@moku-labs/ci 1.2.2 → 1.2.4

package/dist/release.mjs

@@ -788,6 +788,60 @@ function isAsciiOnly(text) {
 	return !NON_ASCII.test(text);
 }
 /**
+* The one-line form a top-level value had in the source, e.g. `["dist", "LICENSE"]`.
+*
+* @param source - The original file contents.
+* @param key - The top-level key to look up.
+* @returns The inline text, or `undefined` when the value spanned several lines or is absent.
+* @example
+* inlineValueOf('{\n  "files": ["dist"],\n}', "files"); // '["dist"]'
+*/
+function inlineValueOf(source, key) {
+	const prefix = `  ${JSON.stringify(key)}: `;
+	const line = source.split("\n").find((candidate) => candidate.startsWith(prefix));
+	if (line === void 0) return void 0;
+	const value = line.slice(prefix.length).replace(/,\s*$/, "");
+	return /^[[{].*[\]}]$/.test(value) ? value : void 0;
+}
+/**
+* Put back the one-line objects and arrays the source had. Formatters such as biome keep a
+* short `"files": ["dist"]` on one line; `JSON.stringify` expands it, and an untouched value
+* then shows up as changed lines in the diff. Only top-level, unchanged values are restored.
+*
+* @param manifest - The manifest being written.
+* @param expanded - Its `JSON.stringify` rendering.
+* @param source - The original file contents.
+* @returns The rendering with the untouched inline values restored.
+* @example
+* keepInlineValues({ files: ["dist"] }, '{\n  "files": [\n    "dist"\n  ]\n}\n', source);
+*/
+function keepInlineValues(manifest, expanded, source) {
+	let text = expanded;
+	for (const [key, value] of Object.entries(manifest)) {
+		const inline = inlineValueOf(source, key);
+		if (inline === void 0 || parseManifestValue(inline) !== JSON.stringify(value)) continue;
+		const block = JSON.stringify(value, void 0, 2).replaceAll("\n", "\n  ");
+		const label = `  ${JSON.stringify(key)}: `;
+		text = text.replace(`${label}${block}`, () => `${label}${inline}`);
+	}
+	return text;
+}
+/**
+* The canonical JSON of an inline value, for comparing it with the value being written.
+*
+* @param inline - The one-line JSON text.
+* @returns Its compact re-serialization, or `undefined` when it does not parse.
+* @example
+* parseManifestValue('["dist", "LICENSE"]'); // '["dist","LICENSE"]'
+*/
+function parseManifestValue(inline) {
+	try {
+		return JSON.stringify(JSON.parse(inline));
+	} catch {
+		return;
+	}
+}
+/**
 * Render a manifest the way npm itself writes one: two-space JSON with a trailing newline.
 * A source file that was ASCII-only stays ASCII-only, so an escaped dash the package chose
 * does not show up as a changed line in the diff.
@@ -799,8 +853,10 @@ function isAsciiOnly(text) {
 * await files.write("package.json", formatManifest(manifest, source));
 */
 function formatManifest(manifest, source) {
-	const text = `${JSON.stringify(manifest, void 0, 2)}\n`;
-	if (source === void 0 || !isAsciiOnly(source)) return text;
+	const expanded = `${JSON.stringify(manifest, void 0, 2)}\n`;
+	if (source === void 0) return expanded;
+	const text = keepInlineValues(manifest, expanded, source);
+	if (!isAsciiOnly(source)) return text;
 	return text.replaceAll(new RegExp(NON_ASCII, "g"), (character) => String.raw`\u${character.codePointAt(0)?.toString(16).padStart(4, "0")}`);
 }
 /**
@@ -1596,6 +1652,8 @@ const tagSyncCheck = {
 */
 /** Basename npm registers the publisher against — the workflow file's name, not its path. */
 const PUBLISH_WORKFLOW_FILE$1 = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
+/** Detail of the result when the listing sits behind 2FA; `setup` offers to register anyway. */
+const TRUST_NEEDS_OTP = "npm asks for an OTP, cannot verify from here";
 /**
 * Whether npm's output says the `trust` command itself does not exist.
 *
@@ -1667,7 +1725,7 @@ const trustedPublisherCheck = {
 		]);
 		if (isUnknownCommand(`${listing.stdout}${listing.stderr}`)) return warn("this npm has no `trust` command", "upgrade npm");
 		if (isUnauthorized(`${listing.stdout}${listing.stderr}`)) return skip("cannot list trusted publishers without `npm login`");
-		if (isOtpRequired(`${listing.stdout}${listing.stderr}`)) return warn("npm asks for an OTP, cannot verify from here", `npm trust list ${manifest.name}`);
+		if (isOtpRequired(`${listing.stdout}${listing.stderr}`)) return warn(TRUST_NEEDS_OTP, `npm trust list ${manifest.name}`);
 		if (listing.code !== 0 || !listing.stdout.includes(PUBLISH_WORKFLOW_FILE$1)) return fail("no trusted publisher registered", trustCommand(manifest.name, ownerRepo));
 		return pass(`${ownerRepo} · ${PUBLISH_WORKFLOW_FILE$1}`);
 	}
@@ -2094,6 +2152,22 @@ function deferred(setup, description) {
 	return true;
 }
 /**
+* Hand a step that needs the owner's OTP back to the owner. npm asks for the OTP in a
+* browser; with nobody at the keyboard (`--yes`) that would hang, so the command is printed.
+*
+* @param setup - The wizard state.
+* @param step - What the step does, as a noun phrase ("first publish").
+* @param command - The command the owner runs themselves.
+* @returns `true` when the run is unattended and the caller must not act.
+* @example
+* if (needsOwner(setup, "first publish", "npm publish --access public")) return false;
+*/
+function needsOwner(setup, step, command) {
+	if (!setup.unattended) return false;
+	setup.ui.check(false, `${step} needs your OTP, run it yourself`, command);
+	return true;
+}
+/**
 * Verify the two human-only prerequisites. Nothing else in the wizard can run without
 * them, and neither can be automated — the wizard prints the command and stops.
 *
@@ -2222,7 +2296,7 @@ async function normalizeContract(setup, manifest) {
 * @param setup - The wizard state.
 * @param name - The package name.
 * @param version - The version about to be published.
-* @returns `true` when the package exists on npm after this step.
+* @returns `true` when this run performed the first publish.
 * @example
 * await firstPublish(setup, "@moku-labs/common", "0.2.0");
 */
@@ -2235,13 +2309,14 @@ async function firstPublish(setup, name, version) {
 	]);
 	if (view.code === 0) {
 		setup.ui.check(true, `${name}@${view.stdout.trim()} already on npm`);
-		return true;
+		return false;
 	}
 	if (!await setup.prompts.confirm(`Publish ${name}@${version} to npm now?`)) {
 		setup.ui.check(false, "first publish skipped");
 		return false;
 	}
 	if (deferred(setup, `run bun run build && npm publish --access public`)) return false;
+	if (needsOwner(setup, "first publish", "bun run build && npm publish --access public")) return false;
 	if (await setup.ctx.exec.inherit("bun", ["run", "build"]) !== 0) {
 		setup.ui.error("build failed — not publishing");
 		return false;
@@ -2307,14 +2382,49 @@ async function pushVersionTag(setup, version) {
 async function registerTrustedPublisher(setup) {
 	setup.ui.heading("Trusted publisher");
 	const result = await trustedPublisherCheck.run(setup.ctx);
-	if (result.status !== "fail" || result.fix === void 0) {
-		setup.ui.check(result.status === "pass", `${result.detail}`, result.fix);
+	if (result.status === "pass") {
+		setup.ui.check(true, result.detail);
 		return;
 	}
-	if (deferred(setup, result.fix)) return;
-	const [command = "npm", ...args] = result.fix.split(" ");
+	const registration = result.detail === "npm asks for an OTP, cannot verify from here" ? await registrationBehindOtp(setup) : failFix(result);
+	if (registration === void 0) {
+		setup.ui.check(false, result.detail, result.fix);
+		return;
+	}
+	if (deferred(setup, registration)) return;
+	if (needsOwner(setup, "trusted publisher registration", registration)) return;
+	const [command = "npm", ...args] = registration.split(" ");
 	const code = await setup.ctx.exec.inherit(command, args);
-	setup.ui.check(code === 0, "trusted publisher registered");
+	const hint = code === 0 ? void 0 : `verify: ${result.fix}`;
+	setup.ui.check(code === 0, "trusted publisher registered", hint);
+}
+/**
+* The fix of a failing result. A warn or a skip is not something the wizard may act on.
+*
+* @param result - The check result.
+* @returns The fix command when the result is a failure.
+* @example
+* failFix({ status: "fail", detail: "…", fix: "npm trust github …" });
+*/
+function failFix(result) {
+	return result.status === "fail" ? result.fix : void 0;
+}
+/**
+* The registration command for an account behind 2FA. There the listing needs an OTP, so
+* the check cannot tell "missing" from "registered"; the wizard asks, and npm — with stdio
+* inherited — prompts for the OTP itself and refuses a duplicate.
+*
+* @param setup - The wizard state.
+* @returns The command to run, or `undefined` when it cannot be built or was declined.
+* @example
+* const registration = await registrationBehindOtp(setup);
+*/
+async function registrationBehindOtp(setup) {
+	const manifest = await readManifest(setup.ctx.files);
+	const declared = manifest === void 0 ? void 0 : repositoryUrlOf(manifest);
+	const ownerRepo = declared === void 0 ? void 0 : ownerRepoFrom(declared);
+	if (!manifest?.name || ownerRepo === void 0) return void 0;
+	return await setup.prompts.confirm("npm needs an OTP to list trusted publishers. Register publish.yml now?") ? trustCommand(manifest.name, ownerRepo) : void 0;
 }
 /**
 * Apply the PR-only branch ruleset to the default branch. Tags stay unrestricted — the
@@ -2372,6 +2482,7 @@ async function applyBranchRuleset(setup, ownerRepo) {
 async function runSetup(options) {
 	const setup = {
 		dryRun: false,
+		unattended: false,
 		...options
 	};
 	const { ui } = setup;
@@ -2387,7 +2498,7 @@ async function runSetup(options) {
 	}
 	await writeWorkflows(setup);
 	await normalizeContract(setup, manifest);
-	await firstPublish(setup, manifest.name, manifest.version);
+	const justPublished = await firstPublish(setup, manifest.name, manifest.version);
 	await pushVersionTag(setup, manifest.version);
 	await registerTrustedPublisher(setup);
 	const declared = repositoryUrlOf(manifest);
@@ -2395,10 +2506,12 @@ async function runSetup(options) {
 	if (ownerRepo === void 0) ui.warn("no GitHub owner/repo — skipping the branch ruleset");
 	else await applyBranchRuleset(setup, ownerRepo);
 	ui.heading("Doctor");
-	return (await runDoctor({
+	const report = await runDoctor({
 		ctx: setup.ctx,
 		ui
-	})).failed ? 1 : 0;
+	});
+	if (justPublished) ui.info("published just now: npm can answer 404 for a few minutes, re-run release:doctor then");
+	return report.failed ? 1 : 0;
 }
 //#endregion
 //#region src/lib/argv.ts
@@ -2737,7 +2850,8 @@ async function dispatch(parsed, ctx, ui) {
 		ctx,
 		ui,
 		prompts: parsed.yes || parsed.dryRun ? ASSENTING_PROMPTS : createBrandPrompts(),
-		dryRun: parsed.dryRun
+		dryRun: parsed.dryRun,
+		unattended: parsed.yes
 	});
 	if (parsed.command === "release" && parsed.releaseType !== void 0) return runRelease({
 		ctx,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moku-labs/ci",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "Central CI and release for the moku family: reusable workflows, caller examples and the moku-release CLI.",
   "type": "module",
   "sideEffects": [