rman 1.3.0 → 2.0.0-beta.3

package/builtins/presets/node.js

@@ -0,0 +1,57 @@
+import { definePlatform } from '../../core/interfaces/plugin.js';
+import { defineConfig } from '../../interfaces/rman-config.interface.js';
+import { augmentSystemInfo, ciCommand, cleanCommand, NodePlatform } from '../platforms/node/index.js';
+import { NpmPublishTarget } from '../publish-targets/npm/index.js';
+/**
+ * **The `node` preset** - everything rman knows about the npm ecosystem, as a config.
+ *
+ * ```yaml
+ * # .rmanrc.yml
+ * extends: node
+ * ```
+ *
+ * It contributes the technology (how a `package.json` is read, where `workspaces` point, how
+ * versions are planned), the two commands that are npm's alone (`clean`, `ci`), and the `npm`
+ * publish target. A polyglot repository names several: `extends: ['node', 'cargo']` holds both,
+ * because every key here appends.
+ */
+/* **A config rather than a plugin, and that is the whole shape of a preset.** `commands` and
+ * `publishTargets` were already config keys; `platforms` is one now, so a technology arrives the
+ * same way everything else does. What used to need a `Builtin` type, a name that looked like a glob
+ * and an expansion step is `extends` and nothing else.
+ *
+ * **A function, so nothing here happens until a repository asks for it.** `augmentSystemInfo()`
+ * mutates the core's own `SystemInfo` in place, so running it at import time would have `rman info`
+ * report npm's tooling in a Cargo repository that never named this preset. `extends` imports the
+ * module it names and calls this; a repository that names something else never reaches it. */
+export function nodePreset() {
+    augmentSystemInfo();
+    return defineConfig({
+        platforms: [(nodePlatform ??= definePlatform(new NodePlatform()))],
+        commands: [ciCommand, cleanCommand],
+        publishTargets: [(npmTarget ??= new NpmPublishTarget())],
+    });
+}
+export default nodePreset;
+/**
+ * **One instance of each across every call, so calling this preset twice contributes one of each.**
+ *
+ * A repository writing `extends: 'rman:node'` is read *and* gets the same preset laid under it by
+ * default, which is ordinary rather than a mistake - the contribution keys append and drop a
+ * duplicate **by identity** (`appendList`). The two commands are module consts, so they dedup on
+ * their own; anything this factory `new`s does not, and both of these have been that at some point.
+ *
+ * - **The target announced itself loudly.** Two of them reached `publish`, which refuses two
+ *   targets declaring one option name, and it died with `Publish targets "npm" and "npm" both
+ *   declare an option named "packageManager"` - the guard working exactly as intended, on a
+ *   collision with itself.
+ * - **The platform does not, and that is the one to watch.** `_addPlatform` dedups by *name*, so a
+ *   second `node` platform never reaches `context.platforms` and nothing resolves differently. What
+ *   it does is put the same technology in `config.platforms` twice - visible only in `rman config`
+ *   and to whoever iterates the key - plus an `augmentSystemInfo()` and a `new NodePlatform()` per
+ *   read. Caught by the identity spec in `docs-api.spec.ts` rather than by anything failing.
+ *
+ * **A new preset has to do the same for anything it constructs.**
+ */
+let npmTarget;
+let nodePlatform;

package/{services → builtins/publish-targets/docker}/docker-publish.service.d.ts

@@ -1,31 +1,19 @@
-import type { Package } from '../core/package.js';
-import type { Repository } from '../core/repository.js';
-import { type PackageFilterOptions } from '../utils/package-filter.js';
-export declare namespace DockerPublishService {
-    /** Injectable "does this tag already exist" check - mainly for tests, so they don't depend on
-     *  network access or a real Docker daemon. Same shape as `PublishService.Deps.npmViewVersion`. */
-    interface Deps {
-        imageExists?: (image: string, tag: string) => Promise<boolean>;
-    }
-    interface Options extends PackageFilterOptions {
-        /** A package with uncommitted local changes is excluded (status `'skip'`) instead of aborting
-         *  the whole plan (status `'error'`) - same as `version`/`publish --target npm`'s own option. */
-        ignoreDirty?: boolean;
-        /** Prefixed onto a bare (no `/`) `publish.docker.image` - falls back to the
-         *  `DOCKERHUB_NAMESPACE` environment variable. */
-        namespace?: string;
-    }
-    type ApplyOptions = Options;
-    /** One package's outcome in a docker-publish plan - see `getPlan`. */
-    interface Entry {
-        package: Package;
-        version: string;
-        status: 'publish' | 'skip' | 'up-to-date' | 'error';
-        /** The fully-qualified `<namespace>/<image>` this entry publishes to - unset only when the
-         *  package's own `publish.docker.image` config is missing entirely (an `'error'` entry). */
-        image?: string;
-        reason?: string;
-    }
+import { Service } from '../../../core/classes/service.js';
+import { type PublishTarget } from '../../../core/interfaces/publish-target.js';
+import { type PackageFilterOptions } from '../../../utils/package-filter.js';
+/**
+ * The name this target answers to in `publish.target` and `--target`.
+ *
+ * Declared beside the implementation rather than in `publish-target.ts`: the seam is general and
+ * must not know any one target's name, and the adapter in `builtins/publish-targets/docker/docker.target.ts` reads it from
+ * here, which keeps the dependency pointing one way.
+ */
+export declare const DOCKER_TARGET = "docker";
+/**
+ * A service class - see `ListService` for the shape and `Service` for the three measured
+ * consequences a namespace had. `repository` left the signature because the application carries it.
+ */
+export declare class DockerPublishService extends Service {
     /**
      * Computes what `publish --target docker` *would* do. Unlike the npm side (opt-out via
      * `"private"`), the docker target is opt-in: only packages whose own (cascaded) `.rmanrc
@@ -39,14 +27,47 @@ export declare namespace DockerPublishService {
      * already exists on the registry (via `docker manifest inspect`, queried concurrently) decides
      * the rest: `'up-to-date'` if so, `'publish'` if not.
      */
-    function getPlan(repository: Repository, options?: Options, deps?: Deps): Promise<Entry[]>;
+    getPlan(options?: DockerPublishService.Options, deps?: DockerPublishService.Deps): Promise<DockerPublishService.Entry[]>;
     /**
      * Publishes every `'publish'` entry in `plan`: one `docker login` and one `docker buildx create`
      * up front (each package's own build reuses them), then per package a single `docker buildx
-     * build --push` using that package's `publish.docker` config (platforms, named build-contexts,
+     * build --push` using that package's `publish.docker` config (architectures, named build-contexts,
      * build-args, an optional `cwd` override). A package's `publish.docker.readme` file (default
      * `DOCKER_README.md`), if present, updates the DockerHub repo description afterward. A package's
      * own failure doesn't stop unrelated packages elsewhere in the plan.
      */
-    function applyPlan(repository: Repository, plan: Entry[]): Promise<Entry[]>;
+    applyPlan(plan: DockerPublishService.Entry[]): Promise<DockerPublishService.Entry[]>;
+}
+export declare namespace DockerPublishService {
+    /** Injectable "does this tag already exist" check - mainly for tests, so they don't depend on
+     *  network access or a real Docker daemon. Same shape as `PublishService.Deps.npmViewVersion`. */
+    interface Deps {
+        imageExists?: (image: string, tag: string) => Promise<boolean>;
+    }
+    interface Options extends PackageFilterOptions {
+        /** A package with uncommitted local changes is excluded (status `'skip'`) instead of aborting
+         *  the whole plan (status `'error'`) - same as `version`/`publish --target npm`'s own option. */
+        ignoreDirty?: boolean;
+        /** Prefixed onto a bare (no `/`) `publish.docker.image` - falls back to the
+         *  `DOCKERHUB_NAMESPACE` environment variable. */
+        namespace?: string;
+    }
+    type ApplyOptions = Options;
+    /**
+     * One package's outcome in a docker-publish plan - see `getPlan`.
+     *
+     * A `PublishTarget.Entry` with one field of its own, which is the shape that interface expects: a
+     * target knows things about its own registry that no other target has a word for, and `detail` is
+     * where it puts whatever the command should print beside the package.
+     */
+    interface Entry extends PublishTarget.Entry {
+        /** The fully-qualified `<namespace>/<image>` this entry publishes to - unset only when the
+         *  package's own `publish.docker.image` config is missing entirely (an `'error'` entry). */
+        image?: string;
+    }
+}
+declare module '../../../core/classes/service.js' {
+    interface ServiceMap {
+        dockerPublish: DockerPublishService;
+    }
 }

package/{services → builtins/publish-targets/docker}/docker-publish.service.js

@@ -2,11 +2,24 @@ import { execFile } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
-import { exec } from '../utils/exec.js';
-import { GitHelper } from '../utils/git.js';
-import { filterPackages } from '../utils/package-filter.js';
-export var DockerPublishService;
-(function (DockerPublishService) {
+import { Service } from '../../../core/classes/service.js';
+import { targetsOf } from '../../../core/interfaces/publish-target.js';
+import { exec } from '../../../utils/exec.js';
+import { GitHelper } from '../../../utils/git.js';
+import { filterPackages } from '../../../utils/package-filter.js';
+/**
+ * The name this target answers to in `publish.target` and `--target`.
+ *
+ * Declared beside the implementation rather than in `publish-target.ts`: the seam is general and
+ * must not know any one target's name, and the adapter in `builtins/publish-targets/docker/docker.target.ts` reads it from
+ * here, which keeps the dependency pointing one way.
+ */
+export const DOCKER_TARGET = 'docker';
+/**
+ * A service class - see `ListService` for the shape and `Service` for the three measured
+ * consequences a namespace had. `repository` left the signature because the application carries it.
+ */
+export class DockerPublishService extends Service {
     /**
      * Computes what `publish --target docker` *would* do. Unlike the npm side (opt-out via
      * `"private"`), the docker target is opt-in: only packages whose own (cascaded) `.rmanrc
@@ -20,9 +33,14 @@ export var DockerPublishService;
      * already exists on the registry (via `docker manifest inspect`, queried concurrently) decides
      * the rest: `'up-to-date'` if so, `'publish'` if not.
      */
-    async function getPlan(repository, options = {}, deps = {}) {
+    async getPlan(options = {}, deps = {}) {
+        const repository = this.repository;
         const git = new GitHelper({ cwd: repository.dirname });
-        const packages = filterPackages(repository.getPackages({ toposort: true }), options).filter(pkg => targetsDocker(pkg) && !pkg.config.publish?.skip);
+        /** Which packages are the docker target's is the one question `PublishTarget` answers for every
+         *  target alike (`publish.target`, or `claims` when a package declares none) - asked through
+         *  `targetsOf` rather than re-read here, so `publish` and `list --json` cannot disagree about
+         *  where a package ships. */
+        const packages = filterPackages(repository.getPackages({ toposort: true }), options).filter(pkg => targetsOf(this.app, pkg).some(t => t.name === DOCKER_TARGET) && !pkg.config.publish?.skip);
         const dirtyFiles = await git.listDirtyFiles({ absolute: true });
         const isDirty = (pkg) => dirtyFiles.some(f => !path.relative(pkg.dirname, f).startsWith('..'));
         const imageExists = deps.imageExists ?? defaultImageExists;
@@ -52,6 +70,7 @@ export var DockerPublishService;
                     package: pkg,
                     version: pkg.version,
                     image,
+                    detail: image,
                     status: options.ignoreDirty ? 'skip' : 'error',
                     reason: 'uncommitted local changes',
                 });
@@ -65,27 +84,33 @@ export var DockerPublishService;
                 package: pkg,
                 version: pkg.version,
                 image,
+                detail: image,
                 status: exists ? 'up-to-date' : 'publish',
                 reason: exists ? `registry already has ${image}:${pkg.version}` : 'never published',
             });
         }));
         return packages.map(pkg => entries.get(pkg.name));
     }
-    DockerPublishService.getPlan = getPlan;
     /**
      * Publishes every `'publish'` entry in `plan`: one `docker login` and one `docker buildx create`
      * up front (each package's own build reuses them), then per package a single `docker buildx
-     * build --push` using that package's `publish.docker` config (platforms, named build-contexts,
+     * build --push` using that package's `publish.docker` config (architectures, named build-contexts,
      * build-args, an optional `cwd` override). A package's `publish.docker.readme` file (default
      * `DOCKER_README.md`), if present, updates the DockerHub repo description afterward. A package's
      * own failure doesn't stop unrelated packages elsewhere in the plan.
      */
-    async function applyPlan(repository, plan) {
+    async applyPlan(plan) {
+        const repository = this.repository;
         const toPublish = plan.filter(e => e.status === 'publish');
         if (!toPublish.length)
             return plan;
-        await dockerLogin(repository.dirname);
-        await exec('docker buildx create --use', { cwd: repository.dirname, stdio: 'inherit', throwOnError: false });
+        await dockerLogin(repository.app, repository.dirname);
+        await exec('docker buildx create --use', {
+            cwd: repository.dirname,
+            app: repository.app,
+            stdio: 'inherit',
+            throwOnError: false,
+        });
         const result = [];
         for (const entry of plan) {
             if (entry.status !== 'publish') {
@@ -103,12 +128,11 @@ export var DockerPublishService;
         }
         return result;
     }
-    DockerPublishService.applyPlan = applyPlan;
-})(DockerPublishService || (DockerPublishService = {}));
+}
 const execFileAsync = promisify(execFile);
 /** `docker manifest inspect <image>:<tag>` - `false` for any failure (tag doesn't exist yet, no
- *  network, not logged in, ...), same catch-everything shape as `PublishService`'s own
- *  `defaultNpmViewVersion`. */
+ *  network, not logged in, ...), the same catch-everything shape every target's registry check has:
+ *  "is this version out there" must never fail the run for a reason that is not an answer. */
 async function defaultImageExists(image, tag) {
     try {
         await execFileAsync('docker', ['manifest', 'inspect', `${image}:${tag}`]);
@@ -118,11 +142,6 @@ async function defaultImageExists(image, tag) {
         return false;
     }
 }
-function targetsDocker(pkg) {
-    const target = pkg.config.publish?.target;
-    const targets = Array.isArray(target) ? target : target ? [target] : ['npm'];
-    return targets.includes('docker');
-}
 function resolveImageRef(image, namespaceOverride) {
     if (image.includes('/'))
         return image;
@@ -138,21 +157,25 @@ function expandEnvValue(value) {
     const match = /^\$([A-Za-z_][A-Za-z0-9_]*)$/.exec(value);
     return match ? (process.env[match[1]] ?? '') : value;
 }
-async function dockerLogin(cwd) {
+async function dockerLogin(app, cwd) {
     const username = process.env.DOCKERHUB_USERNAME;
     const password = process.env.DOCKERHUB_PASSWORD;
     if (!username || !password) {
         throw new Error('DOCKERHUB_USERNAME/DOCKERHUB_PASSWORD environment variables are required to publish to Docker');
     }
-    await exec(`echo "${password}" | docker login --username "${username}" --password-stdin`, { cwd, stdio: 'inherit' });
+    await exec(`echo "${password}" | docker login --username "${username}" --password-stdin`, {
+        cwd,
+        app,
+        stdio: 'inherit',
+    });
 }
 async function buildAndPush(repository, entry) {
     const pkg = entry.package;
     const docker = pkg.config.publish.docker;
-    const platforms = docker.platforms?.length ? docker.platforms : ['linux/amd64'];
+    const architectures = docker.architectures?.length ? docker.architectures : ['linux/amd64'];
     const dockerfile = path.resolve(pkg.dirname, docker.dockerfile || 'Dockerfile');
     const cwd = docker.cwd ? path.resolve(repository.dirname, docker.cwd) : pkg.dirname;
-    const args = ['buildx', 'build', '--platform', platforms.join(',')];
+    const args = ['buildx', 'build', '--platform', architectures.join(',')];
     for (const [name, dir] of Object.entries(docker.buildContexts ?? {})) {
         args.push('--build-context', `${name}="${path.resolve(pkg.dirname, dir)}"`);
     }
@@ -160,7 +183,7 @@ async function buildAndPush(repository, entry) {
         args.push('--build-arg', `${name}="${expandEnvValue(value)}"`);
     }
     args.push('-f', `"${dockerfile}"`, '-t', `"${entry.image}:${entry.version}"`, '-t', `"${entry.image}:latest"`, '--push', '.');
-    await exec(`docker ${args.join(' ')}`, { cwd, stdio: 'inherit' });
+    await exec(`docker ${args.join(' ')}`, { cwd, app: repository.app, stdio: 'inherit' });
 }
 async function updateDescription(entry) {
     const pkg = entry.package;

package/builtins/publish-targets/docker/docker.target.d.ts

@@ -0,0 +1,54 @@
+import type { PublishTarget } from '../../../core/interfaces/publish-target.js';
+import type { ConfigValue, ScopedVars } from '../../../interfaces/rman-config.interface.js';
+/**
+ * **`publish.docker.*`** - this target's own config block, declared here rather than centrally.
+ *
+ * Reaches `RmanConfig` through the `PublishTargetConfigs` slot `publish.command.ts` exports, which
+ * is the same slot the `node` built-in declares `publish.npm.*` in. Whoever reads a key declares it: the
+ * only thing that reads these is `DockerPublishService`, two files away.
+ *
+ * Required once `"docker"` is one of a package's `publish.target`s - `publish --target docker`
+ * errors clearly on a package that opts in and leaves this out.
+ */
+export interface DockerPublishOptions extends DockerPublishOptionsKeys, ScopedVars {
+}
+/** Every key here is a **value**, so every one is a `ConfigValue` - this target declares no step,
+ *  which is what makes the whole block uniform (see `VersionExtraKeys` for the interface where it
+ *  is not). */
+export interface DockerPublishOptionsKeys {
+    /** DockerHub image name/repository - bare (e.g. `"my-app"`) to be prefixed with
+     *  `--docker-namespace`/`DOCKERHUB_NAMESPACE`, or already-namespaced (contains a `/`) to use
+     *  verbatim. */
+    image: ConfigValue<string>;
+    /** Relative to the package's own directory. Default `"Dockerfile"`. */
+    dockerfile?: ConfigValue<string>;
+    /**
+     * The architectures to build for - `docker buildx build --platform`. Default `["linux/amd64"]`.
+     */
+    architectures?: ConfigValue<string[]>;
+    /** Build `cwd` override, relative to the repository root - only needed when the Dockerfile's
+     *  own `COPY`/`ADD` paths expect something other than the package's own directory (rare). */
+    cwd?: ConfigValue<string>;
+    /** Named `docker buildx build --build-context <name>=<path>` entries, keyed by name - each
+     *  path is relative to the package's own directory (or absolute). */
+    buildContexts?: ConfigValue<Record<string, string>>;
+    /** `docker buildx build --build-arg <name>=<value>` entries - a value of exactly `"$NAME"`
+     *  expands to `process.env.NAME` at build time (e.g. to pass a CI secret through). */
+    buildArgs?: ConfigValue<Record<string, string>>;
+    /** A file (relative to the package's own directory) whose contents become the DockerHub repo's
+     *  full description, if present. Default `"DOCKER_README.md"`. */
+    readme?: ConfigValue<string>;
+}
+/**
+ * **Docker, as a publish target** - the core's own, and the reason `PublishTarget` is in the core
+ * rather than in a plugin.
+ *
+ * Any language's project can ship an image; nothing about `docker buildx build --push` is npm's, or
+ * Cargo's, or Maven's. It was already a core *service*, and could still only be reached through
+ * `rman-node`'s `publish` command - so a repository with no JavaScript in it had to install a Node
+ * plugin to push a container. This file is the ten lines that fix that.
+ *
+ * Opt-in, and therefore no `claims`: most packages in a repository are not images, so a package
+ * ships here only by naming `"docker"` in its own `publish.target`.
+ */
+export declare const dockerPublishTarget: PublishTarget;

package/builtins/publish-targets/docker/docker.target.js

@@ -0,0 +1,40 @@
+import { DOCKER_TARGET } from './docker-publish.service.js';
+/**
+ * **Docker, as a publish target** - the core's own, and the reason `PublishTarget` is in the core
+ * rather than in a plugin.
+ *
+ * Any language's project can ship an image; nothing about `docker buildx build --push` is npm's, or
+ * Cargo's, or Maven's. It was already a core *service*, and could still only be reached through
+ * `rman-node`'s `publish` command - so a repository with no JavaScript in it had to install a Node
+ * plugin to push a container. This file is the ten lines that fix that.
+ *
+ * Opt-in, and therefore no `claims`: most packages in a repository are not images, so a package
+ * ships here only by naming `"docker"` in its own `publish.target`.
+ */
+export const dockerPublishTarget = {
+    name: DOCKER_TARGET,
+    describe: 'Build and push a container image (docker buildx build --push)',
+    options: {
+        dockerNamespace: {
+            target: 'cli',
+            cliName: 'docker-namespace',
+            describe: 'Prefixed onto a bare (no "/") "publish.docker.image" - default: the DOCKERHUB_NAMESPACE ' +
+                'environment variable.',
+            type: 'string',
+        },
+    },
+    getPlan(ctx) {
+        return ctx.app.getService('dockerPublish').getPlan(optionsOf(ctx));
+    },
+    applyPlan(ctx, plan) {
+        /** The entries are this target's own - `getPlan` produced them - so the cast reads back what
+         *  was put in rather than claiming anything new. The command only ever passes a plan back to
+         *  the target that made it. */
+        return ctx.app.getService('dockerPublish').applyPlan(plan);
+    },
+};
+/** The shared filters plus the one flag this target declared - read here rather than in the service,
+ *  so the service keeps taking a plain options object and stays callable without a CLI. */
+function optionsOf(ctx) {
+    return { ...ctx.options, namespace: ctx.args.dockerNamespace };
+}

package/builtins/publish-targets/docker/index.d.ts

@@ -0,0 +1,2 @@
+export * from './docker.target.js';
+export * from './docker-publish.service.js';

package/builtins/publish-targets/docker/index.js

@@ -0,0 +1,2 @@
+export * from './docker.target.js';
+export * from './docker-publish.service.js';

package/builtins/publish-targets/npm/index.d.ts

@@ -0,0 +1,2 @@
+export * from './npm-publish-target.js';
+export * from './npm-view.js';

package/builtins/publish-targets/npm/index.js

@@ -0,0 +1,2 @@
+export * from './npm-publish-target.js';
+export * from './npm-view.js';

package/builtins/publish-targets/npm/npm-publish-target.d.ts

@@ -0,0 +1,73 @@
+import type { PublishTarget } from '../../../core/interfaces/publish-target.js';
+import { PublishService } from '../../platforms/node/services/publish.service.js';
+/** The name this target answers to in `publish.target` and `--target`. */
+export declare const NPM_TARGET = "npm";
+/**
+ * **npm, as a publish target** - what is left of the old `rman-node` `publish` command once the command
+ * itself went back to the core where it belonged.
+ *
+ * The split is worth stating, because it is the whole point of the move: everything about
+ * *publishing a repository* - which packages are candidates, dependency order, the plan/confirm/
+ * apply shape, `--dry-run`, the JSON a CI gate reads - is the core's and always was. What is npm's
+ * is this file: seven flags, one registry question, and one push. A Cargo or Maven target is the
+ * same size.
+ *
+ * **`claims` is the other half, and it fixes a real bug.** The core used to default a package with
+ * no `publish.target` to `['npm']`, which is a statement only an ecosystem can make - so a Cargo
+ * package beside a Node one was reported by `rman list --json` as shipping to npm, and treated by
+ * `publish` as an npm candidate. Asking `pkg.provider === 'node'` puts the answer where the
+ * knowledge is: this plugin read that manifest, so this plugin is the one that can say so.
+ *
+ * A class, like `NodePlugin` and `NodeManifestProvider`: a config declares it as
+ * `publishTargets: [new NpmPublishTarget()]`, which is one shape for everything a plugin package
+ * contributes rather than an object literal here and a class there.
+ */
+export declare class NpmPublishTarget implements PublishTarget {
+    name: string;
+    describe: string;
+    /** npm's alone: a package rman read through the `node` platform. */
+    platforms: string[];
+    options: {
+        packageManager: {
+            target: "cli";
+            cliName: string;
+            describe: string;
+            choices: readonly ["npm", "yarn", "pnpm", "bun"];
+        };
+        access: {
+            target: "cli";
+            describe: string;
+            choices: string[];
+        };
+        tag: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+        otp: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+        registry: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+        userconfig: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+        contents: {
+            target: "cli";
+            describe: string;
+            type: "string";
+        };
+    };
+    getPlan(ctx: PublishTarget.Context): Promise<PublishService.Entry[]>;
+    applyPlan(ctx: PublishTarget.Context, plan: PublishTarget.Entry[]): Promise<PublishService.Entry[]>;
+    /** The shared filters plus the two flags both halves need - read here rather than in the
+     *  service, which keeps taking a plain options object and stays callable without a CLI. */
+    protected planOptions(ctx: PublishTarget.Context): PublishService.Options;
+}

package/builtins/publish-targets/npm/npm-publish-target.js

@@ -0,0 +1,95 @@
+import { CiService } from '../../platforms/node/services/ci.service.js';
+import { PublishService } from '../../platforms/node/services/publish.service.js';
+/** The name this target answers to in `publish.target` and `--target`. */
+export const NPM_TARGET = 'npm';
+/**
+ * **npm, as a publish target** - what is left of the old `rman-node` `publish` command once the command
+ * itself went back to the core where it belonged.
+ *
+ * The split is worth stating, because it is the whole point of the move: everything about
+ * *publishing a repository* - which packages are candidates, dependency order, the plan/confirm/
+ * apply shape, `--dry-run`, the JSON a CI gate reads - is the core's and always was. What is npm's
+ * is this file: seven flags, one registry question, and one push. A Cargo or Maven target is the
+ * same size.
+ *
+ * **`claims` is the other half, and it fixes a real bug.** The core used to default a package with
+ * no `publish.target` to `['npm']`, which is a statement only an ecosystem can make - so a Cargo
+ * package beside a Node one was reported by `rman list --json` as shipping to npm, and treated by
+ * `publish` as an npm candidate. Asking `pkg.provider === 'node'` puts the answer where the
+ * knowledge is: this plugin read that manifest, so this plugin is the one that can say so.
+ *
+ * A class, like `NodePlugin` and `NodeManifestProvider`: a config declares it as
+ * `publishTargets: [new NpmPublishTarget()]`, which is one shape for everything a plugin package
+ * contributes rather than an object literal here and a class there.
+ */
+export class NpmPublishTarget {
+    name = NPM_TARGET;
+    describe = 'Publish to an npm registry (npm/yarn/pnpm/bun publish)';
+    /** npm's alone: a package rman read through the `node` platform. */
+    platforms = ['node'];
+    options = {
+        packageManager: {
+            target: 'cli',
+            cliName: 'package-manager',
+            describe: 'Package manager to publish with (default: npm, or .rmanrc "packageManager")',
+            choices: CiService.PACKAGE_MANAGERS,
+        },
+        access: {
+            target: 'cli',
+            describe: 'npm publish --access <public|restricted> - required by the registry for a new scoped package',
+            choices: ['public', 'restricted'],
+        },
+        tag: {
+            target: 'cli',
+            describe: 'npm publish --tag <tag> - overrides the dist-tag. A prerelease already publishes under its ' +
+                'own identifier (2.0.0-beta.1 -> "beta") and a release under "latest", so this is rarely needed',
+            type: 'string',
+        },
+        otp: {
+            target: 'cli',
+            describe: 'npm publish --otp <otp> - a 2FA one-time password, for registries that require it',
+            type: 'string',
+        },
+        registry: {
+            target: 'cli',
+            describe: 'Registry to check against and publish to (default: whatever .npmrc already configures)',
+            type: 'string',
+        },
+        userconfig: {
+            target: 'cli',
+            describe: 'Path to a custom .npmrc to use for both the registry check and the actual publish',
+            type: 'string',
+        },
+        contents: {
+            target: 'cli',
+            describe: "Subdirectory to publish from, relative to each package's own directory - only consulted when a " +
+                'package has no "publishConfig.directory" of its own (that always wins when present)',
+            type: 'string',
+        },
+    };
+    getPlan(ctx) {
+        return PublishService.getPlan(ctx.repository, this.planOptions(ctx));
+    }
+    applyPlan(ctx, plan) {
+        return PublishService.applyPlan(ctx.repository, plan, {
+            ...this.planOptions(ctx),
+            packageManager: ctx.args.packageManager,
+            access: ctx.args.access,
+            otp: ctx.args.otp,
+            contents: ctx.args.contents,
+        });
+    }
+    /** The shared filters plus the two flags both halves need - read here rather than in the
+     *  service, which keeps taking a plain options object and stays callable without a CLI. */
+    planOptions(ctx) {
+        return {
+            ...ctx.options,
+            registry: ctx.args.registry,
+            userconfig: ctx.args.userconfig,
+            /** Read at *plan* time too, not only where the publish command is built: the plan is what
+             *  decides the dist-tag and refuses the two cases with nothing to derive, so `--dry-run` and
+             *  the JSON a pipeline gates on have to see the flag. */
+            tag: ctx.args.tag,
+        };
+    }
+}

package/builtins/publish-targets/npm/npm-view.d.ts

@@ -0,0 +1,48 @@
+/** What the registry knows about one package - the two halves `publish` needs, from one call. */
+export interface NpmPackageView {
+    /** The version the **`latest` dist-tag** points at, which is what a bare `npm install <name>`
+     *  resolves to. Not necessarily the highest: a prerelease published under its own tag, or a
+     *  patch to an older line, leaves `latest` where it was. */
+    latest?: string;
+    /** Every version ever published, `latest` included. */
+    versions: string[];
+}
+/**
+ * `npm view <name> version versions --json` - `undefined` for anything that is not an answer (never
+ * published, no network, private or restricted with no access). Catch-everything on purpose: every
+ * caller treats "no answer" as a legitimate state rather than a failure.
+ *
+ * **Two fields in one call, because the two questions are genuinely different and `publish` needs
+ * both.** Whether *this* version is already out there decides `up-to-date` vs `publish`, and only
+ * `versions` can answer it; what `latest` points at is what the plan *reports*, so a reader can see
+ * where the registry stands. Asking `latest` alone was the same approximation in both roles, and it
+ * is wrong in both directions: a prerelease on its own dist-tag never moves `latest`, so `publish`
+ * kept proposing an already-published version until npm answered 403; and a package whose local
+ * version is *behind* `latest` was proposed just as wrongly.
+ *
+ * **`versions` is normalized to an array defensively, and the reason is what happens if it is
+ * not.** `includes` exists on a string too, so a bare `"1.0.0"` would answer `versions.includes()`
+ * without any error at all - and answer it by substring, where `"1.0.10".includes("1.0.1")` is
+ * `true` (measured). npm's own `--json` output *is* a real array here on this npm (measured: a
+ * single-entry `maintainers` comes back as `[...]`, not unwrapped), so this guards a shape
+ * difference across npm versions rather than one I reproduced - but a silent wrong answer about
+ * whether a version is published is worth two lines.
+ */
+export declare function npmViewPackage(name: string, cwd: string, options?: {
+    registry?: string;
+    userconfig?: string;
+}): Promise<NpmPackageView | undefined>;
+/**
+ * `npm view <name> version` - the **`latest` dist-tag's** version, or `undefined` for anything that
+ * is not an answer.
+ *
+ * `packageJsonManifest.publishedVersion` asks this so that `detectChangeHash` can guess a tag name
+ * for a package with no release tag at all, and `latest` is the right question for it: it wants the
+ * one version the ecosystem considers current, not the set of everything ever published. It passes
+ * no options - a bare `npm view` already picks up the repository's own `.npmrc` from `cwd`, which
+ * is what that path wants. `publish` asks `npmViewPackage` instead; see there for why.
+ */
+export declare function npmViewVersion(name: string, cwd: string, options?: {
+    registry?: string;
+    userconfig?: string;
+}): Promise<string | undefined>;