@gjsify/cli 0.64.24 → 0.64.26-next.312

package/lib/commands/onboard.d.ts

@@ -1,4 +1,5 @@
 import type { Command } from '../types/index.js';
+import { type PublishOutcome } from './publish.js';
 interface OnboardOptions {
     repository?: string;
     workflow: string;
@@ -18,4 +19,6 @@ interface OnboardOptions {
     yes?: boolean;
 }
 export declare const onboardCommand: Command<unknown, OnboardOptions>;
+/** Human-readable reason for a failed publish outcome. */
+export declare function describePublishFailure(pub: PublishOutcome): string;
 export {};

package/lib/commands/onboard.js

@@ -36,6 +36,7 @@ import { DEFAULT_REGISTRY, whoami } from '@gjsify/npm-registry';
 import { filterWorkspaces } from '@gjsify/workspace';
 import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
 import { OtpProvider } from '../utils/npm-otp.js';
+import { OIDC_VERIFY_IN_CI_HINT } from '../utils/npm-oidc.js';
 import { writeAroundPrompt } from '../utils/prompt-output.js';
 import { publishWorkspace } from './publish.js';
 import { createTrustRequester } from './trust.js';
@@ -549,6 +550,10 @@ export const onboardCommand = {
             log('  Re-run to pick them up — the sweep is idempotent and skips everything already configured. ' +
                 `A lower --write-concurrency (currently ${writeConcurrency}) provokes the limit less.`);
         }
+        if (!dryRun) {
+            log();
+            log(OIDC_VERIFY_IN_CI_HINT);
+        }
         finish(results, plans, { asJson, dryRun, failed, root, sources, discovered: all.length });
     },
 };
@@ -663,13 +668,21 @@ async function buildIfPresent(ws, log) {
         throw new Error(`build exited with code ${code}`);
 }
 /** Human-readable reason for a failed publish outcome. */
-function describePublishFailure(pub) {
+export function describePublishFailure(pub) {
+    if (pub.ok) {
+        return `unexpected successful publish outcome: ${pub.action}`;
+    }
     switch (pub.action) {
         case 'otp-required':
             return 'npm required a 2FA code (re-run with --otp, or on a TTY)';
-        case 'oidc-failed':
-        case 'oidc-no-token':
-            return 'OIDC/token auth failed';
+        case 'oidc-failed': {
+            const msg = pub.error instanceof Error ? pub.error.message : String(pub.error);
+            return `OIDC token exchange failed: ${msg}`;
+        }
+        case 'oidc-no-token': {
+            const msg = pub.error instanceof Error ? pub.error.message : String(pub.error);
+            return `OIDC token exchange unavailable and no fallback token: ${msg}`;
+        }
         case 'diagnostic':
             return `HTTP 404 (${pub.diag.reason})`;
         case 'publish-unconfirmed':
@@ -687,9 +700,28 @@ function describePublishFailure(pub) {
             return (`not published — ${pub.missing.length} required pin(s) name a package ${pub.registry} does not ` +
                 `have: ${pub.missing.map((m) => `${m.block}.${m.name}@${m.spec}`).join(', ')}. Bootstrap the ` +
                 `target BEFORE its dependent; that order is a correctness property`);
+        case 'held-unpublished-dependency': {
+            const reasons = pub.reasons.map((r) => `${r.block}.${r.name}@${r.version} (${r.detail})`).join(', ');
+            return (`not published — ${pub.reasons.length} intra-repo pin(s) name a version ${pub.registry} does not serve ` +
+                `yet: ${reasons}. The package is held until the dependency is available.`);
+        }
         case 'error':
-            return `HTTP ${pub.status} ${pub.statusText}`;
-        default:
-            return 'unknown';
+            return `HTTP ${pub.status} ${pub.statusText}: ${pub.text}`;
+        default: {
+            // Exhaustiveness check: if this compiles, every PublishOutcome action is handled above.
+            const _exhaustive = pub;
+            return assertNeverDescribeFailure(_exhaustive);
+        }
     }
 }
+/**
+ * Fallback renderer for a future PublishOutcome action this switch does not know yet.
+ * Kept separate so the `never` assignment above stays the compile-time exhaustiveness check.
+ */
+function assertNeverDescribeFailure(pub) {
+    const anyPub = pub;
+    const action = typeof anyPub.action === 'string' ? anyPub.action : 'unknown';
+    const error = anyPub.error;
+    const msg = error instanceof Error ? error.message : error ? String(error) : '';
+    return `publish failed: ${action}${msg ? ` — ${msg}` : ''}`;
+}

package/lib/commands/trust.js

@@ -22,6 +22,7 @@ import { DEFAULT_REGISTRY, buildHeaders, registryFor, whoami } from '@gjsify/npm
 import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
 import { mergePublishables } from '../utils/publishable-packages.js';
 import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
+import { OIDC_VERIFY_IN_CI_HINT } from '../utils/npm-oidc.js';
 import { OtpProvider, withOtpRetry } from '../utils/npm-otp.js';
 import { classifyTrustList, githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, trustUrl, validateRepository, } from '../utils/trust-registry.js';
 export const trustCommand = {
@@ -245,7 +246,15 @@ export const trustCommand = {
             console.log('Failed (re-run `gjsify trust` — it is incremental; usually a lapsed 2FA window or rate-limit):');
             for (const f of failures)
                 console.log(`  ${f}`);
-            process.exit(1);
+            if (!dryRun) {
+                console.log();
+                console.log(OIDC_VERIFY_IN_CI_HINT);
+            }
+            return process.exit(1);
+        }
+        if (!dryRun) {
+            console.log();
+            console.log(OIDC_VERIFY_IN_CI_HINT);
         }
     },
 };

package/lib/utils/npm-oidc.d.ts

@@ -45,6 +45,12 @@ export declare class OidcExchangeError extends Error {
      */
     claims?: Record<string, unknown> | undefined);
 }
+/**
+ * Post-bootstrap hint printed by `gjsify onboard` and `gjsify trust`.
+ * The trust entry can be stored locally, but the OIDC exchange can only be
+ * verified inside GitHub Actions where `ACTIONS_ID_TOKEN_REQUEST_URL` exists.
+ */
+export declare const OIDC_VERIFY_IN_CI_HINT: string;
 /**
  * Decode the non-secret payload of a JWT — the middle base64url segment. A GitHub OIDC
  * id-token's payload is public metadata about the workflow run; the SIGNATURE is what makes it

package/lib/utils/npm-oidc.js

@@ -43,6 +43,13 @@ export class OidcExchangeError extends Error {
         this.name = 'OidcExchangeError';
     }
 }
+/**
+ * Post-bootstrap hint printed by `gjsify onboard` and `gjsify trust`.
+ * The trust entry can be stored locally, but the OIDC exchange can only be
+ * verified inside GitHub Actions where `ACTIONS_ID_TOKEN_REQUEST_URL` exists.
+ */
+export const OIDC_VERIFY_IN_CI_HINT = 'Trust entries are stored but the OIDC exchange is only verifiable in CI: ' +
+    'run `gh workflow run release.yml --ref main -f verify_only=true -f skip_publish=true` and check for ✗ lines.';
 /**
  * Decode the non-secret payload of a JWT — the middle base64url segment. A GitHub OIDC
  * id-token's payload is public metadata about the workflow run; the SIGNATURE is what makes it

package/lib/utils/ship/nested-bundles.js

@@ -45,7 +45,10 @@ export function stageSubordinates(input) {
             const abs = join(bundle.source, ...rel.split(posix.sep));
             files.push({
                 path: posix.join(bundleRoot, rel),
-                mode: stagedMode(rel, abs),
+                // A bundle's own executable is executable whatever the source's mode
+                // says: NTFS carries no POSIX bits, so `stagedMode` reads 0o644 there
+                // and a darwin stage assembled on win32 would ship a dead `.appex`.
+                mode: /^Contents\/MacOS\/[^/]+$/.test(rel) ? 0o755 : stagedMode(rel, abs),
                 source: { kind: 'file', path: abs },
             });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.64.24",
+    "version": "0.64.26-next.312",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -142,22 +142,22 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/blueprint": "^0.64.24",
-        "@gjsify/buffer": "^0.64.24",
-        "@gjsify/create-app": "^0.64.24",
-        "@gjsify/node-globals": "^0.64.24",
-        "@gjsify/node-polyfills": "^0.64.24",
-        "@gjsify/npm-registry": "^0.64.24",
-        "@gjsify/resolve-npm": "^0.64.24",
-        "@gjsify/rolldown-plugin-gjsify": "^0.64.24",
-        "@gjsify/vite-plugin-blueprint": "^0.64.24",
-        "@gjsify/rolldown-plugin-pnp": "^0.64.24",
-        "@gjsify/semver": "^0.64.24",
-        "@gjsify/tar": "^0.64.24",
-        "@gjsify/tsc": "^0.64.24",
-        "@gjsify/utils": "^0.64.24",
-        "@gjsify/web-polyfills": "^0.64.24",
-        "@gjsify/workspace": "^0.64.24",
+        "@gjsify/blueprint": "0.64.26-next.312",
+        "@gjsify/buffer": "0.64.26-next.312",
+        "@gjsify/create-app": "0.64.26-next.312",
+        "@gjsify/node-globals": "0.64.26-next.312",
+        "@gjsify/node-polyfills": "0.64.26-next.312",
+        "@gjsify/npm-registry": "0.64.26-next.312",
+        "@gjsify/resolve-npm": "0.64.26-next.312",
+        "@gjsify/rolldown-plugin-gjsify": "0.64.26-next.312",
+        "@gjsify/vite-plugin-blueprint": "0.64.26-next.312",
+        "@gjsify/rolldown-plugin-pnp": "0.64.26-next.312",
+        "@gjsify/semver": "0.64.26-next.312",
+        "@gjsify/tar": "0.64.26-next.312",
+        "@gjsify/tsc": "0.64.26-next.312",
+        "@gjsify/utils": "0.64.26-next.312",
+        "@gjsify/web-polyfills": "0.64.26-next.312",
+        "@gjsify/workspace": "0.64.26-next.312",
         "acorn": "^8.17.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
@@ -166,13 +166,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.64.24",
+        "@gjsify/unit": "0.64.26-next.312",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.64.24",
-        "@gjsify/rolldown-native": "^0.64.24"
+        "@gjsify/oxfmt-native": "0.64.26-next.312",
+        "@gjsify/rolldown-native": "0.64.26-next.312"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {
@@ -191,5 +191,6 @@
     "bugs": {
         "url": "https://github.com/gjsify/gjsify/issues"
     },
-    "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme"
+    "homepage": "https://github.com/gjsify/gjsify/tree/main/packages/infra/cli#readme",
+    "gitHead": "75fa6155a8f1fa0f7e5d70c43418ae41ecac8c0e"
 }