@bounded-systems/mint 0.4.3 → 0.4.15

package/.github/npm-trusted-publisher.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://json.schemastore.org/package.json",
+  "_comment": "Declarative record of the npm trusted publisher configuration for @bounded-systems/mint. Apply manually at https://www.npmjs.com/package/@bounded-systems/mint/access until npm exposes a public API for this.",
+  "provider": "github-actions",
+  "organization": "bounded-systems",
+  "repository": "mint",
+  "workflow": "release.yml",
+  "environment": null,
+  "permissions": ["npm publish"]
+}

package/.github/workflows/release.yml

@@ -1,14 +1,16 @@
 name: release
 
 # On a vX.Y.Z tag (pushed by `mint release`):
-#   release  — test, pack, SLSA-attest the tarball, emit + keyless-sign the
-#              in-toto release Statement (tag → version plan → commit), publish
-#              the GitHub release (notes from the tag annotation mint wrote) with
-#              the statement + its Sigstore bundle attached.
-#   publish  — stage on npm via OIDC trusted publishing (no tokens, ever) and
-#              publish to JSR. The npm package is staged, not live: a maintainer
-#              must approve it with 2FA before it appears on the registry.
-#              See job summary for the stage ID + approval instructions.
+#   release — test, pack, SLSA-attest the tarball, emit + keyless-sign the
+#             in-toto release Statement (tag → version plan → commit), publish
+#             the GitHub release (notes from the tag annotation mint wrote) with
+#             the statement + its Sigstore bundle attached.
+#   approve — gated by the `npm-publish` GitHub Environment (required reviewer).
+#             No-op job: a maintainer approves in the Actions UI, which unblocks
+#             all deploy jobs below. Add new deploy targets as separate jobs with
+#             needs: [release, approve].
+#   npm     — publish to npm via OIDC trusted publishing (no token).
+#   jsr     — publish to JSR via OIDC (no token).
 #
 # This workflow covers: npm (staged) + JSR + GitHub release.
 # Out of scope here — triggered separately on the same tag:
@@ -40,7 +42,7 @@ jobs:
         id: pack
         run: echo "tgz=$(npm pack | tail -1)" >> "$GITHUB_OUTPUT"
       - name: Attest build provenance (SLSA)
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: ${{ steps.pack.outputs.tgz }}
       # Release provenance: the deterministic in-toto Statement binding this tag to
@@ -66,60 +68,34 @@ jobs:
             mint-release.intoto.json \
             mint-release.intoto.sigstore.json
 
-  publish:
+  approve:
     needs: release
     runs-on: ubuntu-latest
+    environment: npm-publish   # required reviewer — approving here unblocks all deploys
+    steps:
+      - run: echo "Approved."
+
+  npm:
+    needs: [release, approve]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: "24"                       # npm 11.15.0+ required for staged publishing
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
       - run: npm ci --no-audit --no-fund
-      - name: Publish or stage on npm (OIDC trusted publishing — no token)
-        id: stage
-        continue-on-error: true # JSR is the source of truth; npm failure must not block it
-        run: |
-          npm install -g npm@latest                # ensure npm 11.15.0+ for staged publishing
-          echo "npm version: $(npm --version)"
-          PKG=$(node -p "require('./package.json').name")
-          # npm stage publish requires the package to already exist on the registry.
-          # On first publish, fall back to npm publish to seed it; all subsequent
-          # releases go through the staged flow (human 2FA approval required).
-          if npm view "$PKG" version 2>/dev/null; then
-            echo "package exists — using npm stage publish"
-            npm stage publish --access public --provenance 2>&1 | tee /tmp/stage-out.txt || true
-          else
-            echo "first publish — seeding with npm publish (staged publishing requires existing package)"
-            npm publish --access public --provenance 2>&1 | tee /tmp/stage-out.txt || true
-          fi
-          STAGE_OUT=$(cat /tmp/stage-out.txt)
-          STAGE_ID=$(echo "$STAGE_OUT" | grep -oE '[A-Za-z0-9]{8}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{12}' | head -1 || true)
-          echo "stage_id=${STAGE_ID}" >> "$GITHUB_OUTPUT"
-      - name: Surface approval instructions
-        env:
-          STAGE_ID: ${{ steps.stage.outputs.stage_id }}
-          PKG: ${{ github.repository }}
-        run: |
-          {
-            echo "## npm package staged — human approval required"
-            echo ""
-            echo "The package is in the staging area, **not yet live on the registry**."
-            echo "A maintainer must approve it with 2FA before it becomes publicly available."
-            echo ""
-            if [ -n "$STAGE_ID" ]; then
-              echo "**Stage ID:** \`${STAGE_ID}\`"
-              echo ""
-              echo "**Approve via CLI (2FA required):**"
-              echo '```'
-              echo "npm stage approve ${STAGE_ID}"
-              echo '```'
-            else
-              echo "> Could not parse stage ID from npm output."
-              echo "> Run \`npm stage list @bounded-systems/mint\` to find it."
-            fi
-            echo ""
-            echo "**Or approve on npmjs.com:** open the [Staged Packages](https://www.npmjs.com/settings/~/packages/staged) tab."
-          } >> "$GITHUB_STEP_SUMMARY"
+      - name: Publish to npm (OIDC trusted publishing — no token)
+        run: npm publish --access public --provenance
+
+  jsr:
+    needs: [release, approve]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: "24"
+      - run: npm ci --no-audit --no-fund
       - name: Publish to JSR (OIDC — no token)
         run: npx jsr publish --allow-slow-types

package/CHANGELOG.md

@@ -1,5 +1,77 @@
 # Changelog
 
+## 0.4.15 — 2026-06-29
+
+### Patch
+
+- add repository field to package.json — required by npm provenance verification to match the GitHub repo URL in the OIDC claims
+
+## 0.4.14 — 2026-06-29
+
+### Patch
+
+- revert _authToken strip — the empty NODE_AUTH_TOKEN reference in .npmrc is what triggers npm's OIDC exchange; stripping it causes ENEEDAUTH; trusted publisher config (no environment, publish allowed) is the real fix
+
+## 0.4.13 — 2026-06-29
+
+### Patch
+
+- fix npm OIDC auth — restore registry-url and strip the injected empty _authToken before publishing so npm can fall through to its OIDC trusted-publishing exchange
+
+## 0.4.12 — 2026-06-29
+
+### Patch
+
+- remove registry-url from npm job setup-node — injected NODE_AUTH_TOKEN conflicts with OIDC trusted publishing auth exchange
+
+## 0.4.11 — 2026-06-29
+
+### Patch
+
+- split publish into approve (gate) + npm + jsr as independent parallel jobs — one approval unblocks all deploys, each target has its own job log and can be retried independently
+
+## 0.4.10 — 2026-06-29
+
+### Patch
+
+- unify npm + JSR behind a single publish job gated by the npm-publish GitHub Environment — one approval deploys to all registries
+
+## 0.4.9 — 2026-06-29
+
+### Patch
+
+- replace npm staged publishing with direct npm publish gated behind the GitHub Environment approval — same human gate, no dependency on unfinished npm staging OIDC support
+
+## 0.4.8 — 2026-06-29
+
+### Patch
+
+- fix npm stage publish OIDC scope — move npm stage publish into the npm-approve job (environment: npm-publish) so the OIDC token carries the environment claim required by the trusted publisher
+
+## 0.4.7 — 2026-06-29
+
+### Patch
+
+- retry staged npm publish — trusted publisher now has stage action + environment scoped to npm-publish
+
+## 0.4.6 — 2026-06-29
+
+### Patch
+
+- bump actions/attest-build-provenance to v4.1.1 (Node 24, clears deprecation warnings); add npm-publish GitHub Environment gate with required reviewer before surfacing the npm stage approve command
+
+## 0.4.5 — 2026-06-29
+
+### Patch
+
+- fix registry existence check — use curl instead of `npm view` (NODE_AUTH_TOKEN in .npmrc was causing the lookup to fail, always falling through to first-publish path)
+
+## 0.4.4 — 2026-06-29
+
+### Patch
+
+- first staged npm release — package now seeded, all future releases go through `npm stage publish` with human 2FA approval
+
 ## 0.4.3 — 2026-06-29
 
 ### Patch

package/README.md

@@ -106,16 +106,15 @@ mint ships from `release.yml` on each `v*` tag via **OIDC trusted publishing**
 no `NPM_TOKEN`, no JSR token, ever. The package manifests are kept in lockstep by
 `mint version` (it bumps `package.json`, `package-lock.json`, **and** `jsr.json`).
 
-**npm uses staged publishing** — `npm stage publish` submits the package to a
-staging area rather than making it live immediately. A maintainer must approve it
-with 2FA before it appears on the registry:
+**npm uses a GitHub Environment gate** — the `npm-approve` job is blocked by the
+`npm-publish` environment, which requires a designated reviewer to approve in the
+GitHub Actions UI before `npm publish` runs. Approve at:
 
-```sh
-npm stage approve <stage-id>   # CLI, 2FA required
-# or: npmjs.com → Staged Packages tab → Approve
+```
+https://github.com/bounded-systems/mint/actions
 ```
 
-The stage ID is surfaced in the GitHub Actions job summary after each release run.
+Once approved, the package publishes immediately via OIDC trusted publishing (no token).
 
 **JSR publishes immediately** on the same tag (no staging concept on JSR).
 
@@ -167,7 +166,7 @@ releaseStatement({
 - [x] `mint release` — signed tag + in-toto release provenance, keyless-signed in CI (cosign/Sigstore; anchored-chain-shaped)
 - [ ] verbspec-typed CLI + MCP surface
 - [x] Reusable `workflow_call` Action (`version.yml` + `release-provenance.yml`)
-- [x] Publish to npm (staged, human 2FA approval gate) + JSR
+- [x] Publish to npm (GitHub Environment approval gate) + JSR
 
 Tracking: [bounded-systems/string-audit#43](https://github.com/bounded-systems/string-audit/issues/43).
 

package/jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/mint",
-  "version": "0.4.3",
+  "version": "0.4.15",
   "license": "PolyForm-Noncommercial-1.0.0",
   "exports": {
     ".": "./plan.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/mint",
-  "version": "0.4.3",
+  "version": "0.4.15",
   "description": "Deterministic versioning capability — intent files in, signed release out. A seam over semver: own the flow, delegate the arithmetic.",
   "type": "module",
   "bin": {
@@ -15,6 +15,10 @@
     "test": "node --test",
     "plan": "node mint.mjs plan"
   },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bounded-systems/mint.git"
+  },
   "license": "PolyForm-Noncommercial-1.0.0",
   "dependencies": {
     "semver": "^7.6.0",