Harden npm package distribution proof #43

Merged

pdurlej merged 2 commits from codex/package-distribution-proof into main

2026-05-18 23:34:18 +02:00

codex commented

2026-05-18 18:54:49 +02:00

Collaborator

Canary Context Pack

Product story

Fork B owns Package Distribution. Before alpha publish, the release proof should catch npm packaging drift locally, especially cases where npm pack looks fine but npm publish --dry-run would alter package metadata.

What changed

Added npm run publish:dry-run as an explicit non-publishing alpha dry-run gate.
Updated release:smoke to run that publish dry-run and fail if npm reports metadata auto-correction such as a missing/stripped CLI bin.
Added scripts/build.mjs so npm run build compiles with tsc and sets dist/cli.js executable for npm bin publishing.
Normalized package.json#bin.fallow-ts to npm's canonical dist/cli.js path.
Updated package tests and release checklist for the new distribution gates.

Why it changed

While implementing the dry-run gate, npm publish --dry-run exposed a real release blocker: npm would auto-correct package metadata and remove the CLI bin because dist/cli.js was not executable at publish validation time. This PR makes that failure visible and fixes it.

Files touched

scripts/build.mjs
scripts/release-smoke.mjs
package.json
tests/package.test.mjs
docs/release-checklist.md

Relevant context

Fork B / Package Distribution Context from the alpha release train.
Built in isolated worktree /Users/pd/Developer/fallow-ts-package-distribution because the main worktree had uncommitted Release Identity changes.
Based on main after PR #39.

Runtime evidence

npm ci
npm run build
npm run publish:dry-run
npm run release:smoke
npm test — 34/34 passing
npm run pack:dry-run
node dist/cli.js analyze --root . --format json --output /tmp/fallow-ts-report.json
node dist/cli.js analyze --root examples/demo-project --format text
git diff --check

Known constraints

npm publish --dry-run still prints npm's normal dry-run login warning. That is allowed. The release-smoke guard blocks metadata drift warnings, not the harmless dry-run login warning.

Coordination notes

This PR overlaps package.json with Fork A / PR #40. Recommended merge order remains #40 first, then this PR rebased or updated if needed. No version, changelog release cut, CI workflow, adoption prose, parser, resolver, or finding changes are included.

Explicit out-of-scope

No npm publish, no version bump, no package name ownership claim, no CI matrix changes, no analyzer changes, no new runtime dependencies.

Requested decision

Approve merge if the distribution proof is appropriate and the bin executable fix belongs in Package Distribution.

Merge blockers

npm publish --dry-run still auto-correcting metadata, release-smoke depending on registry publication, failing package tests, or crossing into release identity / CI / analyzer ownership.

## Canary Context Pack ### Product story Fork B owns Package Distribution. Before alpha publish, the release proof should catch npm packaging drift locally, especially cases where `npm pack` looks fine but `npm publish --dry-run` would alter package metadata. ### What changed - Added `npm run publish:dry-run` as an explicit non-publishing alpha dry-run gate. - Updated `release:smoke` to run that publish dry-run and fail if npm reports metadata auto-correction such as a missing/stripped CLI bin. - Added `scripts/build.mjs` so `npm run build` compiles with `tsc` and sets `dist/cli.js` executable for npm `bin` publishing. - Normalized `package.json#bin.fallow-ts` to npm's canonical `dist/cli.js` path. - Updated package tests and release checklist for the new distribution gates. ### Why it changed While implementing the dry-run gate, `npm publish --dry-run` exposed a real release blocker: npm would auto-correct package metadata and remove the CLI bin because `dist/cli.js` was not executable at publish validation time. This PR makes that failure visible and fixes it. ### Files touched - `scripts/build.mjs` - `scripts/release-smoke.mjs` - `package.json` - `tests/package.test.mjs` - `docs/release-checklist.md` ### Relevant context - Fork B / Package Distribution Context from the alpha release train. - Built in isolated worktree `/Users/pd/Developer/fallow-ts-package-distribution` because the main worktree had uncommitted Release Identity changes. - Based on `main` after PR #39. ### Runtime evidence - `npm ci` - `npm run build` - `npm run publish:dry-run` - `npm run release:smoke` - `npm test` — 34/34 passing - `npm run pack:dry-run` - `node dist/cli.js analyze --root . --format json --output /tmp/fallow-ts-report.json` - `node dist/cli.js analyze --root examples/demo-project --format text` - `git diff --check` ### Known constraints `npm publish --dry-run` still prints npm's normal dry-run login warning. That is allowed. The release-smoke guard blocks metadata drift warnings, not the harmless dry-run login warning. ### Coordination notes This PR overlaps `package.json` with Fork A / PR #40. Recommended merge order remains #40 first, then this PR rebased or updated if needed. No version, changelog release cut, CI workflow, adoption prose, parser, resolver, or finding changes are included. ### Explicit out-of-scope No npm publish, no version bump, no package name ownership claim, no CI matrix changes, no analyzer changes, no new runtime dependencies. ### Requested decision Approve merge if the distribution proof is appropriate and the `bin` executable fix belongs in Package Distribution. ### Merge blockers `npm publish --dry-run` still auto-correcting metadata, release-smoke depending on registry publication, failing package tests, or crossing into release identity / CI / analyzer ownership.

codex added 1 commit

2026-05-18 18:54:49 +02:00

Harden npm publish dry-run proof

CI / test (push) Failing after 15s

Details

CI / test (pull_request) Failing after 14s

Details

4814e8f6b3

Adds an explicit npm publish dry-run gate to the package distribution proof and wires release smoke to fail when npm reports metadata auto-correction.

Also fixes a real npm packaging blocker: build now sets dist/cli.js executable and package bin uses npm's canonical dist/cli.js path, so npm publish dry-run no longer strips the CLI bin.

Verified:

- npm ci

- npm run build

- npm run publish:dry-run

- npm run release:smoke

- npm test

- npm run pack:dry-run

- node dist/cli.js analyze --root . --format json --output /tmp/fallow-ts-report.json

- node dist/cli.js analyze --root examples/demo-project --format text

- git diff --check

codex requested review from claude

2026-05-18 18:54:54 +02:00

codex referenced this pull request

2026-05-18 23:12:29 +02:00

Make per-file IO error test deterministic #44

codex added 1 commit

2026-05-18 23:22:53 +02:00

Merge remote-tracking branch 'origin/main' into codex/package-distribution-proof

CI / test (push) Successful in 14s

Details

CI / test (pull_request) Successful in 14s

Details