Operator Gate: final npm publish readiness check, no publish

[realproject7]

Parent: #465
Type: Operator Gate

Goal

Final human/operator readiness check before publishing a cleaned plotlink-ows npm package. This ticket does not publish; the operator will handle npm login and publish manually after sign-off.

Required Inputs

• All code sub-tickets under [EPIC] Safe npm dependency and package hygiene for publish readiness #465 are merged.
• Latest main is pulled locally.
• Node 20.x and npm 10.x are active.

Checklist

• Run npm install and confirm warnings are acceptable/documented.
• Run npm audit --omit=dev and confirm remaining advisories are acceptable/documented.
• Run npm run typecheck.
• Run npm test.
• Run npm run app:build.
• Run the package hygiene/preflight command from Add npm package hygiene baseline and release preflight checks #466.
• Confirm npm pack --dry-run --json package contents are clean.
• Install the packed tarball in a temp directory and smoke-test plotlink-ows startup.
• Confirm no secrets/passphrases/wallet data are included in package contents, logs, fixtures, or docs.
• Confirm npm latest/dist-tag plan with the operator before publish.

Acceptance

• Operator posts the final prepublish result and either approves manual npm publish or opens follow-up tickets.
• No npm publish is run by QuadWork agents.

[realproject7]

#472 final operator gate is currently blocked by #479.

Local final verification after Batch 42 found that the package hygiene work is mostly successful (npm audit --omit=dev, typecheck, tests, build, preflight all pass; packed runtime deps exclude @aws-sdk/client-s3, React, and Vite), but the real packed-tarball install/start smoke still fails before serving /api/auth/status:

Error: Schema engine error:
Error: Command failed: npx prisma db push --schema .../node_modules/plotlink-ows/app/prisma/schema.prisma --skip-generate

Keep this operator gate open until #479 is fixed and the packed tarball startup smoke passes under Node 20/npm 10.

[realproject7]

Final local publish-readiness verification after Batch 44 / PR #483 is still blocked. #481 is fixed, but

plotlink-ows@1.2.93 preflight
node scripts/preflight.mjs

=== Expected toolchain ===
engines.node: 20.x
engines.npm: 10.x
packageManager: npm@10.9.8
running node v24.14.1 / npm 11.11.0
! Node v24.14.1 is not 20.x — publish should run on Node 20.x (engines.node).
! npm 11.11.0 is not 10.x — publish should run on npm 10.x (engines.npm / packageManager).

=== Production audit (npm audit --omit=dev) ===
{"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0}
✓ no high/critical production vulnerabilities

=== Runtime dependency boundary (dependencies allowlist) ===
✓ runtime 'dependencies' match the OWS allowlist (11 pkgs; no web-app/S3/build leaks)

=== Packed package contents (npm pack --dry-run) ===
entries: 129 unpacked: 2034KB tarball: 581KB
✓ clean: no node_modules / test / fixture / coverage / screenshot / tarball / cache / temp / secret files
✓ required runtime contents present (bin, README, LICENSE, server, Prisma schema, web dist)

=== Tarball install smoke test ===
✓ tarball installs cleanly; bin + runtime + postinstall prerequisites present (5 checked)
✓ bin/plotlink-ows.js passes node --check

=== Prod-only start smoke (packed tarball install + boot) ===

added 69 packages in 6s
✓ tarball installed prod-only (--omit=dev, scripts on)
✓ removed deps absent from prod install (@aws-sdk/client-s3, react, vite)
✗ server did not serve /api/auth/status within 60s (bin exitCode=1)
✗ server did not serve the prebuilt web UI at /

--- captured server output ---
| ◇ injected env (0) from ../../../../../../../../../var/folders/h2/jnwv3mw16k14k74gb7mqf4xm0000gn/T/plotlink-start-smoke-LIUXHb/home/.plotlink-ows/.env // tip: ◈ secrets for agents [www.dotenvx.com]
| Updated /.plotlink-ows/CLAUDE.md (v1.2.93)
| Prisma schema loaded from app/prisma/schema.prisma
| Datasource "db": SQLite database "local.db" at "file:/var/folders/h2/jnwv3mw16k14k74gb7mqf4xm0000gn/T/plotlink-start-smoke-LIUXHb/home/.plotlink-ows/data/local.db"
|
| Error: Schema engine error:
|
|
| ✗ Database setup failed (prisma db push).
| schema: /private/var/folders/h2/jnwv3mw16k14k74gb7mqf4xm0000gn/T/plotlink-start-smoke-LIUXHb/node_modules/plotlink-ows/app/prisma/schema.prisma
| database: file:/.plotlink-ows/data/local.db
| reason: Command failed: /Users/cho/.nvm/versions/node/v24.14.1/bin/node /private/var/folders/h2/jnwv3mw16k14k74gb7mqf4xm0000gn/T/plotlink-start-smoke-LIUXHb/node_modules/prisma/build/index.js db push --schema /private/var/folders/h2/jnwv3mw16k14k74gb7mqf4xm0000gn/T/plotlink-start-smoke-LIUXHb/node_modules/plotlink-ows/app/prisma/schema.prisma --skip-generate
| This usually means a corrupted install (missing the 'prisma' runtime
| dependency or its query engine). Reinstall with: npx plotlink-ows@latest
✗ prod-only start smoke failed — the packed tarball did not install+boot+serve (see output above).

=== Preflight summary ===
warnings: 2 failures: 1

✗ Preflight FAILED — 1 blocking issue(s). Do not publish. now fails in the packed prod-only startup smoke at Prisma schema-engine startup () before is served. I opened follow-up #484 with the full reproduction and captured output. Keep this operator gate open; no npm publish performed.

[realproject7]

Correction / latest status for #472:

Final local publish-readiness verification after Batch 44 / PR #483 is still blocked. #481 is fixed, but npm run preflight now fails in the packed prod-only startup smoke at Prisma schema-engine startup (prisma db push) before /api/auth/status is served.

I opened follow-up #484 with the full reproduction and captured output. Keep this operator gate open; no npm publish performed.

[realproject7]

Final operator publish-readiness gate is now green on latest main after PR #485 and PR #486.

Environment:

• Node v20.20.2
• npm 10.8.2
• main at 4f1774f (Merge pull request #486 from realproject7/codex/fix-npm-bin-path)
• package version plotlink-ows@1.2.94
• npm registry currently reports latest: 1.0.33, so 1.2.94 has no version collision.

Verification performed locally:

• npm install — passed. The remaining install warning is the known React 19 / valtio nested use-sync-external-store peer warning in dev install output.
• npm audit --omit=dev — passed, 0 vulnerabilities.
• npm run typecheck — passed.
• npm test — passed, 95 test files / 1261 tests.
• npm run app:build — passed.
• npm run preflight — passed with 0 warnings / 0 failures.
  • runtime dependency allowlist passed.
  • packed package contents passed: 131 entries, tarball about 583KB, unpacked about 2038KB.
  • tarball install smoke passed.
  • prod-only packed start smoke passed: fresh HOME install with --omit=dev served both GET /api/auth/status and GET /.
• npm pack --dry-run --json — passed; package contents inspected via npm output.
• npm publish --dry-run — passed cleanly for plotlink-ows@1.2.94.

Previously blocking items are resolved:

• Fix packed tarball startup smoke failing at Prisma db push #479/Fix packed prod-only Prisma schema engine startup failure #484 Prisma schema-engine packed-startup failure is fixed by PR [#484] Apply SQLite schema without the native Prisma schema-engine #485.
• Disable browser auto-open during packed start smoke #481 browser auto-open side effect in release smoke is fixed by PR [#481] Skip CLI browser auto-open during release start smoke #483.
• npm publish-time bin[plotlink-ows] auto-correct warning is removed by PR Fix npm bin path metadata #486.

No npm publish was run. Manual publish can proceed from the operator side when ready.