@bounded-systems/mint 0.4.15 → 0.5.0

package/.github/workflows/standard.yml

@@ -0,0 +1,15 @@
+name: standard
+on:
+  push:
+    branches: [main]
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  standard:
+    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@d43c3280588ef05f4ead43426db1091d4cb8f520
+    with:
+      security: true
+      test: true
+      runtime: node
+      test-command: "npm ci --no-audit --no-fund && npm test"

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.5.0 — 2026-07-05
+
+### Minor
+
+- read + bump `deno.json` (not just `package.json`/`jsr.json`) — unblocks every Deno/JSR package in the org from adopting mint (fixes #13; unblocks gh-project-room#47)
+
+### Patch
+
+- docs: document the minimumDependencyAge 24h JSR/npm cooldown for consumers and its batch-rollout ripple (#11)
+
 ## 0.4.15 — 2026-06-29
 
 ### Patch

package/README.md

@@ -137,6 +137,54 @@ JSR type-checker resolves mint's `node:` imports.
 > authorizes the keyless OIDC publish; after it, every tagged release publishes
 > with no token.
 
+### Consumers: the 24h JSR/npm cooldown after a release
+
+Every fresh JSR/npm publish immediately hits Deno's
+[`minimumDependencyAge`](https://docs.deno.com/runtime/packages/supply_chain/)
+in any consumer running Deno 2.9+: since 2.9 it defaults to **24 hours** — Deno
+refuses to resolve a version published inside that window, full stop, no
+config needed to trigger it. It's a real supply-chain guard (malicious
+versions are usually caught/yanked within days), but it applies to first-party
+`@bounded-systems/*` releases exactly the same as to a random third party.
+
+Concretely: `baobab@0.2.0` published, and every downstream consumer's CI
+(e.g. a `check-contrast.yml` caller) hard-failed for the next 24h trying to
+resolve it — not a flake, a guaranteed wait baked into every release
+([bounded-systems/mint#11](https://github.com/bounded-systems/mint/issues/11)).
+For one package that's a wait; for a coordinated rollout of several
+interdependent `@bounded-systems/*` packages in one sitting, it ripples —
+every consumer of every package in the batch eats the same 24h, and chains of
+dependencies compound it.
+
+**The fix does NOT live in a consumer's `deno.json`.** An earlier version of
+this doc claimed a `minimumDependencyAge.exclude` list there would work —
+that was wrong, and only looked right because it was tested against Deno
+2.8.3 (which doesn't enforce the 24h default at all; the default only started
+in 2.9). Verified against the real `2.9.1` binary: `deno.json` is never even
+read when `deno run`'s entrypoint is a bare `jsr:...` specifier — config-file
+discovery only applies in normal "project mode." Planting invalid JSON in a
+`deno.json` and confirming Deno never complained is what exposed this.
+
+**What actually works:** the `--minimum-dependency-age` CLI flag on the
+invocation itself. That means the fix has to live wherever the `deno run`
+command is composed — for a reusable GitHub Actions workflow like
+`check-contrast.yml`, that's an input on the workflow, not something a caller
+can override from its own repo
+([bounded-systems/baobab#7](https://github.com/bounded-systems/baobab/pull/7)
+adds `minimum-dependency-age`, defaulting to `"0"`, since the only thing that
+workflow ever resolves from the network is `@bounded-systems/baobab` itself —
+a first-party package the caller already trust-bounds via its own version
+range input, so the age gate adds no real protection there). Any other
+reusable workflow or script that shells out to `deno run jsr:...`/`npm:...`
+directly needs the same treatment: an explicit `--minimum-dependency-age`
+(or `--minimum-dependency-age=0` if every dependency it touches is
+first-party) on the command, not a config file a caller drops in.
+
+This still doesn't scale past a handful of hand-fixed workflows — #11 is the
+open ask for mint to own generating this consistently across every
+`@bounded-systems/*` reusable workflow, rather than fixing each one by hand
+as it's hit.
+
 ## Library
 
 ```js

package/jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/mint",
-  "version": "0.4.15",
+  "version": "0.5.0",
   "license": "PolyForm-Noncommercial-1.0.0",
   "exports": {
     ".": "./plan.mjs",

package/mint.mjs

@@ -34,10 +34,23 @@ async function readJson(path) {
   return JSON.parse(await readFile(path, "utf8"));
 }
 
+// The version lives in whichever manifest a repo uses: deno.json (Deno),
+// jsr.json (JSR-from-npm), or package.json (npm). A repo may carry several kept
+// in lockstep. Detect the first present one that declares a version.
+const MANIFESTS = ["deno.json", "jsr.json", "package.json"];
+
 async function currentVersion() {
-  const pkg = await readJson("package.json");
-  if (!pkg.version) throw new Error("package.json has no version field");
-  return pkg.version;
+  for (const path of MANIFESTS) {
+    try {
+      const m = await readJson(path);
+      if (m.version) return m.version;
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  throw new Error(
+    `no manifest with a version field (looked for: ${MANIFESTS.join(", ")})`,
+  );
 }
 
 async function cmdPlan() {
@@ -63,10 +76,25 @@ async function cmdVersion() {
     return;
   }
 
-  // Bump the manifest (+ lockfile if present), preserving 2-space JSON.
-  const pkg = await readJson("package.json");
-  pkg.version = p.nextVersion;
-  await writeFile("package.json", JSON.stringify(pkg, null, 2) + "\n");
+  // Bump every manifest present (deno.json / jsr.json / package.json) in
+  // lockstep, preserving 2-space JSON.
+  const bumped = [];
+  for (const path of MANIFESTS) {
+    try {
+      const m = await readJson(path);
+      m.version = p.nextVersion;
+      await writeFile(path, JSON.stringify(m, null, 2) + "\n");
+      bumped.push(path);
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  if (bumped.length === 0) {
+    throw new Error(
+      `no manifest to bump (looked for: ${MANIFESTS.join(", ")})`,
+    );
+  }
+  // Keep an npm lockfile in lockstep if present.
   try {
     const lock = await readJson("package-lock.json");
     lock.version = p.nextVersion;
@@ -75,14 +103,6 @@ async function cmdVersion() {
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
-  // Keep jsr.json in lockstep (JSR has its own manifest version).
-  try {
-    const jsr = await readJson("jsr.json");
-    jsr.version = p.nextVersion;
-    await writeFile("jsr.json", JSON.stringify(jsr, null, 2) + "\n");
-  } catch (e) {
-    if (e.code !== "ENOENT") throw e;
-  }
 
   // Prepend the entry to CHANGELOG.md (create with a header if absent).
   let changelog = "";
@@ -95,7 +115,7 @@ async function cmdVersion() {
   // Consume the intents.
   for (const i of intents) if (i.file) await unlink(i.file);
 
-  console.log(`mint: ${p.currentVersion} → ${p.nextVersion} (${p.bump}). Updated package.json + CHANGELOG.md, consumed ${intents.length} intent(s).`);
+  console.log(`mint: ${p.currentVersion} → ${p.nextVersion} (${p.bump}). Updated ${bumped.join(" + ")} + CHANGELOG.md, consumed ${intents.length} intent(s).`);
   console.log(`Next: commit, then \`mint release\` to cut the tag + emit release provenance.`);
 }
 
@@ -122,9 +142,7 @@ function ciBuilder() {
 // (reads package.json + CHANGELOG + git HEAD + CI env); delegates the pure shape
 // to release.mjs. Throws with a CLI-friendly message on a missing changelog entry.
 async function gatherStatement() {
-  const pkg = await readJson("package.json");
-  const version = pkg.version;
-  if (!version) throw new Error("package.json has no version");
+  const version = await currentVersion();
   const tag = `v${version}`;
 
   let changelog = "";

package/mint.test.mjs

@@ -177,3 +177,37 @@ test("DSSE pre-authentication encoding wraps the canonical statement", () => {
   assert.ok(pae.startsWith(`DSSEv1 ${DSSE_PAYLOAD_TYPE.length} ${DSSE_PAYLOAD_TYPE} ${Buffer.byteLength(payload)} `));
   assert.ok(pae.endsWith(payload));
 });
+
+// ── CLI manifest handling: mint reads/bumps deno.json, not just package.json (#13)
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const MINT = fileURLToPath(new URL("./mint.mjs", import.meta.url));
+
+function bumpIn(manifestName) {
+  const d = mkdtempSync(join(tmpdir(), "mint-cli-"));
+  try {
+    writeFileSync(
+      join(d, manifestName),
+      JSON.stringify({ name: "@x/y", version: "0.1.0", exports: "./m.ts" }, null, 2) + "\n",
+    );
+    mkdirSync(join(d, ".release"));
+    writeFileSync(join(d, ".release", "i.md"), "---\nbump: minor\n---\nx\n");
+    execFileSync("node", [MINT, "version"], { cwd: d, stdio: "pipe" });
+    return JSON.parse(readFileSync(join(d, manifestName), "utf8")).version;
+  } finally {
+    rmSync(d, { recursive: true, force: true });
+  }
+}
+
+test("mint version bumps a deno.json-only repo (#13)", () => {
+  assert.equal(bumpIn("deno.json"), "0.2.0");
+});
+
+test("mint version still bumps a jsr.json / package.json repo", () => {
+  assert.equal(bumpIn("jsr.json"), "0.2.0");
+  assert.equal(bumpIn("package.json"), "0.2.0");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/mint",
-  "version": "0.4.15",
+  "version": "0.5.0",
   "description": "Deterministic versioning capability — intent files in, signed release out. A seam over semver: own the flow, delegate the arithmetic.",
   "type": "module",
   "bin": {

package/.github/workflows/ci.yml

@@ -1,20 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
-        with:
-          node-version: "22"
-      - run: npm ci --no-audit --no-fund
-      - run: npm test