@kb-labs/release-manager-cli 2.119.0 → 2.119.1-canary.b53bbee1d

package/dist/manifest.json

@@ -0,0 +1,1309 @@
+{
+  "schema": "kb.plugin/3",
+  "id": "@kb-labs/release",
+  "version": "0.1.0",
+  "display": {
+    "name": "Release Manager",
+    "description": "Plan, execute, and audit releases across your workspace",
+    "tags": [
+      "release",
+      "publish",
+      "versioning"
+    ]
+  },
+  "platform": {
+    "requires": [
+      "storage",
+      "cache"
+    ],
+    "optional": [
+      "llm",
+      "analytics",
+      "logger"
+    ]
+  },
+  "setup": {
+    "handler": "./setup/handler.js#default",
+    "describe": "Prepare the .kb/release workspace (plans, reports, backups)."
+  },
+  "cli": {
+    "groupMeta": [
+      {
+        "path": "release",
+        "describe": "Release management commands"
+      }
+    ],
+    "commands": [
+      {
+        "path": "release plan",
+        "category": "Pipeline",
+        "describe": "Analyze changes and prepare release plan",
+        "operationType": "analyze",
+        "longDescription": "Detect modified packages and compute version bumps based on changes",
+        "handler": "./cli/commands/plan.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope (glob pattern)"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named release flow from release.flows"
+          },
+          {
+            "name": "bump",
+            "type": "string",
+            "default": "auto",
+            "description": "Version bump strategy",
+            "choices": [
+              "patch",
+              "minor",
+              "major",
+              "auto"
+            ]
+          },
+          {
+            "name": "channel",
+            "type": "string",
+            "default": "stable",
+            "description": "Release channel — canary previews the -canary.<shortsha> version shape",
+            "choices": [
+              "stable",
+              "canary"
+            ]
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Print plan as JSON"
+          }
+        ],
+        "examples": [
+          "kb release plan",
+          "kb release plan --scope packages/*",
+          "kb release plan --bump minor",
+          "kb release plan --channel canary",
+          "kb release plan --json"
+        ]
+      },
+      {
+        "path": "release run",
+        "category": "Pipeline",
+        "describe": "Execute release process (plan, check, publish)",
+        "operationType": "execute",
+        "longDescription": "Run full release: plan versions, run checks, publish packages",
+        "handler": "./cli/commands/run.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope or glob pattern (e.g. @my-org/core, packages/*)"
+          },
+          {
+            "name": "bump",
+            "type": "string",
+            "default": "auto",
+            "description": "Version bump override (default: auto-detect from commits)",
+            "choices": [
+              "patch",
+              "minor",
+              "major",
+              "auto"
+            ]
+          },
+          {
+            "name": "strict",
+            "type": "boolean",
+            "description": "Fail on any check failure"
+          },
+          {
+            "name": "channel",
+            "type": "string",
+            "default": "stable",
+            "description": "Release channel — canary publishes straight to npm under a prerelease tag, no git commit/tag",
+            "choices": [
+              "stable",
+              "canary"
+            ]
+          },
+          {
+            "name": "dry-run",
+            "type": "boolean",
+            "description": "Simulate release without publishing or tagging"
+          },
+          {
+            "name": "skip-checks",
+            "type": "boolean",
+            "description": "Skip pre-release checks"
+          },
+          {
+            "name": "skip-build",
+            "type": "boolean",
+            "description": "Skip build step"
+          },
+          {
+            "name": "skip-verify",
+            "type": "boolean",
+            "description": "Skip artifact verification (npm pack check)"
+          },
+          {
+            "name": "skip-publish",
+            "type": "boolean",
+            "description": "Prepare-only: build, version, changelog, git commit/tag — never publish to npm. No npm credentials required. Pair with a tag-triggered CI job running `kb release promote`."
+          },
+          {
+            "name": "no-verify",
+            "type": "boolean",
+            "description": "Pass --no-verify to git push (bypasses pre-push hooks)"
+          },
+          {
+            "name": "yes",
+            "type": "boolean",
+            "description": "Skip confirmation prompt — for CI/headless mode"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Print result as JSON"
+          }
+        ],
+        "examples": [
+          "kb release run",
+          "kb release run --dry-run",
+          "kb release run --yes",
+          "kb release run --yes --no-verify",
+          "kb release run --bump minor --yes",
+          "kb release run --scope @my-org/core",
+          "kb release run --skip-checks --skip-build",
+          "kb release run --strict --json",
+          "kb release run --channel canary --yes",
+          "kb release run --flow platform --skip-publish --yes"
+        ]
+      },
+      {
+        "path": "release publish",
+        "category": "Publish",
+        "describe": "Publish packages to npm registry",
+        "operationType": "execute",
+        "longDescription": "Smart npm publish with interactive 2FA support and better UX",
+        "handler": "./cli/commands/publish.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope (glob pattern)"
+          },
+          {
+            "name": "otp",
+            "type": "string",
+            "description": "One-time password (optional, will prompt if needed)"
+          },
+          {
+            "name": "dry-run",
+            "type": "boolean",
+            "description": "Simulate publish without actually publishing"
+          },
+          {
+            "name": "tag",
+            "type": "string",
+            "description": "NPM dist-tag (default: latest)"
+          },
+          {
+            "name": "access",
+            "type": "string",
+            "description": "Package access level",
+            "choices": [
+              "public",
+              "restricted"
+            ]
+          },
+          {
+            "name": "token",
+            "type": "string",
+            "description": "NPM auth token (overrides NPM_TOKEN env)"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release publish",
+          "kb release publish --scope @kb-labs/core",
+          "kb release publish --otp 123456",
+          "kb release publish --dry-run",
+          "kb release publish --tag next --access public"
+        ]
+      },
+      {
+        "path": "release stage",
+        "category": "Publish",
+        "describe": "Pack the currently-committed package versions for a flow into real npm tarballs, once, for `release deliver` to ship",
+        "operationType": "execute",
+        "longDescription": "Produces the actual npm tarball artifacts for a flow's already-committed package.json versions — no re-bump, no rebuild. Writes a manifest.json (name/version/tarball/sha256) alongside the tarballs. Intended to run once in CI right after checking out a release tag; every `release deliver` target then ships these exact bytes instead of re-packing independently. Not the same command as `release pack` (that one verifies proposed packages before a release is decided; this one packs an already-decided one).",
+        "handler": "./cli/commands/stage.js#default",
+        "flags": [
+          {
+            "name": "release-tag",
+            "type": "string",
+            "description": "Git tag to resolve {flow, channel} from (via release.flows[*].tagPattern) — alternative to --flow"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named flow — selects packages the same way `release run --flow` does (e.g. excludes sdk from platform)"
+          },
+          {
+            "name": "out-dir",
+            "type": "string",
+            "description": "Output directory for tarballs + manifest.json (default: .kb/release/artifacts)"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release stage --flow platform",
+          "kb release stage --release-tag platform-v2.105.0",
+          "kb release stage --flow sdk --out-dir .kb/release/artifacts"
+        ]
+      },
+      {
+        "path": "release stage plan",
+        "category": "Publish",
+        "describe": "Publish a release plan's planned package versions to a local staging registry (Verdaccio)",
+        "operationType": "execute",
+        "longDescription": "Runs BEFORE version bump, off the in-memory plan `release plan` already computed. Publishes each plan package at its PLANNED nextVersion — internal sibling dependencies rewritten to `^nextVersion` too — to --registry, so the `pack-install` Checks gate can verify cross-package dependencies against the version this release is about to ship instead of whatever is already live on npm. Distinct from `release stage`, which packs already-committed, already-bumped versions for CI delivery after approval.",
+        "handler": "./cli/commands/stage-plan.js#default",
+        "flags": [
+          {
+            "name": "plan-path",
+            "type": "string",
+            "description": "Path to the plan.json written by `release plan`"
+          },
+          {
+            "name": "registry",
+            "type": "string",
+            "description": "Target staging registry URL (e.g. http://localhost:4873)"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named flow — used only to resolve config for package discovery"
+          },
+          {
+            "name": "token",
+            "type": "string",
+            "description": "Auth token to send (default: \"verdaccio-local\" — a placeholder; the staging registry allows anonymous publish)"
+          },
+          {
+            "name": "tag",
+            "type": "string",
+            "description": "npm dist-tag to publish under (default: \"latest\")"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release stage plan --flow platform --plan-path .kb/release/plans/root/current/plan.json --registry http://localhost:4873"
+        ]
+      },
+      {
+        "path": "release clean install",
+        "category": "Publish",
+        "describe": "Install a packed tarball into a throwaway consumer and confirm it imports cleanly",
+        "operationType": "execute",
+        "longDescription": "Installs --tarball into a fresh, outside-the-workspace consumer project and confirms --name can be imported afterward. Shared by check-pack-install.sh (local release gate) and `release stage` (CI publish path) so both use identical verification — catches an already-published PEER dependency that is itself broken, which static manifest checks cannot see. Surfaces the real failure reason via @npmcli/arborist directly; plain `npm install` swallows this exact failure class as an unhandled rejection with no usable error.",
+        "handler": "./cli/commands/verify-clean-install.js#default",
+        "flags": [
+          {
+            "name": "tarball",
+            "type": "string",
+            "description": "Path to the packed tarball to install"
+          },
+          {
+            "name": "name",
+            "type": "string",
+            "description": "Package name to import after install"
+          },
+          {
+            "name": "registry",
+            "type": "string",
+            "description": "Registry override for ALL dependency resolution (default: real npm) — e.g. a local staging Verdaccio"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          },
+          {
+            "name": "additionalTarballs",
+            "type": "string",
+            "description": "Comma-separated tarball paths for workspace siblings. Forces pnpm to install these exact local artifacts via pnpm.overrides instead of resolving the same package names from the real npm registry — required with --package-manager pnpm to avoid silently testing an already-published, possibly stale, version of an in-repo sibling."
+          },
+          {
+            "name": "packageManager",
+            "type": "string",
+            "description": "\"pnpm\" enables the additionalTarballs override path; \"npm\" (default) keeps the plain Arborist install."
+          }
+        ],
+        "examples": [
+          "kb release clean install --tarball ./kb-labs-sdk-2.115.0.tgz --name @kb-labs/sdk",
+          "kb release clean install --tarball ./a.tgz --name @kb-labs/a --package-manager pnpm --additional-tarballs ./b.tgz,./c.tgz"
+        ]
+      },
+      {
+        "path": "release promote",
+        "category": "Publish",
+        "describe": "Promote already-released package versions to npm (no re-bump, no rebuild)",
+        "operationType": "execute",
+        "longDescription": "Publishes the CURRENT on-disk package.json versions to npm — no version bump, no rebuild. Intended to run after `release run --channel stable` (typically targeting Verdaccio via config.registry): once that run is verified, `release promote` pushes the exact same, already-committed versions to npm under the stable dist-tag.",
+        "handler": "./cli/commands/promote.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope (glob pattern)"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named flow — selects packages the same way `release run --flow` does (e.g. excludes sdk from platform)"
+          },
+          {
+            "name": "tag",
+            "type": "string",
+            "description": "npm dist-tag override (default: config.publish.stableTag, falls back to \"latest\")"
+          },
+          {
+            "name": "registry",
+            "type": "string",
+            "description": "Registry override (default: config.publish.npmRegistry, falls back to real npm)"
+          },
+          {
+            "name": "otp",
+            "type": "string",
+            "description": "One-time password (optional, will prompt if needed)"
+          },
+          {
+            "name": "dry-run",
+            "type": "boolean",
+            "description": "Simulate promote without actually publishing"
+          },
+          {
+            "name": "access",
+            "type": "string",
+            "description": "Package access level",
+            "choices": [
+              "public",
+              "restricted"
+            ]
+          },
+          {
+            "name": "token",
+            "type": "string",
+            "description": "NPM auth token (overrides NPM_TOKEN env)"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release promote",
+          "kb release promote --flow platform",
+          "kb release promote --flow sdk",
+          "kb release promote --scope @kb-labs/core",
+          "kb release promote --dry-run",
+          "kb release promote --tag next"
+        ]
+      },
+      {
+        "path": "release deliver",
+        "category": "Publish",
+        "describe": "Ship the tarballs `release stage` already packed to a target — no packing, no rebuild",
+        "operationType": "execute",
+        "longDescription": "CI-side half of the \"plugin prepares, CI delivers\" release flow: reads manifest.json written by `release stage` and ships those exact tarballs to --target (only \"npm\" is implemented this pass). Resolves {flow, channel} from --release-tag via release.flows[*].tagPattern so CI never needs to guess the flow itself — just pass the tag. Verifies the delivery against the real registry afterwards (with retry, since real npm has propagation lag); never attempts npm unpublish on a verification failure — that is a human decision.",
+        "handler": "./cli/commands/deliver.js#default",
+        "flags": [
+          {
+            "name": "release-tag",
+            "type": "string",
+            "description": "Git tag to resolve {flow, channel} from (via release.flows[*].tagPattern) — alternative to --flow"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named flow — alternative to --release-tag"
+          },
+          {
+            "name": "target",
+            "type": "string",
+            "description": "Delivery target (default: npm — the only target implemented this pass)",
+            "choices": [
+              "npm"
+            ]
+          },
+          {
+            "name": "artifacts-dir",
+            "type": "string",
+            "description": "Where `release stage` wrote tarballs + manifest.json (default: .kb/release/artifacts)"
+          },
+          {
+            "name": "tag",
+            "type": "string",
+            "description": "npm dist-tag override (default: config.publish.stableTag, falls back to \"latest\")"
+          },
+          {
+            "name": "registry",
+            "type": "string",
+            "description": "Registry override (default: config.publish.npmRegistry, falls back to real npm)"
+          },
+          {
+            "name": "otp",
+            "type": "string",
+            "description": "One-time password (optional, will prompt if needed)"
+          },
+          {
+            "name": "dry-run",
+            "type": "boolean",
+            "description": "Simulate delivery without actually publishing"
+          },
+          {
+            "name": "access",
+            "type": "string",
+            "description": "Package access level",
+            "choices": [
+              "public",
+              "restricted"
+            ]
+          },
+          {
+            "name": "token",
+            "type": "string",
+            "description": "NPM auth token (overrides NPM_TOKEN env)"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release deliver --release-tag platform-v2.105.0 --target npm",
+          "kb release deliver --flow sdk --target npm",
+          "kb release deliver --release-tag sdk-v3.2.0 --dry-run"
+        ]
+      },
+      {
+        "path": "release rollback",
+        "category": "Utilities",
+        "describe": "Rollback last release",
+        "operationType": "mutate",
+        "longDescription": "Restore workspace state from backup snapshot",
+        "handler": "./cli/commands/rollback.js#default",
+        "flags": [
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release rollback",
+          "kb release rollback --json"
+        ]
+      },
+      {
+        "path": "release report",
+        "category": "Utilities",
+        "describe": "Show last release report",
+        "operationType": "read",
+        "longDescription": "Display the most recent release execution report",
+        "handler": "./cli/commands/report.js#default",
+        "flags": [
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release report",
+          "kb release report --json"
+        ]
+      },
+      {
+        "path": "release status",
+        "category": "Utilities",
+        "describe": "Show what is actually stable vs. candidate for a flow (git tag, npm dist-tags, recent candidate CI)",
+        "operationType": "read",
+        "longDescription": "Cross-checks the latest stable git tag against real npm dist-tags and recent candidate CI runs, and flags drift — a tag or npm publish existing is not the same as a verified, promoted release.",
+        "handler": "./cli/commands/status.js#default",
+        "flags": [
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named release flow from release.flows (e.g. \"platform\", \"sdk\")",
+            "required": true
+          },
+          {
+            "name": "ci",
+            "type": "boolean",
+            "description": "Include recent candidate CI run status (default: true)"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release status --flow platform",
+          "kb release status --flow sdk --json"
+        ]
+      },
+      {
+        "path": "release changelog",
+        "category": "Utilities",
+        "describe": "Generate changelog from conventional commits",
+        "operationType": "read",
+        "longDescription": "Parse git history and generate changelog with conventional commits support",
+        "handler": "./cli/commands/changelog.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Filter to specific package"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named release flow from release.flows"
+          },
+          {
+            "name": "from",
+            "type": "string",
+            "description": "Start commit/tag"
+          },
+          {
+            "name": "to",
+            "type": "string",
+            "description": "End commit/tag (default: HEAD)"
+          },
+          {
+            "name": "since-tag",
+            "type": "string",
+            "description": "Shorthand for --from <tag>"
+          },
+          {
+            "name": "format",
+            "type": "string",
+            "default": "both",
+            "description": "Output format",
+            "choices": [
+              "json",
+              "md",
+              "both"
+            ]
+          },
+          {
+            "name": "level",
+            "type": "string",
+            "default": "standard",
+            "description": "Detail level",
+            "choices": [
+              "compact",
+              "standard",
+              "detailed"
+            ]
+          },
+          {
+            "name": "template",
+            "type": "string",
+            "description": "Template name (builtin: corporate, corporate-ai, technical, compact) or custom path"
+          },
+          {
+            "name": "breaking-only",
+            "type": "boolean",
+            "description": "Show only breaking changes"
+          },
+          {
+            "name": "include",
+            "type": "string",
+            "description": "Comma-separated types to include"
+          },
+          {
+            "name": "exclude",
+            "type": "string",
+            "description": "Types to exclude"
+          },
+          {
+            "name": "workspace-only",
+            "type": "boolean",
+            "description": "Only workspace changelog"
+          },
+          {
+            "name": "per-package",
+            "type": "boolean",
+            "description": "Only per-package changelogs"
+          },
+          {
+            "name": "force",
+            "type": "boolean",
+            "description": "Skip audit gate"
+          },
+          {
+            "name": "allow-major",
+            "type": "boolean",
+            "description": "Allow major bumps for experimental packages"
+          },
+          {
+            "name": "preid",
+            "type": "string",
+            "description": "Pre-release identifier (rc, beta, alpha)"
+          }
+        ],
+        "examples": [
+          "kb release changelog",
+          "kb release changelog --from v1.0.0",
+          "kb release changelog --format md --level detailed",
+          "kb release changelog --template corporate-ai",
+          "kb release changelog --template ./my-template.ts",
+          "kb release changelog --breaking-only"
+        ]
+      },
+      {
+        "path": "release verify",
+        "category": "Validation",
+        "describe": "Validate release readiness",
+        "operationType": "analyze",
+        "longDescription": "Validate release readiness via flag gates (packages, breaking changes, commit types)",
+        "handler": "./cli/commands/verify.js#default",
+        "flags": [
+          {
+            "name": "fail-if-empty",
+            "type": "boolean",
+            "description": "Fail if no version bumps needed"
+          },
+          {
+            "name": "fail-on-breaking",
+            "type": "boolean",
+            "description": "Fail if breaking changes detected"
+          },
+          {
+            "name": "allow-types",
+            "type": "string",
+            "description": "Comma-separated types required (e.g., feat,fix)"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release verify",
+          "kb release verify --fail-if-empty",
+          "kb release verify --allow-types feat,fix"
+        ]
+      },
+      {
+        "path": "release checks",
+        "category": "Validation",
+        "describe": "Run pre-release checks from release config",
+        "operationType": "analyze",
+        "longDescription": "Execute custom checks defined in release config (lint, test, audit, etc.)",
+        "handler": "./cli/commands/checks.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope (glob pattern)"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named release flow from release.flows"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release checks",
+          "kb release checks --scope @my-org/core",
+          "kb release checks --json"
+        ]
+      },
+      {
+        "path": "release build",
+        "category": "Publish",
+        "describe": "Build packages from release plan",
+        "operationType": "execute",
+        "longDescription": "Build all packages in plan into temp dir then atomically swap dist/",
+        "handler": "./cli/commands/build.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope (glob pattern)"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named release flow from release.flows"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release build",
+          "kb release build --scope platform",
+          "kb release build --json"
+        ]
+      },
+      {
+        "path": "release pack",
+        "category": "Publish",
+        "describe": "Verify built package artifacts via npm pack",
+        "operationType": "execute",
+        "longDescription": "Run npm pack checks: directory imports, test file leaks, missing exports, syntax errors",
+        "handler": "./cli/commands/pack.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope (glob pattern)"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release pack",
+          "kb release pack --scope @my-org/core",
+          "kb release pack --json"
+        ]
+      },
+      {
+        "path": "release version",
+        "category": "Publish",
+        "describe": "Bump package.json versions per release plan",
+        "operationType": "mutate",
+        "longDescription": "Update version fields in package.json files based on computed plan",
+        "handler": "./cli/commands/version.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope (glob pattern)"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named release flow from release.flows"
+          },
+          {
+            "name": "bump",
+            "type": "string",
+            "default": "auto",
+            "description": "Version bump override",
+            "choices": [
+              "patch",
+              "minor",
+              "major",
+              "auto"
+            ]
+          },
+          {
+            "name": "channel",
+            "type": "string",
+            "default": "stable",
+            "description": "Release channel — must match the channel `release plan` used, so a stale/rejected persisted plan is recomputed under the same channel instead of silently falling back to stable",
+            "choices": [
+              "stable",
+              "canary"
+            ]
+          },
+          {
+            "name": "dry-run",
+            "type": "boolean",
+            "description": "Show what would be bumped without writing"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release version",
+          "kb release version --bump minor",
+          "kb release version --channel canary",
+          "kb release version --dry-run",
+          "kb release version --scope platform --json"
+        ]
+      },
+      {
+        "path": "release git",
+        "category": "Publish",
+        "describe": "Commit, tag, and push release changes",
+        "operationType": "mutate",
+        "longDescription": "Create release commit, create version tags, and push to remote",
+        "handler": "./cli/commands/git.js#default",
+        "flags": [
+          {
+            "name": "scope",
+            "type": "string",
+            "description": "Package scope (glob pattern)"
+          },
+          {
+            "name": "flow",
+            "type": "string",
+            "description": "Named release flow from release.flows"
+          },
+          {
+            "name": "bump",
+            "type": "string",
+            "description": "Version bump override (used to reload plan)",
+            "choices": [
+              "patch",
+              "minor",
+              "major",
+              "auto"
+            ]
+          },
+          {
+            "name": "channel",
+            "type": "string",
+            "default": "stable",
+            "description": "Release channel — must match the channel `release plan`/`release version` used, so a stale/rejected persisted plan is recomputed under the same channel instead of silently falling back to stable",
+            "choices": [
+              "stable",
+              "canary"
+            ]
+          },
+          {
+            "name": "dry-run",
+            "type": "boolean",
+            "description": "Skip git operations"
+          },
+          {
+            "name": "no-verify",
+            "type": "boolean",
+            "description": "Pass --no-verify to git push"
+          },
+          {
+            "name": "json",
+            "type": "boolean",
+            "description": "Output in JSON format"
+          }
+        ],
+        "examples": [
+          "kb release git",
+          "kb release git --scope platform",
+          "kb release git --dry-run",
+          "kb release git --no-verify --json"
+        ]
+      }
+    ]
+  },
+  "rest": {
+    "basePath": "/v1/plugins/release",
+    "routes": [
+      {
+        "method": "GET",
+        "path": "/scopes",
+        "handler": "./rest/handlers/scopes-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#ScopesResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/status",
+        "handler": "./rest/handlers/status-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#StatusResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/plan",
+        "handler": "./rest/handlers/plan-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#PlanInputSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#PlanResponseSchema"
+        }
+      },
+      {
+        "method": "POST",
+        "path": "/generate",
+        "handler": "./rest/handlers/generate-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#GeneratePlanRequestSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#GeneratePlanResponseSchema"
+        },
+        "timeoutMs": 120000
+      },
+      {
+        "method": "DELETE",
+        "path": "/plan",
+        "handler": "./rest/handlers/reset-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#ResetPlanRequestSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#ResetPlanResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/changelog",
+        "handler": "./rest/handlers/changelog-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#ChangelogInputSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#ChangelogResponseSchema"
+        }
+      },
+      {
+        "method": "POST",
+        "path": "/changelog/generate",
+        "handler": "./rest/handlers/changelog-generate-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#GenerateChangelogRequestSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#GenerateChangelogResponseSchema"
+        },
+        "timeoutMs": 120000
+      },
+      {
+        "method": "POST",
+        "path": "/changelog/save",
+        "handler": "./rest/handlers/changelog-save-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#SaveChangelogRequestSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#SaveChangelogResponseSchema"
+        }
+      },
+      {
+        "method": "POST",
+        "path": "/run",
+        "handler": "./rest/handlers/run-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#RunReleaseRequestSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#RunReleaseResponseSchema"
+        },
+        "timeoutMs": 300000
+      },
+      {
+        "method": "GET",
+        "path": "/report",
+        "handler": "./rest/handlers/report-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#ReportResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/history",
+        "handler": "./rest/handlers/history-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#HistoryResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/history/:scope/:id/report",
+        "handler": "./rest/handlers/history-report-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#HistoryReportResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/history/:scope/:id/plan",
+        "handler": "./rest/handlers/history-plan-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#HistoryPlanResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/history/:scope/:id/changelog",
+        "handler": "./rest/handlers/history-changelog-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#HistoryChangelogResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/git-timeline",
+        "handler": "./rest/handlers/git-timeline-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#GitTimelineResponseSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/preview",
+        "handler": "./rest/handlers/preview-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#PreviewResponseSchema"
+        }
+      },
+      {
+        "method": "POST",
+        "path": "/build",
+        "handler": "./rest/handlers/build-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#BuildRequestSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#BuildResponseSchema"
+        },
+        "timeoutMs": 300000
+      },
+      {
+        "method": "GET",
+        "path": "/checklist",
+        "handler": "./rest/handlers/checklist-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#ReleaseChecklistSchema"
+        }
+      },
+      {
+        "method": "GET",
+        "path": "/checks",
+        "handler": "./rest/handlers/get-checks-handler.js#default",
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#GetChecksResponseSchema"
+        }
+      },
+      {
+        "method": "POST",
+        "path": "/checks/run",
+        "handler": "./rest/handlers/run-checks-handler.js#default",
+        "input": {
+          "zod": "@kb-labs/release-manager-contracts#RunChecksRequestSchema"
+        },
+        "output": {
+          "zod": "@kb-labs/release-manager-contracts#RunChecksResponseSchema"
+        },
+        "timeoutMs": 600000
+      }
+    ]
+  },
+  "studio": {
+    "version": 2,
+    "remoteName": "releasePlugin",
+    "pages": [
+      {
+        "id": "release.overview",
+        "title": "Release",
+        "icon": "RocketOutlined",
+        "route": "/p/release",
+        "entry": "./ReleasePage",
+        "order": 1
+      }
+    ],
+    "menus": [
+      {
+        "id": "release",
+        "label": "Release",
+        "icon": "RocketOutlined",
+        "target": "release.overview",
+        "order": 60
+      }
+    ]
+  },
+  "configSection": "release",
+  "capabilities": [
+    "fs:read",
+    "fs:write"
+  ],
+  "permissions": {
+    "fs": {
+      "read": [
+        "**/.git/**",
+        "**/.gitignore",
+        "**/.gitattributes",
+        ".kb/**",
+        "**/package.json",
+        "**/package-lock.json",
+        "**/pnpm-lock.yaml",
+        "**/.npmrc",
+        "**/.npmignore",
+        ".kb/release/**",
+        "package.json",
+        "pnpm-workspace.yaml",
+        "**/*.yml",
+        "**/*.yaml",
+        "CHANGELOG.md",
+        "**/CHANGELOG.md"
+      ],
+      "write": [
+        "**/.git/**",
+        "**/.gitignore",
+        "**/.gitattributes",
+        ".kb/**",
+        "**/package.json",
+        "**/package-lock.json",
+        "**/pnpm-lock.yaml",
+        "**/.npmrc",
+        "**/.npmignore",
+        ".kb/release/**",
+        "package.json",
+        "pnpm-workspace.yaml",
+        "**/*.yml",
+        "**/*.yaml",
+        "CHANGELOG.md",
+        "**/CHANGELOG.md"
+      ]
+    },
+    "env": {
+      "read": [
+        "HOME",
+        "USER",
+        "PATH",
+        "SHELL",
+        "TERM",
+        "LANG",
+        "LC_ALL",
+        "TZ",
+        "TMPDIR",
+        "GIT_*",
+        "SSH_AUTH_SOCK",
+        "SSH_AGENT_PID",
+        "NODE_ENV",
+        "KB_*",
+        "NPM_TOKEN",
+        "NPM_AUTH_TOKEN",
+        "NODE_AUTH_TOKEN",
+        "npm_*",
+        "NODE_OPTIONS",
+        "CI",
+        "CI_*",
+        "CONTINUOUS_INTEGRATION",
+        "GITHUB_TOKEN",
+        "GITHUB_*",
+        "GH_TOKEN",
+        "GITLAB_*",
+        "CI_JOB_TOKEN",
+        "JENKINS_*",
+        "BUILD_*",
+        "BRANCH_NAME",
+        "TAG_NAME",
+        "COMMIT_SHA",
+        "KB_RELEASE_*"
+      ]
+    },
+    "network": {
+      "fetch": [
+        "registry.npmjs.org",
+        "npm.pkg.github.com"
+      ]
+    },
+    "shell": {
+      "allow": [
+        "bash",
+        "git",
+        "npm",
+        "npx",
+        "pnpm"
+      ],
+      "maxConcurrent": 2
+    },
+    "platform": {
+      "llm": true,
+      "analytics": true,
+      "cache": {
+        "namespaces": [
+          "release:"
+        ]
+      }
+    },
+    "quotas": {
+      "timeoutMs": 1800000,
+      "memoryMb": 4096,
+      "cpuMs": 300000
+    }
+  },
+  "workflows": {
+    "handlers": [],
+    "templates": [
+      {
+        "id": "full-release",
+        "path": "./workflows/templates/full-release.yaml",
+        "describe": "Full release cycle: plan → checks → build → pack → approve → publish → git",
+        "tags": [
+          "release",
+          "full"
+        ]
+      },
+      {
+        "id": "hotfix",
+        "path": "./workflows/templates/hotfix.yaml",
+        "describe": "Quick hotfix: plan → approve → publish → git (patch bump, no checks)",
+        "tags": [
+          "release",
+          "hotfix"
+        ]
+      },
+      {
+        "id": "dry-run",
+        "path": "./workflows/templates/dry-run.yaml",
+        "describe": "Preview release: plan, checks, pack, changelog — no publish or git ops",
+        "tags": [
+          "release",
+          "dry-run"
+        ]
+      }
+    ]
+  },
+  "artifacts": [
+    {
+      "id": "release.plan.json",
+      "pathTemplate": ".kb/release/plan.json",
+      "description": "Serialized release plan generated by `kb release plan`."
+    },
+    {
+      "id": "release.report.json",
+      "pathTemplate": ".kb/release/report.json",
+      "description": "Execution report emitted by `kb release run`."
+    },
+    {
+      "id": "release.changelog.md",
+      "pathTemplate": ".kb/release/changelog.md",
+      "description": "Workspace changelog output produced during release."
+    }
+  ]
+}