@ankhorage/devtools 1.14.7 → 1.15.0

package/dist/features/apm-release-validation/adapters/outbound/readApmReleaseManifestAsync.js

@@ -0,0 +1,9 @@
+import { readFile } from 'node:fs/promises';
+import { isRecord } from '@ankhorage/utility/object';
+/*** Read a release-owned JSON object while rejecting malformed documents. */
+export async function readApmReleaseManifestAsync(filePath) {
+    const value = JSON.parse(await readFile(filePath, 'utf8'));
+    if (!isRecord(value))
+        throw new Error('APM release document must contain a JSON object.');
+    return value;
+}

package/dist/features/apm-release-validation/adapters/outbound/resolveApmReleaseCommandAsync.d.ts

@@ -0,0 +1,2 @@
+/*** Use Devtools' own built CLI for self-validation and the installed dependency binary in consumers. */
+export declare function resolveApmReleaseCommandAsync(targetDirectory: string): Promise<string>;

package/dist/features/apm-release-validation/adapters/outbound/resolveApmReleaseCommandAsync.js

@@ -0,0 +1,18 @@
+import { resolve } from 'node:path';
+import { readApmReleaseManifestAsync } from './readApmReleaseManifestAsync.js';
+/*** Use Devtools' own built CLI for self-validation and the installed dependency binary in consumers. */
+export async function resolveApmReleaseCommandAsync(targetDirectory) {
+    try {
+        const manifest = await readApmReleaseManifestAsync(resolve(targetDirectory, 'package.json'));
+        return manifest.name === '@ankhorage/devtools'
+            ? 'node ./dist/cli/bin/apm-release.js'
+            : CONSUMER_COMMAND;
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            return CONSUMER_COMMAND;
+        }
+        throw error;
+    }
+}
+const CONSUMER_COMMAND = './node_modules/.bin/ankhorage-apm-release';

package/dist/features/apm-release-validation/application/synchronizeApmReleaseMetadataAsync.d.ts

@@ -0,0 +1,3 @@
+import type { ApmReleaseDescriptorPort } from '../../../types/apm-release-validation.js';
+/*** Bind valid owner metadata to the selected candidate version; never silently skip malformed opt-in. */
+export declare function synchronizeApmReleaseMetadataAsync(port: ApmReleaseDescriptorPort): Promise<boolean>;

package/dist/features/apm-release-validation/application/synchronizeApmReleaseMetadataAsync.js

@@ -0,0 +1,29 @@
+import { validatePackageUpdateMetadata, validateUpdateDescriptor } from '@ankhorage/apm';
+import { isRecord } from '@ankhorage/utility/object';
+import { readApmReleaseMetadata } from '../utils/readApmReleaseMetadata.js';
+/*** Bind valid owner metadata to the selected candidate version; never silently skip malformed opt-in. */
+export async function synchronizeApmReleaseMetadataAsync(port) {
+    const manifest = await port.readPackageAsync();
+    const metadata = readApmReleaseMetadata(manifest);
+    if (metadata === undefined)
+        return false;
+    const discovery = validatePackageUpdateMetadata(metadata);
+    if (!discovery.valid || discovery.metadata === undefined)
+        throw new Error('Invalid APM discovery metadata.');
+    const descriptor = await port.readDescriptorAsync(discovery.metadata.descriptor);
+    const { name, version } = manifest;
+    if (typeof name !== 'string' ||
+        typeof version !== 'string' ||
+        !isRecord(descriptor.owner) ||
+        descriptor.owner.name !== name) {
+        throw new Error('APM release descriptor must belong to the package being versioned.');
+    }
+    const synchronized = { ...descriptor, owner: { ...descriptor.owner, version } };
+    const validation = validateUpdateDescriptor({
+        descriptor: synchronized,
+        expectedOwner: { name, version },
+    });
+    if (!validation.valid)
+        throw new Error(validation.blockers.map(({ code, reason }) => `${code}: ${reason}`).join('\n'));
+    return port.writeDescriptorAsync(discovery.metadata.descriptor, synchronized);
+}

package/dist/features/apm-release-validation/application/validateApmReleaseCandidate.d.ts

@@ -0,0 +1,11 @@
+import type { ApmPackedReleaseCandidate, ApmReleaseValidationOptions, ApmReleaseValidationResult } from '../../../types/apm-release-validation.js';
+/*** Validate packed owner evidence using the released APM protocol, never a copied schema.
+ * Opt-in packages declare ankh.apm with protocolVersion and a package-relative descriptor.
+ * No metadata means not applicable, not a claim that no migration is needed. The descriptor
+ * declares supported no-migration, required migration, or unsupported/manual history explicitly.
+ * Previous descriptors enforce immutable migration checksums and related descriptors validate
+ * cross-owner prerequisites. Package-owned source-to-target tests must also cover skipped versions,
+ * idempotency, interruption/recovery, and unsupported historical states.
+ * @readme
+ */
+export declare function validateApmReleaseCandidate(candidate: ApmPackedReleaseCandidate, options?: ApmReleaseValidationOptions): ApmReleaseValidationResult;

package/dist/features/apm-release-validation/application/validateApmReleaseCandidate.js

@@ -0,0 +1,76 @@
+import { createHash } from 'node:crypto';
+import { validatePackageUpdateMetadata, validateUpdateDescriptor, validateUpdateExtensionBinding, validateUpdateExtensionCapabilities, } from '@ankhorage/apm';
+import { readApmReleaseMetadata } from '../utils/readApmReleaseMetadata.js';
+/*** Validate packed owner evidence using the released APM protocol, never a copied schema.
+ * Opt-in packages declare ankh.apm with protocolVersion and a package-relative descriptor.
+ * No metadata means not applicable, not a claim that no migration is needed. The descriptor
+ * declares supported no-migration, required migration, or unsupported/manual history explicitly.
+ * Previous descriptors enforce immutable migration checksums and related descriptors validate
+ * cross-owner prerequisites. Package-owned source-to-target tests must also cover skipped versions,
+ * idempotency, interruption/recovery, and unsupported historical states.
+ * @readme
+ */
+export function validateApmReleaseCandidate(candidate, options = {}) {
+    const { name, version } = candidate.packageJson;
+    const identity = {
+        ...(typeof name === 'string' ? { packageName: name } : {}),
+        ...(typeof version === 'string' ? { packageVersion: version } : {}),
+        integrity: candidate.integrity,
+    };
+    const metadata = readApmReleaseMetadata(candidate.packageJson);
+    const integrityBlockers = options.expectedIntegrity !== undefined && options.expectedIntegrity !== candidate.integrity
+        ? ['release.integrity-mismatch: Packed bytes differ from the selected release artifact.']
+        : [];
+    if (metadata === undefined) {
+        return {
+            ...identity,
+            applicable: false,
+            valid: integrityBlockers.length === 0,
+            blockers: integrityBlockers,
+        };
+    }
+    const metadataValidation = validatePackageUpdateMetadata(metadata);
+    if (typeof name !== 'string' || !name || typeof version !== 'string' || !version) {
+        return result(identity, ['release.identity: Package must define name and exact version.']);
+    }
+    if (!metadataValidation.valid)
+        return result(identity, [...integrityBlockers, ...messages(metadataValidation.blockers)]);
+    const validation = validateUpdateDescriptor({
+        descriptor: candidate.descriptor,
+        expectedOwner: { name, version },
+        previousDescriptors: options.previousDescriptors,
+        relatedDescriptors: options.relatedDescriptors,
+    });
+    if (!validation.valid || validation.descriptor === undefined || integrityBlockers.length > 0) {
+        return result(identity, [...integrityBlockers, ...messages(validation.blockers)]);
+    }
+    return result(identity, extensionBlockers(candidate, validation.descriptor));
+}
+/*** Validate executable binding and required handlers after static metadata has passed. */
+function extensionBlockers(candidate, descriptor) {
+    if (descriptor.extension === undefined)
+        return [];
+    const artifact = {
+        role: 'target',
+        packageName: descriptor.owner.name,
+        version: descriptor.owner.version,
+        integrity: candidate.integrity,
+        descriptorDigest: createHash('sha256').update(candidate.descriptorSource).digest('hex'),
+    };
+    if (!isBoundExtension(artifact, candidate.extension)) {
+        return messages(validateUpdateExtensionBinding(artifact, candidate.extension));
+    }
+    return messages(validateUpdateExtensionCapabilities(descriptor, artifact, candidate.extension));
+}
+/*** Narrow unknown executable evidence only after the canonical runtime validator accepts it. */
+function isBoundExtension(artifact, value) {
+    return validateUpdateExtensionBinding(artifact, value).length === 0;
+}
+/*** Preserve structured candidate identity and canonical blocker reasons. */
+function result(identity, blockers) {
+    return { ...identity, applicable: true, valid: blockers.length === 0, blockers };
+}
+/*** Render the protocol's own diagnostics without reinterpreting their semantics. */
+function messages(blockers) {
+    return blockers.map(({ code, reason }) => `${code}: ${reason}`);
+}

package/dist/features/apm-release-validation/composition/synchronizeApmReleaseDescriptorAsync.d.ts

@@ -0,0 +1,2 @@
+/*** Compose descriptor version synchronization with the bounded Node filesystem adapter. */
+export declare function synchronizeApmReleaseDescriptorAsync(targetDirectory: string): Promise<boolean>;

package/dist/features/apm-release-validation/composition/synchronizeApmReleaseDescriptorAsync.js

@@ -0,0 +1,6 @@
+import { createApmReleaseDescriptorPort } from '../adapters/outbound/createApmReleaseDescriptorPort.js';
+import { synchronizeApmReleaseMetadataAsync } from '../application/synchronizeApmReleaseMetadataAsync.js';
+/*** Compose descriptor version synchronization with the bounded Node filesystem adapter. */
+export async function synchronizeApmReleaseDescriptorAsync(targetDirectory) {
+    return synchronizeApmReleaseMetadataAsync(createApmReleaseDescriptorPort(targetDirectory));
+}

package/dist/features/apm-release-validation/composition/validatePackedApmReleaseAsync.d.ts

@@ -0,0 +1,12 @@
+import type { ApmReleaseValidationOptions, ApmReleaseValidationResult } from '../../../types/apm-release-validation.js';
+/*** Validate script-free publish bytes and optionally retain that exact accepted archive.
+ * Release order is APM protocol, package-owner metadata/code, then consuming applications.
+ * Build after Changesets versioning and descriptor synchronization. Execute package-owned
+ * acceptance tests, then validate with explicit owner-code consent. The child probe uses the
+ * packed package's native public export resolution and installed dependencies, not omitted source.
+ * Consent permits trusted executable code; a child process is not a security sandbox.
+ * An artifactPath retains accepted bytes exclusively, so publication need not repack or rerun
+ * lifecycle scripts. expectedIntegrity rejects a stale candidate before any owner code loads.
+ * @readme
+ */
+export declare function validatePackedApmReleaseAsync(targetDirectory: string, options?: ApmReleaseValidationOptions): Promise<ApmReleaseValidationResult>;

package/dist/features/apm-release-validation/composition/validatePackedApmReleaseAsync.js

@@ -0,0 +1,14 @@
+import { inspectPackedApmReleaseCandidateAsync } from '../adapters/outbound/inspectPackedApmReleaseCandidateAsync.js';
+/*** Validate script-free publish bytes and optionally retain that exact accepted archive.
+ * Release order is APM protocol, package-owner metadata/code, then consuming applications.
+ * Build after Changesets versioning and descriptor synchronization. Execute package-owned
+ * acceptance tests, then validate with explicit owner-code consent. The child probe uses the
+ * packed package's native public export resolution and installed dependencies, not omitted source.
+ * Consent permits trusted executable code; a child process is not a security sandbox.
+ * An artifactPath retains accepted bytes exclusively, so publication need not repack or rerun
+ * lifecycle scripts. expectedIntegrity rejects a stale candidate before any owner code loads.
+ * @readme
+ */
+export async function validatePackedApmReleaseAsync(targetDirectory, options = {}) {
+    return inspectPackedApmReleaseCandidateAsync(targetDirectory, options);
+}

package/dist/features/apm-release-validation/utils/readApmReleaseMetadata.d.ts

@@ -0,0 +1,2 @@
+/*** Read opt-in owner metadata without copying the APM discovery schema. */
+export declare function readApmReleaseMetadata(manifest: Readonly<Record<string, unknown>>): unknown;

package/dist/features/apm-release-validation/utils/readApmReleaseMetadata.js

@@ -0,0 +1,6 @@
+import { isRecord, readOwnProperty } from '@ankhorage/utility/object';
+/*** Read opt-in owner metadata without copying the APM discovery schema. */
+export function readApmReleaseMetadata(manifest) {
+    const ankh = readOwnProperty(manifest, 'ankh');
+    return isRecord(ankh) ? readOwnProperty(ankh, 'apm') : undefined;
+}

package/dist/internal/readmeDocs.js

@@ -26,7 +26,7 @@ const REQUIRED_README_SNIPPETS = [
     'devtools.vscode.sync',
     '--dry-run',
     "profile: 'auto'",
-    '@ankhorage/utility/project',
+    '@ankhorage/project-detector',
     'ankhorage-changeset',
     'without creating a second Version Packages pull request',
     'chore(release)',

package/dist/owner/synchronizeRenovateOwnerAsync.js

@@ -3,6 +3,7 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { applyBunRuntimePolicy } from '../policy/applyBunRuntimePolicy.js';
 import { nodeRuntimePolicy } from '../policy/bunRuntimePolicy.js';
+import { renderBunPolicyDocumentation } from '../policy/renderBunPolicyDocumentation.js';
 import { renderRenovateWorkflowAsync } from '../tools/workflows/renderRenovateWorkflowAsync.js';
 import { renderWorkflowAsync } from '../tools/workflows/renderWorkflowAsync.js';
 export async function synchronizeRenovateOwnerAsync(operation, targetDirectory, options = {}) {
@@ -57,7 +58,7 @@ async function createManagedDefinitionsAsync(targetDirectory, policy) {
         },
         {
             relativePath: 'README.md',
-            contents: replaceReadmePolicy(readme, policy),
+            contents: renderBunPolicyDocumentation(readme, policy),
         },
     ];
 }
@@ -96,26 +97,6 @@ async function readTargetBunPolicyAsync(targetDirectory) {
         version,
     };
 }
-function replaceReadmePolicy(readme, policy) {
-    const startIndex = readme.indexOf(README_POLICY_START);
-    const endIndex = readme.indexOf(README_POLICY_END);
-    if (startIndex === -1 || endIndex === -1 || endIndex < startIndex) {
-        throw new Error('README.md must contain one ordered Devtools Bun policy marker pair.');
-    }
-    if (readme.includes(README_POLICY_START, startIndex + README_POLICY_START.length) ||
-        readme.includes(README_POLICY_END, endIndex + README_POLICY_END.length)) {
-        throw new Error('README.md must contain exactly one Devtools Bun policy marker pair.');
-    }
-    const replacement = `${README_POLICY_START}\n\n${renderReadmePolicy(policy)}\n\n${README_POLICY_END}`;
-    return `${readme.slice(0, startIndex)}${replacement}${readme.slice(endIndex + README_POLICY_END.length)}`;
-}
-function renderReadmePolicy(policy) {
-    return `\`\`\`text
-Bun runtime       ${policy.version}
-packageManager    ${policy.packageManager}
-@types/bun        ${policy.typesRange}
-\`\`\``;
-}
 async function runBunLockfileAsync(operation, targetDirectory) {
     const args = [
         'install',
@@ -156,5 +137,3 @@ async function syncDefinitionsAsync(targetDirectory, definitions) {
 }
 const BUN_VERSION_PATTERN = /const BUN_VERSION = '(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)';/gu;
 const BUN_TYPES_VERSION_PATTERN = /const BUN_TYPES_VERSION = '(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)';/gu;
-const README_POLICY_END = '<!-- devtools-bun-policy:end -->';
-const README_POLICY_START = '<!-- devtools-bun-policy:start -->';

package/dist/policy/renderBunPolicyDocumentation.d.ts

@@ -0,0 +1,3 @@
+import type { BunPolicy } from '../types/bunPolicy.js';
+/*** Render the managed Bun policy section while preserving the surrounding guide. */
+export declare function renderBunPolicyDocumentation(readme: string, policy: BunPolicy): string;

package/dist/policy/renderBunPolicyDocumentation.js

@@ -0,0 +1,24 @@
+/*** Render the managed Bun policy section while preserving the surrounding guide. */
+export function renderBunPolicyDocumentation(readme, policy) {
+    const startIndex = readme.indexOf(README_POLICY_START);
+    const endIndex = readme.indexOf(README_POLICY_END);
+    if (startIndex === -1 || endIndex === -1 || endIndex < startIndex) {
+        throw new Error('README.md must contain one ordered Devtools Bun policy marker pair.');
+    }
+    if (readme.includes(README_POLICY_START, startIndex + README_POLICY_START.length) ||
+        readme.includes(README_POLICY_END, endIndex + README_POLICY_END.length)) {
+        throw new Error('README.md must contain exactly one Devtools Bun policy marker pair.');
+    }
+    const replacement = `${README_POLICY_START}\n\n${renderReadmePolicy(policy)}\n\n${README_POLICY_END}`;
+    return `${readme.slice(0, startIndex)}${replacement}${readme.slice(endIndex + README_POLICY_END.length)}`;
+}
+/*** Format canonical runtime and type-package versions for the guide. */
+function renderReadmePolicy(policy) {
+    return `\`\`\`text
+Bun runtime       ${policy.version}
+packageManager    ${policy.packageManager}
+@types/bun        ${policy.typesRange}
+\`\`\``;
+}
+const README_POLICY_END = '<!-- devtools-bun-policy:end -->';
+const README_POLICY_START = '<!-- devtools-bun-policy:start -->';

package/dist/tools/eslint/index.js

@@ -2,7 +2,7 @@
  * Create the shared strict ESLint flat configuration used by consuming repositories.
  *
  * The default `profile: 'auto'` reads the nearest `package.json` from `tsconfigRootDir` and uses
- * `@ankhorage/utility/project` to select overlapping project traits. React Native and Expo select
+ * `@ankhorage/project-detector` to select overlapping project traits. React Native and Expo select
  * the `react-native` profile, React and Next.js select `react`, and other projects use `base`.
  *
  * Every profile includes the shared TypeScript, import, unused-import, Prettier, security, and
@@ -30,7 +30,7 @@ import securityPlugin from 'eslint-plugin-security';
 import simpleImportSort from 'eslint-plugin-simple-import-sort';
 import unusedImports from 'eslint-plugin-unused-imports';
 import tseslint from 'typescript-eslint';
-import { resolveEslintProfile } from './profile.js';
+import { resolveEslintProfile } from './resolveEslintProfile.js';
 export const defaultIgnores = [
     '**/ios/**',
     '**/android/**',

package/dist/tools/eslint/resolveEslintProfile.d.ts

@@ -0,0 +1,3 @@
+import type { DevtoolsConfigOptions, ResolvedDevtoolsEslintProfile } from './types.js';
+/*** Read the consuming package metadata and resolve its requested ESLint profile. */
+export declare function resolveEslintProfile(options: DevtoolsConfigOptions): ResolvedDevtoolsEslintProfile;

package/dist/tools/eslint/{profile.js → resolveEslintProfile.js}

@@ -1,6 +1,8 @@
 import { readFileSync } from 'node:fs';
-import { detectProject, } from '@ankhorage/utility/project';
+import { isRecord } from '@ankhorage/utility/object';
 import { resolveProjectPackageJsonPath } from './packageJsonPath.js';
+import { resolveEslintProfileFromDetectionInput } from './resolveEslintProfileFromDetectionInput.js';
+/*** Read the consuming package metadata and resolve its requested ESLint profile. */
 export function resolveEslintProfile(options) {
     const requestedProfile = options.profile ?? 'auto';
     if (requestedProfile !== 'auto')
@@ -9,14 +11,7 @@ export function resolveEslintProfile(options) {
     const input = packageJsonPath === null ? {} : readDetectionInput(packageJsonPath);
     return resolveEslintProfileFromDetectionInput('auto', input);
 }
-export function resolveEslintProfileFromDetectionInput(requestedProfile, input) {
-    if (requestedProfile !== 'auto')
-        return requestedProfile;
-    const { traits } = detectProject(input);
-    if (traits.has('react-native') || traits.has('expo'))
-        return 'react-native';
-    return traits.has('react') ? 'react' : 'base';
-}
+/*** Normalize relevant manifest fields without evaluating project configuration. */
 function readDetectionInput(packageJsonPath) {
     const parsed = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
     if (!isRecord(parsed)) {
@@ -30,20 +25,18 @@ function readDetectionInput(packageJsonPath) {
         ...(typeof parsed.packageManager === 'string' ? { packageManager: parsed.packageManager } : {}),
     };
 }
+/*** Include one dependency section only when it contains a record. */
 function optionalDependencyMap(key, value) {
     const dependencyMap = toDependencyMap(value);
     return dependencyMap === undefined ? {} : { [key]: dependencyMap };
 }
+/*** Retain string package ranges from one manifest dependency section. */
 function toDependencyMap(value) {
     if (!isRecord(value))
         return undefined;
-    const dependencies = {};
-    for (const [name, version] of Object.entries(value)) {
-        if (typeof version === 'string')
-            dependencies[name] = version;
-    }
-    return dependencies;
+    return Object.fromEntries(Object.entries(value).flatMap(([name, version]) => typeof version === 'string' ? [[name, version]] : []));
 }
+/*** Retain runtime engine signals used by the canonical detector. */
 function optionalEngines(value) {
     if (!isRecord(value))
         return {};
@@ -53,6 +46,3 @@ function optionalEngines(value) {
     };
     return Object.keys(engines).length === 0 ? {} : { engines };
 }
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}

package/dist/tools/eslint/resolveEslintProfileFromDetectionInput.d.ts

@@ -0,0 +1,4 @@
+import type { ProjectDetectionInput } from '@ankhorage/project-detector/types';
+import type { DevtoolsEslintProfile, ResolvedDevtoolsEslintProfile } from './types.js';
+/*** Apply Devtools profile precedence to traits from the canonical project detector. */
+export declare function resolveEslintProfileFromDetectionInput(requestedProfile: DevtoolsEslintProfile, input: ProjectDetectionInput): ResolvedDevtoolsEslintProfile;

package/dist/tools/eslint/resolveEslintProfileFromDetectionInput.js

@@ -0,0 +1,10 @@
+import { detectProject } from '@ankhorage/project-detector';
+/*** Apply Devtools profile precedence to traits from the canonical project detector. */
+export function resolveEslintProfileFromDetectionInput(requestedProfile, input) {
+    if (requestedProfile !== 'auto')
+        return requestedProfile;
+    const { traits } = detectProject(input);
+    if (traits.has('react-native') || traits.has('expo'))
+        return 'react-native';
+    return traits.has('react') ? 'react' : 'base';
+}

package/dist/tools/workflows/files/ci.yml

@@ -41,6 +41,13 @@ jobs:
             echo "No build script found; skipping."
           fi
 
+      - name: Validate opted-in APM owner release
+        run: |
+          if node -e "const p=require('./package.json'); process.exit(p.ankh?.apm === undefined ? 1 : 0)"; then
+            bun run test:apm
+            __ANKH_APM_RELEASE_COMMAND__ validate . --allow-owner-code
+          fi
+
       - name: Validate Ankhorage repository
         run: bunx @ankhorage/ankh doctor validate .
 

package/dist/tools/workflows/files/release.yml

@@ -73,6 +73,9 @@ jobs:
 
           before_version="$(node -p "require('./package.json').version")"
           __ANKH_CHANGESETS_VERSION_COMMAND__
+          if node -e "const p=require('./package.json'); process.exit(p.ankh?.apm === undefined ? 1 : 0)"; then
+            __ANKH_APM_RELEASE_COMMAND__ sync .
+          fi
           after_version="$(node -p "require('./package.json').version")"
 
           if git diff --quiet; then
@@ -100,7 +103,30 @@ jobs:
 
       - name: Publish unpublished packages
         if: hashFiles('.changeset/config.json') != ''
-        run: __ANKH_CHANGESETS_PUBLISH_COMMAND__
+        run: |
+          if ! node -e "const p=require('./package.json'); process.exit(p.ankh?.apm === undefined ? 1 : 0)"; then
+            __ANKH_CHANGESETS_PUBLISH_COMMAND__
+            exit 0
+          fi
+
+          package_name="$(node -p "require('./package.json').name")"
+          package_version="$(node -p "require('./package.json').version")"
+          registry_evidence="${RUNNER_TEMP}/apm-registry.json"
+          if npm view "${package_name}@${package_version}" version --json > "$registry_evidence"; then
+            echo "Exact APM owner version is already published."
+          else
+            # Authentication/network errors must never be treated as an unpublished version.
+            node -e "const p=require(process.argv[1]); if(p.error?.code !== 'E404') process.exit(1)" "$registry_evidence"
+            bun install --frozen-lockfile --ignore-scripts
+            bun run build
+            bun run test:apm
+            artifact="$(mktemp -d "${RUNNER_TEMP}/apm-publish.XXXXXX")/candidate.tgz"
+            __ANKH_APM_RELEASE_COMMAND__ validate . --allow-owner-code --artifact "$artifact"
+            npm publish "$artifact" --ignore-scripts
+          fi
+          if ! git rev-parse -q --verify "refs/tags/v${package_version}" >/dev/null; then
+            git tag "v${package_version}"
+          fi
 
       - name: Finalize Changesets v3 tags and GitHub releases
         if: hashFiles('.changeset/config.json') != ''

package/dist/tools/workflows/index.js

@@ -1,5 +1,6 @@
 import { access } from 'node:fs/promises';
 import { join } from 'node:path';
+import { resolveApmReleaseCommandAsync } from '../../features/apm-release-validation/adapters/outbound/resolveApmReleaseCommandAsync.js';
 import { bunRuntimePolicy, nodeRuntimePolicy } from '../../policy/bunRuntimePolicy.js';
 import { renderRenovateWorkflowAsync } from './renderRenovateWorkflowAsync.js';
 import { renderWorkflowAsync } from './renderWorkflowAsync.js';
@@ -30,7 +31,8 @@ function createWorkflowDefinition(relativePath, sourcePath) {
     const sourceUrl = new URL(sourcePath, import.meta.url);
     return {
         relativePath,
-        render: async () => await renderWorkflowAsync(sourceUrl, {
+        render: async (targetDirectory) => await renderWorkflowAsync(sourceUrl, {
+            apmReleaseCommand: await resolveApmReleaseCommandAsync(targetDirectory),
             bunVersion: bunRuntimePolicy.version,
             nodeVersion: nodeRuntimePolicy.setupVersion,
         }),
@@ -42,6 +44,7 @@ function createRenovateWorkflowDefinition() {
     return {
         relativePath: '.github/workflows/renovate.yml',
         render: async (targetDirectory) => await renderRenovateWorkflowAsync(sourceUrl, targetDirectory, {
+            apmReleaseCommand: await resolveApmReleaseCommandAsync(targetDirectory),
             bunVersion: bunRuntimePolicy.version,
             nodeVersion: nodeRuntimePolicy.setupVersion,
         }),

package/dist/tools/workflows/renderWorkflowAsync.d.ts

@@ -1,6 +1,7 @@
 export interface WorkflowPolicy {
     readonly bunVersion: string;
     readonly nodeVersion: string;
+    readonly apmReleaseCommand?: string;
 }
 /*** Renders one workflow template with the canonical runtime and Changesets policy. */
 export declare function renderWorkflowAsync(sourceUrl: URL, policy: WorkflowPolicy): Promise<string>;

package/dist/tools/workflows/renderWorkflowAsync.js

@@ -8,6 +8,7 @@ export async function renderWorkflowAsync(sourceUrl, policy) {
         .replaceAll(CHANGESETS_PUBLISH_COMMAND_TOKEN, changesetsPolicy.workflowCommands.publish)
         .replaceAll(CHANGESETS_STATUS_COMMAND_TOKEN, changesetsPolicy.workflowCommands.status)
         .replaceAll(CHANGESETS_VERSION_COMMAND_TOKEN, changesetsPolicy.workflowCommands.version)
+        .replaceAll('__ANKH_APM_RELEASE_COMMAND__', policy.apmReleaseCommand ?? './node_modules/.bin/ankhorage-apm-release')
         .replaceAll(NODE_VERSION_TOKEN, policy.nodeVersion);
 }
 const BUN_VERSION_TOKEN = '__ANKH_BUN_VERSION__';

package/dist/types/apm-release-validation.d.ts

@@ -0,0 +1,33 @@
+import type { ApmUpdateDescriptor } from '@ankhorage/apm/types';
+/*** Packed bytes and loaded owner evidence supplied to the canonical APM validators. */
+export interface ApmPackedReleaseCandidate {
+    readonly packageJson: Readonly<Record<string, unknown>>;
+    readonly descriptor: unknown;
+    readonly descriptorSource: string;
+    readonly integrity: string;
+    readonly extension?: unknown;
+}
+/*** Explicit release-validation inputs; owner code is never trusted by default. */
+export interface ApmReleaseValidationOptions {
+    readonly allowOwnerCode?: boolean;
+    readonly artifactPath?: string;
+    readonly expectedIntegrity?: string;
+    readonly previousDescriptors?: readonly ApmUpdateDescriptor[];
+    readonly relatedDescriptors?: readonly ApmUpdateDescriptor[];
+}
+/*** Evidence for one exact packed release; inapplicable never means migration-safe. */
+export interface ApmReleaseValidationResult {
+    readonly applicable: boolean;
+    readonly valid: boolean;
+    readonly packageName?: string;
+    readonly packageVersion?: string;
+    readonly integrity?: string;
+    readonly artifactPath?: string;
+    readonly blockers: readonly string[];
+}
+/*** Filesystem capabilities required by descriptor synchronization, independent of transport. */
+export interface ApmReleaseDescriptorPort {
+    readonly readPackageAsync: () => Promise<Readonly<Record<string, unknown>>>;
+    readonly readDescriptorAsync: (subpath: string) => Promise<Readonly<Record<string, unknown>>>;
+    readonly writeDescriptorAsync: (subpath: string, descriptor: Readonly<Record<string, unknown>>) => Promise<boolean>;
+}

package/dist/types/apm-release-validation.js

@@ -0,0 +1 @@
+export {};

package/dist/types/bunPolicy.d.ts

@@ -0,0 +1,5 @@
+export interface BunPolicy {
+    readonly packageManager: string;
+    readonly typesRange: string;
+    readonly version: string;
+}

package/dist/types/bunPolicy.js

@@ -0,0 +1 @@
+export {};

package/dist/types/public.d.ts

@@ -0,0 +1 @@
+export type { ApmPackedReleaseCandidate, ApmReleaseValidationOptions, ApmReleaseValidationResult, } from './apm-release-validation.js';

package/dist/types/public.js

@@ -0,0 +1 @@
+export {};