@gjsify/cli 0.7.3 → 0.7.4

package/lib/commands/affected.js

@@ -96,6 +96,13 @@ const GLOBAL_TRIGGERS = [
     /^packages\/infra\/cli\//,
     /^packages\/infra\/rolldown-plugin-gjsify\//,
     /^packages\/infra\/resolve-npm\//,
+    // The test framework every spec imports. It is a *devDependency* of
+    // virtually every workspace, so with the prod-deps-only closure below
+    // (`includeDev: false`) a change to it would otherwise yield a near-empty
+    // closure and silently skip every downstream test — yet a bug in a matcher
+    // can break assertions anywhere. Treat it as a global trigger so a
+    // `@gjsify/unit` change re-runs the full suite.
+    /^packages\/gjs\/unit\//,
     // Cross-cutting dep + lockfile + root config.
     /^gjsify-lock\.json$/,
     /^package\.json$/,
@@ -210,12 +217,29 @@ function classifyAndExpand(workspaces, rootDir, changedFiles) {
             skipAll: false,
         };
     }
-    // Default: closure walk.
-    const reverse = buildReverseDependencyGraph(workspaces, { includeDev: true });
+    // Default: closure walk over PRODUCTION dependencies only (`includeDev:
+    // false`). The closure answers "whose tests must re-run because a package
+    // they depend on changed" — and that is a RUNTIME relationship. Walking
+    // devDependency edges instead conflated it with the build/test toolchain:
+    // every workspace devDepends `@gjsify/cli`/`@gjsify/tsc`/`@gjsify/unit`,
+    // and the umbrella `@gjsify/node-polyfills` prod-depends every polyfill, so
+    // ANY single-package change fanned out to ~210 of 221 workspaces — the
+    // closure was the whole monorepo and selective CI bought almost nothing.
+    // Prod-only collapses a typical seed to a handful (e.g. sqlite 210→4,
+    // fetch 210→34) while keeping every real runtime dependent. Safe against
+    // under-selection: no `*.spec.ts` imports a *cross-package* sibling via a
+    // devDependency (the only such spec imports are self-imports, which are
+    // covered by the package being its own seed); the universal test framework
+    // `@gjsify/unit` is handled by GLOBAL_TRIGGERS above; and every push-to-
+    // main + the nightly cron still run the FULL suite as the backstop.
+    const reverse = buildReverseDependencyGraph(workspaces, { includeDev: false });
     const closure = affectedClosure(reverse, [...matched]);
     // Integration suites whose forward deps overlap with the closure also
-    // need to run. We walk the forward graph and pull any integration ws
-    // that depends on something inside the closure.
+    // need to run. We walk the forward graph with `includeDev: true` here
+    // (deliberately broader than the reverse closure) so an integration suite
+    // is never missed: integration packages declare the pillars they exercise
+    // as `dependencies`, but the wider walk also tolerates a devDep-declared
+    // edge. Over-running an integration suite is cheap; missing one is not.
     const forward = buildDependencyGraph(workspaces, { includeDev: true });
     let runIntegration = false;
     for (const [from, deps] of forward.edges) {

package/lib/commands/install.d.ts

@@ -6,6 +6,7 @@ interface InstallOptions {
     'save-peer'?: boolean;
     'save-optional'?: boolean;
     immutable?: boolean;
+    'refresh-lockfile'?: boolean;
     verbose: boolean;
     quiet?: boolean;
     progress?: boolean;

package/lib/commands/install.js

@@ -57,6 +57,11 @@ export const installCommand = {
         description: 'CI mode: install strictly from gjsify-lock.json, fail if the lockfile is missing or stale. Equivalent to yarn --immutable / npm ci --frozen-lockfile.',
         type: 'boolean',
         default: false,
+    })
+        .option('refresh-lockfile', {
+        description: 'Re-resolve every dependency to the newest version satisfying its range and rewrite the lockfile (bumps in-range transitive deps). Without it, a resolve preserves versions already pinned in the lockfile and only resolves new/changed deps — the npm/yarn/pnpm default. Mirrors yarn install --mode=update-lockfile.',
+        type: 'boolean',
+        default: false,
     })
         .option('verbose', {
         description: 'Verbose install logging.',
@@ -97,6 +102,11 @@ export const installCommand = {
                 console.error('gjsify install --immutable is incompatible with --global.');
                 process.exit(1);
             }
+            if (args['refresh-lockfile']) {
+                console.error('gjsify install --immutable is incompatible with --refresh-lockfile ' +
+                    '(--immutable forbids rewriting the lockfile). Drop one.');
+                process.exit(1);
+            }
         }
         if (args.global) {
             if (!args.packages || args.packages.length === 0) {
@@ -266,6 +276,7 @@ async function projectInstallNative(args, signal) {
         // it (the whole point is byte-stability under CI).
         lockfile: !args.immutable,
         frozen: args.immutable,
+        refreshLockfile: args['refresh-lockfile'],
         signal,
         progress,
     });
@@ -604,6 +615,7 @@ async function workspaceInstall(cwd, args, signal) {
             verbose: args.verbose,
             lockfile: !args.immutable,
             frozen: args.immutable,
+            refreshLockfile: args['refresh-lockfile'],
             overrides,
             signal,
             progress,

package/lib/commands/publish.js

@@ -298,7 +298,22 @@ export const publishCommand = {
                     process.exit(1);
                 }
                 // Auto-detect: fall back to the npmrc token auth that
-                // buildPublishHeaders already resolved into `headers`.
+                // buildPublishHeaders already resolved into `headers` — BUT only
+                // if one actually exists. In OIDC-only CI there is no npmrc
+                // token, so a "fallback" would PUT with no credentials, get a
+                // 404, and risk being mistaken for a tolerable outcome — exactly
+                // the v0.7.3 incident where a transient OIDC 503 on
+                // `@gjsify/process` left it unpublished while the release stayed
+                // green. Refuse loudly so a transient OIDC failure can never
+                // silently drop a package from a release.
+                if (!headers['authorization']) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    console.error(`gjsify publish: OIDC token exchange failed for ${packed.name} (${msg}) and no fallback npm token is configured — refusing to publish without credentials.`);
+                    if (args.json) {
+                        process.stdout.write(`${JSON.stringify({ ok: false, name: packed.name, version: packed.version, error: 'oidc-failed-no-token' }, null, 2)}\n`);
+                    }
+                    process.exit(1);
+                }
                 if (verbose) {
                     const msg = err instanceof Error ? err.message : String(err);
                     console.error(`gjsify publish: OIDC auto-detect failed (${msg}) — falling back to token auth`);

package/lib/commands/run.js

@@ -41,6 +41,14 @@ export const runCommand = {
         // Without this, anything after `--` lands in args._ and is
         // silently dropped by the handler.
         'populate--': true,
+        // Forward UNKNOWN flags to the target without requiring `--`:
+        //   gjsify run dist/app.gjs.mjs serve --port 8080 --year 2025
+        // Without this, the top-level `.strict()` (cli-app.ts) rejects
+        // --port/--year as "unknown arguments" before they reach the
+        // target. Treating unknown options as positional args routes
+        // them into the `[args..]` positional (then to the child).
+        // Known options (--help / --version) are still handled by gjsify.
+        'unknown-options-as-args': true,
     }),
     handler: async (args) => {
         const target = args.target;

package/lib/utils/install-backend-native.d.ts

@@ -10,5 +10,5 @@ export interface InstalledTopLevel {
 }
 export declare function installPackagesNative(opts: InstallOptions): Promise<InstalledTopLevel[]>;
 export declare function parseSpec(raw: string): ParsedSpec;
-export declare function pickVersion(packument: Packument, range: string): string | null;
+export declare function pickVersion(packument: Packument, range: string, preferred?: string): string | null;
 export {};

package/lib/utils/install-backend-native.js

@@ -58,13 +58,21 @@ export async function installPackagesNative(opts) {
         log('install: --immutable, using lockfile (%d package(s))', Object.keys(existingLock.packages).length);
         nodes = lockfileToNodes(existingLock);
     }
-    else if (existingLock && lockfileMatchesRequest(existingLock, opts.specs)) {
+    else if (!opts.refreshLockfile && existingLock && lockfileMatchesRequest(existingLock, opts.specs)) {
         log('install: using lockfile (%d package(s))', Object.keys(existingLock.packages).length);
         nodes = lockfileToNodes(existingLock);
     }
     else {
-        log('install: resolving %d top-level spec(s) → %s', opts.specs.length, opts.prefix);
-        nodes = await resolveDeps(opts.specs, npmrc, log, opts.overrides, opts.skipDeps, opts.signal, progress);
+        // A resolve has to run (new/changed/removed dep, or no lockfile yet).
+        // Unless --refresh-lockfile was passed, seed it with the versions
+        // already pinned in the existing lockfile so unchanged deps keep their
+        // resolved version and only the genuinely new/changed deps move — the
+        // npm/yarn/pnpm `install` default. Without this, every `^`-range would
+        // re-resolve to the newest registry version, churning the whole tree
+        // (and silently bumping transitive deps) on a one-package add.
+        const preferred = !opts.refreshLockfile && existingLock ? buildPreferredVersions(existingLock) : undefined;
+        log('install: resolving %d top-level spec(s) → %s%s', opts.specs.length, opts.prefix, preferred ? ` (preserving ${preferred.size} locked name(s))` : '');
+        nodes = await resolveDeps(opts.specs, npmrc, log, opts.overrides, opts.skipDeps, opts.signal, progress, preferred);
         if (opts.lockfile) {
             writeLockfile(lockfilePath, opts.specs, nodes);
             log('install: wrote %s (%d entries)', LOCKFILE_NAME, nodes.length);
@@ -127,7 +135,15 @@ function parseSpecName(spec) {
  * the root. Each placement returns a `ResolvedNode` whose `installPath`
  * captures where it lives in the tree.
  */
-async function resolveDeps(specs, npmrc, log, overrides, skipDeps, signal, progress) {
+async function resolveDeps(specs, npmrc, log, overrides, skipDeps, signal, progress, 
+/**
+ * Lockfile-preservation oracle: `name → versions already pinned in the
+ * existing lockfile`. When an edge's range is satisfiable by a pinned
+ * version, that version is reused instead of the newest registry match.
+ * Undefined ⇒ a fresh resolve that always picks the newest in-range version
+ * (first install, or an explicit `--refresh-lockfile`).
+ */
+preferredVersions) {
     progress?.beginPhase('resolve', specs.length);
     const applyOverride = (name, range) => {
         if (!overrides)
@@ -201,11 +217,14 @@ async function resolveDeps(specs, npmrc, log, overrides, skipDeps, signal, progr
                 // Compatible placement reachable; reuse, no new install.
                 continue;
             }
-            // No compatible existing placement. Resolve a fresh version.
+            // No compatible existing placement. Resolve a version — preferring a
+            // version already pinned in the lockfile when it satisfies the range
+            // (so an add doesn't gratuitously bump unchanged deps).
             let version = null;
             try {
                 const packument = await fetchPkg(edge.name);
-                version = pickVersion(packument, edge.range);
+                const preferred = preferredVersionFor(preferredVersions?.get(edge.name), edge.range);
+                version = pickVersion(packument, edge.range, preferred);
                 if (!version) {
                     if (!edge.required)
                         continue;
@@ -452,6 +471,44 @@ function writeLockfile(lockfilePath, specs, nodes) {
     };
     fs.writeFileSync(lockfilePath, JSON.stringify(lockfile, null, 2) + '\n');
 }
+/**
+ * Build the lockfile-preservation oracle: `name → every version currently
+ * pinned in the lockfile` (a name can appear at more than one install path /
+ * version when the tree nested a conflicting copy). Consulted during a resolve
+ * so unchanged deps keep their pinned version instead of bumping to the newest
+ * in-range match.
+ */
+function buildPreferredVersions(lockfile) {
+    const byName = new Map();
+    for (const [installPath, entry] of Object.entries(lockfile.packages)) {
+        const name = nameFromInstallPath(installPath);
+        let set = byName.get(name);
+        if (!set) {
+            set = new Set();
+            byName.set(name, set);
+        }
+        set.add(entry.version);
+    }
+    return byName;
+}
+/**
+ * Pick the pinned version to reuse for an edge: the highest lockfile version of
+ * the name that still satisfies the edge's range, or undefined when none do
+ * (range was tightened/changed, or the name is brand new) — in which case the
+ * resolver falls back to the newest registry match.
+ */
+function preferredVersionFor(locked, range) {
+    if (!locked || locked.size === 0)
+        return undefined;
+    let best;
+    for (const v of locked) {
+        if (!satisfiesRange(v, range))
+            continue;
+        if (best === undefined || new SemVer(v).compare(new SemVer(best)) > 0)
+            best = v;
+    }
+    return best;
+}
 function lockfileToNodes(lockfile) {
     return Object.entries(lockfile.packages).map(([installPath, entry]) => ({
         // Recover the package name from the path: the last segment is
@@ -535,7 +592,14 @@ export function parseSpec(raw) {
     return { name: raw.slice(0, at), range: raw.slice(at + 1) || 'latest' };
 }
 // Exported for unit-testing. Internal API.
-export function pickVersion(packument, range) {
+export function pickVersion(packument, range, preferred) {
+    // Lockfile preservation: if a version already pinned in the lockfile still
+    // satisfies the range and is still published, reuse it instead of bumping to
+    // the newest match. `preferred` is only ever a concrete semver (never a
+    // dist-tag), so this never hijacks a `latest`/`next` range.
+    if (preferred && packument.versions[preferred] && satisfiesRange(preferred, range)) {
+        return preferred;
+    }
     // dist-tag fast path: `latest`, `next`, ...
     if (packument['dist-tags'][range])
         return packument['dist-tags'][range];

package/lib/utils/install-backend.d.ts

@@ -18,6 +18,17 @@ export interface InstallOptions {
     lockfile?: boolean;
     /** Use `<prefix>/gjsify-lock.json` as the source of truth — fail if missing. */
     frozen?: boolean;
+    /**
+     * Native backend only: force a fresh re-resolution that bumps every spec to
+     * the newest version satisfying its range, rewriting the lockfile — the
+     * pre-0.7.x behaviour. By default (this flag off) a resolve that has to run
+     * (a new/changed/removed dep) PRESERVES the versions already pinned in the
+     * existing lockfile and only resolves the genuinely new/changed deps, the
+     * way `npm install` / `yarn install` / `pnpm install` do. Set this to
+     * intentionally pick up in-range updates (≈ `yarn install
+     * --mode=update-lockfile` / `npm update` / `pnpm update`).
+     */
+    refreshLockfile?: boolean;
     /**
      * Per-package version overrides — `<name> → <range>`. Applied to every
      * edge during dependency resolution, irrespective of the requester.

package/lib/utils/npm-oidc.d.ts

@@ -5,6 +5,19 @@ interface OidcExchangeOptions {
     registry: string;
     /** Optional verbose logger — receives single-line strings. */
     log?: (msg: string) => void;
+    /**
+     * Max retries on a TRANSIENT exchange failure (5xx / 429 / network error).
+     * Default 3. A transient npm-side blip (e.g. a 503 Service Unavailable on a
+     * single package mid-release) used to fall straight through to token auth,
+     * which in OIDC-only CI has no token → a 404 that broke the release while
+     * the workflow stayed green (the `@gjsify/process@0.7.3` v0.7.3 incident).
+     * Retrying the exchange keeps the publish on the OIDC path. Non-transient
+     * statuses (404 "package not found", 401/403 misconfig) are NOT retried —
+     * they're surfaced immediately so `--tolerate-untrusted-new` etc. still work.
+     */
+    maxRetries?: number;
+    /** Base backoff in ms for transient retries; doubles each attempt (capped 8s). Default 1000. Tests pass 0. */
+    retryBaseMs?: number;
 }
 export interface OidcExchangeResult {
     /** Short-lived npm token (`Authorization: Bearer <token>`-compatible). */

package/lib/utils/npm-oidc.js

@@ -19,6 +19,9 @@
 //
 // Reference: refs/npm-cli/lib/utils/oidc.js
 // Original: Copyright (c) npm contributors. Artistic-2.0.
+/** HTTP statuses worth retrying — npm-side transient/overload conditions. */
+const TRANSIENT_EXCHANGE_STATUSES = new Set([408, 425, 429, 500, 502, 503, 504]);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export class OidcUnavailableError extends Error {
     reason;
     constructor(message, reason) {
@@ -139,32 +142,59 @@ export async function exchangeOidcForNpmToken(args) {
         : encodeURIComponent(packageName);
     const exchangeUrl = `${registryClean}/-/npm/v1/oidc/token/exchange/package/${escapedName}`;
     log?.(`gjsify oidc: POST ${exchangeUrl}`);
-    const res = await fetch(exchangeUrl, {
-        method: 'POST',
-        headers: {
-            Authorization: `Bearer ${idToken}`,
-            'Content-Type': 'application/json',
-            Accept: 'application/json',
-        },
-        // npm's exchange endpoint accepts an empty JSON body — the JWT is
-        // the proof, no additional claims needed from us.
-        body: '{}',
-    });
-    const text = await res.text().catch(() => '');
-    if (!res.ok) {
-        throw new OidcExchangeError(`npm OIDC token exchange failed for ${packageName}: ${res.status} ${res.statusText} — ${text.slice(0, 300)}`, res.status, text, packageName, decodeJwtPayload(idToken) ?? undefined);
-    }
-    let json;
-    try {
-        json = JSON.parse(text);
-    }
-    catch {
-        throw new OidcExchangeError(`npm OIDC token exchange returned non-JSON body for ${packageName}: ${text.slice(0, 200)}`, res.status, text, packageName);
-    }
-    if (!json.token) {
-        throw new OidcExchangeError(`npm OIDC token exchange returned no \`token\` field for ${packageName}`, res.status, text, packageName);
+    const maxRetries = args.maxRetries ?? 3;
+    const retryBaseMs = args.retryBaseMs ?? 1000;
+    for (let attempt = 0;; attempt++) {
+        let res;
+        try {
+            res = await fetch(exchangeUrl, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${idToken}`,
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json',
+                },
+                // npm's exchange endpoint accepts an empty JSON body — the JWT
+                // is the proof, no additional claims needed from us.
+                body: '{}',
+            });
+        }
+        catch (netErr) {
+            // Network-level failure (DNS, connection reset, TLS): transient.
+            if (attempt < maxRetries) {
+                const delay = Math.min(retryBaseMs * 2 ** attempt, 8000);
+                log?.(`gjsify oidc: network error for ${packageName} (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${delay}ms`);
+                await sleep(delay);
+                continue;
+            }
+            throw new OidcExchangeError(`npm OIDC token exchange network error for ${packageName} after ${attempt + 1} attempt(s): ${netErr instanceof Error ? netErr.message : String(netErr)}`, 0, '', packageName, decodeJwtPayload(idToken) ?? undefined);
+        }
+        const text = await res.text().catch(() => '');
+        if (!res.ok) {
+            // Retry only TRANSIENT npm-side failures; surface everything else
+            // (404/401/403 etc.) immediately so the caller's diagnostics —
+            // `--tolerate-untrusted-new`, Trusted-Publisher misconfig hints —
+            // still fire on the first response.
+            if (TRANSIENT_EXCHANGE_STATUSES.has(res.status) && attempt < maxRetries) {
+                const delay = Math.min(retryBaseMs * 2 ** attempt, 8000);
+                log?.(`gjsify oidc: transient ${res.status} ${res.statusText} for ${packageName} (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${delay}ms`);
+                await sleep(delay);
+                continue;
+            }
+            throw new OidcExchangeError(`npm OIDC token exchange failed for ${packageName}: ${res.status} ${res.statusText} — ${text.slice(0, 300)}`, res.status, text, packageName, decodeJwtPayload(idToken) ?? undefined);
+        }
+        let json;
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            throw new OidcExchangeError(`npm OIDC token exchange returned non-JSON body for ${packageName}: ${text.slice(0, 200)}`, res.status, text, packageName);
+        }
+        if (!json.token) {
+            throw new OidcExchangeError(`npm OIDC token exchange returned no \`token\` field for ${packageName}`, res.status, text, packageName);
+        }
+        return json.token;
     }
-    return json.token;
 }
 /**
  * End-to-end: probe env → fetch id-token → exchange for npm token.

package/lib/utils/prompt.js

@@ -30,7 +30,15 @@ export async function promptHidden(question) {
         stdin.setRawMode(true);
         stdin.resume();
         stdin.setEncoding('utf-8');
-        const onData = (chunk) => {
+        // Do NOT assume `chunk` is a string: under GJS `@gjsify/process` does
+        // not honour `setEncoding('utf-8')` in raw mode, so each chunk arrives
+        // as bytes (a Buffer). Iterating bytes makes `ch === '\r'` always false
+        // and Enter (byte 13) coerce past `ch >= ' '` (→ `13 >= 0`) so it was
+        // masked as another `*` and the prompt never submitted. Normalise to a
+        // string first (same shape as readLine's handler), so this works on
+        // both Node (string) and GJS (bytes) — aligning with `npm login`.
+        const onData = (raw) => {
+            const chunk = typeof raw === 'string' ? raw : raw.toString('utf-8');
             for (const ch of chunk) {
                 if (ch === '\r' || ch === '\n') {
                     cleanup();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.7.3",
+    "version": "0.7.4",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -120,19 +120,19 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.7.3",
-        "@gjsify/create-app": "^0.7.3",
-        "@gjsify/node-globals": "^0.7.3",
-        "@gjsify/node-polyfills": "^0.7.3",
-        "@gjsify/npm-registry": "^0.7.3",
-        "@gjsify/resolve-npm": "^0.7.3",
-        "@gjsify/rolldown-plugin-gjsify": "^0.7.3",
-        "@gjsify/rolldown-plugin-pnp": "^0.7.3",
-        "@gjsify/semver": "^0.7.3",
-        "@gjsify/tar": "^0.7.3",
-        "@gjsify/tsc": "^0.7.3",
-        "@gjsify/web-polyfills": "^0.7.3",
-        "@gjsify/workspace": "^0.7.3",
+        "@gjsify/buffer": "^0.7.4",
+        "@gjsify/create-app": "^0.7.4",
+        "@gjsify/node-globals": "^0.7.4",
+        "@gjsify/node-polyfills": "^0.7.4",
+        "@gjsify/npm-registry": "^0.7.4",
+        "@gjsify/resolve-npm": "^0.7.4",
+        "@gjsify/rolldown-plugin-gjsify": "^0.7.4",
+        "@gjsify/rolldown-plugin-pnp": "^0.7.4",
+        "@gjsify/semver": "^0.7.4",
+        "@gjsify/tar": "^0.7.4",
+        "@gjsify/tsc": "^0.7.4",
+        "@gjsify/web-polyfills": "^0.7.4",
+        "@gjsify/workspace": "^0.7.4",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -140,13 +140,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.7.3",
+        "@gjsify/unit": "^0.7.4",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.7.3",
-        "@gjsify/rolldown-native": "^0.7.3"
+        "@gjsify/oxfmt-native": "^0.7.4",
+        "@gjsify/rolldown-native": "^0.7.4"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {