#!/usr/bin/env bun/** * Publishes the public @executor-js/* workspace packages to npm. * * Walks a hard-coded list of publishable package directories, determines the * dist-tag from the version string (anything containing `-` is treated as beta), * and packs + publishes each package whose current version is not already on npm. * * Invoked from `.github/workflows/release.yml` via the `publish:` input on * changesets/action after the Version Packages PR has been merged, and locally * via `bun run release:publish:packages` (or `--dry-run`). */import { $ } from "bun";import { existsSync } from "node:fs";import { readdir, readFile, rm, writeFile } from "node:fs/promises";import { dirname, join, resolve } from "node:path";import { fileURLToPath } from "node:url"; type Channel = "latest" | "beta"; const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), ".."); const PACKAGE_SCOPE = "@executor-js"; /** * Workspace-relative paths of the public packages. Kept explicit so a new * directory under `packages/plugins/` does not accidentally ship to npm. */const PUBLIC_PACKAGE_DIRS = [  "packages/core/fumadb",  "packages/kernel/core",  "packages/kernel/runtime-quickjs",  "packages/core/sdk",  "packages/core/config",  "packages/core/execution",  "packages/core/cli",  "packages/plugins/example",  "packages/plugins/file-secrets",  "packages/plugins/graphql",  "packages/plugins/keychain",  "packages/plugins/mcp",  "packages/plugins/onepassword",  "packages/plugins/openapi",] as const; const parseArgs = (argv: ReadonlyArray<string>): { dryRun: boolean; prepareOnly: boolean } => {  let dryRun = false;  let prepareOnly = false;  for (const arg of argv) {    if (arg === "--dry-run") {      dryRun = true;      continue;    }    if (arg === "--prepare-only") {      prepareOnly = true;      continue;    }    throw new Error(`Unknown argument: ${arg}`);  }  return { dryRun, prepareOnly };}; const resolveChannel = (version: string): Channel => (version.includes("-") ? "beta" : "latest"); const readPackageMeta = async (pkgDir: string) => {  const pkgJsonPath = join(pkgDir, "package.json");  const pkg = (await Bun.file(pkgJsonPath).json()) as {    name?: string;    version?: string;    private?: boolean;  };   if (!pkg.name || !pkg.version) {    throw new Error(`Missing name/version in ${pkgJsonPath}`);  }  if (pkg.private === true) {    throw new Error(`${pkg.name} is marked private and cannot be published`);  }   return { name: pkg.name, version: pkg.version };}; const packageAlreadyPublished = async (name: string, version: string): Promise<boolean> => {  const proc = Bun.spawn(["npm", "view", `${name}@${version}`, "version"], {    stdio: ["ignore", "ignore", "ignore"],  });  return (await proc.exited) === 0;}; type DependencyBlock = Record<string, string>;type PeerDependenciesMeta = Record<string, { optional?: boolean }>;type MutablePackageJson = {  name?: string;  dependencies?: DependencyBlock;  devDependencies?: DependencyBlock;  peerDependencies?: DependencyBlock;  peerDependenciesMeta?: PeerDependenciesMeta;  optionalDependencies?: DependencyBlock;  [key: string]: unknown;}; /** * Resolves `workspace:*` dependencies between public packages to concrete * versions before packing. Returns a restore function that reverts package.json. * * Workspace-only `@executor-js/*` peer deps (e.g. `@executor-js/api`, * `@executor-js/react`) that aren't in `publishable` are stripped from * `peerDependencies` (and `peerDependenciesMeta`) entirely — they don't * exist on npm, so leaving them in the packed manifest would emit * install-time warnings for unresolvable packages. */const applyWorkspaceVersions = async (  pkgDir: string,  publishable: ReadonlySet<string>,  publishableVersions: ReadonlyMap<string, string>,): Promise<() => Promise<void>> => {  const isInternalScope = (key: string): boolean => key.startsWith(`${PACKAGE_SCOPE}/`);   const renameDepBlock = (block: DependencyBlock | undefined): DependencyBlock | undefined => {    if (!block) return block;    const next: DependencyBlock = {};    let mutated = false;    for (const [key, value] of Object.entries(block)) {      if (publishable.has(key) && value.startsWith("workspace:")) {        next[key] = publishableVersions.get(key) ?? value;        mutated = true;      } else if (isInternalScope(key) && !publishable.has(key)) {        // Workspace-only `@executor-js/*` regular dep that we don't        // publish (e.g. `@executor-js/api`). Strip it: it's not in the        // shipped runtime entries (those imports live in        // `src/api/*` / `src/react/*` which don't make it into the        // packed dist), and leaving it in would 404 at install time.        mutated = true;      } else {        next[key] = value;      }    }    return mutated ? next : block;  };   /**   * Peer-deps variant of `renameDepBlock`: resolve workspace specifiers for   * publishable peers, but DROP non-publishable `@executor-js/*` peers.   * They reference workspace-only packages (`@executor-js/api`,   * `@executor-js/react`) that don't exist on npm, so leaving them in   * the packed manifest emits install-time warnings for unresolvable   * packages. Non-`@executor-js` peers (`react`, `@tanstack/*`,   * `@effect-atom/*`, etc.) are real npm packages and pass through   * unchanged.   */  const renamePeerDepBlock = (block: DependencyBlock | undefined): DependencyBlock | undefined => {    if (!block) return block;    const next: DependencyBlock = {};    let mutated = false;    for (const [key, value] of Object.entries(block)) {      if (publishable.has(key)) {        next[key] = value.startsWith("workspace:")          ? (publishableVersions.get(key) ?? value)          : value;        if (next[key] !== value) mutated = true;      } else if (isInternalScope(key)) {        // Workspace-only `@executor-js/*` peer that we don't publish —        // strip it so the packed tarball doesn't reference an        // npm package that doesn't exist.        mutated = true;      } else {        next[key] = value;      }    }    return mutated ? next : block;  };   /**   * Strips `peerDependenciesMeta` entries that target an   * `@executor-js/*` peer we don't publish, mirroring `renamePeerDepBlock`   * so the meta block can't drift out of sync with the deps block.   */  const renamePeerMetaBlock = (    block: PeerDependenciesMeta | undefined,  ): PeerDependenciesMeta | undefined => {    if (!block) return block;    const next: PeerDependenciesMeta = {};    let mutated = false;    for (const [key, value] of Object.entries(block)) {      if (publishable.has(key)) {        next[key] = value;      } else if (isInternalScope(key)) {        mutated = true;      } else {        next[key] = value;      }    }    return mutated ? next : block;  };   const pkgJsonPath = join(pkgDir, "package.json");  const original = await readFile(pkgJsonPath, "utf8");  const pkg = JSON.parse(original) as MutablePackageJson;  pkg.dependencies = renameDepBlock(pkg.dependencies);  pkg.devDependencies = renameDepBlock(pkg.devDependencies);  pkg.peerDependencies = renamePeerDepBlock(pkg.peerDependencies);  pkg.peerDependenciesMeta = renamePeerMetaBlock(pkg.peerDependenciesMeta);  pkg.optionalDependencies = renameDepBlock(pkg.optionalDependencies);  const pkgNext = `${JSON.stringify(pkg, null, 2)}\n`;  if (pkgNext !== original) {    await writeFile(pkgJsonPath, pkgNext);    return async () => {      await writeFile(pkgJsonPath, original);    };  }  return async () => {};}; /** * Applies `publishConfig` field overrides to package.json in place, returning a * function that restores the original file. `bun pm pack` does not substitute * `publishConfig.exports` / `publishConfig.main` etc at pack time (npm does, * but only for a subset of fields and only for `npm pack`), so we rewrite the * file ourselves so the packed tarball has the correct `exports` pointing at * `dist/` instead of the dev-time `src/index.ts`. */const applyPublishConfig = async (pkgDir: string): Promise<() => Promise<void>> => {  const pkgJsonPath = join(pkgDir, "package.json");  const original = await readFile(pkgJsonPath, "utf8");  const parsed = JSON.parse(original) as {    publishConfig?: Record<string, unknown>;    [key: string]: unknown;  };   const publishConfig = parsed.publishConfig;  if (!publishConfig || typeof publishConfig !== "object") {    return async () => {};  }   // Fields we allow publishConfig to override. `access`/`tag`/`registry` are  // real npm publish-time config keys — they must NOT be hoisted into the  // top-level manifest.  const overridable = new Set([    "exports",    "main",    "module",    "types",    "typings",    "bin",    "browser",    "files",  ]);   const nextPublishConfig: Record<string, unknown> = {};  let mutated = false;  for (const [key, value] of Object.entries(publishConfig)) {    if (overridable.has(key)) {      parsed[key] = value;      mutated = true;    } else {      nextPublishConfig[key] = value;    }  }   if (!mutated) {    return async () => {};  }   if (Object.keys(nextPublishConfig).length === 0) {    delete parsed.publishConfig;  } else {    parsed.publishConfig = nextPublishConfig;  }   await writeFile(pkgJsonPath, `${JSON.stringify(parsed, null, 2)}\n`);  return async () => {    await writeFile(pkgJsonPath, original);  };}; type PackedPackage = {  readonly pkgDir: string;  readonly name: string;  readonly version: string;  readonly channel: Channel;  readonly tarball: string;}; const packPackage = async (  pkgDir: string,  dryRun: boolean,  publishable: ReadonlySet<string>,  publishableVersions: ReadonlyMap<string, string>,): Promise<PackedPackage> => {  const { name, version } = await readPackageMeta(pkgDir);  const channel = resolveChannel(version);   if (!existsSync(join(pkgDir, "dist"))) {    throw new Error(`Missing dist/ in ${pkgDir}. Did you run 'bun run build:packages'?`);  }   console.log(`[pack] ${name}@${version} (${channel})${dryRun ? " [dry-run]" : ""}`);   // Clean any stale tarballs from previous runs so our readdir finds exactly  // the archive produced by the pack below.  const stale = (await readdir(pkgDir)).filter((entry) => entry.endsWith(".tgz"));  for (const entry of stale) {    await rm(join(pkgDir, entry), { force: true });  }   const restoreWorkspaceVersions = await applyWorkspaceVersions(    pkgDir,    publishable,    publishableVersions,  );  const restorePublishConfig = await applyPublishConfig(pkgDir);  try {    await $`bun pm pack`.cwd(pkgDir);  } finally {    await restorePublishConfig();    await restoreWorkspaceVersions();  }   const produced = (await readdir(pkgDir)).filter((entry) => entry.endsWith(".tgz"));  if (produced.length !== 1) {    throw new Error(      `Expected exactly 1 .tgz in ${pkgDir}, found ${produced.length}: ${produced.join(", ")}`,    );  }   return { pkgDir, name, version, channel, tarball: produced[0]! };}; const publishPacked = async (packed: PackedPackage) => {  // Skip publishing already-shipped versions. The pack still ran above so  // smoke tests / pkg-pr-new previews always have a fresh tarball.  if (await packageAlreadyPublished(packed.name, packed.version)) {    console.log(`[skip] ${packed.name}@${packed.version} already on npm`);    return;  }   console.log(`[publish] ${packed.name}@${packed.version} (${packed.channel})`);   const args = ["publish", packed.tarball, "--access", "public", "--tag", packed.channel];  if (process.env.GITHUB_ACTIONS === "true") {    args.push("--provenance");  }   // Buffer output and replay it prefixed: several publishes run at once and  // interleaved npm output is unreadable.  const result = await $`npm ${args}`.cwd(packed.pkgDir).nothrow().quiet();  const output = `${result.stdout.toString()}${result.stderr.toString()}`.trim();  if (output.length > 0) {    console.log(output.replace(/^/gm, `[${packed.name}] `));  }  if (result.exitCode !== 0) {    throw new Error(`npm publish failed for ${packed.name} (exit ${result.exitCode})`);  }}; /** Publish concurrently: these are distinct packages, so no two publishes *  touch the same npm packument (the 409 hazard that forces the executor CLI *  platform variants to publish serially does not apply here). Each publish *  is network + sigstore dominated (~15-25s), so this is where the release *  job's minutes go. */const PUBLISH_CONCURRENCY = 4; const publishAll = async (packed: ReadonlyArray<PackedPackage>) => {  const queue = [...packed];  const failures: string[] = [];   const workers = Array.from({ length: Math.min(PUBLISH_CONCURRENCY, queue.length) }, async () => {    for (let next = queue.shift(); next !== undefined; next = queue.shift()) {      try {        await publishPacked(next);      } catch (error) {        failures.push(error instanceof Error ? error.message : String(error));      }    }  });  await Promise.all(workers);   if (failures.length > 0) {    throw new Error(`${failures.length} package(s) failed to publish:\n${failures.join("\n")}`);  }}; /** * Rewrite-in-place mode for the pkg.pr.new preview workflow. pkg-pr-new runs * `bun pm pack` against each workspace package directly, which can't see our * `publishConfig.exports` overrides or resolve `workspace:*` references. This * walks every public package, applies the same rewrites `publishPackage` * does, and intentionally leaves them mutated — the CI job is ephemeral and * the workflow tears down right after pkg-pr-new finishes. */const prepareOnePackage = async (  pkgDir: string,  publishable: ReadonlySet<string>,  publishableVersions: ReadonlyMap<string, string>,) => {  const { name, version } = await readPackageMeta(pkgDir);  if (!existsSync(join(pkgDir, "dist"))) {    throw new Error(`Missing dist/ in ${pkgDir}. Did you run 'bun run build:packages'?`);  }  console.log(`[prepare] ${name}@${version}`);  await applyWorkspaceVersions(pkgDir, publishable, publishableVersions);  await applyPublishConfig(pkgDir);}; const main = async () => {  const { dryRun, prepareOnly } = parseArgs(process.argv.slice(2));   // Each package's own version determines its dist-tag (pre-release versions  // with `-` publish to `beta`, everything else to `latest`). Packages are  // only skipped when their current version is already on npm.  const mode = prepareOnly ? " [prepare-only]" : dryRun ? " [dry-run]" : "";  console.log(`Publishing ${PACKAGE_SCOPE} packages${mode}`);   await $`bun run build:packages`.cwd(repoRoot);   // Snapshot the public package names and versions up front so public  // workspace dependencies can be written as exact versions in packed tarballs.  const publishable = new Set<string>();  const publishableVersions = new Map<string, string>();  for (const relDir of PUBLIC_PACKAGE_DIRS) {    const pkg = await readPackageMeta(join(repoRoot, relDir));    publishable.add(pkg.name);    publishableVersions.set(pkg.name, pkg.version);  }   if (prepareOnly) {    for (const relDir of PUBLIC_PACKAGE_DIRS) {      await prepareOnePackage(join(repoRoot, relDir), publishable, publishableVersions);    }    return;  }   // Pack sequentially: packing rewrites each package.json in place and `bun  // pm pack` resolves against the shared workspace tree, so overlapping packs  // could observe each other's temporary manifests.  const packed: PackedPackage[] = [];  for (const relDir of PUBLIC_PACKAGE_DIRS) {    packed.push(      await packPackage(join(repoRoot, relDir), dryRun, publishable, publishableVersions),    );  }   if (dryRun) {    return;  }   await publishAll(packed);}; await main();