@open-mercato/cezar 0.9.1-pr699.831 → 0.9.1-pr705.839

package/README.md

@@ -497,7 +497,7 @@ Parallel variants (×2/×3) of one task share that task's backend — mixing
 happens per task and per step, not inside a variant group.
 
 The seam is deliberately small: a backend is one class implementing the
-`AgentRunner` interface (`src/core/agent-runner.ts`) that turns a prompt into
+`AgentRunner` interface (`packages/cezar/src/core/agent-runner.ts`) that turns a prompt into
 a stream of normalized events. Other CLIs — pi, aider, whatever ships next —
 can slot in the same way.
 
@@ -613,8 +613,8 @@ cd cezar
 npm install
 ```
 
-**3. Build** — compiles the server (`tsc → dist/`) and the cockpit
-(`vite build → web/dist/`), then runs the pack gate:
+**3. Build** — compiles the api-client and the server (`tsc → packages/cezar/dist/`) and the cockpit
+(`vite build → packages/cezar/web/dist/`), then runs the pack gate:
 
 ```bash
 npm run build
@@ -666,9 +666,9 @@ npm run uninstall-as-command    # removes cezar / cez / cezar-cli (either flavor
 
 ```bash
 npm run dev          # server (API :4321) + Vite dev server, opens the cockpit in the browser
-npm run dev:server   # tsx src/index.ts — the API server alone
+npm run dev:server   # tsx packages/cezar/src/index.ts — the API server alone
 npm run dev:web      # Vite dev server alone (proxies /api to :4321)
-npm run build        # tsc → dist/, vite build → web/dist/, then the pack gate
+npm run build        # tsc → packages/cezar/dist/, vite build → packages/cezar/web/dist/, then the pack gate
 npm run typecheck    # server + web (tsc --noEmit)
 npm test             # vitest — server + cockpit unit suites
 npm run test:unit    # node:test — fast core-module tests
@@ -678,7 +678,7 @@ npm run test:e2e     # real-browser cockpit suite (agent-browser)
 
 The stack is deliberately small: **TypeScript** (strict, ESM), **Hono** + SSE for
 the server, **Zod** at every boundary, **YAML** for workflows, and a **React 19 +
-Vite + Tailwind v4 + shadcn/ui** cockpit shipped pre-built in `web/dist/` — the
+Vite + Tailwind v4 + shadcn/ui** cockpit shipped pre-built in `packages/cezar/web/dist/` — the
 published package carries the built app, so `npx` users never run a bundler.
 Every module is meant to be read in one sitting.
 

package/dist/release/manifests.d.ts

@@ -0,0 +1,72 @@
+/** The manifest arithmetic both release channels share — the pure half of stamping.
+ *
+ *  `stable.ts` and `snapshot.ts` differ in exactly one decision (how a released package pins
+ *  its sibling: a caret range for stable, an exact pin for a snapshot), so everything else
+ *  lives here rather than twice.
+ *
+ *  Deliberately name-agnostic: names come from the checked-out manifests at call time, never
+ *  from constants, so a package rename lands without touching this pipeline.
+ */
+/** The minimal manifest shape the stamper touches; everything else passes through. */
+export interface ManifestLike {
+    name: string;
+    version: string;
+    /** npm's own opt-out. A private package is still versioned in lockstep, never published. */
+    private?: boolean;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    [key: string]: unknown;
+}
+/**
+ * Whether a release stamps AND publishes this package, or only stamps it.
+ *
+ * The distinction exists because "in the release" and "on the registry" are different things.
+ * A package that ships nowhere yet still needs its version moved in lockstep: the api-client is
+ * the worked example — the service pins it, so a frozen version would leave that range pointing
+ * at a build the release was not cut from, which is exactly the drift this pipeline exists to
+ * prevent. Publishing is gated on npm's own `private` flag rather than a list here, so opening
+ * a package up is one line in ITS manifest and no change to the release code.
+ */
+export declare function isPublishable(pkg: ManifestLike): boolean;
+/**
+ * Every manifest a release stamps.
+ *
+ * The order of the fields is the order they must be PUBLISHED in, because each one depends on
+ * the one before it: the alias is a bin-shim over the service, and the service (from the phase
+ * where it stops merely testing against the client and starts importing it) depends on the
+ * api-client. Publishing the dependent first would briefly advertise a version of its
+ * dependency that does not exist on the registry yet.
+ */
+export interface ReleaseManifests {
+    /** The contract package a consumer installs to talk to a cezar service. */
+    apiClient: ManifestLike;
+    /** The published service + CLI. */
+    cezar: ManifestLike;
+    /** The unscoped bin alias, so `npx cezar-cli` works. */
+    alias: ManifestLike;
+}
+/** How a released package pins a sibling it depends on. */
+export type PinStyle = (version: string) => string;
+/**
+ * Rewrite `pkg`'s range for `depName`, in whichever dependency section already declares it.
+ *
+ * Absent means absent: a package that does not depend on the other is returned untouched. That
+ * is what lets the api-client dependency migrate from `devDependencies` (today: only the tests
+ * import it) to `dependencies` (once the service imports its DTOs at runtime) without the
+ * release pipeline needing to know it happened.
+ */
+export declare function pinDependency(pkg: ManifestLike, depName: string, range: string): ManifestLike;
+/**
+ * Stamp every manifest to `version` and re-pin the intra-release dependencies.
+ *
+ * Two pins, both derived from the manifests rather than hardcoded:
+ *   - the alias → the service, so `npx <alias>@<v>` runs the matching CLI;
+ *   - the service → the api-client, so a published service can never resolve a client build it
+ *     was not released with.
+ *
+ * The alias also inherits `repository`/`homepage`/`bugs` from the service manifest: we publish
+ * with `--provenance`, and npm rejects (E422) any manifest whose `repository.url` does not
+ * match the building repo. The alias file carries none of its own, so it borrows the
+ * service's — already correct, and being a git URL, unaffected by any npm-name rename.
+ */
+export declare function stampManifestSet(manifests: ReleaseManifests, version: string, pin: PinStyle): ReleaseManifests;

package/dist/release/manifests.js

@@ -0,0 +1,73 @@
+/** The manifest arithmetic both release channels share — the pure half of stamping.
+ *
+ *  `stable.ts` and `snapshot.ts` differ in exactly one decision (how a released package pins
+ *  its sibling: a caret range for stable, an exact pin for a snapshot), so everything else
+ *  lives here rather than twice.
+ *
+ *  Deliberately name-agnostic: names come from the checked-out manifests at call time, never
+ *  from constants, so a package rename lands without touching this pipeline.
+ */
+/**
+ * Whether a release stamps AND publishes this package, or only stamps it.
+ *
+ * The distinction exists because "in the release" and "on the registry" are different things.
+ * A package that ships nowhere yet still needs its version moved in lockstep: the api-client is
+ * the worked example — the service pins it, so a frozen version would leave that range pointing
+ * at a build the release was not cut from, which is exactly the drift this pipeline exists to
+ * prevent. Publishing is gated on npm's own `private` flag rather than a list here, so opening
+ * a package up is one line in ITS manifest and no change to the release code.
+ */
+export function isPublishable(pkg) {
+    return pkg.private !== true;
+}
+/**
+ * Rewrite `pkg`'s range for `depName`, in whichever dependency section already declares it.
+ *
+ * Absent means absent: a package that does not depend on the other is returned untouched. That
+ * is what lets the api-client dependency migrate from `devDependencies` (today: only the tests
+ * import it) to `dependencies` (once the service imports its DTOs at runtime) without the
+ * release pipeline needing to know it happened.
+ */
+export function pinDependency(pkg, depName, range) {
+    const sections = ['dependencies', 'devDependencies', 'peerDependencies'];
+    const out = { ...pkg };
+    for (const section of sections) {
+        const deps = pkg[section];
+        if (deps && depName in deps)
+            out[section] = { ...deps, [depName]: range };
+    }
+    return out;
+}
+/**
+ * Stamp every manifest to `version` and re-pin the intra-release dependencies.
+ *
+ * Two pins, both derived from the manifests rather than hardcoded:
+ *   - the alias → the service, so `npx <alias>@<v>` runs the matching CLI;
+ *   - the service → the api-client, so a published service can never resolve a client build it
+ *     was not released with.
+ *
+ * The alias also inherits `repository`/`homepage`/`bugs` from the service manifest: we publish
+ * with `--provenance`, and npm rejects (E422) any manifest whose `repository.url` does not
+ * match the building repo. The alias file carries none of its own, so it borrows the
+ * service's — already correct, and being a git URL, unaffected by any npm-name rename.
+ */
+export function stampManifestSet(manifests, version, pin) {
+    const { apiClient, cezar, alias } = manifests;
+    const range = pin(version);
+    const inherited = {};
+    for (const field of ['repository', 'homepage', 'bugs']) {
+        if (cezar[field] !== undefined)
+            inherited[field] = cezar[field];
+    }
+    return {
+        apiClient: { ...apiClient, version },
+        cezar: pinDependency({ ...cezar, version }, apiClient.name, range),
+        alias: {
+            ...pinDependency({ ...alias, ...inherited, version }, cezar.name, range),
+            // The alias exists only to depend on the service — an unpinned or missing entry would
+            // make `npx <alias>` install nothing useful, so this one is asserted, not merged.
+            dependencies: { ...alias.dependencies, [cezar.name]: range },
+        },
+    };
+}
+//# sourceMappingURL=manifests.js.map

package/dist/release/manifests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifests.js","sourceRoot":"","sources":["../../src/release/manifests.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,GAAiB;IAC7C,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;AAC9B,CAAC;AAuBD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAiB,EAAE,OAAe,EAAE,KAAa;IAC7E,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,CAAU,CAAC;IAClF,MAAM,GAAG,GAAiB,EAAE,GAAG,GAAG,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAuC,CAAC;QAChE,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA2B,EAC3B,OAAe,EACf,GAAa;IAEb,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAE3B,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAU,EAAE,CAAC;QAChE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE;QACpC,KAAK,EAAE,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;QAClE,KAAK,EAAE;YACL,GAAG,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;YACxE,sFAAsF;YACtF,kFAAkF;YAClF,YAAY,EAAE,EAAE,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE;SAC7D;KACF,CAAC;AACJ,CAAC"}

package/dist/release/snapshot.d.ts

@@ -11,6 +11,7 @@
  *  at call time, never from constants — so the `@pat-lewczuk/cezar` →
  *  `@open-mercato/cezar` rename (PR #501) lands independently of this pipeline.
  */
+import { type ReleaseManifests as ReleaseManifestSet } from './manifests.js';
 /** The CI facts the decision needs, straight from GitHub Actions' env/event. */
 export interface SnapshotContext {
     /** `GITHUB_EVENT_NAME` — only `pull_request` and `push` ever publish. */
@@ -40,30 +41,15 @@ export interface SnapshotPlan {
     distTag: string;
 }
 export declare function computeSnapshot(ctx: SnapshotContext): SnapshotPlan | null;
-/** The minimal manifest shape the stamper touches; everything else passes through. */
-export interface ManifestLike {
-    name: string;
-    version: string;
-    dependencies?: Record<string, string>;
-    [key: string]: unknown;
-}
-/** Stamp both manifests to the snapshot version.
- *
- *  The alias is a bin-shim whose only dependency is the scoped package; a
- *  snapshot must pin that dependency **exact** (`0.1.5-pr482.123`, no range) so
- *  `npx <alias>@<version>` runs exactly the PR's code — a `^` range would
- *  resolve to whatever newer version exists (spec, resolved Q5). Stable
- *  releases keep their `^` range and never go through this stamper.
+export type { ManifestLike, ReleaseManifests } from './manifests.js';
+/** Stamp the release set to the snapshot version.
  *
- *  The alias also inherits `repository`/`homepage`/`bugs` from the root manifest:
- *  we publish with `--provenance`, and npm rejects (E422) any manifest whose
- *  `repository.url` doesn't match the building repo. The alias file carries no
- *  such fields of its own, so it must borrow the root's — which already matches
- *  and, being a git URL, is unaffected by any npm-name rename. */
-export declare function stampManifests(rootPkg: ManifestLike, aliasPkg: ManifestLike, version: string): {
-    root: ManifestLike;
-    alias: ManifestLike;
-};
+ *  Every intra-release dependency is pinned **exact** (`0.1.5-pr482.123`, no range) so
+ *  `npx <alias>@<version>` runs exactly the PR's code and the service resolves exactly the
+ *  api-client it was cut with — a `^` range would resolve to whatever newer version exists
+ *  (spec, resolved Q5). Stable releases keep their `^` range and never go through this
+ *  stamper. */
+export declare function stampManifests(manifests: ReleaseManifestSet, version: string): ReleaseManifestSet;
 /** The copy-pasteable commands for the sticky PR comment and the step summary.
  *  Rendered from the *actual* alias package name so a future rename of the npx
  *  command can never leave stale instructions (spec, resolved Q1). */

package/dist/release/snapshot.js

@@ -11,6 +11,7 @@
  *  at call time, never from constants — so the `@pat-lewczuk/cezar` →
  *  `@open-mercato/cezar` rename (PR #501) lands independently of this pipeline.
  */
+import { stampManifestSet } from './manifests.js';
 export function computeSnapshot(ctx) {
     const channel = resolveChannel(ctx);
     if (!channel)
@@ -48,29 +49,15 @@ function resolveChannel(ctx) {
     }
     return null;
 }
-/** Stamp both manifests to the snapshot version.
+/** Stamp the release set to the snapshot version.
  *
- *  The alias is a bin-shim whose only dependency is the scoped package; a
- *  snapshot must pin that dependency **exact** (`0.1.5-pr482.123`, no range) so
- *  `npx <alias>@<version>` runs exactly the PR's code — a `^` range would
- *  resolve to whatever newer version exists (spec, resolved Q5). Stable
- *  releases keep their `^` range and never go through this stamper.
- *
- *  The alias also inherits `repository`/`homepage`/`bugs` from the root manifest:
- *  we publish with `--provenance`, and npm rejects (E422) any manifest whose
- *  `repository.url` doesn't match the building repo. The alias file carries no
- *  such fields of its own, so it must borrow the root's — which already matches
- *  and, being a git URL, is unaffected by any npm-name rename. */
-export function stampManifests(rootPkg, aliasPkg, version) {
-    const inherited = {};
-    for (const field of ['repository', 'homepage', 'bugs']) {
-        if (rootPkg[field] !== undefined)
-            inherited[field] = rootPkg[field];
-    }
-    return {
-        root: { ...rootPkg, version },
-        alias: { ...aliasPkg, ...inherited, version, dependencies: { [rootPkg.name]: version } },
-    };
+ *  Every intra-release dependency is pinned **exact** (`0.1.5-pr482.123`, no range) so
+ *  `npx <alias>@<version>` runs exactly the PR's code and the service resolves exactly the
+ *  api-client it was cut with — a `^` range would resolve to whatever newer version exists
+ *  (spec, resolved Q5). Stable releases keep their `^` range and never go through this
+ *  stamper. */
+export function stampManifests(manifests, version) {
+    return stampManifestSet(manifests, version, (v) => v);
 }
 /** The copy-pasteable commands for the sticky PR comment and the step summary.
  *  Rendered from the *actual* alias package name so a future rename of the npx

package/dist/release/snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../src/release/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgCH,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC;QACpG,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE;QACtB,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,GAAG,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS,GAAG,OAAO,EAAE;QAC3E,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,IAAI,GAAG,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;;;;;;;;;;kEAYkE;AAClE,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,QAAsB,EACtB,OAAe;IAEf,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAU,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,SAAS,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE;QAC7B,KAAK,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE;KACzF,CAAC;AACJ,CAAC;AAED;;sEAEsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAe;IAClE,MAAM,GAAG,GAAG,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC;IAC1C,OAAO;QACL,GAAG,GAAG,oEAAoE;QAC1E,GAAG,GAAG,gDAAgD;QACtD,GAAG,GAAG,qEAAqE;KAC5E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../src/release/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAgC/F,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC;QACpG,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE;QACtB,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,GAAG,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS,GAAG,OAAO,EAAE;QAC3E,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,IAAI,GAAG,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAID;;;;;;eAMe;AACf,MAAM,UAAU,cAAc,CAC5B,SAA6B,EAC7B,OAAe;IAEf,OAAO,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;sEAEsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAe;IAClE,MAAM,GAAG,GAAG,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC;IAC1C,OAAO;QACL,GAAG,GAAG,oEAAoE;QAC1E,GAAG,GAAG,gDAAgD;QACtD,GAAG,GAAG,qEAAqE;KAC5E,CAAC;AACJ,CAAC"}

package/dist/release/stable.d.ts

@@ -6,15 +6,14 @@
  *  thing that ever moves the `latest` dist-tag (spec
  *  `.ai/specs/2026-07-18-npm-preview-publish.md`, #482).
  *
- *  Two decisions live here so they stay unit-testable, side-effect-free, and
- *  name-agnostic (names come from the checked-out manifests, never constants):
- *  the next stable version for a given bump, and how both manifests are stamped.
- *  Crucially, the alias keeps a **caret** range on its scoped dependency — the
- *  opposite of the snapshot stamper's exact pin — so a stable `cezar-cli` picks
- *  up compatible patch releases of the implementation package.
+ *  Two decisions live here so they stay unit-testable and side-effect-free: the next stable
+ *  version for a given bump, and the pin style the release set is stamped with. Crucially,
+ *  stable releases use a **caret** range — the opposite of the snapshot stamper's exact pin —
+ *  so a stable `cezar-cli` picks up compatible patch releases of the implementation package.
  */
+import { type ReleaseManifests as ReleaseManifestSet } from './manifests.js';
 /** The version-bump modes the Release workflow offers. `existing` publishes the
- *  version already committed to the root manifest (for hand-prepared releases);
+ *  version already committed to the service manifest (for hand-prepared releases);
  *  the rest increment semver from the current base. */
 export type ReleaseBump = 'patch' | 'minor' | 'major' | 'existing';
 export declare const RELEASE_BUMPS: readonly ReleaseBump[];
@@ -27,26 +26,13 @@ export declare function isReleaseBump(value: string): value is ReleaseBump;
  *  `npm version` does. Returns `null` for an unparseable base so the caller can
  *  fail loudly instead of publishing a garbage version. */
 export declare function computeStableVersion(bump: ReleaseBump, base: string): string | null;
-/** The minimal manifest shape the stamper touches; everything else passes through. */
-export interface ManifestLike {
-    name: string;
-    version: string;
-    dependencies?: Record<string, string>;
-    [key: string]: unknown;
-}
-/** Stamp both manifests to a stable version.
+export type { ManifestLike, ReleaseManifests } from './manifests.js';
+/** Stamp the release set to a stable version.
  *
- *  Mirror of `stampManifests` in `snapshot.ts`, but the alias's dependency on
- *  the scoped package is a **caret** range (`^0.1.6`), not an exact pin — a
- *  stable `cezar-cli` should follow compatible releases of the implementation
- *  package, whereas a snapshot must pin the one exact build it was cut from.
- *
- *  Like the snapshot stamper, the alias inherits `repository`/`homepage`/`bugs`
- *  from the root manifest: `--provenance` publishes are rejected (E422) unless
- *  the manifest's `repository.url` matches the building repo, and the alias file
- *  carries none of its own. The git URL already matches and survives any
- *  npm-name rename. */
-export declare function stampStableManifests(rootPkg: ManifestLike, aliasPkg: ManifestLike, version: string): {
-    root: ManifestLike;
-    alias: ManifestLike;
-};
+ *  Mirror of `stampSnapshotManifests`, differing in exactly one decision: intra-release
+ *  dependencies get a **caret** range (`^0.1.6`), not an exact pin. A stable `cezar-cli` should
+ *  follow compatible releases of the implementation package, and a stable service should follow
+ *  compatible releases of the api-client; a snapshot must pin the one exact build it was cut
+ *  from. Everything else — which manifests exist, which sections carry the pin, what the alias
+ *  inherits — lives in `manifests.ts` so the two channels cannot drift apart. */
+export declare function stampStableManifests(manifests: ReleaseManifestSet, version: string): ReleaseManifestSet;

package/dist/release/stable.js

@@ -6,13 +6,12 @@
  *  thing that ever moves the `latest` dist-tag (spec
  *  `.ai/specs/2026-07-18-npm-preview-publish.md`, #482).
  *
- *  Two decisions live here so they stay unit-testable, side-effect-free, and
- *  name-agnostic (names come from the checked-out manifests, never constants):
- *  the next stable version for a given bump, and how both manifests are stamped.
- *  Crucially, the alias keeps a **caret** range on its scoped dependency — the
- *  opposite of the snapshot stamper's exact pin — so a stable `cezar-cli` picks
- *  up compatible patch releases of the implementation package.
+ *  Two decisions live here so they stay unit-testable and side-effect-free: the next stable
+ *  version for a given bump, and the pin style the release set is stamped with. Crucially,
+ *  stable releases use a **caret** range — the opposite of the snapshot stamper's exact pin —
+ *  so a stable `cezar-cli` picks up compatible patch releases of the implementation package.
  */
+import { stampManifestSet } from './manifests.js';
 export const RELEASE_BUMPS = ['patch', 'minor', 'major', 'existing'];
 export function isReleaseBump(value) {
     return RELEASE_BUMPS.includes(value);
@@ -42,27 +41,15 @@ export function computeStableVersion(bump, base) {
             return null;
     }
 }
-/** Stamp both manifests to a stable version.
+/** Stamp the release set to a stable version.
  *
- *  Mirror of `stampManifests` in `snapshot.ts`, but the alias's dependency on
- *  the scoped package is a **caret** range (`^0.1.6`), not an exact pin — a
- *  stable `cezar-cli` should follow compatible releases of the implementation
- *  package, whereas a snapshot must pin the one exact build it was cut from.
- *
- *  Like the snapshot stamper, the alias inherits `repository`/`homepage`/`bugs`
- *  from the root manifest: `--provenance` publishes are rejected (E422) unless
- *  the manifest's `repository.url` matches the building repo, and the alias file
- *  carries none of its own. The git URL already matches and survives any
- *  npm-name rename. */
-export function stampStableManifests(rootPkg, aliasPkg, version) {
-    const inherited = {};
-    for (const field of ['repository', 'homepage', 'bugs']) {
-        if (rootPkg[field] !== undefined)
-            inherited[field] = rootPkg[field];
-    }
-    return {
-        root: { ...rootPkg, version },
-        alias: { ...aliasPkg, ...inherited, version, dependencies: { [rootPkg.name]: `^${version}` } },
-    };
+ *  Mirror of `stampSnapshotManifests`, differing in exactly one decision: intra-release
+ *  dependencies get a **caret** range (`^0.1.6`), not an exact pin. A stable `cezar-cli` should
+ *  follow compatible releases of the implementation package, and a stable service should follow
+ *  compatible releases of the api-client; a snapshot must pin the one exact build it was cut
+ *  from. Everything else — which manifests exist, which sections carry the pin, what the alias
+ *  inherits — lives in `manifests.ts` so the two channels cannot drift apart. */
+export function stampStableManifests(manifests, version) {
+    return stampManifestSet(manifests, version, (v) => `^${v}`);
 }
 //# sourceMappingURL=stable.js.map

package/dist/release/stable.js.map

@@ -1 +1 @@
-{"version":3,"file":"stable.js","sourceRoot":"","sources":["../../src/release/stable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAE7F,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;2DAM2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,IAAiB,EAAE,IAAY;IAClE,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QACtC,KAAK,OAAO;YACV,OAAO,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,KAAK,OAAO;YACV,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC;QAC5B;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;uBAWuB;AACvB,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,QAAsB,EACtB,OAAe;IAEf,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAU,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,SAAS,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE;QAC7B,KAAK,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,EAAE,EAAE;KAC/F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"stable.js","sourceRoot":"","sources":["../../src/release/stable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAO/F,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAE7F,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;2DAM2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,IAAiB,EAAE,IAAY;IAClE,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QACtC,KAAK,OAAO;YACV,OAAO,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,KAAK,OAAO;YACV,OAAO,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC;QAC5B;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAID;;;;;;;iFAOiF;AACjF,MAAM,UAAU,oBAAoB,CAClC,SAA6B,EAC7B,OAAe;IAEf,OAAO,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/dist/server/app-type.d.ts

@@ -0,0 +1,20 @@
+import type { createApp } from './server.js';
+/**
+ * The service's HTTP contract, as a type.
+ *
+ * This is the whole boundary between the cezar service and a typed consumer: Hono infers an
+ * app's endpoint table from the app's *type*, and `hc<AppType>` turns that table into a client
+ * whose paths, request bodies and response shapes are checked at compile time. No hand-written
+ * mirror, no schema to author twice — the routes ARE the contract.
+ *
+ * Only routes registered through a **chained** builder appear here. `server.ts` still registers
+ * most families as loose statements (whose return value, and with it the accumulated route
+ * type, is discarded), so this type currently covers the chained families mounted under
+ * `/api/v1` — health, agent-config and workflows. Each family that gets chained widens this
+ * type automatically; nothing here needs updating.
+ *
+ * Type-only by construction: importing this module pulls in no runtime code (`import type`
+ * disappears at build), which is what lets a browser bundle consume it without dragging
+ * `node:*` in.
+ */
+export type AppType = ReturnType<typeof createApp>;

package/dist/server/app-type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=app-type.js.map

package/dist/server/app-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-type.js","sourceRoot":"","sources":["../../src/server/app-type.ts"],"names":[],"mappings":""}