@akira-tl/forgerelay 0.9.4 → 0.10.1

package/scripts/ci/verify.mjs

@@ -14,6 +14,7 @@ runNpm(["run", "release:check"], "Release metadata");
 runNpm(["run", "typecheck"], "Typecheck");
 runNpm(["test"], "Full test suite");
 runNpm(["run", "build"], "Build");
+if (process.platform === "win32") runNpm(["run", "pwsh:accept"], "PowerShell 7 packaged acceptance");
 // The traffic audit is an end-to-end wire-budget check, not a platform feature
 // matrix. Run it once on Linux so regressions are gated without tripling the
 // 7677/7678 server exercise across every CI operating system.

package/scripts/release/release-gate.test.mjs

@@ -21,6 +21,7 @@ test("release tag Hook is a fast repository-state gate for common origin tag pus
     "git push origin v1.2.3",
     "git push --atomic origin v1.2.3",
     "git push origin refs/tags/v1.2.3",
+    "git push --delete origin v1.2.3",
     "git status && git push origin tag v1.2.3 && echo done",
   ]) {
     assert.match(command, matcher);

package/scripts/release-proof.mjs

@@ -6,6 +6,8 @@ import { dirname, join } from "node:path";
 
 const PROOF_VERSION = 1;
 const PROOF_RELATIVE_PATH = join("forgerelay", "release-proof.json");
+const DEFAULT_NPM_REGISTRY_URL = "https://registry.npmjs.org/";
+const DEFAULT_GITHUB_API_URL = "https://api.github.com/";
 
 function fail(message) {
   console.error(`Release proof failed: ${message}`);
@@ -21,12 +23,16 @@ function git(args, options = {}) {
   }).trim();
 }
 
-function packageVersion() {
+function packageMetadata() {
   const pkg = JSON.parse(readFileSync(join(process.cwd(), "package.json"), "utf8"));
   if (typeof pkg.version !== "string" || !pkg.version) {
     throw new Error("package.json must contain a version string");
   }
-  return pkg.version;
+  return pkg;
+}
+
+function packageVersion() {
+  return packageMetadata().version;
 }
 
 function requireDedicatedReleaseNotes(version) {
@@ -132,21 +138,81 @@ function hookTag() {
     || /(?:^|\s)\+(?:refs\/tags\/)?v\d+\.\d+\.\d+(?:-rc\.\d+)?(?=$|\s)/.test(pushCommand)) {
     throw new Error("force push is not allowed for release tags");
   }
-  if (/(?:^|\s)(?:-d|--delete)(?=$|\s)/.test(pushCommand)) {
-    throw new Error("deleting a release tag is not allowed");
-  }
+  const deleting = /(?:^|\s)(?:-d|--delete)(?=$|\s)/.test(pushCommand);
   const tagMatch = /(?:^|\s)(?:tag\s+)?(?:refs\/tags\/)?(v\d+\.\d+\.\d+(?:-rc\.\d+)?)(?=$|\s)/.exec(pushCommand);
   if (!tagMatch?.[1]) {
     throw new Error("release Hook payload does not contain a release tag push");
   }
-  return tagMatch[1];
+  return { tag: tagMatch[1], deleting };
 }
 
-function checkHookTag() {
+function githubRepositorySlug(repository) {
+  const raw = typeof repository === "string" ? repository : repository?.url;
+  if (typeof raw !== "string" || !raw.trim()) {
+    throw new Error("package.json must contain a GitHub repository URL before rebuilding a release tag");
+  }
+  const normalized = raw.trim().replace(/^git\+/, "").replace(/\.git$/, "");
+  const match = /github\.com(?::|\/)([^/\s]+\/[^/\s]+)$/.exec(normalized);
+  if (!match?.[1]) {
+    throw new Error(`unable to determine GitHub repository from package.json repository URL: ${raw}`);
+  }
+  return match[1];
+}
+
+function testEndpoint(name, fallback) {
+  if (process.env.NODE_ENV === "test" && process.env[name]) return process.env[name];
+  return fallback;
+}
+
+async function artifactExists(label, url, headers = {}) {
+  let response;
+  try {
+    response = await fetch(url, {
+      headers,
+      signal: AbortSignal.timeout(8_000),
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`unable to verify ${label} before deleting the release tag: ${detail}`);
+  }
+  if (response.status === 404) return false;
+  if (response.ok) return true;
+  throw new Error(`unable to verify ${label} before deleting the release tag: HTTP ${response.status}`);
+}
+
+async function assertReleaseTagMutable(tag, version) {
+  const pkg = packageMetadata();
+  if (typeof pkg.name !== "string" || !pkg.name) {
+    throw new Error("package.json must contain a package name before rebuilding a release tag");
+  }
+  const repository = githubRepositorySlug(pkg.repository);
+  const npmBase = testEndpoint("FORGERELAY_TEST_NPM_REGISTRY_URL", DEFAULT_NPM_REGISTRY_URL);
+  const githubBase = testEndpoint("FORGERELAY_TEST_GITHUB_API_URL", DEFAULT_GITHUB_API_URL);
+  const npmUrl = new URL(`${encodeURIComponent(pkg.name)}/${encodeURIComponent(version)}`, npmBase).toString();
+  const githubUrl = new URL(
+    `repos/${repository}/releases/tags/${encodeURIComponent(tag)}`,
+    githubBase,
+  ).toString();
+  const [npmPublished, githubReleased] = await Promise.all([
+    artifactExists(`npm package ${pkg.name}@${version}`, npmUrl),
+    artifactExists(`GitHub Release ${tag}`, githubUrl, {
+      Accept: "application/vnd.github+json",
+      "User-Agent": "ForgeRelay-release-tag-gate",
+    }),
+  ]);
+  if (npmPublished) {
+    throw new Error(`npm package ${pkg.name}@${version} already exists; release tag ${tag} is immutable`);
+  }
+  if (githubReleased) {
+    throw new Error(`GitHub Release ${tag} already exists; release tag ${tag} is immutable`);
+  }
+}
+
+async function checkHookTag() {
   assertReleaseTreeClean("pushing a release tag");
   const head = currentHead();
   const version = packageVersion();
-  const tag = hookTag();
+  const { tag, deleting } = hookTag();
   const expectedTag = `v${version}`;
 
   if (tag !== expectedTag) {
@@ -160,6 +226,16 @@ function checkHookTag() {
   } catch {
     throw new Error(`local tag ${tag} does not exist or does not resolve to a commit`);
   }
+
+  if (deleting) {
+    checkProof();
+    await assertReleaseTagMutable(tag, version);
+    console.log(
+      `Release tag rebuild gate OK: ${tag}; npm package and GitHub Release are absent, so the existing tag may be deleted and rebuilt.`,
+    );
+    return;
+  }
+
   if (tagHead !== head) {
     throw new Error(`tag ${tag} points to ${tagHead.slice(0, 12)}, but current HEAD is ${head.slice(0, 12)}`);
   }
@@ -171,7 +247,7 @@ const action = process.argv[2];
 try {
   if (action === "write") writeProof();
   else if (action === "check") checkProof();
-  else if (action === "check-hook") checkHookTag();
+  else if (action === "check-hook") await checkHookTag();
   else throw new Error("usage: node scripts/release-proof.mjs <write|check|check-hook>");
 } catch (error) {
   fail(error instanceof Error ? error.message : String(error));

package/scripts/release-proof.test.mjs

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -21,10 +22,36 @@ async function runProof(cwd, action, env = {}) {
   });
 }
 
+async function artifactApiEnv(t, { npmStatus = 404, githubStatus = 404 } = {}) {
+  const server = createServer((request, response) => {
+    if (request.url?.startsWith("/npm/")) response.statusCode = npmStatus;
+    else if (request.url?.startsWith("/github/")) response.statusCode = githubStatus;
+    else response.statusCode = 500;
+    response.end();
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  const address = server.address();
+  assert.ok(address && typeof address === "object");
+  const base = `http://127.0.0.1:${address.port}`;
+  return {
+    NODE_ENV: "test",
+    FORGERELAY_TEST_NPM_REGISTRY_URL: `${base}/npm/`,
+    FORGERELAY_TEST_GITHUB_API_URL: `${base}/github/`,
+  };
+}
+
 test("release tag hook gate uses repository facts instead of requiring a local proof", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "forgerelay-release-proof-"));
   t.after(() => rm(root, { recursive: true, force: true }));
-  await writeFile(join(root, "package.json"), JSON.stringify({ version: "1.2.3" }) + "\n");
+  await writeFile(join(root, "package.json"), JSON.stringify({
+    name: "@akira-tl/forgerelay",
+    version: "1.2.3",
+    repository: { url: "git+https://github.com/Akira-TL/forgerelay.git" },
+  }) + "\n");
   await mkdir(join(root, "docs", "releases"), { recursive: true });
   await writeFile(join(root, "docs", "releases", "v1.2.3.md"), "# v1.2.3\n\nDedicated notes.\n");
   await writeFile(join(root, "tracked.txt"), "verified\n");
@@ -93,6 +120,14 @@ test("release tag hook gate uses repository facts instead of requiring a local p
   await rm(join(root, "untracked.txt"));
   await git(root, ["add", "tracked.txt"]);
   await git(root, ["commit", "--allow-empty", "-m", "new head"]);
+  await runProof(root, "write");
+  const mutableEnv = await artifactApiEnv(t);
+  const deletion = await runProof(root, "check-hook", {
+    ...mutableEnv,
+    FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push --delete origin v1.2.3" }),
+  });
+  assert.match(deletion.stdout, /Release tag rebuild gate OK: v1\.2\.3/);
+
   await assert.rejects(
     () => runProof(root, "check-hook", {
       FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v1.2.3" }),
@@ -104,6 +139,49 @@ test("release tag hook gate uses repository facts instead of requiring a local p
   );
 });
 
+test("release tag hook gate refuses deletion after an irreversible release artifact exists", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "forgerelay-release-proof-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  await writeFile(join(root, "package.json"), JSON.stringify({
+    name: "@akira-tl/forgerelay",
+    version: "1.3.0",
+    repository: { url: "git+https://github.com/Akira-TL/forgerelay.git" },
+  }) + "\n");
+  await mkdir(join(root, "docs", "releases"), { recursive: true });
+  await writeFile(join(root, "docs", "releases", "v1.3.0.md"), "# v1.3.0\n\nDedicated notes.\n");
+  await git(root, ["init"]);
+  await git(root, ["config", "user.email", "proof@example.com"]);
+  await git(root, ["config", "user.name", "Release Proof Test"]);
+  await git(root, ["add", "."]);
+  await git(root, ["commit", "-m", "release 1.3.0"]);
+  await git(root, ["tag", "v1.3.0"]);
+  await runProof(root, "write");
+
+  const npmPublishedEnv = await artifactApiEnv(t, { npmStatus: 200, githubStatus: 404 });
+  await assert.rejects(
+    () => runProof(root, "check-hook", {
+      ...npmPublishedEnv,
+      FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push --delete origin v1.3.0" }),
+    }),
+    (error) => {
+      assert.match(String(error.stderr ?? error), /npm package .* already exists/);
+      return true;
+    },
+  );
+
+  const githubPublishedEnv = await artifactApiEnv(t, { npmStatus: 404, githubStatus: 200 });
+  await assert.rejects(
+    () => runProof(root, "check-hook", {
+      ...githubPublishedEnv,
+      FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push --delete origin v1.3.0" }),
+    }),
+    (error) => {
+      assert.match(String(error.stderr ?? error), /GitHub Release .* already exists/);
+      return true;
+    },
+  );
+});
+
 test("release tag hook gate rejects a matching tag when dedicated notes are missing", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "forgerelay-release-proof-"));
   t.after(() => rm(root, { recursive: true, force: true }));