@geonosis/doctor 2.10.0 → 2.11.0

package/bin/geonosis-doctor.mjs

@@ -1,14 +1,24 @@
 #!/usr/bin/env node
-// Committed, so `pnpm install` can link the bin on a fresh clone — before `pnpm build` has
-// produced dist/. A bin that only exists after a build is a bin that is missing when you need it.
-//
-// In the repo, `src/` sits beside `dist/`, and a dist older than src answered for a fix it did not
-// carry once (#62). The published package ships no src, so there the check is skipped.
-import { existsSync, readdirSync, statSync } from 'node:fs'
+// Every packages/*/bin shim is packages/cli/bin/geonosis.mjs with its own name and entry: edit that
+// one, then `pnpm generate:shims`. Committed so `pnpm install` can link the bin on a fresh clone,
+// before `pnpm build` has made dist/. In the repo `src/` sits beside `dist/`, and a dist older
+// than src answered for a fix it did not carry once (#62); the published package ships no src, so
+// there the check is skipped.
+import { createHash } from 'node:crypto'
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const here = dirname(fileURLToPath(import.meta.url))
+const own = join(here, '..')
 // tsup never reads a test file, so one counting as source made every bin refuse a build that had
 // not gone stale (#399).
 const NOT_SOURCE = (name) =>
@@ -24,25 +34,162 @@ const newest = (dir, skip) =>
         return Math.max(most, entry.isDirectory() ? newest(at, skip) : statSync(at).mtimeMs)
       }, 0)
     : 0
-const src = join(here, '..', 'src')
-const dist = join(here, '..', 'dist')
+const digestOf = (dir, hash) => {
+  for (const name of readdirSync(dir).toSorted()) {
+    if (NOT_SOURCE(name)) continue
+    const at = join(dir, name)
+    if (statSync(at).isDirectory()) {
+      digestOf(at, hash)
+      continue
+    }
+    hash.update(name).update('\0').update(readFileSync(at)).update('\0')
+  }
+  return hash
+}
+const digest = (...dirs) => {
+  const hash = createHash('sha256')
+  for (const dir of dirs) if (existsSync(dir)) digestOf(dir, hash)
+  return hash.digest('hex')
+}
+// mtime says a source file was WRITTEN, not that it CHANGED. A checkout rewrites it with the same
+// content, and the next `pnpm build` is a cache hit that leaves the current dist exactly as it
+// was — so every bin refused with "run pnpm build", the action that had just changed nothing and
+// would change nothing again. So a digest of the sources is kept from the last run that found
+// dist current: the same digest later is the same sources, whatever their timestamps say, and a
+// different one is the staleness this guard exists for. The newest mtime is kept beside it so a
+// run over untouched sources need not hash them again. The second line is the same record for
+// the dists of the workspace dependencies this build read (row 584, below).
+const recordOf = (pkg) => join(pkg, '.turbo', 'geonosis-src-digest')
+const recorded = (pkg) => {
+  try {
+    const [first = '', second = ''] = readFileSync(recordOf(pkg), 'utf8').split('\n')
+    const [seen = '', sum = ''] = first.trim().split(' ')
+    const [depsSeen = '', depsSum = ''] = second.trim().split(' ')
+    return { depsSeen: Number(depsSeen), depsSum, seen: Number(seen), sum }
+  } catch {
+    return { depsSeen: 0, depsSum: '', seen: 0, sum: '' }
+  }
+}
+const remember = (pkg, known) => {
+  try {
+    mkdirSync(dirname(recordOf(pkg)), { recursive: true })
+    writeFileSync(recordOf(pkg), `${known.seen} ${known.sum}\n${known.depsSeen} ${known.depsSum}\n`)
+  } catch {
+    // A record nothing could write costs one more hash next time, never a wrong answer.
+  }
+}
+// The refusal names a package for turbo's --filter. A manifest that cannot be read costs the
+// name, never the decision: the first digest shim threw here — exit 1 and a node:fs frame — over a
+// tree with no package.json, and a guard that throws neither answers nor refuses.
+const manifestOf = (pkg) => {
+  try {
+    return JSON.parse(readFileSync(join(pkg, 'package.json'), 'utf8'))
+  } catch {
+    return {}
+  }
+}
+const refuse = (sentence) => {
+  process.stderr.write(`geonosis-doctor: ${sentence}\n`)
+  process.exit(2)
+}
+// Whether one package's dist reflects its src: 'unbuilt', 'stale' or 'current'. The same reading
+// for this package and for each workspace dependency, off that package's own record.
+const standing = (pkg) => {
+  const src = join(pkg, 'src')
+  const dist = join(pkg, 'dist')
+  if (!existsSync(src)) return 'current'
+  const built = newest(dist)
+  if (built === 0) return 'unbuilt'
+  const written = newest(src, NOT_SOURCE)
+  const known = recorded(pkg)
+  if (written > built) {
+    const sum = known.seen === written ? known.sum : digest(src)
+    if (sum !== known.sum) return 'stale'
+    if (known.seen !== written) remember(pkg, { ...known, seen: written, sum })
+  } else if (known.seen !== written) {
+    remember(pkg, { ...known, seen: written, sum: digest(src) })
+  }
+  return 'current'
+}
+// Row 584: a dist current against its own src can still have been built against an OLDER
+// dependency's dist — literally, when tsup inlined a workspace devDependency into it — and a
+// dependency whose src has moved past its dist is read by this dist stale, inlined or imported.
+// So every workspace dependency this manifest names (`workspace:`, resolved through the link pnpm
+// made, transitively) is held to the same reading as this package, and this dist must not be
+// older than any of theirs — by content: a dependency rebuilt to the same bytes is the same build,
+// so the `--force --filter` escape below cannot poison the tree it was run in.
+const workspaceDependencies = (pkg, found = new Map()) => {
+  const manifest = manifestOf(pkg)
+  for (const block of [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.optionalDependencies,
+    manifest.peerDependencies
+  ]) {
+    for (const [name, range] of Object.entries(block ?? {})) {
+      if (typeof range !== 'string' || !range.startsWith('workspace:')) continue
+      let dir
+      try {
+        dir = realpathSync(join(pkg, 'node_modules', name))
+      } catch {
+        continue // Not linked: the import will say so far more loudly than this guard can.
+      }
+      if (found.has(dir)) continue
+      found.set(dir, name)
+      workspaceDependencies(dir, found)
+    }
+  }
+  return found
+}
 // `newest` answers 0 for a directory that is NOT THERE and for one that is merely old, so the
 // two conditions were one comparison and one sentence — and the staleness sentence was printed
 // over trees that had never been built at all, blocking a turn in a fresh git worktree, which
 // has no dist because dist is not committed (#357). Only the second is evidence of a mistake.
-if (existsSync(src)) {
-  const built = newest(dist)
+if (existsSync(join(own, 'src'))) {
+  const built = newest(join(own, 'dist'))
   if (built === 0) {
-    process.stderr.write(
-      'geonosis-doctor: this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.\n'
+    refuse(
+      'this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.'
     )
-    process.exit(2)
   }
-  if (newest(src, NOT_SOURCE) > built) {
-    process.stderr.write(
-      'geonosis-doctor: dist is older than src — run pnpm build before trusting this bin.\n'
+  const name = manifestOf(own).name ?? '<this package>'
+  if (standing(own) === 'stale') {
+    refuse(
+      `dist is older than src — run pnpm build before trusting this bin. If that build just said FULL TURBO, the cache hit left a current dist with its old timestamp and this bin had not yet recorded the sources it was current for: pnpm build --force --filter=${name} rebuilds this one package and clears it.`
     )
-    process.exit(2)
+  }
+  const dependencies = workspaceDependencies(own)
+  const dists = new Map()
+  for (const [dir, dependency] of dependencies) {
+    const state = standing(dir)
+    if (state === 'unbuilt') {
+      refuse(
+        `${dependency}, which this dist reads, has never been built — run pnpm build. No dist there at all; nothing is stale.`
+      )
+    }
+    if (state === 'stale') {
+      refuse(
+        `${dependency}'s dist is older than its src, and this dist reads that dist — run pnpm build before trusting this bin. If that build just said FULL TURBO, the cache hit left that dist current with its old timestamp and nothing had yet recorded the sources it was current for: pnpm build --force --filter=${dependency} rebuilds that one package and clears it.`
+      )
+    }
+    dists.set(join(dir, 'dist'), dependency)
+  }
+  if (dists.size > 0) {
+    const known = recorded(own)
+    const theirs = [...dists.keys()].toSorted()
+    const depsNewest = theirs.reduce((most, dist) => Math.max(most, newest(dist)), 0)
+    if (depsNewest > built) {
+      const depsSum = known.depsSeen === depsNewest ? known.depsSum : digest(...theirs)
+      if (depsSum !== known.depsSum) {
+        const newer = theirs.filter((dist) => newest(dist) > built).map((dist) => dists.get(dist))
+        refuse(
+          `dist was built before the current dist of ${newer.join(', ')}, which it reads — run pnpm build before trusting this bin. If that build just said FULL TURBO, the dependency was rebuilt alone and this bin had not yet recorded the build it was current against: pnpm build --force --filter=${name} rebuilds this one package against it.`
+        )
+      }
+      if (known.depsSeen !== depsNewest) remember(own, { ...known, depsSeen: depsNewest, depsSum })
+    } else if (known.depsSeen !== depsNewest) {
+      remember(own, { ...known, depsSeen: depsNewest, depsSum: digest(...theirs) })
+    }
   }
 }