  if (files.length === 0) throw new ReleaseError('npm pack 没列出包内容');
+  return files;
+}
+
+export function checkPublished(files) {
+  const missing = REQUIRED_FILES.filter((one) => !files.includes(one));
+  if (missing.length > 0) throw new ReleaseError(`包里少了 ${missing.join(' / ')} —— 装上会起不来`);
+  const leaked = files.filter(
+    (one) => one.startsWith('src/') || one.endsWith('.npmrc') || one.startsWith('template') || one.includes('.env'),
+  );
+  if (leaked.length > 0) throw new ReleaseError(`包里混进了不该发的：${leaked.slice(0, 3).join('、')}`);
+}
+
+export function checkGitFiles(files) {
+  const missing = REQUIRED_FILES.filter((one) => !files.includes(one));
+  if (missing.length > 0) throw new ReleaseError(`tag 里少了 ${missing.join(' / ')} —— 装上会起不来`);
+  const leaked = files.filter((one) => one.endsWith('.npmrc') || one.includes('.env'));
+  if (leaked.length > 0) throw new ReleaseError(`tag 里混进了凭据文件：${leaked.slice(0, 3).join('、')}`);
+}
+
+export function registryExists(exec, info, name, version) {
+  const argv = ['view', `${name}@${version}`, 'version', '--json', '--registry', info.registry, ...npmrcArgs(info.npmrc)];
+  const result = exec('npm', argv, { capture: true, allowFailure: true });
+  if (result.status === 0) return true;
+  const text = `${result.stdout}\n${result.stderr}`;
+  if (/E404|404|No matching version|not found|不存在/i.test(text)) return false;
+  throw new ReleaseError(`查团队源失败（${info.registry}）：${tailOf(text)}`);
+}
+
+function publishArgsOf(info, version) {
+  const tag = publishTagOf(version);
+  return [
+    'publish',
+    '--registry',
+    info.registry,
+    '--access',
+    info.access,
+    '--ignore-scripts',
+    ...(tag === undefined ? [] : ['--tag', tag]),
+    ...npmrcArgs(info.npmrc),
+  ];
+}
+
+function otpCommandOf(root, info, version) {
+  const tag = publishTagOf(version);
+  return [
+    `cd ${quote(root)}`,
+    '&&',
+    'npm',
+    'publish',
+    '--registry',
+    info.registry,
+    '--access',
+    info.access,
+    '--ignore-scripts',
+    ...(tag === undefined ? [] : ['--tag', tag]),
+    ...npmrcArgs(info.npmrc),
+  ].join(' ');
+}
+
+export function publishRegistry(exec, root, info, manifest, version) {
+  const result = exec('npm', publishArgsOf(info, version), { cwd: root, capture: true, allowFailure: true });
+  if (result.status === 0) return;
+  const text = `${result.stdout}\n${result.stderr}`;
+  if (/EOTP|one-time password|OTP/i.test(text)) {
+    throw new NeedsUser(
+      'otp',
+      '源要求一次性验证码。构建和门禁都过了，请在终端跑下面这条，按提示输入验证码；完了跟我说「好了」，我来核对。',
+      otpCommandOf(root, info, version),
+      { target: info.target, name: manifest.name, version, registry: info.registry },
+    );
+  }
+  if (info.target === 'public' && /E403|403|taken|already exists|Forbidden|cannot publish over/i.test(text)) {
+    throw new NeedsUser('name', '这个名字在 npm 上已经被占了。换一个：`@<user>/<name>` 或加一个后缀？', undefined, {
+      target: info.target,
+      name: manifest.name,
+      version,
+    });
+  }
+  if (/E403|403|already exists|Forbidden/i.test(text)) {
+    throw new NeedsUser('scope', '团队源不让发这个包名（可能被占了，或没有权限）。让管理员确认 scope / 权限后跟我说。', undefined, {
+      target: info.target,
+      name: manifest.name,
+      version,
+    });
+  }
+  if (/E402|402|E404|404|scope|payment|not found/i.test(text)) {
+    throw new NeedsUser('scope', '团队源要求包名带 scope。用 `@<scope>/<name>` 吗？', undefined, {
+      target: info.target,
+      name: manifest.name,
+      version,
+    });
+  }
+  throw new ReleaseError(`npm publish 没过：${tailOf(text)}`);
+}
+
+export function verifyRegistry(exec, info, name, version) {
+  const view = exec(
+    'npm',
+    ['view', `${name}@${version}`, 'version', 'dist.tarball', '--json', '--registry', info.registry, ...npmrcArgs(info.npmrc)],
+    { capture: true, allowFailure: true },
+  );
+  if (view.status !== 0) {
+    throw new ReleaseError(`发完了，但在源上查不到 ${name}@${version} —— 去 registry 确认一下`);
+  }
+  const packed = exec(
+    'npm',
+    ['pack', `${name}@${version}`, '--dry-run', '--json', '--ignore-scripts', '--registry', info.registry, ...npmrcArgs(info.npmrc)],
+    { capture: true, allowFailure: true },
+  );
+  if (packed.status !== 0) throw new ReleaseError(`发完了，但核不了包：${tailOf(`${packed.stdout}\n${packed.stderr}`)}`);
+  const parsed = parseJson(packed.stdout);
+  const first = Array.isArray(parsed) ? parsed[0] : parsed;
+  const files = Array.isArray(first?.files) ? first.files.map((one) => String(one.path ?? one)) : [];
+  if (files.length === 0) throw new ReleaseError('发完了，但 npm pack 没列出包内容');
+  checkPublished(files);
+  return files;
+}
+
+export function packTarball(exec, info, version) {
+  mkdirSync(info.out, { recursive: true });
+  const result = exec(
+    'npm',
+    ['pack', '--json', '--ignore-scripts', '--pack-destination', info.out],
+    { capture: true, allowFailure: true },
+  );
+  if (result.status !== 0) throw new ReleaseError(`npm pack 没过：${tailOf(`${result.stdout}\n${result.stderr}`)}`);
+  const parsed = parseJson(result.stdout);
+  const first = Array.isArray(parsed) ? parsed[0] : parsed;
+  const filename = typeof first?.filename === 'string' ? first.filename : info.fileNameOf(version);
+  const file = join(info.out, filename);
+  if (!existsSync(file)) throw new ReleaseError(`npm pack 说生成了 ${filename}，但文件不在 ${info.out}`);
+  return file;
+}

package/src/release-target.mjs

@@ -0,0 +1,266 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+
+import {
+  NeedsUser,
+  ReleaseError,
+  argValue,
+  artifactsDirOf,
+  hasFlag,
+  normalizeRegistry,
+  tailOf,
+} from './release-util.mjs';
+
+const TARGETS = ['team', 'public', 'tarball', 'git', 'market', 'local'];
+const PUBLIC_REGISTRIES = ['https://registry.npmjs.org/', 'https://registry.npmmirror.com/'];
+
+function isPublicRegistry(registry) {
+  return PUBLIC_REGISTRIES.includes(normalizeRegistry(registry));
+}
+
+function findNpmrc(root) {
+  let dir = resolve(root);
+  for (;;) {
+    const file = join(dir, '.npmrc');
+    if (existsSync(file)) return file;
+    const parent = dirname(dir);
+    if (parent === dir) return undefined;
+    dir = parent;
+  }
+}
+
+function hasAuth(file) {
+  if (file === undefined) return false;
+  try {
+    return /(_authToken|_auth\s*=|always-auth)/i.test(readFileSync(file, 'utf8'));
+  } catch {
+    return false;
+  }
+}
+
+function registryInNpmrc(file, name) {
+  if (file === undefined) return '';
+  let general = '';
+  const scope = name.startsWith('@') ? name.slice(0, name.indexOf('/')) : '';
+  for (const raw of readFileSync(file, 'utf8').split('\n')) {
+    const line = raw.trim();
+    if (line === '' || line.startsWith('#') || line.startsWith(';')) continue;
+    const at = line.indexOf('=');
+    if (at === -1) continue;
+    const key = line.slice(0, at).trim();
+    const value = normalizeRegistry(line.slice(at + 1).trim());
+    if (value === '') continue;
+    if (scope !== '' && key === `${scope}:registry`) return value;
+    if (key === 'registry') general = value;
+  }
+  return general;
+}
+
+function configuredRegistry(root, manifest) {
+  const npmrc = findNpmrc(root);
+  return (
+    normalizeRegistry(process.env.DSH_WB_PUBLISH_REGISTRY) ||
+    normalizeRegistry(manifest.publishConfig?.registry) ||
+    registryInNpmrc(npmrc, String(manifest.name ?? ''))
+  );
+}
+
+export function targetOf(root, manifest, args, indexPlan) {
+  const asked = argValue(args, '--target');
+  if (asked !== undefined) {
+    if (!TARGETS.includes(asked)) throw new ReleaseError(`--target 只认 ${TARGETS.join(' / ')}`);
+    return asked;
+  }
+  if (hasFlag(args, '--public')) return 'public';
+  if (hasFlag(args, '--git') || argValue(args, '--git') !== undefined) return 'git';
+  if (argValue(args, '--out') !== undefined) return 'tarball';
+  const flagged = normalizeRegistry(argValue(args, '--registry'));
+  if (flagged !== '') return isPublicRegistry(flagged) ? 'public' : 'team';
+  if (indexPlan?.policy === 'artifacts-in-repo') return 'market';
+  const configured = configuredRegistry(root, manifest);
+  if (configured !== '') return isPublicRegistry(configured) ? 'public' : 'team';
+  return 'tarball';
+}
+
+function licenseFileOf(root) {
+  for (const name of ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING']) {
+    if (existsSync(join(root, name))) return name;
+  }
+  return undefined;
+}
+
+export function licenseOf(root, manifest, target, args) {
+  const given = argValue(args, '--license') ?? manifest.license;
+  if (typeof given === 'string' && given.trim() !== '') return given.trim();
+  const file = licenseFileOf(root);
+  if (file !== undefined) return `SEE LICENSE IN ${file}`;
+  if (target === 'public') {
+    throw new NeedsUser('license', '公开发布需要一个许可证。用 MIT、Apache-2.0，还是仓库里已有的 LICENSE？', undefined, {
+      target,
+    });
+  }
+  if (target === 'team') return 'UNLICENSED';
+  return undefined;
+}
+
+export function repositoryOf(root, exec) {
+  const result = exec('git', ['-C', root, 'remote', 'get-url', 'origin'], { capture: true, allowFailure: true });
+  const url = result.status === 0 ? result.stdout.trim() : '';
+  return url === '' ? undefined : { type: 'git', url };
+}
+
+function loginCommandOf(registry) {
+  return `npm login --registry ${registry}`;
+}
+
+export function npmrcArgs(npmrc) {
+  return npmrc === undefined ? [] : ['--userconfig', npmrc];
+}
+
+export function checkLogin(exec, info) {
+  const argv = ['whoami', '--registry', info.registry, ...npmrcArgs(info.npmrc)];
+  const result = exec('npm', argv, { capture: true, allowFailure: true });
+  if (result.status === 0) return;
+  const text = `${result.stdout}\n${result.stderr}`;
+  if (/E404|404|not found/i.test(text)) return;
+  if (/ENEEDAUTH|not logged in|401|Unauthorized|E401|E403|403/i.test(text)) {
+    throw new NeedsUser(
+      'login',
+      `${info.target === 'public' ? 'npm' : '团队源'}还没登录。请在终端跑 \`${loginCommandOf(info.registry)}\`，走完登录/验证器再跟我说「好了」，我接着发。`,
+      loginCommandOf(info.registry),
+      { target: info.target, registry: info.registry },
+    );
+  }
+  throw new ReleaseError(`连不上源（${info.registry}）：${tailOf(text)}`);
+}
+
+export function registryInfoOf(root, manifest, args, target, fallbackRegistry) {
+  const name = String(manifest.name ?? '');
+  const askedNpmrc = argValue(args, '--npmrc');
+  const sourceNpmrc = askedNpmrc === undefined ? findNpmrc(root) : resolve(askedNpmrc);
+  if (askedNpmrc !== undefined && !existsSync(sourceNpmrc)) {
+    throw new ReleaseError(`--npmrc 指的文件不存在：${sourceNpmrc}`);
+  }
+  const npmrc = askedNpmrc !== undefined ? sourceNpmrc : hasAuth(sourceNpmrc) ? sourceNpmrc : undefined;
+  const flagged = normalizeRegistry(argValue(args, '--registry'));
+  let registry;
+  if (target === 'public') {
+    registry = flagged || 'https://registry.npmjs.org/';
+    if (!isPublicRegistry(registry)) {
+      throw new ReleaseError('public 目标要公网源；团队私有源用 --target team');
+    }
+  } else {
+    registry =
+      flagged ||
+      normalizeRegistry(process.env.DSH_WB_PUBLISH_REGISTRY) ||
+      normalizeRegistry(manifest.publishConfig?.registry) ||
+      normalizeRegistry(fallbackRegistry) ||
+      registryInNpmrc(sourceNpmrc, name);
+    if (registry === '') {
+      throw new NeedsUser(
+        'registry',
+        '这个工坊还没配团队源。让公司把 registry 和 token 写进 `.npmrc`；或者我先给你打一个安装包。',
+        undefined,
+        { target },
+      );
+    }
+    if (isPublicRegistry(registry)) {
+      throw new ReleaseError('这个源是公共 npm —— 用 --target public 明确公开发布');
+    }
+  }
+  const access = argValue(args, '--access') ?? manifest.publishConfig?.access ?? (target === 'public' ? 'public' : 'restricted');
+  if (access !== 'restricted' && access !== 'public') {
+    throw new ReleaseError(`--access 只认 restricted / public（收到「${access}」）`);
+  }
+  if (target === 'public' && access !== 'public') throw new ReleaseError('public 目标只接受 --access public');
+  return { target, kind: 'registry', name, registry, access, npmrc };
+}
+
+function tarballInfoOf(root, manifest, args, home) {
+  const out = resolve(argValue(args, '--out') ?? artifactsDirOf(home, String(manifest.dsh?.workbench?.unit ?? '')));
+  const fileNameOf = (version) => `${String(manifest.name).replace(/^@/, '').replace(/[/\\]/g, '-')}-${version}.tgz`;
+  const fileOf = (version) => join(out, fileNameOf(version));
+  return {
+    target: 'tarball',
+    kind: 'tarball',
+    out,
+    fileNameOf,
+    fileOf,
+    exists: (version) => existsSync(fileOf(version)),
+  };
+}
+
+function gitInfoOf(root, manifest, args, exec) {
+  const unit = String(manifest.dsh?.workbench?.unit ?? '');
+  const top = exec('git', ['-C', root, 'rev-parse', '--show-toplevel'], { capture: true, allowFailure: true });
+  if (top.status !== 0) {
+    throw new NeedsUser(
+      'git-remote',
+      '这个模块目录还不是 git 仓库。先给它一个仓库/配好权限，或改打一个安装包。',
+      undefined,
+      { target: 'git' },
+    );
+  }
+  const toplevel = top.stdout.trim();
+  const branchResult = exec('git', ['-C', toplevel, 'rev-parse', '--abbrev-ref', 'HEAD'], {
+    capture: true,
+    allowFailure: true,
+  });
+  const branch = branchResult.status === 0 ? branchResult.stdout.trim() : '';
+  if (branch === '' || branch === 'HEAD') {
+    throw new NeedsUser('git-branch', '这个仓库现在不在一个分支上（detached HEAD）。先切回一个分支，再发。', undefined, {
+      target: 'git',
+    });
+  }
+  const remote = argValue(args, '--git') ?? 'origin';
+  const remoteResult = exec('git', ['-C', toplevel, 'remote', 'get-url', remote], { capture: true, allowFailure: true });
+  if (remoteResult.status !== 0 || remoteResult.stdout.trim() === '') {
+    throw new NeedsUser('git-remote', `这个仓库没有可推送的远端 ${remote}。先加一个远端，或改打一个安装包。`, undefined, {
+      target: 'git',
+      remote,
+    });
+  }
+  const url = remoteResult.stdout.trim();
+  const packagePath = relative(toplevel, root).split(sep).join('/') || '.';
+  const status = exec('git', ['-C', toplevel, 'status', '--porcelain', '--untracked-files=all'], {
+    capture: true,
+    allowFailure: true,
+  });
+  if (status.status !== 0) throw new ReleaseError(`读不了 git 状态：${tailOf(status.stderr)}`);
+  const prefix = packagePath === '.' ? '' : `${packagePath}/`;
+  const allowed = ['dist', 'client.js', 'cordis.patch.yml', 'package.json', 'README.md', 'CHANGELOG.md', 'design.json'];
+  const dirty = status.stdout
+    .trim()
+    .split('\n')
+    .filter((line) => line.trim() !== '')
+    .map((line) => line.slice(3).trim())
+    .filter((path) => {
+      if (!path.startsWith(prefix)) return true;
+      const rel = path.slice(prefix.length);
+      return !allowed.some((one) => rel === one || rel.startsWith(`${one}/`));
+    });
+  if (dirty.length > 0) {
+    throw new NeedsUser(
+      'git-dirty',
+      `工作区还有别的未提交改动（${dirty.slice(0, 3).join('、')}）。先提交/暂存，再发；或改用安装包。`,
+      undefined,
+      { target: 'git', paths: dirty.slice(0, 3) },
+    );
+  }
+  const tagOf = (version) => `${unit}@${version}`;
+  const exists = (version) =>
+    exec('git', ['-C', toplevel, 'rev-parse', '-q', '--verify', `refs/tags/${tagOf(version)}`], {
+      capture: true,
+      allowFailure: true,
+    }).status === 0;
+  return { target: 'git', kind: 'git', toplevel, branch, remote, url, packagePath, tagOf, exists };
+}
+
+export function targetInfoOf(root, manifest, args, home, exec, target, fallbackRegistry) {
+  if (target === 'team' || target === 'public') return registryInfoOf(root, manifest, args, target, fallbackRegistry);
+  if (target === 'tarball') return tarballInfoOf(root, manifest, args, home);
+  if (target === 'git') return gitInfoOf(root, manifest, args, exec);
+  return { target: 'local', kind: 'local' };
+}
+
+export { TARGETS };

package/src/release-util.mjs

@@ -1,5 +1,5 @@
 import { mkdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { execaSync } from 'execa';
 import semver from 'semver';
@@ -53,6 +53,29 @@ export function tailOf(text) {
     .join(' | ');
 }
 
+export function argValue(args, flag) {
+  const at = args.indexOf(flag);
+  return at === -1 ? undefined : args[at + 1];
+}
+
+export function hasFlag(args, flag) {
+  return args.includes(flag);
+}
+
+export function normalizeRegistry(url) {
+  const value = String(url ?? '').trim();
+  if (value === '') return '';
+  return value.endsWith('/') ? value : `${value}/`;
+}
+
+export function dshHomeOf(home) {
+  return home ?? process.env.DSH_HOME?.trim() ?? join(homedir(), '.dsh');
+}
+
+export function artifactsDirOf(home, unit) {
+  return join(dshHomeOf(home), 'workbench', 'artifacts', unit);
+}
+
 export function publishTagOf(version) {
   const prerelease = semver.prerelease(String(version ?? '').trim());
   if (prerelease === null) return undefined;

package/src/release.mjs

@@ -1,6 +1,5 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { homedir, tmpdir } from 'node:os';
-import { dirname, join, relative, resolve, sep } from 'node:path';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { isDeepStrictEqual } from 'node:util';
 import semver from 'semver';
@@ -19,10 +18,38 @@ import {
 } from './release-journal.mjs';
 import { emit, installOf, marketInstallOf, stateOf } from './release-report.mjs';
 import { authorChangeOf, changelogGateOf } from './release-changelog.mjs';
-import { NeedsUser, ReleaseError, ResumableError, defaultExec, publishTagOf, tailOf } from './release-util.mjs';
+import {
+  NeedsUser,
+  ReleaseError,
+  ResumableError,
+  argValue,
+  defaultExec,
+  dshHomeOf,
+  hasFlag,
+  tailOf,
+} from './release-util.mjs';
+import {
+  TARGETS,
+  checkLogin,
+  licenseOf,
+  repositoryOf,
+  targetInfoOf,
+  targetOf,
+} from './release-target.mjs';
+import {
+  checkGitFiles,
+  checkPublished,
+  localFiles,
+  packTarball,
+  publishRegistry,
+  registryExists,
+  verifyRegistry,
+} from './release-publish.mjs';
 import {
   MarketIndexError,
+  identityOf,
   marketVersionExists,
+  refreshMarketEntry,
   resolveIndexPlan,
   updateMarketIndex,
   verifyMarketArtifact,
@@ -32,34 +59,6 @@ export { NeedsUser, ReleaseError, ResumableError };
 
 const CLI = fileURLToPath(new URL('../bin/dsh-wb-module.mjs', import.meta.url));
 const SCRIPTS = ['typecheck', 'test', 'selfcheck'];
-const TARGETS = ['team', 'public', 'tarball', 'git', 'market', 'local'];
-const PUBLIC_REGISTRIES = ['https://registry.npmjs.org/', 'https://registry.npmmirror.com/'];
-const REQUIRED_FILES = ['dist/host.js', 'client.js', 'cordis.patch.yml', 'package.json', 'CHANGELOG.md'];
-
-function argValue(args, flag) {
-  const at = args.indexOf(flag);
-  return at === -1 ? undefined : args[at + 1];
-}
-
-function hasFlag(args, flag) {
-  return args.includes(flag);
-}
-
-function parseJson(text) {
-  const raw = String(text ?? '');
-  const start = raw.search(/[[{]/);
-  if (start === -1) return undefined;
-  try {
-    return JSON.parse(raw.slice(start));
-  } catch {
-    return undefined;
-  }
-}
-
-function quote(value) {
-  const text = String(value);
-  return /[\s"'$`\\]/.test(text) ? `'${text.replace(/'/g, `'\\''`)}'` : text;
-}
 
 function readManifest(root) {
   const file = join(root, 'package.json');
@@ -80,115 +79,6 @@ function writeManifest(root, manifest) {
   writeFileSync(join(root, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`);
 }
 
-function dshHomeOf(home) {
-  return home ?? process.env.DSH_HOME?.trim() ?? join(homedir(), '.dsh');
-}
-
-function artifactsDirOf(home, unit) {
-  return join(dshHomeOf(home), 'workbench', 'artifacts', unit);
-}
-
-function normalizeRegistry(url) {
-  const value = String(url ?? '').trim();
-  if (value === '') return '';
-  return value.endsWith('/') ? value : `${value}/`;
-}
-
-function isPublicRegistry(registry) {
-  return PUBLIC_REGISTRIES.includes(normalizeRegistry(registry));
-}
-
-function findNpmrc(root) {
-  let dir = resolve(root);
-  for (;;) {
-    const file = join(dir, '.npmrc');
-    if (existsSync(file)) return file;
-    const parent = dirname(dir);
-    if (parent === dir) return undefined;
-    dir = parent;
-  }
-}
-
-function hasAuth(file) {
-  if (file === undefined) return false;
-  try {
-    return /(_authToken|_auth\s*=|always-auth)/i.test(readFileSync(file, 'utf8'));
-  } catch {
-    return false;
-  }
-}
-
-function registryInNpmrc(file, name) {
-  if (file === undefined) return '';
-  let general = '';
-  const scope = name.startsWith('@') ? name.slice(0, name.indexOf('/')) : '';
-  for (const raw of readFileSync(file, 'utf8').split('\n')) {
-    const line = raw.trim();
-    if (line === '' || line.startsWith('#') || line.startsWith(';')) continue;
-    const at = line.indexOf('=');
-    if (at === -1) continue;
-    const key = line.slice(0, at).trim();
-    const value = normalizeRegistry(line.slice(at + 1).trim());
-    if (value === '') continue;
-    if (scope !== '' && key === `${scope}:registry`) return value;
-    if (key === 'registry') general = value;
-  }
-  return general;
-}
-
-function configuredRegistry(root, manifest) {
-  const npmrc = findNpmrc(root);
-  return (
-    normalizeRegistry(process.env.DSH_WB_PUBLISH_REGISTRY) ||
-    normalizeRegistry(manifest.publishConfig?.registry) ||
-    registryInNpmrc(npmrc, String(manifest.name ?? ''))
-  );
-}
-
-function targetOf(root, manifest, args, indexPlan) {
-  const asked = argValue(args, '--target');
-  if (asked !== undefined) {
-    if (!TARGETS.includes(asked)) throw new ReleaseError(`--target 只认 ${TARGETS.join(' / ')}`);
-    return asked;
-  }
-  if (hasFlag(args, '--public')) return 'public';
-  if (hasFlag(args, '--git') || argValue(args, '--git') !== undefined) return 'git';
-  if (argValue(args, '--out') !== undefined) return 'tarball';
-  const flagged = normalizeRegistry(argValue(args, '--registry'));
-  if (flagged !== '') return isPublicRegistry(flagged) ? 'public' : 'team';
-  if (indexPlan?.policy === 'artifacts-in-repo') return 'market';
-  const configured = configuredRegistry(root, manifest);
-  if (configured !== '') return isPublicRegistry(configured) ? 'public' : 'team';
-  return 'tarball';
-}
-
-function licenseFileOf(root) {
-  for (const name of ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING']) {
-    if (existsSync(join(root, name))) return name;
-  }
-  return undefined;
-}
-
-function licenseOf(root, manifest, target, args) {
-  const given = argValue(args, '--license') ?? manifest.license;
-  if (typeof given === 'string' && given.trim() !== '') return given.trim();
-  const file = licenseFileOf(root);
-  if (file !== undefined) return `SEE LICENSE IN ${file}`;
-  if (target === 'public') {
-    throw new NeedsUser('license', '公开发布需要一个许可证。用 MIT、Apache-2.0，还是仓库里已有的 LICENSE？', undefined, {
-      target,
-    });
-  }
-  if (target === 'team') return 'UNLICENSED';
-  return undefined;
-}
-
-function repositoryOf(root, exec) {
-  const result = exec('git', ['-C', root, 'remote', 'get-url', 'origin'], { capture: true, allowFailure: true });
-  const url = result.status === 0 ? result.stdout.trim() : '';
-  return url === '' ? undefined : { type: 'git', url };
-}
-
 function bumpVersion(version, kind) {
   const next = semver.inc(String(version), kind);
   if (next === null) throw new ReleaseError(`当前版本号读不出来：${String(version)}`);
@@ -212,160 +102,6 @@ function nextVersion(current, asked, exists) {
   throw new ReleaseError('版本号没法自动加 —— 手动给 --version');
 }
 
-function loginCommandOf(registry) {
-  return `npm login --registry ${registry}`;
-}
-
-function npmrcArgs(npmrc) {
-  return npmrc === undefined ? [] : ['--userconfig', npmrc];
-}
-
-function checkLogin(exec, info) {
-  const argv = ['whoami', '--registry', info.registry, ...npmrcArgs(info.npmrc)];
-  const result = exec('npm', argv, { capture: true, allowFailure: true });
-  if (result.status === 0) return;
-  const text = `${result.stdout}\n${result.stderr}`;
-  if (/E404|404|not found/i.test(text)) return;
-  if (/ENEEDAUTH|not logged in|401|Unauthorized|E401|E403|403/i.test(text)) {
-    throw new NeedsUser(
-      'login',
-      `${info.target === 'public' ? 'npm' : '团队源'}还没登录。请在终端跑 \`${loginCommandOf(info.registry)}\`，走完登录/验证器再跟我说「好了」，我接着发。`,
-      loginCommandOf(info.registry),
-      { target: info.target, registry: info.registry },
-    );
-  }
-  throw new ReleaseError(`连不上源（${info.registry}）：${tailOf(text)}`);
-}
-
-function registryInfoOf(root, manifest, args, target, fallbackRegistry) {
-  const name = String(manifest.name ?? '');
-  const askedNpmrc = argValue(args, '--npmrc');
-  const sourceNpmrc = askedNpmrc === undefined ? findNpmrc(root) : resolve(askedNpmrc);
-  if (askedNpmrc !== undefined && !existsSync(sourceNpmrc)) {
-    throw new ReleaseError(`--npmrc 指的文件不存在：${sourceNpmrc}`);
-  }
-  const npmrc = askedNpmrc !== undefined ? sourceNpmrc : hasAuth(sourceNpmrc) ? sourceNpmrc : undefined;
-  const flagged = normalizeRegistry(argValue(args, '--registry'));
-  let registry;
-  if (target === 'public') {
-    registry = flagged || 'https://registry.npmjs.org/';
-    if (!isPublicRegistry(registry)) {
-      throw new ReleaseError('public 目标要公网源；团队私有源用 --target team');
-    }
-  } else {
-    registry =
-      flagged ||
-      normalizeRegistry(process.env.DSH_WB_PUBLISH_REGISTRY) ||
-      normalizeRegistry(manifest.publishConfig?.registry) ||
-      normalizeRegistry(fallbackRegistry) ||
-      registryInNpmrc(sourceNpmrc, name);
-    if (registry === '') {
-      throw new NeedsUser(
-        'registry',
-        '这个工坊还没配团队源。让公司把 registry 和 token 写进 `.npmrc`；或者我先给你打一个安装包。',
-        undefined,
-        { target },
-      );
-    }
-    if (isPublicRegistry(registry)) {
-      throw new ReleaseError('这个源是公共 npm —— 用 --target public 明确公开发布');
-    }
-  }
-  const access = argValue(args, '--access') ?? manifest.publishConfig?.access ?? (target === 'public' ? 'public' : 'restricted');
-  if (access !== 'restricted' && access !== 'public') {
-    throw new ReleaseError(`--access 只认 restricted / public（收到「${access}」）`);
-  }
-  if (target === 'public' && access !== 'public') throw new ReleaseError('public 目标只接受 --access public');
-  return { target, kind: 'registry', name, registry, access, npmrc };
-}
-
-function tarballInfoOf(root, manifest, args, home) {
-  const out = resolve(argValue(args, '--out') ?? artifactsDirOf(home, String(manifest.dsh?.workbench?.unit ?? '')));
-  const fileNameOf = (version) => `${String(manifest.name).replace(/^@/, '').replace(/[/\\]/g, '-')}-${version}.tgz`;
-  const fileOf = (version) => join(out, fileNameOf(version));
-  return {
-    target: 'tarball',
-    kind: 'tarball',
-    out,
-    fileNameOf,
-    fileOf,
-    exists: (version) => existsSync(fileOf(version)),
-  };
-}
-
-function gitInfoOf(root, manifest, args, exec) {
-  const unit = String(manifest.dsh?.workbench?.unit ?? '');
-  const top = exec('git', ['-C', root, 'rev-parse', '--show-toplevel'], { capture: true, allowFailure: true });
-  if (top.status !== 0) {
-    throw new NeedsUser(
-      'git-remote',
-      '这个模块目录还不是 git 仓库。先给它一个仓库/配好权限，或改打一个安装包。',
-      undefined,
-      { target: 'git' },
-    );
-  }
-  const toplevel = top.stdout.trim();
-  const branchResult = exec('git', ['-C', toplevel, 'rev-parse', '--abbrev-ref', 'HEAD'], {
-    capture: true,
-    allowFailure: true,
-  });
-  const branch = branchResult.status === 0 ? branchResult.stdout.trim() : '';
-  if (branch === '' || branch === 'HEAD') {
-    throw new NeedsUser('git-branch', '这个仓库现在不在一个分支上（detached HEAD）。先切回一个分支，再发。', undefined, {
-      target: 'git',
-    });
-  }
-  const remote = argValue(args, '--git') ?? 'origin';
-  const remoteResult = exec('git', ['-C', toplevel, 'remote', 'get-url', remote], { capture: true, allowFailure: true });
-  if (remoteResult.status !== 0 || remoteResult.stdout.trim() === '') {
-    throw new NeedsUser('git-remote', `这个仓库没有可推送的远端 ${remote}。先加一个远端，或改打一个安装包。`, undefined, {
-      target: 'git',
-      remote,
-    });
-  }
-  const url = remoteResult.stdout.trim();
-  const packagePath = relative(toplevel, root).split(sep).join('/') || '.';
-  const status = exec('git', ['-C', toplevel, 'status', '--porcelain', '--untracked-files=all'], {
-    capture: true,
-    allowFailure: true,
-  });
-  if (status.status !== 0) throw new ReleaseError(`读不了 git 状态：${tailOf(status.stderr)}`);
-  const prefix = packagePath === '.' ? '' : `${packagePath}/`;
-  const allowed = ['dist', 'client.js', 'cordis.patch.yml', 'package.json', 'README.md', 'CHANGELOG.md', 'design.json'];
-  const dirty = status.stdout
-    .trim()
-    .split('\n')
-    .filter((line) => line.trim() !== '')
-    .map((line) => line.slice(3).trim())
-    .filter((path) => {
-      if (!path.startsWith(prefix)) return true;
-      const rel = path.slice(prefix.length);
-      return !allowed.some((one) => rel === one || rel.startsWith(`${one}/`));
-    });
-  if (dirty.length > 0) {
-    throw new NeedsUser(
-      'git-dirty',
-      `工作区还有别的未提交改动（${dirty.slice(0, 3).join('、')}）。先提交/暂存，再发；或改用安装包。`,
-      undefined,
-      { target: 'git', paths: dirty.slice(0, 3) },
-    );
-  }
-  const tagOf = (version) => `${unit}@${version}`;
-  const exists = (version) =>
-    exec('git', ['-C', toplevel, 'rev-parse', '-q', '--verify', `refs/tags/${tagOf(version)}`], {
-      capture: true,
-      allowFailure: true,
-    }).status === 0;
-  return { target: 'git', kind: 'git', toplevel, branch, remote, url, packagePath, tagOf, exists };
-}
-
-function targetInfoOf(root, manifest, args, home, exec, target, fallbackRegistry) {
-  if (target === 'team' || target === 'public') return registryInfoOf(root, manifest, args, target, fallbackRegistry);
-  if (target === 'tarball') return tarballInfoOf(root, manifest, args, home);
-  if (target === 'git') return gitInfoOf(root, manifest, args, exec);
-  return { target: 'local', kind: 'local' };
-}
-
 function stage(exec, command, argv, { cwd, capture, err, label }) {
   const result = exec(command, argv, { cwd, capture, allowFailure: true });
   if (result.status === 0) return result;
@@ -392,167 +128,55 @@ function runGate(exec, root, options) {
   for (const script of SCRIPTS) runScriptStage(exec, root, script, options);
 }
 
-function localFiles(exec, root) {
-  const result = exec(
-    'npm',
-    ['pack', '--dry-run', '--json', '--ignore-scripts', '--cache', join(tmpdir(), 'dsh-wb-npm-cache')],
-    { cwd: root, capture: true, allowFailure: true },
-  );
-  if (result.status !== 0) throw new ReleaseError(`核不了本地包内容：${tailOf(`${result.stdout}\n${result.stderr}`)}`);
-  const parsed = parseJson(result.stdout);
-  const first = Array.isArray(parsed) ? parsed[0] : parsed;
-  const files = Array.isArray(first?.files) ? first.files.map((one) => String(one.path ?? one)) : [];
-  if (files.length === 0) throw new ReleaseError('npm pack 没列出包内容');
-  return files;
-}
-
-function checkPublished(files) {
-  const missing = REQUIRED_FILES.filter((one) => !files.includes(one));
-  if (missing.length > 0) throw new ReleaseError(`包里少了 ${missing.join(' / ')} —— 装上会起不来`);
-  const leaked = files.filter(
-    (one) => one.startsWith('src/') || one.endsWith('.npmrc') || one.startsWith('template') || one.includes('.env'),
-  );
-  if (leaked.length > 0) throw new ReleaseError(`包里混进了不该发的：${leaked.slice(0, 3).join('、')}`);
-}
-
-function checkGitFiles(files) {
-  const missing = REQUIRED_FILES.filter((one) => !files.includes(one));
-  if (missing.length > 0) throw new ReleaseError(`tag 里少了 ${missing.join(' / ')} —— 装上会起不来`);
-  const leaked = files.filter((one) => one.endsWith('.npmrc') || one.includes('.env'));
-  if (leaked.length > 0) throw new ReleaseError(`tag 里混进了凭据文件：${leaked.slice(0, 3).join('、')}`);
+function gitPathsOf(info) {
+  const prefix = info.packagePath === '.' ? '' : `${info.packagePath}/`;
+  return ['dist', 'client.js', 'cordis.patch.yml', 'package.json', 'README.md', 'CHANGELOG.md', 'design.json']
+    .map((one) => `${prefix}${one}`)
+    .filter((one) => existsSync(join(info.toplevel, one)));
 }
 
-function registryExists(exec, info, name, version) {
-  const argv = ['view', `${name}@${version}`, 'version', '--json', '--registry', info.registry, ...npmrcArgs(info.npmrc)];
-  const result = exec('npm', argv, { capture: true, allowFailure: true });
-  if (result.status === 0) return true;
-  const text = `${result.stdout}\n${result.stderr}`;
-  if (/E404|404|No matching version|not found|不存在/i.test(text)) return false;
-  throw new ReleaseError(`查团队源失败（${info.registry}）：${tailOf(text)}`);
-}
+const MESSAGE_FILES = ['src/messages.ts', 'src/messages.tsx', 'src/messages.mjs', 'src/messages.js'];
 
-function publishArgsOf(info, version) {
-  const tag = publishTagOf(version);
-  return [
-    'publish',
-    '--registry',
-    info.registry,
-    '--access',
-    info.access,
-    '--ignore-scripts',
-    ...(tag === undefined ? [] : ['--tag', tag]),
-    ...npmrcArgs(info.npmrc),
-  ];
+function titleIn(segment, key) {
+  const quoted = `['"\`]${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}['"\`]`;
+  const match = new RegExp(`${quoted}\\s*:\\s*['"\`]([^'"\`]*)['"\`]`).exec(segment);
+  return match === null ? '' : match[1].trim();
 }
 
-function otpCommandOf(root, info, version) {
-  const tag = publishTagOf(version);
-  return [
-    `cd ${quote(root)}`,
-    '&&',
-    'npm',
-    'publish',
-    '--registry',
-    info.registry,
-    '--access',
-    info.access,
-    '--ignore-scripts',
-    ...(tag === undefined ? [] : ['--tag', tag]),
-    ...npmrcArgs(info.npmrc),
-  ].join(' ');
-}
-
-function publishRegistry(exec, root, info, manifest, version) {
-  const result = exec('npm', publishArgsOf(info, version), { cwd: root, capture: true, allowFailure: true });
-  if (result.status === 0) return;
-  const text = `${result.stdout}\n${result.stderr}`;
-  if (/EOTP|one-time password|OTP/i.test(text)) {
-    throw new NeedsUser(
-      'otp',
-      '源要求一次性验证码。构建和门禁都过了，请在终端跑下面这条，按提示输入验证码；完了跟我说「好了」，我来核对。',
-      otpCommandOf(root, info, version),
-      { target: info.target, name: manifest.name, version, registry: info.registry },
-    );
-  }
-  if (info.target === 'public' && /E403|403|taken|already exists|Forbidden|cannot publish over/i.test(text)) {
-    throw new NeedsUser('name', '这个名字在 npm 上已经被占了。换一个：`@<user>/<name>` 或加一个后缀？', undefined, {
-      target: info.target,
-      name: manifest.name,
-      version,
-    });
-  }
-  if (/E403|403|already exists|Forbidden/i.test(text)) {
-    throw new NeedsUser('scope', '团队源不让发这个包名（可能被占了，或没有权限）。让管理员确认 scope / 权限后跟我说。', undefined, {
-      target: info.target,
-      name: manifest.name,
-      version,
-    });
-  }
-  if (/E402|402|E404|404|scope|payment|not found/i.test(text)) {
-    throw new NeedsUser('scope', '团队源要求包名带 scope。用 `@<scope>/<name>` 吗？', undefined, {
-      target: info.target,
-      name: manifest.name,
-      version,
-    });
-  }
-  throw new ReleaseError(`npm publish 没过：${tailOf(text)}`);
-}
-
-function verifyRegistry(exec, info, name, version) {
-  const view = exec(
-    'npm',
-    ['view', `${name}@${version}`, 'version', 'dist.tarball', '--json', '--registry', info.registry, ...npmrcArgs(info.npmrc)],
-    { capture: true, allowFailure: true },
-  );
-  if (view.status !== 0) {
-    throw new ReleaseError(`发完了，但在源上查不到 ${name}@${version} —— 去 registry 确认一下`);
+export function cardTitleFromMessages(root, unit) {
+  if (unit === '') return undefined;
+  const key = `${unit}.cardTitle`;
+  for (const file of MESSAGE_FILES) {
+    let text;
+    try {
+      text = readFileSync(join(root, file), 'utf8');
+    } catch {
+      continue;
+    }
+    const zhAt = text.search(/\bzh\s*:/);
+    const enAt = text.search(/\ben\s*:/);
+    const zh = zhAt === -1 ? '' : titleIn(text.slice(zhAt, enAt === -1 ? text.length : enAt), key);
+    const en = enAt === -1 ? '' : titleIn(text.slice(enAt), key);
+    if (zh === '' && en === '') continue;
+    return { ...(zh === '' ? {} : { zh }), ...(en === '' ? {} : { en }) };
   }
-  const packed = exec(
-    'npm',
-    ['pack', `${name}@${version}`, '--dry-run', '--json', '--ignore-scripts', '--registry', info.registry, ...npmrcArgs(info.npmrc)],
-    { capture: true, allowFailure: true },
-  );
-  if (packed.status !== 0) throw new ReleaseError(`发完了，但核不了包：${tailOf(`${packed.stdout}\n${packed.stderr}`)}`);
-  const parsed = parseJson(packed.stdout);
-  const first = Array.isArray(parsed) ? parsed[0] : parsed;
-  const files = Array.isArray(first?.files) ? first.files.map((one) => String(one.path ?? one)) : [];
-  if (files.length === 0) throw new ReleaseError('发完了，但 npm pack 没列出包内容');
-  checkPublished(files);
-  return files;
-}
-
-function packTarball(exec, info, version) {
-  mkdirSync(info.out, { recursive: true });
-  const result = exec(
-    'npm',
-    ['pack', '--json', '--ignore-scripts', '--pack-destination', info.out],
-    { capture: true, allowFailure: true },
-  );
-  if (result.status !== 0) throw new ReleaseError(`npm pack 没过：${tailOf(`${result.stdout}\n${result.stderr}`)}`);
-  const parsed = parseJson(result.stdout);
-  const first = Array.isArray(parsed) ? parsed[0] : parsed;
-  const filename = typeof first?.filename === 'string' ? first.filename : info.fileNameOf(version);
-  const file = join(info.out, filename);
-  if (!existsSync(file)) throw new ReleaseError(`npm pack 说生成了 ${filename}，但文件不在 ${info.out}`);
-  return file;
-}
-
-function gitPathsOf(info) {
-  const prefix = info.packagePath === '.' ? '' : `${info.packagePath}/`;
-  return ['dist', 'client.js', 'cordis.patch.yml', 'package.json', 'README.md', 'CHANGELOG.md', 'design.json']
-    .map((one) => `${prefix}${one}`)
-    .filter((one) => existsSync(join(info.toplevel, one)));
+  return undefined;
 }
 
-function gitCommitOf(exec, info, version, capture, progress = {}) {
+function gitCommitOf(exec, info, version, capture, progress = {}, identity) {
   const add = exec('git', ['-C', info.toplevel, 'add', '-f', '--', ...gitPathsOf(info)], {
     capture,
     allowFailure: true,
   });
   if (add.status !== 0) throw new ReleaseError(`git add 没过：${tailOf(`${add.stdout}\n${add.stderr}`)}`);
+  const who = [];
+  if (identity !== undefined) {
+    who.push('-c', `user.name=${identity.name}`);
+    if (identity.email !== undefined) who.push('-c', `user.email=${identity.email}`);
+  }
   const commit = exec(
     'git',
-    ['-C', info.toplevel, 'commit', '-m', `chore(release): ${info.tagOf(version)}`],
+    ['-C', info.toplevel, ...who, 'commit', '-m', `chore(release): ${info.tagOf(version)}`],
     { capture, allowFailure: true },
   );
   if (commit.status !== 0) throw new ReleaseError(`git commit 没过：${tailOf(`${commit.stdout}\n${commit.stderr}`)}`);
@@ -681,6 +305,40 @@ export async function runRelease({
       throw new ReleaseError('这个索引源是 catalog-only：它只收目录、不放产物。用 --index-policy artifacts-in-repo 或换一个可写仓库');
     }
   }
+  if (hasFlag(args, '--refresh')) {
+    if (dryRun) throw new ReleaseError('--refresh 没有预览：它只改索引里的标题 / 作者 / 说明');
+    if (target !== 'market') throw new ReleaseError('--refresh 只对市场索引有意义（--target market）');
+    if (indexPlan === undefined) {
+      throw new ReleaseError('没有可写的 git 索引源 —— 用 --index <仓库> 指定，或先在「模块市场 → 发现」里初始化索引');
+    }
+    const cardTitle = cardTitleFromMessages(root, unit);
+    const titled = cardTitle === undefined ? manifest : { ...manifest, title: cardTitle };
+    const result = refreshMarketEntry({ plan: indexPlan, exec, home, manifest: titled });
+    if (result.updated !== true && result.reason !== undefined) {
+      throw new ReleaseError(`刷新市集元数据没走通：${result.reason}`);
+    }
+    const summary = {
+      ok: true,
+      target: 'market',
+      refresh: true,
+      name: manifest.name,
+      version: result.version ?? manifest.version,
+      refreshed: result.updated === true,
+      market: {
+        url: indexPlan.source.url,
+        ...(result.branch === undefined ? {} : { branch: result.branch }),
+        ...(result.commit === undefined ? {} : { commit: result.commit }),
+      },
+      changes: result.updated === true ? ['市集元数据已刷新'] : [],
+      install: '',
+      text:
+        result.updated === true
+          ? `已刷新 ${manifest.name} 的市集元数据（版本 ${result.version ?? manifest.version} 不变）`
+          : `${manifest.name} 的市集元数据本来就是这样，没动`,
+    };
+    emit(out, json, summary);
+    return summary;
+  }
   const authored = authorChangeOf(root, manifest, exec);
   const authorChange = authored.change;
   if (!verify && !dryRun && authored.author !== undefined) {
@@ -971,10 +629,12 @@ export async function runRelease({
     if (!resumeMatchesTree) runCliStage(exec, root, ['check'], stageOptions);
     if (tracking) advanceRun(home, unit, { phase: 'version', version });
     const next = { ...manifest, version };
+    const cardTitle = cardTitleFromMessages(root, unit);
+    const titled = cardTitle === undefined ? next : { ...next, title: cardTitle };
     const index = updateMarketIndex({
       plan: indexPlan,
       root,
-      manifest: next,
+      manifest: titled,
       unit,
       version,
       publish: {},
@@ -1102,7 +762,7 @@ export async function runRelease({
     writeState(home, unit, stateOf(info, next, version, 'intent'));
     const progress = { committed: false };
     try {
-      const commit = gitCommitOf(exec, info, version, capture, progress);
+      const commit = gitCommitOf(exec, info, version, capture, progress, identityOf(next));
       writeState(home, unit, { ...stateOf(info, next, version, 'committed'), commit });
       gitPushOf(exec, info, version, capture);
       const checked = verifyGit(exec, info, version);