@kb-labs/release-manager-core 2.112.0 → 2.116.11

package/dist/index.d.ts

@@ -132,7 +132,7 @@ interface FlowConfig {
     packages?: PackagesFilter;
     /** Replaces global versioningStrategy. */
     versioningStrategy?: 'lockstep' | 'independent' | 'adaptive';
-    /** If set, replaces global checks for this flow. */
+    /** If set, adds to global checks; matching ids override the global check. */
     checks?: CustomCheckConfig[];
     /**
      * Git tag template for this flow's stable releases. Tokens: `{flow}`
@@ -207,10 +207,10 @@ interface ReleaseConfig {
     build?: BuildConfig;
     /** Filter which packages are discovered and released. */
     packages?: PackagesFilter;
-    /** Per-scope overrides — packages filter merged with global, checks replace global entirely. */
+    /** Per-scope overrides — packages filter merged with global, checks are additive. */
     scopes?: Record<string, {
         packages?: PackagesFilter;
-        /** If set, replaces global `checks` for this scope. */
+        /** If set, adds to global `checks`; matching ids override the global check. */
         checks?: CustomCheckConfig[];
         /** If set, overrides global versioningStrategy for this scope. */
         versioningStrategy?: 'lockstep' | 'independent' | 'adaptive';
@@ -336,7 +336,7 @@ interface PipelineOptions {
     scopeCwd: string;
     /** Original scope name for display/reporting only */
     scope?: string;
-    /** Named flow — selects a release config profile. Completely replaces global packages/versioning/checks. */
+    /** Named flow — selects a release config profile. Packages/versioning replace global values; checks are additive. */
     flow?: string;
     config: ReleaseConfig;
     dryRun?: boolean;
@@ -376,7 +376,7 @@ interface PlannerOptions {
     cwd: string;
     config: ReleaseConfig;
     scope?: string;
-    /** Named flow — selects a release config profile. Completely replaces global packages/versioning/checks. */
+    /** Named flow — selects a release config profile. Packages/versioning replace global values; checks are additive. */
     flow?: string;
     bumpOverride?: VersionBump;
     /** Release track. Defaults to 'stable'. See ReleaseChannel. */
@@ -384,7 +384,9 @@ interface PlannerOptions {
 }
 /**
  * Merge base config with a named flow's config.
- * Flow completely REPLACES packages, versioningStrategy, and checks — no array merging.
+ * Flow replaces packages/versioningStrategy and adds to checks. Matching check
+ * ids override the global definition so a flow can make one gate stricter
+ * without accidentally removing the global release contract.
  * All other config fields (registry, publish, rollback, git, changelog) remain from global.
  */
 declare function mergeConfigWithFlow(config: ReleaseConfig, flowName: string): ReleaseConfig;
@@ -719,6 +721,23 @@ declare function verifyPackage(packagePath: string, packageName?: string): Verif
  * "verify before publish" and "verify after publish" use identical checks.
  */
 declare function verifyExtractedTarball(extractedDir: string): string[];
+/**
+ * These protocols are workspace-only and cannot be consumed from a public
+ * registry. Checking the extracted package (rather than the source manifest)
+ * makes this a release-artifact contract and catches the exact bytes a user
+ * would install.
+ */
+declare function findForbiddenDependencyProtocols(pkg: PkgJson): string[];
+type PkgJson = Record<string, unknown> & {
+    exports?: Record<string, Record<string, string> | string>;
+    module?: string;
+    main?: string;
+    types?: string;
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+};
 
 /**
  * Registry-side artifact verification — confirms a package actually landed
@@ -753,6 +772,31 @@ interface VerifyAgainstRegistryOptions {
  */
 declare function verifyAgainstRegistry(packages: PublishablePackage[], options: VerifyAgainstRegistryOptions): Promise<VerifyResult[]>;
 
+/**
+ * Verify a packed tarball actually installs — and imports — in a clean,
+ * outside-the-workspace consumer. This is the strongest guarantee available:
+ * it catches everything the static findForbiddenDependencyProtocols() check
+ * can (a literal workspace:/link:/file: protocol) PLUS classes that check
+ * can't, most importantly an already-published PEER dependency that is
+ * itself broken (npm auto-installs peers, so a bad manifest several levels
+ * deep in someone else's graph fails this package's install too).
+ *
+ * The package manager is configurable. pnpm is the platform default and is
+ * used for the monorepo release flow; npm remains available for projects that
+ * explicitly publish with npm.
+ */
+interface CleanInstallResult {
+    ok: boolean;
+    /** Human-readable reason, always populated when ok is false. */
+    error?: string;
+}
+/**
+ * Install `tarballPath` into a throwaway consumer project (outside the
+ * monorepo workspace, so pnpm's workspace resolution can't mask a problem)
+ * and confirm `packageName` can actually be imported afterward.
+ */
+declare function verifyCleanInstall(tarballPath: string, packageName: string, additionalTarballs?: string[], packageManager?: 'pnpm' | 'npm'): Promise<CleanInstallResult>;
+
 /**
  * Scope utilities — resolve scope name to filesystem path.
  *
@@ -777,4 +821,4 @@ declare function verifyAgainstRegistry(packages: PublishablePackage[], options:
  */
 declare function resolveScopePath(repoRoot: string, scope: string): Promise<string>;
 
-export { type AuditSummary, type BuildConfig, type BuildResult, type ChangelogGenerator, type CheckId, type CheckResult, type CheckResultDetails, type CustomCheckConfig, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, type FlowConfig, type PackagePublisher, type PackageVersion, type PackagesFilter, type PipelineOptions, type PipelineResult, type PlannerOptions, type PluginLogger, type PublishResult, type PublishablePackage, type ReleaseChannel, type ReleaseConfig, type ReleaseContext, type ReleasePlan, type ReleaseReport, type ReleaseResult, type ReleaseStage, type RollbackSnapshot, type StrategyOptions, type VerifyResult, type VersionBump, type VersionStrategy, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, spawnCommand, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyExtractedTarball, verifyPackage, verifyPackages };
+export { type AuditSummary, type BuildConfig, type BuildResult, type ChangelogGenerator, type CheckId, type CheckResult, type CheckResultDetails, type CleanInstallResult, type CustomCheckConfig, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, type FlowConfig, type PackagePublisher, type PackageVersion, type PackagesFilter, type PipelineOptions, type PipelineResult, type PlannerOptions, type PluginLogger, type PublishResult, type PublishablePackage, type ReleaseChannel, type ReleaseConfig, type ReleaseContext, type ReleasePlan, type ReleaseReport, type ReleaseResult, type ReleaseStage, type RollbackSnapshot, type StrategyOptions, type VerifyResult, type VersionBump, type VersionStrategy, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, spawnCommand, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };

package/dist/index.js

@@ -1,5 +1,5 @@
 import { readFile, writeFile, mkdir, rm, rename, cp } from 'fs/promises';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync, rmSync, statSync, unlinkSync } from 'fs';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync, rmSync, statSync, mkdtempSync, unlinkSync } from 'fs';
 import { join, relative, resolve, dirname } from 'path';
 import simpleGit from 'simple-git';
 import semver2 from 'semver';
@@ -24,6 +24,14 @@ function applyLockstep(packages) {
   if (packages.length === 0) {
     return packages;
   }
+  const alreadyPublished = packages.filter((p) => p.isPublished);
+  if (alreadyPublished.length > 0) {
+    const sharedVersion = alreadyPublished.reduce(
+      (max, p) => semver2.gt(p.nextVersion, max) ? p.nextVersion : max,
+      alreadyPublished[0].nextVersion
+    );
+    return packages.map((pkg) => ({ ...pkg, nextVersion: sharedVersion }));
+  }
   const maxBump = getMaxBump(packages);
   const maxVersion = packages.reduce((max, pkg) => {
     return semver2.gt(pkg.currentVersion, max) ? pkg.currentVersion : max;
@@ -65,9 +73,41 @@ function getMaxBump(packages) {
   return maxBump;
 }
 
+// src/tag.ts
+var DEFAULT_TAG_PATTERN = "{flow}-v{version}";
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var SEMVER_SRC = "\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?";
+function buildReleaseTag(flowName, version, tagPattern) {
+  const pattern = tagPattern ?? DEFAULT_TAG_PATTERN;
+  return pattern.replace("{flow}", flowName).replace("{version}", version);
+}
+function buildTagRegex(flowName, tagPattern) {
+  const escapedPattern = escapeRegex(tagPattern);
+  const src = escapedPattern.replace(escapeRegex("{flow}"), escapeRegex(flowName)).replace(escapeRegex("{version}"), `(${SEMVER_SRC})`);
+  return new RegExp(`^${src}$`);
+}
+function resolveFlowFromTag(config, tag) {
+  const flows = config.flows ?? {};
+  for (const [flowName, flowConfig] of Object.entries(flows)) {
+    const regex = buildTagRegex(flowName, flowConfig.tagPattern ?? DEFAULT_TAG_PATTERN);
+    if (regex.test(tag)) {
+      return { flowName, channel: "stable" };
+    }
+  }
+  return null;
+}
+
 // src/planner.ts
-async function findLastReleaseTag(git, pkgName) {
+async function findLastReleaseTag(git, pkgName, flowTagGlob) {
   try {
+    if (flowTagGlob) {
+      const flowTags = await git.tags(["--sort=-version:refname", "--list", flowTagGlob]);
+      if (flowTags.all.length > 0) {
+        return flowTags.all[0];
+      }
+    }
     const tags = await git.tags(["--sort=-version:refname", `--list`, `${pkgName}@*`]);
     if (tags.all.length > 0) {
       return tags.all[0];
@@ -81,8 +121,8 @@ async function findLastReleaseTag(git, pkgName) {
     return null;
   }
 }
-async function getCommitsSinceTag(git, pkgName, relPath) {
-  const lastTag = await findLastReleaseTag(git, pkgName);
+async function getCommitsSinceTag(git, pkgName, relPath, flowTagGlob) {
+  const lastTag = await findLastReleaseTag(git, pkgName, flowTagGlob);
   try {
     const args = ["log", "--format=%s", ...lastTag ? [`${lastTag}..HEAD`] : [], "--", relPath];
     const raw = await git.raw(args);
@@ -100,7 +140,9 @@ function mergeConfigWithFlow(config, flowName) {
     ...config,
     ...flow.packages !== void 0 && { packages: flow.packages },
     ...flow.versioningStrategy && { versioningStrategy: flow.versioningStrategy },
-    ...flow.checks !== void 0 && { checks: flow.checks },
+    ...flow.checks !== void 0 && {
+      checks: [...new Map([...config.checks ?? [], ...flow.checks].map((check) => [check.id, check])).values()]
+    },
     ...flow.build !== void 0 && { build: flow.build }
   };
 }
@@ -139,6 +181,7 @@ async function discoverCurrentPackages(cwd, scope, config) {
 async function planRelease(options) {
   const { cwd, scope, bumpOverride, channel = "stable" } = options;
   const config = options.flow ? mergeConfigWithFlow(options.config, options.flow) : options.config;
+  const flowTagGlob = options.flow ? buildReleaseTag(options.flow, "*", config.flows?.[options.flow]?.tagPattern) : void 0;
   const packages = await discoverCurrentPackages(cwd, scope, config);
   const isWorkspaceRoot = existsSync(join(cwd, ".gitmodules")) && !scope;
   let modifiedPackages;
@@ -148,7 +191,7 @@ async function planRelease(options) {
     modifiedPackages = packages;
   } else {
     const git = simpleGit(cwd, { timeout: { block: 6e4 } });
-    modifiedPackages = await detectModifiedPackages(git, packages, cwd);
+    modifiedPackages = await detectModifiedPackages(git, packages, cwd, flowTagGlob);
   }
   const registry = config.registry ?? "https://registry.npmjs.org";
   let planPackages = [];
@@ -188,7 +231,8 @@ async function planRelease(options) {
       bump,
       git,
       gitCwd,
-      pkg.name
+      pkg.name,
+      flowTagGlob
     );
     planPackages.push({
       ...pkg,
@@ -373,7 +417,7 @@ async function discoverSubRepoPackages(workspaceRoot, config) {
   }
   return packages;
 }
-async function detectModifiedPackages(git, packages, cwd) {
+async function detectModifiedPackages(git, packages, cwd, flowTagGlob) {
   const status = await git.status();
   const changedPaths = status.files.map((file) => file.path);
   return (await Promise.all(packages.map(async (pkg) => {
@@ -382,21 +426,21 @@ async function detectModifiedPackages(git, packages, cwd) {
     if (hasUncommitted) {
       return pkg;
     }
-    const commits = await getCommitsSinceTag(git, pkg.name, pkgRel);
+    const commits = await getCommitsSinceTag(git, pkg.name, pkgRel, flowTagGlob);
     return commits.length > 0 ? pkg : null;
   }))).filter((pkg) => pkg !== null);
 }
-async function computeNextVersion(packagePath, currentVersion, bump, git, gitCwd, pkgName) {
+async function computeNextVersion(packagePath, currentVersion, bump, git, gitCwd, pkgName, flowTagGlob) {
   if (bump === "auto") {
-    const detectedBump = await detectVersionFromCommits(git, packagePath, gitCwd, pkgName);
+    const detectedBump = await detectVersionFromCommits(git, packagePath, gitCwd, pkgName, flowTagGlob);
     return semver2.inc(currentVersion, detectedBump) || currentVersion;
   }
   return semver2.inc(currentVersion, bump) || currentVersion;
 }
-async function detectVersionFromCommits(git, packagePath, gitCwd, pkgName) {
+async function detectVersionFromCommits(git, packagePath, gitCwd, pkgName, flowTagGlob) {
   try {
     const relPath = relative(resolve(gitCwd), resolve(packagePath));
-    const messages = await getCommitsSinceTag(git, pkgName, relPath);
+    const messages = await getCommitsSinceTag(git, pkgName, relPath, flowTagGlob);
     let hasMinor = false;
     let hasBreaking = false;
     for (const message of messages) {
@@ -494,32 +538,6 @@ function isCheckpointResumable(checkpoint, flow, version) {
   return checkpoint.publishedPackages.length > 0 && Object.values(checkpoint.gitRoots).some((s) => !s.pushed);
 }
 
-// src/tag.ts
-var DEFAULT_TAG_PATTERN = "{flow}-v{version}";
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-var SEMVER_SRC = "\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?";
-function buildReleaseTag(flowName, version, tagPattern) {
-  const pattern = tagPattern ?? DEFAULT_TAG_PATTERN;
-  return pattern.replace("{flow}", flowName).replace("{version}", version);
-}
-function buildTagRegex(flowName, tagPattern) {
-  const escapedPattern = escapeRegex(tagPattern);
-  const src = escapedPattern.replace(escapeRegex("{flow}"), escapeRegex(flowName)).replace(escapeRegex("{version}"), `(${SEMVER_SRC})`);
-  return new RegExp(`^${src}$`);
-}
-function resolveFlowFromTag(config, tag) {
-  const flows = config.flows ?? {};
-  for (const [flowName, flowConfig] of Object.entries(flows)) {
-    const regex = buildTagRegex(flowName, flowConfig.tagPattern ?? DEFAULT_TAG_PATTERN);
-    if (regex.test(tag)) {
-      return { flowName, channel: "stable" };
-    }
-  }
-  return null;
-}
-
 // src/publisher.ts
 async function updatePackageVersion(pkg) {
   const packageJsonPath = join(pkg.path, "package.json");
@@ -659,6 +677,22 @@ function createPackageChangelog(pkg, changelog) {
   }
   return changelog.substring(startIdx, endIdx).trim();
 }
+async function assertTagVersionsMatchDisk(pkgs) {
+  const mismatches = [];
+  for (const pkg of pkgs) {
+    const packageJsonPath = join(pkg.path, "package.json");
+    const onDiskVersion = JSON.parse(await readFile(packageJsonPath, "utf-8")).version;
+    if (onDiskVersion !== pkg.nextVersion) {
+      mismatches.push(`${pkg.name}: tag would say ${pkg.nextVersion}, package.json says ${onDiskVersion ?? "<missing>"}`);
+    }
+  }
+  if (mismatches.length > 0) {
+    throw new Error(
+      `Refusing to create a git tag that doesn't match the committed package.json version(s):
+  ${mismatches.join("\n  ")}`
+    );
+  }
+}
 async function commitAndTagRelease(options) {
   const { cwd, plan, dryRun, noVerify = false, repoRoot, checkpointGitRoots, changelogOutputPath, flowName = "release", tagPattern } = options;
   const simpleGit2 = (await import('simple-git')).default;
@@ -729,6 +763,7 @@ async function commitAndTagRelease(options) {
         result.committed = true;
       }
       if (rootTagged.length === 0) {
+        await assertTagVersionsMatchDisk(pkgs);
         if (singleVersionAcrossPlan) {
           const tagName = buildReleaseTag(flowName, plan.packages[0].nextVersion, tagPattern);
           await rootGit.addTag(tagName);
@@ -1334,6 +1369,7 @@ function verifyExtractedTarball(extractedDir) {
     issues.push(`Test files in dist/: ${testFiles.slice(0, 3).join(", ")}`);
   }
   const extractedPkg = JSON.parse(readFileSync(join(extractedDir, "package.json"), "utf-8"));
+  issues.push(...findForbiddenDependencyProtocols(extractedPkg));
   for (const field of ["main", "module", "types"]) {
     const val = extractedPkg[field];
     if (val && !existsSync(join(extractedDir, val))) {
@@ -1366,6 +1402,25 @@ function verifyExtractedTarball(extractedDir) {
   }
   return issues;
 }
+function findForbiddenDependencyProtocols(pkg) {
+  const issues = [];
+  for (const section of ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies"]) {
+    const deps = pkg[section];
+    if (!deps || typeof deps !== "object") {
+      continue;
+    }
+    for (const [name, value] of Object.entries(deps)) {
+      if (typeof value !== "string") {
+        continue;
+      }
+      const protocol = ["workspace:", "link:", "file:"].find((prefix) => value.startsWith(prefix));
+      if (protocol) {
+        issues.push(`${section}.${name} uses forbidden ${protocol} dependency protocol (${value})`);
+      }
+    }
+  }
+  return issues;
+}
 function resolveEsmEntry(pkg) {
   const dotExport = pkg.exports?.["."];
   const importEntry = dotExport && typeof dotExport === "object" ? dotExport["import"] : void 0;
@@ -1933,6 +1988,84 @@ function buildReport(stage, plan, repoRoot, dryRun, startTime, result) {
     result: { ...result, timingMs: result.timingMs ?? Date.now() - startTime }
   };
 }
+async function verifyCleanInstall(tarballPath, packageName, additionalTarballs = [], packageManager = "npm") {
+  const consumerDir = mkdtempSync(join(tmpdir(), "kb-clean-install-"));
+  try {
+    if (packageManager === "pnpm") {
+      const stagedTarballs = [tarballPath, ...additionalTarballs];
+      const targetName = readPackedPackageName(tarballPath);
+      if (!targetName) {
+        return { ok: false, error: `install failed: cannot read package name from ${tarballPath}` };
+      }
+      const dependencies = { [targetName]: `file:${tarballPath}` };
+      const overrides = {};
+      for (const stagedTarball of stagedTarballs) {
+        const name = readPackedPackageName(stagedTarball);
+        if (!name) {
+          return { ok: false, error: `install failed: cannot read package name from ${stagedTarball}` };
+        }
+        overrides[name] = `file:${stagedTarball}`;
+      }
+      writeFileSync(
+        join(consumerDir, "package.json"),
+        JSON.stringify({ name: "kb-release-consumer", private: true, dependencies, pnpm: { overrides } }, null, 2) + "\n"
+      );
+      const install = spawnSync(
+        "pnpm",
+        ["install", "--ignore-scripts", "--no-lockfile", "--config.auto-install-peers=true"],
+        { cwd: consumerDir, stdio: "pipe", timeout: 12e4 }
+      );
+      if (install.status !== 0) {
+        return { ok: false, error: `install failed: ${describeProcessFailure(install)}` };
+      }
+    } else {
+      writeFileSync(join(consumerDir, "package.json"), JSON.stringify({ name: "kb-release-consumer", private: true }) + "\n");
+      const { Arborist } = await import('@npmcli/arborist');
+      const arb = new Arborist({ path: consumerDir, ignoreScripts: true });
+      try {
+        await arb.reify({ add: [tarballPath, ...additionalTarballs], save: false });
+      } catch (err) {
+        return { ok: false, error: `install failed: ${describeArboristError(err)}` };
+      }
+    }
+    const importCheck = spawnSync(
+      "node",
+      ["--input-type=module", "-e", "await import(process.argv[1])", packageName],
+      { cwd: consumerDir, stdio: "pipe", timeout: 15e3 }
+    );
+    if (importCheck.status !== 0) {
+      const stderr = importCheck.stderr?.toString().trim();
+      return { ok: false, error: `clean consumer cannot import ${packageName}${stderr ? `: ${stderr}` : ""}` };
+    }
+    return { ok: true };
+  } finally {
+    rmSync(consumerDir, { recursive: true, force: true });
+  }
+}
+function readPackedPackageName(tarballPath) {
+  const result = spawnSync("tar", ["xOf", tarballPath, "package/package.json"], { stdio: "pipe" });
+  if (result.status !== 0) {
+    return void 0;
+  }
+  try {
+    const manifest = JSON.parse(result.stdout.toString());
+    return typeof manifest.name === "string" ? manifest.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function describeArboristError(err) {
+  if (err instanceof Error) {
+    const code = err.code;
+    return code ? `[${code}] ${err.message}` : err.message;
+  }
+  return String(err);
+}
+function describeProcessFailure(result) {
+  const stderr = result.stderr?.toString().trim();
+  const stdout = result.stdout?.toString().trim();
+  return stderr || stdout || `package manager exited with code ${result.status ?? "unknown"}`;
+}
 async function resolveScopePath(repoRoot, scope) {
   if (!scope || scope === "root") {
     return repoRoot;
@@ -1957,6 +2090,6 @@ async function resolveScopePath(repoRoot, scope) {
   return join(repoRoot, scope);
 }
 
-export { DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, spawnCommand, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyExtractedTarball, verifyPackage, verifyPackages };
+export { DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, spawnCommand, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map