@mnci/cli 4.2.4 → 4.3.1

package/dist/cli.js

@@ -859,8 +859,9 @@ var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp
 var VERIFY_TARGETS = "lint,typecheck,test,build";
 var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
 var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const hasProjectJson=fs.globSync('apps/*/project.json').length>0;const hasInlineNx=fs.globSync('apps/*/package.json').some((f)=>{try{return Boolean(JSON.parse(fs.readFileSync(f,'utf8')).nx)}catch{return false}});const hasCsproj=fs.globSync('apps/*/*.csproj').length>0;if(!hasProjectJson&&!hasInlineNx&&!hasCsproj){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
+var SHALLOW_CLONE_GUARD = `node -e "const r=require('node:child_process').spawnSync('git',['rev-parse','--is-shallow-repository'],{encoding:'utf8'});if(r.status!==0){console.error('Could not determine whether this checkout has full history (git rev-parse --is-shallow-repository failed) - refusing to release. '+(r.stderr||'').trim());process.exit(1)}if(r.stdout.trim()==='true'){console.error('This checkout is a shallow clone. nx release resolves the current version of each package from its git tag, and silently falls back to the permanently-stale on-disk version when a tag cannot be found - which can propose, and publish, a version DOWNGRADE. Fetch full history before releasing - set fetchDepth (Azure) or fetch-depth (GitHub) to 0.');process.exit(1)}"`;
 function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
-  return `node -e "const fs=require('node:fs'),cp=require('node:child_process');const hasNpm=fs.globSync('packages/*/package.json').length>0;const hasPython=fs.globSync('python-packages/*/pyproject.toml').length>0;const hasCsharp=fs.globSync('packages/*/*.csproj').length>0;if(!hasNpm&&!hasPython&&!hasCsharp){console.log('Nothing to release - skipping.');process.exit(0)}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync('npx nx release --yes',{stdio:'inherit',shell:true,env}).status ?? 1)"`;
+  return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;if(!hasNpm&&!hasPython&&!hasCsharp){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
 function pythonPublishEnvFragment(pythonPublishUrl2) {
   return pythonPublishUrl2 ? `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}` : "";
@@ -943,6 +944,18 @@ variables:
   # agent OS.
   - name: npm_config_cache
     value: $(Pipeline.Workspace)/.npm
+  # Overrides the bump nx would compute from conventional commits for one
+  # release run \u2014 'major', 'minor', 'patch', or an exact version ('1.2.3').
+  # Defined here (rather than left unset) so $(RELEASE_SPECIFIER) always
+  # expands: an Azure Pipelines macro that names an undefined variable is
+  # left as the literal, unexpanded text '$(RELEASE_SPECIFIER)' rather than
+  # empty, which would otherwise reach the release guard below as a bogus
+  # value. Override it per run in Pipelines -> Run pipeline -> Variables, or
+  # set a repo-level default in Pipeline -> Edit -> Variables. See the
+  # release step below for why a bare keyword is unreliable once more than
+  # one package is releasable.
+  - name: RELEASE_SPECIFIER
+    value: ''
 
 steps:
   - checkout: self
@@ -1100,17 +1113,41 @@ steps:
     displayName: Tag the run per app (type-name)
     condition: ${onMain}
 
+  # nx release resolves each package's current version from its git tag, and
+  # falls back to the (permanently stale, since git.commit is false) on-disk
+  # version when a tag cannot be resolved \u2014 which happens whenever this
+  # checkout lacks full history. This is currently guaranteed by fetchDepth 0
+  # above plus the explicit fetch below, but neither is expressed as a
+  # dependency anywhere else, so this makes it a hard, loud precondition
+  # instead of a silently wrong version discovered after release.
+  - script: ${SHALLOW_CLONE_GUARD}
+    displayName: Verify this is a full checkout (nx release needs the real tag history)
+    condition: ${onMain}
+
   # Version + tag + publish, in one release, for npm (packages/*), Python
   # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional commits,
   # tag-only push. Portable guard: nx release errors on an empty scope, so
   # skip cleanly when there is nothing to release. When there are Python or
   # C# packages and an Azure feed, twine/NuGet publish credentials are
   # exported (raw PAT, decoded from the base64 variable).
+  #
+  # RELEASE_SPECIFIER (the pipeline variable above) overrides the bump nx
+  # would compute from conventional commits for THIS run. In a workspace with
+  # more than one releasable package, a bare keyword ('major'/'minor'/'patch')
+  # is unreliable \u2014 nx versions interdependent packages in two passes (a
+  # dependency-bump pass, then the specifier pass), and the second pass
+  # computes from a version cached before the first pass ran, silently
+  # landing back on the same patch bump either way. An exact version ('1.2.3')
+  # does not have this problem, since both passes apply it verbatim \u2014 prefer
+  # it whenever more than one package is releasable. The guard below fails
+  # the run rather than under-bumping silently: clear the variable back to
+  # '' once the override is no longer needed.
   - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2), nugetPublishEnvFragment(nugetFeedUrl2))}
     displayName: Release \u2014 version, tag and publish (npm + Python + C#)
     condition: ${onMain}
     env:
       ${npmAuthName}: ${npmAuthValue}
+      RELEASE_SPECIFIER: $(RELEASE_SPECIFIER)
 
   # nx release's own git push (release.git.push) is deliberately left off: it
   # only runs when a remote GitHub/GitLab Release is configured, which this
@@ -1301,12 +1338,38 @@ jobs:
           path: dist/drop
           if-no-files-found: ignore
 
+      # nx release resolves each package's current version from its git tag,
+      # and falls back to the (permanently stale, since git.commit is false)
+      # on-disk version when a tag cannot be resolved \u2014 which happens
+      # whenever this checkout lacks full history. This is currently
+      # guaranteed by fetch-depth 0 above plus the explicit fetch below, but
+      # neither is expressed as a dependency anywhere else, so this makes it
+      # a hard, loud precondition instead of a silently wrong version
+      # discovered after release.
+      - run: ${SHALLOW_CLONE_GUARD}
+        name: Verify this is a full checkout (nx release needs the real tag history)
+        if: \${{ ${onMain} }}
+
       # Version + tag + publish, in one release, for npm (packages/*), Python
       # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional
       # commits, tag-only push. Portable guard: nx release errors on an empty
       # scope, so skip cleanly when there is nothing to release. When there
       # are Python or C# packages and an Azure feed, twine/NuGet publish
-      # credentials are exported (raw PAT, decoded from the base64 secret).${githubReleases ? `
+      # credentials are exported (raw PAT, decoded from the base64 secret).
+      #
+      # RELEASE_SPECIFIER (repository variable, Settings -> Secrets and
+      # variables -> Actions -> Variables) overrides the bump nx would compute
+      # from conventional commits for THIS run: 'major', 'minor', 'patch', or
+      # an exact version ('1.2.3'). In a workspace with more than one
+      # releasable package, a bare keyword is unreliable \u2014 nx versions
+      # interdependent packages in two passes (a dependency-bump pass, then
+      # the specifier pass), and the second pass computes from a version
+      # cached before the first pass ran, silently landing back on the same
+      # patch bump either way. An exact version does not have this problem,
+      # since both passes apply it verbatim \u2014 prefer it whenever more than one
+      # package is releasable. The guard below fails the run rather than
+      # under-bumping silently: unset or clear the variable once the override
+      # is no longer needed.${githubReleases ? `
       # This provider also creates a per-project GitHub Release (changelog
       # generated from conventional commits since that project's last tag),
       # which is why 'nx release' pushes the tag itself here \u2014 see
@@ -1316,7 +1379,8 @@ jobs:
         name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python + C#)
         if: \${{ ${onMain} }}
         env:
-          ${npmAuthName}: ${npmAuthValue}${githubReleases ? `
+          ${npmAuthName}: ${npmAuthValue}
+          RELEASE_SPECIFIER: \${{ vars.RELEASE_SPECIFIER }}${githubReleases ? `
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
 ${githubReleases ? "" : `
       # nx release's own git push (release.git.push) is deliberately left off: it
@@ -1675,35 +1739,14 @@ var SOURCEMAP_PATH_TRANSFORM = [
   "    },",
   ""
 ].join("\n");
-var ROLLUP_CONFIG_WITH_DTS_FIX = [
-  "  {",
-  "    // Added by MoNecromanCI. @nx/rollup's dts-bundle plugin writes dist/index.d.ts",
-  "    // as a stub re-exporting the real declarations, and builds that specifier with",
-  "    // path.relative() - an OS-NATIVE path. On Windows it emits",
-  String.raw`    //   export * from "./src\\index";`,
-  "    // which is not a valid module specifier on ANY platform: a specifier is",
-  "    // URL-style, so / is correct everywhere and a backslash nowhere. It resolves on",
-  "    // Windows only because the resolver normalises separators there, leaving the",
-  "    // package untyped on Linux and macOS.",
-  "    //",
-  "    // mnci also points `types` past this stub, so nothing depends on it being",
-  "    // correct; this makes the emitted file correct too. Remove once Nx fixes the",
-  "    // plugin - its own devkit already exports normalizePath for exactly this.",
-  "    //",
-  "    // The second half fixes a separate defect in the REAL declarations `types`",
-  '    // points at: tsconfig.lib.json declares under moduleResolution "bundler",',
-  '    // where a bare relative specifier ("./lib/align") is valid, so every emitted',
-  "    // .d.ts keeps the source's own extensionless imports verbatim. A consumer on",
-  '    // "moduleResolution": "nodenext" - the workspace root default - requires an',
-  "    // explicit extension on every relative specifier and gets TS2834 (or,",
-  "    // combined with skipLibCheck, a silent zero-export module) instead. Declared",
-  "    // extensions are left untouched; only a bare relative specifier gets .js",
-  "    // appended, matching what tsc itself emits under node16/nodenext.",
-  "    plugins: [",
+var DECLARATION_SPECIFIER_PLUGIN_MARKER = "name: 'mnci-normalise-declaration-specifiers'";
+var DECLARATION_SPECIFIER_EXTENSION_MARKER = "bareRelativeSpecifier";
+var DECLARATION_SPECIFIER_DIRECTORY_MARKER = "resolveSpecifierSuffix";
+var DECLARATION_SPECIFIER_PLUGIN = [
   "      {",
   "        name: 'mnci-normalise-declaration-specifiers',",
   "        writeBundle (outputOptions) {",
-  "          const { readdirSync, readFileSync, writeFileSync } = require('node:fs')",
+  "          const { existsSync, readdirSync, readFileSync, writeFileSync } = require('node:fs')",
   "          const { join } = require('node:path')",
   "          const dir = outputOptions.dir ?? './dist'",
   "          const stub = join(dir, 'index.d.ts')",
@@ -1721,7 +1764,7 @@ var ROLLUP_CONFIG_WITH_DTS_FIX = [
   "          const normalised = source.replaceAll(separator, '/')",
   "          if (normalised !== source) writeFileSync(stub, normalised)",
   "",
-  String.raw`          const bareRelativeSpecifier = /from(\s+)(['"])(\.[^'"]+?)\2/g`,
+  String.raw`          const ${DECLARATION_SPECIFIER_EXTENSION_MARKER} = /from(\s+)(['"])(\.[^'"]+?)\2/g`,
   String.raw`          const hasExtension = /\.(?:mjs|cjs|jsx?|json)$/`,
   "          let entries",
   "          try {",
@@ -1731,25 +1774,115 @@ var ROLLUP_CONFIG_WITH_DTS_FIX = [
   "          }",
   "          for (const entry of entries) {",
   "            if (!entry.name.endsWith('.d.ts')) continue",
-  "            const filePath = join(entry.parentPath ?? entry.path, entry.name)",
+  "            const from = entry.parentPath ?? entry.path",
+  "            const filePath = join(from, entry.name)",
   "            let declaration",
   "            try {",
   "              declaration = readFileSync(filePath, 'utf8')",
   "            } catch {",
   "              continue",
   "            }",
+  "            // A bare specifier may name a FILE or a DIRECTORY BARREL - resolved",
+  "            // against what rollup actually emitted next to this file, never",
+  "            // guessed. A directory needs /index.js, not .js (a file that was",
+  "            // never written); anything neither form matches is left alone rather",
+  "            // than rewritten to a specifier that cannot resolve.",
+  `            const ${DECLARATION_SPECIFIER_DIRECTORY_MARKER} = (specifier) => {`,
+  "              if (hasExtension.test(specifier)) return null",
+  "              if (existsSync(join(from, specifier + '.d.ts'))) return specifier + '.js'",
+  "              if (existsSync(join(from, specifier, 'index.d.ts'))) return specifier + '/index.js'",
+  "              return null",
+  "            }",
   "            const withExtensions = declaration.replace(",
-  "              bareRelativeSpecifier,",
-  "              (match, space, quote, specifier) =>",
-  "                hasExtension.test(specifier) ? match : `from${space}${quote}${specifier}.js${quote}`,",
+  `              ${DECLARATION_SPECIFIER_EXTENSION_MARKER},`,
+  "              (match, space, quote, specifier) => {",
+  `                const resolved = ${DECLARATION_SPECIFIER_DIRECTORY_MARKER}(specifier)`,
+  "                return resolved === null ? match : `from${space}${quote}${resolved}${quote}`",
+  "              },",
   "            )",
   "            if (withExtensions !== declaration) writeFileSync(filePath, withExtensions)",
   "          }",
   "        }",
-  "      }",
+  "      }"
+].join("\n");
+var ROLLUP_CONFIG_WITH_DTS_FIX = [
+  "  {",
+  "    // Added by MoNecromanCI. @nx/rollup's dts-bundle plugin writes dist/index.d.ts",
+  "    // as a stub re-exporting the real declarations, and builds that specifier with",
+  "    // path.relative() - an OS-NATIVE path. On Windows it emits",
+  String.raw`    //   export * from "./src\\index";`,
+  "    // which is not a valid module specifier on ANY platform: a specifier is",
+  "    // URL-style, so / is correct everywhere and a backslash nowhere. It resolves on",
+  "    // Windows only because the resolver normalises separators there, leaving the",
+  "    // package untyped on Linux and macOS.",
+  "    //",
+  "    // mnci also points `types` past this stub, so nothing depends on it being",
+  "    // correct; this makes the emitted file correct too. Remove once Nx fixes the",
+  "    // plugin - its own devkit already exports normalizePath for exactly this.",
+  "    //",
+  "    // The second half fixes a separate defect in the REAL declarations `types`",
+  '    // points at: tsconfig.lib.json declares under moduleResolution "bundler",',
+  '    // where a bare relative specifier ("./lib/align") is valid, so every emitted',
+  "    // .d.ts keeps the source's own extensionless imports verbatim. A consumer on",
+  '    // "moduleResolution": "nodenext" - the workspace root default - requires an',
+  "    // explicit extension on every relative specifier and gets TS2834 (or,",
+  "    // combined with skipLibCheck, a silent zero-export module) instead. Declared",
+  "    // extensions are left untouched; only a bare relative specifier gets .js",
+  "    // appended, matching what tsc itself emits under node16/nodenext.",
+  "    plugins: [",
+  DECLARATION_SPECIFIER_PLUGIN,
   "    ]",
   "  }"
 ].join("\n");
+function findEnclosingBraceSpan(text, needle) {
+  const needleIndex = text.indexOf(needle);
+  if (needleIndex === -1) {
+    return void 0;
+  }
+  const start = text.lastIndexOf("{", needleIndex);
+  if (start === -1) {
+    return void 0;
+  }
+  let depth = 0;
+  for (let index = start; index < text.length; index += 1) {
+    if (text[index] === "{") {
+      depth += 1;
+    } else if (text[index] === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        return [start, index + 1];
+      }
+    }
+  }
+  return void 0;
+}
+function withUpgradedDeclarationSpecifierPlugin(config) {
+  if (!config.includes(DECLARATION_SPECIFIER_PLUGIN_MARKER) || config.includes(DECLARATION_SPECIFIER_DIRECTORY_MARKER)) {
+    return config;
+  }
+  const span = findEnclosingBraceSpan(config, DECLARATION_SPECIFIER_PLUGIN_MARKER);
+  if (!span) {
+    return config;
+  }
+  const [start, end] = span;
+  return `${config.slice(0, start)}${DECLARATION_SPECIFIER_PLUGIN}${config.slice(end)}`;
+}
+function upgradeDeclarationSpecifierPlugins(workspaceRoot) {
+  const changed = [];
+  const configs = (0, import_node_fs3.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+    cwd: workspaceRoot
+  });
+  for (const relativePath of configs) {
+    const configPath = (0, import_node_path3.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs3.readFileSync)(configPath, "utf8");
+    const after = withUpgradedDeclarationSpecifierPlugin(before);
+    if (after !== before) {
+      writeFileEnsured(configPath, after);
+      changed.push(relativePath.replaceAll("\\", "/"));
+    }
+  }
+  return changed;
+}
 function repairDeclarationSpecifiers(projectRoot) {
   const configPath = (0, import_node_path3.join)(projectRoot, "rollup.config.cjs");
   if (!fileExists(configPath)) {
@@ -1812,6 +1945,22 @@ function repairPublishableManifest(manifestPath) {
   }
   writeFileEnsured(manifestPath, toJson(manifest));
 }
+function repairPublishableManifests(workspaceRoot) {
+  const changed = [];
+  const manifests = (0, import_node_fs3.globSync)(["packages/*/package.json", "libs/*/package.json"], {
+    cwd: workspaceRoot
+  });
+  for (const relativePath of manifests) {
+    const manifestPath = (0, import_node_path3.join)(workspaceRoot, relativePath);
+    const before = (0, import_node_fs3.readFileSync)(manifestPath, "utf8");
+    repairPublishableManifest(manifestPath);
+    const after = (0, import_node_fs3.readFileSync)(manifestPath, "utf8");
+    if (after !== before) {
+      changed.push(relativePath.replaceAll("\\", "/"));
+    }
+  }
+  return changed;
+}
 function ensureAdmZip(workspaceRoot) {
   if (hasPlugin(workspaceRoot, "adm-zip")) {
     return;
@@ -4318,6 +4467,20 @@ function runUpgrade(workspaceRoot, options) {
       logger.detail(`updated ${path}`);
     }
   }
+  const repairedManifests = repairPublishableManifests(workspaceRoot);
+  if (repairedManifests.length > 0) {
+    logger.step("Repointing `types` at the real declaration file");
+    for (const path of repairedManifests) {
+      logger.detail(`updated ${path}`);
+    }
+  }
+  const upgradedDtsPlugins = upgradeDeclarationSpecifierPlugins(workspaceRoot);
+  if (upgradedDtsPlugins.length > 0) {
+    logger.step("Upgrading declaration specifiers to resolve under nodenext");
+    for (const path of upgradedDtsPlugins) {
+      logger.detail(`updated ${path}`);
+    }
+  }
   logger.step(
     "Formatting the workspace (eslint --fix) \u2014 the slowest step, minutes on a large workspace"
   );