impel-cli 0.20.63-canary.4 → 0.20.63-canary.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.63-canary.4",
+  "version": "0.20.63-canary.6",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/scripts/bake-canary-brand.mjs

@@ -4,9 +4,10 @@
 // `publish-canary.yml` runs this in the working tree immediately before
 // `pnpm pack`, after the test suite has run on the unmodified tree. It
 // rewrites the brand DEFAULT in `src/runtimeBrand.js` in place: the channel
-// literal becomes `canary` and the three production `defaultOrigin` literals
-// become the canary row of CHANNEL_ORIGINS, read from the very module being
-// baked so the row has one source of truth.
+// literal becomes `canary`, the three production `defaultOrigin` literals
+// become the canary row of CHANNEL_ORIGINS (read from the very module being
+// baked so the row has one source of truth), and the CLI config namespace
+// becomes `impel-canary` so stable and canary state never share files.
 //
 // It is a one-shot publish step, not a formatter: every literal it replaces
 // must occur exactly once in its shipped form, a file that is already baked
@@ -51,6 +52,7 @@ async function main() {
   const { CHANNEL_ORIGINS } = await importBrandModule(target, "before");
   const rows = [
     ['channel: "stable",', CANARY_MARKER],
+    ['configNamespace: "impel",', 'configNamespace: "impel-canary",'],
     ...["gateway", "sessions", "controlPlane"].map((column) => [
       `defaultOrigin: ${JSON.stringify(CHANNEL_ORIGINS.stable[column])}`,
       `defaultOrigin: ${JSON.stringify(CHANNEL_ORIGINS.canary[column])}`,
@@ -73,10 +75,13 @@ async function main() {
     if (RUNTIME_BRAND.channel !== "canary" || mismatch) {
       throw new Error(`baked DEFAULT is not the canary row (${mismatch || "channel"})`);
     }
+    if (RUNTIME_BRAND.cli.configNamespace !== "impel-canary") {
+      throw new Error(`baked CLI config namespace is not isolated (${RUNTIME_BRAND.cli.configNamespace})`);
+    }
     process.stdout.write(
       `bake-canary-brand: ${target} now carries channel canary `
       + `(gateway ${RUNTIME_BRAND.gateway.defaultOrigin}, sessions ${RUNTIME_BRAND.sessions.defaultOrigin}, `
-      + `controlPlane ${RUNTIME_BRAND.controlPlane.defaultOrigin})\n`,
+      + `controlPlane ${RUNTIME_BRAND.controlPlane.defaultOrigin}, config ${RUNTIME_BRAND.cli.configNamespace})\n`,
     );
   } catch (error) {
     fs.writeFileSync(target, original);

package/scripts/npm-dist-tags.mjs

@@ -5,6 +5,15 @@ import { fileURLToPath } from "node:url";
 
 const DIST_TAGS_URL = "https://registry.npmjs.org/-/package/impel-cli/dist-tags";
 
+// npm accepts a version and returns success before every registry edge exposes
+// its new dist-tag. The post-publish verifier therefore treats a stale canary
+// tag as propagation, not proof that npm publish failed. Five minutes stays
+// comfortably inside the publish job's 15-minute timeout.
+const CANARY_TAG_VERIFY_ATTEMPTS = 20;
+const CANARY_TAG_VERIFY_DELAY_MS = 15_000;
+
+class CanaryDistTagMismatchError extends Error {}
+
 export function assertCanaryDistTags({ beforeLatest, expectedCanary, tags }) {
   const latest = tags.latest ?? "";
   const canary = tags.canary ?? "";
@@ -15,11 +24,46 @@ export function assertCanaryDistTags({ beforeLatest, expectedCanary, tags }) {
     );
   }
   if (canary !== expectedCanary) {
-    throw new Error(`dist-tags.canary is ${canary || "<none>"}, expected ${expectedCanary}.`);
+    throw new CanaryDistTagMismatchError(
+      `dist-tags.canary is ${canary || "<none>"}, expected ${expectedCanary}.`,
+    );
   }
   return { latest, canary };
 }
 
+/**
+ * Verify npm's public dist-tags after publish while allowing the canary tag to
+ * propagate. A moved `latest` remains an immediate failure: that is a release
+ * invariant violation, not ordinary registry propagation.
+ */
+export async function verifyCanaryDistTags({
+  beforeLatest,
+  expectedCanary,
+  readTags = readDistTags,
+  attempts = CANARY_TAG_VERIFY_ATTEMPTS,
+  delayMs = CANARY_TAG_VERIFY_DELAY_MS,
+  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+}) {
+  let lastObservedCanary = "";
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const tags = await readTags({ bustCache: true });
+    try {
+      return assertCanaryDistTags({ beforeLatest, expectedCanary, tags });
+    } catch (error) {
+      if (!(error instanceof CanaryDistTagMismatchError)) throw error;
+      lastObservedCanary = tags.canary ?? "";
+      lastError = error;
+      if (attempt < attempts) await sleep(delayMs);
+    }
+  }
+  throw new Error(
+    `npm accepted the canary publish but did not expose it after ${attempts} dist-tag checks: `
+    + `${lastError?.message || `last dist-tags.canary was ${lastObservedCanary || "<none>"}.`} `
+    + "This is registry propagation lag, not an unpublished tarball.",
+  );
+}
+
 async function readDistTags({ allowMissing, bustCache = false } = {}) {
   const url = bustCache ? `${DIST_TAGS_URL}?t=${Date.now()}` : DIST_TAGS_URL;
   let lastError;
@@ -67,8 +111,7 @@ async function main([command, ...args]) {
   }
   if (command === "assert-canary" && args.length === 2) {
     const [expectedCanary, beforeLatest] = args;
-    const tags = await readDistTags({ bustCache: true });
-    const { latest } = assertCanaryDistTags({ expectedCanary, beforeLatest, tags });
+    const { latest } = await verifyCanaryDistTags({ expectedCanary, beforeLatest });
     appendSummary([
       "## Canary published",
       "",

package/src/runtimeBrand.js

@@ -46,7 +46,7 @@ const DEFAULT = Object.freeze({
   cli: Object.freeze({
     command: "impel",
     packageName: "impel-cli",
-    configNamespace: "impel",
+    configNamespace: "impel-canary",
     providerId: "impel",
     managedMarker: "impel-cli",
     environmentPrefix: "IMPEL",