@kb-labs/release-manager-core 2.118.2 → 2.119.0-canary.0c078654e

package/dist/index.d.ts

@@ -357,6 +357,14 @@ interface ChangelogGenerator {
         repoRoot: string;
         gitCwd: string;
         config: ReleaseConfig;
+        /** Named flow whose release tag pattern bounds the changelog. */
+        flow?: string;
+        /** Explicit git boundaries; these take precedence over the flow baseline. */
+        range?: {
+            from?: string;
+            to?: string;
+            sinceTag?: string;
+        };
     }): Promise<string>;
 }
 interface PipelineOptions {
@@ -744,12 +752,26 @@ declare function runReleaseChecks(checks: CustomCheckConfig[], options: CheckRun
 declare function verifyPackages(packages: PackageVersion[], options?: {
     logger?: Pick<PluginLogger, 'info'>;
     onProgress?: (pkg: string, result: VerifyResult) => void;
+    packageManager?: 'pnpm' | 'npm' | 'yarn';
 }): Promise<VerifyResult[]>;
 /**
  * Verify a single package is publishable.
- * npm pack → extract → check exports, directory imports, test leaks, syntax.
- */
-declare function verifyPackage(packagePath: string, packageName?: string): VerifyResult;
+ * pack → extract → check exports, directory imports, test leaks, syntax.
+ *
+ * Packing tool must match what the real publish step will actually use:
+ * `pnpm pack` resolves `workspace:`/`link:` protocol refs to real version
+ * ranges natively (confirmed: `pnpm pack` on a package with
+ * `peerDependencies: { "@kb-labs/sdk": "workspace:^" }` produces a tarball
+ * with `"@kb-labs/sdk": "^2.115.4"`). `npm pack` does not — it packs the
+ * manifest byte-for-byte, so an unrewritten `workspace:*`/`link:` ref
+ * survives into the tarball and gets correctly flagged by
+ * findForbiddenDependencyProtocols() below. Defaulting to 'npm' here when
+ * the caller doesn't say otherwise is deliberately the strict reading (catch
+ * it even if we don't know yet what will actually publish); passing 'pnpm'
+ * for a pipeline that really does pack with pnpm avoids false positives on
+ * refs pnpm already resolves for free.
+ */
+declare function verifyPackage(packagePath: string, packageName?: string, packageManager?: 'pnpm' | 'npm' | 'yarn'): VerifyResult;
 /**
  * Run the static artifact checks (test-file leaks, exports existence,
  * directory-import detection, syntax validation) against an already
@@ -798,6 +820,13 @@ interface VerifyAgainstRegistryOptions {
      * Default: 0 (single attempt, matches pre-existing Verdaccio behavior).
      */
     retries?: number;
+    /**
+     * Total time to wait for npm metadata and tarballs to propagate after a
+     * publish. When provided this supersedes the legacy fixed retry count, so
+     * an idempotent re-run resumes verification of already-published tarballs
+     * instead of requiring a new publish or a workflow-owned sleep.
+     */
+    visibilityDeadlineMs?: number;
     retryDelaysMs?: readonly number[];
     logger?: Pick<PluginLogger, 'info' | 'warn'>;
 }

package/dist/index.js

@@ -1287,13 +1287,13 @@ function evaluateParser(check, stdout, stderr, exitCode) {
 async function verifyPackages(packages, options) {
   const results = [];
   for (const pkg of packages) {
-    const result = verifyPackage(pkg.path, pkg.name);
+    const result = verifyPackage(pkg.path, pkg.name, options?.packageManager);
     results.push(result);
     options?.onProgress?.(pkg.name, result);
   }
   return results;
 }
-function verifyPackage(packagePath, packageName) {
+function verifyPackage(packagePath, packageName, packageManager = "npm") {
   const pkgJsonPath = join(packagePath, "package.json");
   if (!existsSync(pkgJsonPath)) {
     return { name: packageName ?? packagePath, success: true, issues: [] };
@@ -1310,23 +1310,26 @@ function verifyPackage(packagePath, packageName) {
   const tmpDir = join(tmpdir(), `kb-verify-${randomBytes(6).toString("hex")}`);
   try {
     mkdirSync(tmpDir, { recursive: true });
+    const isPnpm = packageManager === "pnpm";
     const origPkg = readFileSync(pkgJsonPath, "utf-8");
-    const modPkg = JSON.parse(origPkg);
-    for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
-      const deps = modPkg[section];
-      if (!deps) {
-        continue;
-      }
-      for (const [k, v] of Object.entries(deps)) {
-        if (typeof v === "string" && v.startsWith("link:")) {
-          deps[k] = "*";
+    if (!isPnpm) {
+      const modPkg = JSON.parse(origPkg);
+      for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
+        const deps = modPkg[section];
+        if (!deps) {
+          continue;
+        }
+        for (const [k, v] of Object.entries(deps)) {
+          if (typeof v === "string" && v.startsWith("link:")) {
+            deps[k] = "*";
+          }
         }
       }
+      writeFileSync(pkgJsonPath, JSON.stringify(modPkg, null, 2) + "\n");
     }
-    writeFileSync(pkgJsonPath, JSON.stringify(modPkg, null, 2) + "\n");
     let tgzFile;
     try {
-      spawnSync("npm", ["pack", "--pack-destination", tmpDir], { cwd: packagePath, stdio: "pipe", timeout: 3e4 });
+      spawnSync(isPnpm ? "pnpm" : "npm", ["pack", "--pack-destination", tmpDir], { cwd: packagePath, stdio: "pipe", timeout: 3e4 });
       const files = readdirSync(tmpDir).filter((f) => f.endsWith(".tgz"));
       tgzFile = files[0] ? join(tmpDir, files[0]) : void 0;
     } finally {
@@ -1483,31 +1486,35 @@ async function verifyAgainstRegistry(packages, options) {
   const { registry, timeout = DEFAULT_TIMEOUT_MS, retries = 0, retryDelaysMs = DEFAULT_POLL_RETRY_DELAYS_MS, logger } = options;
   const results = [];
   for (const pkg of packages) {
-    results.push(await verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, logger));
+    results.push(await verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, options.visibilityDeadlineMs, logger));
   }
   return results;
 }
-async function waitUntilPublished(pkg, registry, retries, retryDelaysMs, logger) {
-  for (let attempt = 0; attempt <= retries; attempt++) {
+async function waitUntilPublished(pkg, registry, retries, retryDelaysMs, visibilityDeadlineMs, logger) {
+  const deadline = visibilityDeadlineMs === void 0 ? void 0 : Date.now() + visibilityDeadlineMs;
+  for (let attempt = 0; deadline === void 0 ? attempt <= retries : Date.now() <= deadline; attempt++) {
     if (await isVersionPublished(pkg.name, pkg.version, registry)) {
       return true;
     }
-    if (attempt < retries) {
+    if (deadline === void 0 ? attempt < retries : Date.now() < deadline) {
       const delay = retryDelaysMs[Math.min(attempt, retryDelaysMs.length - 1)];
+      const remaining = deadline === void 0 ? void 0 : deadline - Date.now();
+      const waitMs = remaining === void 0 ? delay : Math.min(delay, Math.max(0, remaining));
       logger?.warn?.(
-        `${pkg.name}@${pkg.version} not yet visible on ${registry} (attempt ${attempt + 1}/${retries + 1}), retrying in ${(delay / 1e3).toFixed(0)}s \u2014 likely registry propagation lag`
+        `${pkg.name}@${pkg.version} not yet visible on ${registry} (attempt ${attempt + 1}${deadline === void 0 ? `/${retries + 1}` : ""}), retrying in ${(waitMs / 1e3).toFixed(0)}s${remaining === void 0 ? "" : `; ${(Math.max(0, remaining) / 1e3).toFixed(0)}s remain`} \u2014 likely registry propagation lag`
       );
       await new Promise((r) => {
-        setTimeout(r, delay);
+        setTimeout(r, waitMs);
       });
     }
   }
   return false;
 }
-async function verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, logger) {
-  const published = await waitUntilPublished(pkg, registry, retries, retryDelaysMs, logger);
+async function verifyOneAgainstRegistry(pkg, registry, timeout, retries, retryDelaysMs, visibilityDeadlineMs, logger) {
+  const published = await waitUntilPublished(pkg, registry, retries, retryDelaysMs, visibilityDeadlineMs, logger);
   if (!published) {
-    return { name: pkg.name, success: false, issues: [`${pkg.name}@${pkg.version} was not found on ${registry} after publish (waited through ${retries} retr${retries === 1 ? "y" : "ies"})`] };
+    const waited = visibilityDeadlineMs === void 0 ? `waited through ${retries} retr${retries === 1 ? "y" : "ies"}` : `visibility deadline of ${(visibilityDeadlineMs / 1e3).toFixed(0)}s elapsed`;
+    return { name: pkg.name, success: false, issues: [`${pkg.name}@${pkg.version} was not found on ${registry} after publish (${waited})`] };
   }
   logger?.info?.(`${pkg.name}@${pkg.version} confirmed on ${registry}`);
   const tmpDir = join(tmpdir(), `kb-verdaccio-verify-${randomBytes(6).toString("hex")}`);
@@ -1809,7 +1816,8 @@ async function _runPipeline(ctx) {
   }
   if (!skipVerify && !dryRun) {
     progress("verifying", "Verifying package artifacts...");
-    const verifyResults = await verifyPackages(plan.packages, { logger });
+    const packageManager = config.workspace?.type ?? config.publish?.packageManager ?? "pnpm";
+    const verifyResults = await verifyPackages(plan.packages, { logger, packageManager });
     const verifyFailed = verifyResults.filter((r) => !r.success);
     if (verifyFailed.length > 0) {
       await restoreSnapshot(repoRoot);
@@ -1851,7 +1859,7 @@ async function _runPipeline(ctx) {
   if (changelogGen && channel === "stable") {
     progress("versioning", "Generating changelog...");
     try {
-      changelogMd = await changelogGen.generate(plan, { repoRoot, gitCwd: scopeCwd, config });
+      changelogMd = await changelogGen.generate(plan, { repoRoot, gitCwd: scopeCwd, config, flow });
     } catch (err) {
       logger?.warn?.(`Changelog generation failed: ${err instanceof Error ? err.message : String(err)}`);
     }