@microteia/console 2.31.1 → 2.35.0

package/CONSOLE-VERSIONS.md

@@ -22,6 +22,25 @@
 - fix(command): what was broken, and what it did to whoever hit it.
 -->
 
+#### [2.35.0] — 2026-11-02
+
+- feat(publish): the releases repository README links to the official documentation (https://doc.microteia.com), and `publish` rewrites it whenever it differs from the current text — after the catalog, warning instead of failing. It was written only when seeding an empty repository, so the README of an existing one stayed frozen at the text of its first `publish` and no change to it ever arrived. `publish --dry-run` says when it would be rewritten.
+- docs(pack-console): the npm README of the Console links to https://doc.microteia.com.
+
+#### [2.34.0] — 2026-11-02
+
+- fix(publish): `withEntry` promotes `channels.stable` to the HIGHER of the current and the new version. Publishing out of order — a fix on an older line, `9.180.1` after `9.191.0` — moved `latest` back, and every `unpack --version latest` received the older version. `publish` says whether the version became `latest` or only joined the list.
+- fix(pack): `pack --output <dir>` warns that `publish` reads only `distributions/kernel/<version>/`; the package written elsewhere was simply not found.
+- docs(installation): a platform setting (`SELF_SERVICE_TENANTS`, `AUDIT_ARCHIVE_BUCKET`) reaches the functions with `microteia deploy --only functions`, not `provision`, which only tracks settings declared by extensions and by the installation's `functions/`. The prerequisites and `MICROTEIA.md` §3 said `provision`, which changed nothing.
+
+#### [2.33.0] — 2026-10-28
+
+- feat(export-catalog): each screen now carries `keys` — every record key of the collection as `name`, `kind`, `fields`, `scope`, `normalize` and `sparse`, plus `ownerPluginId` when an extension declared it — and each field carries `unique: true` when it is set. The conflict `message` and the deprecated `status` stay out: they do not change which reservation a record gets. Without this, the artifact plan proposed as new, on every run, a key the office declared in the Form Design or a third-party extension installed. Always written, even empty; a snapshot taken by an older Console is read as "keys unknown", and the authoring tools say so.
+
+#### [2.32.0] — 2026-10-27
+
+- feat(export-catalog): each installed extension now carries `fieldPresets` — every `data.field.preset` it declares, as its key and the parts it has (`mask`, `format`, `validate`), never the templates, formatting ops or validation rules. The authoring tools check a field's `mask`, `rules.format.preset` and `rules.validate.check` against it, so a key the dependency does not declare (`cpf-cnpj` for the Brasil extension's `cpfCnpj`) is refused by `check` instead of installing a field that silently has no mask. Always written, even empty; a snapshot taken by an older Console is read as "presets unknown".
+
 #### [2.31.1] — 2026-10-26
 
 - docs(kernel/manifest): the optional prerequisite `portal-identity-signing` now names a third feature that signs with the functions' runtime account: a portal screen declaring `documentLinks` hands guests V4 signed URLs, and without `iam.serviceAccounts.signBlob` the guest cannot open its documents (the denial shows in the log of `getPortalDocumentUrl`). `microteia grant-signing` grants the same permission for all three.

package/README.md

@@ -1,8 +1,10 @@
-# Microteia Console 2.31.1
+# Microteia Console 2.35.0
 
 Installs and updates Microteia in a Firebase project you own. It has no npm dependencies of its own —
 what it needs are command-line tools that are already on the machine, listed at the bottom.
 
+📖 **Documentation: [doc.microteia.com](https://doc.microteia.com)**
+
 ## Installing it
 
     npm i -g @microteia/console

package/lib/console/exportCatalog.d.ts

@@ -55,6 +55,29 @@ export interface CatalogFieldExport {
     ownerPluginId?: string;
     aggregation?: Record<string, unknown>;
     compute?: string;
+    /** O atalho de chave de um campo só — o kernel o desaçucara em `field:<key>`. */
+    unique?: true;
+}
+/**
+ * Uma chave da coleção (`ScreenDefinition.keys`): o que não pode se repetir. É esquema, como o campo:
+ * quem modela precisa saber que ela existe antes de propor outra, e o plano a propunha como nova a
+ * cada execução quando ela só existia na instalação.
+ *
+ * A mensagem do conflito NÃO viaja — é apresentação, e não muda qual reserva um registro recebe. O
+ * `status` também não: ele é ignorado pelo kernel desde que a adoção passou a ser estado dele.
+ */
+export interface CatalogKeyExport {
+    name: string;
+    kind: string;
+    fields: string[];
+    scope?: string;
+    normalize?: {
+        trim?: boolean;
+        caseInsensitive?: boolean;
+        formatPreset?: string;
+    };
+    sparse?: boolean;
+    ownerPluginId?: string;
 }
 export interface CatalogScreenExport {
     key: string;
@@ -74,6 +97,11 @@ export interface CatalogScreenExport {
     parentRelation?: string;
     tagCollection?: string;
     eventPrefix?: string;
+    /**
+     * Sempre escrita, mesmo vazia, pela mesma razão de `CatalogExtensionExport.exports`: a lista vazia diz
+     * "esta tela não tem chave"; a chave ausente é o silêncio de um Console anterior a este campo.
+     */
+    keys: CatalogKeyExport[];
     fields: CatalogFieldExport[];
 }
 export interface CatalogListExport {
@@ -132,6 +160,15 @@ export interface CatalogExtensionDocumentTemplate {
     source: 'record' | 'payload';
     parameters: CatalogExtensionDocumentParameter[];
 }
+/**
+ * Um preset de campo que a extensão declara (`data.field.preset`), como as PARTES que ele tem — nunca o
+ * template, o formato nem a regra. É contra ele que o `mask` de um campo de outra extensão é conferido:
+ * `mask: 'cpf-cnpj'` contra o `cpfCnpj` da Brasil instalava, e o campo ficava sem máscara.
+ */
+export interface CatalogExtensionFieldPreset {
+    key: string;
+    slots: ('mask' | 'format' | 'validate')[];
+}
 export interface CatalogExtensionExport {
     id: string;
     name: string;
@@ -146,6 +183,8 @@ export interface CatalogExtensionExport {
     navGroups: CatalogExtensionNavGroup[];
     /** Sempre escrita, mesmo vazia, pela mesma razão de `exports`. */
     documentTemplates: CatalogExtensionDocumentTemplate[];
+    /** Sempre escrita, mesmo vazia, pela mesma razão de `exports`. */
+    fieldPresets: CatalogExtensionFieldPreset[];
 }
 export interface CatalogExport {
     version: number;

package/lib/console/exportCatalog.js

@@ -165,6 +165,33 @@ const documentTemplatesOf = (extension) => {
     })
         .sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
 };
+const FIELD_PRESET_POINT = 'data.field.preset';
+/**
+ * Os presets de campo de uma cópia instalada. É a mesma leitura que `declaredFieldPresets` faz no
+ * kernel — chave e rótulo obrigatórios, e as partes pelo critério do editor de campo —, repetida porque
+ * o Console não alcança `src/`; o teste que atravessa a fronteira confere as duas.
+ */
+const fieldPresetsOf = (extension) => {
+    const contributes = Array.isArray(extension.manifest?.contributes) ? extension.manifest.contributes : [];
+    return contributes
+        .map(asRecord)
+        .filter((one) => one?.point === FIELD_PRESET_POINT)
+        .flatMap((one) => {
+        const metadata = asRecord(one.metadata);
+        const key = text(metadata?.key);
+        if (metadata === undefined || key === undefined || text(metadata.label) === undefined)
+            return [];
+        return [{
+                key,
+                slots: [
+                    ...(metadata.mask ? ['mask'] : []),
+                    ...(Array.isArray(metadata.format) && metadata.format.length > 0 ? ['format'] : []),
+                    ...(metadata.validate ? ['validate'] : []),
+                ],
+            }];
+    })
+        .sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+};
 /**
  * A mesma dedução que a aplicação faz ao ler a tela (`screenDefinitionMapper.ts`): o `origin` gravado
  * quando ele existe, senão `plugin` para quem tem dono e `design` para o que o escritório criou. Ela é
@@ -200,6 +227,38 @@ const fieldExport = (raw, index, screenOrigin) => {
         ...(text(field.ownerPluginId) === undefined ? {} : { ownerPluginId: text(field.ownerPluginId) }),
         ...(asRecord(field.aggregation) === undefined ? {} : { aggregation: asRecord(field.aggregation) }),
         ...(compute === undefined ? {} : { compute }),
+        ...(field.unique === true ? { unique: true } : {}),
+    };
+};
+const normalizeExport = (raw) => {
+    const normalize = asRecord(raw);
+    if (normalize === undefined)
+        return undefined;
+    const formatPreset = text(normalize.formatPreset);
+    const picked = {
+        ...(typeof normalize.trim === 'boolean' ? { trim: normalize.trim } : {}),
+        ...(typeof normalize.caseInsensitive === 'boolean' ? { caseInsensitive: normalize.caseInsensitive } : {}),
+        ...(formatPreset === undefined ? {} : { formatPreset }),
+    };
+    return Object.keys(picked).length > 0 ? picked : undefined;
+};
+/** A chave como o kernel a grava, sem o que é apresentação. Sem nome ou sem campo, não é chave. */
+const keyExport = (raw) => {
+    const key = asRecord(raw);
+    const name = text(key?.name);
+    const kind = text(key?.kind);
+    const fields = (Array.isArray(key?.fields) ? key.fields : []).filter((one) => typeof one === 'string' && one !== '');
+    if (key === undefined || name === undefined || kind === undefined || fields.length === 0)
+        return null;
+    const normalize = normalizeExport(key.normalize);
+    return {
+        name,
+        kind,
+        fields,
+        ...(text(key.scope) === undefined ? {} : { scope: text(key.scope) }),
+        ...(normalize === undefined ? {} : { normalize }),
+        ...(typeof key.sparse === 'boolean' ? { sparse: key.sparse } : {}),
+        ...(text(key.ownerPluginId) === undefined ? {} : { ownerPluginId: text(key.ownerPluginId) }),
     };
 };
 const screenExport = (document) => {
@@ -220,6 +279,9 @@ const screenExport = (document) => {
         ...(text(data.parentRelation) === undefined ? {} : { parentRelation: text(data.parentRelation) }),
         ...(text(data.tagCollection) === undefined ? {} : { tagCollection: text(data.tagCollection) }),
         ...(text(data.eventPrefix) === undefined ? {} : { eventPrefix: text(data.eventPrefix) }),
+        keys: (Array.isArray(data.keys) ? data.keys : [])
+            .map(keyExport)
+            .filter((key) => key !== null),
         fields: fields
             .map((field, index) => fieldExport(field, index, origin))
             .filter((field) => field !== null),
@@ -263,6 +325,7 @@ export const buildCatalogExport = (input) => ({
         exports: exportedArtifacts(one),
         navGroups: navGroupsOf(one),
         documentTemplates: documentTemplatesOf(one),
+        fieldPresets: fieldPresetsOf(one),
     }))
         .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0)),
     screens: input.screens

package/lib/kernel/channel.d.ts

@@ -63,7 +63,8 @@ export declare const entryOf: (manifest: KernelManifest, urls: {
     manifest: string;
 }, publishedAt: string) => ChannelEntry;
 /**
- * Acrescenta a entrada e promove o canal, RECUSANDO uma versão que já está lá.
+ * Acrescenta a entrada e promove o canal à MAIOR versão entre a atual e a nova, RECUSANDO uma versão
+ * que já está lá.
  *
  * Republicar é a origem de "a mesma versão com dois conteúdos", e ela não tem conserto depois: alguém
  * conferiu um hash contra o download de ontem e a partir dali as duas instalações discordam sobre o que

package/lib/kernel/channel.js

@@ -109,7 +109,8 @@ export const entryOf = (manifest, urls, publishedAt) => {
 };
 const byVersionDescending = (left, right) => compareVersions(right.version, left.version);
 /**
- * Acrescenta a entrada e promove o canal, RECUSANDO uma versão que já está lá.
+ * Acrescenta a entrada e promove o canal à MAIOR versão entre a atual e a nova, RECUSANDO uma versão
+ * que já está lá.
  *
  * Republicar é a origem de "a mesma versão com dois conteúdos", e ela não tem conserto depois: alguém
  * conferiu um hash contra o download de ontem e a partir dali as duas instalações discordam sobre o que
@@ -120,9 +121,13 @@ export const withEntry = (index, entry) => {
         throw new Error(`${entry.version} is already published, and a released version is never rewritten.\n`
             + 'Bump the version in package.json and package it again.');
     }
+    // Publicar fora de ordem é permitido (uma correção numa linha antiga), e o canal não pode andar para
+    // trás por isso: `latest` passaria a entregar uma versão MAIS VELHA a quem atualiza.
+    const current = index.channels[STABLE_CHANNEL];
+    const stable = current !== undefined && compareVersions(current, entry.version) > 0 ? current : entry.version;
     return {
         schema: INDEX_SCHEMA,
-        channels: { ...index.channels, [STABLE_CHANNEL]: entry.version },
+        channels: { ...index.channels, [STABLE_CHANNEL]: stable },
         kernel: [entry, ...index.kernel].sort(byVersionDescending),
     };
 };

package/lib/kernel/manifest.js

@@ -131,7 +131,7 @@ export const MANUAL_PREREQUISITES = [
             + 'longer. Grant the functions\' runtime service account roles/storage.admin on THAT bucket only (it '
             + 'reads the bucket\'s retention settings and sets each day\'s retention, which the object roles '
             + 'do not cover), write AUDIT_ARCHIVE_BUCKET=<bucket> in .env.<projectId> '
-            + 'and run microteia provision. What it protects against, and what it does not: a locked bucket stops '
+            + 'and run microteia deploy --only functions (provision does not carry the platform\'s own settings). What it protects against, and what it does not: a locked bucket stops '
             + 'deletion and rewriting of what was already archived; the chain makes any change visible on '
             + 'verification. A project owner can still alter or delete an audit line in Firestore BEFORE its day '
             + 'is exported (the export runs hourly, about an hour after midnight UTC), turn the archive off (that '
@@ -147,7 +147,7 @@ export const MANUAL_PREREQUISITES = [
         detail: 'By default every new account gets an organization of its own, with that person as the owner. In an '
             + 'installation shared by several organizations — each one created on purpose — that lets anyone who '
             + 'can create an account open one. Write SELF_SERVICE_TENANTS=false in .env.<projectId> and run '
-            + 'microteia provision: from then on a new account waits to be added to an organization, and only the '
+            + 'microteia deploy --only functions: from then on a new account waits to be added to an organization, and only the '
             + 'installation administrator (SYSTEM) opens organizations, in Access management > Organizations, '
             + 'naming an owner who already has an account. The first account of the installation gets one '
             + 'anyway. Any value other than empty, true or false is read as false. Two-step verification is '

package/lib/shared/paths.d.ts

@@ -87,4 +87,4 @@ export declare const consoleRoot: string;
  * de código nunca chegou a quem instala. Este bloco fica sendo o que ele já era antes de crescer: a
  * política de semver da ferramenta, mais o registro do que motivou as versões até a `2.5.0`.
  */
-export declare const CLI_VERSION = "2.31.1";
+export declare const CLI_VERSION = "2.35.0";

package/lib/shared/paths.js

@@ -94,4 +94,4 @@ export const consoleRoot = resolve(here, '..', '..');
  * de código nunca chegou a quem instala. Este bloco fica sendo o que ele já era antes de crescer: a
  * política de semver da ferramenta, mais o registro do que motivou as versões até a `2.5.0`.
  */
-export const CLI_VERSION = '2.31.1';
+export const CLI_VERSION = '2.35.0';

package/lib/vendor/installationDocs.js

@@ -191,10 +191,15 @@ deliberately, because you asked.
 They live in \`.env.<projectId>\`, next to \`microteia.yaml\`. \`unpack\` creates the file and adds any
 setting a new version introduces, **never overwriting what you filled in**.
 
-After changing a value, run \`microteia provision\`. The value is stamped into each Cloud Function at
-*its* deploy, so a function already running keeps the previous one until it is deployed again; provision
-notices the change (by a salted digest in \`microteia.yaml\`) and requeues exactly the functions that
-carry that setting.
+The value is stamped into each Cloud Function at *its* deploy, so a function already running keeps the
+previous one until it is deployed again. Which command deploys it again depends on who declares the
+setting:
+
+- **A setting of an extension, or of your own \`functions/\`** — run \`microteia provision\`. It notices the
+  change (by a salted digest in \`microteia.yaml\`) and requeues exactly the functions that carry it.
+- **A setting of the platform itself** (\`SELF_SERVICE_TENANTS\`, \`AUDIT_ARCHIVE_BUCKET\`, …) — run
+  \`microteia deploy --only functions\`. \`provision\` does not track them; the deploy compares each
+  function's stamp, which includes its environment, and redeploys the ones whose value changed.
 
 An empty line means "not configured". A feature that needs it stays off rather than failing halfway.
 

package/lib/vendor/pack.js

@@ -3,7 +3,7 @@ import { basename, join, relative } from 'node:path';
 import { flagValue, hasFlag } from '../shared/args.js';
 import { repoRoot } from '../shared/paths.js';
 import { run } from '../shared/run.js';
-import { blank, bullets, heading, info, step, success } from '../shared/ui.js';
+import { blank, bullets, heading, info, step, success, warn } from '../shared/ui.js';
 import { DEFAULT_FUNCTIONS_REGION, KERNEL_COMPONENTS, KERNEL_DISTRIBUTION_ID, MANUAL_PREREQUISITES, MINIMUM_CLI_VERSION, REQUIRED_NODE_VERSION, callableFunctionNames, declaredParametersIn, exportedFunctionNames, parseKernelVersion, parsePreLoginPoints, } from '../kernel/manifest.js';
 import { digestOfFile } from '../shared/digest.js';
 import { kernelTarballName } from '../kernel/channel.js';
@@ -140,7 +140,8 @@ export const pack = async (args) => {
     }
     const baselineFunctions = baselineFunctionsOf(functionNames, claims);
     const baselineIndexes = baselineIndexesOf(rootIndexes.indexes, claims);
-    const outputDir = flagValue(args, 'output') ?? join(root, 'distributions', 'kernel', version);
+    const defaultOutputDir = join(root, 'distributions', 'kernel', version);
+    const outputDir = flagValue(args, 'output') ?? defaultOutputDir;
     const stageDir = join(outputDir, 'package');
     const tarball = join(outputDir, kernelTarballName(version));
     heading(`Packaging Microteia kernel ${version} (contract ${kernelVersion})`);
@@ -264,6 +265,13 @@ export const pack = async (args) => {
         `size: ${(digest.bytes / 1_000_000).toFixed(1)} MB, sha256 ${digest.sha256.slice(0, 12)}…`,
     ]);
     blank();
+    if (outputDir !== defaultOutputDir) {
+        // O `publish` lê só `distributions/kernel/<versão>/`: o pacote escrito em outro lugar não é achado,
+        // e sem este aviso a recusa dele parecia um pacote que nunca foi feito.
+        warn(`--output wrote it outside ${relative(root, defaultOutputDir)}/, and "microteia publish" reads only there.`);
+        info('  Copy the folder there to publish it, or install the file directly (below).');
+        blank();
+    }
     info('Publish it with:');
     bullets(['microteia publish --dry-run   (says what would go up)', 'microteia publish']);
     blank();

package/lib/vendor/packageTemplates.js

@@ -178,6 +178,8 @@ export const consoleReadme = (version) => `# Microteia Console ${version}
 Installs and updates Microteia in a Firebase project you own. It has no npm dependencies of its own —
 what it needs are command-line tools that are already on the machine, listed at the bottom.
 
+📖 **Documentation: [doc.microteia.com](https://doc.microteia.com)**
+
 ## Installing it
 
     npm i -g ${CONSOLE_PACKAGE_NAME}

package/lib/vendor/publish.js

@@ -6,7 +6,7 @@ import { CLI_VERSION, repoRoot } from '../shared/paths.js';
 import { capture, captureOrThrow, run } from '../shared/run.js';
 import { blank, bullets, heading, info, pending, step, success, warn } from '../shared/ui.js';
 import { digestMismatch, digestOfFile } from '../shared/digest.js';
-import { emptyIndex, entryOf, kernelTarballName, parseIndex, publishedBefore, serializeIndex, withEntry, } from '../kernel/channel.js';
+import { emptyIndex, entryOf, kernelTarballName, parseIndex, publishedBefore, serializeIndex, withEntry, STABLE_CHANNEL, } from '../kernel/channel.js';
 import { CONSOLE_CHANGELOG, KERNEL_CHANGELOG, changelogEntries, readChangelog } from './changelogs.js';
 import { CONSOLE_PACKAGE_NAME } from './packageTemplates.js';
 import { assertInsideRepository } from './repository.js';
@@ -72,16 +72,21 @@ const readPublishedIndex = async (repo) => {
     const text = Buffer.from(contents.content, 'base64').toString('utf8');
     return { index: parseIndex(text, `${repo}/${INDEX_PATH}`), sha: contents.sha, empty: false };
 };
+/** O caminho do README DENTRO do repositório de releases. */
+const README_PATH = 'README.md';
 /**
  * O que fica na raiz do repositório de releases, para quem chegar nele sem contexto.
  *
- * Ele é escrito UMA vez, ao semear — não é sobreposto depois. O que promete estar atual é o catálogo,
- * e é ele que a cada publicação é reescrito.
+ * É documento GERADO, e nenhuma pessoa escreve naquele repositório: por isso é sobreposto sempre que
+ * diverge deste texto. Escrito só ao semear, ele congelava no texto do primeiro `publish` — o link da
+ * documentação oficial nunca chegaria ao repositório que já existia.
  */
 const releasesReadme = () => `# Microteia — releases
 
 Distribution artifacts for the Microteia platform. **No source lives here**: what travels is compiled.
 
+📖 **Documentation: [doc.microteia.com](https://doc.microteia.com)**
+
 - \`kernel/index.json\` — the catalog the Microteia Console reads. It lists every published version with
   its size and sha256, and the absolute URLs of the files that carry it.
 - Each version is a release tagged \`kernel-<version>\`, carrying the package and its manifest.
@@ -94,6 +99,17 @@ Nobody downloads from here by hand:
 The Console reads the catalog, verifies what it downloads against the sha256 above, and only then puts
 it in place.
 `;
+const writeReadme = async (repo, sha, message) => {
+    const content = Buffer.from(releasesReadme(), 'utf8').toString('base64');
+    const args = [
+        'api', '--method', 'PUT', `repos/${repo}/contents/${README_PATH}`,
+        '-f', `message=${message}`,
+        '-f', `content=${content}`,
+    ];
+    if (sha !== null)
+        args.push('-f', `sha=${sha}`);
+    await captureOrThrow('gh', args);
+};
 /**
  * Dá ao repositório o primeiro commit, porque sem ele não existe release.
  *
@@ -104,14 +120,20 @@ it in place.
  */
 const seedRepository = async (repo) => {
     pending(`${repo} has no commits yet — writing its README first`);
-    const content = Buffer.from(releasesReadme(), 'utf8').toString('base64');
-    await captureOrThrow('gh', [
-        'api', '--method', 'PUT', `repos/${repo}/contents/README.md`,
-        '-f', 'message=the releases repository',
-        '-f', `content=${content}`,
-    ]);
+    await writeReadme(repo, null, 'the releases repository');
     success(`seeded ${repo}`);
 };
+const staleReadme = async (repo) => {
+    const result = await capture('gh', ['api', `repos/${repo}/contents/${README_PATH}`]);
+    if (result.code !== 0) {
+        if (`${result.stderr}${result.stdout}`.includes('HTTP 404'))
+            return { sha: null };
+        throw new Error(`Could not read ${README_PATH} from ${repo}.\n${result.stderr.trim() || result.stdout.trim()}`);
+    }
+    const contents = JSON.parse(result.stdout);
+    const text = Buffer.from(contents.content, 'base64').toString('utf8');
+    return text === releasesReadme() ? null : { sha: contents.sha };
+};
 const writePublishedIndex = async (repo, index, sha, version) => {
     const content = Buffer.from(serializeIndex(index), 'utf8').toString('base64');
     const args = [
@@ -178,6 +200,7 @@ const publishKernel = async (root, version, repo, dryRun) => {
     const directory = join(root, 'distributions', 'kernel', version);
     const manifestPath = join(directory, 'manifest.json');
     const published = await readPublishedIndex(repo);
+    const readme = published.empty ? null : await staleReadme(repo);
     /**
      * O corpo do release cobre o INTERVALO, e não só a versão que está saindo. Um pacote leva tudo o que
      * veio antes dele; um release que só cita a própria entrada esconde as versões que foram empacotadas e
@@ -190,13 +213,19 @@ const publishKernel = async (root, version, repo, dryRun) => {
         manifest: assetUrl(repo, version, 'manifest.json'),
     }, new Date().toISOString()));
     success(`kernel ${version} verified: ${manifest.tarball?.bytes} bytes, sha256 ${manifest.tarball?.sha256.slice(0, 12)}…`);
-    info(`  tag ${tagOf(version)} in ${repo}, and ${INDEX_PATH} promoting it to "latest"`);
+    const promotes = next.channels[STABLE_CHANNEL] === version;
+    info(promotes
+        ? `  tag ${tagOf(version)} in ${repo}, and ${INDEX_PATH} promoting it to "latest"`
+        : `  tag ${tagOf(version)} in ${repo}, and ${INDEX_PATH} listing it — "latest" stays at `
+            + `${next.channels[STABLE_CHANNEL]}, which is newer`);
     info(notes.versions.length === 1
         ? `  release notes: the ${version} entry of ${KERNEL_CHANGELOG}`
         : `  release notes: ${notes.versions.join(', ')} — every entry since ${since ?? 'the first one'}`);
     if (dryRun) {
         if (published.empty)
             info(`  ${repo} has no commits, so it would be seeded with a README first`);
+        if (readme !== null)
+            info(`  ${README_PATH} in ${repo} differs from the current text, so it would be rewritten`);
         info(`  the catalog would go from ${published.index.kernel.length} to ${next.kernel.length} version(s)`);
         return;
     }
@@ -231,7 +260,19 @@ const publishKernel = async (root, version, repo, dryRun) => {
         success(`assets published for ${version}`);
         // O catálogo por último, sempre. Ver a nota de ordem no topo deste módulo.
         await writePublishedIndex(repo, next, published.sha, version);
-        success(`${INDEX_PATH} updated — "microteia unpack --version latest" now takes ${version}`);
+        success(promotes
+            ? `${INDEX_PATH} updated — "microteia unpack --version latest" now takes ${version}`
+            : `${INDEX_PATH} updated — "microteia unpack --version ${version}" takes it; "latest" stays at `
+                + `${next.channels[STABLE_CHANNEL]}`);
+        /**
+         * Depois do catálogo, e sem derrubar a publicação: o README não é o que alguém instala, e uma
+         * falha nele não pode desfazer — nem fazer parecer desfeito — um release que já está no ar.
+         */
+        if (readme !== null) {
+            await writeReadme(repo, readme.sha, `README for kernel ${version}`)
+                .then(() => success(`${README_PATH} in ${repo} rewritten`))
+                .catch((error) => warn(`${README_PATH} in ${repo} could not be rewritten: ${error instanceof Error ? error.message : String(error)}`));
+        }
     }
     finally {
         await rm(notesRoot, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microteia/console",
-  "version": "2.31.1",
+  "version": "2.35.0",
   "description": "Install and update Microteia in a Firebase project you own.",
   "license": "UNLICENSED",
   "type": "module",