Check @geastack dependency ranges before publishing

[moersoy]

Problem

CLI 0.1.97 requires @geastack/targets ^0.1.97, but the newest version on npm is 0.1.95. The targets repo is not checked out under the collection root, so scripts/publish-private-packages.mjs found only cli and would have published it with a dependency nobody can install.

Change

Before anything is published, and also under --plan and --dry-run, every @geastack/* range in a selected package's dependencies and optionalDependencies
must be met in one of two ways:

1. Same publish: a package in this run has a local version that satisfies the range (^, ~, exact, >=). It is published first because of the existing dependency order. npm is not queried.
2. Already on npm: npm view <name>@<range> version finds a match. npm resolves the range itself, so no new dependency was added.

If neither holds, the script stops and nothing is published. The error says which case applies:

• the dependency is in this publish but at a version that does not match
• it was found locally but left out by --package / --from
• it has no checkout under the collection root

An npm query that fails for any other reason, such as a timeout, also stops the publish.

• --skip-dep-check skips the check.
• peerDependencies are not checked, matching how they are left out of the publish order.

Example against the current collection root:

error: unresolved @geastack dependencies:
  - @geastack/cli@0.1.97 needs @geastack/targets@^0.1.97
      npm has no version matching ^0.1.97 (latest: 0.1.95)
      @geastack/targets is not in this publish (no checkout under /Users/moe/Workspaces; pass --root or publish it first)
pass --skip-dep-check to publish anyway

Testing

• node --test test/publish-private-packages.test.mjs: 12/12 pass. The 9 new tests cover a range that resolves nowhere (in both --yes and --plan), a same-publish version that matches and one that does not, a dependency left out by --package, a range already on npm, an npm query failure, --skip-dep-check, and caret/tilde/exact semantics including 0.x and prereleases.
• The full npm test has unrelated failures in this checkout because node_modules
  is not installed (Cannot find package '@clack/prompts').

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 23ad1856-cc1a-4ea5-94d6-1cf0afb1a0a8

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA.
_{Posted by the CLA Assistant Lite bot.}

[moersoy]

I have read the CLA Document and I hereby sign the CLA