rman 1.0.9 → 1.0.12

package/rmanrc.schema.json

@@ -2,8 +2,15 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://raw.githubusercontent.com/panates/rman/main/schemas/rmanrc.schema.json",
   "title": "rman configuration",
-  "description": "Schema for rman's .rmanrc (JSON) and .rmanrc.yml (YAML) config files, and the \"rman\" key in package.json. See docs/api.md#configuration-rmanrc-rmanrcyml for the full reference.",
+  "description": "Schema for rman's .rmanrc (JSON) and .rmanrc.yml (YAML) config files, and the \"rman\" key in package.json. See docs/api.md#configuration-rmanrc-rmanrcyml for the full reference. Any string value may embed ${{ ... }} expressions - real JavaScript, evaluated per package against pkg, repository, env and semver - so one declaration at the root can still say something package-specific (\"../../coverage/${{ pkg.basename }}\", \"panates/${{ pkg.basename }}:${{ semver.major(pkg.version) }}\"). A string that is nothing but one expression keeps that value's own type. A bare {{ ... }} is left alone, so a command carrying someone else's template survives untouched.",
   "type": "object",
+  "additionalProperties": false,
+  "patternProperties": {
+    "^\\[.+\\]$": {
+      "$ref": "#",
+      "description": "Config for the packages this selector names, rather than for the package of the directory declaring it - \"[*]\" for every package in the repository, \"[*-dialect]\" for a glob over package names, \"[pkg-a]\" for one. In YAML the quotes are REQUIRED: a bare [*] parses as a flow sequence and * as an alias indicator. Precedence, lowest first: \"[*]\", then other selectors in declaration order, then the package's own unmarked config."
+    }
+  },
   "properties": {
     "$schema": {
       "type": "string",
@@ -66,15 +73,24 @@
           "default": "release-*",
           "description": "Root-level. Tag naming the repository's own release, as opposed to the per-package/group tags \"changelog.tagPattern\" names - only created when the root is on a calendar version (a repo with more than one version line). Must NOT match any package's \"changelog.tagPattern\", or that package's changelog boundary resolves to the repository release instead of its own."
         },
-        "script": {
+        "stampDockerfile": {
+          "type": "boolean",
+          "default": true,
+          "description": "Per-package cascaded. Keep this package's Dockerfile \"org.opencontainers.image.version\" label in step with the version being written, in the same commit as the bump. The label's value is by specification the version of the packaged software, so there is only one correct value for it. Only ever rewrites a label the Dockerfile already declares (never inserts one), and reads the same path \"publish --target docker\" builds from (\"publish.docker.dockerfile\")."
+        },
+        "stamp": {
           "$ref": "#/definitions/stringOrStringArray",
-          "description": "Command(s) to run as this package's own \"version\" npm-lifecycle step, when its package.json does not define one itself."
+          "description": "Source files whose \"version\" constant is rewritten to the version being written, in the same commit as the bump - paths relative to the package's own directory (e.g. [\"src/constants.ts\"]). Per-package cascaded; a listed file a package doesn't have is a silent no-op. Stamps the source rather than the build output, so anything running from source reports the real version and git records it."
         },
-        "preScript": {
+        "before": {
           "$ref": "#/definitions/stringOrStringArray",
           "description": "Command(s) to run as this package's own \"preversion\" step, when its package.json does not define one itself."
         },
-        "postScript": {
+        "exec": {
+          "$ref": "#/definitions/stringOrStringArray",
+          "description": "Command(s) to run as this package's own \"version\" npm-lifecycle step, when its package.json does not define one itself."
+        },
+        "after": {
           "$ref": "#/definitions/stringOrStringArray",
           "description": "Command(s) to run as this package's own \"postversion\" step, when its package.json does not define one itself."
         }
@@ -131,11 +147,11 @@
     },
     "publish": {
       "type": "object",
-      "description": "Options for the \"publish\" command/PublishService, DockerPublishService and GithubReleaseService. Per-package cascaded.",
+      "description": "Options for the \"publish\" command/PublishService and DockerPublishService. Per-package cascaded.",
       "additionalProperties": false,
       "properties": {
         "target": {
-          "description": "Where \"publish\" releases this package to. Default [\"npm\"]. A package that only ships Docker images (typically also \"private\": true) sets [\"docker\"]; a standalone app shipped as GitHub Release assets - or deployed elsewhere, with the release only recording that it shipped - sets [\"github\"]; any combination works. Each target answers \"is this version already out there?\" against its own registry: npm via \"npm view\", docker via \"docker manifest inspect\", github via the release for that version's tag.",
+          "description": "Which registry \"publish\" ships this package to. Default [\"npm\"]. A package that only ships Docker images (typically also \"private\": true) sets [\"docker\"]; both works too. Each target answers \"is this version already out there?\" against its own registry: npm via \"npm view\", docker via \"docker manifest inspect\". This is strictly about package distribution - the repository's GitHub Release is not a target here, see \"githubRelease\" and the \"github-release\" command.",
           "default": [
             "npm"
           ],
@@ -151,14 +167,14 @@
             }
           ]
         },
+        "directory": {
+          "type": "string",
+          "description": "Where this package's publishable output lives, relative to its own directory (e.g. \"build\"). Per-package cascaded, so a root \"[*]\" block can say it once instead of repeating publishConfig.directory in every package.json - which still wins when a package declares it. Publishing from such a directory means the manifest there is GENERATED by publish, from the package's own, with devDependencies, non-install scripts, \"private\" and publishConfig.directory removed and \"workspace:\" ranges resolved. There is nothing to configure about it."
+        },
         "docker": {
           "$ref": "#/definitions/dockerPublishConfig",
           "description": "Required once \"docker\" is one of this package's \"publish.target\"s."
         },
-        "github": {
-          "$ref": "#/definitions/githubPublishConfig",
-          "description": "Optional even when \"github\" is one of this package's \"publish.target\"s - every required fact already has a sensible default source."
-        },
         "skip": {
           "type": "boolean",
           "default": false,
@@ -166,39 +182,40 @@
         }
       }
     },
+    "githubRelease": {
+      "$ref": "#/definitions/githubReleaseConfig",
+      "description": "Details of the repository's GitHub Release (\"github-release\"/GithubReleaseService). Entirely optional - every required fact already has a sensible default source. Nothing here decides whether a release is cut: a release records that the repository shipped, so it is always cut. \"assets\" is per-package cascaded; the rest is root-level only."
+    },
     "run": {
       "type": "object",
-      "description": "Per-script options for \"run\"/\"build\"/\"test\"/RunService, keyed by npm script name (e.g. \"build\", \"lint\", \"test\").",
+      "description": "Per-script options for \"run\"/\"build\"/\"test\"/RunService, keyed by npm script name (e.g. \"build\", \"lint\", \"test\"). A bare string (or array of them) is shorthand for { \"exec\": ... } - \"test\": \"mocha\" and \"test\": { \"exec\": \"mocha\" } mean exactly the same thing.",
       "additionalProperties": {
-        "$ref": "#/definitions/runScriptConfig"
+        "oneOf": [
+          {
+            "$ref": "#/definitions/stringOrStringArray"
+          },
+          {
+            "$ref": "#/definitions/runScriptConfig"
+          }
+        ]
       }
     },
-    "packages": {
-      "type": "object",
-      "description": "Per-package overrides, keyed by the in-repo package's own name.",
-      "additionalProperties": {
-        "type": "object",
-        "additionalProperties": false,
-        "properties": {
-          "dependencies": {
-            "description": "Extra in-repo \"dependencies\" not present in this package's real package.json, purely for rman's own dependency graph (topo-sort, --deps/--dependents, run's task scheduling). An array defaults each entry's range to \"*\"; an object gives an explicit name -> range map.",
-            "oneOf": [
-              {
-                "type": "array",
-                "items": {
-                  "type": "string"
-                }
-              },
-              {
-                "type": "object",
-                "additionalProperties": {
-                  "type": "string"
-                }
-              }
-            ]
+    "dependencies": {
+      "description": "In-repo packages this one depends on beyond what its real package.json declares, purely for rman's own dependency graph (topo-sort, --deps/--dependents, run's task scheduling). An array defaults each entry's range to \"*\"; an object gives an explicit name -> range map. Declare it from the root through a selector (\"[pkg-a]\": { \"dependencies\": [...] }) or in the package's own .rmanrc.",
+      "oneOf": [
+        {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
           }
         }
-      }
+      ]
     }
   },
   "definitions": {
@@ -230,8 +247,7 @@
       "type": "string",
       "enum": [
         "npm",
-        "docker",
-        "github"
+        "docker"
       ]
     },
     "dockerPublishConfig": {
@@ -286,7 +302,7 @@
         }
       }
     },
-    "githubPublishConfig": {
+    "githubReleaseConfig": {
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -295,7 +311,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Files to attach to the release, as glob patterns relative to the package's own directory (e.g. [\"dist/*.tar.gz\"]). A release with no assets is still valid."
+          "description": "Files to attach to the release, as glob patterns relative to the package's own directory (e.g. [\"dist/*.tar.gz\"]). Read from every package, since one release covers the whole source tree. A release with no assets is still valid."
         },
         "repository": {
           "type": "string",
@@ -353,22 +369,22 @@
           "type": "string",
           "description": "Conditional-execution expression: atoms \"changed\"/\"dirty\"/\"committed\" (optionally \"= <hash>\" or \"= {ENV_VAR}\"), combined with and/or/not/(...). E.g. \"changed\", \"(changed or dirty) and not committed\"."
         },
-        "script": {
+        "before": {
           "$ref": "#/definitions/stringOrStringArray",
-          "description": "Command(s) to run as this package's own script, when its package.json does not define one for this script name."
+          "description": "Command(s) to run as this package's own \"pre<script>\" hook, when its package.json does not define one."
         },
-        "preScript": {
+        "exec": {
           "$ref": "#/definitions/stringOrStringArray",
-          "description": "Command(s) to run as this package's own \"pre<script>\" hook, when its package.json does not define one."
+          "description": "Command(s) to run as this package's own script, when its package.json does not define one for this script name."
         },
-        "postScript": {
+        "after": {
           "$ref": "#/definitions/stringOrStringArray",
           "description": "Command(s) to run as this package's own \"post<script>\" hook, when its package.json does not define one."
         },
         "override": {
           "type": "boolean",
           "default": false,
-          "description": "When true, \"script\"/\"preScript\"/\"postScript\" above replace the package's own package.json definition even when it already has one."
+          "description": "When true, \"before\"/\"exec\"/\"after\" above replace the package's own package.json definition even when it already has one."
         }
       }
     }

package/services/github-release.service.d.ts

@@ -11,7 +11,7 @@ export declare namespace GithubReleaseService {
         /** Uncommitted local changes anywhere in the repository make the release `'skip'` instead of
          *  `'error'` - same as `version`/`publish`'s other targets. */
         ignoreDirty?: boolean;
-        /** `owner/repo` override - otherwise the root's own `publish.github.repository`, falling back
+        /** `owner/repo` override - otherwise the root's own `githubRelease.repository`, falling back
          *  to the `origin` remote's URL. */
         repository?: string;
     }
@@ -31,13 +31,14 @@ export declare namespace GithubReleaseService {
         reason?: string;
     }
     /**
-     * Computes what `publish --target github` *would* do - **one** release per run, or none.
+     * Computes what `github-release` *would* do - **one** release per run.
      *
      * A GitHub Release is a property of the repository, not of a package: the tag covers the whole
-     * source tree, so everything that shipped under it belongs in it. That makes the `"github"`
-     * target a repository-level opt-in (typically in the root `.rmanrc`, alongside `"npm"`); it's
-     * honored as soon as *any* package resolves it, since a per-package release would have to invent
-     * a tag no package owns.
+     * source tree, so everything that shipped under it belongs in it. There is deliberately **no
+     * opt-in**: it isn't a place a package ships to (that's `publish.target`, which is about
+     * registries - npm, Docker Hub, GitHub Packages), it's the repository's own record that a
+     * release happened, and a repository always wants that record. Re-running is harmless - an
+     * existing release for the tag reads `'up-to-date'`.
      *
      * The release is identified by the repository's own version (the root's - see
      * `VersionService`'s `buildRootEntry`): its release tag when that version is a calendar one, and
@@ -52,9 +53,9 @@ export declare namespace GithubReleaseService {
      */
     function getPlan(repository: Repository, options?: Options, deps?: Deps): Promise<Entry[]>;
     /**
-     * Creates the repository's GitHub Release, then uploads whatever `publish.github.assets` globs
-     * match. The body covers **every** package that shipped under this release - not just the ones
-     * naming `"github"` as a target - since the tag covers all of their code either way.
+     * Creates the repository's GitHub Release, then uploads whatever `githubRelease.assets` globs
+     * match, across every package. The body covers **every** package that shipped under this
+     * release, since the tag covers all of their code either way.
      *
      * Each package's notes are bounded by the *previous repository release*, and headed with that
      * package's own version, so a repo whose packages sit on different version lines still reads

package/services/github-release.service.js

@@ -9,13 +9,14 @@ import { ChangelogService } from './changelog.service.js';
 export var GithubReleaseService;
 (function (GithubReleaseService) {
     /**
-     * Computes what `publish --target github` *would* do - **one** release per run, or none.
+     * Computes what `github-release` *would* do - **one** release per run.
      *
      * A GitHub Release is a property of the repository, not of a package: the tag covers the whole
-     * source tree, so everything that shipped under it belongs in it. That makes the `"github"`
-     * target a repository-level opt-in (typically in the root `.rmanrc`, alongside `"npm"`); it's
-     * honored as soon as *any* package resolves it, since a per-package release would have to invent
-     * a tag no package owns.
+     * source tree, so everything that shipped under it belongs in it. There is deliberately **no
+     * opt-in**: it isn't a place a package ships to (that's `publish.target`, which is about
+     * registries - npm, Docker Hub, GitHub Packages), it's the repository's own record that a
+     * release happened, and a repository always wants that record. Re-running is harmless - an
+     * existing release for the tag reads `'up-to-date'`.
      *
      * The release is identified by the repository's own version (the root's - see
      * `VersionService`'s `buildRootEntry`): its release tag when that version is a calendar one, and
@@ -30,18 +31,15 @@ export var GithubReleaseService;
      */
     async function getPlan(repository, options = {}, deps = {}) {
         const root = repository.rootPackage;
-        const wanted = [root, ...repository.getPackages()].some(pkg => targetsGithub(pkg) && !pkg.config.publish?.skip);
-        if (!wanted)
-            return [];
         const git = new GitHelper({ cwd: repository.dirname });
         const base = { package: root, version: root.version };
-        const repo = options.repository ?? root.config?.publish?.github?.repository ?? repoFromRemoteUrl(await git.remoteUrl());
+        const repo = options.repository ?? root.config?.githubRelease?.repository ?? repoFromRemoteUrl(await git.remoteUrl());
         if (!repo) {
             return [
                 {
                     ...base,
                     status: 'error',
-                    reason: 'cannot resolve "owner/repo" - set "publish.github.repository" or an "origin" remote',
+                    reason: 'cannot resolve "owner/repo" - set "githubRelease.repository" or an "origin" remote',
                 },
             ];
         }
@@ -91,9 +89,9 @@ export var GithubReleaseService;
     }
     GithubReleaseService.getPlan = getPlan;
     /**
-     * Creates the repository's GitHub Release, then uploads whatever `publish.github.assets` globs
-     * match. The body covers **every** package that shipped under this release - not just the ones
-     * naming `"github"` as a target - since the tag covers all of their code either way.
+     * Creates the repository's GitHub Release, then uploads whatever `githubRelease.assets` globs
+     * match, across every package. The body covers **every** package that shipped under this
+     * release, since the tag covers all of their code either way.
      *
      * Each package's notes are bounded by the *previous repository release*, and headed with that
      * package's own version, so a repo whose packages sit on different version lines still reads
@@ -113,7 +111,7 @@ export var GithubReleaseService;
             const release = await createOrUpdateRelease(entry.repository, entry.tag, {
                 name: entry.tag,
                 body,
-                draft: !!repository.rootPackage.config?.publish?.github?.draft,
+                draft: !!repository.rootPackage.config?.githubRelease?.draft,
                 prerelease: resolvePrerelease(repository.rootPackage, entry.version),
             });
             await uploadAssets(repository, entry.repository, release.id);
@@ -127,11 +125,6 @@ export var GithubReleaseService;
 })(GithubReleaseService || (GithubReleaseService = {}));
 const GITHUB_API = 'https://api.github.com';
 const GITHUB_UPLOADS = 'https://uploads.github.com';
-function targetsGithub(pkg) {
-    const target = pkg.config.publish?.target;
-    const targets = Array.isArray(target) ? target : target ? [target] : ['npm'];
-    return targets.includes('github');
-}
 /** The tag naming this repository's release. A calendar root version means several version lines,
  *  so the release needs a name of its own (`release-*`); a plain one means every package shares it,
  *  and that shared version's tag already *is* the release. */
@@ -144,7 +137,7 @@ function releaseTagGlob(root) {
     return pattern.replace('{name}', root.name);
 }
 function resolvePrerelease(root, version) {
-    const configured = root.config?.publish?.github?.prerelease;
+    const configured = root.config?.githubRelease?.prerelease;
     // A calendar version's time part is a semver prerelease identifier by construction - it says
     // nothing about the release being a preview, so it must not be read as one.
     return configured ?? (!isCalendarVersion(version) && !!semver.prerelease(version));
@@ -242,12 +235,12 @@ async function createOrUpdateRelease(repository, tag, fields) {
     }
     return release;
 }
-/** Every `publish.github.assets` glob across the repository, each resolved against its own
+/** Every `githubRelease.assets` glob across the repository, each resolved against its own
  *  package's directory - an app ships its artifacts from its own folder, but they all land on the
  *  one release the repository cut. */
 async function uploadAssets(repository, repo, releaseId) {
     for (const pkg of [repository.rootPackage, ...repository.getPackages()]) {
-        const patterns = pkg.config.publish?.github?.assets;
+        const patterns = pkg.config.githubRelease?.assets;
         if (!patterns?.length)
             continue;
         const files = await fastGlob(patterns, { cwd: pkg.dirname, absolute: true, onlyFiles: true });

package/services/publish.service.js

@@ -1,3 +1,19 @@
+/**
+ * Prepares the `package.json` that `npm publish` will actually read, and returns a function that
+ * undoes it - always call that from a `finally`, so a failed publish leaves nothing behind.
+ *
+ * Which file that is depends on where the output lives:
+ *
+ * - **Publishing the package directory itself** - its own `package.json` is the manifest, rewritten
+ *   in place: every `"workspace:"` range becomes a real, registry-consumable one (the same
+ *   substitution pnpm/yarn's own publish performs - see `resolveWorkspaceRange`), since `npm
+ *   publish` reads what is on disk rather than packing from a staging tarball.
+ * - **Publishing a build directory** - there is no manifest there until something writes one, and
+ *   that something is this: see `derivePublishManifest`.
+ *
+ * Returns `undefined` when there is nothing to do at all (the package directory, with no
+ * `"workspace:"` range in it) - no disk write, nothing to restore.
+ */
 import { execFile } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -8,6 +24,94 @@ import { filterPackages } from '../utils/package-filter.js';
 import { parseWorkspaceRange, resolveWorkspaceRange } from '../utils/workspace-range.js';
 import { CiService } from './ci.service.js';
 import { DEPENDENCY_KEYS } from './version.service.js';
+function preparePublishManifest(pkg, publishDir, packagesByName) {
+    if (path.resolve(publishDir) !== path.resolve(pkg.dirname)) {
+        const file = path.join(publishDir, 'package.json');
+        const previous = fs.existsSync(file) ? fs.readFileSync(file, 'utf-8') : undefined;
+        fs.mkdirSync(publishDir, { recursive: true });
+        fs.writeFileSync(file, JSON.stringify(derivePublishManifest(pkg, packagesByName), undefined, 2) + '\n', 'utf-8');
+        return () => {
+            if (previous === undefined)
+                fs.rmSync(file, { force: true });
+            else
+                fs.writeFileSync(file, previous, 'utf-8');
+        };
+    }
+    const hasWorkspaceRange = DEPENDENCY_KEYS.some(depKey => {
+        const deps = pkg.json[depKey];
+        return deps && Object.values(deps).some(v => parseWorkspaceRange(v));
+    });
+    if (!hasWorkspaceRange)
+        return undefined;
+    const original = fs.readFileSync(pkg.jsonFileName, 'utf-8');
+    resolveWorkspaceRanges(pkg.json, packagesByName);
+    pkg.writeJson();
+    return () => {
+        fs.writeFileSync(pkg.jsonFileName, original, 'utf-8');
+        pkg.reloadJson();
+    };
+}
+/**
+ * The manifest to publish from a build directory, derived from the package's own - generated here
+ * rather than by a build script, and deliberately with nothing to configure.
+ *
+ * Generated at *publish* time, which is the whole point: a build script writes it when the build
+ * runs, so bumping the version afterwards (or building before a bump) publishes a manifest that
+ * disagrees with the package - and the `"workspace:"` rewrite above, which only ever touched the
+ * package's own file, never reached the copy at all.
+ *
+ * What comes out is the package's `package.json` minus what a consumer of the tarball can neither
+ * see nor use:
+ *
+ * - `devDependencies` - npm never installs a dependency's own, so they are pure noise.
+ * - `scripts`, **except** `preinstall`/`install`/`postinstall`. Those three are the only ones a
+ *   consumer's install actually runs, and dropping them would silently break every package that
+ *   builds a native module on install. The rest (`build`, `test`, `prepare`, ...) never reach the
+ *   consumer - `prepare` runs for a git dependency, which builds from the repository, not from this
+ *   tarball.
+ * - `private` - rman refuses to publish a private package in the first place, so carrying the flag
+ *   into a manifest that is being published can only be wrong.
+ * - `publishConfig.directory` - it pointed *here*; kept, it would point one level deeper again.
+ */
+function derivePublishManifest(pkg, packagesByName) {
+    const json = structuredClone(pkg.json);
+    resolveWorkspaceRanges(json, packagesByName);
+    delete json.devDependencies;
+    delete json.private;
+    if (json.scripts) {
+        const kept = Object.fromEntries(Object.entries(json.scripts).filter(([name]) => CONSUMER_SCRIPTS.has(name)));
+        if (Object.keys(kept).length)
+            json.scripts = kept;
+        else
+            delete json.scripts;
+    }
+    if (json.publishConfig) {
+        delete json.publishConfig.directory;
+        if (!Object.keys(json.publishConfig).length)
+            delete json.publishConfig;
+    }
+    return json;
+}
+/** The only lifecycle scripts a consumer's `npm install` of this package runs - see
+ *  https://docs.npmjs.com/cli/using-npm/scripts. */
+const CONSUMER_SCRIPTS = new Set(['preinstall', 'install', 'postinstall']);
+/** Rewrites `json`'s `"workspace:"` ranges in place, resolving each against the in-repo package it
+ *  names. Shared by both manifest paths, so they can never disagree about the substitution. */
+function resolveWorkspaceRanges(json, packagesByName) {
+    for (const depKey of DEPENDENCY_KEYS) {
+        const deps = json[depKey];
+        if (!deps)
+            continue;
+        for (const depName of Object.keys(deps)) {
+            const parsed = parseWorkspaceRange(deps[depName]);
+            if (!parsed)
+                continue;
+            const depPkg = packagesByName.get(depName);
+            if (depPkg)
+                deps[depName] = resolveWorkspaceRange(parsed, depPkg.version);
+        }
+    }
+}
 export var PublishService;
 (function (PublishService) {
     /**
@@ -106,12 +210,10 @@ export var PublishService;
                 result.push({ ...entry, status: 'error', reason: `dependency "${blocker}" failed to publish` });
                 continue;
             }
-            const restore = rewriteWorkspaceRangesForPublish(pkg, packagesByName);
+            const publishDir = resolvePublishDir(pkg, options.contents);
+            const restore = preparePublishManifest(pkg, publishDir, packagesByName);
             try {
-                await exec(buildPublishCommand(packageManager, options), {
-                    cwd: resolvePublishDir(pkg, options.contents),
-                    stdio: 'inherit',
-                });
+                await exec(buildPublishCommand(packageManager, options), { cwd: publishDir, stdio: 'inherit' });
                 result.push(entry);
             }
             catch (e) {
@@ -145,13 +247,14 @@ async function defaultNpmViewVersion(name, cwd, options) {
         return undefined;
     }
 }
-/** npm's own native `publishConfig.directory` (if the package declares one) always wins over
- *  `options.contents` - the package's own package.json is the more authoritative, persistent
- *  statement of "this is where the publishable output lives", `--contents` is just a fallback for
- *  when it doesn't declare one at all. */
+/** Where the publishable output lives, most specific statement first: the package's own
+ *  `publishConfig.directory` (npm/pnpm's native spelling, and a statement about that one package),
+ *  then `.rmanrc "publish.directory"` (which a `"[*]"` block can say once for a whole repository
+ *  instead of repeating in every `package.json`), then `--contents` for a single run. */
 function resolvePublishDir(pkg, contentsOverride) {
     const native = pkg.json.publishConfig?.directory;
-    const rel = (typeof native === 'string' && native) || contentsOverride;
+    const configured = pkg.config?.publish?.directory;
+    const rel = (typeof native === 'string' && native) || configured || contentsOverride;
     return rel ? path.resolve(pkg.dirname, rel) : pkg.dirname;
 }
 function buildPublishCommand(packageManager, options) {
@@ -168,40 +271,3 @@ function buildPublishCommand(packageManager, options) {
         args.push('--userconfig', options.userconfig);
     return `${packageManager} ${args.join(' ')}`;
 }
-/**
- * Rewrites every `"workspace:"` dependency range in `pkg`'s `package.json` to a real,
- * registry-publishable range (the same substitution pnpm/yarn's own publish performs - see
- * `resolveWorkspaceRange`), just before shelling out to `npm publish` - which reads whatever is
- * actually on disk, unlike pnpm/yarn's own publish this never packs into a staging tarball first.
- * Returns a function that restores the file's original bytes (and `pkg`'s in-memory state)
- * verbatim; always invoke it from a `finally`, so a failed publish never leaves a rewritten
- * `package.json` behind. Returns `undefined` (nothing to restore, no disk write at all) when `pkg`
- * has no `"workspace:"` ranges to begin with.
- */
-function rewriteWorkspaceRangesForPublish(pkg, packagesByName) {
-    const hasWorkspaceRange = DEPENDENCY_KEYS.some(depKey => {
-        const deps = pkg.json[depKey];
-        return deps && Object.values(deps).some(v => parseWorkspaceRange(v));
-    });
-    if (!hasWorkspaceRange)
-        return undefined;
-    const original = fs.readFileSync(pkg.jsonFileName, 'utf-8');
-    for (const depKey of DEPENDENCY_KEYS) {
-        const deps = pkg.json[depKey];
-        if (!deps)
-            continue;
-        for (const depName of Object.keys(deps)) {
-            const parsed = parseWorkspaceRange(deps[depName]);
-            if (!parsed)
-                continue;
-            const depPkg = packagesByName.get(depName);
-            if (depPkg)
-                deps[depName] = resolveWorkspaceRange(parsed, depPkg.version);
-        }
-    }
-    pkg.writeJson();
-    return () => {
-        fs.writeFileSync(pkg.jsonFileName, original, 'utf-8');
-        pkg.reloadJson();
-    };
-}

package/services/run.service.d.ts

@@ -42,10 +42,15 @@ export declare namespace RunService {
      * `getScriptSteps`:
      *   run:
      *     build:
-     *       script: tsc -b
-     *       preScript: [node ./generate.js, node ./validate.js]
-     *       postScript: node ./copy-assets.js
+     *       before: [node ./generate.js, node ./validate.js]
+     *       exec: tsc -b
+     *       after: node ./copy-assets.js
      *       override: true   # use these even if the package *does* define its own
+     *
+     * A bare string is shorthand for `exec`, which is by far the common case - a script that is just
+     * a command, with nothing to configure about how it runs:
+     *   run:
+     *     test: mocha          # same as   test: { exec: mocha }
      */
     function getConfig(pkg: Package, script: string): Record<string, unknown>;
     /**