forgeos 0.1.0-alpha.48 → 0.1.0-alpha.49

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.48 input=e33f72bcdf6ab58ac5b6405b90a332317f8f763ca9b9521db6a75de4e7a2bc57 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.49 input=a7c20b1d3492dcb4111d826ff8622647abd8f6be499cffb3c27e077c9b3267b1 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # forgeos
 
+## 0.1.0-alpha.49
+
+### Patch Changes
+
+- Improve release doctor visibility for npm dist-tag drift.
+
+  - `forge release doctor --json` now checks the published npm `alpha` and
+    `latest` dist-tags for public packages, reports the currently published
+    tag versions, and suggests the exact `npm dist-tag add` remediation when
+    `latest` still points at an older alpha.
+  - The npm dist-tag check is advisory rather than publish-blocking, so a
+    prepared alpha release can still ship while clearly reporting that the
+    consumer-facing `latest` tag needs promotion.
+  - GitHub Actions latest-promotion notices now include the local remediation
+    command and the `NPM_TOKEN` configuration hint when latest promotion is
+    skipped.
+
 ## 0.1.0-alpha.48
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,17 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.49
+
+- `forge release doctor --json` now reports npm `alpha` and `latest` dist-tag
+  versions for public packages, including exact remediation when `latest`
+  points at an older alpha.
+- The dist-tag check is advisory and non-publish-blocking, keeping alpha
+  release validation usable while making stale `latest` state explicit.
+- GitHub Actions latest-promotion notices now include the local
+  `npm dist-tag add <package>@<version> latest` fallback and `NPM_TOKEN`
+  configuration hint when promotion is skipped.
+
 ## 0.1.0-alpha.48
 
 - Added the production-shaped WorkOS FGA flow:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.48",
+  "version": "0.1.0-alpha.49",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.48","releaseId":"forgeos@0.1.0-alpha.48+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.49","releaseId":"forgeos@0.1.0-alpha.49+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.48 input=e33f72bcdf6ab58ac5b6405b90a332317f8f763ca9b9521db6a75de4e7a2bc57 content=688cbf07ac4fedd1f2f4fc8a3055f32a6f5a8d1ea9df8fe0c2ed81cec120fb3b
+// @forge-generated generator=0.1.0-alpha.49 input=a7c20b1d3492dcb4111d826ff8622647abd8f6be499cffb3c27e077c9b3267b1 content=bfe9659e5f5a5d2d52e6ac7eb6c13d2bc356c8bf95724fafc6e10fe4641f2104
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.48",
-  "releaseId": "forgeos@0.1.0-alpha.48+unknown",
+  "packageVersion": "0.1.0-alpha.49",
+  "releaseId": "forgeos@0.1.0-alpha.49+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/commands.ts

@@ -6,6 +6,8 @@ import { classify } from "../compiler/classifier/classify.ts";
 import { buildRuntimeMatrix } from "../compiler/classifier/runtime-matrix.ts";
 import {
   FORGE_DB_EMPTY_TIMESTAMP_LITERAL,
+  FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED,
+  FORGE_RELEASE_NPM_DIST_TAG_STALE,
   FORGE_RELEASE_PACKAGE_PACK_FAILED,
 } from "../compiler/diagnostics/codes.ts";
 import { createDiagnostic } from "../compiler/diagnostics/create.ts";
@@ -1149,7 +1151,7 @@ interface ReleaseDoctorCheck {
   requiredForPublish: boolean;
   requiredForProduction?: boolean;
   state?: string;
-  result: ReleaseCommandResult | SelfHostCommandResult | DocsCheckResult | DeployCommandResult | PackagePackCheckResult;
+  result: ReleaseCommandResult | SelfHostCommandResult | DocsCheckResult | DeployCommandResult | PackagePackCheckResult | NpmDistTagCheckResult;
 }
 
 interface PackagePackCheckResult {
@@ -1166,6 +1168,24 @@ interface PackagePackCheckResult {
   exitCode: 0 | 1;
 }
 
+interface NpmDistTagCheckResult {
+  ok: boolean;
+  data: {
+    command: string;
+    packageName: string | null;
+    packageVersion: string | null;
+    alphaVersion: string | null;
+    latestVersion: string | null;
+    alphaMatches: boolean;
+    latestMatches: boolean;
+    source: "npm-view" | "env-fixture" | "skipped";
+  };
+  diagnostics: ReturnType<typeof createDiagnostic>[];
+  nextActions?: string[];
+  failureKind?: string;
+  exitCode: 0 | 1;
+}
+
 interface ReleaseDoctorResult {
   schemaVersion: "0.1.0";
   ok: boolean;
@@ -1263,6 +1283,156 @@ function runPackagePackDryRun(workspaceRoot: string): PackagePackCheckResult {
   }
 }
 
+function parseNpmDistTagsJson(raw: string): Record<string, string> | null {
+  try {
+    const parsed = JSON.parse(raw) as unknown;
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const tags: Record<string, string> = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (typeof value === "string") {
+        tags[key] = value;
+      }
+    }
+    return tags;
+  } catch {
+    return null;
+  }
+}
+
+function runNpmDistTagCheck(workspaceRoot: string): NpmDistTagCheckResult {
+  const pkg = readPackageJson(workspaceRoot) as {
+    name?: unknown;
+    version?: unknown;
+    private?: unknown;
+  };
+  const packageName = typeof pkg.name === "string" ? pkg.name : null;
+  const packageVersion = typeof pkg.version === "string" ? pkg.version : null;
+  const command = packageName ? `npm view ${packageName} dist-tags --json` : "npm view <package> dist-tags --json";
+  const baseData = {
+    command,
+    packageName,
+    packageVersion,
+    alphaVersion: null,
+    latestVersion: null,
+    alphaMatches: false,
+    latestMatches: false,
+    source: "skipped" as const,
+  };
+
+  if (pkg.private === true) {
+    return {
+      ok: true,
+      data: baseData,
+      diagnostics: [],
+      exitCode: 0,
+    };
+  }
+  if (!packageName || !packageVersion) {
+    return {
+      ok: false,
+      data: baseData,
+      diagnostics: [
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED,
+          message: "release doctor could not check npm dist-tags because package.json is missing name or version",
+          fixHint: "Set package.json name and version before publishing, then rerun forge release doctor.",
+          suggestedCommands: ["node bin/forge.mjs release doctor --json"],
+        }),
+      ],
+      nextActions: ["node bin/forge.mjs release doctor --json"],
+      failureKind: "npm-dist-tags-package-metadata-missing",
+      exitCode: 1,
+    };
+  }
+
+  const fixture = process.env.FORGE_RELEASE_NPM_DIST_TAGS_JSON;
+  const source = fixture ? "env-fixture" as const : "npm-view" as const;
+  const stdout = fixture ?? spawnSync("npm", ["view", packageName, "dist-tags", "--json"], {
+    cwd: workspaceRoot,
+    encoding: "utf8",
+    timeout: 10_000,
+    windowsHide: true,
+  }).stdout;
+  const tags = parseNpmDistTagsJson(stdout || "");
+  if (!tags) {
+    return {
+      ok: false,
+      data: { ...baseData, source },
+      diagnostics: [
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED,
+          message: `release doctor could not read npm dist-tags for ${packageName}`,
+          fixHint: `Run ${command}. If the package has not been published yet, publish it with the alpha tag first.`,
+          suggestedCommands: [command, "npm run release:publish-alpha"],
+        }),
+      ],
+      nextActions: [command, "npm run release:publish-alpha"],
+      failureKind: "npm-dist-tags-unavailable",
+      exitCode: 1,
+    };
+  }
+
+  const alphaVersion = tags.alpha ?? null;
+  const latestVersion = tags.latest ?? null;
+  const alphaMatches = alphaVersion === packageVersion;
+  const latestMatches = latestVersion === packageVersion;
+  const data = {
+    command,
+    packageName,
+    packageVersion,
+    alphaVersion,
+    latestVersion,
+    alphaMatches,
+    latestMatches,
+    source,
+  };
+  if (alphaMatches && latestMatches) {
+    return {
+      ok: true,
+      data,
+      diagnostics: [],
+      exitCode: 0,
+    };
+  }
+
+  const nextActions: string[] = [];
+  const diagnostics: ReturnType<typeof createDiagnostic>[] = [];
+  if (!alphaMatches) {
+    nextActions.push("npm run release:publish-alpha");
+    diagnostics.push(createDiagnostic({
+      severity: "warning",
+      code: FORGE_RELEASE_NPM_DIST_TAG_STALE,
+      message: `${packageName}@alpha points to ${alphaVersion ?? "none"}, not local version ${packageVersion}`,
+      fixHint: "Publish the current package with the alpha tag before asking users to install forgeos@alpha.",
+      suggestedCommands: ["npm run release:publish-alpha", command],
+    }));
+  }
+  if (!latestMatches) {
+    const promote = `npm dist-tag add ${packageName}@${packageVersion} latest`;
+    nextActions.push(promote);
+    nextActions.push("configure NPM_TOKEN in GitHub Actions secrets, or run npm login locally before promoting latest");
+    diagnostics.push(createDiagnostic({
+      severity: "warning",
+      code: FORGE_RELEASE_NPM_DIST_TAG_STALE,
+      message: `${packageName}@latest points to ${latestVersion ?? "none"}, not local version ${packageVersion}`,
+      fixHint: `Promote latest after the alpha package is verified: ${promote}`,
+      suggestedCommands: [promote, command],
+    }));
+  }
+  return {
+    ok: false,
+    data,
+    diagnostics,
+    nextActions,
+    failureKind: !alphaMatches ? "npm-alpha-dist-tag-stale" : "npm-latest-dist-tag-stale",
+    exitCode: 1,
+  };
+}
+
 export async function runReleaseDoctorCommand(command: Extract<ForgeCommand, { kind: "release" }>): Promise<ReleaseDoctorResult> {
   const release = await runReleaseCommand({
     ...command,
@@ -1300,6 +1470,7 @@ export async function runReleaseDoctorCommand(command: Extract<ForgeCommand, { k
     production: true,
   });
   const packagePack = runPackagePackDryRun(command.workspaceRoot);
+  const npmDistTags = runNpmDistTagCheck(command.workspaceRoot);
   const checks: ReleaseDoctorCheck[] = [
     {
       name: "release-prepared",
@@ -1340,6 +1511,13 @@ export async function runReleaseDoctorCommand(command: Extract<ForgeCommand, { k
       requiredForPublish: true,
       result: packagePack,
     },
+    {
+      name: "npm-dist-tags",
+      ok: npmDistTags.ok,
+      requiredForPublish: false,
+      state: npmDistTags.failureKind ?? (npmDistTags.data.source === "skipped" ? "skipped" : "current"),
+      result: npmDistTags,
+    },
   ];
   const failed = checks.filter((check) => !check.ok).map((check) => check.name);
   const notPrepared = checks

package/src/forge/compiler/diagnostics/codes.ts

@@ -111,6 +111,10 @@ export const FORGE_RELEASE_GENERATED_DRIFT =
 export const FORGE_RELEASE_ID_MISSING = "FORGE_RELEASE_ID_MISSING" as const;
 export const FORGE_RELEASE_PACKAGE_PACK_FAILED =
   "FORGE_RELEASE_PACKAGE_PACK_FAILED" as const;
+export const FORGE_RELEASE_NPM_DIST_TAG_STALE =
+  "FORGE_RELEASE_NPM_DIST_TAG_STALE" as const;
+export const FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED =
+  "FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED" as const;
 export const FORGE_SOURCEMAP_PUBLIC_EXPOSURE =
   "FORGE_SOURCEMAP_PUBLIC_EXPOSURE" as const;
 export const FORGE_SOURCEMAP_UPLOAD_MISSING =
@@ -475,6 +479,8 @@ export const DIAGNOSTIC_CODES = [
   FORGE_RELEASE_GENERATED_DRIFT,
   FORGE_RELEASE_ID_MISSING,
   FORGE_RELEASE_PACKAGE_PACK_FAILED,
+  FORGE_RELEASE_NPM_DIST_TAG_STALE,
+  FORGE_RELEASE_NPM_DIST_TAG_CHECK_FAILED,
   FORGE_SOURCEMAP_PUBLIC_EXPOSURE,
   FORGE_SOURCEMAP_UPLOAD_MISSING,
   FORGE_SOURCEMAP_UPLOAD_FAILED,

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.48";
+export const FORGEOS_VERSION = "0.1.0-alpha.49";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;