@moku-labs/ci 1.2.1 → 1.2.3

package/dist/release.mjs

@@ -774,16 +774,90 @@ function parseManifest(text) {
 async function readManifest(files) {
 	return parseManifest(await files.read(MANIFEST_PATH));
 }
+/** Any character outside printable ASCII and the JSON whitespace. */
+const NON_ASCII = /[^\t\n\r -~]/;
+/**
+* Whether a text holds only ASCII characters, i.e. every other character is `\uXXXX`-escaped.
+*
+* @param text - The file contents to test.
+* @returns `true` when no raw non-ASCII character is present.
+* @example
+* isAsciiOnly('{"description":"a \\u2014 b"}'); // true
+*/
+function isAsciiOnly(text) {
+	return !NON_ASCII.test(text);
+}
+/**
+* The one-line form a top-level value had in the source, e.g. `["dist", "LICENSE"]`.
+*
+* @param source - The original file contents.
+* @param key - The top-level key to look up.
+* @returns The inline text, or `undefined` when the value spanned several lines or is absent.
+* @example
+* inlineValueOf('{\n  "files": ["dist"],\n}', "files"); // '["dist"]'
+*/
+function inlineValueOf(source, key) {
+	const prefix = `  ${JSON.stringify(key)}: `;
+	const line = source.split("\n").find((candidate) => candidate.startsWith(prefix));
+	if (line === void 0) return void 0;
+	const value = line.slice(prefix.length).replace(/,\s*$/, "");
+	return /^[[{].*[\]}]$/.test(value) ? value : void 0;
+}
+/**
+* Put back the one-line objects and arrays the source had. Formatters such as biome keep a
+* short `"files": ["dist"]` on one line; `JSON.stringify` expands it, and an untouched value
+* then shows up as changed lines in the diff. Only top-level, unchanged values are restored.
+*
+* @param manifest - The manifest being written.
+* @param expanded - Its `JSON.stringify` rendering.
+* @param source - The original file contents.
+* @returns The rendering with the untouched inline values restored.
+* @example
+* keepInlineValues({ files: ["dist"] }, '{\n  "files": [\n    "dist"\n  ]\n}\n', source);
+*/
+function keepInlineValues(manifest, expanded, source) {
+	let text = expanded;
+	for (const [key, value] of Object.entries(manifest)) {
+		const inline = inlineValueOf(source, key);
+		if (inline === void 0 || parseManifestValue(inline) !== JSON.stringify(value)) continue;
+		const block = JSON.stringify(value, void 0, 2).replaceAll("\n", "\n  ");
+		const label = `  ${JSON.stringify(key)}: `;
+		text = text.replace(`${label}${block}`, () => `${label}${inline}`);
+	}
+	return text;
+}
+/**
+* The canonical JSON of an inline value, for comparing it with the value being written.
+*
+* @param inline - The one-line JSON text.
+* @returns Its compact re-serialization, or `undefined` when it does not parse.
+* @example
+* parseManifestValue('["dist", "LICENSE"]'); // '["dist","LICENSE"]'
+*/
+function parseManifestValue(inline) {
+	try {
+		return JSON.stringify(JSON.parse(inline));
+	} catch {
+		return;
+	}
+}
 /**
 * Render a manifest the way npm itself writes one: two-space JSON with a trailing newline.
+* A source file that was ASCII-only stays ASCII-only, so an escaped dash the package chose
+* does not show up as a changed line in the diff.
 *
 * @param manifest - The manifest to serialize.
+* @param source - The file contents the manifest was read from, when there were any.
 * @returns The file contents to write.
 * @example
-* await files.write("package.json", formatManifest(manifest));
+* await files.write("package.json", formatManifest(manifest, source));
 */
-function formatManifest(manifest) {
-	return `${JSON.stringify(manifest, void 0, 2)}\n`;
+function formatManifest(manifest, source) {
+	const expanded = `${JSON.stringify(manifest, void 0, 2)}\n`;
+	if (source === void 0) return expanded;
+	const text = keepInlineValues(manifest, expanded, source);
+	if (!isAsciiOnly(source)) return text;
+	return text.replaceAll(new RegExp(NON_ASCII, "g"), (character) => String.raw`\u${character.codePointAt(0)?.toString(16).padStart(4, "0")}`);
 }
 /**
 * The repository URL a manifest declares, in either the object or shorthand string form.
@@ -1578,6 +1652,8 @@ const tagSyncCheck = {
 */
 /** Basename npm registers the publisher against — the workflow file's name, not its path. */
 const PUBLISH_WORKFLOW_FILE$1 = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
+/** Detail of the result when the listing sits behind 2FA; `setup` offers to register anyway. */
+const TRUST_NEEDS_OTP = "npm asks for an OTP, cannot verify from here";
 /**
 * Whether npm's output says the `trust` command itself does not exist.
 *
@@ -1649,7 +1725,7 @@ const trustedPublisherCheck = {
 		]);
 		if (isUnknownCommand(`${listing.stdout}${listing.stderr}`)) return warn("this npm has no `trust` command", "upgrade npm");
 		if (isUnauthorized(`${listing.stdout}${listing.stderr}`)) return skip("cannot list trusted publishers without `npm login`");
-		if (isOtpRequired(`${listing.stdout}${listing.stderr}`)) return warn("npm asks for an OTP, cannot verify from here", `npm trust list ${manifest.name}`);
+		if (isOtpRequired(`${listing.stdout}${listing.stderr}`)) return warn(TRUST_NEEDS_OTP, `npm trust list ${manifest.name}`);
 		if (listing.code !== 0 || !listing.stdout.includes(PUBLISH_WORKFLOW_FILE$1)) return fail("no trusted publisher registered", trustCommand(manifest.name, ownerRepo));
 		return pass(`${ownerRepo} · ${PUBLISH_WORKFLOW_FILE$1}`);
 	}
@@ -2097,9 +2173,55 @@ async function ensurePrerequisites(setup) {
 	return true;
 }
 /**
+* Whether git already holds this exact file: tracked, and with no uncommitted change.
+*
+* @param setup - The wizard state.
+* @param path - Repo-relative path of the file.
+* @returns `true` when `git checkout -- <path>` would bring the current content back.
+* @example
+* await isCommittedUnchanged(setup, ".github/workflows/ci.yml");
+*/
+async function isCommittedUnchanged(setup, path) {
+	if ((await setup.ctx.exec.capture("git", [
+		"ls-files",
+		"--error-unmatch",
+		path
+	])).code !== 0) return false;
+	const status = await setup.ctx.exec.capture("git", [
+		"status",
+		"--porcelain",
+		"--",
+		path
+	]);
+	return status.code === 0 && status.stdout.trim() === "";
+}
+/**
+* Ask before replacing an existing workflow, and keep the original: in git when it is
+* committed and unmodified, in a `.bak` copy otherwise.
+*
+* @param setup - The wizard state.
+* @param template - The central workflow about to be written.
+* @param existing - The current contents of the file.
+* @returns `true` when the caller may write the template now.
+* @example
+* if (!(await clearExistingWorkflow(setup, template, existing))) continue;
+*/
+async function clearExistingWorkflow(setup, template, existing) {
+	const kind = isThinWorkflow(existing, template) ? "differs" : "is a legacy workflow";
+	const committed = await isCommittedUnchanged(setup, template.path);
+	const safety = committed ? "git keeps the original" : "a .bak copy is kept";
+	if (!await setup.prompts.confirm(`${template.path} ${kind}. Replace it (${safety})?`)) {
+		setup.ui.check(false, `${template.path} left unchanged`);
+		return false;
+	}
+	if (deferred(setup, `${committed ? "replace" : "back up and replace"} ${template.path}`)) return false;
+	if (!committed) await setup.ctx.files.backup(template.path);
+	return true;
+}
+/**
 * Write the two thin workflows. A file that already calls the pinned central workflow is
 * left alone; a differing file is only replaced after an explicit confirm, and a `.bak`
-* copy is kept.
+* copy is kept unless git already holds the original.
 *
 * @param setup - The wizard state.
 * @returns Nothing.
@@ -2114,15 +2236,7 @@ async function writeWorkflows(setup) {
 			setup.ui.check(true, `${template.path} up to date`);
 			continue;
 		}
-		if (existing !== void 0) {
-			const kind = isThinWorkflow(existing, template) ? "differs" : "is a legacy workflow";
-			if (!await setup.prompts.confirm(`${template.path} ${kind}. Replace it (a .bak copy is kept)?`)) {
-				setup.ui.check(false, `${template.path} left unchanged`);
-				continue;
-			}
-			if (deferred(setup, `back up and replace ${template.path}`)) continue;
-			await setup.ctx.files.backup(template.path);
-		} else if (deferred(setup, `write ${template.path}`)) continue;
+		if (!(existing === void 0 ? !deferred(setup, `write ${template.path}`) : await clearExistingWorkflow(setup, template, existing))) continue;
 		await setup.ctx.files.write(template.path, template.content);
 		setup.ui.check(true, `${template.path} written`);
 	}
@@ -2155,7 +2269,8 @@ async function normalizeContract(setup, manifest) {
 		return;
 	}
 	if (deferred(setup, `write package.json`)) return;
-	await setup.ctx.files.write(MANIFEST_PATH, formatManifest(next));
+	const source = await setup.ctx.files.read(MANIFEST_PATH);
+	await setup.ctx.files.write(MANIFEST_PATH, formatManifest(next, source));
 	setup.ui.check(true, `${MANIFEST_PATH} normalized`);
 }
 /**
@@ -2165,7 +2280,7 @@ async function normalizeContract(setup, manifest) {
 * @param setup - The wizard state.
 * @param name - The package name.
 * @param version - The version about to be published.
-* @returns `true` when the package exists on npm after this step.
+* @returns `true` when this run performed the first publish.
 * @example
 * await firstPublish(setup, "@moku-labs/common", "0.2.0");
 */
@@ -2178,7 +2293,7 @@ async function firstPublish(setup, name, version) {
 	]);
 	if (view.code === 0) {
 		setup.ui.check(true, `${name}@${view.stdout.trim()} already on npm`);
-		return true;
+		return false;
 	}
 	if (!await setup.prompts.confirm(`Publish ${name}@${version} to npm now?`)) {
 		setup.ui.check(false, "first publish skipped");
@@ -2209,6 +2324,11 @@ async function firstPublish(setup, name, version) {
 */
 async function pushVersionTag(setup, version) {
 	setup.ui.heading("Tag");
+	const latest = latestVersionTag((await setup.ctx.exec.capture("git", [...LATEST_TAG_ARGS])).stdout);
+	if (latest !== void 0) {
+		setup.ui.check(true, `release tags exist, latest is ${latest}`);
+		return;
+	}
 	const tag = `v${version}`;
 	if ((await setup.ctx.exec.capture("git", [
 		"tag",
@@ -2245,14 +2365,48 @@ async function pushVersionTag(setup, version) {
 async function registerTrustedPublisher(setup) {
 	setup.ui.heading("Trusted publisher");
 	const result = await trustedPublisherCheck.run(setup.ctx);
-	if (result.status !== "fail" || result.fix === void 0) {
-		setup.ui.check(result.status === "pass", `${result.detail}`, result.fix);
+	if (result.status === "pass") {
+		setup.ui.check(true, result.detail);
+		return;
+	}
+	const registration = result.detail === "npm asks for an OTP, cannot verify from here" ? await registrationBehindOtp(setup) : failFix(result);
+	if (registration === void 0) {
+		setup.ui.check(false, result.detail, result.fix);
 		return;
 	}
-	if (deferred(setup, result.fix)) return;
-	const [command = "npm", ...args] = result.fix.split(" ");
+	if (deferred(setup, registration)) return;
+	const [command = "npm", ...args] = registration.split(" ");
 	const code = await setup.ctx.exec.inherit(command, args);
-	setup.ui.check(code === 0, "trusted publisher registered");
+	const hint = code === 0 ? void 0 : `verify: ${result.fix}`;
+	setup.ui.check(code === 0, "trusted publisher registered", hint);
+}
+/**
+* The fix of a failing result. A warn or a skip is not something the wizard may act on.
+*
+* @param result - The check result.
+* @returns The fix command when the result is a failure.
+* @example
+* failFix({ status: "fail", detail: "…", fix: "npm trust github …" });
+*/
+function failFix(result) {
+	return result.status === "fail" ? result.fix : void 0;
+}
+/**
+* The registration command for an account behind 2FA. There the listing needs an OTP, so
+* the check cannot tell "missing" from "registered"; the wizard asks, and npm — with stdio
+* inherited — prompts for the OTP itself and refuses a duplicate.
+*
+* @param setup - The wizard state.
+* @returns The command to run, or `undefined` when it cannot be built or was declined.
+* @example
+* const registration = await registrationBehindOtp(setup);
+*/
+async function registrationBehindOtp(setup) {
+	const manifest = await readManifest(setup.ctx.files);
+	const declared = manifest === void 0 ? void 0 : repositoryUrlOf(manifest);
+	const ownerRepo = declared === void 0 ? void 0 : ownerRepoFrom(declared);
+	if (!manifest?.name || ownerRepo === void 0) return void 0;
+	return await setup.prompts.confirm("npm needs an OTP to list trusted publishers. Register publish.yml now?") ? trustCommand(manifest.name, ownerRepo) : void 0;
 }
 /**
 * Apply the PR-only branch ruleset to the default branch. Tags stay unrestricted — the
@@ -2325,7 +2479,7 @@ async function runSetup(options) {
 	}
 	await writeWorkflows(setup);
 	await normalizeContract(setup, manifest);
-	await firstPublish(setup, manifest.name, manifest.version);
+	const justPublished = await firstPublish(setup, manifest.name, manifest.version);
 	await pushVersionTag(setup, manifest.version);
 	await registerTrustedPublisher(setup);
 	const declared = repositoryUrlOf(manifest);
@@ -2333,10 +2487,12 @@ async function runSetup(options) {
 	if (ownerRepo === void 0) ui.warn("no GitHub owner/repo — skipping the branch ruleset");
 	else await applyBranchRuleset(setup, ownerRepo);
 	ui.heading("Doctor");
-	return (await runDoctor({
+	const report = await runDoctor({
 		ctx: setup.ctx,
 		ui
-	})).failed ? 1 : 0;
+	});
+	if (justPublished) ui.info("published just now: npm can answer 404 for a few minutes, re-run release:doctor then");
+	return report.failed ? 1 : 0;
 }
 //#endregion
 //#region src/lib/argv.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moku-labs/ci",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Central CI and release for the moku family: reusable workflows, caller examples and the moku-release CLI.",
   "type": "module",
   "sideEffects": [
@@ -56,8 +56,8 @@
     "lint:fix": "biome check --write . && eslint --fix .",
     "format": "biome format --write .",
     "test": "vitest run",
-    "release:setup": "moku-release setup",
-    "release:doctor": "moku-release doctor",
-    "release": "moku-release"
+    "release:setup": "bun run build && node dist/release.mjs setup",
+    "release:doctor": "bun run build && node dist/release.mjs doctor",
+    "release": "bun run build && node dist/release.mjs"
   }
 }