@knights-eye-chess/ai-analysis 0.1.0-dev.14 → 0.1.0-dev.17

package/NPM-PUBLISHING.md

@@ -2,16 +2,20 @@
 
 The owner authorized public npm prereleases on 10 October 2026. Use **`next`** and preserve any existing `latest` tag. Licensing is documented in [LICENSING.md](LICENSING.md).
 
+The first registry prerelease is `0.1.0-dev.14`. The source checkout now prepares
+`0.1.0-dev.17` with Move Classifier `0.1.0-dev.13`.
+This next candidate has not been published; `@next` remains the verified registry release.
+
 ## Prepare the exact candidate
 
-Use Node 24 and npm 11:
+Use Node 24.19.0 and npm 11.9.0:
 
 ```sh
 npm ci
 npm run publish:prepare
 ```
 
-Review `artifacts/knights-eye-chess-ai-analysis-0.1.0-dev.14.tgz`, including its files, exports, declarations, licenses and exact registry dependencies. Reusable source and offline owner tests are intentional; application traces, credentials, vendor archives and source lockfiles are excluded. The checkout stays `private: true`; publish only the staged archive. Archive contents are immutable: use a new version for changed bytes.
+Review `artifacts/knights-eye-chess-ai-analysis-0.1.0-dev.17.tgz`, including its files, exports, declarations, licenses and exact registry dependencies. Reusable source and offline owner tests are intentional; application traces, credentials, vendor archives and source lockfiles are excluded. The checkout stays `private: true`; publish only the staged archive. Archive contents are immutable: use a new version for changed bytes.
 
 Before every coordinated release, run `node tools/release-tooling/sync.mjs --check` in the reviewed app checkout alongside all six component revisions. Record those commits and the result.
 

package/README.md

@@ -22,19 +22,17 @@ engine hosting, persistence and privacy settings for chess data and traces.
 
 ## Get started
 
-Use Node 24 or newer. This preview has not been published to npm. From a checkout
-of [this repository](https://github.com/knights-eye-chess/ai-analysis):
+Use Node 24 or newer. Install the published prerelease with the chess library
+imported by the example below:
 
 ```sh
-npm ci
-npm run pack:checked
+npm install @knights-eye-chess/ai-analysis@next chess.js@1.4.0
 ```
 
-Install the resulting archive in your app:
-
-```sh
-npm install /absolute/path/to/ai-analysis/artifacts/knights-eye-chess-ai-analysis-0.1.0-dev.12.tgz
-```
+The first reviewed registry candidate is `0.1.0-dev.14`; pin the exact version
+for a reproducible install. Source developers can use `npm ci` and
+`npm run pack:checked` in this checkout.
+[SOURCE-ORIGIN.json](SOURCE-ORIGIN.json) records historical archive provenance.
 
 This runnable example uses a local connector with a fixed answer. It needs no
 provider credentials or engine, and demonstrates host wiring rather than model

package/npm-release.json

@@ -1,5 +1,5 @@
 {
   "registryDependencies": {
-    "@knights-eye-chess/move-classifier": "0.1.0-dev.10"
+    "@knights-eye-chess/move-classifier": "0.1.0-dev.13"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knights-eye-chess/ai-analysis",
-  "version": "0.1.0-dev.14",
+  "version": "0.1.0-dev.17",
   "type": "module",
   "files": [
     "dist",
@@ -51,7 +51,7 @@
   "dependencies": {
     "@ai-sdk/provider": "4.0.9",
     "@ai-sdk/provider-utils": "5.0.34",
-    "@knights-eye-chess/move-classifier": "0.1.0-dev.10",
+    "@knights-eye-chess/move-classifier": "0.1.0-dev.13",
     "@types/json-schema": "7.0.15",
     "@types/node": "22.19.19",
     "ai": "7.0.85",

package/scripts/publish-reviewed.mjs

@@ -11,15 +11,15 @@ export function npmFailure(result) {
   for (const output of [result.stdout, result.stderr]) {
     try { const parsed = JSON.parse(output || '{}'); error ||= parsed.error; } catch {}
   }
-  const allowed = new Set(['EOTP', 'E401', 'E403', 'E404', 'E409', 'E422', 'E429', 'E500', 'E502', 'E503', 'E504', 'EPROVENANCE', 'EUSAGE', 'ENEEDAUTH', 'ENOTP', 'EPRIVATE', 'EPUBLISHCONFLICT', 'EUNSCOPED', 'ECONNRESET', 'ETIMEDOUT', 'ENOTFOUND']);
-  const candidate = typeof error?.code === 'string' ? error.code : (result.stderr || '').match(/^npm (?:error|ERR!) code ([A-Z][A-Z0-9]+)\s*$/m)?.[1];
+  const allowed = new Set(['EOTP', 'E401', 'E403', 'E404', 'E408', 'E409', 'E422', 'E429', 'E500', 'E502', 'E503', 'E504', 'EPROVENANCE', 'EUSAGE', 'ENEEDAUTH', 'ENOTP', 'EPRIVATE', 'EPUBLISHCONFLICT', 'EUNSCOPED', 'ECONNRESET', 'ETIMEDOUT', 'ENOTFOUND', 'EAI_AGAIN', 'ECONNREFUSED']);
+  const candidate = typeof error?.code === 'string' ? error.code : result.error?.code || (result.stderr || '').match(/^npm (?:error|ERR!) code ([A-Z][A-Z0-9_]+)\s*$/m)?.[1];
   const code = allowed.has(candidate) ? candidate : 'UNKNOWN';
   const rawStatus = error?.statusCode ?? error?.status ?? (/^E[45]\d\d$/.test(code) ? Number(code.slice(1)) : undefined);
   const httpStatus = Number.isInteger(rawStatus) && rawStatus >= 400 && rawStatus <= 599 ? rawStatus : 'unknown';
   const exitStatus = Number.isInteger(result.status) && result.status >= 0 && result.status <= 255 ? result.status : 'unknown';
   return {code, httpStatus, exitStatus};
 }
-export function publishReviewed({root, version, sha256, env = process.env, run = spawnSync, wait = () => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2000)}) {
+export function publishReviewed({root, version, sha256, env = process.env, run = spawnSync, wait = milliseconds => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds), now = Date.now}) {
   if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_EVENT_NAME !== 'workflow_dispatch' || env.GITHUB_REF !== 'refs/heads/dev') throw Error('Publishing requires manual GitHub Actions dispatch on dev');
   if (env.GITHUB_REPOSITORY_VISIBILITY !== 'public') throw Error('Provenance publishing requires a public GitHub repository');
   if (!env.NODE_AUTH_TOKEN?.trim()) throw Error('Missing NODE_AUTH_TOKEN; publication has no authentication fallback');
@@ -35,26 +35,31 @@ export function publishReviewed({root, version, sha256, env = process.env, run =
   const pkg = JSON.parse(metadataResult.stdout);
   if (pkg.name !== source.name || pkg.version !== version || pkg.private || pkg.publishConfig?.access !== 'public' || pkg.publishConfig?.registry !== 'https://registry.npmjs.org/' || pkg.publishConfig?.tag !== 'next') throw Error('Expected reviewed staged registry candidate');
   const integrity = 'sha512-' + createHash('sha512').update(bytes).digest('base64');
-  const lookupArgs = ['view', `${pkg.name}@${version}`, '--json', '--registry', 'https://registry.npmjs.org/'];
+  const lookupArgs = ['view', `${pkg.name}@${version}`, '--json', '--registry', 'https://registry.npmjs.org/', '--prefer-online', '--fetch-retries=0', '--fetch-timeout=15000'];
   const lookupOptions = { ...options, timeout: 15000 };
   const lookup = run('npm', lookupArgs, lookupOptions);
   if (lookup.status === 0) {
-    const existing = JSON.parse(lookup.stdout);
+    let existing;
+    try { existing = JSON.parse(lookup.stdout); } catch { throw Error('Registry lookup returned invalid JSON; refusing publication'); }
     if (existing.name !== pkg.name || existing.version !== version || existing.dist?.integrity !== integrity) throw Error('Published version exists with different identity or integrity');
     return { name: pkg.name, version, sha256, integrity, published: false, alreadyPublished: true, registryConfirmed: true };
   }
-  let error;
-  try { error = JSON.parse(lookup.stdout || '{}').error; } catch {}
-  if (error?.code !== 'E404') throw Error('Registry lookup failed; refusing publication');
+  const absent = npmFailure(lookup);
+  if (absent.code !== 'E404') throw Error(`Registry lookup failed; refusing publication: code=${absent.code}, httpStatus=${absent.httpStatus}, exitStatus=${absent.exitStatus}`);
   const result = run('npm', ['publish', archive, '--ignore-scripts', '--access', 'public', '--tag', 'next', '--registry', 'https://registry.npmjs.org/', '--provenance', '--json'], options);
   if (result.status !== 0) {
     const {code, httpStatus, exitStatus} = npmFailure(result);
     throw Error(`npm publish failed for ${pkg.name}@${version}: code=${code}, httpStatus=${httpStatus}, exitStatus=${exitStatus}`);
   }
-  let visible = false;
-  for (let attempt = 0; attempt < 3; attempt++) {
-    if (attempt) wait();
-    const confirmation = run('npm', lookupArgs, lookupOptions);
+  let visible = false, attempts = 0, lastFailure;
+  const started = now(), deadline = started + 240000;
+  const transientCodes = new Set(['E404', 'E408', 'E429', 'E500', 'E502', 'E503', 'E504', 'ECONNRESET', 'ETIMEDOUT', 'ENOTFOUND', 'EAI_AGAIN', 'ECONNREFUSED']);
+  for (let attempt = 0; attempt < 25; attempt++) {
+    if (attempt) wait(Math.min(10000, Math.max(0, deadline - now())));
+    const remaining = deadline - now();
+    if (remaining <= 0) break;
+    const confirmation = run('npm', lookupArgs, { ...lookupOptions, timeout: Math.min(15000, remaining) });
+    attempts++;
     if (confirmation.status === 0) {
       let existing;
       try { existing = JSON.parse(confirmation.stdout); } catch {}
@@ -62,8 +67,16 @@ export function publishReviewed({root, version, sha256, env = process.env, run =
       visible = true;
       break;
     }
+    lastFailure = npmFailure(confirmation);
+    const {code, httpStatus, exitStatus} = lastFailure;
+    if (['E401', 'E403', 'ENEEDAUTH', 'EOTP', 'ENOTP'].includes(code) || [401, 403].includes(httpStatus) || !(transientCodes.has(code) || [408, 429, 500, 502, 503, 504].includes(httpStatus))) {
+      throw Error(`Postpublication registry confirmation failed for ${pkg.name}@${version}: code=${code}, httpStatus=${httpStatus}, exitStatus=${exitStatus}; publication was not retried`);
+    }
+  }
+  if (!visible) {
+    const {code = 'UNKNOWN', httpStatus = 'unknown', exitStatus = 'unknown'} = lastFailure || {};
+    throw Error(`npm publication returned success but registry confirmation pending for ${pkg.name}@${version}: attempts=${attempts}, elapsedMs=${Math.max(0, Math.min(240000, now() - started))}, code=${code}, httpStatus=${httpStatus}, exitStatus=${exitStatus}; bounded confirmation ended, publication was not retried`);
   }
-  if (!visible) throw Error(`npm publication returned success but registry confirmation failed for ${pkg.name}@${version}; publication was not retried`);
   return { name: pkg.name, version, sha256, integrity, published: true, alreadyPublished: false, registryConfirmed: true };
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {

package/scripts/release-tooling.json

@@ -3,7 +3,7 @@
   "canonical": "knightseye-net/tools/release-tooling",
   "sha256": {
     "scripts/pack.mjs": "334aa4041e59b14fd2b072969f50beea64449136f7f9146d63d7277fc2e4808a",
-    "scripts/publish-reviewed.mjs": "e9e8a6f5eeff37d5050b96e75fda2fa33084b1f9bc5d5a6688b0aef737dd51c5",
+    "scripts/publish-reviewed.mjs": "b91c7aa578bc34c490b42006038de4ee8b9c596a592aa079bacd836d02feb647",
     ".github/workflows/npm-publish.yml": "b25cec136db205d69a407284dae2bb66f3d56be13ed2a1367f0db167a232050d",
     "scripts/verify-release.mjs": "d0f9baead779e553385bb7c26f1238ad4e60a189a818d4db4f721a1e5f88dedc",
     "scripts/update-dependency.mjs": "9919f172be33973f124eabf56c1dc70e41e941e601783ef01aba1c47dd70db9d",