@zalom/plastic 2.0.0-alpha.17 → 2.0.0-alpha.19

package/scripts/node-packet

@@ -0,0 +1,92 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require_relative "lib/node_packet"
+require_relative "lib/savepoint"
+
+# node-packet - the CLI over NodePacket (intent 338, G5). Builds one node's
+# whole input from disk and writes it to packets/<node>--a<N>.packet (or
+# --out), printing a parsable summary and the exact node-transition running
+# command intent 340's runner should record.
+#
+# Usage:
+#   node-packet <intent_dir> --node <id> [--budget N] [--hop-tokens N]
+#               [--holder H] [--expires E] [--model M] [--attempt N]
+#               [--out PATH] [--force]
+#
+# Exit codes (spec D17, shared with node-transition's family):
+#   0 - the packet was written (or the identical bytes already existed)
+#   2 - usage: not an intent directory, missing --node, or an unknown node
+#   3 - an unreadable, cyclic or unparsable graph, node file, or record
+#   4 - overflow past the third cut; nothing was written
+#   5 - an existing attempt file whose bytes differ; nothing was written
+module NodePacketCLI
+  module_function
+
+  def usage
+    warn "Usage: node-packet <intent_dir> --node <id> [--budget N] [--hop-tokens N] " \
+         "[--holder H] [--expires E] [--model M] [--attempt N] [--out PATH] [--force]"
+  end
+
+  def intent_directory?(dir)
+    dir && File.directory?(dir) && File.exist?(Savepoint.intent_file(dir))
+  end
+
+  def opt(args, name)
+    (i = args.index(name)) && args[i + 1]
+  end
+
+  def main(argv)
+    args = argv.dup
+    intent_dir_arg = args.shift
+
+    unless intent_directory?(intent_dir_arg && File.expand_path(intent_dir_arg))
+      warn "node-packet: #{intent_dir_arg.inspect} is not an intent directory"
+      usage
+      exit 2
+    end
+    intent_dir = File.expand_path(intent_dir_arg)
+
+    node = opt(args, "--node")
+    if node.to_s.strip.empty?
+      warn "node-packet: --node is required"
+      usage
+      exit 2
+    end
+
+    budget = opt(args, "--budget")
+    hop_tokens = opt(args, "--hop-tokens")
+    attempt = opt(args, "--attempt")
+    out = opt(args, "--out")
+    holder = opt(args, "--holder")
+    expires = opt(args, "--expires")
+    model = opt(args, "--model")
+    force = args.include?("--force")
+
+    result = NodePacket.build(
+      intent_dir: intent_dir,
+      node: node,
+      budget_tokens: budget ? budget.to_i : NodePacket::DEFAULT_BUDGET_TOKENS,
+      hop_tokens: hop_tokens ? hop_tokens.to_i : NodePacket::DEFAULT_HOP_TOKENS,
+      holder: holder,
+      expires: expires,
+      model: model,
+      attempt: attempt ? attempt.to_i : nil,
+      out: out,
+      force: force,
+    )
+
+    if result[:ok]
+      puts NodePacket.summary_line(result)
+      puts result[:running_command]
+      exit 0
+    end
+
+    Array(result[:errors]).each { |e| warn "node-packet: #{e}" }
+    puts result[:needs_decision_command] if result[:needs_decision_command]
+    exit result[:exit_code]
+  end
+end
+
+NodePacketCLI.main(ARGV) if $PROGRAM_NAME == __FILE__

package/scripts/node-transition

@@ -0,0 +1,291 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "time"
+require_relative "lib/savepoint"
+require_relative "lib/node_ledger"
+require_relative "lib/ready_set"
+require_relative "lib/guarded_append"
+require_relative "lib/lock"
+require_relative "lib/arm"
+
+# node-transition - the CLI over NodeLedger that REFUSES what the graph does not
+# allow (intent 335, G2). An orchestrator can run this by hand today, before the
+# runner (intent 340) exists.
+#
+# Usage:
+#   node-transition <intent_dir> --node <id|Intent> --state <state> [--field k=v]...
+#                    [--comment "..."] [--needs a,b] [--session SID] [--now ISO8601]
+#   node-transition report <intent_dir>
+#
+# Exit codes (spec D18, matching the tree: scripts/append-ledger:125 uses 3 for a
+# guard that could not be taken, scripts/end-intent:675 uses 4 for a lock-ownership
+# refusal):
+#   0 - the line was appended
+#   2 - usage: not an intent directory, bad subject, unknown state, missing
+#       required field, a tab or newline in a value
+#   3 - the ledger guard was unavailable; nothing was written
+#   4 - running, and the caller does not hold delivery.lock
+#   5 - running, and the subject is not ready
+#   6 - reclaimed, and the subject's last running line has not expired
+module NodeTransition
+  module_function
+
+  # The readiness precondition for `running` (intent 336, G3): ReadySet.ready?
+  # applied to `subject` against `edges`/`nodes` already parsed once, before
+  # the guard is ever taken (spec: "parsed once, before the guard"). Takes
+  # `content` (the ledger's raw text), never a path, so this method can be run
+  # twice: once as a cheap unguarded pre-check for a fast, readable refusal,
+  # and once - the AUTHORITATIVE decision - as the guard's precondition,
+  # evaluated against the exact content GuardedAppend just read under its
+  # lock hold (post-execution review row 7.1, carried forward by 336). A
+  # path-based re-read here would defeat the guard: two callers could each
+  # open their own handle, both see "planned", and both go on to append
+  # `running`.
+  def running_ready?(content, subject, edges, nodes, caps: ReadySet::DEFAULT_CAPS)
+    ReadySet.ready?(content: content, subject: subject, graph: { edges: edges }, nodes: nodes, caps: caps)
+  end
+
+  # graph.md and nodes/ for `subject`'s readiness (intent 336, G3): a genuinely
+  # missing graph.md degrades gracefully to no known needs/kind/files (the
+  # same fallback the temporary needs_from_graph reader gave, so a legacy
+  # intent with no graph.md still dispatches ad hoc node ids), while a
+  # PRESENT but broken graph.md (no ## Graph section, a cycle) is a clean
+  # refusal, never a raise - {edges:, nodes:, error:}.
+  def resolve_graph_and_nodes(intent_dir)
+    graph_path = File.join(intent_dir, "graph.md")
+    return { edges: {}, nodes: {}, error: nil } unless File.exist?(graph_path)
+
+    loaded = ReadySet.load_graph(intent_dir)
+    return { edges: loaded[:edges] || {}, nodes: loaded[:nodes] || {}, error: nil } if loaded[:ok]
+
+    { edges: {}, nodes: {}, error: loaded[:errors].join("; ") }
+  end
+
+  # Session resolution per spec D16: an explicit --session is authoritative and
+  # NEVER falls through (an explicit non-owner is refused outright, never
+  # silently granted ownership through a fallback). Without it, try the
+  # environment's CLAUDE_CODE_SESSION_ID, then the derived `auto-` key, and keep
+  # the first candidate that actually HOLDS the lock (owner or delegate,
+  # Lock.holds?) - so the fallback can never grant ownership to a session that
+  # does not have it.
+  def resolve_owning_session(intent_dir, explicit:, env_session:)
+    if explicit && !explicit.to_s.strip.empty?
+      return Lock.holds?(intent_dir, session: explicit) ? explicit : nil
+    end
+
+    store = Arm.store_for(intent_dir)
+    intent_id = Arm.intent_id_for(intent_dir)
+    candidates = [env_session, Arm.derive_key(store, intent_id)].reject { |c| c.to_s.strip.empty? }
+    candidates.find { |c| Lock.holds?(intent_dir, session: c) }
+  end
+
+  def intent_directory?(dir)
+    dir && File.directory?(dir) && File.exist?(Savepoint.intent_file(dir))
+  end
+
+  def valid_subject?(subject)
+    subject == Savepoint::INTENT_SUBJECT || subject.to_s.match?(Savepoint::NODE_SUBJECT_RE)
+  end
+
+  def opt(args, name)
+    (i = args.index(name)) && args[i + 1]
+  end
+
+  def opt_all(args, name)
+    args.each_index.select { |i| args[i] == name }.map { |i| args[i + 1] }
+  end
+
+  def parse_fields(args)
+    opt_all(args, "--field").each_with_object({}) do |pair, memo|
+      key, value = pair.to_s.split("=", 2)
+      memo[key] = value if key && !key.empty?
+    end
+  end
+
+  def usage
+    warn "Usage: node-transition <intent_dir> --node <id|Intent> --state <state> " \
+         "[--field k=v]... [--comment \"...\"] [--needs a,b] [--session SID] [--now ISO8601]"
+    warn "       node-transition report <intent_dir>"
+  end
+
+  def run_report(intent_dir)
+    unless intent_directory?(intent_dir)
+      warn "node-transition: #{intent_dir.inspect} is not an intent directory"
+      usage
+      exit 2
+    end
+
+    savepoint_path = File.join(intent_dir, "savepoint.md")
+    anomalies = NodeLedger.anomalies(savepoint_path)
+    if anomalies.empty?
+      puts "node-transition report: no torn or unattributed transition lines"
+    else
+      anomalies.each { |a| puts "#{a[:reason]}: #{a[:line]}" }
+    end
+    exit 0
+  end
+
+  def main(argv)
+    args = argv.dup
+    head = args.shift
+
+    if head == "report"
+      report_dir_arg = args.shift
+      run_report(report_dir_arg && File.expand_path(report_dir_arg))
+      return
+    end
+
+    intent_dir_arg = head
+    unless intent_directory?(intent_dir_arg && File.expand_path(intent_dir_arg))
+      warn "node-transition: #{intent_dir_arg.inspect} is not an intent directory"
+      usage
+      exit 2
+    end
+    intent_dir = File.expand_path(intent_dir_arg)
+
+    subject = opt(args, "--node")
+    state = opt(args, "--state")
+    comment = opt(args, "--comment")
+    needs_flag = opt(args, "--needs")
+    session_flag = opt(args, "--session")
+    now_flag = opt(args, "--now")
+    fields = parse_fields(args)
+
+    if subject.nil? || state.nil?
+      warn "node-transition: --node and --state are required"
+      usage
+      exit 2
+    end
+
+    unless valid_subject?(subject)
+      warn "node-transition: #{subject.inspect} is neither #{Savepoint::INTENT_SUBJECT} nor a valid node id"
+      exit 2
+    end
+
+    unless NodeLedger::STATES.include?(state)
+      warn "node-transition: unknown state #{state.inspect}"
+      exit 2
+    end
+
+    now = begin
+      now_flag ? Time.iso8601(now_flag) : Time.now
+    rescue ArgumentError
+      warn "node-transition: --now must be ISO 8601"
+      exit 2
+    end
+
+    begin
+      fields.each_value { |v| NodeLedger.normalize_value(v) }
+      NodeLedger.normalize_value(comment) if comment
+    rescue ArgumentError => e
+      warn "node-transition: #{e.message}"
+      exit 2
+    end
+
+    missing = NodeLedger.missing_fields(state, fields)
+    unless missing.empty?
+      warn "node-transition: state #{state} requires #{missing.join(', ')}"
+      exit 2
+    end
+
+    savepoint_path = File.join(intent_dir, "savepoint.md")
+    precondition = nil
+
+    case state
+    when "running"
+      owning_session = resolve_owning_session(intent_dir, explicit: session_flag,
+                                                            env_session: ENV["CLAUDE_CODE_SESSION_ID"])
+      unless owning_session
+        warn "node-transition: the caller does not hold delivery.lock for #{intent_dir}"
+        exit 4
+      end
+
+      if subject == Savepoint::INTENT_SUBJECT
+        # The node readiness rule (four conditions over the work graph) is
+        # scoped to node subjects; the intent-scope subject is never gated by
+        # it, so a legacy intent with no graph.md at all can still write an
+        # Intent line (spec Acceptance Criteria; matrix "Transition the
+        # Intent subject").
+        precondition = nil
+      else
+        resolved = resolve_graph_and_nodes(intent_dir)
+        if resolved[:error]
+          warn "node-transition: #{resolved[:error]}"
+          exit 5
+        end
+
+        needs_override = needs_flag ? needs_flag.split(",").map(&:strip).reject(&:empty?) : nil
+        edges = needs_override ? resolved[:edges].merge(subject => needs_override) : resolved[:edges]
+        nodes = resolved[:nodes]
+
+        # Fast, unguarded pre-check: a cheap, readable refusal for the common
+        # case, but NEVER the authoritative decision (post-execution review
+        # row 7.1, carried forward by 336). The authoritative check is the
+        # `precondition` below, run inside GuardedAppend's lock hold against
+        # the content it actually read. `edges` and `nodes` are parsed once,
+        # above, before the guard is ever taken (spec D1).
+        precheck_content = File.exist?(savepoint_path) ? File.read(savepoint_path) : ""
+        result = running_ready?(precheck_content, subject, edges, nodes)
+        unless result[:ready]
+          warn "node-transition: #{result[:blockers].join('; ')}"
+          exit 5
+        end
+
+        precondition = ->(content) { running_ready?(content, subject, edges, nodes)[:ready] }
+      end
+    when "reclaimed"
+      running_entry = NodeLedger.last_running(savepoint_path, subject)
+      unless running_entry
+        warn "node-transition: #{subject} has no running line to reclaim"
+        exit 6
+      end
+
+      # Post-execution review row 7.4: expiry alone is not enough. A `done`
+      # node whose last `running` line's expires= happens to be in the past
+      # must not revert to `planned` and become re-dispatchable - reclaim is
+      # deliberately lock-free (spec D43), so this status check is the only
+      # thing that stops it. Row 7.5 pins that a genuinely running, expired
+      # subject is still reclaimable, so the crash sweep keeps working.
+      current_status = NodeLedger.status_for(savepoint_path, subject)
+      unless current_status == "running"
+        warn "node-transition: #{subject} is #{current_status}, not running; nothing to reclaim"
+        exit 6
+      end
+
+      expires_raw = (running_entry[:fields] || {})["expires"]
+      expiry_time = begin
+        expires_raw && Time.iso8601(expires_raw)
+      rescue ArgumentError
+        nil
+      end
+
+      unless expiry_time && now > expiry_time
+        warn "node-transition: #{subject}'s running line has not expired yet"
+        exit 6
+      end
+    end
+
+    result = begin
+      NodeLedger.append_transition(savepoint_path, subject: subject, state: state, fields: fields,
+                                    comment: comment, now: now, precondition: precondition)
+    rescue GuardedAppend::Unavailable => e
+      warn "node-transition: #{e.message}"
+      exit 3
+    rescue ArgumentError => e
+      warn "node-transition: #{e.message}"
+      exit 2
+    end
+
+    if result == :refused
+      warn "node-transition: #{subject} was no longer ready by the time the write lock was taken"
+      exit 5
+    end
+
+    puts "node-transition: appended #{state} for #{subject}"
+    exit 0
+  end
+end
+
+NodeTransition.main(ARGV) if $PROGRAM_NAME == __FILE__

package/scripts/outcome-report

@@ -0,0 +1,74 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# outcome-report - the CLI over scripts/lib/outcome_report.rb (intent 339, G6).
+# Prints the generated outcome.md by default; --write puts it on disk through
+# AtomicWrite. `end-intent` calls the library directly (never shells out to
+# this), so this command is for a human or an agent checking the generated
+# report before or instead of a close.
+#
+# Usage:
+#   outcome-report <intent_dir> [--write] [--disposition delivered|abandoned]
+#
+# Exit codes:
+#   0 - printed (or written) successfully
+#   2 - usage error: no path given, an unknown flag, or the path is not an
+#       intent directory
+#   3 - the report model could not be built (a malformed or absent graph.md)
+
+require_relative "lib/outcome_report"
+require_relative "lib/intent_screen"
+require_relative "lib/outcome_guard"
+
+def usage_abort(message)
+  warn "outcome-report: #{message}"
+  exit 2
+end
+
+args = ARGV.dup
+write_flag = false
+disposition = "delivered"
+positional = []
+
+while (arg = args.shift)
+  case arg
+  when "--write"
+    write_flag = true
+  when "--disposition"
+    disposition = args.shift or usage_abort("--disposition needs a value")
+  else
+    usage_abort("unknown flag #{arg.inspect}") if arg.start_with?("--")
+    positional << arg
+  end
+end
+
+target = positional.first
+usage_abort("usage: outcome-report <intent_dir> [--write] [--disposition delivered|abandoned]") unless target
+# Row v1f.9 (N3): refuse an unknown --disposition here rather than write a
+# record OutcomeGuard then refuses. OutcomeGuard::DISPOSITIONS is already
+# loaded in-process, so this is one comparison, not a duplicated list.
+unless OutcomeGuard::DISPOSITIONS.include?(disposition)
+  usage_abort("--disposition must be one of #{OutcomeGuard::DISPOSITIONS.join('|')}, got #{disposition.inspect}")
+end
+
+intent_dir = File.expand_path(target)
+usage_abort("#{intent_dir} is not an intent directory") unless IntentScreen.intent_dir?(intent_dir)
+
+model = OutcomeReport.model(intent_dir)
+unless model[:ok]
+  warn "outcome-report: the report model could not be built: #{model[:errors].join('; ')}"
+  exit 3
+end
+
+if write_flag
+  OutcomeReport.write(intent_dir, disposition: disposition)
+  puts File.join(intent_dir, "outcome.md")
+else
+  outcome_path = File.join(intent_dir, "outcome.md")
+  existing = File.exist?(outcome_path) ? File.read(outcome_path) : nil
+  puts OutcomeReport.render(model, disposition: disposition, existing: existing,
+                                   findings: OutcomeReport.findings(intent_dir), intent_dir: intent_dir)
+end
+
+exit 0

package/scripts/ready-set

@@ -0,0 +1,126 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# ready-set - the CLI over ReadySet (intent 336, G3). No computed field this
+# intent adds ships without a script that reads it (327 D18, C19): prints the
+# ready order, the blockers for every unready node, the batches, and every
+# maximal-length critical path; emits JSON for a caller like the runner (G7).
+#
+# Usage:
+#   ready-set <intent_dir> [--json] [--ranker finish-first|critical-path]
+#
+# Exit codes (matching scripts/validate-work-graph's shape):
+#   0 - printed (or emitted as JSON)
+#   1 - the graph is invalid (missing, cyclic, or a malformed node file)
+#   2 - usage: not an intent directory, or an unknown --ranker value
+
+require "json"
+require_relative "lib/ready_set"
+require_relative "lib/savepoint"
+
+module ReadySetCli
+  module_function
+
+  RANKERS = {
+    "finish-first" => -> { ReadySet::FinishFirstRanker.new },
+    "critical-path" => -> { ReadySet::CriticalPathRanker.new },
+  }.freeze
+
+  def usage
+    warn "Usage: ready-set <intent_dir> [--json] [--ranker #{RANKERS.keys.join('|')}]"
+  end
+
+  def intent_directory?(dir)
+    dir && File.directory?(dir) && File.exist?(Savepoint.intent_file(dir))
+  end
+
+  def main(argv)
+    args = argv.dup
+    json = !!args.delete("--json")
+
+    ranker_name = nil
+    if (i = args.index("--ranker"))
+      ranker_name = args[i + 1]
+      args.slice!(i, 2)
+    end
+
+    intent_dir_arg = args.shift
+    unless intent_directory?(intent_dir_arg && File.expand_path(intent_dir_arg))
+      warn "ready-set: #{intent_dir_arg.inspect} is not an intent directory"
+      usage
+      return 2
+    end
+    intent_dir = File.expand_path(intent_dir_arg)
+
+    ranker = nil
+    if ranker_name
+      factory = RANKERS[ranker_name]
+      unless factory
+        warn "ready-set: unknown ranker #{ranker_name.inspect} (use #{RANKERS.keys.join(', ')})"
+        return 2
+      end
+      ranker = factory.call
+    end
+
+    analysis = ReadySet.analyze(intent_dir, ranker: ranker)
+    unless analysis[:ok]
+      warn "ready-set: #{analysis[:errors].join('; ')}"
+      return 1
+    end
+
+    if json
+      puts JSON.pretty_generate(json_payload(analysis))
+    else
+      print_report(analysis)
+    end
+    0
+  end
+
+  def json_payload(analysis)
+    unready = analysis[:nodes].reject { |_, v| v[:ready] }
+    {
+      "ready" => analysis[:ranked_ready].map { |r| r[:id] },
+      "ranker" => analysis[:ranker_name],
+      "batches" => analysis[:batches],
+      "critical_path" => analysis[:critical_path],
+      "paths" => analysis[:paths],
+      "hops" => analysis[:hops],
+      "max_paths_total" => analysis[:max_paths_total],
+      "blockers" => unready.transform_values { |v| v[:blockers] },
+      "errors" => analysis[:errors],
+    }
+  end
+
+  def print_report(analysis)
+    unready = analysis[:nodes].reject { |_, v| v[:ready] }
+
+    puts "Ranker: #{analysis[:ranker_name]}"
+    puts
+    puts "Ready (#{analysis[:ranked_ready].length}):"
+    if analysis[:ranked_ready].empty?
+      puts "  (none)"
+    else
+      analysis[:ranked_ready].each { |r| puts "  #{r[:id]}" }
+    end
+    puts
+    puts "Blockers:"
+    if unready.empty?
+      puts "  (none)"
+    else
+      unready.each do |id, view|
+        puts "  #{id}:"
+        view[:blockers].each { |b| puts "    - #{b}" }
+      end
+    end
+    puts
+    puts "Batches:"
+    analysis[:batches].each_with_index { |batch, i| puts "  #{i + 1}: #{batch.join(', ')}" }
+    puts
+    puts "Critical path (#{analysis[:hops]} hops): #{(analysis[:critical_path] || []).join(' > ')}"
+    puts "Every maximal-length path (#{analysis[:max_paths_total]} total, #{analysis[:paths].length} shown):"
+    analysis[:paths].each { |p| puts "  #{p.join(' > ')}" }
+  end
+end
+
+exit(ReadySetCli.main(ARGV)) if $PROGRAM_NAME == __FILE__

package/scripts/release-check

@@ -0,0 +1,118 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# release-check - deterministic CLI over ReleaseGuard (intent 347).
+#
+# Guards a tagged publish before the workflow ever reaches `npm publish`:
+# the pushed tag must equal `v` plus the version in package.json, the three
+# repo version files must agree, and the runner's npm must meet the 11.5.1
+# floor npm requires for OIDC trusted publishing. Writes the derived
+# dist-tag and version to $GITHUB_OUTPUT, so the alpha/beta/latest rule has
+# exactly one implementation, ReleaseGuard.dist_tag, shared with the test
+# suite.
+#
+# Usage:
+#   release-check --tag <tag> --npm-version <version>
+#                  [--github-output <path>] [--root <dir>]
+#
+# Exit codes: 0 (clean), 1 (violations; reported on stderr, one per line,
+# each naming the specific thing that is wrong), 2 (usage).
+
+require "json"
+
+require_relative "lib/release_guard"
+
+NPM_FLOOR = [11, 5, 1].freeze
+KNOWN_FLAGS = %w[--tag --npm-version --github-output --root].freeze
+
+def usage
+  warn "usage: release-check --tag <tag> --npm-version <version> [--github-output <path>] [--root <dir>]"
+  exit 2
+end
+
+def parse_args(argv)
+  opts = {}
+  i = 0
+  while i < argv.length
+    flag = argv[i]
+    usage unless KNOWN_FLAGS.include?(flag)
+
+    value = argv[i + 1]
+    usage if value.nil?
+
+    opts[flag] = value
+    i += 2
+  end
+  opts
+end
+
+def read_version(path)
+  JSON.parse(File.read(path))["version"]
+rescue Errno::ENOENT, JSON::ParserError
+  nil
+end
+
+opts = parse_args(ARGV)
+usage unless opts["--tag"] && opts["--npm-version"]
+
+root = opts["--root"] ? File.expand_path(opts["--root"]) : File.expand_path("..", __dir__)
+package_json_path = File.join(root, "package.json")
+plugin_json_path = File.join(root, ".claude-plugin", "plugin.json")
+marketplace_json_path = File.join(root, ".claude-plugin", "marketplace.json")
+
+violations = []
+
+canonical_version = read_version(package_json_path)
+violations << "could not read a version from #{package_json_path}" if canonical_version.nil?
+
+tag = opts["--tag"].sub(%r{\Arefs/tags/}, "")
+dist_tag = nil
+
+if canonical_version
+  expected_tag = "v#{canonical_version}"
+  if tag != expected_tag
+    violations << "tag #{tag} does not match package.json version #{canonical_version} (expected #{expected_tag})"
+  end
+
+  dist_tag = ReleaseGuard.dist_tag(canonical_version)
+  stable = dist_tag == "latest"
+
+  result = ReleaseGuard.check(
+    package_json: package_json_path,
+    plugin_json: plugin_json_path,
+    marketplace_json: marketplace_json_path,
+    stable: stable
+  )
+
+  unless result.ok?
+    result.mismatches.each do |file|
+      violations << "version file #{file} does not agree with package.json (#{canonical_version})"
+    end
+    if stable && result.prerelease_suffix
+      violations << "stable cut #{canonical_version} carries the pre-release suffix -#{result.prerelease_suffix}"
+    end
+  end
+end
+
+npm_version = opts["--npm-version"].to_s.strip
+if npm_version.empty? || !npm_version.match?(/\A\d+(\.\d+)*\z/)
+  violations << "npm --version reported #{opts["--npm-version"].inspect}, which is empty or not numeric"
+elsif (npm_version.split(".").map(&:to_i) <=> NPM_FLOOR) < 0
+  violations << "npm #{npm_version} is below the 11.5.1 floor OIDC trusted publishing requires"
+end
+
+if violations.empty?
+  if opts["--github-output"]
+    File.open(opts["--github-output"], "a") do |f|
+      f.puts "version=#{canonical_version}"
+      f.puts "dist_tag=#{dist_tag}"
+    end
+  end
+  puts "OK: tag #{tag}, version #{canonical_version}, dist-tag #{dist_tag}"
+  exit 0
+end
+
+warn "VIOLATIONS:"
+violations.each { |v| warn "- #{v}" }
+exit 1