@dzhechkov/harness-core 0.8.43 → 0.8.44

package/src/pack-artifact.ts

@@ -0,0 +1,109 @@
+/** One staged artifact for signing, publication and sibling drift. Linux/macOS tar. */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { packedTarballName } from './packed-install-smoke.js';
+
+export type ExecLike = (command: string, options: { cwd: string; stdio: 'pipe'; encoding: 'utf-8'; maxBuffer: number }) => string;
+export interface PackArtifactResult {
+  readonly tgzPath: string;
+  readonly sha256: string;
+  readonly files: readonly string[];
+}
+
+export class UnknownWorkspaceSpecError extends Error {
+  constructor(dependency: string, spec: string) {
+    super(`Unknown workspace dependency spec for ${dependency}: ${spec}; supply a version and use workspace:*, workspace:^ or workspace:~`);
+    this.name = 'UnknownWorkspaceSpecError';
+  }
+}
+
+export function rewriteWorkspaceSpecs(
+  pkgJsonText: string,
+  siblingVersions: ReadonlyMap<string, string>,
+): string {
+  const pkg = JSON.parse(pkgJsonText) as Record<string, unknown>;
+  const fields = ['dependencies', 'peerDependencies', 'optionalDependencies', 'devDependencies'] as const;
+  for (const field of fields) {
+    const candidate = pkg[field];
+    if (candidate === null || typeof candidate !== 'object' || Array.isArray(candidate)) continue;
+    const table = candidate as Record<string, unknown>;
+    for (const [dep, spec] of Object.entries(table)) {
+      if (typeof spec !== 'string') continue;
+      const match = /^workspace:([*^~])$/.exec(spec);
+      const version = siblingVersions.get(dep);
+      if (match === null) {
+        if (spec.startsWith('workspace:') || spec.startsWith('catalog:')) {
+          throw new UnknownWorkspaceSpecError(dep, spec);
+        }
+        continue;
+      }
+      if (version === undefined) continue;
+      const marker = match[1]!;
+      table[dep] = marker === '*' ? version : `${marker}${version}`;
+    }
+  }
+  return JSON.stringify(pkg, null, 2) + '\n';
+}
+
+/** Current pins, read afresh so a later sign sees a sibling's new version. */
+export function readWorkspaceVersions(repoRoot: string): ReadonlyMap<string, string> {
+  const scope = join(repoRoot, 'packages', '@dzhechkov');
+  const versions = new Map<string, string>();
+  if (!existsSync(scope)) return versions;
+  for (const entry of readdirSync(scope).sort()) {
+    const manifest = join(scope, entry, 'package.json');
+    if (!existsSync(manifest)) continue;
+    const pkg = JSON.parse(readFileSync(manifest, 'utf8')) as { name?: unknown; version?: unknown };
+    if (typeof pkg.name === 'string' && typeof pkg.version === 'string') versions.set(pkg.name, pkg.version);
+  }
+  return versions;
+}
+
+// POSIX shell argument quoting: paths may contain spaces, quotes, dollars or backticks.
+
+export function packArtifact(opts: {
+  pkgDir: string;
+  destDir: string;
+  exec: ExecLike;
+  pinVersions: ReadonlyMap<string, string>;
+}): PackArtifactResult {
+  const pkgDir = resolve(opts.pkgDir);
+  const destDir = resolve(opts.destDir);
+  const manifestPath = join(pkgDir, 'package.json');
+  const original = readFileSync(manifestPath);
+  try {
+    const staged = JSON.parse(rewriteWorkspaceSpecs(original.toString('utf8'), opts.pinVersions)) as Record<string, unknown>;
+    // The public rewrite helper historically leaves a known shorthand without a pin unchanged.
+    // An artifact must never ship that unresolved value, even when its caller supplied an incomplete map.
+    for (const field of ['dependencies', 'peerDependencies', 'optionalDependencies', 'devDependencies']) {
+      const table = staged[field];
+      if (table === null || typeof table !== 'object' || Array.isArray(table)) continue;
+      for (const [dependency, value] of Object.entries(table)) {
+        if (typeof value === 'string' && /^workspace:[*^~]$/.test(value)) {
+          throw new UnknownWorkspaceSpecError(dependency, value);
+        }
+      }
+    }
+    const scripts = staged['scripts'];
+    if (scripts !== null && typeof scripts === 'object' && !Array.isArray(scripts)) {
+      delete (scripts as Record<string, unknown>)['prepublishOnly'];
+    }
+    const name = staged['name'];
+    const version = staged['version'];
+    if (typeof name !== 'string' || typeof version !== 'string') throw new Error(`Missing package name/version in ${manifestPath}`);
+    mkdirSync(destDir, { recursive: true });
+    writeFileSync(manifestPath, JSON.stringify(staged, null, 2) + '\n');
+    const execOptions = { cwd: pkgDir, stdio: 'pipe' as const, encoding: 'utf-8' as const, maxBuffer: 64 * 1024 * 1024 };
+    // The command shape is a CONTRACT: publish's test fake admits exactly this template — double-quoted
+    // via JSON.stringify, verbatim from the publish.ts template it replaced (publish-confirm-seam.test.ts).
+    opts.exec(`npm pack . --pack-destination ${JSON.stringify(destDir)}`, execOptions);
+    const tgzPath = join(destDir, packedTarballName(name, version));
+    const listing = opts.exec(`tar -tzf ${JSON.stringify(tgzPath)}`, execOptions);
+    const files = listing.split(/\r?\n/).filter(p => p !== '' && !p.endsWith('/')).map(p => p.replace(/^package\//, '')).sort();
+    const sha256 = createHash('sha256').update(readFileSync(tgzPath)).digest('hex');
+    return { tgzPath, sha256, files };
+  } finally {
+    writeFileSync(manifestPath, original);
+  }
+}

package/src/profile.ts

@@ -512,7 +512,12 @@ export function syncProfileBlock(profile: OperatorProfile, home?: string, now?:
     let backup: string | null = null;
     if (existing !== null) {
       const stamp = (now ?? new Date()).toISOString().replace(/[:.]/g, '-');
+      // Two syncs inside one millisecond (a fast CI runner) share a stamp: MEASURED 2026-09-24 on
+      // package-story-gates (73ac1a32) — the second backup overwrote the first and the test that
+      // promises "backups accumulate rather than overwriting" read 1 file. A taken name gets a
+      // counter suffix; a backup is never written over an existing one.
       backup = `${target}.dz-profile-backup-${stamp}`;
+      for (let n = 1; existsSync(backup); n += 1) backup = `${target}.dz-profile-backup-${stamp}-${n}`;
       writeFileSync(backup, existing, { mode: 0o600 });
       chmodSync(backup, 0o600); // writeFileSync's mode applies only at creation
     }

package/src/publish-sibling-drift.ts

@@ -44,7 +44,7 @@ export type SiblingDriftStatus = 'same' | 'drift' | 'unavailable';
  * symmetric by construction (same function, same rules, both sides) but can miss a file
  * `.npmignore` excludes or include one npm would never ship.
  */
-export type InventorySource = 'npm-pack' | 'pnpm-pack' | 'readdir-approximation';
+export type InventorySource = 'pack-artifact' | 'npm-pack' | 'pnpm-pack' | 'readdir-approximation';
 
 export interface SiblingDriftResult {
   readonly name: string;
@@ -98,7 +98,7 @@ export interface DetectSiblingDriftOptions {
    * drift".
    */
   readonly localInventory?: LocalInventory;
-  /** Label for the injected provider's source (default `'npm-pack'`); the CLI passes `'pnpm-pack'` for a packed tree. */
+  /** Label for the injected provider (default 'npm-pack'); CLI uses 'pack-artifact'. */
   readonly localInventorySource?: InventorySource;
 }
 
@@ -140,6 +140,8 @@ export interface PackInventoryUnavailable {
  */
 export interface PackedTree {
   readonly packedDir: string;
+  /** Exact files from packArtifact().files; old providers may omit this. */
+  readonly paths?: readonly string[];
 }
 
 export type LocalInventoryResult = PackInventory | PackedTree | PackInventoryUnavailable;
@@ -453,7 +455,9 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
       }
       try {
         workspaceHashes = 'packedDir' in localResult
-          ? hashTreeFull(localResult.packedDir, workspaceManifest)
+          ? localResult.paths !== undefined
+            ? hashTreeFromPaths(localResult.packedDir, localResult.paths, workspaceManifest)
+            : hashTreeFull(localResult.packedDir, workspaceManifest)
           : hashTreeFromPaths(workspaceDir, localResult.paths, workspaceManifest);
       } catch (err) {
         if (!(err instanceof InventoryListingError)) throw err;
@@ -496,3 +500,12 @@ export function detectSiblingDrift(opts: DetectSiblingDriftOptions): SiblingDrif
   }
   return results;
 }
+
+
+/** Named drift evidence for both the publish BLOCKED line and its durable audit row. */
+export function formatDriftFiles(changedFiles: readonly string[], source: InventorySource, max = 5): string {
+  const shown = changedFiles.slice(0, Math.max(0, max));
+  const remaining = changedFiles.length - shown.length;
+  const names = [...shown, ...(remaining > 0 ? [`… (+${remaining} more)`] : [])].join(', ');
+  return `${names || '(no changed files)'} [source: ${source}]`;
+}

package/src/publish.ts

@@ -23,7 +23,7 @@ import { createHash } from 'node:crypto';
 
 import { claimCheck } from './claim-check.js';
 import { findReleaseLine, rewriteReleaseLine, isReleaseLineToken, shortPackageName } from './release-line.js';
-import { packedTarballName } from './packed-install-smoke.js';
+import { packArtifact, rewriteWorkspaceSpecs } from './pack-artifact.js';
 
 export type ProbeOutcome = {
   readonly attempt: number;
@@ -263,27 +263,7 @@ function maxPublished(name: string, localVersion: string, exec: PublishExec = ex
  * Mirror pnpm's package-time expansion of the three shorthand workspace dependency specs.
  * Pure by construction: callers provide both the source bytes and the sibling version table.
  */
-export function rewriteWorkspaceSpecs(
-  pkgJsonText: string,
-  siblingVersions: ReadonlyMap<string, string>,
-): string {
-  const pkg = JSON.parse(pkgJsonText) as Record<string, unknown>;
-  const fields = ['dependencies', 'peerDependencies', 'optionalDependencies', 'devDependencies'] as const;
-  for (const field of fields) {
-    const candidate = pkg[field];
-    if (candidate === null || typeof candidate !== 'object' || Array.isArray(candidate)) continue;
-    const table = candidate as Record<string, unknown>;
-    for (const [dep, spec] of Object.entries(table)) {
-      if (typeof spec !== 'string') continue;
-      const match = /^workspace:([*^~])$/.exec(spec);
-      const version = siblingVersions.get(dep);
-      if (match === null || version === undefined) continue;
-      const marker = match[1]!;
-      table[dep] = marker === '*' ? version : `${marker}${version}`;
-    }
-  }
-  return JSON.stringify(pkg, null, 2) + '\n';
-}
+export { rewriteWorkspaceSpecs } from './pack-artifact.js';
 
 /**
  * Pure half: which `workspace:`-declared deps of a package would pack to a floor that is neither
@@ -1311,34 +1291,13 @@ export function publishPackages(
       }
 
       if (opts.packedTransport !== undefined) {
-        // AM-1: pack ONCE, from a package.json whose workspace: specs are already resolved to each
-        // sibling's PINNED version — the SAME transformation `rewriteWorkspaceSpecs` performs — so
-        // the tarball about to be smoked is exactly what `npm publish <tgzPath>` ships. Lifecycle
-        // scripts already ran during the `build` step above; `prepublishOnly` is dropped here to
-        // mirror what pnpm itself strips at pack time (the manifest-freshness guard, cli.ts, does
-        // the identical transformation for verification — this is that same convention, now used
-        // to actually PRODUCE the artifact rather than merely check one).
-        const bumpedText = readFileSync(pkgJsonPath, 'utf-8'); // already carries newVersion
-        const rewritten = JSON.parse(rewriteWorkspaceSpecs(bumpedText, pinVersions)) as Record<string, unknown>;
-        const scripts = rewritten['scripts'];
-        if (scripts !== null && typeof scripts === 'object' && !Array.isArray(scripts)) {
-          delete (scripts as Record<string, unknown>)['prepublishOnly'];
-        }
-        const stagedText = JSON.stringify(rewritten, null, 2) + '\n';
-        let tgzPath: string;
-        let digest: string;
-        writeFileSync(pkgJsonPath, stagedText);
-        try {
-          const packOptions = { cwd: pkg.dir, stdio: 'pipe' as const, encoding: 'utf-8' as const };
-          if (opts.exec) opts.exec(`npm pack . --pack-destination ${JSON.stringify(opts.packedTransport.packDestDir)}`, packOptions);
-          else execSync(`npm pack . --pack-destination ${JSON.stringify(opts.packedTransport.packDestDir)}`, packOptions);
-          tgzPath = join(opts.packedTransport.packDestDir, packedTarballName(pkg.name, newVersion));
-          digest = sha256File(tgzPath);
-        } finally {
-          // The COMMITTED tree keeps `workspace:` specs (only the version bump is meant to stick) —
-          // the rewrite above is packing-only and is undone here regardless of pack's outcome.
-          writeFileSync(pkgJsonPath, bumpedText);
-        }
+        // Pack, inventory and digest the exact artifact later handed to npm publish.
+        const { tgzPath, sha256: digest } = packArtifact({
+          pkgDir: pkg.dir,
+          destDir: opts.packedTransport.packDestDir,
+          exec: opts.exec ?? execSync,
+          pinVersions,
+        });
         pendingPacked.push({
           name: pkg.name,
           dir: pkg.dir,