@timekast/factory 1.11.0 → 1.12.0

package/dist/commands/status.js

@@ -18,6 +18,7 @@ import { execa } from 'execa';
 import { FACTORY_REPO } from '../lib/constants.js';
 import { hasLockfile, readLockfile } from '../lib/lockfile.js';
 import { compare } from '../lib/semver.js';
+import { isKitReleaseTag } from '../lib/unpack.js';
 /**
  * The BETA channel banner (BETA-005). Emitted by `status` and `doctor` when the
  * lockfile is on the beta channel (`lockfile.beta === true`) so the dev always
@@ -47,7 +48,9 @@ async function fetchLatestRelease() {
             '30',
         ]);
         const releases = JSON.parse(stdout);
-        const stable = releases.find((r) => !r.isPrerelease);
+        // Only consider the KIT release line (`v*`): the repo also hosts `launcher-v*`
+        // releases, which must never be mistaken for the latest kit version.
+        const stable = releases.find((r) => !r.isPrerelease && isKitReleaseTag(r.tagName));
         if (!stable)
             return null;
         return stripVersionPrefix(stable.tagName);

package/dist/lib/unpack.js

@@ -22,10 +22,31 @@ import { FACTORY_REPO, MANIFEST_FILE, TIMEKAST_DIR } from './constants.js';
 import { compare } from './semver.js';
 /** Download the profile tarball into `tmpDir`; returns the tarball path. */
 export async function downloadProfileTarball(profile, tmpDir) {
+    // List releases and resolve the latest KIT release by tag, then download BY TAG.
+    // We do NOT let `gh` resolve repo-wide "latest": the repo also hosts the launcher
+    // release line (`launcher-v*`), whose assets are not kit tarballs, so "latest"
+    // can point at a launcher release. Filtering to `v*` keeps the kit line isolated.
+    const { stdout } = await execa('gh', [
+        'release',
+        'list',
+        '--repo',
+        FACTORY_REPO,
+        '--json',
+        'tagName,isPrerelease',
+        '--limit',
+        '30',
+    ]);
+    const releases = JSON.parse(stdout);
+    const latestKit = resolveLatestKitRelease(releases);
+    if (!latestKit) {
+        throw new CLIError(`No se encontró un release del kit (\`v*\`) publicado en \`${FACTORY_REPO}\`.\n` +
+            'Verifica que exista un release con los assets de distribución.');
+    }
     try {
         await execa('gh', [
             'release',
             'download',
+            latestKit.tagName,
             '--repo',
             FACTORY_REPO,
             '--pattern',
@@ -35,12 +56,12 @@ export async function downloadProfileTarball(profile, tmpDir) {
         ]);
     }
     catch {
-        throw new CLIError(`No se encontró un release publicado con el perfil \`${profile}\` en \`${FACTORY_REPO}\`.\n` +
-            'Verifica que exista un release con los assets de distribución.');
+        throw new CLIError(`No se encontró el asset \`${profile}\` en el release del kit \`${latestKit.tagName}\` de \`${FACTORY_REPO}\`.\n` +
+            'Verifica que el release contenga los assets de distribución.');
     }
     const downloaded = readdirSync(tmpDir).filter((f) => f.endsWith('.tgz'));
     if (downloaded.length === 0) {
-        throw new CLIError(`El release no contiene un asset para el perfil \`${profile}\`. ` +
+        throw new CLIError(`El release del kit \`${latestKit.tagName}\` no contiene un asset para el perfil \`${profile}\`. ` +
             'Verifica el release del Factory.');
     }
     return path.join(tmpDir, downloaded[0]);
@@ -81,6 +102,28 @@ export function resolveLatestBeta(releases) {
     // semver-max: `compare` strips the leading `v` itself, so tags pass verbatim.
     return betas.reduce((max, r) => (compare(r.tagName, max.tagName) > 0 ? r : max));
 }
+/**
+ * True when a release tag belongs to the KIT's release line (`v<semver>`, e.g.
+ * `v10.9.0`). The same repo hosts the launcher line (`launcher-v*`) and — via npm,
+ * not GitHub Releases — the CLI line (`cli-v*`); neither starts with `v<digit>`,
+ * so this predicate isolates the kit from every other release line in the repo.
+ * Without it, `gh`'s repo-wide "latest" / a non-prerelease `launcher-v*` could be
+ * mistaken for the latest kit version and break `status` / `update`.
+ */
+export function isKitReleaseTag(tagName) {
+    return /^v\d/.test(tagName);
+}
+/**
+ * Pick the latest STABLE kit release from a list: filter to kit tags (excluding
+ * `launcher-v*` / any non-kit line) AND non-prerelease, then the highest by semver.
+ * Returns null when no stable kit release exists.
+ */
+export function resolveLatestKitRelease(releases) {
+    const kit = releases.filter((r) => !r.isPrerelease && isKitReleaseTag(r.tagName));
+    if (kit.length === 0)
+        return null;
+    return kit.reduce((max, r) => (compare(r.tagName, max.tagName) > 0 ? r : max));
+}
 /**
  * Download the latest beta profile tarball into `tmpDir`; returns the tarball
  * path. Beta counterpart of {@link downloadProfileTarball}: instead of letting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timekast/factory",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "Public, thin CLI to bootstrap and maintain TimeKast Factory derived projects.",
   "type": "module",
   "license": "UNLICENSED",