rman 2.11.0 → 2.11.2

package/builtins/platforms/node/services/publish.service.d.ts

@@ -43,6 +43,11 @@ export declare namespace PublishService {
          * goes green" is the most important sentence in the plan when it applies.
          */
         staged?: boolean;
+        /** Subdirectory to publish from, relative to the package's own directory - only consulted when
+         *  the package doesn't already declare its own `package.json` `publishConfig.directory` (npm's
+         *  native mechanism for this, which always wins when present). A plan option, because the
+         *  manifest in that directory is what the plan decides from. */
+        contents?: string;
     }
     interface ApplyOptions extends Options {
         packageManager?: CiService.PackageManager;
@@ -50,10 +55,6 @@ export declare namespace PublishService {
         access?: 'public' | 'restricted';
         /** `npm publish --otp <otp>` - a 2FA one-time password, for registries that require it. */
         otp?: string;
-        /** Subdirectory to publish from, relative to the package's own directory - only consulted when
-         *  the package doesn't already declare its own `package.json` `publishConfig.directory` (npm's
-         *  native mechanism for this, which always wins when present). */
-        contents?: string;
     }
     /** One package's outcome in a publish plan - see `getPlan`. */
     interface Entry {
@@ -101,7 +102,11 @@ export declare namespace PublishService {
      * queries it to decide, so it's safe to call any time, including as the plan a bare `rman
      * publish` shows before asking for confirmation.
      *
-     * A `private: true` package is always `'skip'`ped outright. Each remaining package's **dist-tag**
+     * **Whether a package is private is decided from the manifest that would be published.** From a
+     * build directory that is the one `publish` derives (see `derivePublishManifest`): `private` there
+     * only when the source has it and no `publishConfig`. In place it is the source's own. A build
+     * directory that is missing or holds nothing but a `package.json` is an `'error'`: nothing has been
+     * built to publish. Each remaining package's **dist-tag**
      * is settled next (`distTagFor`): usually derived from the version itself, `'error'` in the two
      * cases with nothing to derive - that one is about the invocation rather than the package, so it
      * is answered before anything touches the network. A package with uncommitted local changes is

package/builtins/platforms/node/services/publish.service.js

@@ -72,21 +72,19 @@ function preparePublishManifest(pkg, publishDir, packagesByName) {
  *   builds a native module on install. The rest (`build`, `test`, `prepare`, ...) never reach the
  *   consumer - `prepare` runs for a git dependency, which builds from the repository, not from this
  *   tarball.
- * - `private` - it is a statement about the **source tree**, not about the artifact derived from it,
- *   and a manifest being published is by definition not private. rman's own gate normally stops a
- *   private package before this runs, so the line looks unreachable; it is not, because `private`
- *   is also how a repository keeps a stray `npm publish` out of the package directory while
- *   publishing `build/` on purpose. That is a real configuration - this repository ran it until
- *   `rman publish` became its own release path and the gate started refusing the thing it ships.
- *   A narrower guard (`prepublishOnly`, which never reaches a consumer either) says the same thing
- *   without claiming the artifact is unpublishable.
+ * - `private` - **only when the package declares a `publishConfig`**. A package configured to be
+ *   published that is also `private` is guarding its source tree against a stray `npm publish`,
+ *   not refusing to ship; one with no `publishConfig` means it, and keeps the flag. `getPlan`
+ *   decides from the manifest this produces, so the rule here *is* the publish rule - a preset
+ *   writing the build directory's manifest must apply the same one.
  * - `publishConfig.directory` - it pointed *here*; kept, it would point one level deeper again.
  */
 function derivePublishManifest(pkg, packagesByName) {
     const json = structuredClone(pkg.manifest.raw);
     resolveWorkspaceRanges(json, packagesByName);
     delete json.devDependencies;
-    delete json.private;
+    if (json.publishConfig)
+        delete json.private;
     if (json.scripts) {
         const kept = Object.fromEntries(Object.entries(json.scripts).filter(([name]) => CONSUMER_SCRIPTS.has(name)));
         if (Object.keys(kept).length)
@@ -129,7 +127,11 @@ export var PublishService;
      * queries it to decide, so it's safe to call any time, including as the plan a bare `rman
      * publish` shows before asking for confirmation.
      *
-     * A `private: true` package is always `'skip'`ped outright. Each remaining package's **dist-tag**
+     * **Whether a package is private is decided from the manifest that would be published.** From a
+     * build directory that is the one `publish` derives (see `derivePublishManifest`): `private` there
+     * only when the source has it and no `publishConfig`. In place it is the source's own. A build
+     * directory that is missing or holds nothing but a `package.json` is an `'error'`: nothing has been
+     * built to publish. Each remaining package's **dist-tag**
      * is settled next (`distTagFor`): usually derived from the version itself, `'error'` in the two
      * cases with nothing to derive - that one is about the invocation rather than the package, so it
      * is answered before anything touches the network. A package with uncommitted local changes is
@@ -187,7 +189,19 @@ export var PublishService;
                     reason: 'excluded via .rmanrc "publish.skip"',
                 });
             }
-            else if (pkg.isPrivate) {
+            else if (privateBySource(pkg)) {
+                entries.set(pkg.name, { package: pkg, version: pkg.version, status: 'skip', reason: 'private package' });
+            }
+            else if (!hasBuildOutput(pkg, options.contents)) {
+                const dir = path.relative(pkg.dirname, resolvePublishDir(pkg, options.contents)) || '.';
+                entries.set(pkg.name, {
+                    package: pkg,
+                    version: pkg.version,
+                    status: 'error',
+                    reason: `nothing to publish in "${dir}" - it is missing or empty; build the package first`,
+                });
+            }
+            else if (publishesInPlace(pkg, options.contents) && pkg.manifest.raw.private) {
                 entries.set(pkg.name, { package: pkg, version: pkg.version, status: 'skip', reason: 'private package' });
             }
             else if (distTag.error) {
@@ -310,6 +324,41 @@ function resolvePublishDir(pkg, contentsOverride) {
     const rel = (typeof native === 'string' && native) || configured || contentsOverride;
     return rel ? path.resolve(pkg.dirname, rel) : pkg.dirname;
 }
+/** `private` in the source with no `publishConfig` - private in every manifest derived from it too. */
+/* **Decided from the manifest `npm publish` reads, which rman writes.** Publishing from a build
+ * directory, that is `derivePublishManifest`'s output - written over whatever is there at publish time
+ * - so `private` is the source's, kept only without a `publishConfig`. Reported from
+ * `postgrejs-kysely`: its source carried `private: true` as a guard against a stray `npm publish`,
+ * the plan answered `skip - private package`, and version, tag and GitHub release went through with
+ * nothing on the registry.
+ *
+ * **2.11.1 read `build/package.json` instead, and that file is not what is published.** It is
+ * whatever the build left there - the shared preset writes one, but only from the build `after` step
+ * a package can replace, and `@opra/common`/`@opra/client` replace it with their own esbuild step. Both
+ * had 625 and 52 built files and no `package.json`, the plan answered `error` for both, and opra's
+ * release stopped after the version had been pushed.
+ *
+ * Asked before the build is looked for, so an unbuilt private package is skipped rather than
+ * reported as unbuilt: opra's examples inherit `publish.npm.directory` and skip their build. */
+function privateBySource(pkg) {
+    return !!pkg.manifest.raw.private && !pkg.manifest.raw.publishConfig;
+}
+/** Whether `pkg` is published from its own directory, whose `package.json` is then the manifest. */
+/* In place, `private` is the source's whatever `publishConfig` says - npm refuses to publish it. */
+function publishesInPlace(pkg, contentsOverride) {
+    return path.resolve(resolvePublishDir(pkg, contentsOverride)) === path.resolve(pkg.dirname);
+}
+/** Whether the directory `pkg` is published from holds something to publish - anything besides a
+ *  `package.json`, which `publish` writes itself. Always true in place. */
+/* Without it `applyPlan` creates the directory, writes the derived manifest and publishes a tarball
+ * holding nothing else. Not "has a package.json": that is the build's to write or not (see
+ * `privateBySource`). */
+function hasBuildOutput(pkg, contentsOverride) {
+    if (publishesInPlace(pkg, contentsOverride))
+        return true;
+    const dir = resolvePublishDir(pkg, contentsOverride);
+    return fs.existsSync(dir) && fs.readdirSync(dir).some(name => name !== 'package.json');
+}
 /**
  * Which registry a package's own version is asked about, and published to.
  *

package/builtins/publish-targets/npm/npm-publish-target.js

@@ -84,7 +84,6 @@ export class NpmPublishTarget {
             packageManager: ctx.args.packageManager,
             access: ctx.args.access,
             otp: ctx.args.otp,
-            contents: ctx.args.contents,
         });
     }
     /** The shared filters plus the two flags both halves need - read here rather than in the
@@ -103,6 +102,9 @@ export class NpmPublishTarget {
              *  flag was not given, so each package's own `publish.npm.staged` still decides - `false`
              *  here would mean `--no-staged` and silently overrule the config. */
             staged: ctx.args.staged,
+            /** The plan decides from the manifest in the directory being published, so it has to know
+             *  which directory that is. */
+            contents: ctx.args.contents,
         };
     }
 }

package/commands/publish.command.js

@@ -286,8 +286,11 @@ function printApplied(applied, plan, label) {
     return failed;
 }
 /** The `logged` convention: printed here, so `runCli`'s catch does not print it a second time. */
+/* On stderr, because under `--json` stdout is one JSON document: measured on opra's release, the
+ * failure line printed below the plan and a reader parsing it got `Unexpected non-whitespace
+ * character after JSON`. */
 function logged(message) {
-    console.log(colors.red(message));
+    console.error(colors.red(message));
     const err = new Error(message);
     err.logged = true;
     return err;

package/constants.js

@@ -1 +1 @@
-export const version = '2.11.0';
+export const version = '2.11.2';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rman",
   "description": "Repository manager",
-  "version": "2.11.0",
+  "version": "2.11.2",
   "author": "Panates",
   "license": "MIT",
   "dependencies": {