Fix npm release verification

.github/workflows/release.yaml

@@ -4,6 +4,15 @@ on:
   release:
     types:
       - published
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing release tag to verify or resume
+        required: true
+        type: string
+
+env:
+  RELEASE_TAG: ${{ github.event.release.tag_name || inputs.release_tag }}
 
 permissions:
   contents: read
@@ -18,6 +27,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          ref: ${{ env.RELEASE_TAG }}
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -26,8 +36,8 @@ jobs:
           registry-url: https://registry.npmjs.org
           package-manager-cache: false
 
-      - name: Install current npm CLI
-        run: npm install --global npm@12.0.2
+      - name: Install trusted publishing npm CLI
+        run: npm install --global npm@11.5.1
 
       - name: Install JavaScript development dependencies
         run: npm ci
@@ -46,8 +56,11 @@ jobs:
           package_version=$(node --print "require('./packages/engine/package.json').version")
           workspace_version=$(node --print "require('./package.json').version")
           test "$package_version" = "$workspace_version"
-          test "$GITHUB_REF_NAME" = "v$package_version"
-          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+          test "$RELEASE_TAG" = "v$package_version"
+          release_commit=$(git rev-list --max-count=1 "$RELEASE_TAG")
+          test -n "$release_commit"
+          test "$(git rev-parse HEAD)" = "$release_commit"
+          git merge-base --is-ancestor "$release_commit" origin/main
 
       - name: Build browser WebAssembly package
         run: npm run build:wasm

RELEASING.md

@@ -26,6 +26,8 @@ After `@stack-sh/engine` exists on npm, configure its trusted publisher with the
 
 Then create the `v0.1.0` GitHub Release from the same merged revision. The release workflow recognizes that the package version already exists and completes without publishing it twice.
 
+If a published release needs to resume after a workflow-only correction, run the Release workflow manually with the existing exact tag. The recovery path checks out that tag and applies the same version, ancestry, build, test, package-content, and publication checks before it can publish.
+
 ## Subsequent releases
 
 1. Update the workspace and package versions in a pull request.

scripts/validate-npm-pack.mjs

@@ -1,13 +1,16 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 
-const packages = JSON.parse(
+const packResult = JSON.parse(
   execFileSync(
     "npm",
     ["pack", "--dry-run", "--json", "--workspace", "@stack-sh/engine"],
     { encoding: "utf8" },
   ),
 );
+const packages = Array.isArray(packResult)
+  ? packResult
+  : Object.values(packResult);
 assert.equal(packages.length, 1);
 assert.equal(packages[0].name, "@stack-sh/engine");
 assert.deepEqual(