@blockcast/moq-media-sync 0.1.0-blockcast.1 → 0.1.0-blockcast.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +30 -9
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -6,16 +6,18 @@ Delivery callbacks stage effects and return a commit function. Resetting or canc
|
|
|
6
6
|
|
|
7
7
|
## Release
|
|
8
8
|
|
|
9
|
-
`@moq
|
|
10
|
-
[
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
9
|
+
`@blockcast/moq-media-sync` is the permanent published home of this package. It was proposed upstream to
|
|
10
|
+
[moq-dev/moq](https://github.com/moq-dev/moq) as moq-dev/moq#5423 from
|
|
11
|
+
[Blockcast/moq `feat/media-sync-core`](https://github.com/Blockcast/moq/tree/feat/media-sync-core); moq-dev closed
|
|
12
|
+
that PR unmerged on 2026-10-15, so there will be no upstream release. `release.json` keeps the proposal as history.
|
|
13
|
+
The workspace name stays `@moq/media-sync` so Hang imports it unchanged, but the `@moq` scope belongs to moq-dev, so
|
|
14
|
+
this workspace package is private and is never published under that name.
|
|
15
|
+
|
|
16
|
+
Consumers outside this repository install the Blockcast release through an npm alias, which keeps
|
|
15
17
|
their `@moq/media-sync` imports unchanged:
|
|
16
18
|
|
|
17
19
|
```json
|
|
18
|
-
"@moq/media-sync": "npm:@blockcast/moq-media-sync@0.1.0-blockcast.
|
|
20
|
+
"@moq/media-sync": "npm:@blockcast/moq-media-sync@0.1.0-blockcast.2"
|
|
19
21
|
```
|
|
20
22
|
|
|
21
23
|
`bun run pack:blockcast` builds that tarball with the identity and upstream provenance in `release.json`, records
|
|
@@ -23,5 +25,24 @@ the source commit in the manifest's `blockcast.source`, refuses `file:`/`link:`/
|
|
|
23
25
|
specs, installs it into a temporary consumer, imports both entrypoints, runs the shared clock vectors, and removes
|
|
24
26
|
the temporary files.
|
|
25
27
|
|
|
26
|
-
|
|
27
|
-
|
|
28
|
+
Releases are published from CI by `.github/workflows/publish-media-sync.yml`: bump `version` in `release.json`, merge,
|
|
29
|
+
then push the tag `media-sync-v<version>` on that main commit. The workflow refuses a tag whose version differs from
|
|
30
|
+
`release.json` or the packed manifest, a commit main does not contain, a packed `blockcast.source` that is not the
|
|
31
|
+
tagged commit, or a local-path dependency, then publishes through npm trusted publishing (environment `npm-publish`).
|
|
32
|
+
There is no npm provenance attestation: this repo is private and npm refuses provenance for a private source repo. A
|
|
33
|
+
`workflow_dispatch` run is a dry run that packs, verifies and prints the tarball sha512 without publishing.
|
|
34
|
+
|
|
35
|
+
These guards run from the tagged commit's own copy of the workflow, and npm's trusted-publisher binding (repo,
|
|
36
|
+
workflow file, environment) names no ref, so anyone who can push a tag could run an edited copy without them. They are
|
|
37
|
+
only binding once the repo settings back them, before the npm binding is made: the `npm-publish` environment exists
|
|
38
|
+
with a Tag deployment rule `media-sync-v*` (not "protected branches only", which refuses every tag run) and a named
|
|
39
|
+
required reviewer (on a private repo, required reviewers depend on the GitHub plan), and a tag ruleset restricts who
|
|
40
|
+
can create, update or delete `media-sync-v*` tags (Restrict creations, Restrict updates and Restrict deletions, bypass
|
|
41
|
+
for the release owner only). Restricting creations alone is not enough: moving an existing tag forward to a child
|
|
42
|
+
commit with an edited workflow is a fast-forward, which "Block force pushes" does not stop.
|
|
43
|
+
|
|
44
|
+
The npm binding must allow direct publishing. A trusted-publisher configuration created after 2026-09-03 allows only
|
|
45
|
+
`npm stage publish` by default; this workflow runs `npm publish`, so the binding needs *Allowed actions: npm publish*,
|
|
46
|
+
or npm refuses the publish. A new configuration expires unless its first publish succeeds within 2 days, so make the
|
|
47
|
+
binding only when the first tag is ready to push. The publish step logs at `verbose`, so a refused OIDC exchange is
|
|
48
|
+
visible instead of a generic E401/E404.
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@blockcast/moq-media-sync",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "0.1.0-blockcast.
|
|
4
|
+
"version": "0.1.0-blockcast.2",
|
|
5
5
|
"description": "Transport-neutral media clock and generation-safe delivery queue",
|
|
6
6
|
"license": "(MIT OR Apache-2.0)",
|
|
7
7
|
"repository": {
|
|
@@ -21,7 +21,7 @@
|
|
|
21
21
|
}
|
|
22
22
|
},
|
|
23
23
|
"blockcast": {
|
|
24
|
-
"source": "Blockcast/hang-mmt-fec@
|
|
24
|
+
"source": "Blockcast/hang-mmt-fec@8efe6f390cbc9eafd09eac9ccfb6098087473126",
|
|
25
25
|
"upstream": {
|
|
26
26
|
"package": "@moq/media-sync",
|
|
27
27
|
"repository": "https://github.com/moq-dev/moq",
|
|
@@ -29,6 +29,6 @@
|
|
|
29
29
|
"proposal": "https://github.com/Blockcast/moq/tree/feat/media-sync-core",
|
|
30
30
|
"proposalCommit": "a4f8a552f952c683b72cf1a6365bf5a476910e60"
|
|
31
31
|
},
|
|
32
|
-
"
|
|
32
|
+
"permanent": "@blockcast/moq-media-sync is the permanent home of this package: moq-dev closed moq-dev/moq#5423 unmerged on 2026-10-15, so there will be no @moq/media-sync release to switch back to. upstream records the declined proposal as history."
|
|
33
33
|
}
|
|
34
34
|
}
|