@napi-rs/cli 3.8.4 → 3.8.6

package/src/api/pre-publish.ts

@@ -51,6 +51,7 @@ import {
   mkdirAsync,
   restrictWasiNodeEngine,
   resolvePackageReconciliationPaths,
+  RootPublishers,
   wasiLoaderSuffix,
   wasiTargetHasThreads,
   writeFileAtomic,
@@ -59,6 +60,7 @@ import {
   parseTriple,
   type CommonPackageJsonFields,
   type FileSystemTransactionWrite,
+  type RootPublisher,
   type Target,
   type UserNapiConfig,
 } from '../utils/index.js'
@@ -312,6 +314,7 @@ export async function prePublish(userOptions: PrePublishOptions) {
           packageName,
           binaryName,
           npmClient,
+          rootPublisher: configuredRootPublisher,
           wasm,
         } = await readNapiConfig(
           packageJsonPath,
@@ -319,6 +322,10 @@ export async function prePublish(userOptions: PrePublishOptions) {
             ? resolve(options.cwd, options.configPath)
             : undefined,
         )
+        const rootPublisher = resolveRootPublisher(
+          options.rootPublisher,
+          configuredRootPublisher,
+        )
         const threadlessWasiTarget = targets.find(
           (target) =>
             target.platform === 'wasi' && !wasiTargetHasThreads(target),
@@ -425,6 +432,7 @@ export async function prePublish(userOptions: PrePublishOptions) {
           nodeEngine,
           facade: rootFacade,
           staleGeneratedFiles: rootFacadeReconciliation.staleGeneratedFiles,
+          rootPublisher,
         }
         if (preparedWorkspaceRoot) {
           const stagedTransactionRoot = join(
@@ -1573,8 +1581,101 @@ function createLegacyDeepImportExports(rootDir: string) {
   return exportsMap
 }
 
-function collectRootPackagePathReferences(
+// pnpm and yarn berry (>= 2) rewrite the manifest they pack:
+// `publishConfig.exports` wholesale-replaces `exports` in the published
+// package.json (pnpm docs: "It is possible to override some fields in the
+// manifest before the package is packed"; verified empirically with pnpm 11
+// and yarn 4 `pack`). npm does NOT: its `publishConfig` only carries
+// publish-time configuration such as tag, registry and access
+// (https://docs.npmjs.com/cli/v11/configuring-npm/package-json#publishconfig),
+// and npm 11 packs the raw `exports` untouched. Yarn Classic (1.x) behaves
+// like npm here — verified empirically with yarn 1.22.22 `pack`, which keeps
+// the raw `exports` in the tarball manifest.
+const REWRITING_ROOT_PUBLISHERS = new Set<RootPublisher>(['pnpm', 'yarn'])
+
+export function rootPublisherRewritesRootExports(
+  rootPublisher: RootPublisher | undefined,
+) {
+  return (
+    rootPublisher !== undefined && REWRITING_ROOT_PUBLISHERS.has(rootPublisher)
+  )
+}
+
+// `prePublish` publishes only the generated per-platform packages; the root
+// package is packed and published by whoever called us. Which manifest ships
+// therefore cannot be observed here, so it must be declared: `--root-publisher`
+// wins over the `napi.rootPublisher` config field, and when neither is set the
+// conservative union of both export maps is validated.
+export function resolveRootPublisher(
+  optionValue: string | undefined,
+  configValue: string | undefined,
+): RootPublisher | undefined {
+  const [value, source] =
+    optionValue === undefined
+      ? ([configValue, 'napi.rootPublisher'] as const)
+      : ([optionValue, '--root-publisher'] as const)
+  if (value === undefined) {
+    return undefined
+  }
+  if (!(RootPublishers as readonly string[]).includes(value)) {
+    throw new Error(
+      `Unknown ${source} value "${value}". Expected one of: ${RootPublishers.join(', ')}.`,
+    )
+  }
+  return value as RootPublisher
+}
+
+// Package managers identify themselves to lifecycle scripts (e.g.
+// `prepublishOnly`) via `npm_config_user_agent`. That names the process that
+// invoked this command, which is not necessarily the root publisher, so it
+// never selects a validation branch — it only makes the failure actionable by
+// naming the option to set.
+//
+// The patterns require a complete `<name>/<version>` token — a semver-ish
+// version followed by a token boundary — so that a malformed agent such as
+// `yarn/2garbage` is not read as "yarn 2" (and `pnpm/x` not as pnpm) by
+// matching a numeric prefix. The prerelease/build tails are kept as two
+// separate optional groups on purpose: collapsing them into
+// `(?:[-+][0-9A-Za-z.-]+)*` makes the `-` ambiguous with the character class
+// and backtracks exponentially on a non-matching tail.
+const VERSION_TOKEN_TAIL = String.raw`(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?(?=\s|$)`
+const PNPM_PUBLISHER_PATTERN = new RegExp(
+  String.raw`(?:^|\s)pnpm\/\d+` + VERSION_TOKEN_TAIL,
+)
+const YARN_PUBLISHER_PATTERN = new RegExp(
+  String.raw`(?:^|\s)yarn\/(\d+)` + VERSION_TOKEN_TAIL,
+)
+
+export function sniffRewritingPublisherFromUserAgent(
+  userAgent: string | undefined = process.env.npm_config_user_agent,
+): 'pnpm' | 'yarn' | undefined {
+  if (typeof userAgent !== 'string') {
+    return undefined
+  }
+  if (PNPM_PUBLISHER_PATTERN.test(userAgent)) {
+    return 'pnpm'
+  }
+  const yarnMajor = YARN_PUBLISHER_PATTERN.exec(userAgent)
+  return yarnMajor !== null && Number(yarnMajor[1]) >= 2 ? 'yarn' : undefined
+}
+
+export function rootPublisherHint(
+  rootPublisher: RootPublisher | undefined,
+  userAgent?: string,
+) {
+  if (rootPublisher !== undefined) {
+    return ''
+  }
+  const sniffed = sniffRewritingPublisherFromUserAgent(userAgent)
+  if (sniffed === undefined) {
+    return ''
+  }
+  return ` This ran under ${sniffed}, which replaces "exports" with "publishConfig.exports" when it packs: if ${sniffed} also publishes the root package, set napi.rootPublisher to "${sniffed}" (or pass --root-publisher ${sniffed}) to validate the publish-effective export map instead.`
+}
+
+export function collectRootPackagePathReferences(
   packageJson: CommonPackageJsonFields,
+  rootPublisher?: RootPublisher,
 ) {
   const files = new Set<string>()
   addLegacyPackageFileReference(files, packageJson.main)
@@ -1588,13 +1689,24 @@ function collectRootPackagePathReferences(
     (packageJson as CommonPackageJsonFields & { typings?: unknown }).typings,
   )
   addLegacyPackageFileReference(files, packageJson.browser)
-  collectRootExportFileReferences(files, packageJson.exports)
 
+  // Validate the export map(s) that will actually ship. Under a declared
+  // manifest-rewriting publisher (pnpm/yarn), `publishConfig.exports` replaces
+  // the local `exports` in the published manifest, so only the
+  // publish-effective map matters: the local map may reference
+  // development-only sources (e.g. `dev: ./src/*.ts` conditions) that are
+  // never packed. Under npm and Yarn Classic — or when no publisher is
+  // declared — the raw `exports` ships as-is, so validate both maps.
   const publishConfig = asRecord(packageJson.publishConfig)
-  if (
+  const hasPublishConfigExports =
     publishConfig &&
     Object.prototype.hasOwnProperty.call(publishConfig, 'exports')
-  ) {
+  const rawExportsReplacedOnPublish =
+    hasPublishConfigExports && rootPublisherRewritesRootExports(rootPublisher)
+  if (!rawExportsReplacedOnPublish) {
+    collectRootExportFileReferences(files, packageJson.exports)
+  }
+  if (hasPublishConfigExports) {
     collectRootExportFileReferences(files, publishConfig.exports)
   }
   return [...files]
@@ -1717,9 +1829,10 @@ export function parseNpmPackFiles(output: string) {
   )
 }
 
-function validateRootFacadePacklist(
+export function validateRootFacadePacklist(
   rootDir: string,
   rootPackageFiles: string[],
+  rootPublisher?: RootPublisher,
 ) {
   const paths = validateRootPackagePaths(rootDir, rootPackageFiles)
   const packedFiles = readNpmPackFiles(rootDir, 'threadless WASI root package')
@@ -1736,7 +1849,7 @@ function validateRootFacadePacklist(
     .map(({ path }) => path)
   if (missingPaths.length > 0) {
     throw new Error(
-      `The threadless WASI root package references paths omitted by npm pack: ${missingPaths.join(', ')}. Add them to package.json "files" or remove the matching .npmignore rules.`,
+      `The threadless WASI root package references paths omitted by npm pack: ${missingPaths.join(', ')}. Add them to package.json "files" or remove the matching .npmignore rules.${rootPublisherHint(rootPublisher)}`,
     )
   }
 }
@@ -1747,6 +1860,7 @@ interface RootReleaseMaterializationPlan {
   nodeEngine?: string
   facade?: ThreadlessWasiRootFacade
   staleGeneratedFiles: string[]
+  rootPublisher?: RootPublisher
 }
 
 function pathIsWithin(root: string, path: string) {
@@ -2218,7 +2332,10 @@ async function stageRootReleasePlan(
   await cp(packageJsonPath, join(stagedRootDir, 'package.json'))
   if (plan.facade) {
     const packedFiles = readNpmPackFiles(rootDir, 'root package')
-    const referencedFiles = collectRootPackagePathReferences(plan.packageJson)
+    const referencedFiles = collectRootPackagePathReferences(
+      plan.packageJson,
+      plan.rootPublisher,
+    )
     for (const file of new Set([
       ...packedFiles,
       ...referencedFiles,
@@ -2240,10 +2357,17 @@ async function stageRootReleasePlan(
   }
   await materializeRootReleasePlan(stagedRootDir, plan)
   if (plan.facade) {
-    validateRootFacadePacklist(stagedRootDir, [
-      ...plan.facade.generatedFiles,
-      ...collectRootPackagePathReferences(plan.packageJson),
-    ])
+    validateRootFacadePacklist(
+      stagedRootDir,
+      [
+        ...plan.facade.generatedFiles,
+        ...collectRootPackagePathReferences(
+          plan.packageJson,
+          plan.rootPublisher,
+        ),
+      ],
+      plan.rootPublisher,
+    )
   }
 }
 

package/src/def/pre-publish.ts

@@ -47,6 +47,14 @@ export abstract class BasePrePublishCommand extends Command {
     description: 'Whether skip optionalDependencies packages publish',
   })
 
+  rootPublisher?: 'npm' | 'pnpm' | 'yarn' | 'yarn-classic' = Option.String(
+    '--root-publisher',
+    {
+      description:
+        'The package manager that publishes the root package. pnpm and yarn berry replace `exports` with `publishConfig.exports` while packing, so for them the root package validation targets the publish-effective export map. Defaults to the `napi.rootPublisher` config field, and validates both export maps when neither is set',
+    },
+  )
+
   dryRun = Option.Boolean('--dry-run', false, {
     description: 'Dry run without touching file system',
   })
@@ -62,6 +70,7 @@ export abstract class BasePrePublishCommand extends Command {
       ghReleaseName: this.ghReleaseName,
       ghReleaseId: this.ghReleaseId,
       skipOptionalPublish: this.skipOptionalPublish,
+      rootPublisher: this.rootPublisher,
       dryRun: this.dryRun,
     }
   }
@@ -119,6 +128,10 @@ export interface PrePublishOptions {
    * @default false
    */
   skipOptionalPublish?: boolean
+  /**
+   * The package manager that publishes the root package. pnpm and yarn berry replace `exports` with `publishConfig.exports` while packing, so for them the root package validation targets the publish-effective export map. Defaults to the `napi.rootPublisher` config field, and validates both export maps when neither is set
+   */
+  rootPublisher?: 'npm' | 'pnpm' | 'yarn' | 'yarn-classic'
   /**
    * Dry run without touching file system
    *

package/src/utils/config.ts

@@ -16,6 +16,17 @@ export type SupportedTestFramework = ValueOfConstArray<
   typeof SupportedTestFrameworks
 >
 
+/**
+ * Package managers that may publish the **root** package, distinguished by
+ * whether they rewrite the manifest while packing it.
+ *
+ * `yarn` means yarn berry (>= 2); Yarn Classic (1.x) packs the raw manifest
+ * like npm does and is spelled `yarn-classic`.
+ */
+export const RootPublishers = ['npm', 'pnpm', 'yarn', 'yarn-classic'] as const
+
+export type RootPublisher = ValueOfConstArray<typeof RootPublishers>
+
 export interface UserNapiConfig {
   /**
    * Name of the binary to be generated, default to `index`
@@ -37,6 +48,23 @@ export interface UserNapiConfig {
    */
   npmClient?: string
 
+  /**
+   * The package manager that publishes the **root** package.
+   *
+   * `napi pre-publish` publishes only the generated per-platform packages; the
+   * root package is packed and published by the caller, so this cannot be
+   * inferred reliably. pnpm and yarn berry replace `exports` with
+   * `publishConfig.exports` while packing, so under those publishers
+   * `napi pre-publish` validates only the publish-effective export map and the
+   * local `exports` may point at development-only sources. npm and Yarn
+   * Classic ship `exports` untouched.
+   *
+   * Unset — the default — validates both maps, which is correct for every
+   * publisher but rejects development-only conditions such as
+   * `"dev": "./src/index.ts"`.
+   */
+  rootPublisher?: RootPublisher
+
   /**
    * Whether generate const enum for typescript bindings
    */
@@ -182,7 +210,12 @@ export type NapiConfig = Required<
 > &
   Pick<
     UserNapiConfig,
-    'wasm' | 'dtsHeader' | 'dtsHeaderFile' | 'constEnum' | 'runtimeStringEnum'
+    | 'wasm'
+    | 'dtsHeader'
+    | 'dtsHeaderFile'
+    | 'constEnum'
+    | 'runtimeStringEnum'
+    | 'rootPublisher'
   > & {
     targets: Target[]
     packageJson: CommonPackageJsonFields