fix(release): advance immutable prerelease collisions

[kattsushi]

Summary

• keep Nx's calculated release candidate authoritative
• query successful package-level registry history before any release-tree flush
• advance occupied same-channel prereleases to the first unused counter
• fail closed on unreadable history, auth/network/server errors, malformed SemVer data and stable collisions
• preserve root changelog behavior and sanitize registry errors

This fixes the immutable @effectify/react-query@1.0.0-beta.0 collision blocking beta promotion PR #225 without importing a synthetic Git tag or skipping the package.

Security and lifecycle contract

• registry query uses exact argv: npm view <package> versions --json
• every E404 is ambiguous and fails closed; there is no not-found success path
• credentials, query strings, fragments and child-process details are never rendered
• first publication without readable package history requires a separate explicit path
• Nx calculates before update/flush; failures stop before manifest, changelog, commit, tag or push mutation

TDD evidence

• RED: missing collision factory and then unsafe E404/auth/timeout/semver/redaction behaviors failed as intended
• GREEN: 25/25 release-action tests
• release-policy contract: 10/10
• real npm E404 and mixed failures fail closed
• successful package histories advance React Query beta.0 to beta.1
• simulated registry timeout leaves release manifests and changelog untouched

Exact beta dry-run

Package	Candidate	npm
@effectify/react-router	0.6.0-beta.0	absent
@effectify/react-query	1.0.0-beta.1	absent
@effectify/node-better-auth	0.5.12-beta.0	absent
@effectify/solid-query	0.5.12-beta.0	absent
@effectify/react-router-better-auth	0.5.12-beta.0	absent
@effectify/prisma	1.1.13-beta.0	absent
@effectify/hatchet	0.1.0-beta.0	absent

The dry-run calculated all seven and failed only during GitHub Release preview because the local SSH alias cannot resolve repository metadata; Nx confirmed dry-run made no changes.

Validation

• Node 24.19.0
• Oxfmt and git diff --check: PASS
• affected by these two files: root project only; zero release projects
• disposable worktree cleaned; tracked status exact

Review boundary

The large test diff is an explicit release-safety exception covering every fail-closed branch. Review tools/release-version-actions.cjs for registry/lifecycle behavior and the test file for negative-path completeness.

After merge, #225 must be refreshed, fully revalidated on its new immutable head, and receive fresh human beta authorization.

Closes #228

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 728b2952-b86d-4c99-955e-837a1ef2007e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}