@kb-labs/release-manager-cli 2.103.0 → 2.105.0

package/dist/cli/commands/stage.js

@@ -0,0 +1,171 @@
+import { createHash } from 'crypto';
+import { spawnSync } from 'child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { defineCommand, findRepoRoot, useConfig, useLoader } from '@kb-labs/sdk';
+import { mergeConfigWithFlow, discoverCurrentPackages, resolveFlowFromTag } from '@kb-labs/release-manager-core';
+
+// src/cli/commands/stage.ts
+function rewriteLinkDep(deps, depName, val, pkgPath, versionMap) {
+  const pinned = versionMap.get(depName);
+  if (pinned) {
+    deps[depName] = `^${pinned}`;
+    return;
+  }
+  try {
+    const linkPath = val.slice("link:".length);
+    const linked = JSON.parse(readFileSync(join(pkgPath, linkPath, "package.json"), "utf-8"));
+    deps[depName] = `^${linked.version ?? "*"}`;
+  } catch {
+    deps[depName] = "*";
+  }
+}
+function rewriteWorkspaceDep(deps, depName, val, versionMap) {
+  const pinned = versionMap.get(depName);
+  if (!pinned) {
+    return false;
+  }
+  deps[depName] = val === "workspace:*" ? `^${pinned}` : val.replace("workspace:", "");
+  return true;
+}
+function rewriteDepsSection(deps, pkgPath, versionMap, packageManager) {
+  let modified = false;
+  for (const depName of Object.keys(deps)) {
+    const val = deps[depName];
+    if (typeof val !== "string") {
+      continue;
+    }
+    if (val.startsWith("link:")) {
+      rewriteLinkDep(deps, depName, val, pkgPath, versionMap);
+      modified = true;
+    } else if (val.startsWith("workspace:") && packageManager !== "pnpm" && rewriteWorkspaceDep(deps, depName, val, versionMap)) {
+      modified = true;
+    }
+  }
+  return modified;
+}
+function rewriteWorkspaceDeps(pkg, versionMap, packageManager) {
+  const pkgPath = pkg.path;
+  const pkgJsonPath = join(pkgPath, "package.json");
+  const original = readFileSync(pkgJsonPath, "utf-8");
+  const pkgJson = JSON.parse(original);
+  let modified = false;
+  if (pkgJson.version !== pkg.version) {
+    pkgJson.version = pkg.version;
+    modified = true;
+  }
+  for (const section of ["dependencies", "peerDependencies"]) {
+    const deps = pkgJson[section];
+    if (!deps) {
+      continue;
+    }
+    if (rewriteDepsSection(deps, pkgPath, versionMap, packageManager)) {
+      modified = true;
+    }
+  }
+  if (modified) {
+    writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
+  }
+  return () => writeFileSync(pkgJsonPath, original);
+}
+function resolveFlowName(config, flags) {
+  if (flags.flow) {
+    return flags.flow;
+  }
+  if (flags["release-tag"]) {
+    const resolved = resolveFlowFromTag(config, flags["release-tag"]);
+    if (!resolved) {
+      return { error: `Could not resolve a release.flows entry from tag "${flags["release-tag"]}"` };
+    }
+    return resolved.flowName;
+  }
+  return { error: "requires --flow or --release-tag" };
+}
+
+// src/cli/commands/stage.ts
+var stage_default = defineCommand({
+  id: "release:stage",
+  description: "Pack the currently-committed package versions for a flow into real npm tarballs, once, for `release deliver` to ship",
+  handler: {
+    async execute(ctx, input) {
+      const { flags } = input;
+      const cwd = ctx.cwd || process.cwd();
+      const repoRoot = await findRepoRoot(cwd);
+      const fileConfig = await useConfig();
+      const baseConfig = fileConfig ?? {};
+      const flowResult = resolveFlowName(baseConfig, flags);
+      if (typeof flowResult !== "string") {
+        const msg = `release:stage ${flowResult.error}`;
+        if (flags.json) {
+          ctx.ui?.json?.({ error: msg });
+        } else {
+          ctx.ui?.error?.(msg);
+        }
+        return { exitCode: 1 };
+      }
+      const flowName = flowResult;
+      const config = mergeConfigWithFlow(baseConfig, flowName);
+      const outDir = join(repoRoot, flags["out-dir"] ?? ".kb/release/artifacts");
+      mkdirSync(outDir, { recursive: true });
+      const discoverLoader = useLoader(`Discovering currently-committed packages for flow "${flowName}"...`);
+      discoverLoader.start();
+      const discovered = await discoverCurrentPackages(repoRoot, void 0, config);
+      discoverLoader.succeed(`Found ${discovered.length} package(s) to stage`);
+      if (discovered.length === 0) {
+        const msg = `No packages found for flow "${flowName}"`;
+        if (flags.json) {
+          ctx.ui?.json?.({ outDir, artifacts: [] });
+        } else {
+          ctx.ui?.write?.(msg);
+        }
+        return { exitCode: 1 };
+      }
+      const versionMap = new Map(discovered.map((pkg) => [pkg.name, pkg.currentVersion]));
+      const artifacts = [];
+      const packLoader = useLoader("Packing tarballs...");
+      packLoader.start();
+      for (const pkg of discovered) {
+        const restore = rewriteWorkspaceDeps({ path: pkg.path, version: pkg.currentVersion }, versionMap, "npm");
+        try {
+          const packResult = spawnSync("npm", ["pack", "--pack-destination", outDir, "--json"], {
+            cwd: pkg.path,
+            stdio: "pipe"
+          });
+          if (packResult.status !== 0) {
+            const stderr = packResult.stderr?.toString().trim() || packResult.stdout?.toString().trim();
+            throw new Error(`npm pack failed for ${pkg.name}@${pkg.currentVersion}${stderr ? `: ${stderr}` : ""}`);
+          }
+          const parsed = JSON.parse(packResult.stdout.toString());
+          const filename = parsed[0]?.filename;
+          if (!filename) {
+            throw new Error(`npm pack produced no tarball for ${pkg.name}@${pkg.currentVersion}`);
+          }
+          const sha256 = createHash("sha256").update(readFileSync(join(outDir, filename))).digest("hex");
+          artifacts.push({ name: pkg.name, version: pkg.currentVersion, tarball: filename, sha256 });
+        } finally {
+          restore();
+        }
+      }
+      packLoader.succeed(`Packed ${artifacts.length} tarball(s) to ${outDir}`);
+      writeFileSync(join(outDir, "manifest.json"), JSON.stringify(artifacts, null, 2) + "\n", "utf-8");
+      const result = { exitCode: 0, outDir, artifacts };
+      if (flags.json) {
+        ctx.ui?.json?.(result);
+        return result;
+      }
+      ctx.ui?.sideBox?.({
+        title: "Stage",
+        sections: [{
+          header: `Staged to ${outDir}`,
+          items: artifacts.map((a) => `${ctx.ui.symbols.success} ${a.name}@${a.version} \u2192 ${a.tarball}`)
+        }],
+        status: "success"
+      });
+      return result;
+    }
+  }
+});
+
+export { stage_default as default };
+//# sourceMappingURL=stage.js.map
+//# sourceMappingURL=stage.js.map

package/dist/cli/commands/stage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/shared/dep-rewrite.ts","../../../src/shared/resolve-flow.ts","../../../src/cli/commands/stage.ts"],"names":["join","readFileSync","writeFileSync"],"mappings":";;;;;;;;AAyBA,SAAS,cAAA,CACP,IAAA,EACA,OAAA,EACA,GAAA,EACA,SACA,UAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,OAAO,CAAA;AACrC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC1B,IAAA;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AACzC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,IAAA,CAAK,SAAS,QAAA,EAAU,cAAc,CAAA,EAAG,OAAO,CAAC,CAAA;AACxF,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,CAAA,CAAA,EAAI,MAAA,CAAO,WAAW,GAAG,CAAA,CAAA;AAAA,EAC3C,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,GAAA;AAAA,EAClB;AACF;AAEA,SAAS,mBAAA,CACP,IAAA,EACA,OAAA,EACA,GAAA,EACA,UAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,OAAO,CAAA;AACrC,EAAA,IAAI,CAAC,MAAA,EAAQ;AAAE,IAAA,OAAO,KAAA;AAAA,EAAO;AAC7B,EAAA,IAAA,CAAK,OAAO,CAAA,GAAI,GAAA,KAAQ,aAAA,GAAgB,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AACnF,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,kBAAA,CACP,IAAA,EACA,OAAA,EACA,UAAA,EACA,cAAA,EACS;AACT,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,OAAA,IAAW,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACvC,IAAA,MAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AACxB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAAE,MAAA;AAAA,IAAU;AACzC,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AAC3B,MAAA,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA;AACtD,MAAA,QAAA,GAAW,IAAA;AAAA,IACb,CAAA,MAAA,IAAW,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,cAAA,KAAmB,MAAA,IAAU,mBAAA,CAAoB,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,UAAU,CAAA,EAAG;AAC3H,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAEO,SAAS,oBAAA,CACd,GAAA,EACA,UAAA,EACA,cAAA,EACY;AACZ,EAAA,MAAM,UAAU,GAAA,CAAI,IAAA;AACpB,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAChD,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,WAAA,EAAa,OAAO,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAA,GAAW,KAAA;AAEf,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,GAAA,CAAI,OAAA,EAAS;AACnC,IAAA,OAAA,CAAQ,UAAU,GAAA,CAAI,OAAA;AACtB,IAAA,QAAA,GAAW,IAAA;AAAA,EACb;AAEA,EAAA,KAAA,MAAW,OAAA,IAAW,CAAC,cAAA,EAAgB,kBAAkB,CAAA,EAAY;AACnE,IAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,CAAA;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM;AAAE,MAAA;AAAA,IAAU;AACvB,IAAA,IAAI,kBAAA,CAAmB,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,cAAc,CAAA,EAAG;AAAE,MAAA,QAAA,GAAW,IAAA;AAAA,IAAM;AAAA,EACxF;AAEA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,aAAA,CAAc,aAAa,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,CAAC,IAAI,IAAI,CAAA;AAAA,EACpE;AAEA,EAAA,OAAO,MAAM,aAAA,CAAc,WAAA,EAAa,QAAQ,CAAA;AAClD;AC1FO,SAAS,eAAA,CAAgB,QAAuB,KAAA,EAAwD;AAC7G,EAAA,IAAI,MAAM,IAAA,EAAM;AAAE,IAAA,OAAO,KAAA,CAAM,IAAA;AAAA,EAAM;AACrC,EAAA,IAAI,KAAA,CAAM,aAAa,CAAA,EAAG;AACxB,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,MAAA,EAAQ,KAAA,CAAM,aAAa,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,KAAA,EAAO,CAAA,kDAAA,EAAqD,KAAA,CAAM,aAAa,CAAC,CAAA,CAAA,CAAA,EAAI;AAAA,IAC/F;AACA,IAAA,OAAO,QAAA,CAAS,QAAA;AAAA,EAClB;AACA,EAAA,OAAO,EAAE,OAAO,kCAAA,EAAmC;AACrD;;;ACyBA,IAAO,gBAAQ,aAAA,CAAc;AAAA,EAC3B,EAAA,EAAI,eAAA;AAAA,EACJ,WAAA,EAAa,sHAAA;AAAA,EAEb,OAAA,EAAS;AAAA,IACP,MAAM,OAAA,CAAQ,GAAA,EAAsB,KAAA,EAAmD;AACrF,MAAA,MAAM,EAAE,OAAM,GAAI,KAAA;AAClB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACnC,MAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa,GAAG,CAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,MAAM,SAAA,EAAyB;AAClD,MAAA,MAAM,UAAA,GAA4B,cAAc,EAAC;AAEjD,MAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,UAAA,EAAY,KAAK,CAAA;AACpD,MAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,QAAA,MAAM,GAAA,GAAM,CAAA,cAAA,EAAiB,UAAA,CAAW,KAAK,CAAA,CAAA;AAC7C,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,IAAA,GAAO,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,GAAG,CAAA;AAAA,QAAG;AACjF,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AACA,MAAA,MAAM,QAAA,GAAW,UAAA;AAEjB,MAAA,MAAM,MAAA,GAAwB,mBAAA,CAAoB,UAAA,EAAY,QAAQ,CAAA;AACtE,MAAA,MAAM,SAASA,IAAAA,CAAK,QAAA,EAAU,KAAA,CAAM,SAAS,KAAK,uBAAuB,CAAA;AACzE,MAAA,SAAA,CAAU,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAErC,MAAA,MAAM,cAAA,GAAiB,SAAA,CAAU,CAAA,mDAAA,EAAsD,QAAQ,CAAA,IAAA,CAAM,CAAA;AACrG,MAAA,cAAA,CAAe,KAAA,EAAM;AACrB,MAAA,MAAM,UAAA,GAAa,MAAM,uBAAA,CAAwB,QAAA,EAAU,QAAW,MAAM,CAAA;AAC5E,MAAA,cAAA,CAAe,OAAA,CAAQ,CAAA,MAAA,EAAS,UAAA,CAAW,MAAM,CAAA,oBAAA,CAAsB,CAAA;AAEvE,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAM,GAAA,GAAM,+BAA+B,QAAQ,CAAA,CAAA,CAAA;AACnD,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,IAAI,IAAA,GAAO,EAAE,QAAQ,SAAA,EAAW,IAAI,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,GAAG,CAAA;AAAA,QAAG;AAC5F,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AAEA,MAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,UAAA,CAAW,GAAA,CAAI,CAAA,GAAA,KAAO,CAAC,GAAA,CAAI,IAAA,EAAM,GAAA,CAAI,cAAc,CAAC,CAAC,CAAA;AAChF,MAAA,MAAM,YAA8B,EAAC;AAErC,MAAA,MAAM,UAAA,GAAa,UAAU,qBAAqB,CAAA;AAClD,MAAA,UAAA,CAAW,KAAA,EAAM;AACjB,MAAA,KAAA,MAAW,OAAO,UAAA,EAAY;AAC5B,QAAA,MAAM,OAAA,GAAU,oBAAA,CAAqB,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,cAAA,EAAe,EAAG,UAAA,EAAY,KAAK,CAAA;AACvG,QAAA,IAAI;AACF,UAAA,MAAM,UAAA,GAAa,UAAU,KAAA,EAAO,CAAC,QAAQ,oBAAA,EAAsB,MAAA,EAAQ,QAAQ,CAAA,EAAG;AAAA,YACpF,KAAK,GAAA,CAAI,IAAA;AAAA,YACT,KAAA,EAAO;AAAA,WACR,CAAA;AACD,UAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,YAAA,MAAM,MAAA,GAAS,UAAA,CAAW,MAAA,EAAQ,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,UAAA,CAAW,MAAA,EAAQ,QAAA,EAAS,CAAE,IAAA,EAAK;AAC1F,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,cAAc,CAAA,EAAG,MAAA,GAAS,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,UACvG;AACA,UAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,MAAA,CAAO,UAAU,CAAA;AACtD,UAAA,MAAM,QAAA,GAAW,MAAA,CAAO,CAAC,CAAA,EAAG,QAAA;AAC5B,UAAA,IAAI,CAAC,QAAA,EAAU;AACb,YAAA,MAAM,IAAI,MAAM,CAAA,iCAAA,EAAoC,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,cAAc,CAAA,CAAE,CAAA;AAAA,UACtF;AACA,UAAA,MAAM,MAAA,GAAS,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAOC,YAAAA,CAAaD,IAAAA,CAAK,MAAA,EAAQ,QAAQ,CAAC,CAAC,CAAA,CAAE,OAAO,KAAK,CAAA;AAC7F,UAAA,SAAA,CAAU,IAAA,CAAK,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,cAAA,EAAgB,OAAA,EAAS,QAAA,EAAU,MAAA,EAAQ,CAAA;AAAA,QAC3F,CAAA,SAAE;AACA,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF;AACA,MAAA,UAAA,CAAW,QAAQ,CAAA,OAAA,EAAU,SAAA,CAAU,MAAM,CAAA,eAAA,EAAkB,MAAM,CAAA,CAAE,CAAA;AAEvE,MAAAE,aAAAA,CAAcF,IAAAA,CAAK,MAAA,EAAQ,eAAe,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,SAAA,EAAW,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM,OAAO,CAAA;AAE/F,MAAA,MAAM,MAAA,GAAsB,EAAE,QAAA,EAAU,CAAA,EAAG,QAAQ,SAAA,EAAU;AAC7D,MAAA,IAAI,MAAM,IAAA,EAAM;AACd,QAAA,GAAA,CAAI,EAAA,EAAI,OAAO,MAAM,CAAA;AACrB,QAAA,OAAO,MAAA;AAAA,MACT;AAEA,MAAA,GAAA,CAAI,IAAI,OAAA,GAAU;AAAA,QAChB,KAAA,EAAO,OAAA;AAAA,QACP,UAAU,CAAC;AAAA,UACT,MAAA,EAAQ,aAAa,MAAM,CAAA,CAAA;AAAA,UAC3B,OAAO,SAAA,CAAU,GAAA,CAAI,OAAK,CAAA,EAAG,GAAA,CAAI,GAAG,OAAA,CAAQ,OAAO,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,QAAA,EAAM,CAAA,CAAE,OAAO,CAAA,CAAE;AAAA,SAC5F,CAAA;AAAA,QACD,MAAA,EAAQ;AAAA,OACT,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT;AAAA;AAEJ,CAAC","file":"stage.js","sourcesContent":["/**\n * Rewrite a package's own version and workspace:/link: dependency references\n * before `pnpm publish`, so the tarball on disk matches what's about to be\n * published even when that version was never persisted to package.json.\n *\n * - Own version: stable releases already have the target version on disk\n *   (written by updatePackageVersions() before this runs), so this is a\n *   no-op for them. Canary releases compute nextVersion in-memory only —\n *   never committed to package.json/git — so without this, `pnpm publish`\n *   would read the OLD on-disk version, and either fail outright or (worse)\n *   get misclassified as \"already published\" by the retry/idempotency\n *   patterns since that old version genuinely IS already on the registry.\n * - pnpm handles `workspace:*` natively during `pnpm publish` — no rewrite needed.\n * - npm/yarn do NOT — we must replace with `^version` before publish.\n * - `link:` references are never valid on the npm registry — always rewrite.\n *\n * Returns a restore function that reverts package.json to original content.\n * Call it in a finally block to guarantee cleanup.\n */\n\nimport { readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\n\n// ── rewriteWorkspaceDeps helpers ──────────────────────────────────────────\n\nfunction rewriteLinkDep(\n  deps: Record<string, string>,\n  depName: string,\n  val: string,\n  pkgPath: string,\n  versionMap: Map<string, string>,\n): void {\n  const pinned = versionMap.get(depName);\n  if (pinned) {\n    deps[depName] = `^${pinned}`;\n    return;\n  }\n  try {\n    const linkPath = val.slice('link:'.length);\n    const linked = JSON.parse(readFileSync(join(pkgPath, linkPath, 'package.json'), 'utf-8')) as { version?: string };\n    deps[depName] = `^${linked.version ?? '*'}`;\n  } catch {\n    deps[depName] = '*';\n  }\n}\n\nfunction rewriteWorkspaceDep(\n  deps: Record<string, string>,\n  depName: string,\n  val: string,\n  versionMap: Map<string, string>,\n): boolean {\n  const pinned = versionMap.get(depName);\n  if (!pinned) { return false; }\n  deps[depName] = val === 'workspace:*' ? `^${pinned}` : val.replace('workspace:', '');\n  return true;\n}\n\nfunction rewriteDepsSection(\n  deps: Record<string, string>,\n  pkgPath: string,\n  versionMap: Map<string, string>,\n  packageManager: string,\n): boolean {\n  let modified = false;\n  for (const depName of Object.keys(deps)) {\n    const val = deps[depName];\n    if (typeof val !== 'string') { continue; }\n    if (val.startsWith('link:')) {\n      rewriteLinkDep(deps, depName, val, pkgPath, versionMap);\n      modified = true;\n    } else if (val.startsWith('workspace:') && packageManager !== 'pnpm' && rewriteWorkspaceDep(deps, depName, val, versionMap)) {\n      modified = true;\n    }\n  }\n  return modified;\n}\n\nexport function rewriteWorkspaceDeps(\n  pkg: { path: string; version: string },\n  versionMap: Map<string, string>,\n  packageManager: string,\n): () => void {\n  const pkgPath = pkg.path;\n  const pkgJsonPath = join(pkgPath, 'package.json');\n  const original = readFileSync(pkgJsonPath, 'utf-8');\n  const pkgJson = JSON.parse(original) as Record<string, unknown> & { version?: string };\n  let modified = false;\n\n  if (pkgJson.version !== pkg.version) {\n    pkgJson.version = pkg.version;\n    modified = true;\n  }\n\n  for (const section of ['dependencies', 'peerDependencies'] as const) {\n    const deps = pkgJson[section] as Record<string, string> | undefined;\n    if (!deps) { continue; }\n    if (rewriteDepsSection(deps, pkgPath, versionMap, packageManager)) { modified = true; }\n  }\n\n  if (modified) {\n    writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n  }\n\n  return () => writeFileSync(pkgJsonPath, original);\n}\n\n// ── topoSort helpers ──────────────────────────────────────────────────────\n\n/**\n * Build a simple topological sort of packages for publish order.\n *\n * Packages are grouped into \"waves\": wave 0 has no intra-release deps,\n * wave 1 depends only on wave 0, etc. Within each wave publish order\n * is arbitrary (safe to parallelise).\n *\n * Cycles (should not exist in a well-formed monorepo) fall into a\n * \"remainder\" group appended at the end.\n */\nexport interface TopoPackage {\n  name: string;\n  path: string;\n  version: string;\n}\n\nfunction buildIntraDeps(packages: TopoPackage[], nameSet: Set<string>): Map<string, Set<string>> {\n  const deps = new Map<string, Set<string>>();\n  for (const pkg of packages) {\n    const intra = new Set<string>();\n    try {\n      const pkgJson = JSON.parse(readFileSync(join(pkg.path, 'package.json'), 'utf-8')) as {\n        dependencies?: Record<string, string>;\n        peerDependencies?: Record<string, string>;\n      };\n      for (const section of ['dependencies', 'peerDependencies'] as const) {\n        for (const depName of Object.keys(pkgJson[section] ?? {})) {\n          if (nameSet.has(depName)) { intra.add(depName); }\n        }\n      }\n    } catch {\n      // If we can't read package.json, treat as no deps\n    }\n    deps.set(pkg.name, intra);\n  }\n  return deps;\n}\n\nfunction buildDependantsMap(packages: TopoPackage[], deps: Map<string, Set<string>>): Map<string, Set<string>> {\n  const dependants = new Map<string, Set<string>>();\n  for (const pkg of packages) {\n    for (const dep of deps.get(pkg.name) ?? []) {\n      if (!dependants.has(dep)) { dependants.set(dep, new Set()); }\n      dependants.get(dep)!.add(pkg.name);\n    }\n  }\n  return dependants;\n}\n\nfunction computeWaves(\n  packages: TopoPackage[],\n  deps: Map<string, Set<string>>,\n  dependants: Map<string, Set<string>>,\n): TopoPackage[][] {\n  const byName = new Map(packages.map(p => [p.name, p]));\n  const remaining = new Map<string, number>(\n    packages.map(p => [p.name, (deps.get(p.name) ?? new Set()).size])\n  );\n  const waves: TopoPackage[][] = [];\n\n  while (remaining.size > 0) {\n    const wave = [...remaining.entries()]\n      .filter(([, count]) => count === 0)\n      .map(([name]) => byName.get(name)!);\n\n    if (wave.length === 0) {\n      waves.push([...remaining.keys()].map(n => byName.get(n)!));\n      break;\n    }\n\n    waves.push(wave);\n    for (const pkg of wave) {\n      remaining.delete(pkg.name);\n      for (const dependant of dependants.get(pkg.name) ?? []) {\n        if (remaining.has(dependant)) {\n          remaining.set(dependant, (remaining.get(dependant) ?? 1) - 1);\n        }\n      }\n    }\n  }\n\n  return waves.filter(w => w.length > 0);\n}\n\nexport function topoSort(packages: TopoPackage[], _packageManager: string): TopoPackage[][] {\n  const nameSet = new Set(packages.map(p => p.name));\n  const deps = buildIntraDeps(packages, nameSet);\n  const dependants = buildDependantsMap(packages, deps);\n  return computeWaves(packages, deps, dependants);\n}\n","/**\n * Shared `--release-tag` / `--flow` resolution for commands that operate\n * on an already-decided release (`stage`, `deliver`) — mirrors the tag\n * grammar in `@kb-labs/release-manager-core`'s `resolveFlowFromTag` so CI\n * can pass just the tag and the plugin decides the flow, per the\n * \"plugin prepares, CI delivers\" release plan.\n */\n\nimport { resolveFlowFromTag, type ReleaseConfig } from '@kb-labs/release-manager-core';\n\nexport interface FlowResolvableFlags {\n  flow?: string;\n  'release-tag'?: string;\n}\n\nexport function resolveFlowName(config: ReleaseConfig, flags: FlowResolvableFlags): string | { error: string } {\n  if (flags.flow) { return flags.flow; }\n  if (flags['release-tag']) {\n    const resolved = resolveFlowFromTag(config, flags['release-tag']);\n    if (!resolved) {\n      return { error: `Could not resolve a release.flows entry from tag \"${flags['release-tag']}\"` };\n    }\n    return resolved.flowName;\n  }\n  return { error: 'requires --flow or --release-tag' };\n}\n","/**\n * Standalone stage command — packs the flow's currently-committed package\n * versions into real npm tarballs, once, so every downstream `release\n * deliver` job ships the exact same bytes instead of re-packing\n * independently from source. See plugins/release/docs/adr/0001-* and the\n * \"plugin prepares, CI delivers\" release plan.\n *\n * Deliberately does NOT call planRelease() — same reasoning as promote.ts:\n * versions are already fixed by the prepare step that already ran (version\n * bump, changelog, git commit/tag/push). This command's only job is\n * \"pack exactly what's already on disk, unchanged.\"\n *\n * Not to be confused with `release:pack` (`pack.ts`) — that command\n * verifies *proposed* packages via `npm pack` + static checks before a\n * release is decided; this one produces the *actual* tarball artifact for\n * an already-decided release.\n */\n\nimport { createHash } from 'node:crypto';\nimport { spawnSync } from 'node:child_process';\nimport { mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { defineCommand, type CLIInput, type PluginContextV3, useLoader, useConfig } from '@kb-labs/sdk';\nimport {\n  discoverCurrentPackages,\n  mergeConfigWithFlow,\n  type ReleaseConfig,\n} from '@kb-labs/release-manager-core';\nimport { findRepoRoot } from '../../shared/utils';\nimport { rewriteWorkspaceDeps } from '../../shared/dep-rewrite';\nimport { resolveFlowName, type FlowResolvableFlags } from '../../shared/resolve-flow';\n\ninterface StageFlags extends FlowResolvableFlags {\n  'out-dir'?: string;\n  json?: boolean;\n}\n\nexport interface StagedArtifact {\n  name: string;\n  version: string;\n  tarball: string;\n  sha256: string;\n}\n\ninterface StageResult {\n  exitCode: number;\n  outDir?: string;\n  artifacts?: StagedArtifact[];\n}\n\nexport default defineCommand({\n  id: 'release:stage',\n  description: 'Pack the currently-committed package versions for a flow into real npm tarballs, once, for `release deliver` to ship',\n\n  handler: {\n    async execute(ctx: PluginContextV3, input: CLIInput<StageFlags>): Promise<StageResult> {\n      const { flags } = input;\n      const cwd = ctx.cwd || process.cwd();\n      const repoRoot = await findRepoRoot(cwd);\n\n      const fileConfig = await useConfig<ReleaseConfig>();\n      const baseConfig: ReleaseConfig = fileConfig ?? {};\n\n      const flowResult = resolveFlowName(baseConfig, flags);\n      if (typeof flowResult !== 'string') {\n        const msg = `release:stage ${flowResult.error}`;\n        if (flags.json) { ctx.ui?.json?.({ error: msg }); } else { ctx.ui?.error?.(msg); }\n        return { exitCode: 1 };\n      }\n      const flowName = flowResult;\n\n      const config: ReleaseConfig = mergeConfigWithFlow(baseConfig, flowName);\n      const outDir = join(repoRoot, flags['out-dir'] ?? '.kb/release/artifacts');\n      mkdirSync(outDir, { recursive: true });\n\n      const discoverLoader = useLoader(`Discovering currently-committed packages for flow \"${flowName}\"...`);\n      discoverLoader.start();\n      const discovered = await discoverCurrentPackages(repoRoot, undefined, config);\n      discoverLoader.succeed(`Found ${discovered.length} package(s) to stage`);\n\n      if (discovered.length === 0) {\n        const msg = `No packages found for flow \"${flowName}\"`;\n        if (flags.json) { ctx.ui?.json?.({ outDir, artifacts: [] }); } else { ctx.ui?.write?.(msg); }\n        return { exitCode: 1 };\n      }\n\n      const versionMap = new Map(discovered.map(pkg => [pkg.name, pkg.currentVersion]));\n      const artifacts: StagedArtifact[] = [];\n\n      const packLoader = useLoader('Packing tarballs...');\n      packLoader.start();\n      for (const pkg of discovered) {\n        const restore = rewriteWorkspaceDeps({ path: pkg.path, version: pkg.currentVersion }, versionMap, 'npm');\n        try {\n          const packResult = spawnSync('npm', ['pack', '--pack-destination', outDir, '--json'], {\n            cwd: pkg.path,\n            stdio: 'pipe',\n          });\n          if (packResult.status !== 0) {\n            const stderr = packResult.stderr?.toString().trim() || packResult.stdout?.toString().trim();\n            throw new Error(`npm pack failed for ${pkg.name}@${pkg.currentVersion}${stderr ? `: ${stderr}` : ''}`);\n          }\n          const parsed = JSON.parse(packResult.stdout.toString()) as Array<{ filename: string }>;\n          const filename = parsed[0]?.filename;\n          if (!filename) {\n            throw new Error(`npm pack produced no tarball for ${pkg.name}@${pkg.currentVersion}`);\n          }\n          const sha256 = createHash('sha256').update(readFileSync(join(outDir, filename))).digest('hex');\n          artifacts.push({ name: pkg.name, version: pkg.currentVersion, tarball: filename, sha256 });\n        } finally {\n          restore();\n        }\n      }\n      packLoader.succeed(`Packed ${artifacts.length} tarball(s) to ${outDir}`);\n\n      writeFileSync(join(outDir, 'manifest.json'), JSON.stringify(artifacts, null, 2) + '\\n', 'utf-8');\n\n      const result: StageResult = { exitCode: 0, outDir, artifacts };\n      if (flags.json) {\n        ctx.ui?.json?.(result);\n        return result;\n      }\n\n      ctx.ui?.sideBox?.({\n        title: 'Stage',\n        sections: [{\n          header: `Staged to ${outDir}`,\n          items: artifacts.map(a => `${ctx.ui.symbols.success} ${a.name}@${a.version} → ${a.tarball}`),\n        }],\n        status: 'success',\n      });\n\n      return result;\n    },\n  },\n});\n"]}

package/dist/index.js

@@ -121,6 +121,10 @@ var manifest = {
           "skip-checks": { type: "boolean", description: "Skip pre-release checks" },
           "skip-build": { type: "boolean", description: "Skip build step" },
           "skip-verify": { type: "boolean", description: "Skip artifact verification (npm pack check)" },
+          "skip-publish": {
+            type: "boolean",
+            description: "Prepare-only: build, version, changelog, git commit/tag \u2014 never publish to npm. No npm credentials required. Pair with a tag-triggered CI job running `kb release promote`."
+          },
           "no-verify": { type: "boolean", description: "Pass --no-verify to git push (bypasses pre-push hooks)" },
           yes: { type: "boolean", description: "Skip confirmation prompt \u2014 for CI/headless mode" },
           json: { type: "boolean", description: "Print result as JSON" }
@@ -134,7 +138,8 @@ var manifest = {
           "kb release run --scope @my-org/core",
           "kb release run --skip-checks --skip-build",
           "kb release run --strict --json",
-          "kb release run --channel canary --yes"
+          "kb release run --channel canary --yes",
+          "kb release run --flow platform --skip-publish --yes"
         ]
       },
       // release:publish - Publish packages to npm
@@ -166,6 +171,26 @@ var manifest = {
           "kb release publish --tag next --access public"
         ]
       },
+      // release:stage - Pack the currently-committed versions into real tarballs, once
+      {
+        path: "release stage",
+        category: "Publish",
+        describe: "Pack the currently-committed package versions for a flow into real npm tarballs, once, for `release deliver` to ship",
+        operationType: "execute",
+        longDescription: "Produces the actual npm tarball artifacts for a flow's already-committed package.json versions \u2014 no re-bump, no rebuild. Writes a manifest.json (name/version/tarball/sha256) alongside the tarballs. Intended to run once in CI right after checking out a release tag; every `release deliver` target then ships these exact bytes instead of re-packing independently. Not the same command as `release pack` (that one verifies proposed packages before a release is decided; this one packs an already-decided one).",
+        handler: "./cli/commands/stage.js#default",
+        flags: defineCommandFlags({
+          "release-tag": { type: "string", description: "Git tag to resolve {flow, channel} from (via release.flows[*].tagPattern) \u2014 alternative to --flow" },
+          flow: { type: "string", description: "Named flow \u2014 selects packages the same way `release run --flow` does (e.g. excludes sdk from platform)" },
+          "out-dir": { type: "string", description: "Output directory for tarballs + manifest.json (default: .kb/release/artifacts)" },
+          json: { type: "boolean", description: "Output in JSON format" }
+        }),
+        examples: [
+          "kb release stage --flow platform",
+          "kb release stage --release-tag platform-v2.105.0",
+          "kb release stage --flow sdk --out-dir .kb/release/artifacts"
+        ]
+      },
       // release:promote - Promote an already-released version to npm
       {
         path: "release promote",
@@ -176,6 +201,7 @@ var manifest = {
         handler: "./cli/commands/promote.js#default",
         flags: defineCommandFlags({
           scope: { type: "string", description: "Package scope (glob pattern)" },
+          flow: { type: "string", description: "Named flow \u2014 selects packages the same way `release run --flow` does (e.g. excludes sdk from platform)" },
           tag: { type: "string", description: 'npm dist-tag override (default: config.publish.stableTag, falls back to "latest")' },
           registry: { type: "string", description: "Registry override (default: config.publish.npmRegistry, falls back to real npm)" },
           otp: { type: "string", description: "One-time password (optional, will prompt if needed)" },
@@ -190,11 +216,44 @@ var manifest = {
         }),
         examples: [
           "kb release promote",
+          "kb release promote --flow platform",
+          "kb release promote --flow sdk",
           "kb release promote --scope @kb-labs/core",
           "kb release promote --dry-run",
           "kb release promote --tag next"
         ]
       },
+      // release:deliver - Ship a `release stage`d artifact to a target (npm)
+      {
+        path: "release deliver",
+        category: "Publish",
+        describe: "Ship the tarballs `release stage` already packed to a target \u2014 no packing, no rebuild",
+        operationType: "execute",
+        longDescription: 'CI-side half of the "plugin prepares, CI delivers" release flow: reads manifest.json written by `release stage` and ships those exact tarballs to --target (only "npm" is implemented this pass). Resolves {flow, channel} from --release-tag via release.flows[*].tagPattern so CI never needs to guess the flow itself \u2014 just pass the tag. Verifies the delivery against the real registry afterwards (with retry, since real npm has propagation lag); never attempts npm unpublish on a verification failure \u2014 that is a human decision.',
+        handler: "./cli/commands/deliver.js#default",
+        flags: defineCommandFlags({
+          "release-tag": { type: "string", description: "Git tag to resolve {flow, channel} from (via release.flows[*].tagPattern) \u2014 alternative to --flow" },
+          flow: { type: "string", description: "Named flow \u2014 alternative to --release-tag" },
+          target: { type: "string", choices: ["npm"], description: "Delivery target (default: npm \u2014 the only target implemented this pass)" },
+          "artifacts-dir": { type: "string", description: "Where `release stage` wrote tarballs + manifest.json (default: .kb/release/artifacts)" },
+          tag: { type: "string", description: 'npm dist-tag override (default: config.publish.stableTag, falls back to "latest")' },
+          registry: { type: "string", description: "Registry override (default: config.publish.npmRegistry, falls back to real npm)" },
+          otp: { type: "string", description: "One-time password (optional, will prompt if needed)" },
+          "dry-run": { type: "boolean", description: "Simulate delivery without actually publishing" },
+          access: {
+            type: "string",
+            choices: ["public", "restricted"],
+            description: "Package access level"
+          },
+          token: { type: "string", description: "NPM auth token (overrides NPM_TOKEN env)" },
+          json: { type: "boolean", description: "Output in JSON format" }
+        }),
+        examples: [
+          "kb release deliver --release-tag platform-v2.105.0 --target npm",
+          "kb release deliver --flow sdk --target npm",
+          "kb release deliver --release-tag sdk-v3.2.0 --dry-run"
+        ]
+      },
       // release:rollback - Rollback last release
       {
         path: "release rollback",