@fuzdev/fuz_gitops 0.78.1 → 0.79.0

package/dist/multi_repo_publisher.js

@@ -4,10 +4,12 @@ import { styleText as st } from 'node:util';
 import { repo_is_npm } from './local_repo.js';
 import { update_package_json } from './dependency_updater.js';
 import { generate_publishing_plan } from './publishing_plan.js';
+import { load_repos_status, to_repos_command } from './repos_status_load.js';
+import { check_publish_readiness } from './repo_readiness.js';
 import { default_gitops_operations } from './operations_defaults.js';
 import { GITOPS_NPM_WAIT_TIMEOUT_DEFAULT } from './gitops_constants.js';
 import { summarize_events } from './publishing_event.js';
-import { capture_handler, multi_handler } from './publishing_event_handler.js';
+import { capture_handler, multi_handler, redact_secrets } from './publishing_event_handler.js';
 export const publish_repos = async (repos, options) => {
     const { log, ops = default_gitops_operations } = options;
     // Convenience entry: generate the plan, then execute it. Callers that already hold a
@@ -27,6 +29,7 @@ export const publish_repos = async (repos, options) => {
 export const execute_publishing_plan = async (all_repos, plan, options) => {
     const start_time = Date.now();
     const { wetrun, log, ops = default_gitops_operations } = options;
+    const version_strategy = options.version_strategy ?? 'caret';
     // Only npm repos publish; drop any non-npm repos (e.g. cargo) so preflight and the
     // executor's name lookup never touch them. The plan already excludes them too.
     const repos = all_repos.filter(repo_is_npm);
@@ -42,20 +45,16 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
     const emit = (event) => {
         events_handler.emit(event);
     };
-    // Preflight checks (skip for dry runs since we're not actually publishing)
+    // Preflight checks (skip for dry runs since we're not actually publishing): it builds
+    // exactly the packages the plan publishes. Repo git state isn't preflight's:
+    // `gitops_publish --wetrun` gates on it before its confirmation prompt.
     if (wetrun) {
-        const preflight_options = {
-            skip_changesets: false, // Always check for changesets
-            required_branch: 'main',
-            log
-        };
         const preflight = await ops.preflight.run_preflight_checks({
             repos,
-            preflight_options,
-            git_ops: ops.git,
+            version_changes: plan.version_changes,
+            log,
             npm_ops: ops.npm,
-            build_ops: ops.build,
-            changeset_ops: ops.changeset
+            build_ops: ops.build
         });
         if (!preflight.ok) {
             throw new TaskError(`Preflight checks failed: ${preflight.errors.join(', ')}`);
@@ -96,6 +95,23 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
         const repo = repo_by_name.get(pkg_name);
         if (!repo)
             continue;
+        // Re-check the repo right before its `gro publish`: the gate ran before the prompt, and a
+        // cascade's npm waits leave a long window. `--no-pull` means gro won't notice origin
+        // moving until its push is rejected — after `changeset publish` put the version on npm —
+        // and its `commit -a` would sweep a tracked edit made since into the release commit.
+        // Aborting here, before any npm side effect, leaves the dirty state resumption expects.
+        if (wetrun) {
+            const recheck = await recheck_publish_readiness(repo, options.registry, ops);
+            if (!recheck.ok) {
+                const err = new Error(`${pkg_name} isn't ready to publish, re-checked right before \`gro publish\`: ` +
+                    `${recheck.message}. Aborting before it touches npm — fix it, then re-run ` +
+                    `'gro gitops_publish --wetrun' to re-plan from the current state.`);
+                failed.set(pkg_name, err);
+                emit({ event: 'package_failed', name: pkg_name, error: err.message, code: 'not_ready' });
+                log?.error(st('red', `  ❌ ${err.message}`));
+                break;
+            }
+        }
         // An earlier publish may have rewritten this package's dependency ranges. No install is
         // needed here: `gro publish` runs its own install (which self-heals npm's stale-cache
         // ETARGET), so the package's freshly-rewritten deps are installed and healed as part of
@@ -146,10 +162,9 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
                     log
                 });
                 if (!wait_result.ok) {
-                    // Handle inline (don't throw into the generic catch): the npm-wait failure
-                    // carries a typed `timeout` signal, so we know this is a network failure
-                    // without sniffing the message.
-                    const err = new Error(`Failed to wait for package: ${wait_result.message}${wait_result.timeout ? ' (timeout)' : ''}`);
+                    // Handle inline (don't throw into the generic catch): a failed npm wait is a
+                    // network failure, known by where it happened rather than by sniffing the message.
+                    const err = new Error(`Failed to wait for package: ${wait_result.message}`);
                     failed.set(pkg_name, err);
                     emit({ event: 'package_failed', name: pkg_name, error: err.message, code: 'network' });
                     log?.error(st('red', `  ❌ Failed to publish ${pkg_name}: ${err.message}`));
@@ -158,8 +173,8 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
                 emit({ event: 'npm_waited', name: pkg_name, version: version.new_version });
                 // 3. Update every dependent the plan says has a prod/peer dep on this package.
                 // This rewrites their package.json ranges and creates their auto-changeset,
-                // which a later step of this same pass publishes. The dependent is queued for
-                // a single install just before it publishes (see the top of the loop).
+                // which a later step of this same pass publishes; its `gro publish` installs the
+                // rewritten deps then (see the top of the loop).
                 const dependent_updates = group_dependency_updates(plan.dependency_updates, published, (update) => update.updated_dependency === pkg_name &&
                     (update.type === 'dependencies' || update.type === 'peerDependencies'));
                 for (const [dependent_name, updates] of dependent_updates) {
@@ -184,24 +199,15 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
                         });
                     }
                     changed_repos.add(dependent_name); // Mark as changed for deployment
-                    if (republishes) {
-                        await update_package_json(dependent_repo, updates, {
-                            strategy: options.version_strategy || 'caret',
-                            published_versions: published, // creates the auto-changeset
-                            log,
-                            git_ops: ops.git,
-                            fs_ops: ops.fs
-                        });
-                    }
-                    else {
-                        // update-only leaf: rewrite ranges + commit, no changeset (it won't republish)
-                        await update_package_json(dependent_repo, updates, {
-                            strategy: options.version_strategy || 'caret',
-                            log,
-                            git_ops: ops.git,
-                            fs_ops: ops.fs
-                        });
-                    }
+                    await update_package_json(dependent_repo, updates, {
+                        strategy: version_strategy,
+                        // `published_versions` creates the auto-changeset; an update-only leaf gets
+                        // its ranges rewritten and committed with no changeset (it won't republish)
+                        published_versions: republishes ? published : undefined,
+                        log,
+                        git_ops: ops.git,
+                        fs_ops: ops.fs
+                    });
                 }
             }
         }
@@ -214,10 +220,11 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
                 error: err.message,
                 // TODO: emit a precise code once the npm/process ops return typed errors —
                 // today a publish-step cause lives in unstructured stderr, so use the honest
-                // coarse bucket rather than guessing 'auth'/'network'/'build' from the message.
+                // coarse bucket rather than guessing a cause (auth, build, …) from the message.
                 code: 'publish'
             });
-            log?.error(st('red', `  ❌ Failed to publish ${pkg_name}: ${err.message}`));
+            // the first line alone: the stderr tail the rest repeats just streamed live
+            log?.error(st('red', `  ❌ Failed to publish ${pkg_name}: ${err.message.split('\n')[0]}`));
             break; // Always fail fast on error
         }
     }
@@ -252,7 +259,7 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
             // package.json but must NOT generate a changeset — dev-only changes redeploy
             // (rebuild) without republishing, so they shouldn't bump the next release.
             await update_package_json(repo, dev_updates, {
-                strategy: options.version_strategy || 'caret',
+                strategy: version_strategy,
                 log,
                 git_ops: ops.git,
                 fs_ops: ops.fs
@@ -275,18 +282,24 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
                 // Build fresh (no --no-build): a deployed site bundles its dependencies, so it
                 // must be rebuilt against the versions this run just published — the preflight
                 // build ran against the old versions, before the cascade rewrote package.json.
-                const deploy_result = await ops.process.spawn({
+                const deploy_result = await ops.process.run_interactive({
                     cmd: 'gro',
                     args: ['deploy'],
-                    cwd: repo.repo_dir
+                    cwd: repo.repo_dir,
+                    stdout: options.child_stdout
                 });
                 if (deploy_result.ok) {
                     emit({ event: 'deploy_completed', name: repo.library.name });
                     log?.info(st('green', `  ✅ Deployed ${repo.library.name}`));
                 }
                 else {
-                    emit({ event: 'deploy_failed', name: repo.library.name, error: deploy_result.message });
-                    log?.warn(st('yellow', `  ⚠️  Failed to deploy ${repo.library.name}`));
+                    emit({
+                        event: 'deploy_failed',
+                        name: repo.library.name,
+                        error: format_run_failure(deploy_result)
+                    });
+                    // the stderr tail just streamed live, so the log names the failure alone
+                    log?.warn(st('yellow', `  ⚠️  Failed to deploy ${repo.library.name}: ${deploy_result.message}`));
                 }
             }
             catch (error) {
@@ -351,10 +364,13 @@ export const execute_publishing_plan = async (all_repos, plan, options) => {
  * Publishes a single repo using `gro publish`.
  *
  * Dry run mode: reports the precomputed plan entry without side effects.
- * Real mode: runs `gro publish --no-build` (builds already validated in preflight),
- * reads the new version from `package.json`, and returns it alongside the plan's
- * predicted bump metadata. The caller compares the read-back version to the plan to
- * detect drift.
+ * Real mode: runs `gro publish --no-build --no-pull --branch <entry branch>` (builds
+ * already validated in preflight; the readiness re-check just found the branch in sync
+ * with origin or ahead of it, so gro's own `git pull` is skipped, and gro checks out the branch the
+ * registry entry follows rather than its `main` default) in the foreground — its output
+ * live and stdin the terminal's, for npm's one-time-password prompt — reads the new version from
+ * `package.json`, and returns it alongside the plan's predicted bump metadata. The
+ * caller compares the read-back version to the plan to detect drift.
  *
  * @throws {Error} if the publish, version read-back, or commit-hash lookup fails
  */
@@ -373,14 +389,15 @@ const publish_single_repo = async (repo, options, ops, planned) => {
             tag: `v${planned.to}`
         };
     }
-    // Run gro publish with --no-build (builds were validated in preflight checks)
-    const publish_result = await ops.process.spawn({
+    const publish_result = await ops.process.run_interactive({
         cmd: 'gro',
-        args: ['publish', '--no-build'],
-        cwd: repo.repo_dir
+        args: gro_publish_args(repo),
+        cwd: repo.repo_dir,
+        stdout: options.child_stdout
     });
     if (!publish_result.ok) {
-        throw new Error(`Failed to publish ${repo.library.name}: ${publish_result.message}`);
+        // no "Failed to publish" prefix: the caller's log and report name the package
+        throw new Error(format_run_failure(publish_result));
     }
     // Read the new version from package.json after gro publish
     const package_json_path = join(repo.repo_dir, 'package.json');
@@ -408,6 +425,53 @@ const publish_single_repo = async (repo, options, ops, planned) => {
         tag: `v${new_version}`
     };
 };
+/**
+ * Re-checks one repo's readiness right before its `gro publish`: `repos status
+ * --fetch --json <key>` through `ops.repos`, then `check_publish_readiness` on
+ * that entry — the gate's predicate, so a branch ahead of origin (the
+ * executor's own dependency-rewrite commit leaves a dependent ahead) is ready.
+ *
+ * @returns ok, or the problems found (or why the check couldn't run), joined
+ */
+const recheck_publish_readiness = async (repo, registry, ops) => {
+    const key = repo.entry.key;
+    const loaded = await load_repos_status({
+        keys: [key],
+        registry,
+        fetch: true,
+        repos_ops: ops.repos
+    });
+    if (!loaded.ok)
+        return { ok: false, message: `the check didn't run: ${loaded.message}` };
+    const checked = check_publish_readiness({
+        report: loaded.report,
+        keys: [key],
+        repos_command: to_repos_command(registry)
+    });
+    return checked.ok ? { ok: true } : { ok: false, message: checked.lines.join('; ') };
+};
+/**
+ * The `gro publish` arguments the executor runs in a repo: `--no-build`, since
+ * preflight validated the build; `--no-pull`, since the readiness re-check right
+ * before found the branch in sync with origin or ahead of it, so a pull would only
+ * move what the check vouched for; and `--branch` naming the branch the registry entry follows,
+ * which gro checks out (its default is `main`).
+ */
+const gro_publish_args = (repo) => {
+    const args = ['publish', '--no-build', '--no-pull'];
+    if (repo.entry.branch !== null)
+        args.push('--branch', repo.entry.branch);
+    return args;
+};
+/**
+ * The failure message for a command the executor ran: why it failed on the first
+ * line, then the end of its stderr with known secret shapes redacted, since the
+ * message lands in the result, the event stream, and the JSON or markdown report.
+ * The live log shows the first line alone, the stderr having just streamed.
+ */
+const format_run_failure = (failure) => failure.stderr_tail
+    ? `${failure.message}\nthe end of its stderr:\n${redact_secrets(failure.stderr_tail)}`
+    : failure.message;
 /**
  * Groups dependency updates by dependent package — `dependent → (dependency → new
  * version)`, the shape `update_package_json` consumes. Restricted by `predicate` (e.g.

package/dist/npm_registry.d.ts

@@ -6,13 +6,31 @@ export interface WaitOptions {
     max_delay?: number;
     timeout?: number;
 }
-export interface PackageInfo {
-    name: string;
-    version: string;
+/**
+ * The side effects of the registry checks — running npm, sleeping, and reading
+ * the clock — injected so tests drive them with plain objects.
+ */
+export interface NpmRegistryDeps {
+    /**
+     * Runs `npm` with `args` and resolves to what it wrote to stdout — empty when
+     * nothing, or when npm couldn't run. A throw counts as unavailable too.
+     */
+    run_npm: (args: Array<string>) => Promise<string>;
+    /** Sleeps for `ms` milliseconds. */
+    wait: (ms: number) => Promise<void>;
+    /** The current time in milliseconds, as `Date.now`. */
+    now: () => number;
 }
+export declare const default_npm_registry_deps: NpmRegistryDeps;
+/**
+ * Checks whether `pkg@version` is on the npm registry, by `npm view`.
+ *
+ * @returns `true` when the registry reports that exact version, `false` when it
+ * doesn't or npm couldn't run
+ */
 export declare const check_package_available: (pkg: string, version: string, options?: {
     log?: Logger;
-}) => Promise<boolean>;
+}, deps?: NpmRegistryDeps) => Promise<boolean>;
 /**
  * Waits for package version to propagate to NPM registry.
  *
@@ -28,19 +46,5 @@ export declare const check_package_available: (pkg: string, version: string, opt
  * @param options.timeout - total timeout in ms (default 300000 = 5min)
  * @throws {Error} if timeout reached or max attempts exceeded
  */
-export declare const wait_for_package: (pkg: string, version: string, options?: WaitOptions) => Promise<void>;
-/**
- * Fetches package metadata from NPM registry.
- *
- * Returns name and latest version. Returns null if package doesn't exist
- * or registry is unreachable.
- *
- * @returns package info or null on error/not found
- */
-export declare const get_package_info: (pkg: string, options?: {
-    log?: Logger;
-}) => Promise<PackageInfo | null>;
-export declare const package_exists: (pkg: string, options?: {
-    log?: Logger;
-}) => Promise<boolean>;
+export declare const wait_for_package: (pkg: string, version: string, options?: WaitOptions, deps?: NpmRegistryDeps) => Promise<void>;
 //# sourceMappingURL=npm_registry.d.ts.map

package/dist/npm_registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm_registry.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/npm_registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAKtD,MAAM,WAAW,WAAW;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,uBAAuB,GACnC,KAAK,MAAM,EACX,SAAS,MAAM,EACf,UAAS;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,KAC5B,OAAO,CAAC,OAAO,CAiBjB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,GAC5B,KAAK,MAAM,EACX,SAAS,MAAM,EACf,UAAS,WAAgB,KACvB,OAAO,CAAC,IAAI,CA2Cd,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC5B,KAAK,MAAM,EACX,UAAS;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,KAC5B,OAAO,CAAC,WAAW,GAAG,IAAI,CAkB5B,CAAC;AAEF,eAAO,MAAM,cAAc,GAC1B,KAAK,MAAM,EACX,UAAS;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,KAC5B,OAAO,CAAC,OAAO,CAGjB,CAAC"}
+{"version":3,"file":"npm_registry.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/npm_registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAKtD,MAAM,WAAW,WAAW;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,oCAAoC;IACpC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,uDAAuD;IACvD,GAAG,EAAE,MAAM,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,yBAAyB,EAAE,eAIvC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,KAAK,MAAM,EACX,SAAS,MAAM,EACf,UAAS;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,EAC9B,OAAM,eAA2C,KAC/C,OAAO,CAAC,OAAO,CASjB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,GAC5B,KAAK,MAAM,EACX,SAAS,MAAM,EACf,UAAS,WAAgB,EACzB,OAAM,eAA2C,KAC/C,OAAO,CAAC,IAAI,CAwCd,CAAC"}

package/dist/npm_registry.js

@@ -1,17 +1,22 @@
 import { spawn_out } from '@fuzdev/fuz_util/process.ts';
 import { wait } from '@fuzdev/fuz_util/async.ts';
 import { styleText as st } from 'node:util';
-export const check_package_available = async (pkg, version, options = {}) => {
+export const default_npm_registry_deps = {
+    run_npm: async (args) => (await spawn_out('npm', args)).stdout ?? '',
+    wait,
+    now: () => Date.now()
+};
+/**
+ * Checks whether `pkg@version` is on the npm registry, by `npm view`.
+ *
+ * @returns `true` when the registry reports that exact version, `false` when it
+ * doesn't or npm couldn't run
+ */
+export const check_package_available = async (pkg, version, options = {}, deps = default_npm_registry_deps) => {
     const { log } = options;
     try {
-        // Use npm view to check if the specific version exists
-        const result = await spawn_out('npm', ['view', `${pkg}@${version}`, 'version']);
-        if (result.stdout) {
-            const output = result.stdout.trim();
-            // If we get a version back, it exists
-            return output === version;
-        }
-        return false;
+        const stdout = await deps.run_npm(['view', `${pkg}@${version}`, 'version']);
+        return stdout.trim() === version;
     }
     catch (error) {
         log?.debug(`Failed to check ${pkg}@${version}: ${error}`);
@@ -33,63 +38,31 @@ export const check_package_available = async (pkg, version, options = {}) => {
  * @param options.timeout - total timeout in ms (default 300000 = 5min)
  * @throws {Error} if timeout reached or max attempts exceeded
  */
-export const wait_for_package = async (pkg, version, options = {}) => {
+export const wait_for_package = async (pkg, version, options = {}, deps = default_npm_registry_deps) => {
     const { log, max_attempts = 30, initial_delay = 1000, max_delay = 60000, timeout = 300000 // 5 minutes default
      } = options;
-    const start_time = Date.now();
+    const start_time = deps.now();
     let attempt = 0;
     let delay = initial_delay;
     while (attempt < max_attempts) {
         attempt++;
-        // Check timeout
-        if (Date.now() - start_time > timeout) {
+        if (deps.now() - start_time > timeout) {
             throw new Error(`Timeout waiting for ${pkg}@${version} after ${timeout}ms`);
         }
-        // Check if package is available
-        if (await check_package_available(pkg, version, { log })) {
+        if (await check_package_available(pkg, version, { log }, deps)) {
             log?.info(st('green', `    ✓ ${pkg}@${version} is now available on NPM`));
             return;
         }
         // Log progress occasionally
-        if (attempt > 0 && attempt % 5 === 0) {
+        if (attempt % 5 === 0) {
             log?.info(st('dim', `    Still waiting... (attempt ${attempt}/${max_attempts})`));
         }
         // Wait with exponential backoff + jitter
         const jitter = Math.random() * delay * 0.1; // 10% jitter
         const actual_delay = Math.min(delay + jitter, max_delay);
-        await wait(actual_delay);
+        await deps.wait(actual_delay);
         // Exponential backoff
         delay = Math.min(delay * 1.5, max_delay);
     }
     throw new Error(`${pkg}@${version} not available after ${max_attempts} attempts`);
 };
-/**
- * Fetches package metadata from NPM registry.
- *
- * Returns name and latest version. Returns null if package doesn't exist
- * or registry is unreachable.
- *
- * @returns package info or null on error/not found
- */
-export const get_package_info = async (pkg, options = {}) => {
-    const { log } = options;
-    try {
-        const result = await spawn_out('npm', ['view', pkg, '--json']);
-        if (result.stdout) {
-            const data = JSON.parse(result.stdout);
-            return {
-                name: data.name,
-                version: data.version
-            };
-        }
-        return null;
-    }
-    catch (error) {
-        log?.debug(`Failed to get package info for ${pkg}: ${error}`);
-        return null;
-    }
-};
-export const package_exists = async (pkg, options = {}) => {
-    const info = await get_package_info(pkg, options);
-    return info !== null;
-};