rman 2.11.0 → 2.11.1

package/builtins/platforms/node/services/publish.service.d.ts

@@ -43,6 +43,11 @@ export declare namespace PublishService {
          * goes green" is the most important sentence in the plan when it applies.
          */
         staged?: boolean;
+        /** Subdirectory to publish from, relative to the package's own directory - only consulted when
+         *  the package doesn't already declare its own `package.json` `publishConfig.directory` (npm's
+         *  native mechanism for this, which always wins when present). A plan option, because the
+         *  manifest in that directory is what the plan decides from. */
+        contents?: string;
     }
     interface ApplyOptions extends Options {
         packageManager?: CiService.PackageManager;
@@ -50,10 +55,6 @@ export declare namespace PublishService {
         access?: 'public' | 'restricted';
         /** `npm publish --otp <otp>` - a 2FA one-time password, for registries that require it. */
         otp?: string;
-        /** Subdirectory to publish from, relative to the package's own directory - only consulted when
-         *  the package doesn't already declare its own `package.json` `publishConfig.directory` (npm's
-         *  native mechanism for this, which always wins when present). */
-        contents?: string;
     }
     /** One package's outcome in a publish plan - see `getPlan`. */
     interface Entry {
@@ -101,7 +102,11 @@ export declare namespace PublishService {
      * queries it to decide, so it's safe to call any time, including as the plan a bare `rman
      * publish` shows before asking for confirmation.
      *
-     * A `private: true` package is always `'skip'`ped outright. Each remaining package's **dist-tag**
+     * **Whether a package is private is read from the manifest that would be published** - the one in
+     * its build directory when it publishes from one, its own otherwise. A build directory with no
+     * `package.json` is an `'error'`: nothing has been built to publish. A package `private` in its
+     * source with no `publishConfig` is skipped before that is asked, since it stays private in any
+     * manifest derived from it. Each remaining package's **dist-tag**
      * is settled next (`distTagFor`): usually derived from the version itself, `'error'` in the two
      * cases with nothing to derive - that one is about the invocation rather than the package, so it
      * is answered before anything touches the network. A package with uncommitted local changes is

package/builtins/platforms/node/services/publish.service.js

@@ -72,21 +72,19 @@ function preparePublishManifest(pkg, publishDir, packagesByName) {
  *   builds a native module on install. The rest (`build`, `test`, `prepare`, ...) never reach the
  *   consumer - `prepare` runs for a git dependency, which builds from the repository, not from this
  *   tarball.
- * - `private` - it is a statement about the **source tree**, not about the artifact derived from it,
- *   and a manifest being published is by definition not private. rman's own gate normally stops a
- *   private package before this runs, so the line looks unreachable; it is not, because `private`
- *   is also how a repository keeps a stray `npm publish` out of the package directory while
- *   publishing `build/` on purpose. That is a real configuration - this repository ran it until
- *   `rman publish` became its own release path and the gate started refusing the thing it ships.
- *   A narrower guard (`prepublishOnly`, which never reaches a consumer either) says the same thing
- *   without claiming the artifact is unpublishable.
+ * - `private` - **only when the package declares a `publishConfig`**. A package configured to be
+ *   published that is also `private` is guarding its source tree against a stray `npm publish`,
+ *   not refusing to ship; one with no `publishConfig` means it, and keeps the flag. `getPlan`
+ *   decides from the manifest this produces, so the rule here *is* the publish rule - a preset
+ *   writing the build directory's manifest must apply the same one.
  * - `publishConfig.directory` - it pointed *here*; kept, it would point one level deeper again.
  */
 function derivePublishManifest(pkg, packagesByName) {
     const json = structuredClone(pkg.manifest.raw);
     resolveWorkspaceRanges(json, packagesByName);
     delete json.devDependencies;
-    delete json.private;
+    if (json.publishConfig)
+        delete json.private;
     if (json.scripts) {
         const kept = Object.fromEntries(Object.entries(json.scripts).filter(([name]) => CONSUMER_SCRIPTS.has(name)));
         if (Object.keys(kept).length)
@@ -129,7 +127,11 @@ export var PublishService;
      * queries it to decide, so it's safe to call any time, including as the plan a bare `rman
      * publish` shows before asking for confirmation.
      *
-     * A `private: true` package is always `'skip'`ped outright. Each remaining package's **dist-tag**
+     * **Whether a package is private is read from the manifest that would be published** - the one in
+     * its build directory when it publishes from one, its own otherwise. A build directory with no
+     * `package.json` is an `'error'`: nothing has been built to publish. A package `private` in its
+     * source with no `publishConfig` is skipped before that is asked, since it stays private in any
+     * manifest derived from it. Each remaining package's **dist-tag**
      * is settled next (`distTagFor`): usually derived from the version itself, `'error'` in the two
      * cases with nothing to derive - that one is about the invocation rather than the package, so it
      * is answered before anything touches the network. A package with uncommitted local changes is
@@ -187,7 +189,19 @@ export var PublishService;
                     reason: 'excluded via .rmanrc "publish.skip"',
                 });
             }
-            else if (pkg.isPrivate) {
+            else if (privateBySource(pkg)) {
+                entries.set(pkg.name, { package: pkg, version: pkg.version, status: 'skip', reason: 'private package' });
+            }
+            else if (!fs.existsSync(path.join(resolvePublishDir(pkg, options.contents), 'package.json'))) {
+                const dir = path.relative(pkg.dirname, resolvePublishDir(pkg, options.contents)) || '.';
+                entries.set(pkg.name, {
+                    package: pkg,
+                    version: pkg.version,
+                    status: 'error',
+                    reason: `nothing to publish in "${dir}" - it has no package.json; build the package first`,
+                });
+            }
+            else if (publishedManifestOf(pkg, options.contents).private) {
                 entries.set(pkg.name, { package: pkg, version: pkg.version, status: 'skip', reason: 'private package' });
             }
             else if (distTag.error) {
@@ -310,6 +324,27 @@ function resolvePublishDir(pkg, contentsOverride) {
     const rel = (typeof native === 'string' && native) || configured || contentsOverride;
     return rel ? path.resolve(pkg.dirname, rel) : pkg.dirname;
 }
+/** The manifest `npm publish` will read for `pkg` - its build directory's, or its own when it
+ *  publishes in place. */
+/* **Decided from the artifact, not the source**, because the two disagree about `private` and only
+ * one of them is published. Read before any build, the plan answered `skip - private package` for a
+ * single-package repository whose source carries `private: true` as a guard against a stray
+ * `npm publish` - while `derivePublishManifest` was removing that very flag from what it ships.
+ * Reported from `postgrejs-kysely`: version, tag and GitHub release all went through, and the
+ * registry got nothing. */
+function publishedManifestOf(pkg, contentsOverride) {
+    const dir = resolvePublishDir(pkg, contentsOverride);
+    if (path.resolve(dir) === path.resolve(pkg.dirname))
+        return pkg.manifest.raw;
+    return JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8'));
+}
+/** `private` in the source with no `publishConfig` - private in every manifest derived from it too,
+ *  so it is known without a build. */
+/* Asked first so an unbuilt private package is skipped rather than reported as unbuilt: opra's
+ * examples inherit `publish.npm.directory` from the shared preset and skip their build. */
+function privateBySource(pkg) {
+    return !!pkg.manifest.raw.private && !pkg.manifest.raw.publishConfig;
+}
 /**
  * Which registry a package's own version is asked about, and published to.
  *

package/builtins/publish-targets/npm/npm-publish-target.js

@@ -84,7 +84,6 @@ export class NpmPublishTarget {
             packageManager: ctx.args.packageManager,
             access: ctx.args.access,
             otp: ctx.args.otp,
-            contents: ctx.args.contents,
         });
     }
     /** The shared filters plus the two flags both halves need - read here rather than in the
@@ -103,6 +102,9 @@ export class NpmPublishTarget {
              *  flag was not given, so each package's own `publish.npm.staged` still decides - `false`
              *  here would mean `--no-staged` and silently overrule the config. */
             staged: ctx.args.staged,
+            /** The plan decides from the manifest in the directory being published, so it has to know
+             *  which directory that is. */
+            contents: ctx.args.contents,
         };
     }
 }

package/constants.js

@@ -1 +1 @@
-export const version = '2.11.0';
+export const version = '2.11.1';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rman",
   "description": "Repository manager",
-  "version": "2.11.0",
+  "version": "2.11.1",
   "author": "Panates",
   "license": "MIT",
   "dependencies": {