@kaikybrofc/omnizap-system 2.1.10 → 2.2.0

package/.env.example

@@ -521,6 +521,13 @@ DEPLOY_PACKAGE_SECONDARY_TOKEN_KEYS=
 # ==============================
 # Release (auto commit/push)
 # ==============================
+# Tipo de bump padrão no npm run release (patch/minor/major...)
+RELEASE_TYPE=patch
+# Opcional: força versão exata (ex: 2.2.0), ignorando RELEASE_TYPE
+RELEASE_FORCE_VERSION=
+# Rollover automático de patch: quando patch >= RELEASE_PATCH_ROLLOVER_AT, vira (major).(minor+1).0
+RELEASE_PATCH_ROLLOVER_ENABLED=1
+RELEASE_PATCH_ROLLOVER_AT=10
 # Faz commit automatico de alteracoes pendentes antes do release
 RELEASE_GIT_AUTO_COMMIT=1
 # Faz push automatico dos commits gerados no release
@@ -535,6 +542,8 @@ RELEASE_GIT_VERSION_COMMIT_PREFIX=chore(release): v
 
 # Cria/atualiza GitHub Release (aba Releases) automaticamente no npm run release
 RELEASE_GITHUB_RELEASE=1
+# Se 1, falha o release caso GitHub Release esteja desativado
+RELEASE_REQUIRE_GITHUB_RELEASE=1
 RELEASE_GITHUB_REPO=kaikybrofc/omnizap-system
 RELEASE_GITHUB_TOKEN=
 RELEASE_GITHUB_TAG_PREFIX=v
@@ -545,3 +554,12 @@ RELEASE_GITHUB_PRERELEASE=
 RELEASE_GITHUB_DRAFT=0
 # Opcional: commit/tag alvo (vazio usa HEAD atual)
 RELEASE_GITHUB_TARGET=
+
+# Se 1, exige publish em ambos os registries no release (GitHub Packages + npmjs)
+RELEASE_REQUIRE_DUAL_PUBLISH=1
+# Verificação final: local + registries + GitHub Release na mesma versão
+RELEASE_VERIFY_UNIFIED_VERSION=1
+RELEASE_VERIFY_PRIMARY_REGISTRY=https://npm.pkg.github.com
+RELEASE_VERIFY_SECONDARY_REGISTRY=https://registry.npmjs.org
+RELEASE_VERIFY_PRIMARY_TOKEN_KEYS=DEPLOY_PACKAGE_TOKEN,DEPLOY_GITHUB_TOKEN,GITHUB_TOKEN,GH_TOKEN,NPM_TOKEN,NODE_AUTH_TOKEN
+RELEASE_VERIFY_SECONDARY_TOKEN_KEYS=DEPLOY_PACKAGE_SECONDARY_TOKEN,NPM_TOKEN,NODE_AUTH_TOKEN

package/README.md

@@ -132,7 +132,7 @@ Variáveis legadas foram mantidas por compatibilidade (`QUOTE_API_URL`, `WAIFU_A
 - `npm run pm2:prod`: sobe com PM2 usando `ecosystem.prod.config.cjs`.
 - `npm run deploy`: deploy automático de `public/` com cache-bust, backup, validação e reload do Nginx.
 - `npm run deploy:dry-run`: simula o deploy sem publicar/recarregar serviços.
-- `npm run release`: bump de versão `patch` + deploy + publish + atualização da aba GitHub Releases.
+- `npm run release`: release completo com versão unificada (npmjs + GitHub Packages + GitHub Release) e verificação final.
 - `npm run release:minor`: bump `minor` + deploy + publish do package.
 - `npm run release:major`: bump `major` + deploy + publish do package.
 - `npm run test`: executa testes Node (`node --test`).
@@ -224,10 +224,14 @@ Comando único de release (patch + deploy + publish):
 npm run release
 ```
 
-`npm run release` agora executa publish primário + secundário por padrão (você pode desativar com `DEPLOY_PACKAGE_PUBLISH_SECONDARY=0`).
+`npm run release` executa publish primário + secundário por padrão e valida consistência final de versão.
 
 Variáveis do fluxo de release (git):
 
+- `RELEASE_TYPE` (default: `patch`)
+- `RELEASE_FORCE_VERSION` (opcional) - força versão exata (ex.: `2.2.0`)
+- `RELEASE_PATCH_ROLLOVER_ENABLED` (default: `1`) - rollover automático de patch
+- `RELEASE_PATCH_ROLLOVER_AT` (default: `10`) - quando patch atingir este valor, próximo release vira `major.(minor+1).0`
 - `RELEASE_GIT_AUTO_COMMIT` (default: `1`) - commit automático se houver alterações pendentes
 - `RELEASE_GIT_AUTO_PUSH` (default: `1`) - push automático dos commits gerados
 - `RELEASE_GIT_REMOTE` (default: `origin`)
@@ -236,6 +240,7 @@ Variáveis do fluxo de release (git):
 - `RELEASE_GIT_COMMIT_VERSION` (default: `1`) - commita alteração da versão após sucesso
 - `RELEASE_GIT_VERSION_COMMIT_PREFIX` (default: `chore(release): v`)
 - `RELEASE_GITHUB_RELEASE` (default: `1`) - cria/atualiza GitHub Release na aba Releases
+- `RELEASE_REQUIRE_GITHUB_RELEASE` (default: `1`) - falha se GitHub Release estiver desativado
 - `RELEASE_GITHUB_REPO` (opcional; ex.: `kaikybrofc/omnizap-system`)
 - `RELEASE_GITHUB_TOKEN` (opcional; fallback: `DEPLOY_GITHUB_TOKEN`/`GITHUB_TOKEN`/`GH_TOKEN`)
 - `RELEASE_GITHUB_TAG_PREFIX` (default: `v`) - prefixo da tag (`v2.1.9`)
@@ -244,6 +249,16 @@ Variáveis do fluxo de release (git):
 - `RELEASE_GITHUB_PRERELEASE` (default: auto) - vazio detecta `-` na versão como prerelease
 - `RELEASE_GITHUB_DRAFT` (default: `0`)
 - `RELEASE_GITHUB_TARGET` (opcional; vazio usa `HEAD`)
+- `RELEASE_REQUIRE_DUAL_PUBLISH` (default: `1`) - exige publish em GitHub Packages e npmjs
+- `RELEASE_VERIFY_UNIFIED_VERSION` (default: `1`) - valida versão final em local + registries + GitHub Release
+- `RELEASE_VERIFY_PRIMARY_REGISTRY` (default: `https://npm.pkg.github.com`)
+- `RELEASE_VERIFY_SECONDARY_REGISTRY` (default: `https://registry.npmjs.org`)
+- `RELEASE_VERIFY_PRIMARY_TOKEN_KEYS` / `RELEASE_VERIFY_SECONDARY_TOKEN_KEYS` - ordem de fallback de tokens para verificação
+
+Exemplo de rollover automático:
+
+- `2.1.9` + `npm run release` -> `2.1.10`
+- `2.1.10` + `npm run release` -> `2.2.0`
 
 ## Execução com PM2
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaikybrofc/omnizap-system",
-  "version": "2.1.10",
+  "version": "2.2.0",
   "description": "Sistema profissional de automação WhatsApp com tecnologia Baileys",
   "main": "index.js",
   "publishConfig": {

package/scripts/github-release-notify.mjs

@@ -59,8 +59,8 @@ const parseRepoFromRemote = () => {
 const token = env('RELEASE_GITHUB_TOKEN', 'DEPLOY_GITHUB_TOKEN', 'GITHUB_TOKEN', 'GH_TOKEN');
 const repository = env('RELEASE_GITHUB_REPO', 'DEPLOY_GITHUB_REPO', 'GITHUB_REPOSITORY') || parseRepoFromRemote();
 
-if (!action || action !== 'upsert') {
-  console.error('Uso: node scripts/github-release-notify.mjs upsert --tag vX.Y.Z [opções]');
+if (!action || !['upsert', 'get'].includes(action)) {
+  console.error('Uso: node scripts/github-release-notify.mjs <upsert|get> --tag vX.Y.Z [opções]');
   process.exit(1);
 }
 
@@ -137,6 +137,15 @@ const run = async () => {
     failFromResponse(byTag, 'GitHub API');
   }
 
+  if (action === 'get') {
+    if (!existingRelease) {
+      throw new Error(`GitHub release não encontrada para tag ${tag}`);
+    }
+    const url = existingRelease.html_url || '';
+    process.stdout.write(`found id=${existingRelease.id} tag=${tag} url=${url}`);
+    return;
+  }
+
   const commonPayload = {
     tag_name: tag,
     target_commitish: target || undefined,
@@ -177,4 +186,3 @@ run().catch((error) => {
   console.error(error?.message || error);
   process.exit(1);
 });
-

package/scripts/release.sh

@@ -3,6 +3,9 @@ set -euo pipefail
 
 PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 RELEASE_TYPE="${RELEASE_TYPE:-patch}"
+RELEASE_FORCE_VERSION="${RELEASE_FORCE_VERSION:-}"
+RELEASE_PATCH_ROLLOVER_ENABLED="${RELEASE_PATCH_ROLLOVER_ENABLED:-1}"
+RELEASE_PATCH_ROLLOVER_AT="${RELEASE_PATCH_ROLLOVER_AT:-10}"
 RELEASE_GIT_AUTO_COMMIT="${RELEASE_GIT_AUTO_COMMIT:-1}"
 RELEASE_GIT_AUTO_PUSH="${RELEASE_GIT_AUTO_PUSH:-1}"
 RELEASE_GIT_REMOTE="${RELEASE_GIT_REMOTE:-origin}"
@@ -11,12 +14,20 @@ RELEASE_GIT_PRE_COMMIT_MESSAGE="${RELEASE_GIT_PRE_COMMIT_MESSAGE:-chore(release)
 RELEASE_GIT_COMMIT_VERSION="${RELEASE_GIT_COMMIT_VERSION:-1}"
 RELEASE_GIT_VERSION_COMMIT_PREFIX="${RELEASE_GIT_VERSION_COMMIT_PREFIX:-chore(release): v}"
 RELEASE_GITHUB_RELEASE="${RELEASE_GITHUB_RELEASE:-1}"
+RELEASE_REQUIRE_GITHUB_RELEASE="${RELEASE_REQUIRE_GITHUB_RELEASE:-1}"
 RELEASE_GITHUB_TAG_PREFIX="${RELEASE_GITHUB_TAG_PREFIX:-v}"
 RELEASE_GITHUB_NAME_PREFIX="${RELEASE_GITHUB_NAME_PREFIX:-v}"
 RELEASE_GITHUB_GENERATE_NOTES="${RELEASE_GITHUB_GENERATE_NOTES:-1}"
 RELEASE_GITHUB_PRERELEASE="${RELEASE_GITHUB_PRERELEASE:-}"
 RELEASE_GITHUB_DRAFT="${RELEASE_GITHUB_DRAFT:-0}"
 RELEASE_GITHUB_TARGET="${RELEASE_GITHUB_TARGET:-}"
+RELEASE_REQUIRE_DUAL_PUBLISH="${RELEASE_REQUIRE_DUAL_PUBLISH:-1}"
+RELEASE_VERIFY_UNIFIED_VERSION="${RELEASE_VERIFY_UNIFIED_VERSION:-1}"
+RELEASE_VERIFY_PRIMARY_REGISTRY="${RELEASE_VERIFY_PRIMARY_REGISTRY:-${DEPLOY_PACKAGE_REGISTRY:-https://npm.pkg.github.com}}"
+RELEASE_VERIFY_SECONDARY_REGISTRY="${RELEASE_VERIFY_SECONDARY_REGISTRY:-${DEPLOY_PACKAGE_SECONDARY_REGISTRY:-https://registry.npmjs.org}}"
+RELEASE_VERIFY_PRIMARY_TOKEN_KEYS="${RELEASE_VERIFY_PRIMARY_TOKEN_KEYS:-DEPLOY_PACKAGE_TOKEN,DEPLOY_GITHUB_TOKEN,GITHUB_TOKEN,GH_TOKEN,NPM_TOKEN,NODE_AUTH_TOKEN}"
+RELEASE_VERIFY_SECONDARY_TOKEN_KEYS="${RELEASE_VERIFY_SECONDARY_TOKEN_KEYS:-DEPLOY_PACKAGE_SECONDARY_TOKEN,NPM_TOKEN,NODE_AUTH_TOKEN}"
+TMP_NPMRC_FILES=()
 
 case "$RELEASE_TYPE" in
   patch|minor|major|prepatch|preminor|premajor|prerelease)
@@ -32,6 +43,15 @@ log() {
   printf '[release] %s\n' "$*"
 }
 
+cleanup_tmp_npmrcs() {
+  for npmrc_tmp in "${TMP_NPMRC_FILES[@]:-}"; do
+    if [ -n "$npmrc_tmp" ] && [ -f "$npmrc_tmp" ]; then
+      rm -f "$npmrc_tmp"
+    fi
+  done
+}
+trap cleanup_tmp_npmrcs EXIT
+
 require_cmd() {
   if ! command -v "$1" >/dev/null 2>&1; then
     printf '[release] comando ausente: %s\n' "$1" >&2
@@ -39,6 +59,23 @@ require_cmd() {
   fi
 }
 
+to_bool() {
+  local value
+  value="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
+  case "$value" in
+    1|true|yes|on)
+      printf 'true'
+      ;;
+    *)
+      printf 'false'
+      ;;
+  esac
+}
+
+sanitize_npm_output() {
+  printf '%s' "$1" | tr -d "\"'[:space:]"
+}
+
 resolve_branch() {
   if [ -n "$RELEASE_GIT_BRANCH" ]; then
     printf '%s' "$RELEASE_GIT_BRANCH"
@@ -56,6 +93,130 @@ resolve_branch() {
   printf '%s' "$branch"
 }
 
+resolve_token_from_dotenv() {
+  local token_keys="$1"
+  if [ -z "$token_keys" ]; then
+    return 0
+  fi
+
+  (
+    cd "$PROJECT_ROOT" && TOKEN_KEYS="$token_keys" node --input-type=module -e "
+      import dotenv from 'dotenv';
+      dotenv.config({ path: '.env' });
+      const keys = String(process.env.TOKEN_KEYS || '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean);
+      for (const key of keys) {
+        const value = process.env[key];
+        if (value && String(value).trim()) {
+          process.stdout.write(String(value).trim());
+          process.exit(0);
+        }
+      }
+    " 2>/dev/null || true
+  )
+}
+
+create_npmrc_for_registry() {
+  local registry="$1"
+  local token="$2"
+  local scope_owner="$3"
+  local registry_host=""
+  registry_host="$(printf '%s' "$registry" | sed -E 's#^https?://##; s#/*$##')"
+
+  local npmrc_tmp=""
+  npmrc_tmp="$(mktemp /tmp/omnizap-release-npmrc.XXXXXX)"
+  {
+    printf 'registry=%s\n' "$registry"
+    if [ -n "$scope_owner" ]; then
+      printf '@%s:registry=%s\n' "$scope_owner" "$registry"
+    fi
+    if [ -n "$token" ]; then
+      printf '//%s/:_authToken=%s\n' "$registry_host" "$token"
+      printf '//%s:_authToken=%s\n' "$registry_host" "$token"
+    fi
+  } > "$npmrc_tmp"
+  chmod 600 "$npmrc_tmp"
+  TMP_NPMRC_FILES+=("$npmrc_tmp")
+  printf '%s' "$npmrc_tmp"
+}
+
+verify_registry_version() {
+  local pkg_name="$1"
+  local pkg_version="$2"
+  local registry="$3"
+  local token_keys="$4"
+  local auth_required="$5"
+
+  local token=""
+  token="$(resolve_token_from_dotenv "$token_keys")"
+  if [ "$auth_required" = "1" ] && [ -z "$token" ]; then
+    printf '[release] Verificação em %s requer token (keys: %s).\n' "$registry" "$token_keys" >&2
+    exit 1
+  fi
+
+  local scope_owner=""
+  scope_owner="$(printf '%s' "$pkg_name" | sed -nE 's#^@([^/]+)/.*#\1#p')"
+  local npmrc_tmp=""
+  npmrc_tmp="$(create_npmrc_for_registry "$registry" "$token" "$scope_owner")"
+
+  local version_raw=""
+  if ! version_raw="$(
+    cd "$PROJECT_ROOT" &&
+    npm_config_userconfig="$npmrc_tmp" npm view "${pkg_name}@${pkg_version}" version --registry "$registry" --userconfig "$npmrc_tmp" 2>/dev/null
+  )"; then
+    printf '[release] Falha ao validar versão %s em %s.\n' "$pkg_version" "$registry" >&2
+    exit 1
+  fi
+  local version_value=""
+  version_value="$(sanitize_npm_output "$version_raw")"
+  if [ "$version_value" != "$pkg_version" ]; then
+    printf '[release] Versão divergente em %s: esperado=%s encontrado=%s\n' "$registry" "$pkg_version" "${version_value:-vazio}" >&2
+    exit 1
+  fi
+
+  local latest_raw=""
+  if ! latest_raw="$(
+    cd "$PROJECT_ROOT" &&
+    npm_config_userconfig="$npmrc_tmp" npm view "$pkg_name" dist-tags.latest --registry "$registry" --userconfig "$npmrc_tmp" 2>/dev/null
+  )"; then
+    printf '[release] Falha ao validar dist-tag latest em %s.\n' "$registry" >&2
+    exit 1
+  fi
+  local latest_value=""
+  latest_value="$(sanitize_npm_output "$latest_raw")"
+  if [ "$latest_value" != "$pkg_version" ]; then
+    printf '[release] Dist-tag latest divergente em %s: esperado=%s latest=%s\n' "$registry" "$pkg_version" "${latest_value:-vazio}" >&2
+    exit 1
+  fi
+
+  log "Verificado em $registry: versão=$pkg_version latest=$latest_value"
+}
+
+compute_target_version() {
+  local current="$1"
+
+  if [ -n "$RELEASE_FORCE_VERSION" ]; then
+    printf '%s' "$RELEASE_FORCE_VERSION"
+    return 0
+  fi
+
+  if [ "$RELEASE_TYPE" = "patch" ] && [ "$RELEASE_PATCH_ROLLOVER_ENABLED" = "1" ]; then
+    if [[ "$RELEASE_PATCH_ROLLOVER_AT" =~ ^[0-9]+$ ]] && [[ "$current" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+      local major="${BASH_REMATCH[1]}"
+      local minor="${BASH_REMATCH[2]}"
+      local patch="${BASH_REMATCH[3]}"
+      if [ "$patch" -ge "$RELEASE_PATCH_ROLLOVER_AT" ]; then
+        printf '%s.%s.0' "$major" "$((minor + 1))"
+        return 0
+      fi
+    fi
+  fi
+
+  printf ''
+}
+
 commit_and_push_if_dirty() {
   local commit_message="$1"
 
@@ -100,37 +261,48 @@ if ! (cd "$PROJECT_ROOT" && git rev-parse --is-inside-work-tree >/dev/null 2>&1)
   exit 1
 fi
 
-to_bool() {
-  local value
-  value="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
-  case "$value" in
-    1|true|yes|on)
-      printf 'true'
-      ;;
-    *)
-      printf 'false'
-      ;;
-  esac
-}
+if [ "$RELEASE_REQUIRE_GITHUB_RELEASE" = "1" ] && [ "$RELEASE_GITHUB_RELEASE" != "1" ]; then
+  printf '[release] RELEASE_REQUIRE_GITHUB_RELEASE=1 exige RELEASE_GITHUB_RELEASE=1.\n' >&2
+  exit 1
+fi
 
 commit_and_push_if_dirty "$RELEASE_GIT_PRE_COMMIT_MESSAGE"
 
 current_version="$(cd "$PROJECT_ROOT" && npm pkg get version | tr -d '"[:space:]')"
 log "Versão atual: $current_version"
-log "Aplicando bump: $RELEASE_TYPE"
+target_version="$(compute_target_version "$current_version")"
 
-(cd "$PROJECT_ROOT" && npm version "$RELEASE_TYPE" --no-git-tag-version >/dev/null)
+if [ -n "$target_version" ]; then
+  if [ "$target_version" = "$current_version" ]; then
+    printf '[release] versão alvo igual à versão atual (%s). Verifique regras de bump.\n' "$current_version" >&2
+    exit 1
+  fi
+  log "Aplicando versão alvo: $target_version"
+  (cd "$PROJECT_ROOT" && npm version "$target_version" --no-git-tag-version >/dev/null)
+else
+  log "Aplicando bump: $RELEASE_TYPE"
+  (cd "$PROJECT_ROOT" && npm version "$RELEASE_TYPE" --no-git-tag-version >/dev/null)
+fi
 
 new_version="$(cd "$PROJECT_ROOT" && npm pkg get version | tr -d '"[:space:]')"
 log "Nova versão: $new_version"
 
 log "Executando deploy com publish de package"
+deploy_publish_primary="${DEPLOY_PACKAGE_PUBLISH:-1}"
+deploy_publish_secondary="${DEPLOY_PACKAGE_PUBLISH_SECONDARY:-1}"
+
+if [ "$RELEASE_REQUIRE_DUAL_PUBLISH" = "1" ]; then
+  if [ "$deploy_publish_primary" != "1" ] || [ "$deploy_publish_secondary" != "1" ]; then
+    printf '[release] RELEASE_REQUIRE_DUAL_PUBLISH=1 exige DEPLOY_PACKAGE_PUBLISH=1 e DEPLOY_PACKAGE_PUBLISH_SECONDARY=1.\n' >&2
+    exit 1
+  fi
+fi
 
 if ! (
   cd "$PROJECT_ROOT"
   DEPLOY_PACKAGE_STEP="${DEPLOY_PACKAGE_STEP:-1}" \
-  DEPLOY_PACKAGE_PUBLISH="${DEPLOY_PACKAGE_PUBLISH:-1}" \
-  DEPLOY_PACKAGE_PUBLISH_SECONDARY="${DEPLOY_PACKAGE_PUBLISH_SECONDARY:-1}" \
+  DEPLOY_PACKAGE_PUBLISH="$deploy_publish_primary" \
+  DEPLOY_PACKAGE_PUBLISH_SECONDARY="$deploy_publish_secondary" \
   DEPLOY_PACKAGE_SECONDARY_REGISTRY="${DEPLOY_PACKAGE_SECONDARY_REGISTRY:-https://registry.npmjs.org}" \
   DEPLOY_PACKAGE_SECONDARY_ACCESS="${DEPLOY_PACKAGE_SECONDARY_ACCESS:-public}" \
   DEPLOY_PACKAGE_INSTALL="${DEPLOY_PACKAGE_INSTALL:-0}" \
@@ -147,13 +319,14 @@ if [ "$RELEASE_GIT_COMMIT_VERSION" = "1" ]; then
   commit_and_push_if_dirty "${RELEASE_GIT_VERSION_COMMIT_PREFIX}${new_version}"
 fi
 
+release_tag="${RELEASE_GITHUB_TAG_PREFIX}${new_version}"
+
 if [ "$RELEASE_GITHUB_RELEASE" = "1" ]; then
   if [ "$RELEASE_GIT_AUTO_PUSH" != "1" ]; then
     printf '[release] RELEASE_GITHUB_RELEASE=1 requer RELEASE_GIT_AUTO_PUSH=1 para garantir commit acessível no GitHub.\n' >&2
     exit 1
   fi
 
-  local_tag="${RELEASE_GITHUB_TAG_PREFIX}${new_version}"
   local_name="${RELEASE_GITHUB_NAME_PREFIX}${new_version}"
   local_target="$RELEASE_GITHUB_TARGET"
   if [ -z "$local_target" ]; then
@@ -176,10 +349,10 @@ if [ "$RELEASE_GITHUB_RELEASE" = "1" ]; then
   local draft_bool=""
   draft_bool="$(to_bool "$RELEASE_GITHUB_DRAFT")"
 
-  log "Criando/atualizando GitHub Release ($local_tag)"
+  log "Criando/atualizando GitHub Release ($release_tag)"
   release_output="$(
     cd "$PROJECT_ROOT" && node ./scripts/github-release-notify.mjs upsert \
-      --tag "$local_tag" \
+      --tag "$release_tag" \
       --target "$local_target" \
       --name "$local_name" \
       --generate-notes "$generate_notes_bool" \
@@ -189,4 +362,28 @@ if [ "$RELEASE_GITHUB_RELEASE" = "1" ]; then
   log "GitHub Release atualizado: $release_output"
 fi
 
+if [ "$RELEASE_VERIFY_UNIFIED_VERSION" = "1" ]; then
+  pkg_name="$(cd "$PROJECT_ROOT" && npm pkg get name | tr -d '"[:space:]')"
+  if [ -z "$pkg_name" ]; then
+    printf '[release] Falha ao ler nome do pacote para verificação final.\n' >&2
+    exit 1
+  fi
+
+  local_version_now="$(cd "$PROJECT_ROOT" && npm pkg get version | tr -d '"[:space:]')"
+  if [ "$local_version_now" != "$new_version" ]; then
+    printf '[release] Versão local divergente após release: esperado=%s encontrado=%s\n' "$new_version" "$local_version_now" >&2
+    exit 1
+  fi
+  log "Verificado localmente: versão=$local_version_now"
+
+  verify_registry_version "$pkg_name" "$new_version" "$RELEASE_VERIFY_PRIMARY_REGISTRY" "$RELEASE_VERIFY_PRIMARY_TOKEN_KEYS" "1"
+  verify_registry_version "$pkg_name" "$new_version" "$RELEASE_VERIFY_SECONDARY_REGISTRY" "$RELEASE_VERIFY_SECONDARY_TOKEN_KEYS" "0"
+
+  gh_release_check="$(
+    cd "$PROJECT_ROOT" && node ./scripts/github-release-notify.mjs get --tag "$release_tag"
+  )"
+  log "Verificado GitHub Release: $gh_release_check"
+  log "Verificação final concluída: todas as versões estão em $new_version"
+fi
+
 log "Release concluída: $new_version"