@gjsify/cli 0.63.0 → 0.63.1-next.235

package/lib/cli-app.js

@@ -18,7 +18,7 @@
 import yargs from 'yargs';
 import { classifyCliFailure } from './cli-fail.js';
 import { cliVersion } from './utils/publish-headers.js';
-import { buildCommand as build, clearCommand as clear, copyCommand as copy, envCommand as env, execCommand as exec, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, shipCommand as ship, dlxCommand as dlx, installCommand as install, linkCommand as link, unlinkCommand as unlink, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, trustCommand as trust, onboardCommand as onboard, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, pruneCommand as prune, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, storybookCommand as storybook, devCommand as dev, debugCommand as debug, devtoolsCommand as devtools, browseCommand as browse, webextCommand as webext, blueprintCommand as blueprint, } from './commands/index.js';
+import { buildCommand as build, clearCommand as clear, copyCommand as copy, envCommand as env, execCommand as exec, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, shipCommand as ship, dlxCommand as dlx, installCommand as install, linkCommand as link, unlinkCommand as unlink, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, trustCommand as trust, onboardCommand as onboard, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, pruneCommand as prune, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, storybookCommand as storybook, siteCommand as site, devCommand as dev, debugCommand as debug, devtoolsCommand as devtools, browseCommand as browse, webextCommand as webext, blueprintCommand as blueprint, } from './commands/index.js';
 import { APP_NAME } from './constants.js';
 import { isBun, isDeno, isNode, gjsSystemVersion } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { ensureGjsifyShimOnPath } from './utils/gjsify-shim.js';
@@ -133,6 +133,7 @@ export async function runCli(argv) {
         .command(tsc.command, tsc.description, tsc.builder, tsc.handler)
         .command(affected.command, affected.description, affected.builder, affected.handler)
         .command(storybook.command, storybook.description, storybook.builder, storybook.handler)
+        .command(site.command, site.description, site.builder, site.handler)
         .command(dev.command, dev.description, dev.builder, dev.handler)
         .command(debug.command, debug.description, debug.builder, debug.handler)
         .command(devtools.command, devtools.description, devtools.builder, devtools.handler)

package/lib/commands/index.d.ts

@@ -39,6 +39,7 @@ export * from './barrels.js';
 export * from './tsc.js';
 export * from './affected.js';
 export * from './storybook.js';
+export * from './site.js';
 export * from './dev.js';
 export * from './debug.js';
 export * from './devtools.js';

package/lib/commands/index.js

@@ -39,6 +39,7 @@ export * from './barrels.js';
 export * from './tsc.js';
 export * from './affected.js';
 export * from './storybook.js';
+export * from './site.js';
 export * from './dev.js';
 export * from './debug.js';
 export * from './devtools.js';

package/lib/commands/self-update.d.ts

@@ -2,7 +2,8 @@ import type { Command } from '../types/index.js';
 interface SelfUpdateOptions {
     check?: boolean;
     force?: boolean;
-    tag: string;
+    /** `undefined` is "no explicit --tag", which `nextChannelNotice` must tell apart. */
+    tag?: string;
     skipDeps?: boolean;
     prune?: boolean;
 }
@@ -34,4 +35,30 @@ export declare function verifyPathResolution(opts: {
     targetVersion: string;
     platform?: NodeJS.Platform;
 }): PathVerdict;
+/**
+ * Is `version` a `next`-channel prerelease — the shape `publish-next` publishes?
+ *
+ * The channel's scheme is `<x.y.z>-next.<run number>` (ADR 0111), so the test is the
+ * prerelease identifier `next`, never a substring: `1.2.3-nextgen.1` is somebody else's
+ * preid and `1.2.3-beta.1+next` carries it in build metadata, and neither is this channel.
+ */
+export declare function isNextChannelVersion(version: string | null | undefined): boolean;
+/**
+ * The one line a bare `self-update` prints when it is about to move the user OFF the
+ * `next` channel — or `null` when it is not.
+ *
+ * `--tag` is and stays the only mechanism; there is no remembered channel and no
+ * `--channel` flag, because a second place to record "which channel am I on" is a second
+ * thing that can disagree with the installed version. So the notice is purely derived:
+ * running a `next` build plus no explicit `--tag` means the implicit `latest` is a channel
+ * change the user did not ask for in words. An explicit `--tag` — even `--tag latest` — is
+ * the user saying it, and gets no notice.
+ *
+ * Pure, so the interesting case is testable without a global install on the channel.
+ */
+export declare function nextChannelNotice(opts: {
+    currentVersion: string | null | undefined;
+    /** `undefined` means no `--tag` was passed; any string is an explicit choice. */
+    requestedTag: string | undefined;
+}): string | null;
 export {};

package/lib/commands/self-update.js

@@ -24,6 +24,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, posix, resolve, win32 } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { fetchPackument } from '@gjsify/npm-registry';
+import { parse } from '@gjsify/semver';
 import { installPackages, makeProgressReporter } from '../utils/install-backend.js';
 import { classifyInstall } from '../utils/install-provenance.js';
 import { defaultGlobalLayout, globalLayoutIsDefault, hasBundlerEngineInstalled, installGjsEnginePackages, linkGlobalBins, resolveBinOnPath, } from '../utils/install-global.js';
@@ -31,6 +32,8 @@ import { pathWithoutSelfShim } from '../utils/gjsify-shim.js';
 import { resolveHostPlatform } from '../utils/platform-check.js';
 import { pruneAfterInstall } from '../utils/prune-prefix.js';
 const PACKAGE_NAME = '@gjsify/cli';
+/** What `self-update` installs when no `--tag` is given. Applied in the handler, not by yargs. */
+const DEFAULT_TAG = 'latest';
 export const selfUpdateCommand = {
     command: 'self-update',
     description: `Update the installed ${PACKAGE_NAME} to the latest release (or pinned --tag).`,
@@ -48,7 +51,10 @@ export const selfUpdateCommand = {
         .option('tag', {
         description: 'npm dist-tag or pinned version to install (e.g. `latest`, `next`, `0.5.0`).',
         type: 'string',
-        default: 'latest',
+        // No yargs `default` on purpose. The effective default is still
+        // DEFAULT_TAG, applied in the handler — but a default here collapses
+        // "no --tag" and "--tag latest" into one value, and the next-channel
+        // notice is about exactly that distinction.
     })
         .option('prune', {
         description: 'After updating, remove packages an earlier install left behind that this host cannot use (foreign os/cpu/libc). Use --no-prune to disable.',
@@ -93,7 +99,15 @@ export const selfUpdateCommand = {
                 `If you installed via \`npm install -g\`, remove that and use:\n` +
                 `  curl -fsSL https://github.com/gjsify/gjsify/releases/latest/download/install.mjs -o /tmp/g.mjs && gjs -m /tmp/g.mjs && rm /tmp/g.mjs`);
         }
-        console.log(`Fetching dist-tags for ${PACKAGE_NAME}@${args.tag} ...`);
+        const tag = args.tag ?? DEFAULT_TAG;
+        // A bare `self-update` on a `next` build is a CHANNEL CHANGE, and silence
+        // about it is how a user ends up reporting "my prerelease fix disappeared".
+        // One line, then proceed — the default is still `latest`, and `--tag next`
+        // stays the only mechanism for staying on the channel (ADR 0111).
+        const notice = nextChannelNotice({ currentVersion, requestedTag: args.tag });
+        if (notice)
+            console.log(notice);
+        console.log(`Fetching dist-tags for ${PACKAGE_NAME}@${tag} ...`);
         let packument;
         try {
             packument = await fetchPackument(PACKAGE_NAME);
@@ -103,13 +117,13 @@ export const selfUpdateCommand = {
             console.error(`Failed to fetch packument: ${msg}`);
             return process.exit(1);
         }
-        const target = resolveTag(packument, args.tag);
+        const target = resolveTag(packument, tag);
         if (!target) {
-            console.error(`Unknown dist-tag '${args.tag}' on ${PACKAGE_NAME}. ` +
+            console.error(`Unknown dist-tag '${tag}' on ${PACKAGE_NAME}. ` +
                 `Known tags: ${Object.keys(packument['dist-tags'] ?? {}).join(', ') || '(none)'}`);
             return process.exit(1);
         }
-        console.log(`Latest matching --tag ${args.tag}: v${target}`);
+        console.log(`Latest matching --tag ${tag}: v${target}`);
         // A version match is NOT sufficient to declare "up to date": a global
         // GJS install can be on the right `@gjsify/cli` version yet be MISSING
         // the GJS bundler engine (`@gjsify/rolldown-native`) — it's an optional
@@ -275,6 +289,40 @@ export function verifyPathResolution(opts) {
             `  this run — open a new shell and check \`${opts.binName} --version\`.`,
     };
 }
+/**
+ * Is `version` a `next`-channel prerelease — the shape `publish-next` publishes?
+ *
+ * The channel's scheme is `<x.y.z>-next.<run number>` (ADR 0111), so the test is the
+ * prerelease identifier `next`, never a substring: `1.2.3-nextgen.1` is somebody else's
+ * preid and `1.2.3-beta.1+next` carries it in build metadata, and neither is this channel.
+ */
+export function isNextChannelVersion(version) {
+    if (!version)
+        return false;
+    const parsed = parse(version);
+    return (parsed?.prerelease ?? []).some((id) => id === 'next');
+}
+/**
+ * The one line a bare `self-update` prints when it is about to move the user OFF the
+ * `next` channel — or `null` when it is not.
+ *
+ * `--tag` is and stays the only mechanism; there is no remembered channel and no
+ * `--channel` flag, because a second place to record "which channel am I on" is a second
+ * thing that can disagree with the installed version. So the notice is purely derived:
+ * running a `next` build plus no explicit `--tag` means the implicit `latest` is a channel
+ * change the user did not ask for in words. An explicit `--tag` — even `--tag latest` — is
+ * the user saying it, and gets no notice.
+ *
+ * Pure, so the interesting case is testable without a global install on the channel.
+ */
+export function nextChannelNotice(opts) {
+    if (opts.requestedTag !== undefined)
+        return null;
+    if (!isNextChannelVersion(opts.currentVersion))
+        return null;
+    return (`Note: v${opts.currentVersion} is a \`next\` prerelease; updating without --tag moves you to ` +
+        `\`${DEFAULT_TAG}\`. Use \`--tag next\` to stay on the next channel.`);
+}
 /**
  * Resolve the CLI's own `package.json#version`. Walks up from
  * `import.meta.url` (the bundle file under GJS, or `lib/index.js` under

package/lib/commands/site.d.ts

@@ -0,0 +1,15 @@
+import type { Command } from '../types/index.js';
+interface SiteCliOptions {
+    operation: string;
+    root?: string;
+    out?: string;
+    offline: boolean;
+    cache: boolean;
+    cacheDir?: string;
+    check: boolean;
+    package: boolean;
+    runtime?: string;
+    globals?: string;
+}
+export declare const siteCommand: Command<unknown, SiteCliOptions>;
+export {};

package/lib/commands/site.js

@@ -0,0 +1,153 @@
+// `gjsify site` — render the static landing page of the CURRENT project from its
+// AppStream metainfo, or sync the page catalogues. The work lives in
+// `@gjsify/site`; this is the entry point into it.
+//
+// Why a subcommand and not a `gjsify-site` bin: a bin has to name an
+// interpreter in its shebang, and that would pick the runtime FOR the user. The
+// CLI already runs on whichever runtime it was installed with — gjs after the
+// Linux install script, Node after `npm install -g @gjsify/cli` on
+// Windows/macOS, bun or deno when installed with those — so taking the entry
+// point through the CLI makes the site build inherit that choice instead of
+// overriding it. `@gjsify/site` uses GdkPixbuf for its image work, which is
+// reachable on all four (natively under gjs, through the `@gjsify/node-gi`
+// reverse bridge otherwise).
+//
+// Dispatch follows `gjsify storybook`: a generated entry importing
+// `@gjsify/site` from the CONSUMER's node_modules, bundled `--app gjs|node` and
+// run. That keeps `@gjsify/site` (tier 2) out of this tier-1 package's
+// dependencies, and it is what lowers the `gi://GdkPixbuf` import to the right
+// thing for the runtime in use.
+//
+// The resolved install directory is passed to the child as `--package-dir`. A
+// bundle's `import.meta.url` is the OUTFILE, so the library cannot find its own
+// `po/` and `lib/client/` on its own — only the caller still knows.
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { hostRuntime } from '@gjsify/rolldown-plugin-gjsify/runtime';
+/** The `@gjsify/site` install reachable from `cwd`, walking the node_modules chain upwards. */
+function resolveSitePackage(cwd) {
+    let dir = resolve(cwd);
+    for (;;) {
+        const candidate = join(dir, 'node_modules', '@gjsify', 'site');
+        if (existsSync(join(candidate, 'package.json')))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+/**
+ * The generated entry. Arguments arrive as ARGV rather than baked in, so the cached bundle serves
+ * every invocation — flags change far more often than this does.
+ *
+ * The exit is spelled per runtime on purpose. Under GJS `process.exit` does not halt and loses its
+ * code (the `gjsify storybook` measurement), so the gjs entry uses `system.exit`; both read the
+ * user arguments from where their own runtime puts them.
+ */
+function generateEntry(app) {
+    const header = `// Auto-generated by \`gjsify site\` — do not edit by hand.\nimport { runSiteCli } from '@gjsify/site';\n`;
+    return app === 'gjs'
+        ? `${header}import system from 'system';\n\nsystem.exit(await runSiteCli(system.programArgs));\n`
+        : `${header}\nprocess.exit(await runSiteCli(process.argv.slice(2)));\n`;
+}
+export const siteCommand = {
+    command: 'site <operation>',
+    description: "Render this project's static landing page from its AppStream metainfo (downloads, screenshots, " +
+        'release notes, support links), or sync the page catalogues.',
+    builder: (yargs) => yargs
+        .positional('operation', {
+        description: 'build — render the pages; i18n — update the page catalogues',
+        type: 'string',
+        choices: ['build', 'i18n'],
+        demandOption: true,
+    })
+        .option('root', {
+        description: 'Repository to read from (default: the working directory)',
+        type: 'string',
+    })
+        .option('out', { description: 'Output directory, emptied first (default: <root>/dist)', type: 'string' })
+        .option('offline', { description: 'Skip every network call', type: 'boolean', default: false })
+        .option('cache', {
+        description: 'Use the one-hour HTTP response cache (--no-cache to ignore it)',
+        type: 'boolean',
+        default: true,
+    })
+        .option('cache-dir', {
+        description: 'Where the response cache and the image renditions live',
+        defaultDescription: '<root>/node_modules/.cache/gjsify-site',
+        type: 'string',
+    })
+        .option('check', {
+        description: 'i18n: report what is out of date instead of writing it',
+        type: 'boolean',
+        default: false,
+    })
+        .option('package', {
+        description: "i18n: sync @gjsify/site's own catalogues instead of this project's",
+        type: 'boolean',
+        default: false,
+    })
+        .option('runtime', {
+        description: 'Runtime to build for and run on: gjs | node | bun | deno (default: the host runtime). ' +
+            'node/bun/deno build the same `--app node` bundle and require @gjsify/node-gi in the project.',
+        type: 'string',
+        choices: ['gjs', 'node', 'bun', 'deno'],
+        defaultDescription: 'host runtime (gjs on gjs, else node/bun/deno)',
+    })
+        .option('globals', { description: 'Value for `gjsify build --globals` (default: auto)', type: 'string' }),
+    handler: async (args) => {
+        const cwd = process.cwd();
+        const packageDir = resolveSitePackage(cwd);
+        if (!packageDir) {
+            console.error('gjsify site: @gjsify/site is not installed in this project.\n\n' +
+                '  The generator ships as its own package so a project only pays for it when it\n' +
+                '  publishes a page. Add it, then run this again:\n\n' +
+                '      npm install --save-dev @gjsify/site');
+            return process.exit(1);
+        }
+        if (!existsSync(join(packageDir, 'lib', 'client', 'site.js'))) {
+            console.error(`gjsify site: ${packageDir} has no built client bundle (lib/client/site.js).\n` +
+                '  In a source checkout, build the package first: `gjsify workspace site build`.');
+            return process.exit(1);
+        }
+        const runtime = (args.runtime ?? hostRuntime());
+        const app = runtime === 'gjs' ? 'gjs' : 'node';
+        const cacheDir = join(cwd, 'node_modules', '.cache', 'gjsify-site');
+        mkdirSync(cacheDir, { recursive: true });
+        const entryPath = join(cacheDir, `entry.${app}.ts`);
+        const outPath = join(cacheDir, `site.${app}.mjs`);
+        writeFileSync(entryPath, generateEntry(app));
+        const { runCli } = await import('../cli-app.js');
+        await runCli(['build', entryPath, '--app', app, '--globals', args.globals ?? 'auto', '--outfile', outPath]);
+        // RESOLVED values, not the raw argv: the child parses its own flags and
+        // cannot know where this CLI found the package.
+        const forwarded = [args.operation, '--package-dir', packageDir];
+        if (args.root)
+            forwarded.push('--root', resolve(cwd, args.root));
+        if (args.out)
+            forwarded.push('--out', resolve(cwd, args.out));
+        if (args.offline)
+            forwarded.push('--offline');
+        if (!args.cache)
+            forwarded.push('--no-cache');
+        else if (args.cacheDir)
+            forwarded.push('--cache-dir', resolve(cwd, args.cacheDir));
+        if (args.check)
+            forwarded.push('--check');
+        if (args.package)
+            forwarded.push('--package');
+        if (runtime === 'gjs') {
+            const { runGjsBundle } = await import('../utils/run-gjs.js');
+            await runGjsBundle(outPath, forwarded, { completion: 'exit', exitOnSuccess: true });
+            return;
+        }
+        if (runtime === 'node') {
+            const { runNodeBundle } = await import('../utils/run-node.js');
+            await runNodeBundle(outPath, forwarded, { completion: 'exit', exitOnSuccess: true });
+            return;
+        }
+        const { runRuntimeBundle } = await import('../utils/run-node.js');
+        await runRuntimeBundle(runtime, outPath, forwarded, { completion: 'exit', exitOnSuccess: true });
+    },
+};

package/lib/commands/upgrade.d.ts

@@ -1,4 +1,5 @@
-import { type DependencyGroup } from '../utils/dep-aggregation.js';
+import { type Workspace } from '@gjsify/workspace';
+import { type DepDeclaration, type DependencyGroup } from '../utils/dep-aggregation.js';
 import type { Command } from '../types/index.js';
 interface UpgradeOptions {
     latest?: boolean;
@@ -16,6 +17,27 @@ interface UpgradeOptions {
     yes?: boolean;
 }
 export declare const upgradeCommand: Command<unknown, UpgradeOptions>;
+export declare function collectFromWorkspace(workspace: Workspace, depFilters: string[]): DepDeclaration[];
+/**
+ * Is this spec a dist-tag (`next`, `latest`, `beta`) rather than a version range?
+ *
+ * npm's own rule is "whatever `semver.validRange` rejects is a tag", and that is NOT
+ * usable here: `@gjsify/semver`'s `validRange` reads any unparseable leading token as an
+ * x-range, so it answers `>=0.0.0` for `latest` — the most common dist-tag of all — while
+ * correctly answering `null` for `next`. A detector that disagreed with itself across tag
+ * names is worse than none, so the test is lexical and total instead.
+ *
+ * A semver range begins with a letter in exactly two ways: an x-range (`x`, `X`, and the
+ * `*`/empty spellings beside them) and a `v`-prefixed version (`v1.2.3`, `v1.x`). Every
+ * other letter-initial spec is a tag — which is also the npm rule for what a tag may be
+ * NAMED, since a tag that parses as a version is refused at `npm dist-tag add`.
+ *
+ * Deliberately NOT fixing `validRange` instead: its leniency is what makes `gjsify
+ * install` accept `1`, `1.2` and `x` from real-world manifests, and tightening the shared
+ * parser to serve one caller's discrimination question would be a resolution change to
+ * every install in the repository.
+ */
+export declare function isDistTagSpec(raw: string): boolean;
 /**
  * `--exact` half of the CI gate: does every matched dep carry a bare version?
  *

package/lib/commands/upgrade.js

@@ -31,7 +31,9 @@
 //
 // Workspace-protocol ranges (`workspace:*`, `workspace:^`, …) are always
 // skipped — those are internal links and `gjsify install` resolves them
-// locally.
+// locally. So are DIST-TAG specs (`"@gjsify/cli": "next"`, the `next`-channel
+// opt-in of ADR 0111): a tag carries no version to compare, and `--align`
+// used to overwrite it with one. See `isDistTagSpec`.
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
@@ -242,7 +244,7 @@ function collectAllDeclarations(workspaces, depFilters) {
     }
     return out;
 }
-function collectFromWorkspace(workspace, depFilters) {
+export function collectFromWorkspace(workspace, depFilters) {
     const out = [];
     const pkg = workspace.manifest;
     for (const field of DEP_FIELDS) {
@@ -254,6 +256,21 @@ function collectFromWorkspace(workspace, depFilters) {
                 continue;
             if (depFilters.length && !depFilters.some((f) => name.toLowerCase().includes(f)))
                 continue;
+            // A DIST-TAG is not a range and has no version to compare. Skipped for the
+            // same reason as the protocols below — `gjsify install` resolves it, and
+            // nothing here can say anything true about it.
+            //
+            // THE DEFECT THIS CLOSES. `"@gjsify/cli": "next"` is how a consumer app opts
+            // into the `next` channel (ADR 0111): one spec, resolved through the
+            // packument's `dist-tags` on every install. Without this skip `splitRange`
+            // returned `{prefix: '', version: null}`, so the declaration joined its dep's
+            // group as the literal range `next`: `--check` reported the dep inconsistent
+            // against every sibling declaring a real range, `checkLockfileRangeViolations`
+            // reported the resolved prerelease as violating `next`, and `--align` —
+            // the repair that failure message names — REWROTE the spec to the group's
+            // highest declared version, silently destroying the opt-in it was pointed at.
+            if (isDistTagSpec(raw))
+                continue;
             // Skip workspace-protocol + file: + link: + git: + http(s): specs.
             if (raw.startsWith('workspace:') ||
                 raw.startsWith('file:') ||
@@ -280,6 +297,40 @@ function collectFromWorkspace(workspace, depFilters) {
     }
     return out;
 }
+/** The three spellings of an x-range: alphabetic (or empty) and still a RANGE, not a tag. */
+const X_RANGE_SPELLINGS = new Set(['x', 'X', '*', '']);
+/**
+ * Is this spec a dist-tag (`next`, `latest`, `beta`) rather than a version range?
+ *
+ * npm's own rule is "whatever `semver.validRange` rejects is a tag", and that is NOT
+ * usable here: `@gjsify/semver`'s `validRange` reads any unparseable leading token as an
+ * x-range, so it answers `>=0.0.0` for `latest` — the most common dist-tag of all — while
+ * correctly answering `null` for `next`. A detector that disagreed with itself across tag
+ * names is worse than none, so the test is lexical and total instead.
+ *
+ * A semver range begins with a letter in exactly two ways: an x-range (`x`, `X`, and the
+ * `*`/empty spellings beside them) and a `v`-prefixed version (`v1.2.3`, `v1.x`). Every
+ * other letter-initial spec is a tag — which is also the npm rule for what a tag may be
+ * NAMED, since a tag that parses as a version is refused at `npm dist-tag add`.
+ *
+ * Deliberately NOT fixing `validRange` instead: its leniency is what makes `gjsify
+ * install` accept `1`, `1.2` and `x` from real-world manifests, and tightening the shared
+ * parser to serve one caller's discrimination question would be a resolution change to
+ * every install in the repository.
+ */
+export function isDistTagSpec(raw) {
+    const spec = raw.trim();
+    if (X_RANGE_SPELLINGS.has(spec))
+        return false;
+    if (!/^[A-Za-z]/.test(spec))
+        return false;
+    if (/^v\d/.test(spec) || /^v[xX*]/.test(spec))
+        return false;
+    // npm tag names are URL path segments: no whitespace, no range operators, nothing the
+    // packument lookup could not carry. A letter-initial spec that is none of the above
+    // and still fails this is malformed either way, and is left to the registry to reject.
+    return /^[A-Za-z][\w.-]*$/.test(spec);
+}
 function splitRange(range) {
     const m = range.match(/^(\^|~|>=|<=|>|<|=)?\s*([0-9].*)$/);
     if (!m)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.63.0",
+    "version": "0.63.1-next.235",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -142,22 +142,22 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/blueprint": "^0.63.0",
-        "@gjsify/buffer": "^0.63.0",
-        "@gjsify/create-app": "^0.63.0",
-        "@gjsify/node-globals": "^0.63.0",
-        "@gjsify/node-polyfills": "^0.63.0",
-        "@gjsify/npm-registry": "^0.63.0",
-        "@gjsify/resolve-npm": "^0.63.0",
-        "@gjsify/rolldown-plugin-gjsify": "^0.63.0",
-        "@gjsify/vite-plugin-blueprint": "^0.63.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.63.0",
-        "@gjsify/semver": "^0.63.0",
-        "@gjsify/tar": "^0.63.0",
-        "@gjsify/tsc": "^0.63.0",
-        "@gjsify/utils": "^0.63.0",
-        "@gjsify/web-polyfills": "^0.63.0",
-        "@gjsify/workspace": "^0.63.0",
+        "@gjsify/blueprint": "0.63.1-next.235",
+        "@gjsify/buffer": "0.63.1-next.235",
+        "@gjsify/create-app": "0.63.1-next.235",
+        "@gjsify/node-globals": "0.63.1-next.235",
+        "@gjsify/node-polyfills": "0.63.1-next.235",
+        "@gjsify/npm-registry": "0.63.1-next.235",
+        "@gjsify/resolve-npm": "0.63.1-next.235",
+        "@gjsify/rolldown-plugin-gjsify": "0.63.1-next.235",
+        "@gjsify/vite-plugin-blueprint": "0.63.1-next.235",
+        "@gjsify/rolldown-plugin-pnp": "0.63.1-next.235",
+        "@gjsify/semver": "0.63.1-next.235",
+        "@gjsify/tar": "0.63.1-next.235",
+        "@gjsify/tsc": "0.63.1-next.235",
+        "@gjsify/utils": "0.63.1-next.235",
+        "@gjsify/web-polyfills": "0.63.1-next.235",
+        "@gjsify/workspace": "0.63.1-next.235",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -166,13 +166,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.63.0",
+        "@gjsify/unit": "0.63.1-next.235",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.63.0",
-        "@gjsify/rolldown-native": "^0.63.0"
+        "@gjsify/oxfmt-native": "0.63.1-next.235",
+        "@gjsify/rolldown-native": "0.63.1-next.235"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {
@@ -191,5 +191,6 @@
     "bugs": {
         "url": "https://github.com/gjsify/gjsify/issues"
     },
-    "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme"
+    "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme",
+    "gitHead": "9d2cca56170a0215b3e0792e98421ed1f83e7f72"
 }