@ankhorage/devtools 1.15.4 → 1.15.6

package/README.md

@@ -3,7 +3,7 @@
 
 # @ankhorage/devtools
 
-![license: MIT](././paradox/badges/license.svg) ![npm: v1.15.4](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
+![license: MIT](././paradox/badges/license.svg) ![npm: v1.15.6](././paradox/badges/npm.svg) ![runtime: bun](././paradox/badges/runtime.svg) ![typescript: strict](././paradox/badges/typescript.svg) ![eslint: checked](././paradox/badges/eslint.svg) ![prettier: checked](././paradox/badges/prettier.svg) ![build: checked](././paradox/badges/build.svg) ![tests: checked](././paradox/badges/tests.svg) ![docs: paradox](././paradox/badges/docs.svg)
 
 Shared tooling, repository automation, runtime policies, and agent standards for Ankhorage TypeScript projects
 

package/dist/tools/skills/assets/zora-designer/scripts/owner-api.ts

@@ -231,12 +231,7 @@ async function loadInstalledZoraPluginMetadata(
 
   const loaded: { metadata: Record<string, unknown>; packageName: string; version: string }[] = [];
   for (const packageName of [...packageNames].filter(isZoraPluginPackage).sort()) {
-    const minimumVersion =
-      packageName === '@ankhorage/zora-chess'
-        ? '0.2.0'
-        : packageName === '@ankhorage/zora-tabletop'
-          ? '0.1.0'
-          : '0.0.0';
+    const minimumVersion = resolvePluginMinimumVersion(targetManifest, packageName);
     const requirement: OwnerRequirement = {
       packageName,
       minimumVersion,
@@ -255,6 +250,42 @@ function isZoraPluginPackage(packageName: string): boolean {
   return packageName.startsWith('@ankhorage/zora-') && packageName !== '@ankhorage/zora';
 }
 
+/*** Resolve one ZORA plugin minimum version from the target package declaration or owner package itself. */
+function resolvePluginMinimumVersion(
+  targetManifest: Record<string, unknown>,
+  packageName: string,
+): string {
+  if (targetManifest.name === packageName) {
+    const { version } = targetManifest;
+    if (typeof version === 'string' && parseVersion(version)[0] >= 0) return version;
+    throw new Error(`ZORA plugin owner package ${packageName} must declare a semantic version.`);
+  }
+
+  for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+    const dependencies = targetManifest[field];
+    if (!isRecord(dependencies)) continue;
+    const specifier = dependencies[packageName];
+    if (typeof specifier === 'string') {
+      return readPluginMinimumVersion(packageName, specifier);
+    }
+  }
+
+  throw new Error(`ZORA plugin ${packageName} must be declared by the target package.`);
+}
+
+/*** Read the semantic lower bound from one supported published dependency specifier. */
+function readPluginMinimumVersion(packageName: string, specifier: string): string {
+  const normalized = specifier.trim().replace(/^workspace:/u, '');
+  const match = /^(?:\^|~|>=)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/u.exec(normalized);
+  const minimumVersion = match?.[1];
+  if (minimumVersion === undefined) {
+    throw new Error(
+      `ZORA plugin ${packageName} must use an exact, caret, tilde, or >= semantic dependency range; found ${specifier}.`,
+    );
+  }
+  return minimumVersion;
+}
+
 /*** Load only Contracts for tooling that runs before another owner package has been built. */
 export async function loadContractsApi(targetDirectory = process.cwd()): Promise<ContractsApi> {
   const loaded = await loadOwnerModule(targetDirectory, OWNER_REQUIREMENTS.contracts);

package/dist/tools/workflows/files/release.yml

@@ -147,34 +147,44 @@ jobs:
           registry_evidence="${RUNNER_TEMP}/npm-publish-verification.json"
           artifact="${RUNNER_TEMP}/npm-publish-verification.tgz"
           pack_dir="${RUNNER_TEMP}/npm-pack-verification"
-          max_attempts=30
+          max_attempts=60
           retry_seconds=30
           mkdir -p "$pack_dir"
 
+          last_stage="registry-metadata"
           for attempt in $(seq 1 "$max_attempts"); do
             echo "Verifying ${package_spec} on npm (attempt ${attempt}/${max_attempts})..."
+            last_stage="registry-metadata"
+
             if npm view "$package_spec" version dist.tarball dist.integrity --json > "$registry_evidence"; then
               resolved_version="$(node -e "const p=require(process.argv[1]); process.stdout.write(p.version ?? '')" "$registry_evidence")"
               tarball="$(node -e "const p=require(process.argv[1]); process.stdout.write(p['dist.tarball'] ?? '')" "$registry_evidence")"
               integrity="$(node -e "const p=require(process.argv[1]); process.stdout.write(p['dist.integrity'] ?? '')" "$registry_evidence")"
 
               if [ "$resolved_version" = "$PUBLISHED_PACKAGE_VERSION" ] && [ -n "$tarball" ] && [ -n "$integrity" ]; then
+                last_stage="tarball-download"
                 if curl --fail --location --silent --show-error --output "$artifact" "$tarball"; then
+                  last_stage="integrity"
                   if EXPECTED_INTEGRITY="$integrity" ARTIFACT="$artifact" node -e "const { createHash }=require('node:crypto'); const { readFileSync }=require('node:fs'); const actual='sha512-'+createHash('sha512').update(readFileSync(process.env.ARTIFACT)).digest('base64'); if(actual!==process.env.EXPECTED_INTEGRITY){console.error('Downloaded npm tarball integrity mismatch.'); process.exit(1)}"; then
-                    npm pack "$package_spec" --pack-destination "$pack_dir" >/dev/null
-                    echo "Verified ${package_spec}: metadata, integrity, tarball download, and npm pack are available."
-                    exit 0
+                    last_stage="npm-pack"
+                    attempt_pack_dir="$pack_dir/attempt-${attempt}"
+                    mkdir -p "$attempt_pack_dir"
+                    if npm pack "$package_spec" --pack-destination "$attempt_pack_dir" >/dev/null; then
+                      echo "Verified ${package_spec}: metadata, integrity, tarball download, and npm pack are available."
+                      exit 0
+                    fi
                   fi
                 fi
               fi
             fi
 
+            echo "Published npm artifact not ready at stage: ${last_stage}."
             if [ "$attempt" -lt "$max_attempts" ]; then
               sleep "$retry_seconds"
             fi
           done
 
-          echo "Published npm artifact did not become retrievable after ${max_attempts} attempts."
+          echo "Published npm artifact did not become retrievable after ${max_attempts} attempts; last stage: ${last_stage}."
           cat "$registry_evidence" 2>/dev/null || true
           exit 1
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.15.4",
+  "version": "1.15.6",
   "description": "Shared tooling, repository automation, runtime policies, and agent standards for Ankhorage TypeScript projects",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",