@mnci/cli 4.3.0 → 4.3.2

package/dist/cli.js

@@ -859,8 +859,9 @@ var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp
 var VERIFY_TARGETS = "lint,typecheck,test,build";
 var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
 var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const hasProjectJson=fs.globSync('apps/*/project.json').length>0;const hasInlineNx=fs.globSync('apps/*/package.json').some((f)=>{try{return Boolean(JSON.parse(fs.readFileSync(f,'utf8')).nx)}catch{return false}});const hasCsproj=fs.globSync('apps/*/*.csproj').length>0;if(!hasProjectJson&&!hasInlineNx&&!hasCsproj){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
+var SHALLOW_CLONE_GUARD = `node -e "const r=require('node:child_process').spawnSync('git',['rev-parse','--is-shallow-repository'],{encoding:'utf8'});if(r.status!==0){console.error('Could not determine whether this checkout has full history (git rev-parse --is-shallow-repository failed) - refusing to release. '+(r.stderr||'').trim());process.exit(1)}if(r.stdout.trim()==='true'){console.error('This checkout is a shallow clone. nx release resolves the current version of each package from its git tag, and silently falls back to the permanently-stale on-disk version when a tag cannot be found - which can propose, and publish, a version DOWNGRADE. Fetch full history before releasing - set fetchDepth (Azure) or fetch-depth (GitHub) to 0.');process.exit(1)}"`;
 function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
-  return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;if(!hasNpm&&!hasPython&&!hasCsharp){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
+  return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
 function pythonPublishEnvFragment(pythonPublishUrl2) {
   return pythonPublishUrl2 ? `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}` : "";
@@ -1112,6 +1113,17 @@ steps:
     displayName: Tag the run per app (type-name)
     condition: ${onMain}
 
+  # nx release resolves each package's current version from its git tag, and
+  # falls back to the (permanently stale, since git.commit is false) on-disk
+  # version when a tag cannot be resolved \u2014 which happens whenever this
+  # checkout lacks full history. This is currently guaranteed by fetchDepth 0
+  # above plus the explicit fetch below, but neither is expressed as a
+  # dependency anywhere else, so this makes it a hard, loud precondition
+  # instead of a silently wrong version discovered after release.
+  - script: ${SHALLOW_CLONE_GUARD}
+    displayName: Verify this is a full checkout (nx release needs the real tag history)
+    condition: ${onMain}
+
   # Version + tag + publish, in one release, for npm (packages/*), Python
   # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional commits,
   # tag-only push. Portable guard: nx release errors on an empty scope, so
@@ -1326,6 +1338,18 @@ jobs:
           path: dist/drop
           if-no-files-found: ignore
 
+      # nx release resolves each package's current version from its git tag,
+      # and falls back to the (permanently stale, since git.commit is false)
+      # on-disk version when a tag cannot be resolved \u2014 which happens
+      # whenever this checkout lacks full history. This is currently
+      # guaranteed by fetch-depth 0 above plus the explicit fetch below, but
+      # neither is expressed as a dependency anywhere else, so this makes it
+      # a hard, loud precondition instead of a silently wrong version
+      # discovered after release.
+      - run: ${SHALLOW_CLONE_GUARD}
+        name: Verify this is a full checkout (nx release needs the real tag history)
+        if: \${{ ${onMain} }}
+
       # Version + tag + publish, in one release, for npm (packages/*), Python
       # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional
       # commits, tag-only push. Portable guard: nx release errors on an empty
@@ -1717,11 +1741,18 @@ var SOURCEMAP_PATH_TRANSFORM = [
 ].join("\n");
 var DECLARATION_SPECIFIER_PLUGIN_MARKER = "name: 'mnci-normalise-declaration-specifiers'";
 var DECLARATION_SPECIFIER_EXTENSION_MARKER = "bareRelativeSpecifier";
+var DECLARATION_SPECIFIER_DIRECTORY_MARKER = "resolveSpecifierSuffix";
+function hasDeclarationSpecifierPlugin(config) {
+  return config.includes(DECLARATION_SPECIFIER_PLUGIN_MARKER);
+}
+function hasDirectoryAwareDeclarationSpecifiers(config) {
+  return config.includes(DECLARATION_SPECIFIER_DIRECTORY_MARKER);
+}
 var DECLARATION_SPECIFIER_PLUGIN = [
   "      {",
   "        name: 'mnci-normalise-declaration-specifiers',",
   "        writeBundle (outputOptions) {",
-  "          const { readdirSync, readFileSync, writeFileSync } = require('node:fs')",
+  "          const { existsSync, readdirSync, readFileSync, writeFileSync } = require('node:fs')",
   "          const { join } = require('node:path')",
   "          const dir = outputOptions.dir ?? './dist'",
   "          const stub = join(dir, 'index.d.ts')",
@@ -1749,17 +1780,31 @@ var DECLARATION_SPECIFIER_PLUGIN = [
   "          }",
   "          for (const entry of entries) {",
   "            if (!entry.name.endsWith('.d.ts')) continue",
-  "            const filePath = join(entry.parentPath ?? entry.path, entry.name)",
+  "            const from = entry.parentPath ?? entry.path",
+  "            const filePath = join(from, entry.name)",
   "            let declaration",
   "            try {",
   "              declaration = readFileSync(filePath, 'utf8')",
   "            } catch {",
   "              continue",
   "            }",
+  "            // A bare specifier may name a FILE or a DIRECTORY BARREL - resolved",
+  "            // against what rollup actually emitted next to this file, never",
+  "            // guessed. A directory needs /index.js, not .js (a file that was",
+  "            // never written); anything neither form matches is left alone rather",
+  "            // than rewritten to a specifier that cannot resolve.",
+  `            const ${DECLARATION_SPECIFIER_DIRECTORY_MARKER} = (specifier) => {`,
+  "              if (hasExtension.test(specifier)) return null",
+  "              if (existsSync(join(from, specifier + '.d.ts'))) return specifier + '.js'",
+  "              if (existsSync(join(from, specifier, 'index.d.ts'))) return specifier + '/index.js'",
+  "              return null",
+  "            }",
   "            const withExtensions = declaration.replace(",
   `              ${DECLARATION_SPECIFIER_EXTENSION_MARKER},`,
-  "              (match, space, quote, specifier) =>",
-  "                hasExtension.test(specifier) ? match : `from${space}${quote}${specifier}.js${quote}`,",
+  "              (match, space, quote, specifier) => {",
+  `                const resolved = ${DECLARATION_SPECIFIER_DIRECTORY_MARKER}(specifier)`,
+  "                return resolved === null ? match : `from${space}${quote}${resolved}${quote}`",
+  "              },",
   "            )",
   "            if (withExtensions !== declaration) writeFileSync(filePath, withExtensions)",
   "          }",
@@ -1818,7 +1863,7 @@ function findEnclosingBraceSpan(text, needle) {
   return void 0;
 }
 function withUpgradedDeclarationSpecifierPlugin(config) {
-  if (!config.includes(DECLARATION_SPECIFIER_PLUGIN_MARKER) || config.includes(DECLARATION_SPECIFIER_EXTENSION_MARKER)) {
+  if (!config.includes(DECLARATION_SPECIFIER_PLUGIN_MARKER) || config.includes(DECLARATION_SPECIFIER_DIRECTORY_MARKER)) {
     return config;
   }
   const span = findEnclosingBraceSpan(config, DECLARATION_SPECIFIER_PLUGIN_MARKER);
@@ -4059,6 +4104,7 @@ function checkNpmrc(workspaceRoot, registry, scope) {
 function checkVersionActions(workspaceRoot) {
   const candidates = [
     ...(0, import_node_fs9.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
+    ...(0, import_node_fs9.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
     ...(0, import_node_fs9.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
   ].map((manifest) => toPosix2(manifest));
   return candidates.flatMap((manifest) => {
@@ -4187,6 +4233,44 @@ function checkRollupSourceMaps(workspaceRoot) {
     ];
   });
 }
+function checkDeclarationSpecifiers(workspaceRoot) {
+  const configs = (0, import_node_fs9.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+    cwd: workspaceRoot
+  }).map((config) => toPosix2(config));
+  return configs.flatMap((relativePath) => {
+    const configPath = (0, import_node_path15.join)(workspaceRoot, relativePath);
+    if (!fileExists(configPath)) {
+      return [];
+    }
+    const resolved = resolveRollupConfigText(configPath);
+    if (!hasDeclarationSpecifierPlugin(resolved)) {
+      return [
+        {
+          check: `${relativePath} normalises declaration specifiers`,
+          ok: false,
+          detail: "no mnci-normalise-declaration-specifiers plugin \u2014 the emitted .d.ts files keep the extensionless imports tsconfig.lib.json allows, which a nodenext consumer cannot resolve",
+          // Deliberately NOT `mnci upgrade`, which would send the user in a
+          // circle: `upgradeDeclarationSpecifierPlugins` only rewrites a
+          // plugin that is already there, and `repairDeclarationSpecifiers`
+          // is anchored on the generator's own placeholder comment, which a
+          // config in this state no longer has. Verified by running the
+          // command against exactly this shape — it no-ops. Naming a command
+          // that silently does nothing is the failure mode this file's own
+          // source-map check already goes out of its way to avoid.
+          remedy: "add the plugin to withNx's second argument by hand (copy it from a freshly `mnci add npm-lib`'d project) \u2014 `mnci upgrade` only updates a plugin that is already present, it cannot restore a missing one"
+        }
+      ];
+    }
+    return [
+      {
+        check: `${relativePath} resolves directory barrels in declarations`,
+        ok: hasDirectoryAwareDeclarationSpecifiers(resolved),
+        detail: "the plugin appends .js to every bare specifier, including ones naming a directory barrel, which needs /index.js \u2014 the named file is never emitted, so every export behind it publishes as `any` with nothing reporting it",
+        remedy: "run `mnci upgrade`, which replaces the plugin body with the current one"
+      }
+    ];
+  });
+}
 function collectFindings(workspaceRoot) {
   const nxJsonPath = (0, import_node_path15.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
@@ -4203,6 +4287,7 @@ function collectFindings(workspaceRoot) {
     checkNpmrc(workspaceRoot, nxJson.mnci?.registry, nxJson.mnci?.scope),
     checkNoRootRuntimeDependencies(workspaceRoot),
     ...checkRollupSourceMaps(workspaceRoot),
+    ...checkDeclarationSpecifiers(workspaceRoot),
     ...checkVersionActions(workspaceRoot),
     ...checkTargetFilesExist(workspaceRoot),
     checkSync(workspaceRoot)