@youdie006/prodex 0.40.17 → 0.40.18

package/prodex.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { runCli } from "./dist/cli.js";
+
+runCli(process.argv.slice(2))
+  .then((code) => {
+    if (code !== 0) process.exitCode = code;
+  })
+  .catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  });

package/scripts/npm-command.mjs

@@ -0,0 +1,71 @@
+import { execFile } from "node:child_process";
+import { realpathSync, statSync } from "node:fs";
+import path from "node:path";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+export function resolveNpmCliPath(options = {}) {
+  const env = normalizeNpmEnvironment(options.env ?? process.env);
+  const execPath = options.execPath ?? process.execPath;
+  const cwd = options.cwd ?? process.cwd();
+  const candidates = [];
+  const npmExecPath = envValue(env, "npm_execpath");
+  if (npmExecPath && !isCompetingPackageManagerCli(npmExecPath)) candidates.push(path.resolve(cwd, npmExecPath));
+
+  const pathValue = envValue(env, "PATH");
+  for (const entry of pathValue?.split(path.delimiter) ?? []) {
+    if (!entry) continue;
+    for (const commandName of process.platform === "win32" ? ["npm.cmd", "npm.exe", "npm"] : ["npm"]) {
+      const commandPath = path.join(entry, commandName);
+      const resolvedCommand = existingJavaScriptFile(commandPath);
+      if (resolvedCommand) candidates.push(resolvedCommand);
+    }
+    candidates.push(path.join(entry, "node_modules", "npm", "bin", "npm-cli.js"));
+    candidates.push(path.resolve(entry, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"));
+  }
+
+  const nodeDir = path.dirname(execPath);
+  candidates.push(path.join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"));
+  candidates.push(path.resolve(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"));
+
+  for (const candidate of candidates) {
+    const resolved = existingJavaScriptFile(candidate);
+    if (resolved) return resolved;
+  }
+  throw new Error(`Could not locate npm's JavaScript CLI for ${execPath}`);
+}
+
+export function execNpm(args, options = {}) {
+  const env = normalizeNpmEnvironment(options.env ?? process.env);
+  const npmCliPath = resolveNpmCliPath({ cwd: options.cwd, env, execPath: process.execPath });
+  return execFileAsync(process.execPath, [npmCliPath, ...args], { ...options, env, encoding: "utf8" });
+}
+
+export function normalizeNpmEnvironment(env, platform = process.platform) {
+  if (platform !== "win32") return env;
+  // Node otherwise sorts duplicate Windows names and can keep the inherited
+  // spelling instead of an explicit override appended by the caller.
+  const entries = new Map();
+  for (const [name, value] of Object.entries(env)) entries.set(name.toLowerCase(), [name, value]);
+  return Object.fromEntries(entries.values());
+}
+
+function envValue(env, name) {
+  if (typeof env[name] === "string") return env[name];
+  const entry = Object.entries(env).find(([key, value]) => key.toLowerCase() === name.toLowerCase() && typeof value === "string");
+  return entry?.[1];
+}
+
+function isCompetingPackageManagerCli(candidate) {
+  return /^(?:pnpm|pnpx|yarn|yarnpkg)(?:\.(?:cjs|mjs|js))?$/i.test(path.basename(candidate));
+}
+
+function existingJavaScriptFile(candidate) {
+  try {
+    const resolved = realpathSync(candidate);
+    return /\.(?:cjs|mjs|js)$/i.test(resolved) && statSync(resolved).isFile() ? resolved : undefined;
+  } catch {
+    return undefined;
+  }
+}

package/scripts/release-check.mjs

@@ -4,6 +4,7 @@ import { lstat, readFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
+import { execNpm } from "./npm-command.mjs";
 
 const execFileAsync = promisify(execFile);
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -159,7 +160,7 @@ async function runFullReleaseVerification(rootDir) {
   ];
   for (const [command, commandArgs] of checks) {
     const key = [command, ...commandArgs].join(" ");
-    await run(commandForPlatform(command), commandArgs, rootDir, CHECK_TIMEOUT_MS[key] ?? CHECK_TIMEOUT_MS.default);
+    await run(command, commandArgs, rootDir, CHECK_TIMEOUT_MS[key] ?? CHECK_TIMEOUT_MS.default);
   }
 }
 
@@ -205,7 +206,7 @@ async function assertPackedFileModes(rootDir, packageJson) {
 async function readPackedFiles(rootDir) {
   let stdout;
   try {
-    ({ stdout } = await execFileAsync(commandForPlatform("npm"), ["pack", "--json", "--dry-run", "--ignore-scripts"], {
+    ({ stdout } = await execNpm(["pack", "--json", "--dry-run", "--ignore-scripts"], {
       cwd: rootDir,
       timeout: 120_000,
       maxBuffer: 20 * 1024 * 1024
@@ -282,6 +283,9 @@ function findNonExecutableBinPackedFiles(files, packageJson) {
 }
 
 async function findNonExecutableBinSourceFiles(rootDir, packageJson) {
+  // Windows ACLs do not map to POSIX execute bits. npm still reports package
+  // bin entries with canonical executable modes in the packed file metadata.
+  if (process.platform === "win32") return [];
   const invalid = [];
   for (const packagePath of packageBinPaths(packageJson)) {
     const filePath = path.join(rootDir, packagePath);
@@ -349,11 +353,18 @@ async function run(command, commandArgs, cwd, timeoutMs = 300_000) {
   const commandLine = [command, ...commandArgs].join(" ");
   console.log(`release_check: ${commandLine}`);
   try {
-    await execFileAsync(command, commandArgs, {
-      cwd,
-      timeout: timeoutMs,
-      maxBuffer: 20 * 1024 * 1024
-    });
+    const execute = command === "npm"
+      ? execNpm(commandArgs, {
+          cwd,
+          timeout: timeoutMs,
+          maxBuffer: 20 * 1024 * 1024
+        })
+      : execFileAsync(command === "node" ? process.execPath : command, commandArgs, {
+          cwd,
+          timeout: timeoutMs,
+          maxBuffer: 20 * 1024 * 1024
+        });
+    await execute;
   } catch (error) {
     // Surface the real failure: the one-line detail used to show the FIRST
     // stderr line, which npm noise ("npm warn ...") could occupy while the
@@ -376,10 +387,6 @@ function printCapturedOutputTail(error, commandLine) {
   }
 }
 
-function commandForPlatform(command) {
-  return process.platform === "win32" && command === "npm" ? "npm.cmd" : command;
-}
-
 function parseArgs(values) {
   const parsed = {
     root: undefined,

package/scripts/release-pack.mjs

@@ -5,10 +5,10 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
+import { execNpm } from "./npm-command.mjs";
 
 const execFileAsync = promisify(execFile);
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
 
 try {
   const args = parseArgs(process.argv.slice(2));
@@ -71,7 +71,7 @@ async function ensureDistBuiltForSource(root) {
   const tsconfigPath = path.join(root, "tsconfig.json");
   const srcDir = path.join(root, "src");
   if (!(await pathExists(tsconfigPath)) || !(await pathExists(srcDir))) return false;
-  await execFileAsync(npmCommand, ["run", "build"], { cwd: root, maxBuffer: 20 * 1024 * 1024 });
+  await execNpm(["run", "build"], { cwd: root, maxBuffer: 20 * 1024 * 1024 });
   return true;
 }
 
@@ -211,7 +211,11 @@ async function run(command, commandArgs, cwd) {
 
 async function runNpmPack(commandArgs, cwd, label) {
   try {
-    return await run(npmCommand, commandArgs, cwd);
+    return await execNpm(commandArgs, {
+      cwd,
+      timeout: 120_000,
+      maxBuffer: 20 * 1024 * 1024
+    });
   } catch (error) {
     throw new Error(`${label} failed: ${commandFailureDetail(error)}`);
   }
@@ -340,7 +344,12 @@ function errorMessage(error) {
 }
 
 function shellQuote(value) {
-  return /^[A-Za-z0-9_./:@=-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+  const shellSafe = /^[A-Za-z0-9_./:@=-]+$/.test(value);
+  if (shellSafe && (process.platform !== "win32" || !value.startsWith("@"))) return value;
+  const escaped = process.platform === "win32"
+    ? value.replaceAll("'", "''")
+    : value.replaceAll("'", "'\\''");
+  return `'${escaped}'`;
 }
 
 async function readReleaseGitStatus(root) {