@ontrails/trails 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # trails
 
+## 0.2.2
+
+### Patch Changes
+
+- [`0ae6a5d`](https://github.com/outfitter-dev/trails/commit/0ae6a5de15fd36bff2997a163b2ce64772151514): Wait up to two minutes for npm metadata and dist-tags to converge during post-publish verification. Retain confirmed package proofs, bound in-flight npm probes by the same deadline, and fail immediately on registry access errors or newer tags without retrying publication.
+
+## 0.2.1
+
+### Patch Changes
+
+- [`d785a07`](https://github.com/outfitter-dev/trails/commit/d785a07b458899a7da14999e9b7856b8a7446e66): Align current installation examples with the 0.2.1 scaffold correction and keep Homebrew version checks explicit while preserving the 0.2.0 repair guidance.
+- [`d785a07`](https://github.com/outfitter-dev/trails/commit/d785a07b458899a7da14999e9b7856b8a7446e66): Keep automatic release eligibility when canonical version generation updates the root Bun lockfile and bundled skill framework metadata, while retaining the existing release provenance checks and rejecting other plugin files.
+- [`fdef61f`](https://github.com/outfitter-dev/trails/commit/fdef61feeef9b2250d537640db147cb9a9e484bd): Update package installation guidance to reflect the verified npm and Homebrew 0.2.0 release, with the published CLI scaffold repair linked from its README.
+- [`fdef61f`](https://github.com/outfitter-dev/trails/commit/fdef61feeef9b2250d537640db147cb9a9e484bd): Generate an explicit `@types/node` development dependency in fresh standalone and workspace apps so Node built-in imports resolve in cold installs.
+- [`ef3c802`](https://github.com/outfitter-dev/trails/commit/ef3c802f7e5b6ca92b32b11d76c26517ef388b13): Exclude unrelated `.worktrees` checkouts from lock round-trip copies while preserving tracked inputs and explicitly selected lock fixtures.
+
 ## 0.2.0
 
 ### Patch Changes

package/README.md

@@ -2,17 +2,19 @@
 
 Command-line tools for working with Trails projects.
 
-Use the canonical [Homebrew installation guide](../../docs/getting-started.md#installation) for installation, updates, and removal. Stable `0.2.0` installation requires the release assets and tap update; that handoff is pending. The formula requires Bun at runtime.
+Use the canonical [Homebrew installation guide](../../docs/getting-started.md#installation) for installation, updates, and removal. The CLI requires Bun at runtime; use `trails --version` to check the installed release.
 
 Use the CLI to scaffold a Trails app, add surfaces, inspect the current topo, run warden checks, manage draft state, and keep local Trails project state tidy.
 
-These commands target stable `0.2.0`. Run them after that version is published to npm.
+These installation examples target Trails `0.2.1` on the normal npm release line.
 
 ```bash
-bunx @ontrails/trails@0.2.0 create my-app --permit '{"id":"local-dev","scopes":["project:write"]}'
-bunx @ontrails/trails@0.2.0 create my-app --workspace --permit '{"id":"local-dev","scopes":["project:write"]}'
+bunx @ontrails/trails@0.2.1 create my-app --permit '{"id":"local-dev","scopes":["project:write"]}'
+bunx @ontrails/trails@0.2.1 create my-app --workspace --permit '{"id":"local-dev","scopes":["project:write"]}'
 ```
 
+Apps generated by the published `0.2.0` CLI need an explicit Node types dependency before typechecking. Follow the [0.2.0 scaffold repair](../../docs/getting-started.md#repair-apps-generated-by-020).
+
 Common workflows:
 
 - `trails create` starts a standalone app by default; `--workspace` creates a configured workspace with that app under `apps/<name>`. Generated surfaces live under `bin/`, app source stays side-effect-free, and `--dry-run` returns the complete write plan without touching disk. Workspace creation rejects targets nested beneath an existing configured workspace while allowing a child workspace beneath an ancestor standalone Config. On a rerun, a preserved app entry also rejects when its runtime-selected topo ID can be statically proven to conflict with `workspace.apps`; dynamic, indirect, and post-construction mutation forms remain preserved and are validated by runtime commands such as `trails compile`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ontrails/trails",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/outfitter-dev/trails.git",
@@ -33,25 +33,25 @@
   "dependencies": {
     "@clack/prompts": "^1.1.0",
     "@manypkg/get-packages": "1.1.3",
-    "@ontrails/adapter-kit": "^0.2.0",
-    "@ontrails/cli": "^0.2.0",
-    "@ontrails/commander": "^0.2.0",
-    "@ontrails/config": "^0.2.0",
-    "@ontrails/core": "^0.2.0",
-    "@ontrails/http": "^0.2.0",
-    "@ontrails/mcp": "^0.2.0",
-    "@ontrails/observability": "^0.2.0",
-    "@ontrails/permits": "^0.2.0",
-    "@ontrails/regrade": "^0.2.0",
-    "@ontrails/source": "^0.2.0",
-    "@ontrails/topography": "^0.2.0",
-    "@ontrails/warden": "^0.2.0",
+    "@ontrails/adapter-kit": "^0.2.2",
+    "@ontrails/cli": "^0.2.2",
+    "@ontrails/commander": "^0.2.2",
+    "@ontrails/config": "^0.2.2",
+    "@ontrails/core": "^0.2.2",
+    "@ontrails/http": "^0.2.2",
+    "@ontrails/mcp": "^0.2.2",
+    "@ontrails/observability": "^0.2.2",
+    "@ontrails/permits": "^0.2.2",
+    "@ontrails/regrade": "^0.2.2",
+    "@ontrails/source": "^0.2.2",
+    "@ontrails/topography": "^0.2.2",
+    "@ontrails/warden": "^0.2.2",
     "commander": "^14.0.3",
     "typescript": "5.9.3",
     "zod": "^4.3.5"
   },
   "devDependencies": {
-    "@ontrails/cloudflare": "^0.2.0",
-    "@ontrails/testing": "^0.2.0"
+    "@ontrails/cloudflare": "^0.2.2",
+    "@ontrails/testing": "^0.2.2"
   }
 }

package/src/release/index.ts

@@ -116,8 +116,6 @@ export {
   npmRegistryVersionView,
   npmRegistryView,
   registryPostureErrors,
-  runRegistryPreflight,
-  runRegistryPreflightCli,
   type PackageRegistryFacts,
   type PackageRegistryState,
   type RegistryCheckPhase,
@@ -127,6 +125,10 @@ export {
   type RegistryView,
   type RegistryWorkspace,
 } from './native-bun-registry.js';
+export {
+  runRegistryPreflight,
+  runRegistryPreflightCli,
+} from './native-bun-registry-preflight.js';
 export {
   collectReleaseNotesInput,
   dedupeReleaseChanges,

package/src/release/lock-roundtrip-workspace.ts

@@ -39,6 +39,7 @@ const isDisposablePath = (segments: readonly string[]): boolean =>
       part === '.tmp-tests' ||
       part === '.trails-tmp' ||
       part === '.turbo' ||
+      part === '.worktrees' ||
       (part === 'worktrees' && segments[index - 1] === '.claude') ||
       (part === 'notes' && segments[index - 1] === '.agents')
   );

package/src/release/native-bun-registry-preflight.ts

@@ -0,0 +1,333 @@
+/* oxlint-disable max-statements -- release preflight CLI with explicit reporting */
+import { join, resolve } from 'node:path';
+
+import {
+  checkRegistryPosture,
+  classifyPackageRegistryState,
+  createNpmRegistryVersionProofView,
+  createNpmRegistryView,
+  discoverRegistryWorkspaces,
+  factsFromRegistryResult,
+  formatDistTagSummary,
+  registryPostureErrors,
+  runNpmRegistryCommand,
+} from './native-bun-registry.js';
+import type {
+  RegistryPreflightOptions,
+  RegistryResult,
+  RegistryVersionProof,
+  RegistryVersionView,
+  RegistryView,
+  RegistryWorkspace,
+} from './native-bun-registry.js';
+
+const REPO_ROOT = resolve(process.cwd());
+
+interface RegistryVerificationRuntime {
+  readonly now: () => number;
+  readonly sleep: (ms: number) => Promise<void>;
+  readonly timeoutMs: number;
+}
+
+interface RegistryVerificationReport {
+  readonly attempts: number;
+  readonly elapsedMs: number;
+  readonly results: readonly RegistryResult[];
+  readonly state: 'complete' | 'failed' | 'timeout';
+}
+
+type RegistryProbe = (
+  workspaces: readonly RegistryWorkspace[],
+  signal?: AbortSignal
+) => Promise<RegistryResult[]>;
+
+const verificationRuntime: RegistryVerificationRuntime = {
+  now: () => performance.now(),
+  sleep: async (ms) => {
+    await Bun.sleep(ms);
+  },
+  timeoutMs: 120_000,
+};
+
+const USAGE = `Usage: bun scripts/check-registry-preflight.ts [options]
+
+Read-only npm registry preflight for public @ontrails/* workspaces.
+
+Options:
+  --tag <tag>            Expected npm dist-tag. Defaults to .changeset/pre.json
+                         tag while in prerelease mode, otherwise "latest".
+  --require-published    Fail when any workspace package is missing from npm.
+                         Use after publication to require exact metadata or
+                         equivalent consumer package-fetch proof. Wait up to
+                         two minutes for missing metadata or lagging tags.
+  -h, --help             Show this help and exit.
+
+Exit codes: 0 success, 1 registry posture failure, 2 arg-parse error.`;
+
+const parseArgs = (argv: readonly string[]): RegistryPreflightOptions => {
+  let requirePublished = false;
+  let tag: string | undefined;
+
+  const needsValue = (flag: string, value: string | undefined): string => {
+    if (value === undefined || value.startsWith('--')) {
+      console.error(`${flag} requires a value`);
+      console.error(USAGE);
+      process.exit(2);
+    }
+    return value;
+  };
+
+  let i = 0;
+  while (i < argv.length) {
+    const arg = argv[i] as string;
+    if (arg === '--require-published') {
+      requirePublished = true;
+    } else if (arg === '--tag') {
+      i += 1;
+      tag = needsValue('--tag', argv[i]);
+    } else if (arg === '-h' || arg === '--help') {
+      console.log(USAGE);
+      process.exit(0);
+    } else {
+      console.error(`Unknown argument: ${arg}`);
+      console.error(USAGE);
+      process.exit(2);
+    }
+    i += 1;
+  }
+
+  return { requirePublished, tag };
+};
+
+const resolveDefaultTag = async (): Promise<string> => {
+  const prePath = join(REPO_ROOT, '.changeset', 'pre.json');
+  if (!(await Bun.file(prePath).exists())) {
+    return 'latest';
+  }
+  const pre = (await Bun.file(prePath).json()) as {
+    mode?: string;
+    tag?: string;
+  };
+  if (pre.mode !== 'pre') {
+    return 'latest';
+  }
+  if (typeof pre.tag === 'string' && pre.tag.length > 0) {
+    return pre.tag;
+  }
+  throw new Error(`${prePath} is in prerelease mode but has no tag`);
+};
+
+const formatTargetVersionStatus = (
+  proof: RegistryVersionProof | undefined,
+  versionPublished: boolean | undefined
+): string => {
+  if (proof?.kind === 'exact-metadata') {
+    return 'exact-version metadata available';
+  }
+  if (proof?.kind === 'consumer-pack') {
+    return 'exact-version metadata unavailable, consumer pack available';
+  }
+  if (proof?.kind === 'unavailable') {
+    return 'exact-version metadata and consumer pack unavailable';
+  }
+  if (versionPublished === true) {
+    return 'target version published';
+  }
+  if (versionPublished === false) {
+    return 'target version not published yet';
+  }
+  return 'target version publish state unknown';
+};
+
+const printResults = (
+  results: readonly RegistryResult[],
+  expectedTag: string
+): void => {
+  console.log(`Registry preflight for dist-tag "${expectedTag}"`);
+  for (const result of results) {
+    if (result.status === 'published') {
+      const targetStatus = formatTargetVersionStatus(
+        result.versionProof,
+        result.versionPublished
+      );
+      console.log(
+        `✓ ${result.name}@${result.workspaceVersion}: package exists, ${targetStatus} (registry version ${result.version}, expected ${expectedTag}=${result.expectedTagVersion ?? 'missing'}, tags ${formatDistTagSummary(result.distTags)})`
+      );
+    } else if (result.status === 'missing') {
+      console.log(
+        `• ${result.name}@${result.workspaceVersion}: first-time package candidate (not found on registry)`
+      );
+    } else {
+      console.log(`✗ ${result.name}: registry probe failed: ${result.error}`);
+    }
+  }
+};
+
+/**
+ * Wait for npm observations to converge after publication, retaining complete
+ * package proofs. The shared registry classifier remains the verdict owner;
+ * only missing versions/packages and lagging tags earn another read-only probe.
+ * The internal runtime seam makes the deadline and backoff testable without
+ * exposing release tuning flags or sleeping through regression tests.
+ */
+export const verifyPublishedRegistry = async (
+  workspaces: readonly RegistryWorkspace[],
+  expectedTag: string,
+  probe: RegistryProbe,
+  runtime: RegistryVerificationRuntime = verificationRuntime
+): Promise<RegistryVerificationReport> => {
+  const start = runtime.now();
+  const deadline = start + runtime.timeoutMs;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), runtime.timeoutMs);
+  const results = new Map<string, RegistryResult>();
+  let pending = workspaces;
+  let attempts = 0;
+  let delayMs = 5000;
+  const report = (
+    state: RegistryVerificationReport['state']
+  ): RegistryVerificationReport => ({
+    attempts,
+    elapsedMs: runtime.now() - start,
+    results: [...results.values()],
+    state,
+  });
+
+  try {
+    while (pending.length > 0) {
+      if (controller.signal.aborted || runtime.now() >= deadline) {
+        controller.abort();
+        return report('timeout');
+      }
+      attempts += 1;
+      const observed = await probe(pending, controller.signal);
+      const timedOut = controller.signal.aborted || runtime.now() >= deadline;
+      for (const result of observed) {
+        // Aborting npm must not erase the last useful propagation evidence.
+        if (
+          timedOut &&
+          result.status === 'inaccessible' &&
+          results.has(result.name)
+        ) {
+          continue;
+        }
+        results.set(result.name, result);
+      }
+      const pendingNames = new Set(
+        observed
+          .filter(
+            (result) =>
+              classifyPackageRegistryState(
+                factsFromRegistryResult(result, expectedTag)
+              ).kind !== 'complete'
+          )
+          .map(({ name }) => name)
+      );
+      pending = pending.filter(({ name }) => pendingNames.has(name));
+      if (pending.length === 0) {
+        return report('complete');
+      }
+      if (timedOut) {
+        controller.abort();
+        return report('timeout');
+      }
+      if (
+        registryPostureErrors(observed, expectedTag, 'ready').length > 0 ||
+        observed.some(
+          (result) =>
+            result.status === 'published' &&
+            factsFromRegistryResult(result, expectedTag).versionPublished ===
+              undefined
+        )
+      ) {
+        return report('failed');
+      }
+      const waitMs = Math.min(delayMs, deadline - runtime.now());
+      console.log(
+        `Waiting for registry propagation: ${pending.length}/${workspaces.length} packages pending; retrying in ${waitMs / 1000}s (${pending.map(({ name }) => name).join(', ')}).`
+      );
+      await runtime.sleep(waitMs);
+      delayMs = Math.min(delayMs * 2, 30_000);
+    }
+    return report('complete');
+  } finally {
+    clearTimeout(timer);
+  }
+};
+
+const createRegistryProbe =
+  (
+    expectedTag: string,
+    view: RegistryView | undefined,
+    versionView: RegistryVersionView | undefined
+  ): RegistryProbe =>
+  async (workspaces, signal) => {
+    if (view !== undefined) {
+      return versionView === undefined
+        ? checkRegistryPosture(workspaces, view, expectedTag)
+        : checkRegistryPosture(workspaces, view, versionView, expectedTag);
+    }
+    const runNpm = (args: readonly string[]) =>
+      runNpmRegistryCommand(args, signal);
+    return checkRegistryPosture(
+      workspaces,
+      createNpmRegistryView(runNpm),
+      createNpmRegistryVersionProofView(runNpm),
+      expectedTag
+    );
+  };
+
+/** Run the read-only readiness check or bounded post-publish verification. */
+export const runRegistryPreflight = async (
+  options: RegistryPreflightOptions,
+  view?: RegistryView,
+  versionView?: RegistryVersionView
+): Promise<number> => {
+  const expectedTag = options.tag ?? (await resolveDefaultTag());
+  const workspaces = await discoverRegistryWorkspaces();
+  const probe = createRegistryProbe(expectedTag, view, versionView);
+  const verification = options.requirePublished
+    ? await verifyPublishedRegistry(workspaces, expectedTag, probe)
+    : undefined;
+  const results = verification?.results ?? (await probe(workspaces));
+  printResults(results, expectedTag);
+  const errors = registryPostureErrors(
+    results,
+    expectedTag,
+    options.requirePublished ? 'published' : 'ready'
+  );
+  if (verification?.state === 'timeout') {
+    console.error(
+      `\nPost-publish registry verification timed out after ${Math.round(verification.elapsedMs / 1000)}s (${verification.attempts} probes). No publication was retried. Inspect the remaining registry observations before recovery.`
+    );
+  } else if (errors.length > 0) {
+    console.error(
+      options.requirePublished
+        ? '\nPost-publish registry verification failed; no publication was retried:'
+        : '\nRegistry preflight failed:'
+    );
+  }
+  if (errors.length > 0 || verification?.state === 'timeout') {
+    for (const error of errors) {
+      console.error(`- ${error}`);
+    }
+    return 1;
+  }
+  console.log('\nRegistry preflight passed.');
+  return 0;
+};
+
+export const runRegistryPreflightCli = async (
+  args: readonly string[] = process.argv.slice(2)
+): Promise<number> => {
+  try {
+    return await runRegistryPreflight(parseArgs(args));
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+};
+
+if (import.meta.main) {
+  process.exit(await runRegistryPreflightCli(process.argv.slice(2)));
+}

package/src/release/native-bun-registry.ts

@@ -1,4 +1,3 @@
-/* oxlint-disable max-statements -- release preflight CLI with explicit reporting */
 import { readdir } from 'node:fs/promises';
 import { join, relative, resolve } from 'node:path';
 
@@ -179,55 +178,6 @@ export const factsFromRegistryResult = (
   };
 };
 
-const USAGE = `Usage: bun scripts/check-registry-preflight.ts [options]
-
-Read-only npm registry preflight for public @ontrails/* workspaces.
-
-Options:
-  --tag <tag>            Expected npm dist-tag. Defaults to .changeset/pre.json
-                         tag while in prerelease mode, otherwise "latest".
-  --require-published    Fail when any workspace package is missing from npm.
-                         Use after publication to require exact metadata or
-                         equivalent consumer package-fetch proof.
-  -h, --help             Show this help and exit.
-
-Exit codes: 0 success, 1 registry posture failure, 2 arg-parse error.`;
-
-const parseArgs = (argv: readonly string[]): RegistryPreflightOptions => {
-  let requirePublished = false;
-  let tag: string | undefined;
-
-  const needsValue = (flag: string, value: string | undefined): string => {
-    if (value === undefined || value.startsWith('--')) {
-      console.error(`${flag} requires a value`);
-      console.error(USAGE);
-      process.exit(2);
-    }
-    return value;
-  };
-
-  let i = 0;
-  while (i < argv.length) {
-    const arg = argv[i] as string;
-    if (arg === '--require-published') {
-      requirePublished = true;
-    } else if (arg === '--tag') {
-      i += 1;
-      tag = needsValue('--tag', argv[i]);
-    } else if (arg === '-h' || arg === '--help') {
-      console.log(USAGE);
-      process.exit(0);
-    } else {
-      console.error(`Unknown argument: ${arg}`);
-      console.error(USAGE);
-      process.exit(2);
-    }
-    i += 1;
-  }
-
-  return { requirePublished, tag };
-};
-
 const readJson = async <T>(path: string): Promise<T> => {
   const file = Bun.file(path);
   if (!(await file.exists())) {
@@ -244,21 +194,6 @@ const errorCode = (error: unknown): string | undefined => {
   return typeof code === 'string' ? code : undefined;
 };
 
-const resolveDefaultTag = async (): Promise<string> => {
-  const prePath = join(REPO_ROOT, '.changeset', 'pre.json');
-  if (!(await Bun.file(prePath).exists())) {
-    return 'latest';
-  }
-  const pre = await readJson<{ mode?: string; tag?: string }>(prePath);
-  if (pre.mode !== 'pre') {
-    return 'latest';
-  }
-  if (typeof pre.tag === 'string' && pre.tag.length > 0) {
-    return pre.tag;
-  }
-  throw new Error(`${prePath} is in prerelease mode but has no tag`);
-};
-
 const discoverWorkspaceDirs = async (
   repoRoot: string,
   patterns: readonly string[]
@@ -348,14 +283,21 @@ const readSpawnResult = async (
   return { exitCode, stderr, stdout };
 };
 
-const runNpmCommand: NpmCommandRunner = async (args) =>
-  readSpawnResult(
+/** Run a read-only npm registry command, aborting its subprocess at the verification deadline. */
+export const runNpmRegistryCommand = async (
+  args: readonly string[],
+  signal?: AbortSignal
+): Promise<NpmCommandResult> => {
+  signal?.throwIfAborted();
+  return readSpawnResult(
     Bun.spawn(['npm', ...args], {
       stderr: 'pipe',
       stdin: 'ignore',
       stdout: 'pipe',
+      ...(signal === undefined ? {} : { killSignal: 'SIGKILL', signal }),
     })
   );
+};
 
 const isNpmNotFoundOutput = (stdout: string, stderr: string): boolean => {
   const combined = `${stdout}\n${stderr}`;
@@ -453,7 +395,7 @@ const npmDistTagRegistryView = async (
 };
 
 export const createNpmRegistryView =
-  (runNpm: NpmCommandRunner = runNpmCommand): RegistryView =>
+  (runNpm: NpmCommandRunner = runNpmRegistryCommand): RegistryView =>
   async (name) => {
     const { exitCode, stderr, stdout } = await runNpm([
       'view',
@@ -498,7 +440,9 @@ const unknownRegistryVersionView: RegistryVersionView = async () =>
   UNKNOWN_REGISTRY_VERSION_STATE.published;
 
 export const createNpmRegistryVersionProofView =
-  (runNpm: NpmCommandRunner = runNpmCommand): RegistryVersionProofView =>
+  (
+    runNpm: NpmCommandRunner = runNpmRegistryCommand
+  ): RegistryVersionProofView =>
   async (name, version) => {
     const { exitCode, stderr, stdout } = await runNpm([
       'view',
@@ -548,7 +492,7 @@ export const createNpmRegistryVersionProofView =
   };
 
 export const createNpmRegistryVersionView = (
-  runNpm: NpmCommandRunner = runNpmCommand
+  runNpm: NpmCommandRunner = runNpmRegistryCommand
 ): RegistryVersionView => {
   const proofView = createNpmRegistryVersionProofView(runNpm);
   return async (name, version) => {
@@ -738,111 +682,3 @@ export const formatDistTagSummary = (
   SUMMARY_DIST_TAGS.map((tag) => `${tag}=${distTags[tag] ?? 'missing'}`).join(
     ', '
   );
-
-const formatTargetVersionStatus = (
-  proof: RegistryVersionProof | undefined,
-  versionPublished: boolean | undefined
-): string => {
-  if (proof?.kind === 'exact-metadata') {
-    return 'exact-version metadata available';
-  }
-  if (proof?.kind === 'consumer-pack') {
-    return 'exact-version metadata unavailable, consumer pack available';
-  }
-  if (proof?.kind === 'unavailable') {
-    return 'exact-version metadata and consumer pack unavailable';
-  }
-  if (versionPublished === true) {
-    return 'target version published';
-  }
-  if (versionPublished === false) {
-    return 'target version not published yet';
-  }
-  return 'target version publish state unknown';
-};
-
-const printResults = (
-  results: readonly RegistryResult[],
-  expectedTag: string
-): void => {
-  console.log(`Registry preflight for dist-tag "${expectedTag}"`);
-  for (const result of results) {
-    if (result.status === 'published') {
-      const targetStatus = formatTargetVersionStatus(
-        result.versionProof,
-        result.versionPublished
-      );
-      console.log(
-        `✓ ${result.name}@${result.workspaceVersion}: package exists, ${targetStatus} (registry version ${result.version}, expected ${expectedTag}=${result.expectedTagVersion ?? 'missing'}, tags ${formatDistTagSummary(result.distTags)})`
-      );
-    } else if (result.status === 'missing') {
-      console.log(
-        `• ${result.name}@${result.workspaceVersion}: first-time package candidate (not found on registry)`
-      );
-    } else {
-      console.log(`✗ ${result.name}: registry probe failed: ${result.error}`);
-    }
-  }
-};
-
-const normalizeRegistryPreflightViews = (
-  view: RegistryView | undefined,
-  versionView: RegistryVersionView | undefined
-): {
-  readonly versionView: RegistryVersionProbeView;
-  readonly view: RegistryView;
-} => {
-  if (view === undefined) {
-    return {
-      versionView: npmRegistryVersionProofView,
-      view: npmRegistryView,
-    };
-  }
-  return { versionView: versionView ?? unknownRegistryVersionView, view };
-};
-
-export const runRegistryPreflight = async (
-  options: RegistryPreflightOptions,
-  view?: RegistryView,
-  versionView?: RegistryVersionView
-): Promise<number> => {
-  const registryViews = normalizeRegistryPreflightViews(view, versionView);
-  const expectedTag = options.tag ?? (await resolveDefaultTag());
-  const workspaces = await discoverRegistryWorkspaces();
-  const results = await checkRegistryPosture(
-    workspaces,
-    registryViews.view,
-    registryViews.versionView,
-    expectedTag
-  );
-  printResults(results, expectedTag);
-  const errors = registryPostureErrors(
-    results,
-    expectedTag,
-    options.requirePublished ? 'published' : 'ready'
-  );
-  if (errors.length > 0) {
-    console.error('\nRegistry preflight failed:');
-    for (const error of errors) {
-      console.error(`- ${error}`);
-    }
-    return 1;
-  }
-  console.log('\nRegistry preflight passed.');
-  return 0;
-};
-
-export const runRegistryPreflightCli = async (
-  args: readonly string[] = process.argv.slice(2)
-): Promise<number> => {
-  try {
-    return await runRegistryPreflight(parseArgs(args));
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    return 1;
-  }
-};
-
-if (import.meta.main) {
-  process.exit(await runRegistryPreflightCli(process.argv.slice(2)));
-}

package/src/release/policy.ts

@@ -728,6 +728,14 @@ const evaluateGeneratedReleaseDiff = (
   let hasPackageVersionFile = false;
 
   for (const file of changedFiles) {
+    if (
+      (file.path === 'bun.lock' ||
+        file.path === 'plugin/skills/trails/SKILL.md') &&
+      file.status === 'M'
+    ) {
+      continue;
+    }
+
     if (file.path === '.changeset/pre.json' && file.status === 'M') {
       continue;
     }

package/src/scaffold-version-sync.ts

@@ -95,6 +95,12 @@ const loadScaffoldVersions = async (
       'devDependencies',
       rootPackageJsonPath
     ),
+    nodeTypes: requireValue(
+      devDeps['@types/node'],
+      '@types/node',
+      'devDependencies',
+      rootPackageJsonPath
+    ),
     oxfmt: requireValue(
       devDeps['oxfmt'],
       'oxfmt',

package/src/scaffold-versions.generated.ts

@@ -4,6 +4,7 @@ export const scaffoldDependencyVersions = {
   bunTypes: '^1.3.11',
   commander: '^14.0.3',
   lefthook: '^2.1.1',
+  nodeTypes: '^25.5.0',
   oxfmt: '0.47.0',
   oxlint: '1.62.0',
   typescript: '^5.9.3',

package/src/trails/create-scaffold.ts

@@ -92,6 +92,7 @@ const generateAppPackageJson = (name: string): string => {
       Object.entries({
         '@ontrails/trails': ontrailsPackageRange,
         '@types/bun': scaffoldDependencyVersions.bunTypes,
+        '@types/node': scaffoldDependencyVersions.nodeTypes,
         oxfmt: scaffoldDependencyVersions.oxfmt,
         oxlint: scaffoldDependencyVersions.oxlint,
         typescript: scaffoldDependencyVersions.typescript,