@theholocron/cli 5.0.0-alpha.5 → 5.0.0-alpha.7

package/dist/cli.mjs

@@ -3324,6 +3324,170 @@ async function runPublish(input = {}) {
 		packageNames
 	};
 }
+/**
+* `holocron publish` (no `--initial`) — the steady-state publish
+* `exec.publishCmd` in `release.config.ts` should call, replacing each
+* repo's hand-typed `pnpm -r --filter=./packages/* publish ...` shell (which
+* differs, today, only in monorepo-vs-single-package, provenance on/off, and
+* whether a repo needs to skip already-published packages) with one uniform
+* invocation. Part of the config-resolution workstream, #676 — see
+* `.notes/tech-config-resolution.spec.md`.
+*
+* Deliberately does not do the `--initial` bootstrap dance (npm
+* login-if-needed, Trusted Publisher next-steps printout) — a steady-state
+* publish runs in CI, authenticated via OIDC automatically, no interactive
+* step involved. Reuses `hasPackagesDir()`'s monorepo-vs-single-package
+* detection rather than duplicating it.
+*/
+async function runSteadyPublish(input = {}) {
+	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
+	const cwd = input.cwd ?? process.cwd();
+	const tag = input.tag ?? "latest";
+	const dryRun = input.dryRun ?? false;
+	const otp = input.otp;
+	const exec = input.exec ?? defaultExec$1;
+	const provenance = input.provenance ?? true;
+	const skipAlreadyPublished = input.skipAlreadyPublished ?? false;
+	const entries = input.packages ?? discoverPublicPackageEntries(cwd);
+	const packageNames = entries.map((e) => e.name);
+	print(`Holocron publish${dryRun ? " (dry-run)" : ""}`);
+	print(`  cwd: ${cwd}`);
+	print(`  tag: ${tag}`);
+	print(`  provenance: ${provenance}`);
+	if (skipAlreadyPublished) print("  skip-already-published: true");
+	logger.info({
+		tag,
+		provenance,
+		skipAlreadyPublished,
+		dryRun: dryRun || void 0
+	}, "publish: start");
+	if (otp) print(`  otp: <${otp.length} chars>`);
+	print("");
+	if (entries.length === 0) {
+		const message = "nothing to publish (no packages/* and root package.json is private or unnamed)";
+		print(`  ✗ ${message}`);
+		logger.warn({ reason: message }, "publish: done");
+		return {
+			status: "fail",
+			message,
+			packageNames
+		};
+	}
+	const baseFlags = [
+		"--access",
+		"public",
+		"--no-git-checks",
+		"--tag",
+		tag,
+		...provenance ? ["--provenance"] : []
+	];
+	const otpFlags = otp ? ["--otp", otp] : [];
+	if (dryRun) {
+		print("");
+		if (skipAlreadyPublished) for (const entry of entries) print(`  … would check ${entry.name}@${entry.version}, publish if not already on npm`);
+		else {
+			const args = [
+				...hasPackagesDir(cwd) ? ["-r", "--filter=./packages/*"] : [],
+				"publish",
+				...baseFlags,
+				...otpFlags
+			];
+			print(`  … (dry-run) skipping actual publish`);
+			print(`    would run: pnpm ${args.join(" ")}`);
+		}
+		logger.info({
+			tag,
+			status: "dry-run",
+			packages: entries.length
+		}, "publish: done");
+		return {
+			status: "dry-run",
+			message: "dry-run — no publish executed",
+			packageNames
+		};
+	}
+	if (skipAlreadyPublished) {
+		print("  → publishing packages not already on npm…");
+		for (const entry of entries) {
+			const view = await exec("npm", [
+				"view",
+				`${entry.name}@${entry.version}`,
+				"version"
+			], { cwd });
+			if (view.exitCode === 0 && view.stdout.trim()) {
+				print(`    skip ${entry.name}@${entry.version} (already published)`);
+				continue;
+			}
+			const publish = await exec("pnpm", [
+				"--filter",
+				entry.dir,
+				"publish",
+				...baseFlags,
+				...otpFlags
+			], { cwd });
+			if (publish.exitCode !== 0) {
+				const message = `publish failed for ${entry.name}@${entry.version} (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
+				print(`  ✗ ${message}`);
+				logger.warn({
+					tag,
+					package: entry.name,
+					reason: message
+				}, "publish: done");
+				return {
+					status: "fail",
+					message,
+					packageNames
+				};
+			}
+			print(`    ✓ ${entry.name}@${entry.version}`);
+		}
+		logger.info({
+			tag,
+			status: "ok",
+			packages: entries.length
+		}, "publish: done");
+		return {
+			status: "ok",
+			packageNames
+		};
+	}
+	print("  → publishing all public @theholocron/* packages…");
+	const publish = await exec("pnpm", [
+		...hasPackagesDir(cwd) ? ["-r", "--filter=./packages/*"] : [],
+		"publish",
+		...baseFlags,
+		...otpFlags
+	], { cwd });
+	if (publish.exitCode !== 0) {
+		const message = `publish failed (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
+		print(`  ✗ ${message}`);
+		if (publish.stdout.includes("EOTP") || publish.stderr.includes("EOTP")) {
+			print("");
+			print("  → hint: your npm account requires 2FA for writes. Re-run with `--otp <code>`:");
+			print(`    pnpm exec holocron publish --otp <6-digit-code>`);
+		}
+		logger.warn({
+			tag,
+			reason: message
+		}, "publish: done");
+		return {
+			status: "fail",
+			message,
+			packageNames
+		};
+	}
+	print("    ✓ publish complete");
+	logger.info({
+		tag,
+		status: "ok",
+		packages: entries.length
+	}, "publish: done");
+	return {
+		status: "ok",
+		packageNames
+	};
+}
 function hasPackagesDir(cwd) {
 	return existsSync(join(cwd, "packages"));
 }
@@ -3337,6 +3501,37 @@ function publicPackageName(pkgPath) {
 		return;
 	}
 }
+/** Read a `package.json`'s `name` + `version`, when it's public (`!private && name`). */
+function publicPackageEntry(pkgPath, dir) {
+	if (!existsSync(pkgPath)) return void 0;
+	try {
+		const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+		return !pkg.private && pkg.name && pkg.version ? {
+			name: pkg.name,
+			version: pkg.version,
+			dir
+		} : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Same repo-layout detection as {@link discoverPublicPackages}, but carrying
+* version + a `pnpm --filter`-ready path — {@link runSteadyPublish}'s
+* `skipAlreadyPublished` mode needs both to check `npm view <pkg>@<version>`
+* and publish one workspace at a time.
+*/
+function discoverPublicPackageEntries(cwd) {
+	if (!hasPackagesDir(cwd)) {
+		const entry = publicPackageEntry(join(cwd, "package.json"), ".");
+		return entry ? [entry] : [];
+	}
+	const packagesDir = join(cwd, "packages");
+	return readdirSync(packagesDir, { withFileTypes: true }).filter((e) => e.isDirectory()).flatMap((e) => {
+		const entry = publicPackageEntry(join(packagesDir, e.name, "package.json"), `./packages/${e.name}`);
+		return entry ? [entry] : [];
+	});
+}
 /**
 * Monorepo (`packages/` present): every public `packages/*` workspace.
 * Single package (no `packages/`): the root `package.json`, if it's public —
@@ -7976,11 +8171,10 @@ try {
 	}).command("publish", "Publish @theholocron/* packages to npm", (y) => y.option("initial", {
 		type: "boolean",
 		default: false,
-		describe: "One-shot bootstrap publish for trusted-publishing-eligible packages (npm needs the package to exist before Trusted Publishing can be configured for it). Required today — a non-initial `publish` isn't implemented yet."
+		describe: "One-shot bootstrap publish for trusted-publishing-eligible packages (npm needs the package to exist before Trusted Publishing can be configured for it). Skips the steady-state OIDC path below — use only for a package's very first publish."
 	}).option("tag", {
 		type: "string",
-		default: "alpha",
-		describe: "npm distribution tag (defaults to alpha)"
+		describe: "npm distribution tag. Defaults to alpha for --initial, latest for a steady-state publish."
 	}).option("otp", {
 		type: "string",
 		describe: "One-time password from your authenticator (required if npm needs 2FA for writes)"
@@ -7990,6 +8184,14 @@ try {
 	}).option("repo", {
 		type: "string",
 		describe: "owner/repo for Trusted Publisher config (--sync-trust). Defaults to theholocron/holocron."
+	}).option("provenance", {
+		type: "boolean",
+		default: true,
+		describe: "Publish with --provenance (steady-state only). Default on — free under CI/OIDC."
+	}).option("skip-already-published", {
+		type: "boolean",
+		default: false,
+		describe: "Steady-state only: check `npm view <pkg>@<version>` before publishing each package and skip it if that exact version already exists, instead of one bulk publish. For repos that ship many independently-versioned packages where a release doesn't bump every one."
 	}), async (argv) => {
 		if (argv.syncTrust) {
 			const [oldFile, newFile] = argv.syncTrust;
@@ -8007,15 +8209,21 @@ try {
 			})).status === "fail") process.exitCode = 1;
 			return;
 		}
-		if (!argv.initial) {
-			getLogger().error("publish: only `--initial` and `--sync-trust` are supported today. Run `holocron publish --initial`.");
-			process.exitCode = 1;
+		if (argv.initial) {
+			if ((await runPublish({
+				cwd: argv.cwd,
+				dryRun: argv.dryRun,
+				...argv.tag ? { tag: argv.tag } : {},
+				...argv.otp ? { otp: argv.otp } : {}
+			})).status === "fail") process.exitCode = 1;
 			return;
 		}
-		if ((await runPublish({
+		if ((await runSteadyPublish({
 			cwd: argv.cwd,
-			tag: argv.tag,
 			dryRun: argv.dryRun,
+			provenance: argv.provenance,
+			skipAlreadyPublished: argv.skipAlreadyPublished,
+			...argv.tag ? { tag: argv.tag } : {},
 			...argv.otp ? { otp: argv.otp } : {}
 		})).status === "fail") process.exitCode = 1;
 	}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, teams, topics, keywords, description, homepage, readme, workflows, scripts, wiki)", (y) => y.positional("steps", {