@gjsify/cli 0.5.0 → 0.5.2

package/lib/bundler-pick.d.ts

@@ -78,6 +78,20 @@ export declare function runWatch(finalOpts: BundlerOptions): Promise<RolldownWat
  */
 export declare function runBundle(finalOpts: BundlerOptions): Promise<RolldownOutput>;
 export declare function shouldUseNative(): Promise<boolean>;
+/**
+ * Walk parent directories from `startDir` (and optionally a second anchor
+ * `bundleDir`) looking for `node_modules/@gjsify/rolldown-native/package.json`.
+ * Returns the package root path (parent of its `package.json`) on the first
+ * hit, or null when nothing is found within 12 levels.
+ *
+ * This is a raw `existsSync`-based probe that bypasses both `createRequire`
+ * (whose GJS polyfill may not walk the full chain when anchored inside a
+ * sub-package dir) and `findWorkspaceRoot` (which requires `discoverWorkspaces`
+ * to map the sub-package to a workspace member, a step that can fail under
+ * the GJS polyfill stack). Used by `tryLoadNative` as an explicit fallback
+ * when the standard `resolveNpmPackage` anchors miss.
+ */
+export declare function findRolldownNativeDir(startDir: string, bundleDir?: string): string | null;
 /**
  * Sanitize fields the JSON encoder can't ship to the Rust deserializer.
  *

package/lib/bundler-pick.js

@@ -27,7 +27,7 @@
 // at hook-call time. The current gjsify plugin set doesn't use any
 // of those, so we don't gate on it; future incompatibilities surface
 // as build errors rather than silent wrong behavior.
-import { promises as fs } from 'node:fs';
+import { promises as fs, existsSync } from 'node:fs';
 import * as path from 'node:path';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
@@ -199,6 +199,39 @@ export async function shouldUseNative() {
     const native = await tryLoadNative();
     return native !== null;
 }
+/**
+ * Walk parent directories from `startDir` (and optionally a second anchor
+ * `bundleDir`) looking for `node_modules/@gjsify/rolldown-native/package.json`.
+ * Returns the package root path (parent of its `package.json`) on the first
+ * hit, or null when nothing is found within 12 levels.
+ *
+ * This is a raw `existsSync`-based probe that bypasses both `createRequire`
+ * (whose GJS polyfill may not walk the full chain when anchored inside a
+ * sub-package dir) and `findWorkspaceRoot` (which requires `discoverWorkspaces`
+ * to map the sub-package to a workspace member, a step that can fail under
+ * the GJS polyfill stack). Used by `tryLoadNative` as an explicit fallback
+ * when the standard `resolveNpmPackage` anchors miss.
+ */
+export function findRolldownNativeDir(startDir, bundleDir) {
+    const relPath = path.join('node_modules', '@gjsify', 'rolldown-native', 'package.json');
+    const dirsToSearch = [startDir];
+    if (bundleDir && bundleDir !== startDir)
+        dirsToSearch.push(bundleDir);
+    for (const anchor of dirsToSearch) {
+        let dir = anchor;
+        for (let i = 0; i < 12; i++) {
+            const candidate = path.join(dir, relPath);
+            if (existsSync(candidate)) {
+                return path.join(dir, 'node_modules', '@gjsify', 'rolldown-native');
+            }
+            const parent = path.resolve(dir, '..');
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    return null;
+}
 async function tryLoadNative() {
     if (_nativeProbe)
         return _nativeProbe;
@@ -229,7 +262,36 @@ async function tryLoadNative() {
                 // install dir, anchoring solely at `import.meta.url`
                 // misses node_modules layouts where the user's cwd
                 // or the workspace root carries the package instead.
-                const resolved = resolveNpmPackage(specifier, { bundleUrl: import.meta.url }) ??
+                //
+                // When `resolveNpmPackage`'s standard anchors all miss
+                // (e.g. invoked from a package subdir whose own
+                // node_modules doesn't carry the optional-peer
+                // `@gjsify/rolldown-native`), fall back to a raw
+                // `existsSync`-based parent-dir walk — it bypasses
+                // both the GJS `createRequire` polyfill's walk
+                // limitations and `findWorkspaceRoot`'s dependency on
+                // `discoverWorkspaces`, both of which can fail to map a
+                // sub-package dir up to the hoisted workspace root.
+                const bundleDir = path.dirname(new URL(import.meta.url).pathname);
+                const resolvedFromNpm = resolveNpmPackage(specifier, { bundleUrl: import.meta.url });
+                const resolvedFromFs = resolvedFromNpm
+                    ? null
+                    : (() => {
+                        const pkgDir = findRolldownNativeDir(process.cwd(), bundleDir);
+                        if (!pkgDir)
+                            return null;
+                        // Resolve the package entry via createRequire anchored
+                        // inside the found package dir so we get the correct
+                        // exports-map / main field entry point.
+                        try {
+                            return createRequire(pathToFileURL(path.join(pkgDir, '__gjsify_resolve__.js')).href).resolve(specifier);
+                        }
+                        catch {
+                            return null;
+                        }
+                    })();
+                const resolved = resolvedFromNpm ??
+                    resolvedFromFs ??
                     createRequire(import.meta.url).resolve(specifier);
                 target = pathToFileURL(resolved).href;
             }

package/lib/commands/publish.js

@@ -35,7 +35,8 @@
 // in-the-wild publish payloads.
 import { readFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { DEFAULT_REGISTRY, registryFor, buildHeaders } from '@gjsify/npm-registry';
+import { DEFAULT_REGISTRY, registryFor } from '@gjsify/npm-registry';
+import { buildPublishHeaders, escapePackageName } from '../utils/publish-headers.js';
 import { packWorkspace } from './pack.js';
 import { getNpmTrustedToken, hasGithubOidcEnv, OidcExchangeError, OidcUnavailableError } from '../utils/npm-oidc.js';
 import { diagnose404, is404DiagnosticCandidate } from '../utils/publish-diagnose.js';
@@ -208,18 +209,12 @@ export const publishCommand = {
         const npmrc = await loadNpmrc(wsDir);
         const registry = process.env.npm_config_registry ?? registryFor(packed.name, npmrc) ?? DEFAULT_REGISTRY;
         const registryClean = registry.endsWith('/') ? registry.slice(0, -1) : registry;
-        // npm-package-arg's escapedName convention for scoped packages:
-        // `@${scope-without-leading-@}%2f${name}` (lowercase %2f, literal @).
-        // Unscoped: `encodeURIComponent(name)`. Match it exactly — the
-        // npm registry is picky about the publish PUT URL shape.
-        const escapedName = packed.name.startsWith('@')
-            ? (() => {
-                const slash = packed.name.indexOf('/');
-                const scope = packed.name.slice(1, slash);
-                const base = packed.name.slice(slash + 1);
-                return `@${encodeURIComponent(scope)}%2f${encodeURIComponent(base)}`;
-            })()
-            : encodeURIComponent(packed.name);
+        // npm-package-arg's escapedName convention (npa.js:188):
+        // `name.replace('/', '%2f')` — scoped `@scope/name` → `@scope%2fname`
+        // (literal @, lowercase %2f, segments NOT otherwise re-encoded);
+        // unscoped names pass through. Match it exactly — the npm registry is
+        // picky about the publish PUT URL shape.
+        const escapedName = escapePackageName(packed.name);
         const url = `${registryClean}/${escapedName}`;
         // npm publish convention: the dist.tarball URL + _attachments key both
         // use the UNSCOPED basename — `cli-0.4.5.tgz`, not
@@ -241,14 +236,15 @@ export const publishCommand = {
             packed: { ...packed, wireFilename },
             provenance,
         });
-        const headers = buildHeaders(url, { npmrc });
-        headers['content-type'] = 'application/json';
-        headers['accept'] = '*/*';
-        // 2FA OTP — sent as the `npm-otp` header (npm-registry-fetch convention,
-        // verified in refs/npm-cli/node_modules/npm-registry-fetch/lib/index.js
-        // line ~243: `if (opts.otp) headers['npm-otp'] = opts.otp`).
-        if (otp)
-            headers['npm-otp'] = otp;
+        // Build the publish-PUT headers to match what `npm publish` sends via
+        // npm-registry-fetch's `getHeaders` — critically `npm-command: publish`
+        // (the routing header npm's create-package frontdoor keys on; without it
+        // a first-publish of a brand-new scoped package returns a bare 404
+        // `Not Found`), plus `npm-auth-type` (legacy when --otp, else web), a
+        // real `user-agent`, and `npm-otp` when an OTP is supplied. See
+        // `utils/publish-headers.ts` for the field-by-field refs/npm-cli
+        // evidence.
+        const headers = buildPublishHeaders(url, { npmrc, otp });
         // Trusted Publishing path. `--trusted` forces OIDC (errors if env
         // vars are missing); the default `undefined` triggers auto-detect:
         // OIDC is used iff GitHub OIDC env vars are present AND no
@@ -301,7 +297,8 @@ export const publishCommand = {
                     handleOidcFailure(err, packed.name, args.json === true);
                     process.exit(1);
                 }
-                // Auto-detect: fall back to whatever buildHeaders found.
+                // Auto-detect: fall back to the npmrc token auth that
+                // buildPublishHeaders already resolved into `headers`.
                 if (verbose) {
                     const msg = err instanceof Error ? err.message : String(err);
                     console.error(`gjsify publish: OIDC auto-detect failed (${msg}) — falling back to token auth`);

package/lib/utils/publish-headers.d.ts

@@ -0,0 +1,45 @@
+import { type NpmrcConfig } from '@gjsify/npm-registry';
+/**
+ * Percent-encode a package name for the publish PUT path, matching
+ * npm-package-arg's `escapedName` convention (npa.js:188):
+ * `this.escapedName = name.replace('/', '%2f')`.
+ *
+ * Scoped: `@scope/name` → `@scope%2fname` (literal `@`, lowercase `%2f`, the
+ * scope/name segments NOT otherwise re-encoded — npm only replaces the slash).
+ * Unscoped: returned unchanged (npa stores the bare name; the only characters
+ * npm forbids are those `encodeURIComponent` would touch, which npa rejects up
+ * front). The npm registry is picky about this exact shape on the publish PUT
+ * URL — `%2F` (uppercase) or a re-encoded `@` would miss the create route.
+ */
+export declare function escapePackageName(name: string): string;
+export interface PublishHeaderOptions {
+    /** Parsed ~/.npmrc — supplies the `authorization` (Bearer/Basic) header. */
+    npmrc?: NpmrcConfig;
+    /** 2FA one-time code. When present, sent as `npm-otp` AND flips auth-type. */
+    otp?: string;
+    /**
+     * Override the `authorization` header (e.g. an OIDC Bearer token resolved
+     * after `buildHeaders` ran). When set it replaces whatever the npmrc auth
+     * resolution produced.
+     */
+    authorization?: string;
+    /**
+     * npm user-agent. Defaults to an npm-CLI-shaped string. The registry does
+     * not validate the exact value, but a real UA is what npm sends; the dead
+     * `gjsify-install/0.3.7` placeholder is not used here.
+     */
+    userAgent?: string;
+}
+/**
+ * Build the full set of headers for the publish PUT, mirroring
+ * `npm-registry-fetch`'s `getHeaders` for `npm publish`.
+ *
+ * The set: `authorization`, `content-type: application/json`,
+ * `npm-command: publish`, `npm-auth-type` (`web`, or `legacy` when `--otp`),
+ * `user-agent`, and `npm-otp` when an OTP is supplied.
+ *
+ * Notably it does NOT set an `accept: *` wildcard — `npm-registry-fetch` sends
+ * no `accept` header on the publish PUT; the stray wildcard gjsify used to send
+ * is dropped to match.
+ */
+export declare function buildPublishHeaders(url: string, opts: PublishHeaderOptions): Record<string, string>;

package/lib/utils/publish-headers.js

@@ -0,0 +1,99 @@
+// Publish-request header builder — matches what npm's CLI sends on a publish
+// PUT so the npm registry's create-package frontdoor routes a *new* scoped
+// package correctly.
+//
+// Root cause this fixes: a first-publish of a never-before-published
+// `@scope/<name>` via token auth was returning a bare `404 Not Found` (body
+// `Not Found`, NOT a JSON npm error). That is a routing miss, not a
+// payload-validation failure — npm's write frontdoor keys the create path on
+// the `npm-command` header, which gjsify was not sending. `npm publish` with
+// the same ~/.npmrc token succeeds because libnpmpublish goes through
+// `npm-registry-fetch`'s `getHeaders`, which always sets `npm-command`
+// (+ `npm-auth-type`, + a real `user-agent`).
+//
+// Evidence (refs/npm-cli):
+//   - `lib/npm.js:404`  `flat.npmCommand = this.command`  → set for EVERY npm
+//     command; equals `"publish"` for `npm publish`.
+//   - `node_modules/npm-registry-fetch/lib/index.js:231-233`
+//        `if (opts.npmCommand) headers['npm-command'] = opts.npmCommand`
+//     and `:219-221` `if (opts.authType) headers['npm-auth-type'] = …`
+//     and `:215-217` `'user-agent': opts.userAgent`.
+//   - `workspaces/config/lib/definitions/definitions.js:282-290` — `auth-type`
+//     default `'web'`, flattened to `flatOptions.authType`.
+//   - `:1581-1587` — when `--otp` is set, npm forces `auth-type` to `'legacy'`
+//     before flattening, so an OTP publish sends `npm-auth-type: legacy`.
+//   - `node_modules/npm-package-arg/lib/npa.js:188`
+//        `this.escapedName = name.replace('/', '%2f')` — lowercase `%2f`,
+//     literal `@`. (gjsify's URL encoding already matches this — it was never
+//     the bug.)
+//
+// This module is pure (no I/O, no `gi://`) so it is unit-testable on both Node
+// and GJS without dragging in the runtime fetch/Soup stack.
+import { buildHeaders } from '@gjsify/npm-registry';
+/**
+ * Percent-encode a package name for the publish PUT path, matching
+ * npm-package-arg's `escapedName` convention (npa.js:188):
+ * `this.escapedName = name.replace('/', '%2f')`.
+ *
+ * Scoped: `@scope/name` → `@scope%2fname` (literal `@`, lowercase `%2f`, the
+ * scope/name segments NOT otherwise re-encoded — npm only replaces the slash).
+ * Unscoped: returned unchanged (npa stores the bare name; the only characters
+ * npm forbids are those `encodeURIComponent` would touch, which npa rejects up
+ * front). The npm registry is picky about this exact shape on the publish PUT
+ * URL — `%2F` (uppercase) or a re-encoded `@` would miss the create route.
+ */
+export function escapePackageName(name) {
+    return name.replace('/', '%2f');
+}
+/**
+ * Build the full set of headers for the publish PUT, mirroring
+ * `npm-registry-fetch`'s `getHeaders` for `npm publish`.
+ *
+ * The set: `authorization`, `content-type: application/json`,
+ * `npm-command: publish`, `npm-auth-type` (`web`, or `legacy` when `--otp`),
+ * `user-agent`, and `npm-otp` when an OTP is supplied.
+ *
+ * Notably it does NOT set an `accept: *` wildcard — `npm-registry-fetch` sends
+ * no `accept` header on the publish PUT; the stray wildcard gjsify used to send
+ * is dropped to match.
+ */
+export function buildPublishHeaders(url, opts) {
+    const headers = buildHeaders(url, { npmrc: opts.npmrc });
+    // npm-registry-fetch never sets `accept` on the publish PUT — drop the
+    // placeholder `accept-encoding` we don't want to influence the create route
+    // either. (buildHeaders defaults accept-encoding to `identity`; a publish
+    // PUT body is JSON we generated, so the encoding header is irrelevant — but
+    // we keep it harmless and explicit by leaving it as buildHeaders set it.)
+    // content-type: application/json — npm-registry-fetch sets this for any
+    // non-string/non-stream/non-buffer body (index.js:63-67); our body is a
+    // JSON string, so we set it explicitly.
+    headers['content-type'] = 'application/json';
+    // npm-command: publish — THE routing header. npm sets it for every command
+    // (npm.js:404); the registry's write frontdoor uses it to route the
+    // create-package PUT. Missing it = bare `404 Not Found` on a new package.
+    headers['npm-command'] = 'publish';
+    // npm-auth-type — `web` by default, `legacy` when an OTP is supplied
+    // (definitions.js:1583-1586). Sent by getHeaders (index.js:219-221).
+    headers['npm-auth-type'] = opts.otp ? 'legacy' : 'web';
+    // user-agent — a real npm-shaped UA (getHeaders index.js:215-217).
+    headers['user-agent'] = opts.userAgent ?? defaultUserAgent();
+    // npm-otp — only when an OTP is supplied (index.js:243-245).
+    if (opts.otp)
+        headers['npm-otp'] = opts.otp;
+    // authorization override (OIDC token resolved after npmrc auth).
+    if (opts.authorization)
+        headers['authorization'] = opts.authorization;
+    return headers;
+}
+/**
+ * npm-CLI-shaped user-agent. Format mirrors npm-registry-fetch's
+ * `default-opts.js` (`npm@<v>/node@<v>+<arch> (<platform>)`); we substitute the
+ * gjsify CLI identity. The registry does not validate the exact value — it just
+ * must be a non-placeholder UA, which some WAF / CDN frontdoors require.
+ */
+function defaultUserAgent() {
+    const proc = globalThis.process;
+    const arch = proc?.arch ?? 'x64';
+    const platform = proc?.platform ?? 'linux';
+    return `gjsify-publish/0.5.0 (${platform} ${arch})`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.5.0",
+    "version": "0.5.2",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -120,19 +120,19 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.5.0",
-        "@gjsify/create-app": "^0.5.0",
-        "@gjsify/node-globals": "^0.5.0",
-        "@gjsify/node-polyfills": "^0.5.0",
-        "@gjsify/npm-registry": "^0.5.0",
-        "@gjsify/resolve-npm": "^0.5.0",
-        "@gjsify/rolldown-plugin-gjsify": "^0.5.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.5.0",
-        "@gjsify/semver": "^0.5.0",
-        "@gjsify/tar": "^0.5.0",
-        "@gjsify/tsc": "^0.5.0",
-        "@gjsify/web-polyfills": "^0.5.0",
-        "@gjsify/workspace": "^0.5.0",
+        "@gjsify/buffer": "^0.5.2",
+        "@gjsify/create-app": "^0.5.2",
+        "@gjsify/node-globals": "^0.5.2",
+        "@gjsify/node-polyfills": "^0.5.2",
+        "@gjsify/npm-registry": "^0.5.2",
+        "@gjsify/resolve-npm": "^0.5.2",
+        "@gjsify/rolldown-plugin-gjsify": "^0.5.2",
+        "@gjsify/rolldown-plugin-pnp": "^0.5.2",
+        "@gjsify/semver": "^0.5.2",
+        "@gjsify/tar": "^0.5.2",
+        "@gjsify/tsc": "^0.5.2",
+        "@gjsify/web-polyfills": "^0.5.2",
+        "@gjsify/workspace": "^0.5.2",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -140,13 +140,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.5.0",
+        "@gjsify/unit": "^0.5.2",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.5.0",
-        "@gjsify/rolldown-native": "^0.5.0"
+        "@gjsify/oxfmt-native": "^0.5.2",
+        "@gjsify/rolldown-native": "^0.5.2"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {