rman 1.2.5 → 2.0.0-beta.2

package/plugins/node/node.platform.d.ts

@@ -0,0 +1,53 @@
+import type { Package } from '../../core/package.js';
+import type { Platform } from '../../core/plugin.js';
+import type { RunService } from '../../services/run.service.js';
+import { NodeManifestProvider } from './node-manifest.provider.js';
+import { NodeVersionPlanService } from './services/version-plan.service.js';
+export declare class NodePlatform implements Platform {
+    /** The ecosystem, not the file - this is what every package it reads reports as
+     *  `pkg.provider === 'node'`. `manifestProvider.fileName` already says `package.json`. */
+    name: string;
+    manifestProvider: NodeManifestProvider;
+    versionPlanner: NodeVersionPlanService;
+    /**
+     * npm's `workspaces` globs, resolved against `dir` - the directories directly below it that hold
+     * a `package.json`.
+     *
+     * **Asked of every directory the walk reaches, not only of the repository root**, which is what
+     * the seam changing from a layout to a per-directory question bought: a `package.json` naming
+     * `workspaces` is a workspace root wherever it sits, so a Node sub-workspace inside a larger
+     * repository is now found by the same code that finds the top one. `deep: 0` already made the
+     * globs one level, so nothing here had to change to make that true.
+     */
+    getWorkspace(dir: string): string[] | undefined;
+    /**
+     * Teaches `run` about `package.json#scripts`.
+     *
+     * rman's core resolves a script from `.rmanrc` alone - `before`/`exec`/`after`. That a script might
+     * *also* live in `package.json`, that `prebuild` and `postbuild` run around `build`, and that
+     * `a && b` is two steps rather than one, are all facts about npm, so they are here.
+     *
+     * Registered as a `RunService` step source rather than by wrapping anything: the npm part of `run`
+     * is inside step resolution, not at its entry point, so there is nothing a wrapper could reach.
+     * The core decides what to do with what this returns - see `getScriptSteps` for the precedence.
+     */
+    getRunSteps(pkg: Package, script: string): RunService.ScriptSlots | undefined;
+    /**
+     * Where npm puts a repository's locally installed executables: `node_modules/.bin`, at **every**
+     * level from `cwd` up to the filesystem root - which is how npm itself resolves a binary, so a
+     * package's `eslint` is found whether it was installed in that package or hoisted to the workspace
+     * root.
+     *
+     * Adapted from [npm-run-path](https://github.com/sindresorhus/npm-run-path), and it used to sit in
+     * rman's core. It is npm's directory layout from end to end: a Cargo or Go repository has no
+     * `node_modules` to walk, and nothing here would ever fire for it.
+     *
+     * **The running `node`'s own directory goes last**, after the walk, and its position is
+     * load-bearing. It is there so a script calling `node` gets the interpreter rman itself runs on
+     * rather than whatever the shell would pick. It also puts rman's own bin directory ahead of the
+     * inherited PATH, which is a measured trap: a nested `rman` invocation inside a `run` script
+     * resolves to the globally installed one, not to the repository's. Shim it in
+     * `<root>/node_modules/.bin` when that has to be overridden - the walk above reaches there first.
+     */
+    getBinPaths(cwd: string): string[];
+}

package/plugins/node/node.platform.js

@@ -0,0 +1,134 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import parseNpmScript from '@netlify/parse-npm-script';
+import glob from 'fast-glob';
+import { NodeManifestProvider } from './node-manifest.provider.js';
+import { NodeVersionPlanService } from './services/version-plan.service.js';
+/** Stands in for a script the package does not declare. `#` is a shell comment, so were it ever to
+ *  reach a shell it would do nothing - but it is filtered out above instead. */
+const PLACEHOLDER = '#';
+export class NodePlatform {
+    /** The ecosystem, not the file - this is what every package it reads reports as
+     *  `pkg.provider === 'node'`. `manifestProvider.fileName` already says `package.json`. */
+    name = 'node';
+    manifestProvider = new NodeManifestProvider();
+    versionPlanner = new NodeVersionPlanService();
+    /**
+     * npm's `workspaces` globs, resolved against `dir` - the directories directly below it that hold
+     * a `package.json`.
+     *
+     * **Asked of every directory the walk reaches, not only of the repository root**, which is what
+     * the seam changing from a layout to a per-directory question bought: a `package.json` naming
+     * `workspaces` is a workspace root wherever it sits, so a Node sub-workspace inside a larger
+     * repository is now found by the same code that finds the top one. `deep: 0` already made the
+     * globs one level, so nothing here had to change to make that true.
+     */
+    getWorkspace(dir) {
+        const manifest = path.join(dir, 'package.json');
+        if (!fs.existsSync(manifest))
+            return undefined;
+        let patterns;
+        try {
+            patterns = JSON.parse(fs.readFileSync(manifest, 'utf-8'))?.workspaces;
+        }
+        catch {
+            /** A malformed `package.json` is not this provider's error to report - `Package` will do it
+             *  with the file in hand when something actually reads the manifest. */
+            return undefined;
+        }
+        if (!Array.isArray(patterns))
+            return undefined;
+        const packageDirs = [];
+        for (const pattern of patterns) {
+            if (typeof pattern !== 'string')
+                continue;
+            const dirs = glob.sync(pattern, { cwd: dir, absolute: true, deep: 0, onlyDirectories: true });
+            for (const d of dirs) {
+                if (fs.existsSync(path.join(d, 'package.json')))
+                    packageDirs.push(d);
+            }
+        }
+        return packageDirs;
+    }
+    /**
+     * Teaches `run` about `package.json#scripts`.
+     *
+     * rman's core resolves a script from `.rmanrc` alone - `before`/`exec`/`after`. That a script might
+     * *also* live in `package.json`, that `prebuild` and `postbuild` run around `build`, and that
+     * `a && b` is two steps rather than one, are all facts about npm, so they are here.
+     *
+     * Registered as a `RunService` step source rather than by wrapping anything: the npm part of `run`
+     * is inside step resolution, not at its entry point, so there is nothing a wrapper could reach.
+     * The core decides what to do with what this returns - see `getScriptSteps` for the precedence.
+     */
+    getRunSteps(pkg, script) {
+        const scripts = pkg.manifest.raw?.scripts;
+        if (!scripts || typeof scripts !== 'object')
+            return undefined;
+        const declared = (name) => typeof scripts[name] === 'string' && !!scripts[name];
+        if (!declared(script) && !declared('pre' + script) && !declared('post' + script))
+            return undefined;
+        /**
+         * `parseNpmScript` expands npm's own lifecycle - `pre<script>`, the script, `post<script>` - and
+         * splits each on `&&` into the commands npm would run in sequence. The placeholder matters: it
+         * asks for a script the package may not declare itself (it may have only a `prebuild`), and
+         * without something there the parser reports the whole chain as absent.
+         */
+        const json = { ...pkg.manifest.raw, scripts: { ...scripts } };
+        json.scripts[script] = json.scripts[script] || PLACEHOLDER;
+        const info = parseNpmScript(json, 'npm run ' + script);
+        if (!info?.raw?.length)
+            return undefined;
+        const slots = { before: [], exec: [], after: [] };
+        for (const step of info.steps) {
+            const slot = slotOf(step.name, script);
+            if (!slot)
+                continue;
+            for (const command of Array.isArray(step.parsed) ? step.parsed : [step.parsed]) {
+                if (command === PLACEHOLDER)
+                    continue;
+                slots[slot].push(command);
+            }
+        }
+        return slots;
+    }
+    /**
+     * Where npm puts a repository's locally installed executables: `node_modules/.bin`, at **every**
+     * level from `cwd` up to the filesystem root - which is how npm itself resolves a binary, so a
+     * package's `eslint` is found whether it was installed in that package or hoisted to the workspace
+     * root.
+     *
+     * Adapted from [npm-run-path](https://github.com/sindresorhus/npm-run-path), and it used to sit in
+     * rman's core. It is npm's directory layout from end to end: a Cargo or Go repository has no
+     * `node_modules` to walk, and nothing here would ever fire for it.
+     *
+     * **The running `node`'s own directory goes last**, after the walk, and its position is
+     * load-bearing. It is there so a script calling `node` gets the interpreter rman itself runs on
+     * rather than whatever the shell would pick. It also puts rman's own bin directory ahead of the
+     * inherited PATH, which is a measured trap: a nested `rman` invocation inside a `run` script
+     * resolves to the globally installed one, not to the repository's. Shim it in
+     * `<root>/node_modules/.bin` when that has to be overridden - the walk above reaches there first.
+     */
+    getBinPaths(cwd) {
+        const result = [];
+        let previous;
+        let dir = path.resolve(cwd);
+        while (previous !== dir) {
+            result.push(path.join(dir, 'node_modules/.bin'));
+            previous = dir;
+            dir = path.resolve(dir, '..');
+        }
+        result.push(path.resolve(cwd, process.execPath, '..'));
+        return result;
+    }
+}
+/** npm's lifecycle names, mapped onto rman's three slots. */
+function slotOf(stepName, script) {
+    if (stepName === 'pre' + script)
+        return 'before';
+    if (stepName === script)
+        return 'exec';
+    if (stepName === 'post' + script)
+        return 'after';
+    return undefined;
+}

package/plugins/node/npm-publish-target.d.ts

@@ -0,0 +1,73 @@
+import type { Package } from '../../core/package.js';
+import type { PublishTarget } from '../../core/publish-target.js';
+import { PublishService } from './services/publish.service.js';
+/** The name this target answers to in `publish.target` and `--target`. */
+export declare const NPM_TARGET = "npm";
+/**
+ * **npm, as a publish target** - what is left of the old `rman-node` `publish` command once the command
+ * itself went back to the core where it belonged.
+ *
+ * The split is worth stating, because it is the whole point of the move: everything about
+ * *publishing a repository* - which packages are candidates, dependency order, the plan/confirm/
+ * apply shape, `--dry-run`, the JSON a CI gate reads - is the core's and always was. What is npm's
+ * is this file: seven flags, one registry question, and one push. A Cargo or Maven target is the
+ * same size.
+ *
+ * **`claims` is the other half, and it fixes a real bug.** The core used to default a package with
+ * no `publish.target` to `['npm']`, which is a statement only an ecosystem can make - so a Cargo
+ * package beside a Node one was reported by `rman list --json` as shipping to npm, and treated by
+ * `publish` as an npm candidate. Asking `pkg.provider === 'node'` puts the answer where the
+ * knowledge is: this plugin read that manifest, so this plugin is the one that can say so.
+ *
+ * A class, like `NodePlugin` and `NodeManifestProvider`: a config declares it as
+ * `publishTargets: [new NpmPublishTarget()]`, which is one shape for everything a plugin package
+ * contributes rather than an object literal here and a class there.
+ */
+export declare class NpmPublishTarget implements PublishTarget {
+    name: string;
+    describe: string;
+    claims(pkg: Package): boolean;
+    options: {
+        packageManager: {
+            target: "cli";
+            cliName: string;
+            describe: string;
+            choices: readonly ["npm", "yarn", "pnpm", "bun"];
+        };
+        access: {
+            target: "cli";
+            describe: string;
+            choices: string[];
+        };
+        tag: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+        otp: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+        registry: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+        userconfig: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+        contents: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+    };
+    getPlan(ctx: PublishTarget.Context): Promise<PublishService.Entry[]>;
+    applyPlan(ctx: PublishTarget.Context, plan: PublishTarget.Entry[]): Promise<PublishService.Entry[]>;
+    /** The shared filters plus the two flags both halves need - read here rather than in the
+     *  service, which keeps taking a plain options object and stays callable without a CLI. */
+    protected planOptions(ctx: PublishTarget.Context): PublishService.Options;
+}

package/plugins/node/npm-publish-target.js

@@ -0,0 +1,96 @@
+import { CiService } from './services/ci.service.js';
+import { PublishService } from './services/publish.service.js';
+/** The name this target answers to in `publish.target` and `--target`. */
+export const NPM_TARGET = 'npm';
+/**
+ * **npm, as a publish target** - what is left of the old `rman-node` `publish` command once the command
+ * itself went back to the core where it belonged.
+ *
+ * The split is worth stating, because it is the whole point of the move: everything about
+ * *publishing a repository* - which packages are candidates, dependency order, the plan/confirm/
+ * apply shape, `--dry-run`, the JSON a CI gate reads - is the core's and always was. What is npm's
+ * is this file: seven flags, one registry question, and one push. A Cargo or Maven target is the
+ * same size.
+ *
+ * **`claims` is the other half, and it fixes a real bug.** The core used to default a package with
+ * no `publish.target` to `['npm']`, which is a statement only an ecosystem can make - so a Cargo
+ * package beside a Node one was reported by `rman list --json` as shipping to npm, and treated by
+ * `publish` as an npm candidate. Asking `pkg.provider === 'node'` puts the answer where the
+ * knowledge is: this plugin read that manifest, so this plugin is the one that can say so.
+ *
+ * A class, like `NodePlugin` and `NodeManifestProvider`: a config declares it as
+ * `publishTargets: [new NpmPublishTarget()]`, which is one shape for everything a plugin package
+ * contributes rather than an object literal here and a class there.
+ */
+export class NpmPublishTarget {
+    name = NPM_TARGET;
+    describe = 'Publish to an npm registry (npm/yarn/pnpm/bun publish)';
+    claims(pkg) {
+        return pkg.provider === 'node';
+    }
+    options = {
+        packageManager: {
+            target: 'cli',
+            cliName: 'package-manager',
+            describe: 'Package manager to publish with (default: npm, or .rmanrc "packageManager")',
+            choices: CiService.PACKAGE_MANAGERS,
+        },
+        access: {
+            target: 'cli',
+            describe: 'npm publish --access <public|restricted> - required by the registry for a new scoped package',
+            choices: ['public', 'restricted'],
+        },
+        tag: {
+            target: 'cli',
+            describe: 'npm publish --tag <tag> - overrides the dist-tag. A prerelease already publishes under its ' +
+                'own identifier (2.0.0-beta.1 -> "beta") and a release under "latest", so this is rarely needed',
+            type: 'string',
+        },
+        otp: {
+            target: 'cli',
+            describe: 'npm publish --otp <otp> - a 2FA one-time password, for registries that require it',
+            type: 'string',
+        },
+        registry: {
+            target: 'cli',
+            describe: 'Registry to check against and publish to (default: whatever .npmrc already configures)',
+            type: 'string',
+        },
+        userconfig: {
+            target: 'cli',
+            describe: 'Path to a custom .npmrc to use for both the registry check and the actual publish',
+            type: 'string',
+        },
+        contents: {
+            target: 'cli',
+            describe: "Subdirectory to publish from, relative to each package's own directory - only consulted when a " +
+                'package has no "publishConfig.directory" of its own (that always wins when present)',
+            type: 'string',
+        },
+    };
+    getPlan(ctx) {
+        return PublishService.getPlan(ctx.repository, this.planOptions(ctx));
+    }
+    applyPlan(ctx, plan) {
+        return PublishService.applyPlan(ctx.repository, plan, {
+            ...this.planOptions(ctx),
+            packageManager: ctx.args.packageManager,
+            access: ctx.args.access,
+            otp: ctx.args.otp,
+            contents: ctx.args.contents,
+        });
+    }
+    /** The shared filters plus the two flags both halves need - read here rather than in the
+     *  service, which keeps taking a plain options object and stays callable without a CLI. */
+    planOptions(ctx) {
+        return {
+            ...ctx.options,
+            registry: ctx.args.registry,
+            userconfig: ctx.args.userconfig,
+            /** Read at *plan* time too, not only where the publish command is built: the plan is what
+             *  decides the dist-tag and refuses the two cases with nothing to derive, so `--dry-run` and
+             *  the JSON a pipeline gates on have to see the flag. */
+            tag: ctx.args.tag,
+        };
+    }
+}

package/plugins/node/services/ci.service.d.ts

@@ -0,0 +1,47 @@
+import type { Repository } from '../../../core/repository.js';
+import type { LogLevel } from '../../../utils/logger.js';
+import type { PackageFilterOptions } from '../../../utils/package-filter.js';
+export declare namespace CiService {
+    /**
+     * The package managers this plugin knows how to drive, and the `choices` both `ci --package-manager`
+     * and the `npm` publish target's own flag offer.
+     *
+     * Exported rather than module-private, which it was: the publish target needs the same list, and
+     * a second copy of it is the kind of drift that shows up as a flag accepting a value nothing can
+     * act on. One list, one place it is written down.
+     */
+    const PACKAGE_MANAGERS: readonly ["npm", "yarn", "pnpm", "bun"];
+    type PackageManager = (typeof PACKAGE_MANAGERS)[number];
+    interface Options extends PackageFilterOptions {
+        packageManager?: PackageManager;
+        /** Show the live progress panel while running. Default true, same as `run`/`build`; auto-disabled
+         *  when stdout isn't a TTY. Doesn't affect what's printed once done - see `run`. */
+        progress?: boolean;
+        /** Verbosity of the classic per-step log (only applies when the live panel is off). Falls back to
+         *  the root's `.rmanrc logLevel`, then 'info' - see `resolveRootLogLevel`. */
+        logLevel?: LogLevel;
+    }
+    /** `.rmanrc packageManager` (root only) picks the package manager used for the final install;
+     *  explicit CLI value wins over it. Defaults to 'npm'. */
+    function resolvePackageManager(repository: Repository, cliValue?: PackageManager): PackageManager;
+    /** Deletes `node_modules` and any known lockfile directly under `dirname`. Returns the names
+     *  that actually existed (and were removed), so the caller can log only those. */
+    function wipe(dirname: string): Promise<string[]>;
+    /**
+     * `ci`: a from-scratch, reproducible install for CI pipelines. For every package (root
+     * included), deletes `node_modules` and any lockfile - or, if the package defines its own
+     * `"ci"` script, runs that instead. Once every package is clean, installs once at the root
+     * with the configured package manager (`npm`/`yarn`/`pnpm`/`bun`).
+     *
+     * Uses the same live progress panel as `run`/`build` (see `../utils/progress-panel.ts`) while it
+     * runs, falling back to a plain rmdir/clean/run/install log line per step when the panel is off.
+     *
+     * Unlike `run`/`build`, it does *not* end with a per-package success tally: `ci`'s packages don't
+     * have independently meaningful outcomes the way a build or test run does - wiping a package is
+     * trivial and the one step that can genuinely fail, the install, is a single operation for the
+     * whole repository. Counting "N succeeded" across packages would just be noise, so only actual
+     * failures get called out (by name, with whatever output they produced), followed by one plain
+     * completed/failed line.
+     */
+    function reinstall(repository: Repository, options?: Options): Promise<void>;
+}

package/plugins/node/services/ci.service.js

@@ -0,0 +1,213 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import colors from 'ansi-colors';
+import { exec } from '../../../utils/exec.js';
+import { Logger, resolveRootLogLevel } from '../../../utils/logger.js';
+import { filterPackages } from '../../../utils/package-filter.js';
+import { formatDuration, ProgressPanel } from '../../../utils/progress-panel.js';
+export var CiService;
+(function (CiService) {
+    /**
+     * The package managers this plugin knows how to drive, and the `choices` both `ci --package-manager`
+     * and the `npm` publish target's own flag offer.
+     *
+     * Exported rather than module-private, which it was: the publish target needs the same list, and
+     * a second copy of it is the kind of drift that shows up as a flag accepting a value nothing can
+     * act on. One list, one place it is written down.
+     */
+    CiService.PACKAGE_MANAGERS = ['npm', 'yarn', 'pnpm', 'bun'];
+    /** `.rmanrc packageManager` (root only) picks the package manager used for the final install;
+     *  explicit CLI value wins over it. Defaults to 'npm'. */
+    function resolvePackageManager(repository, cliValue) {
+        if (cliValue)
+            return cliValue;
+        const configured = repository.config?.packageManager;
+        if (configured === undefined)
+            return 'npm';
+        if (CiService.PACKAGE_MANAGERS.includes(configured))
+            return configured;
+        throw new Error(`Invalid "packageManager" in .rmanrc: "${configured}" (expected one of: ${CiService.PACKAGE_MANAGERS.join(', ')})`);
+    }
+    CiService.resolvePackageManager = resolvePackageManager;
+    /** Deletes `node_modules` and any known lockfile directly under `dirname`. Returns the names
+     *  that actually existed (and were removed), so the caller can log only those. */
+    async function wipe(dirname) {
+        const removed = [];
+        for (const name of ['node_modules', ...LOCK_FILES]) {
+            const target = path.join(dirname, name);
+            const existed = await fs
+                .access(target)
+                .then(() => true)
+                .catch(() => false);
+            if (!existed)
+                continue;
+            await fs.rm(target, { recursive: true, force: true });
+            removed.push(name);
+        }
+        return removed;
+    }
+    CiService.wipe = wipe;
+    /**
+     * `ci`: a from-scratch, reproducible install for CI pipelines. For every package (root
+     * included), deletes `node_modules` and any lockfile - or, if the package defines its own
+     * `"ci"` script, runs that instead. Once every package is clean, installs once at the root
+     * with the configured package manager (`npm`/`yarn`/`pnpm`/`bun`).
+     *
+     * Uses the same live progress panel as `run`/`build` (see `../utils/progress-panel.ts`) while it
+     * runs, falling back to a plain rmdir/clean/run/install log line per step when the panel is off.
+     *
+     * Unlike `run`/`build`, it does *not* end with a per-package success tally: `ci`'s packages don't
+     * have independently meaningful outcomes the way a build or test run does - wiping a package is
+     * trivial and the one step that can genuinely fail, the install, is a single operation for the
+     * whole repository. Counting "N succeeded" across packages would just be noise, so only actual
+     * failures get called out (by name, with whatever output they produced), followed by one plain
+     * completed/failed line.
+     */
+    async function reinstall(repository, options = {}) {
+        const packageManager = resolvePackageManager(repository, options.packageManager);
+        const logger = new Logger(options.logLevel ?? resolveRootLogLevel(repository));
+        // root is handled separately below - for a non-monorepo, getPackages() would otherwise
+        // include it a second time (it doubles as "the" package).
+        const packages = filterPackages(repository.getPackages().filter(p => p !== repository.rootPackage), options);
+        const progress = options.progress ?? true;
+        const panel = new ProgressPanel('CI', !!process.stdout.isTTY && progress);
+        const runStartedAt = Date.now();
+        panel.start();
+        const items = [];
+        let failed = false;
+        try {
+            const results = await Promise.allSettled(packages.map(pkg => {
+                const item = panel.addItem(pkg.name);
+                items.push(item);
+                return ciForPackage(pkg, item, panel.enabled, logger);
+            }));
+            if (results.some(r => r.status === 'rejected'))
+                failed = true;
+            const rootItem = panel.addItem('root');
+            items.push(rootItem);
+            try {
+                await ciForRoot(repository, rootItem, panel.enabled, packageManager, logger);
+            }
+            catch {
+                failed = true;
+            }
+        }
+        finally {
+            panel.stop();
+        }
+        for (const item of items) {
+            if (item.status !== 'failed')
+                continue;
+            logger.error(colors.red.bold('X'), item.name);
+            if (item.log.length)
+                logger.error(colors.red(item.log.join('\n')));
+        }
+        const totalElapsed = formatDuration(Date.now() - runStartedAt);
+        const summary = [failed ? colors.red('ci failed') : colors.green('ci completed'), colors.gray(`(${totalElapsed})`)];
+        if (failed)
+            logger.error(...summary);
+        else
+            logger.info(...summary);
+        if (failed) {
+            const err = new Error('"ci" failed');
+            err.logged = true;
+            throw err;
+        }
+    }
+    CiService.reinstall = reinstall;
+})(CiService || (CiService = {}));
+const LOCK_FILES = ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lock', 'bun.lockb'];
+/** Runs a shell `command` in `cwd`, driving `item` for the live panel when it's on, or falling
+ *  back to the plain "classic" log line `logLine` prints first - the same split `run`'s classic
+ *  log uses. `logLine` is expected to go through a `Logger` (so it respects `--log-level`), not a
+ *  raw `console.log`. */
+async function runStep(app, item, panelEnabled, cwd, command, logLine) {
+    if (panelEnabled) {
+        await exec(command, {
+            app,
+            cwd,
+            stdio: 'pipe',
+            onLine: line => {
+                item.log.push(line);
+                item.lastLine = line;
+            },
+        });
+    }
+    else {
+        logLine();
+        await exec(command, { cwd, app, stdio: 'inherit' });
+    }
+}
+/** Logs (or reflects onto the live panel) the outcome of a `wipe()` call - including the "nothing
+ *  to remove" case, which otherwise prints nothing at all in the classic log and can look like the
+ *  package was never processed (most workspace layouts hoist deps to the root's `node_modules`,
+ *  so an individual package legitimately has nothing of its own to wipe most of the time). */
+function logWipeResult(item, panelEnabled, logger, label, removed) {
+    if (panelEnabled) {
+        item.lastLine = removed.length ? `removed ${removed.join(', ')}` : 'already clean';
+        return;
+    }
+    if (!removed.length) {
+        logger.info(colors.gray('clean'), colors.cyan(label));
+        return;
+    }
+    for (const name of removed)
+        logger.info(colors.yellow('rmdir'), colors.cyan(label), name);
+}
+/** A package can opt out of the default wipe by defining its own `"ci"` npm script - if present,
+ *  that runs instead of the wipe, same as any other rman script. */
+async function ciForPackage(pkg, item, panelEnabled, logger) {
+    item.status = 'running';
+    item.startedAt = Date.now();
+    try {
+        const script = pkg.manifest.raw.scripts?.ci;
+        if (typeof script === 'string' && script) {
+            item.currentStep = 'ci';
+            await runStep(pkg.repository.app, item, panelEnabled, pkg.dirname, script, () => logger.info(colors.cyan('run'), colors.cyan(item.name), script));
+        }
+        else {
+            item.currentStep = 'wipe';
+            const removed = await CiService.wipe(pkg.dirname);
+            logWipeResult(item, panelEnabled, logger, item.name, removed);
+        }
+        item.status = 'success';
+    }
+    catch (e) {
+        item.status = 'failed';
+        throw e;
+    }
+    finally {
+        item.finishedAt = Date.now();
+    }
+}
+/** The root gets one extra step over a regular package once it isn't opting out with its own
+ *  `"ci"` script: after its own wipe, it installs once for the whole repository. */
+async function ciForRoot(repository, item, panelEnabled, packageManager, logger) {
+    item.status = 'running';
+    item.startedAt = Date.now();
+    try {
+        const script = repository.rootPackage.manifest.raw.scripts?.ci;
+        if (typeof script === 'string' && script) {
+            item.currentStep = 'ci';
+            await runStep(repository.app, item, panelEnabled, repository.dirname, script, () => logger.info(colors.cyan('run'), colors.cyan('root'), script));
+        }
+        else {
+            item.stepsTotal = 2;
+            item.stepIndex = 0;
+            item.currentStep = 'wipe';
+            const removed = await CiService.wipe(repository.dirname);
+            logWipeResult(item, panelEnabled, logger, 'root', removed);
+            item.stepIndex = 1;
+            item.currentStep = 'install';
+            await runStep(repository.app, item, panelEnabled, repository.dirname, `${packageManager} install`, () => logger.info(colors.cyan('install'), `Running "${packageManager} install"`));
+        }
+        item.status = 'success';
+    }
+    catch (e) {
+        item.status = 'failed';
+        throw e;
+    }
+    finally {
+        item.finishedAt = Date.now();
+    }
+}