@geonosis/release 1.4.0 → 2.1.0

package/dist/release-cli.js

@@ -1,99 +1,46 @@
 import {
+  ADOPTION_NEXT,
   CannotRun,
+  DEFAULT_REGISTRY,
+  MIGRATIONS_NEXT,
+  PUBLISHED_NEXT,
+  SCHEMA_NEXT,
+  SMOKE_NEXT,
+  adoptionEnvelope,
+  comparisonsIn,
+  formatAdoption,
+  formatBaseline,
   formatDeployed,
   formatMigrations,
   formatPlan,
   formatProve,
+  formatPublished,
+  formatSchema,
+  formatSnapshot,
+  formatSweep,
   formatVerdict,
+  migrationsEnvelope,
   prove,
   proveOver,
+  publishedEnvelope,
+  readReleaseConfig,
+  recordBaseline,
+  runAdoption,
   runDeployed,
   runMigrations,
-  runPlan
-} from "./chunk-D5IC766I.js";
-
-// src/release-cli.ts
-import { resolve } from "path";
-
-// src/envelope.ts
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
-import { fileURLToPath } from "url";
-var ENVELOPES_DIR = ".geonosis/envelopes";
-var envelopePath = (root, tool) => join(root, ENVELOPES_DIR, `${tool}.json`);
-var UnbalancedEnvelope = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "UnbalancedEnvelope";
-  }
-};
-var isCount = (value) => Number.isSafeInteger(value) && value >= 0;
-var unbalancedMessage = (envelope, next) => `${envelope.tool}: considered ${envelope.considered} but accounts for ${envelope.read + envelope.refused.length + envelope.excused.length} \u2014 ${envelope.read} read + ${envelope.refused.length} refused + ${envelope.excused.length} excused. A run that has lost count of its own inputs cannot say what it measured, so no verdict was rendered and no envelope was written. Next: ${next}`;
-var writeEnvelope = ({
-  envelope,
-  next,
-  root
-}) => {
-  if (envelope.tool.trim() === "") {
-    throw new UnbalancedEnvelope(
-      `an envelope with no tool name cannot be filed or reported against. Next: ${next}`
-    );
-  }
-  if (envelope.version.trim() === "") {
-    throw new UnbalancedEnvelope(
-      `${envelope.tool}: an envelope that cannot name the build that wrote it dates nothing, and a stale one reads exactly like a fresh one. Next: ${next}`
-    );
-  }
-  if (!isCount(envelope.considered) || !isCount(envelope.read)) {
-    throw new UnbalancedEnvelope(
-      `${envelope.tool}: considered ${envelope.considered} and read ${envelope.read} \u2014 a census is a whole number of things, and arithmetic over anything else balances by accident. Next: ${next}`
-    );
-  }
-  if (envelope.considered !== envelope.read + envelope.refused.length + envelope.excused.length) {
-    throw new UnbalancedEnvelope(unbalancedMessage(envelope, next));
-  }
-  const at = envelopePath(root, envelope.tool);
-  mkdirSync(dirname(at), { recursive: true });
-  writeFileSync(at, `${JSON.stringify(envelope, void 0, 2)}
-`);
-  return at;
-};
-var UNKNOWN = "unknown";
-var versionIn = (dir) => {
-  try {
-    const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-    return typeof manifest.version === "string" ? manifest.version : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var versionOf = (moduleUrl) => {
-  let dir = dirname(fileURLToPath(moduleUrl));
-  for (; ; ) {
-    const found = versionIn(dir);
-    if (found !== void 0) return found;
-    const up = dirname(dir);
-    if (up === dir) return UNKNOWN;
-    dir = up;
-  }
-};
-var MIGRATIONS_TOOL = "release-migrations";
-var MIGRATIONS_NEXT = "geonosis-release migrations --since <ref> --json and compare `files` against `unreadable` \u2014 every added file leaves by exactly one door, and a file in one list and not the other is the accounting bug this refuses over";
-var migrationsEnvelope = (report, durationMs) => ({
-  considered: report.files.length,
-  durationMs,
-  excused: report.files.filter((one) => one.state === "excused").map((one) => ({
-    path: one.path,
-    reason: "a contract-migration marker this gate could believe"
-  })),
-  findings: [...report.refusals, ...report.markers, ...report.squawk],
-  read: report.files.filter((one) => one.state !== "excused" && one.state !== "unreadable").length,
-  refused: report.unreadable.map((one) => ({ path: one.path, reason: one.why })),
-  tool: MIGRATIONS_TOOL,
-  version: versionOf(import.meta.url)
-});
+  runPlan,
+  runPublished,
+  runSchema,
+  runSnapshot,
+  schemaEnvelope,
+  sweepEnvelope,
+  sweepSmoke,
+  writeEnvelope
+} from "./chunk-MZWAN6WT.js";
 
 // src/release-cli.ts
+import { existsSync } from "fs";
+import { join, resolve } from "path";
 var USAGE = `geonosis-release <command> [options]
 
   migrations --since <ref> [--dialect <name>] [--root <dir>] [--json]
@@ -110,6 +57,17 @@ var USAGE = `geonosis-release <command> [options]
 
               Exit 0 clean, 1 refusals, 2 the run could not be made.
 
+  schema [--root <dir>] [--json]
+
+              The wall no oxlint rule can see. Over every migration under every directory
+              geonosis.json \u2192 release.schema.domains declares: a statement naming a table another
+              domain declared is a cross-domain dependency the import graph does not show, and a
+              current_setting('\u2026') outside release.schema.sessionVariables writes one consumer's
+              session vocabulary into a package everyone installs.
+
+              Options only, empty defaults; the block declared and empty is a refusal naming both.
+              Whole-directory, not diff-scoped \u2014 a domain's migrations are applied as a set.
+
   plan [--root <dir>] [--i-accept-an-unproven-smoke] [--json]
 
               The contract as data \u2014 geonosis.json \u2192 release.steps and release.proof \u2014 validated
@@ -133,13 +91,88 @@ var USAGE = `geonosis-release <command> [options]
               tree declares in the wrangler configs geonosis.json names and release.secrets.
               \`versions upload\` applies no triggers, and a secret can be put outside the gate
               entirely \u2014 so declared and deployed drift apart silently, with a green pipeline.
+
+  published --group [--registry <url>] [--wait <seconds>] [--root <dir>] [--json]
+
+              Every workspace's local version against the version the registry answers, with no
+              sampling. \`changeset publish\` exiting zero is not the release; the GROUP resolving
+              from npm is \u2014 a six-package sample announced a version while the one unchecked entry
+              point read one release behind, and the consumer's bump aborted on it and left a
+              nested duplicate (#147).
+
+              The registry is asked over HTTP, never through npm or bun: their manifest CACHE is
+              the thing that lied. --wait polls through the few minutes in which a freshly
+              published name still 404s.
+
+              Exit 0 the whole group is there, 1 a gap, 2 the registry could not be asked.
+
+  adoption [--registry <url>] [--root <dir>] [--json]
+
+              How far every declared consumer is from the version this workspace holds, read off
+              the recordings the smoke keeps and never off a consumer's disk. Per consumer: MATCH,
+              BEHIND <name> <declared> \u2192 <current>, INCOHERENT (a group published as one number
+              declared at two), FLOOR UNDECLARED (informational \u2014 a floor is opted into).
+
+              --registry compares against what npm answers instead of against this workspace.
+
+              Exit 0 always: it is a report, and the release review carries one row per consumer
+              from it (D-061).
+
+  smoke snapshot <name> --from <their tree> [--replace] [--root <dir>] [--json]
+                        [--typecheck <cmd>] [--lint <cmd>] [--doctor <cmd>]
+
+              Copy a consumer tree, read-only, into .geonosis/consumer-snapshots/<name>/ \u2014 the
+              thing a release must be read against. Installed packages, build output and the git
+              history stay behind; the manager comes off the lockfile; the versions every manifest
+              declares and the commands the smoke will run are recorded beside the copy.
+
+              The bytes are a private tree's (D-048), so it refuses to write where git would let
+              them be committed.
+
+  smoke baseline --snapshot <name> [--rc-dir <workspace>] [--install <cmd>] [--json]
+  smoke run      [--snapshot <name>] [--absent <name>]... [--rc-dir <workspace>] [--install <cmd>]
+                 [--json]
+
+              Pack every workspace package of the release candidate (\`pnpm pack\` \u2014 a tarball is
+              what a consumer installs, and a release that shipped no declarations shipped them in
+              the tree and not in the tarball), point a COPY of the snapshot's manifests at those
+              tarballs, install with the snapshot's own manager, and run the snapshot's own
+              typecheck, lint and doctor.
+
+              \`baseline\` records what those three answered at the versions the consumer is on.
+              \`run\` compares against it and refuses only what THIS release broke, in their
+              compiler's and their doctor's own lines. Exit 0 nothing new, 1 a new failure,
+              2 the run could not be made \u2014 including a phase the baseline cannot be compared to.
+
+              With no --snapshot it sweeps every consumer geonosis.json declares, one block each in
+              declaration order. A declared name with no recording whose tree is on this machine \u2014
+              named in .geonosis/consumer-trees.local.json, uncommitted \u2014 REFUSES with the snapshot
+              command to run; --absent <name> excuses one out loud and keeps it in the count. A
+              recording whose source tree has moved since it was taken prints STALE.
 `;
-var VALUED = /* @__PURE__ */ new Set(["--dialect", "--root", "--runner", "--since"]);
-var FLAGS = /* @__PURE__ */ new Set(["--check", "--i-accept-an-unproven-smoke", "--json"]);
+var VALUED = /* @__PURE__ */ new Set([
+  "--absent",
+  "--dialect",
+  "--doctor",
+  "--from",
+  "--install",
+  "--lint",
+  "--rc-dir",
+  "--registry",
+  "--root",
+  "--runner",
+  "--since",
+  "--snapshot",
+  "--typecheck",
+  "--wait"
+]);
+var FLAGS = /* @__PURE__ */ new Set(["--check", "--group", "--i-accept-an-unproven-smoke", "--json", "--replace"]);
 var DIALECTS = /* @__PURE__ */ new Set(["mikro-orm-ts", "postgres", "sqlite"]);
 var parseArgs = (argv) => {
+  const many = {};
   const read = {};
   const flags = /* @__PURE__ */ new Set();
+  const rest = [];
   let json = false;
   for (let index = 1; index < argv.length; index += 1) {
     const flag = argv[index] ?? "";
@@ -148,13 +181,18 @@ var parseArgs = (argv) => {
       flags.add(flag);
       continue;
     }
+    if (!flag.startsWith("--")) {
+      rest.push(flag);
+      continue;
+    }
     if (!VALUED.has(flag)) throw new CannotRun(`unknown argument "${flag}"`);
     const value = argv[index + 1];
     if (value === void 0 || value.startsWith("--")) throw new CannotRun(`${flag} needs a value`);
     read[flag] = value;
+    many[flag] = [...many[flag] ?? [], value];
     index += 1;
   }
-  return { command: argv[0] ?? "", flags, json, read };
+  return { command: argv[0] ?? "", flags, json, many, read, rest };
 };
 var rootOf = (parsed, cwd) => resolve(cwd, parsed.read["--root"] ?? cwd);
 var migrations = (parsed, cwd) => {
@@ -185,6 +223,24 @@ var migrations = (parsed, cwd) => {
   if (report.unreadable.length > 0) return 2;
   return report.ok ? 0 : 1;
 };
+var schema = (parsed, cwd) => {
+  const root = rootOf(parsed, cwd);
+  const startedAt = Date.now();
+  const report = runSchema({ root });
+  process.stdout.write(
+    parsed.json ? `${JSON.stringify(report, void 0, 2)}
+` : formatSchema(report)
+  );
+  const at = writeEnvelope({
+    envelope: schemaEnvelope(report, Date.now() - startedAt),
+    next: SCHEMA_NEXT,
+    root
+  });
+  if (!parsed.json) process.stdout.write(`envelope: ${at}
+`);
+  if (report.unreadable.length > 0) return 2;
+  return report.ok ? 0 : 1;
+};
 var plan = (parsed, cwd) => {
   const report = runPlan({
     accept: parsed.flags.has("--i-accept-an-unproven-smoke"),
@@ -223,6 +279,166 @@ var deployed = (parsed, cwd) => {
   );
   return report.ok ? 0 : 1;
 };
+var published = async (parsed, cwd) => {
+  if (!parsed.flags.has("--group")) {
+    throw new CannotRun("published needs --group \u2014 the whole workspace, or nothing");
+  }
+  const wait = parsed.read["--wait"];
+  if (wait !== void 0 && !/^\d+(?:\.\d+)?$/.test(wait)) {
+    throw new CannotRun(`--wait takes a number of seconds, not "${wait}"`);
+  }
+  const root = rootOf(parsed, cwd);
+  const startedAt = Date.now();
+  const report = await runPublished({
+    registry: parsed.read["--registry"] ?? DEFAULT_REGISTRY,
+    root,
+    waitSeconds: wait === void 0 ? 0 : Number(wait)
+  });
+  process.stdout.write(
+    parsed.json ? `${JSON.stringify(report, void 0, 2)}
+` : formatPublished(report)
+  );
+  const at = writeEnvelope({
+    envelope: publishedEnvelope(report, Date.now() - startedAt),
+    next: PUBLISHED_NEXT,
+    root
+  });
+  if (!parsed.json) process.stdout.write(`envelope: ${at}
+`);
+  if (report.unreachable > 0) return 2;
+  return report.ok ? 0 : 1;
+};
+var adoption = async (parsed, cwd) => {
+  const root = rootOf(parsed, cwd);
+  const startedAt = Date.now();
+  const registry = parsed.read["--registry"];
+  const report = await runAdoption({
+    declared: readReleaseConfig(root).smoke?.snapshots ?? [],
+    ...registry === void 0 ? {} : { registry },
+    root
+  });
+  process.stdout.write(
+    parsed.json ? `${JSON.stringify(report, void 0, 2)}
+` : formatAdoption(report)
+  );
+  const at = writeEnvelope({
+    envelope: adoptionEnvelope(report, Date.now() - startedAt),
+    next: ADOPTION_NEXT,
+    root
+  });
+  if (!parsed.json) process.stdout.write(`envelope: ${at}
+`);
+  return 0;
+};
+var namedCommands = (parsed) => ({
+  ...parsed.read["--doctor"] === void 0 ? {} : { doctor: parsed.read["--doctor"] },
+  ...parsed.read["--lint"] === void 0 ? {} : { lint: parsed.read["--lint"] },
+  ...parsed.read["--typecheck"] === void 0 ? {} : { typecheck: parsed.read["--typecheck"] }
+});
+var snapshot = (parsed, root) => {
+  const name = parsed.rest[1];
+  if (name === void 0) {
+    throw new CannotRun("smoke snapshot needs a name: smoke snapshot <name> --from <their tree>");
+  }
+  const from = parsed.read["--from"];
+  if (from === void 0) {
+    throw new CannotRun("smoke snapshot needs --from <the consumer tree to copy>");
+  }
+  const record = runSnapshot({
+    exclude: readReleaseConfig(root).smoke?.exclude ?? [],
+    from,
+    name,
+    named: namedCommands(parsed),
+    replace: parsed.flags.has("--replace"),
+    root
+  });
+  process.stdout.write(
+    parsed.json ? `${JSON.stringify(record, void 0, 2)}
+` : formatSnapshot(record)
+  );
+  return 0;
+};
+var wantedSnapshots = (parsed, root) => {
+  const configured = readReleaseConfig(root).smoke?.snapshots ?? [];
+  const named = parsed.read["--snapshot"];
+  const install = parsed.read["--install"];
+  const withFlag = (one) => {
+    const chosen = install ?? one.install;
+    return {
+      ...one.commands === void 0 ? {} : { commands: one.commands },
+      ...chosen === void 0 ? {} : { install: chosen },
+      name: one.name
+    };
+  };
+  if (named === void 0) return configured.map(withFlag);
+  return [withFlag(configured.find((one) => one.name === named) ?? { name: named })];
+};
+var rcOf = (parsed, root, cwd) => {
+  const named = parsed.read["--rc-dir"];
+  if (named !== void 0) return resolve(cwd, named);
+  if (existsSync(join(root, "package.json"))) return root;
+  throw new CannotRun(
+    "nothing here is a release candidate \u2014 pass --rc-dir <the workspace whose packages this release publishes>, because a smoke with nothing packed compares a tree to itself"
+  );
+};
+var baseline = (parsed, root, cwd) => {
+  const wanted = wantedSnapshots(parsed, root);
+  const one = wanted[0];
+  if (parsed.read["--snapshot"] === void 0 || one === void 0) {
+    throw new CannotRun("smoke baseline needs --snapshot <name>");
+  }
+  const rc = parsed.read["--rc-dir"];
+  const recorded = recordBaseline({
+    ...one.commands === void 0 ? {} : { commands: one.commands },
+    ...one.install === void 0 ? {} : { install: one.install },
+    name: one.name,
+    ...rc === void 0 ? {} : { rc: resolve(cwd, rc) },
+    root
+  });
+  process.stdout.write(
+    parsed.json ? `${JSON.stringify(recorded, void 0, 2)}
+` : formatBaseline(one.name, recorded)
+  );
+  return 0;
+};
+var smokeRun = (parsed, root, cwd) => {
+  const startedAt = Date.now();
+  const wanted = wantedSnapshots(parsed, root);
+  if (wanted.length === 0) {
+    throw new CannotRun(
+      "nothing here names a consumer to read this release against \u2014 geonosis.json \u2192 release.smoke.snapshots names them, or pass --snapshot <name>. A release check over zero consumers is not a green release check."
+    );
+  }
+  const swept = sweepSmoke({
+    absent: parsed.many["--absent"] ?? [],
+    rc: rcOf(parsed, root, cwd),
+    root,
+    skipMissing: parsed.read["--snapshot"] === void 0,
+    wanted
+  });
+  process.stdout.write(
+    parsed.json ? `${JSON.stringify(swept, void 0, 2)}
+` : formatSweep(swept)
+  );
+  const at = writeEnvelope({
+    envelope: sweepEnvelope(swept, Date.now() - startedAt),
+    next: SMOKE_NEXT,
+    root
+  });
+  if (!parsed.json) process.stdout.write(`envelope: ${at}
+`);
+  const comparisons = comparisonsIn(swept);
+  if (comparisons.some((one) => one.refused.length > 0)) return 2;
+  return comparisons.every((one) => one.ok) ? 0 : 1;
+};
+var smoke = (parsed, cwd) => {
+  const root = rootOf(parsed, cwd);
+  const verb = parsed.rest[0];
+  if (verb === "snapshot") return snapshot(parsed, root);
+  if (verb === "baseline") return baseline(parsed, root, cwd);
+  if (verb === "run") return smokeRun(parsed, root, cwd);
+  throw new CannotRun(`smoke has snapshot, baseline and run \u2014 "${verb ?? ""}" is none of them`);
+};
 var CONFIG_SHAPE = `geonosis-release reads geonosis.json
 
 geonosis.json \u2192 "release"      every key optional; a repo that configured nothing gets nothing
@@ -232,6 +448,15 @@ geonosis.json \u2192 "release"      every key optional; a repo that configured n
       phases    string[]?       "up" and/or "down" (default ["up"])
       squawk    object?         { exclude: string[] } \u2014 the rule ids to leave out
   proof         object?         { mustAssertVersion: boolean }
+  schema        object?         the walls no oxlint rule can see (#168)
+      domains   Entry[]?        { dir, name, tables } \u2014 whose migrations, and whose tables
+      sessionVariables string[]? the session variable names DDL may name
+  smoke         object?         the consumer trees this release is read against
+      exclude   string[]?       what a snapshot leaves behind, beyond the built and the installed
+      snapshots Entry[]?        { name, install?, commands? } \u2014 the recorded snapshot, the command
+                                that tree is installed with when the manager's default is not it,
+                                and { doctor?, lint?, typecheck? } when their gates are not the
+                                scripts of those names
   secrets       string[]?       the secret names a deployment carries
   steps         string[]?       the release steps
   workers       string[]?       the workers it deploys
@@ -239,7 +464,10 @@ geonosis.json \u2192 "release"      every key optional; a repo that configured n
   wranglerEnv   string?         the named environment block to read out of them
 
 A key outside either list is refused BY NAME, with the accepted set. This shape had to be read out
-of a bundled chunk file by a consumer once (#75).`;
+of a bundled chunk file by a consumer once (#75).
+
+published reads no geonosis.json at all: its inputs are every package.json under the root \u2014 "name"
+and "version", and "private" to tell a package a publish is a claim about from one it is not.`;
 var main = async () => {
   const argv = process.argv.slice(2);
   if (argv.includes("--print-config-shape")) {
@@ -252,12 +480,18 @@ var main = async () => {
     return 0;
   }
   const parsed = parseArgs(argv);
+  if (parsed.command === "smoke") return smoke(parsed, process.cwd());
+  const stray = parsed.rest[0];
+  if (stray !== void 0) throw new CannotRun(`unknown argument "${stray}"`);
   if (parsed.command === "migrations") return migrations(parsed, process.cwd());
   if (parsed.command === "plan") return plan(parsed, process.cwd());
+  if (parsed.command === "schema") return schema(parsed, process.cwd());
   if (parsed.command === "prove") return proving(parsed, process.cwd());
   if (parsed.command === "deployed") return deployed(parsed, process.cwd());
+  if (parsed.command === "published") return published(parsed, process.cwd());
+  if (parsed.command === "adoption") return adoption(parsed, process.cwd());
   throw new CannotRun(
-    `no command called "${parsed.command}" \u2014 this bin has migrations, plan, prove, deployed`
+    `no command called "${parsed.command}" \u2014 this bin has migrations, schema, plan, prove, deployed, published, adoption, smoke`
   );
 };
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/release",
-  "version": "1.4.0",
+  "version": "2.1.0",
   "types": "./dist/index.d.ts",
   "description": "The release contract with its proofs: an expand-only migration gate over three dialects, a smoke that must name the version that answered it, and declared ≠ deployed.",
   "keywords": [
@@ -45,7 +45,7 @@
   },
   "devDependencies": {
     "squawk-cli": "2.63.0",
-    "@geonosis/ratchet": "1.4.0"
+    "@geonosis/ratchet": "2.1.0"
   },
   "engines": {
     "node": ">=22"