@mnci/cli 4.3.3 → 4.5.0

package/README.md

@@ -34,7 +34,7 @@ plays (`.use-case`, `.client`, `.repository`, `.algorithm`, `.validator`,
 
 ```
 src/
-  cli.handler.ts              the CLI transport — decodes argv, calls one use case
+  main.ts                     the CLI transport — decodes argv, calls one use case
   workspace-overlay/          the config files mnci owns and rewrites
   workspace-creation/         mnci new, and the interactive wizard
   workspace-upgrade/          mnci upgrade
@@ -49,9 +49,14 @@ src/
   cli-version/                the update check
 ```
 
-The dependency graph is acyclic and flows one way: `cli.handler` → the command
+The dependency graph is acyclic and flows one way: `main` → the command
 slices → the infrastructure slices → `file-system` as a leaf. That is checked,
-not assumed.
+not assumed — and now enforced: the root `eslint.config.mjs` turns on
+`@mnci/eslint-config`'s `verticalSlices` rules for `packages/cli/src`, so a
+deep sibling import, a file without a role suffix, a nested subfeature or a
+cycle between slices fails `npm run lint` rather than needing someone to
+re-run the checks by hand. It is scoped to this package deliberately; the
+config file says which packages were measured and why they are excluded.
 
 ### Exceptions, and when they go away
 

package/dist/cli.js

@@ -28,13 +28,13 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/cli.handler.ts
-var cli_handler_exports = {};
-__export(cli_handler_exports, {
+// src/main.ts
+var main_exports = {};
+__export(main_exports, {
   buildProgram: () => buildProgram,
   main: () => main
 });
-module.exports = __toCommonJS(cli_handler_exports);
+module.exports = __toCommonJS(main_exports);
 var import_commander = require("commander");
 
 // src/project-scaffolding/add-project.use-case.ts
@@ -415,6 +415,14 @@ function withSharedGlobals(nxJson) {
     namedInputs: { ...namedInputs, sharedGlobals: [...existing, ...missing] }
   };
 }
+var PYTHON_GRAPH_PLUGIN = "@mnci/nx-python-pip/graph";
+function withPythonGraphPlugin(nxJson, pluginInstalled) {
+  const plugins = nxJson.plugins ?? [];
+  if (!pluginInstalled || plugins.some((entry) => pluginName(entry) === PYTHON_GRAPH_PLUGIN)) {
+    return nxJson.plugins === void 0 ? nxJson : { ...nxJson, plugins };
+  }
+  return { ...nxJson, plugins: [...plugins, PYTHON_GRAPH_PLUGIN] };
+}
 function withReleaseConfig(nxJson, ci) {
   return { ...nxJson, defaultBase: "main", release: releaseConfig(ci) };
 }
@@ -869,8 +877,19 @@ var SHALLOW_CLONE_GUARD = `node -e "const r=require('node:child_process').spawnS
 function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
   return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
-function pythonPublishEnvFragment(pythonPublishUrl2) {
-  return pythonPublishUrl2 ? `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}` : "";
+var PYPI_TOKEN_VARIABLE = "PYPI_TOKEN";
+function pypiTokenEnvLine(registryKind, variableReference, indent) {
+  return registryKind === "npm" ? `
+${indent}${PYPI_TOKEN_VARIABLE}: ${variableReference(PYPI_TOKEN_VARIABLE)}` : "";
+}
+function pythonPublishEnvFragment(pythonPublishUrl2, registryKind) {
+  if (pythonPublishUrl2 !== void 0) {
+    return `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}`;
+  }
+  if (registryKind !== "npm") {
+    return "";
+  }
+  return `if(hasPython){if(!process.env.${PYPI_TOKEN_VARIABLE}){console.error('This workspace has '+pythonCount+' Python package(s) to publish but ${PYPI_TOKEN_VARIABLE} is empty. Add a PyPI API token as a secret named ${PYPI_TOKEN_VARIABLE}, or remove the Python packages from release.projects.');process.exit(1)}env.TWINE_USERNAME='__token__';env.TWINE_PASSWORD=process.env.${PYPI_TOKEN_VARIABLE};env.TWINE_NON_INTERACTIVE='1'}`;
 }
 function nugetPublishEnvFragment(nugetFeedUrl2) {
   return nugetFeedUrl2 ? "if(hasCsharp){env.NUGET_PAT=Buffer.from(process.env.PAT,'base64').toString()}" : "";
@@ -1148,11 +1167,11 @@ steps:
   # it whenever more than one package is releasable. The guard below fails
   # the run rather than under-bumping silently: clear the variable back to
   # '' once the override is no longer needed.
-  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2), nugetPublishEnvFragment(nugetFeedUrl2))}
+  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
     displayName: Release \u2014 version, tag and publish (npm + Python + C#)
     condition: ${onMain}
     env:
-      ${npmAuthName}: ${npmAuthValue}
+      ${npmAuthName}: ${npmAuthValue}${pypiTokenEnvLine(registryKind, (name) => `$(${name})`, " ".repeat(6))}
       RELEASE_SPECIFIER: $(RELEASE_SPECIFIER)
 
   # nx release's own git push (release.git.push) is deliberately left off: it
@@ -1381,11 +1400,11 @@ jobs:
       # which is why 'nx release' pushes the tag itself here \u2014 see
       # releaseConfig's remarks for why that is safe on this Nx version and
       # why every other provider combination keeps the explicit push step below.` : ""}
-      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2), nugetPublishEnvFragment(nugetFeedUrl2))}
+      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
         name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python + C#)
         if: \${{ ${onMain} }}
         env:
-          ${npmAuthName}: ${npmAuthValue}
+          ${npmAuthName}: ${npmAuthValue}${pypiTokenEnvLine(registryKind, (name) => `\${{ secrets.${name} }}`, " ".repeat(10))}
           RELEASE_SPECIFIER: \${{ vars.RELEASE_SPECIFIER }}${githubReleases ? `
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
 ${githubReleases ? "" : `
@@ -1498,7 +1517,13 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
   };
   const sync = { ...nxJson.sync, ...SYNC_CONFIG };
   const mnci = { ...nxJson.mnci, ...mnciConfig(options) };
-  const patched = withSharedGlobals(withEslintPlugin(withReleaseConfig(nxJson, options.ci)));
+  const rootManifest = readJson((0, import_node_path2.join)(workspaceRoot, "package.json"));
+  const hasPythonPlugin = (rootManifest.devDependencies ?? {})["@mnci/nx-python-pip"] !== void 0 || (rootManifest.dependencies ?? {})["@mnci/nx-python-pip"] !== void 0;
+  const withRelease = withReleaseConfig(nxJson, options.ci);
+  const patched = withPythonGraphPlugin(
+    withSharedGlobals(withEslintPlugin(withRelease)),
+    hasPythonPlugin
+  );
   onProgress("nx.json \u2014 release, sync, generators, shared inputs, mnci block");
   writeFileEnsured(nxJsonPath, toJson({ ...patched, generators, sync, mnci }));
   onProgress("package.json \u2014 root scripts, TS compilers, ESLint toolchain, overrides");
@@ -1892,14 +1917,22 @@ function pascalScope(scope) {
 var CSHARP_VERSION_ACTIONS_PATH = "tools/csharp-version-actions.cjs";
 var CSHARP_VERSION_ACTIONS = `'use strict'
 
-const { join } = require('node:path')
+const { posix } = require('node:path')
 const { VersionActions } = require('nx/release')
 
 const VERSION_TAG = /<Version>([^<]*)<\\/Version>/
 
+/*
+ * posix.join, never plain join. An Nx Tree path is workspace-relative and
+ * forward-slashed on EVERY platform, while join emits a backslashed path on
+ * Windows. This value is handed back to nx release for changelog and manifest
+ * bookkeeping, and interpolated into the user-facing error below, so it was
+ * wrong on every Windows machine. The same bug was already fixed in the
+ * Python and Flutter plugins' release actions; this third copy was missed.
+ */
 function findCsproj (tree, root) {
   const name = tree.children(root).find((entry) => entry.endsWith('.csproj'))
-  return name ? join(root, name) : null
+  return name ? posix.join(root, name) : null
 }
 
 /**
@@ -2836,18 +2869,35 @@ function pythonPipPluginSpec() {
   return process.env.MNCI2_PYTHON_PIP_SPEC ?? "@mnci/nx-python-pip";
 }
 function ensurePythonPipPlugin(workspaceRoot) {
-  if (hasPlugin(workspaceRoot, "@mnci/nx-python-pip")) {
+  if (!hasPlugin(workspaceRoot, "@mnci/nx-python-pip")) {
+    const spec = pythonPipPluginSpec();
+    logger.step(`Installing the Python toolchain plugin (${spec})`);
+    if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
+      throw new Error("npm install of @mnci/nx-python-pip failed");
+    }
+  }
+  registerPythonGraphPlugin(workspaceRoot);
+}
+function registerPythonGraphPlugin(workspaceRoot) {
+  const nxJsonPath = (0, import_node_path12.join)(workspaceRoot, "nx.json");
+  if (!fileExists(nxJsonPath)) {
     return;
   }
-  const spec = pythonPipPluginSpec();
-  logger.step(`Installing the Python toolchain plugin (${spec})`);
-  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
-    throw new Error("npm install of @mnci/nx-python-pip failed");
+  const nxJson = readJson(nxJsonPath);
+  const patched = withPythonGraphPlugin(nxJson, true);
+  if (patched.plugins?.includes(PYTHON_GRAPH_PLUGIN) !== true) {
+    return;
+  }
+  if (nxJson.plugins?.includes(PYTHON_GRAPH_PLUGIN) === true) {
+    return;
   }
+  logger.step(`Registering ${PYTHON_GRAPH_PLUGIN} so nx affected sees Python dependencies`);
+  writeFileEnsured(nxJsonPath, toJson(patched));
 }
 var PYTHON_REQUIREMENTS_DEV = `build
 twine
 ruff
+mypy
 pytest
 pip-audit
 `;
@@ -4993,7 +5043,7 @@ function readCliVersion(packageDirectory) {
   }
 }
 
-// src/cli.handler.ts
+// src/main.ts
 function buildProgram(cliVersion) {
   const program = new import_commander.Command();
   program.name("mnci").description("MoNecromanCI \u2014 a thin CLI over official Nx plugins").version(cliVersion, "-v, --version", "display the version");