@dsh-workbench/module-tools 1.1.0 → 1.1.2

package/README.md

@@ -19,15 +19,24 @@ pnpm design check # 设计底稿有没有空格、README 有没有落后
 最后从出口侧核包（`--dry-run` 只预览，`--verify` 只核已发布的包）。配了可写 git 索引源时，
 发完还会更新 `market.json`（`--index auto|none|<目录|git 地址>`，`artifacts-in-repo` 连产物一起入库，
 `catalog-only` 只更索引）；索引没更上不影响包已发布这件事，结果里会如实写。
+发布可选 `--index-source <id>` 指定发到哪个索引源；不指定时用唯一可发布的源，有多个可发布源会要求指定。
 空仓库先跑 `dsh-wb-module market-init <git 地址>`：生成 `market.json` 与 README 并推首个 commit
 （用仓库声明的默认分支，读不到时用 `--ref` 指定）。在工作台里配了可写索引源之后，
 `release` 默认出口就是 `market`：产物与索引一起进那个仓库。
 发布过程中每一步都写进 `~/.dsh/workbench/releases/<unit>.json`；中断后带 `--resume` 接着发
 （沿用记录里的出口、版本与索引计划，产物没变就不重跑门禁）。
-这一版在 `CHANGELOG.md` 里没有记录、或 `package.json` 缺 `files` 里的 `CHANGELOG.md` 时，
-`release` 直接拦下并给出补的命令；`author` 没写时从本机 `git config` 补进 manifest，索引与产物都带上。
+这一版在 `CHANGELOG.md` 里没有记录时，带 `--changelog-note "这一版改了什么"`
+（`--changelog-type` 选分类，缺省 changed）发一次就写进去，文件不在会先建骨架；
+没带 note 又没记录时 `release` 在跑任何门禁之前就拦下。
+日志写在确认之后，发失败不回滚：这一版已经记下了，下一次发布直接用。
+`package.json` 缺 `files` 里的 `CHANGELOG.md` 一样拦下；`author` 没写时从本机 `git config` 补进 manifest，索引与产物都带上。
+模块的 `package.json` 可用 `dsh.workbench.market` 声明 `category` 与 `labels`（字符串数组）；
+不写就不带分类和标签，索引里只留 `metadata.workbench: true` 这条身份标记。
 要换署名时带 `--author "姓名 <邮箱>"`（或只给姓名）：它写回 `package.json`，索引、产物与提交都用它，
-`--refresh` 时也一样。
+`--refresh` 时也一样。一个包名归第一次发布的人（`market.json` 里的 `owner`）：换署名发同名会被拒，
+`--refresh` 也一样 —— 真要换人，先改那一条的 `owner`。
+同一个市场里，一个模块 id（`dsh.workbench.unit`）只能被一个条目使用；产物目录按包名走
+（`packages/<包名>/`）：换一个包名沿用旧 unit、或两个条目撞同一个 id / 目录，都会被拒。
 
 骨架自带脚本，日常不用记长命令：`build` · `typecheck` · `test` · `selfcheck` · `check` · `lint` · `design`。
 
@@ -42,7 +51,7 @@ pnpm design check # 设计底稿有没有空格、README 有没有落后
 | `dsh-wb-module lint [--fix]` | 用模块自己那份 `eslint.config.mjs`；`--fix` 写回文件 |
 | `dsh-wb-module sync` | 按清单生成 `src/declared-tools.ts`，按 `design.json` 的 `key + recipe` 生成 `src/datasource.ts` |
 | `dsh-wb-module design <init\|check\|render\|accept>` | 设计底稿：填、查空格、生成 README、验收打勾 |
-| `dsh-wb-module changelog <init\|add\|check>` | 更新日志：建 `CHANGELOG.md`、记一版、查这一版有没有；`release` 要求当前版本必须有记录 |
+| `dsh-wb-module changelog check [版本]` | 查这一版有没有记录；发布时用 `release --changelog-note` 写进去 |
 | `dsh-wb-module publish` | 发货前清单：门禁 + `files` + `npm pack`（只 dry run） |
 | `dsh-wb-module release` | 真发布：team / public / tarball / git；全门禁 + 验收闸 + 预检接管 + 发后核包 + 更新市场索引（`--dry-run` / `--verify`） |
 

package/bin/dsh-wb-module.mjs

@@ -61,8 +61,10 @@ const RELEASE_HELP = `
   --registry <url> --access restricted|public --npmrc <文件>
   --license <id> --out <目录> --git <remote>
   --author <署名>                                       换署名（姓名，或 姓名 <邮箱>）；写回 package.json
+  --changelog-note <文字> --changelog-type added|changed|fixed|removed|security|deprecated
+                                                        这一版还没有更新日志时写进 CHANGELOG.md（文件不在先建）
   --index auto|none|<目录|git 地址>                     发布后要更新的索引源
-  --index-ref <分支> --index-path <索引路径> --index-policy artifacts-in-repo|catalog-only
+  --index-source <id> --index-ref <分支> --index-path <索引路径> --index-policy artifacts-in-repo|catalog-only
   --resume                                              上次中断后接着发（用记录里的出口与版本）
   --dry-run --verify --yes --json`;
 
@@ -75,11 +77,10 @@ const MARKET_INIT_HELP = `
 
 const CHANGELOG_HELP = `
 用法：
-  changelog init
-  changelog add [版本] [--type added|changed|fixed|removed|security|deprecated] [--note <文字>] [--date <日期>]
   changelog check [版本] [--json]
 
-版本省略时用 package.json 里的 version。发布时这一版必须在 CHANGELOG.md 里有记录，否则 release 会拦下。`;
+版本省略时用 package.json 里的 version。发布时这一版必须有记录：
+release --changelog-note "这一版改了什么"（文件不在会先建）。`;
 
 const COMMANDS = {
   build: '出 dist/host.js（单文件 ESM）与 client.js（套 loader 壳）',
@@ -91,7 +92,7 @@ const COMMANDS = {
   release: '真发布：全门禁 + 验收闸 + 预检接管 + 发到出口 + 发后核包 + 更新市场索引（中断可 --resume）',
   sync: '按清单生成 src/declared-tools.ts，按 design.json 生成 src/datasource.ts',
   lint: '用模块自己那份 eslint.config.mjs；--fix 写回文件',
-  changelog: '更新日志：init 建 / add 记一版 / check 查这一版有没有（发布前必须有）',
+  changelog: '更新日志：check 查这一版有没有；发布时用 release --changelog-note 写进去',
 };
 
 function flagValue(raw, flag) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-workbench/module-tools",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "模块包的构建与门禁工具：build（单文件 ESM 宿主侧 + 套 loader 壳的浏览器侧）、check（契约/产物边界/源码边界/卡片渲染）。模块包不再各带一份构建脚本。",
   "license": "MIT",
   "type": "module",
@@ -33,7 +33,7 @@
     "semver": "^7.8.5",
     "typescript": "5.9.3",
     "typescript-eslint": "^8.71.0",
-    "@dsh-workbench/shared": "1.1.0"
+    "@dsh-workbench/shared": "1.1.2"
   },
   "repository": {
     "type": "git",

package/src/changelog.mjs

@@ -1,27 +1,18 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 import {
   CHANGELOG_FILE,
-  CHANGELOG_KINDS,
-  appendChangelogEntry,
   changelogDate,
   changelogHasEntry,
-  changelogSkeleton,
   changelogVersion,
   isValidVersion,
+  planChangelog,
 } from '@dsh-workbench/shared/host';
 
 const USAGE = `用法：
-  changelog init                              建一份 ${CHANGELOG_FILE}（已有就不动）
-  changelog add <版本> [--type ${CHANGELOG_KINDS.join('|')}] [--note <文字>] [--date <日期>]
-  changelog check [版本]                      查这一版有没有记录（省略版本用 package.json 的）
-版本也可以省略：用 package.json 里的 version。发布时这一版必须有记录，否则拦下。`;
-
-function argValue(args, flag) {
-  const at = args.indexOf(flag);
-  return at === -1 ? undefined : args[at + 1];
-}
+  changelog check [版本]   查这一版有没有记录（省略版本用 package.json 的）
+发布时把这一版写进去：release --changelog-note "这一版改了什么"（文件不在会先建）`;
 
 function positional(args, at) {
   const value = args[at];
@@ -54,25 +45,18 @@ export function changelogProblemOf(root, version) {
   if (text.trim() === '') {
     return {
       reason: `包里还没有 ${CHANGELOG_FILE} —— 更新日志要随包发布`,
-      command: 'dsh-wb-module changelog init',
+      command: 'dsh-wb-module release --yes --changelog-note "这一版改了什么"',
     };
   }
   if (!changelogHasEntry(text, version)) {
     return {
-      reason: `${CHANGELOG_FILE} 里没有 ${version} 这一版的内容 —— 发布前先把这一版写进去`,
-      command: `dsh-wb-module changelog add ${version} --note "这一版改了什么"`,
+      reason: `${CHANGELOG_FILE} 里没有 ${version} 这一版的内容 —— 发布时把这一版写进去`,
+      command: 'dsh-wb-module release --yes --changelog-note "这一版改了什么"',
     };
   }
   return undefined;
 }
 
-export function initChangelog(root) {
-  const file = changelogFileOf(root);
-  if (existsSync(file)) return { file, created: false };
-  writeFileSync(file, changelogSkeleton());
-  return { file, created: true };
-}
-
 export class ChangelogError extends Error {
   constructor(message, code = 2) {
     super(message);
@@ -81,54 +65,20 @@ export class ChangelogError extends Error {
   }
 }
 
-export function addChangelog(root, { version, kind = 'changed', note, date }) {
-  const text = (note ?? '').trim();
-  if (text === '') throw new ChangelogError('changelog add 要一句 --note：这一版改了什么');
-  if (!CHANGELOG_KINDS.includes(kind)) {
-    throw new ChangelogError(`--type 只认 ${CHANGELOG_KINDS.join(' / ')}（收到「${kind}」）`);
-  }
+export function applyChangelog(root, { version, kind = 'changed', note, date }) {
   const wanted = changelogVersion(version === undefined || version === '' ? manifestVersionOf(root) : version);
   if (!isValidVersion(wanted)) {
     throw new ChangelogError(`版本要写成 x.y.z（收到「${String(version)}」）—— 也可以省略，用 package.json 里的`);
   }
-  const file = changelogFileOf(root);
-  const body = appendChangelogEntry(readChangelogText(root), { version: wanted, kind, note: text, date });
-  writeFileSync(file, body);
-  return { file, version: wanted, kind };
-}
-
-function runInit(root, args) {
-  const result = initChangelog(root);
-  if (args.includes('--json')) {
-    console.log(JSON.stringify({ ok: true, ...result }));
-    return;
-  }
-  if (!result.created) {
-    console.log(`${CHANGELOG_FILE} 已经在：${result.file} —— 没动它`);
-    return;
-  }
-  console.log(`✔ 建好了 ${result.file}`);
-  console.log(`  下一步：dsh-wb-module changelog add ${manifestVersionOf(root) || '<版本>'} --note "这一版改了什么"`);
-}
-
-function runAdd(root, args) {
-  const version = positional(args, 1) ?? manifestVersionOf(root);
-  const kind = argValue(args, '--type') ?? 'changed';
-  const note = argValue(args, '--note') ?? '';
-  const date = (argValue(args, '--date') ?? changelogDate()).trim();
-  let result;
-  try {
-    result = addChangelog(root, { version, kind, note, date });
-  } catch (error) {
-    if (!(error instanceof ChangelogError)) throw error;
-    console.error(error.message);
-    process.exit(error.code);
-  }
-  if (args.includes('--json')) {
-    console.log(JSON.stringify({ ok: true, ...result, date }));
-    return;
-  }
-  console.log(`✔ ${CHANGELOG_FILE} 已记下 ${result.version}（${result.kind}）`);
+  const plan = planChangelog(readChangelogText(root), {
+    version: wanted,
+    kind,
+    note: note ?? '',
+    date: date ?? changelogDate(),
+  });
+  if (plan === undefined) return undefined;
+  if (plan.action === 'written') writeFileSync(changelogFileOf(root), plan.text);
+  return { ...plan, file: changelogFileOf(root) };
 }
 
 function runCheck(root, args) {
@@ -157,8 +107,6 @@ function runCheck(root, args) {
 
 export async function changelog({ root, args = [] }) {
   const sub = args[0];
-  if (sub === 'init') return runInit(root, args);
-  if (sub === 'add') return runAdd(root, args);
   if (sub === 'check') return runCheck(root, args);
   console.error(`不认识的 changelog 子命令：${String(sub)}`);
   console.error(USAGE);

package/src/market-index.mjs

@@ -5,15 +5,16 @@ import { isDeepStrictEqual } from 'node:util';
 import {
   MARKET_INDEX_README_LINES,
   MARKET_INDEX_SEED,
+  claimOf,
   gitUrlOk,
+  marketArtifactPath,
   marketSourceKey,
   parseMarketIndexJson,
   upsertMarketEntry,
 } from '@dsh-workbench/shared/host';
 
 const MARKET_FILE = 'market.json';
-const PACKAGES_DIR = 'packages';
-const WORKBENCH_LABEL = 'workbench';
+const SAFE_PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
 const WORKSPACE_PREFIX = 'workspace:';
 const ARTIFACT_DIRS = ['dist'];
 const ARTIFACT_FILES = ['client.js', 'cordis.patch.yml', 'README.md', 'CHANGELOG.md'];
@@ -51,9 +52,8 @@ function workbenchRootOf(home) {
   return explicit === undefined || explicit === '' ? join(home, 'workbench') : explicit;
 }
 
-function normalizedPolicy(value, fallback) {
-  if (value === 'artifacts-in-repo' || value === 'catalog-only') return value;
-  return fallback;
+function statedPolicy(value) {
+  return value === 'artifacts-in-repo' || value === 'catalog-only' ? value : undefined;
 }
 
 export function sanitizeManifest(manifest) {
@@ -93,6 +93,54 @@ function authorOf(manifest) {
   return '';
 }
 
+export function authorTextOf(manifest) {
+  const { name, email } = authorParts(manifest);
+  if (name === '') return '';
+  return email === '' ? name : `${name} <${email}>`;
+}
+
+export function claimProblemText(name, claim, unit) {
+  if (claim.state === 'unit-taken') {
+    return (
+      `市场里 ${claim.entry} 已经用了模块 id ${unit} —— 两个模块不能共用一个 id，装在一起会撞。` +
+      '给这个模块换一个 unit（dsh.workbench.unit）再发；那个条目如果已经废弃，让索引维护者删掉或给它换一个 unit。'
+    );
+  }
+  if (claim.state === 'path-taken') {
+    return (
+      `市场仓库里的 ${marketArtifactPath(name)} 已经被 ${claim.entry} 占了 —— 一个产物目录只能放一个包。` +
+      '换一个包名再发；那个条目如果已经废弃，让索引维护者先处理掉。'
+    );
+  }
+  return (
+    `市场里 ${name} 已经有主了（${claim.owner ?? '未署名'}），同一个名字不能再由别人发。` +
+    '要发就换个带团队 scope 的包名；你就是原来的作者（只是换了机器或署名），用 author 参数带上原来的署名再发一次（CLI 是 --author）；' +
+    '确实是接手，让索引维护者把这一条的 owner 改成你。'
+  );
+}
+
+export function missingPublisherText() {
+  return '市场里一个名字要有主人：给 package.json 补上 author，或用 author 参数传一个署名（CLI 是 --author），再发。';
+}
+
+function unitOf(manifest) {
+  const unit = manifest?.dsh?.workbench?.unit;
+  return typeof unit === 'string' ? unit.trim() : '';
+}
+
+function claimOfIndexFile(workdir, indexPath, input) {
+  const file = join(workdir, indexPath);
+  if (!existsSync(file)) return { state: 'new' };
+  const parsed = parseMarketIndexJson(readFileSync(file, 'utf8'));
+  if (!parsed.ok) {
+    throw new MarketIndexError(
+      `${indexPath} 不合 format 1：${parsed.problems.map((one) => one.detail).join('；')}`,
+      'index-write',
+    );
+  }
+  return claimOf(parsed.index, input);
+}
+
 export function identityOf(manifest) {
   const { name, email } = authorParts(manifest);
   if (name === '') return undefined;
@@ -117,13 +165,22 @@ function titleOf(manifest) {
   return { ...(zh === '' ? {} : { zh }), ...(en === '' ? {} : { en }) };
 }
 
+function textListOf(value) {
+  return Array.isArray(value)
+    ? [...new Set(value.flatMap((one) => (typeof one === 'string' && one.trim() !== '' ? [one.trim()] : [])))]
+    : [];
+}
+
 export function entryMetaOf(manifest) {
   const author = authorOf(manifest);
   const homepage = typeof manifest.homepage === 'string' ? manifest.homepage.trim() : '';
-  const keywords = Array.isArray(manifest.keywords)
-    ? manifest.keywords.flatMap((one) => (typeof one === 'string' && one.trim() !== '' ? [one.trim()] : []))
-    : [];
+  const keywords = textListOf(manifest.keywords);
+  const market = manifest.dsh?.workbench?.market;
+  const marketRecord = market !== null && typeof market === 'object' && !Array.isArray(market) ? market : {};
+  const category = typeof marketRecord.category === 'string' ? marketRecord.category.trim() : '';
+  const labels = textListOf(marketRecord.labels);
   const order = manifest.dsh?.workbench?.card?.order;
+  const unit = unitOf(manifest);
   const title = titleOf(manifest);
   const description = descriptionOf(manifest);
   return {
@@ -132,8 +189,10 @@ export function entryMetaOf(manifest) {
     ...(author === '' ? {} : { author }),
     ...(homepage === '' ? {} : { homepage }),
     metadata: {
-      category: WORKBENCH_LABEL,
-      labels: [WORKBENCH_LABEL],
+      workbench: true,
+      ...(unit === '' ? {} : { unit }),
+      ...(category === '' ? {} : { category }),
+      ...(labels.length === 0 ? {} : { labels }),
       ...(keywords.length === 0 ? {} : { keywords }),
       ...(typeof order === 'number' ? { sortKeys: { order } } : {}),
     },
@@ -143,8 +202,10 @@ export function entryMetaOf(manifest) {
 export function indexEntryOf(input) {
   const manifest = input.manifest;
   const dsh = manifest.engines?.dsh;
+  const owner = authorTextOf(manifest);
   return {
     name: manifest.name,
+    ...(owner === '' ? {} : { owner }),
     ...entryMetaOf(manifest),
     versions: [
       {
@@ -179,7 +240,7 @@ function readSources(file) {
   }
 }
 
-function planOf(raw, args, fallbackPolicy) {
+function planOf(raw, args, fallbackPolicy, origin) {
   if (raw === null || typeof raw !== 'object') return undefined;
   if (raw.kind !== 'git') return undefined;
   const url = typeof raw.url === 'string' ? raw.url.trim() : '';
@@ -188,7 +249,8 @@ function planOf(raw, args, fallbackPolicy) {
   if (url !== '' && !gitUrlOk(url)) return undefined;
   const ref = (argValue(args, '--index-ref') ?? (typeof raw.ref === 'string' ? raw.ref : '')).trim();
   const path = (argValue(args, '--index-path') ?? (typeof raw.path === 'string' ? raw.path : '')).trim();
-  const policy = normalizedPolicy(argValue(args, '--index-policy'), normalizedPolicy(raw.policy, fallbackPolicy));
+  const fromArgument = statedPolicy(argValue(args, '--index-policy'));
+  const fromSource = statedPolicy(raw.policy);
   return {
     source: {
       kind: 'git',
@@ -197,7 +259,9 @@ function planOf(raw, args, fallbackPolicy) {
       ...(path === '' ? {} : { path }),
       ...(localPath === '' ? {} : { localPath }),
     },
-    policy,
+    policy: fromArgument ?? fromSource ?? fallbackPolicy,
+    policyStated: fromArgument !== undefined || fromSource !== undefined,
+    origin,
   };
 }
 
@@ -234,7 +298,7 @@ function planFromArgument(asked, args, exec) {
   if (existsSync(asDir)) {
     const remote = exec('git', ['-C', asDir, 'remote', 'get-url', 'origin'], { capture: true, allowFailure: true });
     const url = remote.status === 0 ? remote.stdout.trim() : '';
-    const plan = planOf({ kind: 'git', url, localPath: asDir }, args, 'artifacts-in-repo');
+    const plan = planOf({ kind: 'git', url, localPath: asDir }, args, 'artifacts-in-repo', 'argument');
     if (plan === undefined) {
       throw new MarketIndexError(`--index 指的目录不是 git 仓库或没有 origin：${asDir}`, 'index-write');
     }
@@ -243,13 +307,45 @@ function planFromArgument(asked, args, exec) {
   if (!gitUrlOk(asked)) {
     throw new MarketIndexError(`--index 只认 none / 目录 / git 地址（收到「${asked}」）`, 'index-write');
   }
-  return planOf({ kind: 'git', url: asked }, args, 'catalog-only');
+  return planOf({ kind: 'git', url: asked }, args, 'catalog-only', 'argument');
+}
+
+function findBySourceId(payload, id) {
+  const found = payload.sources.find((one) => one?.id === id);
+  if (found === undefined) {
+    const known = payload.sources.map((one) => one?.id).filter((one) => typeof one === 'string').join('、') || '（空）';
+    throw new MarketIndexError(`没有这个索引源：${id}。现有的：${known}`, 'index-write');
+  }
+  if (found.kind !== 'git') {
+    throw new MarketIndexError(`索引源 ${id} 是 http 地址，只能读，不能当发布目的地`, 'index-write');
+  }
+  return found;
 }
 
 function planFromSources(file, args) {
   const payload = readSources(file);
-  const found = payload.sources.find((one) => one?.id === payload.selected);
-  return planOf(found ?? null, args, 'catalog-only');
+  const asked = (argValue(args, '--index-source') ?? '').trim();
+  let found;
+  if (asked !== '') {
+    found = findBySourceId(payload, asked);
+  } else {
+    const publishable = payload.sources.filter((one) => one?.kind === 'git' && one.policy === 'artifacts-in-repo');
+    if (publishable.length === 1) {
+      found = publishable[0];
+    } else if (publishable.length > 1) {
+      found = publishable.find((one) => one.id === payload.selected);
+      if (found === undefined) {
+        const ids = publishable.map((one) => one.id).join('、');
+        throw new MarketIndexError(`有多个可发布的索引源（${ids}）—— 用 --index-source 指定发到哪一个`, 'index-write');
+      }
+    } else {
+      found = payload.sources.find((one) => one?.id === payload.selected);
+    }
+  }
+  const plan = planOf(found ?? null, args, 'catalog-only', 'sources');
+  return plan === undefined || found === undefined || found === null || typeof found.id !== 'string'
+    ? plan
+    : { ...plan, sourceId: found.id };
 }
 
 function runGit(exec, cwd, argv, { allowFailure = false } = {}) {
@@ -331,25 +427,39 @@ function remoteHeadOf(exec, workdir, branch) {
   return line.split(/\s+/)[0] ?? '';
 }
 
-function copyArtifacts(root, workdir, unit, manifest) {
-  const dest = join(workdir, PACKAGES_DIR, unit);
+function copyArtifacts(root, workdir, name, manifest) {
+  if (!SAFE_PACKAGE_NAME.test(name)) {
+    throw new MarketIndexError(`包名不是合法 npm 名，没法当产物目录：${JSON.stringify(name)}`, 'index-write');
+  }
+  const path = marketArtifactPath(name);
+  const dest = join(workdir, path);
   rmSync(dest, { recursive: true, force: true });
   mkdirSync(dest, { recursive: true });
   for (const dir of ARTIFACT_DIRS) {
     const src = join(root, dir);
     if (existsSync(src)) cpSync(src, join(dest, dir), { recursive: true });
   }
-  for (const name of ARTIFACT_FILES) {
-    const src = join(root, name);
-    if (existsSync(src)) copyFileSync(src, join(dest, name));
+  for (const file of ARTIFACT_FILES) {
+    const src = join(root, file);
+    if (existsSync(src)) copyFileSync(src, join(dest, file));
   }
   writeFileSync(join(dest, 'package.json'), `${JSON.stringify(sanitizeManifest(manifest), null, 2)}\n`);
-  return `${PACKAGES_DIR}/${unit}`;
+  return path;
 }
 
-function writeEntry(workdir, indexPath, entry) {
+function writeEntry(workdir, indexPath, entry, publisher, unit) {
   const file = join(workdir, indexPath);
   const current = existsSync(file) ? readFileSync(file, 'utf8') : '';
+  if (publisher === '') throw new MarketIndexError(missingPublisherText(), 'market-owner');
+  const claim = claimOfIndexFile(workdir, indexPath, {
+    name: entry.name,
+    publisher,
+    unit,
+    artifactPath: entry.versions[0]?.source?.type === 'git' ? entry.versions[0].source.path : undefined,
+  });
+  if (claim.state === 'conflict' || claim.state === 'unit-taken' || claim.state === 'path-taken') {
+    throw new MarketIndexError(claimProblemText(entry.name, claim, unit), 'market-owner');
+  }
   const merged = mergeIndexText(current, entry);
   if (!merged.ok) {
     throw new MarketIndexError(
@@ -385,8 +495,20 @@ function publishSourceOf(publish) {
   return undefined;
 }
 
+export function marketClaim({ plan, exec, home, name, unit, publisher }) {
+  const workdir = worktreeOf(plan, exec, home);
+  return claimOfIndexFile(workdir, plan.source.path ?? MARKET_FILE, {
+    name,
+    publisher,
+    unit,
+    artifactPath: marketArtifactPath(name),
+  });
+}
+
 export function updateMarketIndex(options) {
-  const { plan, exec, home, root, manifest, unit, version, publish, now, resume, onStep } = options;
+  const { plan, exec, home, root, manifest, version, publish, now, resume, onStep } = options;
+  const unit = options.unit ?? unitOf(manifest);
+  const publisher = options.publisher ?? authorTextOf(manifest);
   const entryName = `${manifest.name}@${version}`;
   let base = { kind: 'git', url: plan.source.url, entry: entryName };
   let phase = 'start';
@@ -403,7 +525,9 @@ export function updateMarketIndex(options) {
     const indexPath = plan.source.path ?? MARKET_FILE;
     if (resume !== undefined && plan.source.localPath === undefined) {
       runGit(exec, workdir, ['reset', '--hard', 'HEAD'], { allowFailure: true });
-      runGit(exec, workdir, ['clean', '-fd', '--', `${PACKAGES_DIR}/${unit}`, indexPath], { allowFailure: true });
+      runGit(exec, workdir, ['clean', '-fd', '--', marketArtifactPath(manifest.name), indexPath], {
+        allowFailure: true,
+      });
     } else {
       assertClean(exec, workdir);
     }
@@ -422,11 +546,21 @@ export function updateMarketIndex(options) {
         };
       }
     }
+    if (publisher === '') throw new MarketIndexError(missingPublisherText(), 'market-owner');
+    const claim = claimOfIndexFile(workdir, indexPath, {
+      name: manifest.name,
+      publisher,
+      unit,
+      artifactPath: marketArtifactPath(manifest.name),
+    });
+    if (claim.state === 'conflict' || claim.state === 'unit-taken' || claim.state === 'path-taken') {
+      throw new MarketIndexError(claimProblemText(manifest.name, claim, unit), 'market-owner');
+    }
     let source;
     let artifactPath;
     if (plan.policy === 'artifacts-in-repo') {
       report({ phase: 'artifacts' });
-      artifactPath = copyArtifacts(root, workdir, unit, manifest);
+      artifactPath = copyArtifacts(root, workdir, manifest.name, manifest);
       report({ phase: 'artifacts-copied' });
       const sha = commitOf(exec, workdir, `chore(release): ${entryName}`, identityOf(manifest));
       report({ phase: 'artifacts-committed', artifactCommit: sha });
@@ -448,7 +582,7 @@ export function updateMarketIndex(options) {
     }
     const entry = indexEntryOf({ manifest, version, source, at: now() });
     report({ phase: 'index' });
-    writeEntry(workdir, indexPath, entry);
+    writeEntry(workdir, indexPath, entry, publisher, unit);
     let indexSha = commitOf(exec, workdir, `chore(market): ${entryName}`, identityOf(manifest));
     report({ phase: 'index-committed', indexCommit: indexSha });
     const pushed = pushOf(exec, workdir, branch);
@@ -460,7 +594,7 @@ export function updateMarketIndex(options) {
           `模块已进仓库、索引没更新（本地 commit ${indexSha}）：${tailOf(`${pushed.stdout}\n${pushed.stderr}`)}`,
         );
       }
-      writeEntry(workdir, indexPath, entry);
+      writeEntry(workdir, indexPath, entry, publisher, unit);
       indexSha = commitOf(exec, workdir, `chore(market): ${entryName}`, identityOf(manifest));
       report({ phase: 'index-committed', indexCommit: indexSha });
       const retried = pushOf(exec, workdir, branch);
@@ -502,11 +636,14 @@ export function updateMarketIndex(options) {
 
 export function refreshMarketEntry(options) {
   const { plan, exec, home, manifest } = options;
+  const publisher = options.publisher ?? authorTextOf(manifest);
+  const unit = options.unit ?? unitOf(manifest);
   let base = { kind: 'git', url: plan.source.url, entry: manifest.name };
   let phase = 'start';
   try {
     const workdir = worktreeOf(plan, exec, home);
     const indexPath = plan.source.path ?? MARKET_FILE;
+    if (publisher === '') throw new MarketIndexError(missingPublisherText(), 'market-owner');
     assertClean(exec, workdir);
     const branch = plan.source.ref ?? currentBranch(exec, workdir);
     base = { ...base, branch };
@@ -533,7 +670,7 @@ export function refreshMarketEntry(options) {
     if (isDeepStrictEqual(next, existing)) {
       return { ...base, updated: false, unchanged: true, version: latest, phase: 'done' };
     }
-    writeEntry(workdir, indexPath, next);
+    writeEntry(workdir, indexPath, next, publisher, unit);
     let indexSha = commitOf(exec, workdir, `chore(market): refresh ${manifest.name}`, identityOf(manifest));
     const pushed = pushOf(exec, workdir, branch);
     if (pushed.status !== 0) {
@@ -541,7 +678,7 @@ export function refreshMarketEntry(options) {
       if (!replayed) {
         throw new MarketIndexError(`元数据没推上去（本地 commit ${indexSha}）：${tailOf(pushed.stderr)}`, 'index-write');
       }
-      writeEntry(workdir, indexPath, next);
+      writeEntry(workdir, indexPath, next, publisher, unit);
       indexSha = commitOf(exec, workdir, `chore(market): refresh ${manifest.name}`, identityOf(manifest));
       const retried = pushOf(exec, workdir, branch);
       if (retried.status !== 0) {
@@ -666,7 +803,7 @@ export function marketVersionExists({ plan, exec, home, name, version }) {
   }
 }
 
-export function verifyMarketArtifact({ plan, exec, home, unit, commit }) {
+export function verifyMarketArtifact({ plan, exec, home, name, path, commit }) {
   const workdir = worktreeOf(plan, exec, home);
   const found = runGit(exec, workdir, ['cat-file', '-e', `${commit}^{commit}`], { allowFailure: true });
   if (found.status !== 0) {
@@ -676,13 +813,14 @@ export function verifyMarketArtifact({ plan, exec, home, unit, commit }) {
   if (tree.status !== 0) {
     throw new MarketIndexError(`读不了 commit ${commit} 的内容：${tailOf(tree.stderr)}`, 'market-verify');
   }
-  const prefix = `${PACKAGES_DIR}/${unit}/`;
+  const artifactPath = typeof path === 'string' && path !== '' ? path : marketArtifactPath(name);
+  const prefix = `${artifactPath}/`;
   const files = tree.stdout
     .split('\n')
     .map((one) => one.trim())
     .filter((one) => one.startsWith(prefix))
     .map((one) => one.slice(prefix.length));
-  return { path: `${PACKAGES_DIR}/${unit}`, files };
+  return { path: artifactPath, files };
 }
 
 export { MARKET_FILE };

package/src/release-changelog.mjs

@@ -1,5 +1,3 @@
-import { changelogProblemOf } from './changelog.mjs';
-
 function manifestAuthor(manifest) {
   const author = manifest?.author;
   if (typeof author === 'string') return author.trim();
@@ -22,8 +20,3 @@ export function authorChangeOf(root, manifest, exec) {
     change: 'author ← git config',
   };
 }
-
-export function changelogGateOf(root, version) {
-  const problem = changelogProblemOf(root, version);
-  return problem === undefined ? { ok: true } : { ok: false, ...problem };
-}

package/src/release.mjs

@@ -17,7 +17,9 @@ import {
   writeState,
 } from './release-journal.mjs';
 import { emit, installOf, marketInstallOf, stateOf } from './release-report.mjs';
-import { authorChangeOf, changelogGateOf } from './release-changelog.mjs';
+import { authorChangeOf } from './release-changelog.mjs';
+import { CHANGELOG_FILE, CHANGELOG_KINDS, changelogDate, marketArtifactPath } from '@dsh-workbench/shared/host';
+import { applyChangelog, changelogProblemOf } from './changelog.mjs';
 import {
   NeedsUser,
   ReleaseError,
@@ -47,8 +49,12 @@ import {
 } from './release-publish.mjs';
 import {
   MarketIndexError,
+  authorTextOf,
+  claimProblemText,
   identityOf,
+  marketClaim,
   marketVersionExists,
+  missingPublisherText,
   refreshMarketEntry,
   resolveIndexPlan,
   updateMarketIndex,
@@ -251,6 +257,11 @@ export async function runRelease({
   if (askedAuthor !== undefined && (explicitAuthor === '' || /[\r\n]/u.test(explicitAuthor))) {
     throw new ReleaseError('--author 只认一行署名：姓名，或 姓名 <邮箱>');
   }
+  const changelogNote = (argValue(args, '--changelog-note') ?? '').trim();
+  const changelogKind = (argValue(args, '--changelog-type') ?? 'changed').trim();
+  if (!CHANGELOG_KINDS.includes(changelogKind)) {
+    throw new ReleaseError(`--changelog-type 只认 ${CHANGELOG_KINDS.join(' / ')}（收到「${changelogKind}」）`);
+  }
   const manifest = readManifest(root);
   const unit = manifest?.dsh?.workbench?.unit;
   if (typeof unit !== 'string' || unit === '') throw new ReleaseError('这不是一个 wb 模块包（没有 dsh.workbench.unit）');
@@ -312,9 +323,25 @@ export async function runRelease({
       throw new ReleaseError('没有可写的 git 索引源 —— 用 --index <仓库> 指定，或先在「模块市场 → 发现」里初始化索引');
     }
     if (indexPlan.policy !== 'artifacts-in-repo') {
+      if (indexPlan.policyStated !== true) {
+        throw new NeedsUser(
+          'index-write',
+          indexPlan.origin === 'argument'
+            ? '这个索引仓库默认只当目录。要往里发产物，加 --index-policy artifacts-in-repo 再跑一次。'
+            : '这个索引源还没设为可发布。到「模块市场 → 发现 → 索引源」点「设为可发布」，再发一次。',
+          undefined,
+          {
+            target: 'market',
+            ...(indexPlan.origin === 'argument' ? {} : { enableTool: 'workbench_market_enable' }),
+            ...(indexPlan.sourceId === undefined ? {} : { sourceId: indexPlan.sourceId }),
+            ...(indexPlan.source.url === '' ? {} : { sourceUrl: indexPlan.source.url }),
+          },
+        );
+      }
       throw new ReleaseError('这个索引源是 catalog-only：它只收目录、不放产物。用 --index-policy artifacts-in-repo 或换一个可写仓库');
     }
   }
+  const authored = authorChangeOf(root, manifest, exec);
   if (hasFlag(args, '--refresh')) {
     if (dryRun) throw new ReleaseError('--refresh 没有预览：它只改索引里的标题 / 作者 / 说明');
     if (target !== 'market') throw new ReleaseError('--refresh 只对市场索引有意义（--target market）');
@@ -323,7 +350,8 @@ export async function runRelease({
     }
     const cardTitle = cardTitleFromMessages(root, unit);
     const titled = cardTitle === undefined ? manifest : { ...manifest, title: cardTitle };
-    const result = refreshMarketEntry({ plan: indexPlan, exec, home, manifest: titled });
+    const publisher = authorTextOf(manifest) || authored.author || '';
+    const result = refreshMarketEntry({ plan: indexPlan, exec, home, manifest: titled, publisher });
     if (result.updated !== true && result.reason !== undefined) {
       throw new ReleaseError(`刷新市集元数据没走通：${result.reason}`);
     }
@@ -352,13 +380,59 @@ export async function runRelease({
     emit(out, json, summary);
     return summary;
   }
-  const authored = authorChangeOf(root, manifest, exec);
   const authorChange = explicitAuthor === undefined ? authored.change : 'author ← --author';
   if (!explicitApplied && !verify && !dryRun && authored.author !== undefined) {
     manifest.author = authored.author;
     writeManifest(root, manifest);
   }
+  const publisher = authorTextOf(manifest);
+  const writesIndex = indexPlan !== undefined && target !== 'local' && target !== 'tarball';
+  if (!verify && !dryRun && writesIndex) {
+    if (publisher === '') throw new ReleaseError(missingPublisherText());
+    let claim;
+    try {
+      claim = marketClaim({ plan: indexPlan, exec, home, name: manifest.name, unit, publisher });
+    } catch (error) {
+      if (error instanceof MarketIndexError) {
+        throw new NeedsUser(error.step ?? 'index-write', error.message, error.command, { target });
+      }
+      throw error;
+    }
+    if (claim.state === 'conflict' || claim.state === 'unit-taken' || claim.state === 'path-taken') {
+      throw new ReleaseError(claimProblemText(manifest.name, claim, unit));
+    }
+  }
   const frozenVersion = resume && typeof journal?.version === 'string' ? journal.version : undefined;
+  const info =
+    target === 'market'
+      ? { target: 'market', kind: 'market', url: indexPlan.source.url }
+      : targetInfoOf(root, manifest, args, home, exec, target, earlyState?.registry);
+  const askedVersion = argValue(args, '--version');
+  const targetVersionOf = () => {
+    if (info.kind === 'tarball' || info.kind === 'git') {
+      return frozenVersion ?? nextVersion(manifest.version, askedVersion, info.exists);
+    }
+    if (info.kind === 'registry') {
+      return frozenVersion ?? nextVersion(manifest.version, askedVersion, (one) => registryExists(exec, info, manifest.name, one));
+    }
+    if (info.kind === 'market' && indexPlan !== undefined) {
+      return (
+        frozenVersion ??
+        nextVersion(manifest.version, askedVersion, (one) =>
+          marketVersionExists({ plan: indexPlan, exec, home, name: manifest.name, version: one }),
+        )
+      );
+    }
+    return frozenVersion ?? nextVersion(manifest.version, askedVersion, () => false);
+  };
+  const releaseVersion = verify ? undefined : targetVersionOf();
+  const changelogProblem = verify || dryRun ? undefined : changelogProblemOf(root, releaseVersion);
+  if (changelogProblem !== undefined && changelogNote === '') {
+    throw new NeedsUser('changelog', changelogProblem.reason, changelogProblem.command, {
+      target,
+      version: releaseVersion,
+    });
+  }
   const fingerprint = artifactFingerprintOf(root);
   const resumeMatchesTree = resume && frozenVersion !== undefined && journal?.run?.fingerprint === fingerprint;
   const tracking = !verify && !dryRun;
@@ -376,10 +450,6 @@ export async function runRelease({
       },
     });
   }
-  const info =
-    target === 'market'
-      ? { target: 'market', kind: 'market', url: indexPlan.source.url }
-      : targetInfoOf(root, manifest, args, home, exec, target, earlyState?.registry);
   const indexPreviewOf = (name, version) =>
     indexPlan === undefined
       ? undefined
@@ -409,39 +479,18 @@ export async function runRelease({
       unit,
       version,
       publish,
+      publisher: authorTextOf(manifestNow),
       exec,
       home,
       now: () => Date.now(),
     });
   };
+  let changelogChange;
   const changesOf = (version) => [
     ...(authorChange === undefined ? [] : [authorChange]),
     ...(version === manifest.version ? [] : [`version → ${version}`]),
+    ...(changelogChange === undefined ? [] : [changelogChange]),
   ];
-  const gateOf = (version) => {
-    if (verify || dryRun) return;
-    const gate = changelogGateOf(root, version);
-    if (gate.ok !== true) throw new NeedsUser('changelog', gate.reason, gate.command, { target, version });
-  };
-  const askedVersion = argValue(args, '--version');
-  const targetVersionOf = () => {
-    if (info.kind === 'tarball' || info.kind === 'git') {
-      return frozenVersion ?? nextVersion(manifest.version, askedVersion, info.exists);
-    }
-    if (info.kind === 'registry') {
-      return frozenVersion ?? nextVersion(manifest.version, askedVersion, (one) => registryExists(exec, info, manifest.name, one));
-    }
-    if (info.kind === 'market' && indexPlan !== undefined) {
-      return (
-        frozenVersion ??
-        nextVersion(manifest.version, askedVersion, (one) =>
-          marketVersionExists({ plan: indexPlan, exec, home, name: manifest.name, version: one }),
-        )
-      );
-    }
-    return frozenVersion ?? nextVersion(manifest.version, askedVersion, () => false);
-  };
-  if (!verify && !dryRun) gateOf(targetVersionOf());
   if (verify) {
     const state = earlyState;
     const version = argValue(args, '--version') ?? state?.version ?? manifest.version;
@@ -451,7 +500,14 @@ export async function runRelease({
       if (commit === '') throw new ReleaseError('没有记录上次发布的 commit —— 先正常发一次再核');
       let checked;
       try {
-        checked = verifyMarketArtifact({ plan: indexPlan, exec, home, unit, commit });
+        checked = verifyMarketArtifact({
+          plan: indexPlan,
+          exec,
+          home,
+          name: manifest.name,
+          path: typeof state?.path === 'string' ? state.path : undefined,
+          commit,
+        });
       } catch (error) {
         throw new ReleaseError(error instanceof Error ? error.message : String(error));
       }
@@ -612,16 +668,35 @@ export async function runRelease({
   }
   const earlyLicense = info.kind === 'registry' ? licenseOf(root, manifest, target, args) : undefined;
   if (info.kind === 'registry') checkLogin(exec, info);
+  const changelog = dryRun
+    ? undefined
+    : applyChangelog(root, {
+        version: releaseVersion,
+        kind: changelogKind,
+        note: changelogNote,
+        date: changelogDate(),
+      });
+  if (!dryRun && changelog === undefined) {
+    const problem = changelogProblemOf(root, releaseVersion);
+    throw new NeedsUser(
+      'changelog',
+      problem?.reason ?? `${CHANGELOG_FILE} 里没有 ${String(releaseVersion)} 这一版`,
+      problem?.command,
+      { target, version: releaseVersion },
+    );
+  }
+  if (changelog !== undefined && changelog.action === 'written') {
+    changelogChange = `CHANGELOG ← ${changelog.version}`;
+  }
+  const changelogReport =
+    changelog === undefined ? undefined : { version: changelog.version, action: changelog.action };
   const capture = json;
   const stageOptions = { cwd: root, capture, err };
   if (!resumeMatchesTree) runGate(exec, root, stageOptions);
   if (tracking) advanceRun(home, unit, { phase: 'gates' });
 
   if (info.kind === 'market') {
-    const exists = (one) =>
-      marketVersionExists({ plan: indexPlan, exec, home, name: manifest.name, version: one });
-    const version =
-      frozenVersion ?? nextVersion(manifest.version, argValue(args, '--version'), exists);
+    const version = releaseVersion;
     const files = localFiles(exec, root);
     checkPublished(files);
     const summary = {
@@ -632,6 +707,7 @@ export async function runRelease({
       version,
       files,
       changes: changesOf(version),
+      ...(changelogReport === undefined ? {} : { changelog: changelogReport }),
       install: '',
       market: indexPreviewOf(manifest.name, version),
     };
@@ -651,6 +727,7 @@ export async function runRelease({
       unit,
       version,
       publish: {},
+      publisher,
       exec,
       home,
       now: () => Date.now(),
@@ -658,6 +735,17 @@ export async function runRelease({
       ...(tracking ? { onStep: (step) => advanceRun(home, unit, step) } : {}),
     });
     if (index.updated !== true || index.commit === undefined || index.commit === '') {
+      if (index.code === 'market-owner') {
+        if (tracking) {
+          interruptRun(home, unit, {
+            class: 'human',
+            code: 'market-owner',
+            text: index.reason ?? missingPublisherText(),
+            phase: index.phase ?? 'claim',
+          });
+        }
+        throw new ReleaseError(index.reason ?? missingPublisherText());
+      }
       const failure = {
         class: index.code === 'git-market-protected' ? 'human' : 'transient',
         code: index.code ?? 'index-write',
@@ -674,7 +762,7 @@ export async function runRelease({
       });
     }
     writeManifest(root, next);
-    const path = index.path ?? `packages/${unit}`;
+    const path = index.path ?? marketArtifactPath(manifest.name);
     const install = marketInstallOf(index.url, index.commit, path);
     const journalNow = tracking ? readState(home, unit)?.run : undefined;
     writeState(home, unit, {
@@ -698,7 +786,7 @@ export async function runRelease({
   }
 
   if (info.kind === 'tarball') {
-    const version = frozenVersion ?? nextVersion(manifest.version, argValue(args, '--version'), info.exists);
+    const version = releaseVersion;
     const files = localFiles(exec, root);
     checkPublished(files);
     const summary = {
@@ -710,6 +798,7 @@ export async function runRelease({
       file: info.fileOf(version),
       files,
       changes: changesOf(version),
+      ...(changelogReport === undefined ? {} : { changelog: changelogReport }),
       install: installOf(info, manifest.name, version),
     };
     if (dryRun) {
@@ -749,7 +838,7 @@ export async function runRelease({
   }
 
   if (info.kind === 'git') {
-    const version = frozenVersion ?? nextVersion(manifest.version, argValue(args, '--version'), info.exists);
+    const version = releaseVersion;
     const files = localFiles(exec, root);
     checkPublished(files);
     const summary = {
@@ -760,6 +849,7 @@ export async function runRelease({
       version,
       files,
       changes: changesOf(version),
+      ...(changelogReport === undefined ? {} : { changelog: changelogReport }),
       git: { url: info.url, tag: info.tagOf(version) },
       install: installOf(info, manifest.name, version),
       ...(dryRun ? { market: indexPreviewOf(manifest.name, version) } : {}),
@@ -829,12 +919,12 @@ export async function runRelease({
     delete next.private;
     changes.push('摘掉 private');
   }
-  const version =
-    frozenVersion ?? nextVersion(next.version, argValue(args, '--version'), (one) => registryExists(exec, info, next.name, one));
+  const version = releaseVersion;
   if (version !== next.version) {
     next.version = version;
     changes.push(`version → ${version}`);
   }
+  if (changelogChange !== undefined) changes.push(changelogChange);
   if (dryRun) {
     if (!resumeMatchesTree) runCliStage(exec, root, ['check'], stageOptions);
     const files = localFiles(exec, root);
@@ -874,6 +964,7 @@ export async function runRelease({
       registry: info.registry,
       changes,
       files,
+      ...(changelogReport === undefined ? {} : { changelog: changelogReport }),
       install: installOf(info, next.name, version),
       market: indexOf(next, version, { registry: info.registry }),
     };