@ankhorage/devtools 1.15.3 → 1.15.5

package/README.md

@@ -3,7 +3,7 @@
 
 # @ankhorage/devtools
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v1.15.3](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v1.15.5](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Shared tooling, repository automation, runtime policies, and agent standards for Ankhorage TypeScript projects
 

package/dist/tools/skills/assets/zora-designer/scripts/owner-api.ts

@@ -231,12 +231,7 @@ async function loadInstalledZoraPluginMetadata(
 
   const loaded: { metadata: Record<string, unknown>; packageName: string; version: string }[] = [];
   for (const packageName of [...packageNames].filter(isZoraPluginPackage).sort()) {
-    const minimumVersion =
-      packageName === '@ankhorage/zora-chess'
-        ? '0.2.0'
-        : packageName === '@ankhorage/zora-tabletop'
-          ? '0.1.0'
-          : '0.0.0';
+    const minimumVersion = resolvePluginMinimumVersion(targetManifest, packageName);
     const requirement: OwnerRequirement = {
       packageName,
       minimumVersion,
@@ -255,6 +250,42 @@ function isZoraPluginPackage(packageName: string): boolean {
   return packageName.startsWith('@ankhorage/zora-') && packageName !== '@ankhorage/zora';
 }
 
+/*** Resolve one ZORA plugin minimum version from the target package declaration or owner package itself. */
+function resolvePluginMinimumVersion(
+  targetManifest: Record<string, unknown>,
+  packageName: string,
+): string {
+  if (targetManifest.name === packageName) {
+    const { version } = targetManifest;
+    if (typeof version === 'string' && parseVersion(version)[0] >= 0) return version;
+    throw new Error(`ZORA plugin owner package ${packageName} must declare a semantic version.`);
+  }
+
+  for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+    const dependencies = targetManifest[field];
+    if (!isRecord(dependencies)) continue;
+    const specifier = dependencies[packageName];
+    if (typeof specifier === 'string') {
+      return readPluginMinimumVersion(packageName, specifier);
+    }
+  }
+
+  throw new Error(`ZORA plugin ${packageName} must be declared by the target package.`);
+}
+
+/*** Read the semantic lower bound from one supported published dependency specifier. */
+function readPluginMinimumVersion(packageName: string, specifier: string): string {
+  const normalized = specifier.trim().replace(/^workspace:/u, '');
+  const match = /^(?:\^|~|>=)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/u.exec(normalized);
+  const minimumVersion = match?.[1];
+  if (minimumVersion === undefined) {
+    throw new Error(
+      `ZORA plugin ${packageName} must use an exact, caret, tilde, or >= semantic dependency range; found ${specifier}.`,
+    );
+  }
+  return minimumVersion;
+}
+
 /*** Load only Contracts for tooling that runs before another owner package has been built. */
 export async function loadContractsApi(targetDirectory = process.cwd()): Promise<ContractsApi> {
   const loaded = await loadOwnerModule(targetDirectory, OWNER_REQUIREMENTS.contracts);

package/dist/tools/workflows/files/release.yml

@@ -136,6 +136,48 @@ jobs:
             git tag "v${package_version}"
           fi
 
+      - name: Verify published npm artifact
+        if: steps.release.outputs.versioned == 'true'
+        env:
+          PUBLISHED_PACKAGE_NAME: ${{ steps.release.outputs.package_name }}
+          PUBLISHED_PACKAGE_VERSION: ${{ steps.release.outputs.package_version }}
+        run: |
+          set -euo pipefail
+          package_spec="${PUBLISHED_PACKAGE_NAME}@${PUBLISHED_PACKAGE_VERSION}"
+          registry_evidence="${RUNNER_TEMP}/npm-publish-verification.json"
+          artifact="${RUNNER_TEMP}/npm-publish-verification.tgz"
+          pack_dir="${RUNNER_TEMP}/npm-pack-verification"
+          max_attempts=30
+          retry_seconds=30
+          mkdir -p "$pack_dir"
+
+          for attempt in $(seq 1 "$max_attempts"); do
+            echo "Verifying ${package_spec} on npm (attempt ${attempt}/${max_attempts})..."
+            if npm view "$package_spec" version dist.tarball dist.integrity --json > "$registry_evidence"; then
+              resolved_version="$(node -e "const p=require(process.argv[1]); process.stdout.write(p.version ?? '')" "$registry_evidence")"
+              tarball="$(node -e "const p=require(process.argv[1]); process.stdout.write(p['dist.tarball'] ?? '')" "$registry_evidence")"
+              integrity="$(node -e "const p=require(process.argv[1]); process.stdout.write(p['dist.integrity'] ?? '')" "$registry_evidence")"
+
+              if [ "$resolved_version" = "$PUBLISHED_PACKAGE_VERSION" ] && [ -n "$tarball" ] && [ -n "$integrity" ]; then
+                if curl --fail --location --silent --show-error --output "$artifact" "$tarball"; then
+                  if EXPECTED_INTEGRITY="$integrity" ARTIFACT="$artifact" node -e "const { createHash }=require('node:crypto'); const { readFileSync }=require('node:fs'); const actual='sha512-'+createHash('sha512').update(readFileSync(process.env.ARTIFACT)).digest('base64'); if(actual!==process.env.EXPECTED_INTEGRITY){console.error('Downloaded npm tarball integrity mismatch.'); process.exit(1)}"; then
+                    npm pack "$package_spec" --pack-destination "$pack_dir" >/dev/null
+                    echo "Verified ${package_spec}: metadata, integrity, tarball download, and npm pack are available."
+                    exit 0
+                  fi
+                fi
+              fi
+            fi
+
+            if [ "$attempt" -lt "$max_attempts" ]; then
+              sleep "$retry_seconds"
+            fi
+          done
+
+          echo "Published npm artifact did not become retrievable after ${max_attempts} attempts."
+          cat "$registry_evidence" 2>/dev/null || true
+          exit 1
+
       - name: Finalize Changesets v3 tags and GitHub releases
         if: hashFiles('.changeset/config.json') != ''
         env:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.15.3",
+  "version": "1.15.5",
   "description": "Shared tooling, repository automation, runtime policies, and agent standards for Ankhorage TypeScript projects",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",