@kb-labs/release-manager-core 2.100.0 → 2.101.0

package/dist/index.js

@@ -43,6 +43,15 @@ function applyAdaptive(packages) {
   }
   return packages;
 }
+function applyCanarySuffix(packages, shortSha) {
+  if (!shortSha) {
+    throw new Error("applyCanarySuffix: shortSha is required to build a canary version");
+  }
+  return packages.map((pkg) => ({
+    ...pkg,
+    nextVersion: `${pkg.nextVersion}-canary.${shortSha}`
+  }));
+}
 function getMaxBump(packages) {
   let maxBump = "patch";
   for (const pkg of packages) {
@@ -114,32 +123,32 @@ async function isVersionPublished(name, version, registry) {
     return false;
   }
 }
-async function planRelease(options) {
-  const { cwd, scope, bumpOverride } = options;
-  const config = options.flow ? mergeConfigWithFlow(options.config, options.flow) : options.config;
+async function discoverCurrentPackages(cwd, scope, config) {
   const allPackages = await discoverPackages(cwd, config);
-  let packages;
-  if (scope && scope !== "root") {
-    const isWorkspace = existsSync(join(cwd, ".gitmodules"));
-    if (isWorkspace) {
-      const matchedRoots = filterByScope(allPackages, scope, config);
-      const innerPackages = [];
-      for (const root of matchedRoots) {
-        innerPackages.push(root);
-        const inner = await discoverPackages(root.path, config);
-        for (const pkg of inner) {
-          if (!innerPackages.some((p) => p.name === pkg.name)) {
-            innerPackages.push(pkg);
-          }
+  if (!scope || scope === "root") {
+    return allPackages;
+  }
+  const isWorkspace = existsSync(join(cwd, ".gitmodules"));
+  if (isWorkspace) {
+    const matchedRoots = filterByScope(allPackages, scope, config);
+    const innerPackages = [];
+    for (const root of matchedRoots) {
+      innerPackages.push(root);
+      const inner = await discoverPackages(root.path, config);
+      for (const pkg of inner) {
+        if (!innerPackages.some((p) => p.name === pkg.name)) {
+          innerPackages.push(pkg);
         }
       }
-      packages = innerPackages;
-    } else {
-      packages = filterByScope(allPackages, scope, config);
     }
-  } else {
-    packages = allPackages;
+    return innerPackages;
   }
+  return filterByScope(allPackages, scope, config);
+}
+async function planRelease(options) {
+  const { cwd, scope, bumpOverride, channel = "stable" } = options;
+  const config = options.flow ? mergeConfigWithFlow(options.config, options.flow) : options.config;
+  const packages = await discoverCurrentPackages(cwd, scope, config);
   const isWorkspaceRoot = existsSync(join(cwd, ".gitmodules")) && !scope;
   let modifiedPackages;
   if (isWorkspaceRoot) {
@@ -202,11 +211,17 @@ async function planRelease(options) {
   const versionStrategy = mapBumpStrategyToVersionStrategy(bumpStrategy);
   planPackages = applyVersionStrategy(planPackages, {
     strategy: versionStrategy});
+  if (channel === "canary") {
+    const git = simpleGit(cwd, { timeout: { block: 6e4 } });
+    const shortSha = (await git.revparse(["--short", "HEAD"])).trim();
+    planPackages = applyCanarySuffix(planPackages, shortSha);
+  }
   return {
     packages: planPackages,
     strategy: config.strategy || "semver",
     registry: config.registry || "https://registry.npmjs.org",
-    rollbackEnabled: config.rollback?.enabled ?? true
+    rollbackEnabled: config.rollback?.enabled ?? true,
+    channel
   };
 }
 function mapBumpStrategyToVersionStrategy(bumpStrategy) {
@@ -438,91 +453,6 @@ function matchesPackagePattern(pkgName, relativePath, patterns) {
   }
   return false;
 }
-function createExecaShellAdapter() {
-  return {
-    async exec(command, args, options) {
-      try {
-        const result = await execa(command, args || [], {
-          cwd: options?.cwd,
-          timeout: options?.timeout,
-          preferLocal: true,
-          env: options?.env || process.env
-        });
-        return {
-          ok: result.exitCode === 0,
-          code: result.exitCode ?? 0,
-          stdout: result.stdout || "",
-          stderr: result.stderr || ""
-        };
-      } catch (error) {
-        const e = error;
-        return {
-          ok: false,
-          code: e.exitCode || 1,
-          stdout: e.stdout || "",
-          stderr: e.stderr || e.message || ""
-        };
-      }
-    }
-  };
-}
-function rewriteLinkDep(deps, depName, val, pkgPath, versionMap) {
-  const pinned = versionMap.get(depName);
-  if (pinned) {
-    deps[depName] = `^${pinned}`;
-    return;
-  }
-  try {
-    const linkPath = val.slice("link:".length);
-    const linked = JSON.parse(readFileSync(join(pkgPath, linkPath, "package.json"), "utf-8"));
-    deps[depName] = `^${linked.version ?? "*"}`;
-  } catch {
-    deps[depName] = "*";
-  }
-}
-function rewriteWorkspaceDep(deps, depName, val, versionMap) {
-  const pinned = versionMap.get(depName);
-  if (!pinned) {
-    return false;
-  }
-  deps[depName] = val === "workspace:*" ? `^${pinned}` : val.replace("workspace:", "");
-  return true;
-}
-function rewriteDepsSection(deps, pkgPath, versionMap, packageManager) {
-  let modified = false;
-  for (const depName of Object.keys(deps)) {
-    const val = deps[depName];
-    if (typeof val !== "string") {
-      continue;
-    }
-    if (val.startsWith("link:")) {
-      rewriteLinkDep(deps, depName, val, pkgPath, versionMap);
-      modified = true;
-    } else if (val.startsWith("workspace:") && packageManager !== "pnpm" && rewriteWorkspaceDep(deps, depName, val, versionMap)) {
-      modified = true;
-    }
-  }
-  return modified;
-}
-function rewriteWorkspaceDeps(pkgPath, versionMap, packageManager) {
-  const pkgJsonPath = join(pkgPath, "package.json");
-  const original = readFileSync(pkgJsonPath, "utf-8");
-  const pkgJson = JSON.parse(original);
-  let modified = false;
-  for (const section of ["dependencies", "peerDependencies"]) {
-    const deps = pkgJson[section];
-    if (!deps) {
-      continue;
-    }
-    if (rewriteDepsSection(deps, pkgPath, versionMap, packageManager)) {
-      modified = true;
-    }
-  }
-  if (modified) {
-    writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
-  }
-  return () => writeFileSync(pkgJsonPath, original);
-}
 function checkpointPath(repoRoot) {
   return join(repoRoot, ".kb", "release", "checkpoint.json");
 }
@@ -578,76 +508,6 @@ function isCheckpointResumable(checkpoint, flow, version) {
 }
 
 // src/publisher.ts
-async function publishPackages(options) {
-  const { plan, dryRun, shell } = options;
-  const shellApi = shell || createExecaShellAdapter();
-  const result = {
-    published: [],
-    skipped: [],
-    errors: [],
-    versionUpdates: []
-  };
-  if (dryRun) {
-    for (const pkg of plan.packages) {
-      result.skipped.push(`${pkg.name}@${pkg.nextVersion} (dry-run)`);
-      result.versionUpdates.push({
-        package: pkg.name,
-        from: pkg.currentVersion || "unknown",
-        to: pkg.nextVersion || "unknown",
-        updated: false
-      });
-    }
-    return result;
-  }
-  const pm = options.config?.publish?.packageManager ?? "pnpm";
-  const versionMap = new Map(plan.packages.map((p) => [p.name, p.nextVersion]));
-  for (const pkg of plan.packages) {
-    try {
-      const registry = plan.registry || "https://registry.npmjs.org";
-      try {
-        await updatePackageVersion(pkg);
-        result.versionUpdates.push({
-          package: pkg.name,
-          from: pkg.currentVersion || "unknown",
-          to: pkg.nextVersion || "unknown",
-          updated: true
-        });
-      } catch (versionError) {
-        const msg = `Failed to update version for ${pkg.name}: ${versionError instanceof Error ? versionError.message : String(versionError)}`;
-        result.errors.push(msg);
-        result.versionUpdates.push({
-          package: pkg.name,
-          from: pkg.currentVersion || "unknown",
-          to: pkg.nextVersion || "unknown",
-          updated: false
-        });
-        continue;
-      }
-      const restoreDeps = rewriteWorkspaceDeps(pkg.path, versionMap, pm);
-      const access = options.config?.publish?.access ?? "public";
-      let publishResult;
-      try {
-        publishResult = await shellApi.exec(
-          pm,
-          ["publish", "--access", access, "--registry", registry],
-          { cwd: pkg.path, timeout: 6e4 }
-        );
-      } finally {
-        restoreDeps();
-      }
-      if (publishResult.ok) {
-        result.published.push(`${pkg.name}@${pkg.nextVersion}`);
-      } else {
-        const errorDetails = publishResult.stderr || publishResult.stdout || "Unknown error";
-        result.errors.push(`Failed to publish ${pkg.name}: ${errorDetails}`);
-      }
-    } catch (error) {
-      const msg = `Failed to publish ${pkg.name}: ${error instanceof Error ? error.message : String(error)}`;
-      result.errors.push(msg);
-    }
-  }
-  return result;
-}
 async function updatePackageVersion(pkg) {
   const packageJsonPath = join(pkg.path, "package.json");
   const packageJson = JSON.parse(await readFile(packageJsonPath, "utf-8"));
@@ -677,48 +537,14 @@ async function updatePackageVersions(plan) {
   }
   return results;
 }
-async function generateChangelog(options) {
-  const { cwd, plan } = options;
-  const changelogPath = join(cwd, "CHANGELOG.md");
-  let existingChangelog = "";
-  try {
-    existingChangelog = await readFile(changelogPath, "utf-8");
-  } catch {
-  }
-  const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-  const header = `## [${date}] Release
-
-`;
-  const entries = [];
-  for (const pkg of plan.packages) {
-    entries.push(`- **${pkg.name}**: ${pkg.currentVersion} \u2192 ${pkg.nextVersion}`);
-  }
-  const newEntry = header + entries.join("\n") + "\n\n";
-  const updatedChangelog = newEntry + existingChangelog;
-  try {
-    await mkdir(join(cwd, ".kb", "release"), { recursive: true });
-    await writeFile(changelogPath, updatedChangelog, "utf-8");
-  } catch (error) {
-    console.warn(`Failed to write changelog: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  return newEntry;
-}
-async function generateEnhancedChangelog(options) {
-  const simpleChangelog = await generateChangelog({
-    cwd: options.cwd,
-    plan: options.plan
-  });
-  return {
-    changelog: simpleChangelog,
-    manifest: null
-  };
-}
 async function copyChangelogToPackages(options) {
   const { plan, changelog } = options;
+  const uniqueVersions = new Set(plan.packages.map((p) => p.nextVersion));
+  const isLockstep = plan.packages.length > 1 && uniqueVersions.size === 1;
   for (const pkg of plan.packages) {
     try {
       let packageChangelog;
-      if (plan.packages.length === 1) {
+      if (plan.packages.length === 1 || isLockstep) {
         packageChangelog = changelog;
       } else {
         packageChangelog = createPackageChangelog(pkg, changelog);
@@ -733,10 +559,11 @@ async function copyChangelogToPackages(options) {
         existingChangelog = await readFile(changelogPath, "utf-8");
       } catch {
       }
-      const versionPattern = new RegExp(
+      const versionPattern = isLockstep ? new RegExp(`^##\\s+\\[${pkg.nextVersion.replace(/\./g, "\\.")}\\]`, "m") : new RegExp(
         `^##\\s+${pkg.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s+${pkg.nextVersion.replace(/\./g, "\\.")}`,
         "m"
       );
+      const nextSectionPattern = /^##\s+((@[\w-]+\/)?[\w-]+\s+\d|\[\d)/;
       let updatedChangelog;
       if (existingChangelog && versionPattern.test(existingChangelog)) {
         const lines = existingChangelog.split("\n");
@@ -746,7 +573,7 @@ async function copyChangelogToPackages(options) {
           const line = lines[i];
           if (line && versionPattern.test(line)) {
             startIdx = i;
-          } else if (startIdx !== -1 && line && /^##\s+@?[\w-]+/.test(line)) {
+          } else if (startIdx !== -1 && line && nextSectionPattern.test(line)) {
             endIdx = i;
             break;
           }
@@ -941,58 +768,6 @@ async function restoreSnapshot(cwd) {
 async function cleanupOldSnapshots(_snapshotDir) {
 }
 
-// src/runner.ts
-async function runRelease(options) {
-  const {
-    config,
-    runChecks,
-    executePlan,
-    onStageChange
-  } = options;
-  const startTime = Date.now();
-  const errors = [];
-  let checks;
-  try {
-    onStageChange?.("planning");
-    if (config.verify && config.verify.length > 0 && runChecks) {
-      onStageChange?.("checking");
-      checks = await runChecks("checking");
-      const failedChecks = Object.entries(checks).filter(([_, result]) => result && !result.ok).map(([id]) => id);
-      if (failedChecks.length > 0) {
-        errors.push(`Pre-release checks failed: ${failedChecks.join(", ")}`);
-        if (config.strict) {
-          return {
-            ok: false,
-            timingMs: Date.now() - startTime,
-            errors,
-            checks
-          };
-        }
-      }
-    }
-    onStageChange?.("publishing");
-    if (executePlan) {
-      await executePlan();
-    }
-    onStageChange?.("verifying");
-    return {
-      ok: errors.length === 0,
-      timingMs: Date.now() - startTime,
-      errors: errors.length > 0 ? errors : void 0,
-      checks
-    };
-  } catch (error) {
-    onStageChange?.("rollback");
-    errors.push(error instanceof Error ? error.message : String(error));
-    return {
-      ok: false,
-      timingMs: Date.now() - startTime,
-      errors,
-      checks
-    };
-  }
-}
-
 // src/reporters/json.ts
 function renderJson(report) {
   return JSON.stringify(report, null, 2);
@@ -1134,6 +909,49 @@ function formatTiming2(ms) {
   }
   return `${(ms / 6e4).toFixed(1)}m`;
 }
+function createExecaShellAdapter() {
+  return {
+    async exec(command, args, options) {
+      try {
+        const result = await execa(command, args || [], {
+          cwd: options?.cwd,
+          timeout: options?.timeout,
+          preferLocal: true,
+          env: options?.env || process.env
+        });
+        return {
+          ok: result.exitCode === 0,
+          code: result.exitCode ?? 0,
+          stdout: result.stdout || "",
+          stderr: result.stderr || ""
+        };
+      } catch (error) {
+        const e = error;
+        return {
+          ok: false,
+          code: e.exitCode || 1,
+          stdout: e.stdout || "",
+          stderr: e.stderr || e.message || ""
+        };
+      }
+    }
+  };
+}
+
+// src/channel.ts
+var DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+function resolvePublishTag(config, channel) {
+  if (channel === "canary") {
+    return config.publish?.canaryTag ?? "canary";
+  }
+  return config.publish?.stableTag ?? "latest";
+}
+function resolvePublishRegistry(config, channel) {
+  if (channel === "canary") {
+    return config.publish?.npmRegistry ?? DEFAULT_NPM_REGISTRY;
+  }
+  return config.registry ?? DEFAULT_NPM_REGISTRY;
+}
 async function buildPackages(packages, options) {
   const results = [];
   for (const pkg of packages) {
@@ -1388,44 +1206,7 @@ function verifyPackage(packagePath, packageName) {
     }
     spawnSync("tar", ["xzf", tgzFile], { cwd: tmpDir, stdio: "pipe" });
     const extractedDir = join(tmpDir, "package");
-    const testFiles = findFiles(
-      join(extractedDir, "dist"),
-      (f) => f.includes(".spec.") || f.includes(".test.") || f.includes("__tests__")
-    );
-    if (testFiles.length > 0) {
-      issues.push(`Test files in dist/: ${testFiles.slice(0, 3).join(", ")}`);
-    }
-    const extractedPkg = JSON.parse(readFileSync(join(extractedDir, "package.json"), "utf-8"));
-    for (const field of ["main", "module", "types"]) {
-      const val = extractedPkg[field];
-      if (val && !existsSync(join(extractedDir, val))) {
-        issues.push(`${field}: ${val} does not exist in published package`);
-      }
-    }
-    if (extractedPkg.exports) {
-      checkExportsExist(extractedPkg.exports, extractedDir, "exports", issues);
-    }
-    const esmEntry = resolveEsmEntry(extractedPkg);
-    if (esmEntry) {
-      const esmPath = join(extractedDir, esmEntry);
-      if (existsSync(esmPath)) {
-        checkDirectoryImports(esmPath, join(extractedDir, "dist"), issues);
-        const esmCheck = spawnSync("node", ["--check", esmPath], { stdio: "pipe", timeout: 1e4 });
-        if (esmCheck.status !== 0) {
-          issues.push(`ESM syntax error in ${esmEntry}`);
-        }
-      }
-    }
-    const cjsEntry = resolveCjsEntry(extractedPkg);
-    if (cjsEntry) {
-      const cjsPath = join(extractedDir, cjsEntry);
-      if (existsSync(cjsPath)) {
-        const cjsCheck = spawnSync("node", ["--check", cjsPath], { stdio: "pipe", timeout: 1e4 });
-        if (cjsCheck.status !== 0) {
-          issues.push(`CJS syntax error in ${cjsEntry}`);
-        }
-      }
-    }
+    issues.push(...verifyExtractedTarball(extractedDir));
   } catch (err) {
     issues.push(`Verification error: ${err instanceof Error ? err.message : String(err)}`);
   } finally {
@@ -1433,6 +1214,48 @@ function verifyPackage(packagePath, packageName) {
   }
   return { name, success: issues.length === 0, issues };
 }
+function verifyExtractedTarball(extractedDir) {
+  const issues = [];
+  const testFiles = findFiles(
+    join(extractedDir, "dist"),
+    (f) => f.includes(".spec.") || f.includes(".test.") || f.includes("__tests__")
+  );
+  if (testFiles.length > 0) {
+    issues.push(`Test files in dist/: ${testFiles.slice(0, 3).join(", ")}`);
+  }
+  const extractedPkg = JSON.parse(readFileSync(join(extractedDir, "package.json"), "utf-8"));
+  for (const field of ["main", "module", "types"]) {
+    const val = extractedPkg[field];
+    if (val && !existsSync(join(extractedDir, val))) {
+      issues.push(`${field}: ${val} does not exist in published package`);
+    }
+  }
+  if (extractedPkg.exports) {
+    checkExportsExist(extractedPkg.exports, extractedDir, "exports", issues);
+  }
+  const esmEntry = resolveEsmEntry(extractedPkg);
+  if (esmEntry) {
+    const esmPath = join(extractedDir, esmEntry);
+    if (existsSync(esmPath)) {
+      checkDirectoryImports(esmPath, join(extractedDir, "dist"), issues);
+      const esmCheck = spawnSync("node", ["--check", esmPath], { stdio: "pipe", timeout: 1e4 });
+      if (esmCheck.status !== 0) {
+        issues.push(`ESM syntax error in ${esmEntry}`);
+      }
+    }
+  }
+  const cjsEntry = resolveCjsEntry(extractedPkg);
+  if (cjsEntry) {
+    const cjsPath = join(extractedDir, cjsEntry);
+    if (existsSync(cjsPath)) {
+      const cjsCheck = spawnSync("node", ["--check", cjsPath], { stdio: "pipe", timeout: 1e4 });
+      if (cjsCheck.status !== 0) {
+        issues.push(`CJS syntax error in ${cjsEntry}`);
+      }
+    }
+  }
+  return issues;
+}
 function resolveEsmEntry(pkg) {
   const dotExport = pkg.exports?.["."];
   const importEntry = dotExport && typeof dotExport === "object" ? dotExport["import"] : void 0;
@@ -1502,6 +1325,55 @@ function findFiles(dir, predicate) {
   walk(dir);
   return results;
 }
+var DEFAULT_TIMEOUT_MS = 3e4;
+async function verifyAgainstRegistry(packages, options) {
+  const { registry, timeout = DEFAULT_TIMEOUT_MS, logger } = options;
+  const results = [];
+  for (const pkg of packages) {
+    results.push(await verifyOneAgainstRegistry(pkg, registry, timeout, logger));
+  }
+  return results;
+}
+async function verifyOneAgainstRegistry(pkg, registry, timeout, logger) {
+  const published = await isVersionPublished(pkg.name, pkg.version, registry);
+  if (!published) {
+    return { name: pkg.name, success: false, issues: [`${pkg.name}@${pkg.version} was not found on ${registry} after publish`] };
+  }
+  logger?.info?.(`${pkg.name}@${pkg.version} confirmed on ${registry}`);
+  const tmpDir = join(tmpdir(), `kb-verdaccio-verify-${randomBytes(6).toString("hex")}`);
+  const issues = [];
+  try {
+    mkdirSync(tmpDir, { recursive: true });
+    const spec = `${pkg.name}@${pkg.version}`;
+    const packResult = spawnSync(
+      "npm",
+      ["pack", spec, "--registry", registry, "--pack-destination", tmpDir],
+      { stdio: "pipe", timeout }
+    );
+    if (packResult.status !== 0) {
+      const stderr = packResult.stderr?.toString().trim();
+      issues.push(`Could not pull ${spec} back from ${registry} for verification${stderr ? `: ${stderr}` : ""}`);
+      return { name: pkg.name, success: false, issues };
+    }
+    const tgzFile = readdirSync(tmpDir).find((f) => f.endsWith(".tgz"));
+    if (!tgzFile) {
+      issues.push(`npm pack produced no tarball for ${spec} from ${registry}`);
+      return { name: pkg.name, success: false, issues };
+    }
+    spawnSync("tar", ["xzf", tgzFile], { cwd: tmpDir, stdio: "pipe" });
+    const extractedDir = join(tmpDir, "package");
+    if (!existsSync(extractedDir)) {
+      issues.push(`Failed to extract tarball for ${spec}`);
+      return { name: pkg.name, success: false, issues };
+    }
+    issues.push(...verifyExtractedTarball(extractedDir));
+  } catch (err) {
+    issues.push(`Registry verification error: ${err instanceof Error ? err.message : String(err)}`);
+  } finally {
+    rmSync(tmpDir, { recursive: true, force: true });
+  }
+  return { name: pkg.name, success: issues.length === 0, issues };
+}
 function lockPath(repoRoot) {
   return join(repoRoot, ".kb", "release", "release.lock");
 }
@@ -1606,14 +1478,18 @@ async function _runPipeline(ctx) {
     startTime,
     progress
   } = ctx;
+  const channel = config.channel ?? "stable";
+  const publishTag = resolvePublishTag(config, channel);
+  const publishRegistry = resolvePublishRegistry(config, channel);
   if (!dryRun) {
-    const registry = config.registry ?? "https://registry.npmjs.org";
+    const registry = publishRegistry;
     const authError = await verifyNpmAuth(registry);
     if (authError) {
+      const emptyPlan = { packages: [], strategy: "semver", registry, rollbackEnabled: false, channel };
       return {
         success: false,
-        plan: { packages: [], strategy: "semver", registry, rollbackEnabled: false },
-        report: buildReport("planning", { packages: [], strategy: "semver", registry, rollbackEnabled: false }, repoRoot, dryRun, startTime, {
+        plan: emptyPlan,
+        report: buildReport("planning", emptyPlan, repoRoot, dryRun, startTime, {
           ok: false,
           errors: [`npm auth check failed: ${authError}`],
           timingMs: Date.now() - startTime
@@ -1628,7 +1504,8 @@ async function _runPipeline(ctx) {
     scope,
     flow,
     // already includes defaultFlow fallback
-    bumpOverride: config.bump
+    bumpOverride: config.bump,
+    channel
   });
   if (plan.packages.length === 0) {
     return {
@@ -1758,26 +1635,28 @@ async function _runPipeline(ctx) {
     }
     progress("verifying", "Package artifacts verified");
   }
-  progress("versioning", "Updating package versions...");
-  if (!dryRun) {
-    const versionUpdates = await updatePackageVersions(plan);
-    const failedUpdates = versionUpdates.filter((u) => !u.updated);
-    if (failedUpdates.length > 0) {
-      await restoreSnapshot(repoRoot);
-      return {
-        success: false,
-        plan,
-        report: buildReport("versioning", plan, repoRoot, dryRun, startTime, {
-          ok: false,
-          errors: failedUpdates.map((u) => `Version update failed: ${u.package}`),
-          versionUpdates,
-          timingMs: Date.now() - startTime
-        })
-      };
+  if (channel === "stable") {
+    progress("versioning", "Updating package versions...");
+    if (!dryRun) {
+      const versionUpdates = await updatePackageVersions(plan);
+      const failedUpdates = versionUpdates.filter((u) => !u.updated);
+      if (failedUpdates.length > 0) {
+        await restoreSnapshot(repoRoot);
+        return {
+          success: false,
+          plan,
+          report: buildReport("versioning", plan, repoRoot, dryRun, startTime, {
+            ok: false,
+            errors: failedUpdates.map((u) => `Version update failed: ${u.package}`),
+            versionUpdates,
+            timingMs: Date.now() - startTime
+          })
+        };
+      }
     }
   }
   let changelogMd = "";
-  if (changelogGen) {
+  if (changelogGen && channel === "stable") {
     progress("versioning", "Generating changelog...");
     try {
       changelogMd = await changelogGen.generate(plan, { repoRoot, gitCwd: scopeCwd, config });
@@ -1799,7 +1678,9 @@ async function _runPipeline(ctx) {
   }));
   const publishResult = await publisher.publish(packagesToPublish, {
     dryRun,
-    access: "public"
+    access: config.publish?.access ?? "public",
+    tag: publishTag,
+    registry: publishRegistry
   });
   const publishFailed = publishResult.failed.length > 0;
   if (publishFailed) {
@@ -1818,7 +1699,7 @@ async function _runPipeline(ctx) {
       })
     };
   }
-  if (!dryRun) {
+  if (!dryRun && channel === "stable") {
     const uniqueVersions = new Set(plan.packages.map((p) => p.nextVersion));
     const cpVersion = uniqueVersions.size === 1 ? plan.packages[0].nextVersion : "independent";
     writeCheckpoint(repoRoot, {
@@ -1833,8 +1714,31 @@ async function _runPipeline(ctx) {
       gitRoots: {}
     });
   }
+  if (!dryRun && channel === "stable") {
+    progress("verifying", "Verifying published artifacts against the registry...");
+    const registryVerifyResults = await verifyAgainstRegistry(packagesToPublish, {
+      registry: publishRegistry,
+      timeout: config.publish?.verifyRegistryTimeoutMs,
+      logger
+    });
+    const registryVerifyFailed = registryVerifyResults.filter((r) => !r.success);
+    if (registryVerifyFailed.length > 0) {
+      const allIssues = registryVerifyFailed.flatMap((r) => r.issues.map((i) => `${r.name}: ${i}`));
+      return {
+        success: false,
+        plan,
+        report: buildReport("verifying", plan, repoRoot, dryRun, startTime, {
+          ok: false,
+          published: publishResult.published,
+          errors: [`Registry verification failed after publish \u2014 git commit/tag skipped:
+  ${allIssues.join("\n  ")}`],
+          timingMs: Date.now() - startTime
+        })
+      };
+    }
+  }
   let gitResult;
-  if (!dryRun) {
+  if (!dryRun && channel === "stable") {
     progress("verifying", "Committing and tagging release...");
     gitResult = await commitAndTagRelease({ cwd: scopeCwd, plan, dryRun, noVerify, repoRoot });
     deleteCheckpoint(repoRoot);
@@ -1906,6 +1810,6 @@ async function resolveScopePath(repoRoot, scope) {
   return join(repoRoot, scope);
 }
 
-export { applyVersionStrategy, buildPackages, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, generateChangelog, generateEnhancedChangelog, isBuildCommand, matchesPackagePattern, mergeConfigWithFlow, planRelease, publishPackages, renderJson, renderMarkdown, renderText, resolveScopePath, restoreSnapshot, runRelease, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, spawnCommand, updatePackageVersion, updatePackageVersions, verifyPackage, verifyPackages };
+export { applyCanarySuffix, applyVersionStrategy, buildPackages, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, planRelease, renderJson, renderMarkdown, renderText, resolvePublishRegistry, resolvePublishTag, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, spawnCommand, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyExtractedTarball, verifyPackage, verifyPackages };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map