@kb-labs/release-manager-core 2.118.2 → 2.119.0-canary.0b4b21a55

package/dist/index.d.ts

@@ -357,6 +357,14 @@ interface ChangelogGenerator {
         repoRoot: string;
         gitCwd: string;
         config: ReleaseConfig;
+        /** Named flow whose release tag pattern bounds the changelog. */
+        flow?: string;
+        /** Explicit git boundaries; these take precedence over the flow baseline. */
+        range?: {
+            from?: string;
+            to?: string;
+            sinceTag?: string;
+        };
     }): Promise<string>;
 }
 interface PipelineOptions {
@@ -656,6 +664,60 @@ declare function resolveFlowFromTag(config: ReleaseConfig, tag: string): {
     channel: ReleaseChannel;
 } | null;
 
+/**
+ * Release status — a read-only "what is actually true right now" view for a
+ * flow, cross-checking the surfaces that the 2026-08-13 release-system audit
+ * found drifting apart independently: the latest stable git tag, and the
+ * real npm dist-tags packages currently resolve to.
+ *
+ * This does not replace the receipt/state-machine model from the breaking
+ * control-plane cutover plan — it is the cheap, non-breaking piece of that
+ * diagnosis that can ship today: make "a tag/npm entry exists" and "this was
+ * actually verified and promoted" visibly different without any new storage.
+ */
+
+interface NpmDistTagInfo {
+    name: string;
+    stableVersion: string | null;
+    canaryVersion: string | null;
+    error?: string;
+}
+interface StableTagInfo {
+    tag: string | null;
+    version: string | null;
+    commit: string | null;
+    committedAt: string | null;
+}
+interface FlowReleaseStatus {
+    flow: string;
+    packages: string[];
+    git: StableTagInfo;
+    npm: {
+        registry: string;
+        stableDistTag: string;
+        canaryDistTag: string;
+        perPackage: NpmDistTagInfo[];
+        /** Agreed version across all sampled packages, or null if they disagree or none resolved. */
+        stableVersion: string | null;
+        canaryVersion: string | null;
+        stableDrift: boolean;
+        canaryDrift: boolean;
+    };
+    verdict: {
+        ok: boolean;
+        warnings: string[];
+    };
+}
+interface ComputeFlowReleaseStatusOptions {
+    cwd: string;
+    config: ReleaseConfig;
+    flow: string;
+    shell: ShellAPI;
+    /** How many of the flow's packages to sample against npm. Lockstep flows only need enough to detect drift. Default 3. */
+    maxPackagesToCheck?: number;
+}
+declare function computeFlowReleaseStatus(opts: ComputeFlowReleaseStatusOptions): Promise<FlowReleaseStatus>;
+
 /**
  * Unified release pipeline — single orchestrator for CLI and REST.
  *
@@ -744,12 +806,26 @@ declare function runReleaseChecks(checks: CustomCheckConfig[], options: CheckRun
 declare function verifyPackages(packages: PackageVersion[], options?: {
     logger?: Pick<PluginLogger, 'info'>;
     onProgress?: (pkg: string, result: VerifyResult) => void;
+    packageManager?: 'pnpm' | 'npm' | 'yarn';
 }): Promise<VerifyResult[]>;
 /**
  * Verify a single package is publishable.
- * npm pack → extract → check exports, directory imports, test leaks, syntax.
- */
-declare function verifyPackage(packagePath: string, packageName?: string): VerifyResult;
+ * pack → extract → check exports, directory imports, test leaks, syntax.
+ *
+ * Packing tool must match what the real publish step will actually use:
+ * `pnpm pack` resolves `workspace:`/`link:` protocol refs to real version
+ * ranges natively (confirmed: `pnpm pack` on a package with
+ * `peerDependencies: { "@kb-labs/sdk": "workspace:^" }` produces a tarball
+ * with `"@kb-labs/sdk": "^2.115.4"`). `npm pack` does not — it packs the
+ * manifest byte-for-byte, so an unrewritten `workspace:*`/`link:` ref
+ * survives into the tarball and gets correctly flagged by
+ * findForbiddenDependencyProtocols() below. Defaulting to 'npm' here when
+ * the caller doesn't say otherwise is deliberately the strict reading (catch
+ * it even if we don't know yet what will actually publish); passing 'pnpm'
+ * for a pipeline that really does pack with pnpm avoids false positives on
+ * refs pnpm already resolves for free.
+ */
+declare function verifyPackage(packagePath: string, packageName?: string, packageManager?: 'pnpm' | 'npm' | 'yarn'): VerifyResult;
 /**
  * Run the static artifact checks (test-file leaks, exports existence,
  * directory-import detection, syntax validation) against an already
@@ -798,6 +874,13 @@ interface VerifyAgainstRegistryOptions {
      * Default: 0 (single attempt, matches pre-existing Verdaccio behavior).
      */
     retries?: number;
+    /**
+     * Total time to wait for npm metadata and tarballs to propagate after a
+     * publish. When provided this supersedes the legacy fixed retry count, so
+     * an idempotent re-run resumes verification of already-published tarballs
+     * instead of requiring a new publish or a workflow-owned sleep.
+     */
+    visibilityDeadlineMs?: number;
     retryDelaysMs?: readonly number[];
     logger?: Pick<PluginLogger, 'info' | 'warn'>;
 }
@@ -858,4 +941,4 @@ declare function verifyCleanInstall(tarballPath: string, packageName: string, ad
  */
 declare function resolveScopePath(repoRoot: string, scope: string): Promise<string>;
 
-export { type AuditSummary, type BuildConfig, type BuildResult, CHECKS_CONCURRENCY, type ChangelogGenerator, type CheckId, type CheckResult, type CheckResultDetails, type CleanInstallResult, type CustomCheckConfig, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, type FlowConfig, type PackagePublisher, type PackageVersion, type PackagesFilter, type PipelineOptions, type PipelineResult, type PlannerOptions, type PluginLogger, type PublishResult, type PublishablePackage, type ReleaseChannel, type ReleaseConfig, type ReleaseContext, type ReleasePlan, type ReleaseReport, type ReleaseResult, type ReleaseShell, type ReleaseStage, type RollbackSnapshot, type StrategyOptions, type VerifyResult, type VersionBump, type VersionStrategy, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };
+export { type AuditSummary, type BuildConfig, type BuildResult, CHECKS_CONCURRENCY, type ChangelogGenerator, type CheckId, type CheckResult, type CheckResultDetails, type CleanInstallResult, type ComputeFlowReleaseStatusOptions, type CustomCheckConfig, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, type FlowConfig, type FlowReleaseStatus, type NpmDistTagInfo, type PackagePublisher, type PackageVersion, type PackagesFilter, type PipelineOptions, type PipelineResult, type PlannerOptions, type PluginLogger, type PublishResult, type PublishablePackage, type ReleaseChannel, type ReleaseConfig, type ReleaseContext, type ReleasePlan, type ReleaseReport, type ReleaseResult, type ReleaseShell, type ReleaseStage, type RollbackSnapshot, type StableTagInfo, type StrategyOptions, type VerifyResult, type VersionBump, type VersionStrategy, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, computeFlowReleaseStatus, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };

package/dist/index.js

@@ -1050,6 +1050,133 @@ function resolvePublishRegistry(config, channel) {
   }
   return config.registry ?? DEFAULT_NPM_REGISTRY;
 }
+
+// src/status.ts
+var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
+function compareSemver(a, b) {
+  const ma = a.match(SEMVER_RE);
+  const mb = b.match(SEMVER_RE);
+  if (!ma || !mb) {
+    return 0;
+  }
+  for (let i = 1; i <= 3; i++) {
+    const diff = Number(ma[i]) - Number(mb[i]);
+    if (diff !== 0) {
+      return diff;
+    }
+  }
+  return 0;
+}
+function escapeRegex2(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+async function fetchDistTags(name, registry) {
+  try {
+    const encoded = name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : name;
+    const url = `${registry.replace(/\/$/, "")}/${encoded}`;
+    const res = await fetch(url, {
+      headers: { Accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (!res.ok) {
+      return { error: `HTTP ${res.status}` };
+    }
+    const body = await res.json();
+    return body["dist-tags"] ?? {};
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function findLatestStableTag(shell, cwd, flowName, tagPattern) {
+  const empty = { tag: null, version: null, commit: null, committedAt: null };
+  const prefix = tagPattern.split("{version}")[0]?.replace("{flow}", flowName) ?? `${flowName}-v`;
+  const listRes = await shell.exec("git", ["tag", "-l", `${prefix}*`], { cwd });
+  const tags = listRes.stdout.split("\n").map((t) => t.trim()).filter(Boolean);
+  if (tags.length === 0) {
+    return empty;
+  }
+  const versionRe = new RegExp(`^${escapeRegex2(prefix)}(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)$`);
+  const parsed = tags.map((t) => ({ tag: t, version: t.match(versionRe)?.[1] })).filter((t) => Boolean(t.version));
+  if (parsed.length === 0) {
+    return empty;
+  }
+  parsed.sort((a, b) => compareSemver(a.version, b.version));
+  const latest = parsed[parsed.length - 1];
+  const [shaRes, dateRes] = await Promise.all([
+    shell.exec("git", ["rev-list", "-n", "1", latest.tag], { cwd }),
+    shell.exec("git", ["log", "-1", "--format=%cI", latest.tag], { cwd })
+  ]);
+  return {
+    tag: latest.tag,
+    version: latest.version,
+    commit: shaRes.stdout.trim() || null,
+    committedAt: dateRes.stdout.trim() || null
+  };
+}
+async function computeFlowReleaseStatus(opts) {
+  const { cwd, config, flow, shell, maxPackagesToCheck = 3 } = opts;
+  const flowConfig = mergeConfigWithFlow(config, flow);
+  const tagPattern = config.flows?.[flow]?.tagPattern ?? DEFAULT_TAG_PATTERN;
+  const packages = await discoverCurrentPackages(cwd, void 0, flowConfig);
+  const registry = resolvePublishRegistry(config, "canary");
+  const stableDistTag = resolvePublishTag(config, "stable");
+  const canaryDistTag = resolvePublishTag(config, "canary");
+  const sampled = packages.slice(0, maxPackagesToCheck);
+  const perPackage = [];
+  for (const pkg of sampled) {
+    const result = await fetchDistTags(pkg.name, registry);
+    if ("error" in result) {
+      perPackage.push({ name: pkg.name, stableVersion: null, canaryVersion: null, error: result.error });
+    } else {
+      perPackage.push({
+        name: pkg.name,
+        stableVersion: result[stableDistTag] ?? null,
+        canaryVersion: result[canaryDistTag] ?? null
+      });
+    }
+  }
+  const stableVersions = new Set(perPackage.map((p) => p.stableVersion).filter((v) => Boolean(v)));
+  const canaryVersions = new Set(perPackage.map((p) => p.canaryVersion).filter((v) => Boolean(v)));
+  const git = await findLatestStableTag(shell, cwd, flow, tagPattern);
+  const warnings = [];
+  if (stableVersions.size > 1) {
+    warnings.push(`Packages disagree on npm "${stableDistTag}" version: ${[...stableVersions].join(", ")}`);
+  }
+  if (canaryVersions.size > 1) {
+    warnings.push(`Packages disagree on npm "${canaryDistTag}" version: ${[...canaryVersions].join(", ")}`);
+  }
+  const stableVersion = stableVersions.size === 1 ? [...stableVersions][0] : null;
+  const canaryVersion = canaryVersions.size === 1 ? [...canaryVersions][0] : null;
+  if (git.version && stableVersion && git.version !== stableVersion) {
+    warnings.push(
+      `Latest git tag ${git.tag} (${git.version}) does not match npm "${stableDistTag}" (${stableVersion})`
+    );
+  }
+  if (stableVersion && canaryVersion && compareSemver(canaryVersion, stableVersion) > 0) {
+    warnings.push(
+      `npm "${canaryDistTag}" (${canaryVersion}) is ahead of "${stableDistTag}" (${stableVersion}) \u2014 treat as an unverified candidate, not a release, until it has a green delivery + smoke run and has been explicitly promoted`
+    );
+  }
+  return {
+    flow,
+    packages: packages.map((p) => p.name),
+    git,
+    npm: {
+      registry,
+      stableDistTag,
+      canaryDistTag,
+      perPackage,
+      stableVersion,
+      canaryVersion,
+      stableDrift: stableVersions.size > 1,
+      canaryDrift: canaryVersions.size > 1
+    },
+    verdict: {
+      ok: warnings.length === 0,
+      warnings
+    }
+  };
+}
 function buildIntraDeps(packages, nameSet) {
   const deps = /* @__PURE__ */ new Map();
   for (const pkg of packages) {
@@ -1287,13 +1414,13 @@ function evaluateParser(check, stdout, stderr, exitCode) {
 async function verifyPackages(packages, options) {
   const results = [];
   for (const pkg of packages) {
-    const result = verifyPackage(pkg.path, pkg.name);
+    const result = verifyPackage(pkg.path, pkg.name, options?.packageManager);
     results.push(result);
     options?.onProgress?.(pkg.name, result);
   }
   return results;
 }
-function verifyPackage(packagePath, packageName) {
+function verifyPackage(packagePath, packageName, packageManager = "npm") {
   const pkgJsonPath = join(packagePath, "package.json");
   if (!existsSync(pkgJsonPath)) {
     return { name: packageName ?? packagePath, success: true, issues: [] };
@@ -1310,23 +1437,26 @@ function verifyPackage(packagePath, packageName) {
   const tmpDir = join(tmpdir(), `kb-verify-${randomBytes(6).toString("hex")}`);
   try {
     mkdirSync(tmpDir, { recursive: true });
+    const isPnpm = packageManager === "pnpm";
     const origPkg = readFileSync(pkgJsonPath, "utf-8");
-    const modPkg = JSON.parse(origPkg);
-    for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
-      const deps = modPkg[section];
-      if (!deps) {
-        continue;
-      }
-      for (const [k, v] of Object.entries(deps)) {
-        if (typeof v === "string" && v.startsWith("link:")) {
-          deps[k] = "*";
+    if (!isPnpm) {
+      const modPkg = JSON.parse(origPkg);
+      for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
+        const deps = modPkg[section];
+        if (!deps) {
+          continue;
+        }
+        for (const [k, v] of Object.entries(deps)) {
+          if (typeof v === "string" && v.startsWith("link:")) {
+            deps[k] = "*";
+          }
         }
       }
+      writeFileSync(pkgJsonPath, JSON.stringify(modPkg, null, 2) + "\n");
     }
-    writeFileSync(pkgJsonPath, JSON.stringify(modPkg, null, 2) + "\n");
     let tgzFile;
     try {
-      spawnSync("npm", ["pack", "--pack-destination", tmpDir], { cwd: packagePath, stdio: "pipe", timeout: 3e4 });
+      spawnSync(isPnpm ? "pnpm" : "npm", ["pack", "--pack-destination", tmpDir], { cwd: packagePath, stdio: "pipe", timeout: 3e4 });
       const files = readdirSync(tmpDir).filter((f) => f.endsWith(".tgz"));
       tgzFile = files[0] ? join(tmpDir, files[0]) : void 0;
     } finally {
@@ -1483,31 +1613,35 @@ async function verifyAgainstRegistry(packages, options) {
   const { registry, timeout = DEFAULT_TIMEOUT_MS, retries = 0, retryDelaysMs = DEFAULT_POLL_RETRY_DELAYS_MS, logger } = options;
   const results = [];
   for (const pkg of packages) {
-    results.push(await verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, logger));
+    results.push(await verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, options.visibilityDeadlineMs, logger));
   }
   return results;
 }
-async function waitUntilPublished(pkg, registry, retries, retryDelaysMs, logger) {
-  for (let attempt = 0; attempt <= retries; attempt++) {
+async function waitUntilPublished(pkg, registry, retries, retryDelaysMs, visibilityDeadlineMs, logger) {
+  const deadline = visibilityDeadlineMs === void 0 ? void 0 : Date.now() + visibilityDeadlineMs;
+  for (let attempt = 0; deadline === void 0 ? attempt <= retries : Date.now() <= deadline; attempt++) {
     if (await isVersionPublished(pkg.name, pkg.version, registry)) {
       return true;
     }
-    if (attempt < retries) {
+    if (deadline === void 0 ? attempt < retries : Date.now() < deadline) {
       const delay = retryDelaysMs[Math.min(attempt, retryDelaysMs.length - 1)];
+      const remaining = deadline === void 0 ? void 0 : deadline - Date.now();
+      const waitMs = remaining === void 0 ? delay : Math.min(delay, Math.max(0, remaining));
       logger?.warn?.(
-        `${pkg.name}@${pkg.version} not yet visible on ${registry} (attempt ${attempt + 1}/${retries + 1}), retrying in ${(delay / 1e3).toFixed(0)}s \u2014 likely registry propagation lag`
+        `${pkg.name}@${pkg.version} not yet visible on ${registry} (attempt ${attempt + 1}${deadline === void 0 ? `/${retries + 1}` : ""}), retrying in ${(waitMs / 1e3).toFixed(0)}s${remaining === void 0 ? "" : `; ${(Math.max(0, remaining) / 1e3).toFixed(0)}s remain`} \u2014 likely registry propagation lag`
       );
       await new Promise((r) => {
-        setTimeout(r, delay);
+        setTimeout(r, waitMs);
       });
     }
   }
   return false;
 }
-async function verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, logger) {
-  const published = await waitUntilPublished(pkg, registry, retries, retryDelaysMs, logger);
+async function verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, visibilityDeadlineMs, logger) {
+  const published = await waitUntilPublished(pkg, registry, retries, retryDelaysMs, visibilityDeadlineMs, logger);
   if (!published) {
-    return { name: pkg.name, success: false, issues: [`${pkg.name}@${pkg.version} was not found on ${registry} after publish (waited through ${retries} retr${retries === 1 ? "y" : "ies"})`] };
+    const waited = visibilityDeadlineMs === void 0 ? `waited through ${retries} retr${retries === 1 ? "y" : "ies"}` : `visibility deadline of ${(visibilityDeadlineMs / 1e3).toFixed(0)}s elapsed`;
+    return { name: pkg.name, success: false, issues: [`${pkg.name}@${pkg.version} was not found on ${registry} after publish (${waited})`] };
   }
   logger?.info?.(`${pkg.name}@${pkg.version} confirmed on ${registry}`);
   const tmpDir = join(tmpdir(), `kb-verdaccio-verify-${randomBytes(6).toString("hex")}`);
@@ -1809,7 +1943,8 @@ async function _runPipeline(ctx) {
   }
   if (!skipVerify && !dryRun) {
     progress("verifying", "Verifying package artifacts...");
-    const verifyResults = await verifyPackages(plan.packages, { logger });
+    const packageManager = config.workspace?.type ?? config.publish?.packageManager ?? "pnpm";
+    const verifyResults = await verifyPackages(plan.packages, { logger, packageManager });
     const verifyFailed = verifyResults.filter((r) => !r.success);
     if (verifyFailed.length > 0) {
       await restoreSnapshot(repoRoot);
@@ -1851,7 +1986,7 @@ async function _runPipeline(ctx) {
   if (changelogGen && channel === "stable") {
     progress("versioning", "Generating changelog...");
     try {
-      changelogMd = await changelogGen.generate(plan, { repoRoot, gitCwd: scopeCwd, config });
+      changelogMd = await changelogGen.generate(plan, { repoRoot, gitCwd: scopeCwd, config, flow });
     } catch (err) {
       logger?.warn?.(`Changelog generation failed: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -2093,6 +2228,6 @@ async function resolveScopePath(repoRoot, scope) {
   return join(repoRoot, scope);
 }
 
-export { CHECKS_CONCURRENCY, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };
+export { CHECKS_CONCURRENCY, DEFAULT_ROOT_CHANGELOG_PATH, DEFAULT_TAG_PATTERN, applyCanarySuffix, applyVersionStrategy, buildPackages, buildReleaseTag, commitAndTagRelease, computeFlowReleaseStatus, copyChangelogToPackages, createExecaShellAdapter, discoverCurrentPackages, findForbiddenDependencyProtocols, isBuildCommand, isVersionPublished, matchesPackagePattern, mergeConfigWithFlow, mergeRootChangelog, planRelease, renderJson, renderMarkdown, renderText, resolveFlowFromTag, resolvePublishRegistry, resolvePublishTag, resolveRootChangelogRelPath, resolveScopePath, restoreSnapshot, runReleaseChecks, runReleasePipeline, runSafeBuild, saveSnapshot, updatePackageVersion, updatePackageVersions, verifyAgainstRegistry, verifyCleanInstall, verifyExtractedTarball, verifyPackage, verifyPackages };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map