rman 2.11.1 → 2.11.3

package/builtins/platforms/node/services/publish.service.d.ts

@@ -102,11 +102,11 @@ export declare namespace PublishService {
      * queries it to decide, so it's safe to call any time, including as the plan a bare `rman
      * publish` shows before asking for confirmation.
      *
-     * **Whether a package is private is read from the manifest that would be published** - the one in
-     * its build directory when it publishes from one, its own otherwise. A build directory with no
-     * `package.json` is an `'error'`: nothing has been built to publish. A package `private` in its
-     * source with no `publishConfig` is skipped before that is asked, since it stays private in any
-     * manifest derived from it. Each remaining package's **dist-tag**
+     * **Whether a package is private is decided from the manifest that would be published.** From a
+     * build directory that is the one `publish` derives (see `derivePublishManifest`): `private` there
+     * only when the source has it and no `publishConfig`. In place it is the source's own. A build
+     * directory that is missing or holds nothing but a `package.json` is an `'error'`: nothing has been
+     * built to publish. Each remaining package's **dist-tag**
      * is settled next (`distTagFor`): usually derived from the version itself, `'error'` in the two
      * cases with nothing to derive - that one is about the invocation rather than the package, so it
      * is answered before anything touches the network. A package with uncommitted local changes is
@@ -136,10 +136,12 @@ export declare namespace PublishService {
      * landed on the registry first, and publishing is rare enough (once per release) that the
      * simplicity is worth more than the parallelism `run` gets from `power-tasks`.
      *
-     * If a package fails, every other still-pending entry depending on it (transitively) is marked
-     * `'error'` too and never attempted - publishing a package whose own new dependency range points
-     * at a version that never actually reached the registry would hand consumers a broken install.
-     * A package's own failure doesn't stop unrelated packages elsewhere in the plan, though.
+     * If a package fails, every other still-pending entry that **a consumer's install needs it for**
+     * (transitively) is marked `'error'` too and never attempted - publishing a package whose own new
+     * dependency range points at a version that never actually reached the registry would hand
+     * consumers a broken install. A package's own failure doesn't stop unrelated packages elsewhere in
+     * the plan, though, nor one that lists it only where an install does not need it (see
+     * `consumerNeeds`).
      */
     function applyPlan(repository: Repository, plan: Entry[], options?: ApplyOptions): Promise<Entry[]>;
 }

package/builtins/platforms/node/services/publish.service.js

@@ -127,11 +127,11 @@ export var PublishService;
      * queries it to decide, so it's safe to call any time, including as the plan a bare `rman
      * publish` shows before asking for confirmation.
      *
-     * **Whether a package is private is read from the manifest that would be published** - the one in
-     * its build directory when it publishes from one, its own otherwise. A build directory with no
-     * `package.json` is an `'error'`: nothing has been built to publish. A package `private` in its
-     * source with no `publishConfig` is skipped before that is asked, since it stays private in any
-     * manifest derived from it. Each remaining package's **dist-tag**
+     * **Whether a package is private is decided from the manifest that would be published.** From a
+     * build directory that is the one `publish` derives (see `derivePublishManifest`): `private` there
+     * only when the source has it and no `publishConfig`. In place it is the source's own. A build
+     * directory that is missing or holds nothing but a `package.json` is an `'error'`: nothing has been
+     * built to publish. Each remaining package's **dist-tag**
      * is settled next (`distTagFor`): usually derived from the version itself, `'error'` in the two
      * cases with nothing to derive - that one is about the invocation rather than the package, so it
      * is answered before anything touches the network. A package with uncommitted local changes is
@@ -192,16 +192,16 @@ export var PublishService;
             else if (privateBySource(pkg)) {
                 entries.set(pkg.name, { package: pkg, version: pkg.version, status: 'skip', reason: 'private package' });
             }
-            else if (!fs.existsSync(path.join(resolvePublishDir(pkg, options.contents), 'package.json'))) {
+            else if (!hasBuildOutput(pkg, options.contents)) {
                 const dir = path.relative(pkg.dirname, resolvePublishDir(pkg, options.contents)) || '.';
                 entries.set(pkg.name, {
                     package: pkg,
                     version: pkg.version,
                     status: 'error',
-                    reason: `nothing to publish in "${dir}" - it has no package.json; build the package first`,
+                    reason: `nothing to publish in "${dir}" - it is missing or empty; build the package first`,
                 });
             }
-            else if (publishedManifestOf(pkg, options.contents).private) {
+            else if (publishesInPlace(pkg, options.contents) && pkg.manifest.raw.private) {
                 entries.set(pkg.name, { package: pkg, version: pkg.version, status: 'skip', reason: 'private package' });
             }
             else if (distTag.error) {
@@ -259,10 +259,12 @@ export var PublishService;
      * landed on the registry first, and publishing is rare enough (once per release) that the
      * simplicity is worth more than the parallelism `run` gets from `power-tasks`.
      *
-     * If a package fails, every other still-pending entry depending on it (transitively) is marked
-     * `'error'` too and never attempted - publishing a package whose own new dependency range points
-     * at a version that never actually reached the registry would hand consumers a broken install.
-     * A package's own failure doesn't stop unrelated packages elsewhere in the plan, though.
+     * If a package fails, every other still-pending entry that **a consumer's install needs it for**
+     * (transitively) is marked `'error'` too and never attempted - publishing a package whose own new
+     * dependency range points at a version that never actually reached the registry would hand
+     * consumers a broken install. A package's own failure doesn't stop unrelated packages elsewhere in
+     * the plan, though, nor one that lists it only where an install does not need it (see
+     * `consumerNeeds`).
      */
     async function applyPlan(repository, plan, options = {}) {
         const packageManager = CiService.resolvePackageManager(repository, options.packageManager);
@@ -279,7 +281,7 @@ export var PublishService;
                 continue;
             }
             const pkg = entry.package;
-            const blocker = pkg.dependencies.find(d => failed.has(d.name));
+            const blocker = pkg.dependencies.find(d => failed.has(d.name) && consumerNeeds(pkg, d.name));
             if (blocker) {
                 failed.add(pkg.name);
                 result.push({ ...entry, status: 'error', reason: `dependency "${blocker.name}" failed to publish` });
@@ -324,27 +326,59 @@ function resolvePublishDir(pkg, contentsOverride) {
     const rel = (typeof native === 'string' && native) || configured || contentsOverride;
     return rel ? path.resolve(pkg.dirname, rel) : pkg.dirname;
 }
-/** The manifest `npm publish` will read for `pkg` - its build directory's, or its own when it
- *  publishes in place. */
-/* **Decided from the artifact, not the source**, because the two disagree about `private` and only
- * one of them is published. Read before any build, the plan answered `skip - private package` for a
- * single-package repository whose source carries `private: true` as a guard against a stray
- * `npm publish` - while `derivePublishManifest` was removing that very flag from what it ships.
- * Reported from `postgrejs-kysely`: version, tag and GitHub release all went through, and the
- * registry got nothing. */
-function publishedManifestOf(pkg, contentsOverride) {
-    const dir = resolvePublishDir(pkg, contentsOverride);
-    if (path.resolve(dir) === path.resolve(pkg.dirname))
-        return pkg.manifest.raw;
-    return JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8'));
-}
-/** `private` in the source with no `publishConfig` - private in every manifest derived from it too,
- *  so it is known without a build. */
-/* Asked first so an unbuilt private package is skipped rather than reported as unbuilt: opra's
- * examples inherit `publish.npm.directory` from the shared preset and skip their build. */
+/** `private` in the source with no `publishConfig` - private in every manifest derived from it too. */
+/* **Decided from the manifest `npm publish` reads, which rman writes.** Publishing from a build
+ * directory, that is `derivePublishManifest`'s output - written over whatever is there at publish time
+ * - so `private` is the source's, kept only without a `publishConfig`. Reported from
+ * `postgrejs-kysely`: its source carried `private: true` as a guard against a stray `npm publish`,
+ * the plan answered `skip - private package`, and version, tag and GitHub release went through with
+ * nothing on the registry.
+ *
+ * **2.11.1 read `build/package.json` instead, and that file is not what is published.** It is
+ * whatever the build left there - the shared preset writes one, but only from the build `after` step
+ * a package can replace, and `@opra/common`/`@opra/client` replace it with their own esbuild step. Both
+ * had 625 and 52 built files and no `package.json`, the plan answered `error` for both, and opra's
+ * release stopped after the version had been pushed.
+ *
+ * Asked before the build is looked for, so an unbuilt private package is skipped rather than
+ * reported as unbuilt: opra's examples inherit `publish.npm.directory` and skip their build. */
 function privateBySource(pkg) {
     return !!pkg.manifest.raw.private && !pkg.manifest.raw.publishConfig;
 }
+/** Whether a consumer installing `pkg` needs `name` to resolve: a `dependencies` entry, or a peer
+ *  not marked optional. */
+/* **Not every edge blocks a publish**, and blocking on all of them cost a release. A failed publish
+ * stops its dependents because their published range would point at a version that is not there -
+ * which is only true of what reaches the consumer:
+ * - `devDependencies` are removed from the published manifest (`derivePublishManifest`);
+ * - an optional peer that cannot be satisfied does not fail an install;
+ * - `optionalDependencies` are the ones npm proceeds without "if it cannot be found or fails to
+ *   install" (npm's own documentation; not measured here).
+ * Measured on opra's 1.31.0 release: `@opra/api-ui` failed its first publish, and `@opra/http` -
+ * which lists it as an optional peer and a devDependency only - was blocked, taking elastic, mongodb
+ * and sqb with it, though none of their installs would have needed api-ui. */
+function consumerNeeds(pkg, name) {
+    const raw = pkg.manifest.raw;
+    if (raw.dependencies?.[name] !== undefined)
+        return true;
+    return raw.peerDependencies?.[name] !== undefined && !raw.peerDependenciesMeta?.[name]?.optional;
+}
+/** Whether `pkg` is published from its own directory, whose `package.json` is then the manifest. */
+/* In place, `private` is the source's whatever `publishConfig` says - npm refuses to publish it. */
+function publishesInPlace(pkg, contentsOverride) {
+    return path.resolve(resolvePublishDir(pkg, contentsOverride)) === path.resolve(pkg.dirname);
+}
+/** Whether the directory `pkg` is published from holds something to publish - anything besides a
+ *  `package.json`, which `publish` writes itself. Always true in place. */
+/* Without it `applyPlan` creates the directory, writes the derived manifest and publishes a tarball
+ * holding nothing else. Not "has a package.json": that is the build's to write or not (see
+ * `privateBySource`). */
+function hasBuildOutput(pkg, contentsOverride) {
+    if (publishesInPlace(pkg, contentsOverride))
+        return true;
+    const dir = resolvePublishDir(pkg, contentsOverride);
+    return fs.existsSync(dir) && fs.readdirSync(dir).some(name => name !== 'package.json');
+}
 /**
  * Which registry a package's own version is asked about, and published to.
  *

package/commands/publish.command.js

@@ -286,8 +286,11 @@ function printApplied(applied, plan, label) {
     return failed;
 }
 /** The `logged` convention: printed here, so `runCli`'s catch does not print it a second time. */
+/* On stderr, because under `--json` stdout is one JSON document: measured on opra's release, the
+ * failure line printed below the plan and a reader parsing it got `Unexpected non-whitespace
+ * character after JSON`. */
 function logged(message) {
-    console.log(colors.red(message));
+    console.error(colors.red(message));
     const err = new Error(message);
     err.logged = true;
     return err;

package/constants.js

@@ -1 +1 @@
-export const version = '2.11.1';
+export const version = '2.11.3';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rman",
   "description": "Repository manager",
-  "version": "2.11.1",
+  "version": "2.11.3",
   "author": "Panates",
   "license": "MIT",
   "dependencies": {