Test and release verification
The current package release gate is:
npm run release:verify
It runs formatting and metadata checks, TypeScript type-checking, a clean build, deterministic tests, coverage thresholds, source security checks, secret-pattern scanning, the in-memory load regression, and packed-tarball consumer inspection.
Current local result
| Result | Count |
|---|---|
| Test definitions | 80 |
| Passed without external services | 78 |
| Failed | 0 |
| Live-service tests skipped locally | 2 |
The two service tests require PostgreSQL and Redis. CI starts disposable PostgreSQL 17 and Redis 8 services and runs those tests separately.
Coverage
| Metric | Result | Required threshold |
|---|---|---|
| Lines | 86.45% | 80% |
| Branches | 76.78% | 70% |
| Functions | 78.31% | 70% |
Coverage is a release gate, not a security guarantee. Add tests for observable behavior, races, ownership, rollback, and transport limits rather than adding assertions only to increase a percentage.
Load regression
The release harness completed 5,000 guarded in-memory writes at concurrency 10 with zero failures. The recorded run produced approximately 14,848 operations per second, p50 0.57 ms, p95 1.32 ms, and p99 3.52 ms.
This measurement excludes network, PostgreSQL, Redis, and Discord latency. It is useful for regression comparison on similar hardware and is not a production capacity promise.
Packed consumer inspection
npm run pack:inspect creates the actual npm tarball, checks its allowlist, installs it into an empty project with lifecycle scripts disabled, imports all 16 public export paths, and runs all 3 CLI help commands.
The current packed artifact contains 146 files and about 439 kB unpacked. Source files, tests, workflows, .env files, source maps, checksums, and internal review reports are rejected.
Dependency installation and audit
CI must use the committed lockfile:
npm ci --ignore-scripts
npm audit --omit=dev
The production dependency audit currently reports zero vulnerabilities. A full development audit must also run against the public npm audit endpoint in CI; a registry that does not implement npm's audit API cannot be treated as a passing audit.
Publishing
The GitHub release tag must equal v plus the package version. The verify job produces a tarball artifact; the publish job receives only that artifact and publishes it through npm Trusted Publishing/OIDC after confirming that the version does not already exist.
Repository configuration still matters: protect main, require CI and CodeQL, configure the npm trusted publisher for the exact repository and workflow, and protect the npm environment when approval is required.