@bounded-systems/mint 0.4.3 → 0.5.0

package/.github/npm-trusted-publisher.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://json.schemastore.org/package.json",
+  "_comment": "Declarative record of the npm trusted publisher configuration for @bounded-systems/mint. Apply manually at https://www.npmjs.com/package/@bounded-systems/mint/access until npm exposes a public API for this.",
+  "provider": "github-actions",
+  "organization": "bounded-systems",
+  "repository": "mint",
+  "workflow": "release.yml",
+  "environment": null,
+  "permissions": ["npm publish"]
+}

package/.github/workflows/release.yml

@@ -1,14 +1,16 @@
 name: release
 
 # On a vX.Y.Z tag (pushed by `mint release`):
-#   release  — test, pack, SLSA-attest the tarball, emit + keyless-sign the
-#              in-toto release Statement (tag → version plan → commit), publish
-#              the GitHub release (notes from the tag annotation mint wrote) with
-#              the statement + its Sigstore bundle attached.
-#   publish  — stage on npm via OIDC trusted publishing (no tokens, ever) and
-#              publish to JSR. The npm package is staged, not live: a maintainer
-#              must approve it with 2FA before it appears on the registry.
-#              See job summary for the stage ID + approval instructions.
+#   release — test, pack, SLSA-attest the tarball, emit + keyless-sign the
+#             in-toto release Statement (tag → version plan → commit), publish
+#             the GitHub release (notes from the tag annotation mint wrote) with
+#             the statement + its Sigstore bundle attached.
+#   approve — gated by the `npm-publish` GitHub Environment (required reviewer).
+#             No-op job: a maintainer approves in the Actions UI, which unblocks
+#             all deploy jobs below. Add new deploy targets as separate jobs with
+#             needs: [release, approve].
+#   npm     — publish to npm via OIDC trusted publishing (no token).
+#   jsr     — publish to JSR via OIDC (no token).
 #
 # This workflow covers: npm (staged) + JSR + GitHub release.
 # Out of scope here — triggered separately on the same tag:
@@ -40,7 +42,7 @@ jobs:
         id: pack
         run: echo "tgz=$(npm pack | tail -1)" >> "$GITHUB_OUTPUT"
       - name: Attest build provenance (SLSA)
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: ${{ steps.pack.outputs.tgz }}
       # Release provenance: the deterministic in-toto Statement binding this tag to
@@ -66,60 +68,34 @@ jobs:
             mint-release.intoto.json \
             mint-release.intoto.sigstore.json
 
-  publish:
+  approve:
     needs: release
     runs-on: ubuntu-latest
+    environment: npm-publish   # required reviewer — approving here unblocks all deploys
+    steps:
+      - run: echo "Approved."
+
+  npm:
+    needs: [release, approve]
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: "24"                       # npm 11.15.0+ required for staged publishing
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
       - run: npm ci --no-audit --no-fund
-      - name: Publish or stage on npm (OIDC trusted publishing — no token)
-        id: stage
-        continue-on-error: true # JSR is the source of truth; npm failure must not block it
-        run: |
-          npm install -g npm@latest                # ensure npm 11.15.0+ for staged publishing
-          echo "npm version: $(npm --version)"
-          PKG=$(node -p "require('./package.json').name")
-          # npm stage publish requires the package to already exist on the registry.
-          # On first publish, fall back to npm publish to seed it; all subsequent
-          # releases go through the staged flow (human 2FA approval required).
-          if npm view "$PKG" version 2>/dev/null; then
-            echo "package exists — using npm stage publish"
-            npm stage publish --access public --provenance 2>&1 | tee /tmp/stage-out.txt || true
-          else
-            echo "first publish — seeding with npm publish (staged publishing requires existing package)"
-            npm publish --access public --provenance 2>&1 | tee /tmp/stage-out.txt || true
-          fi
-          STAGE_OUT=$(cat /tmp/stage-out.txt)
-          STAGE_ID=$(echo "$STAGE_OUT" | grep -oE '[A-Za-z0-9]{8}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}-[A-Za-z0-9]{12}' | head -1 || true)
-          echo "stage_id=${STAGE_ID}" >> "$GITHUB_OUTPUT"
-      - name: Surface approval instructions
-        env:
-          STAGE_ID: ${{ steps.stage.outputs.stage_id }}
-          PKG: ${{ github.repository }}
-        run: |
-          {
-            echo "## npm package staged — human approval required"
-            echo ""
-            echo "The package is in the staging area, **not yet live on the registry**."
-            echo "A maintainer must approve it with 2FA before it becomes publicly available."
-            echo ""
-            if [ -n "$STAGE_ID" ]; then
-              echo "**Stage ID:** \`${STAGE_ID}\`"
-              echo ""
-              echo "**Approve via CLI (2FA required):**"
-              echo '```'
-              echo "npm stage approve ${STAGE_ID}"
-              echo '```'
-            else
-              echo "> Could not parse stage ID from npm output."
-              echo "> Run \`npm stage list @bounded-systems/mint\` to find it."
-            fi
-            echo ""
-            echo "**Or approve on npmjs.com:** open the [Staged Packages](https://www.npmjs.com/settings/~/packages/staged) tab."
-          } >> "$GITHUB_STEP_SUMMARY"
+      - name: Publish to npm (OIDC trusted publishing — no token)
+        run: npm publish --access public --provenance
+
+  jsr:
+    needs: [release, approve]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: "24"
+      - run: npm ci --no-audit --no-fund
       - name: Publish to JSR (OIDC — no token)
         run: npx jsr publish --allow-slow-types

package/.github/workflows/standard.yml

@@ -0,0 +1,15 @@
+name: standard
+on:
+  push:
+    branches: [main]
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  standard:
+    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@d43c3280588ef05f4ead43426db1091d4cb8f520
+    with:
+      security: true
+      test: true
+      runtime: node
+      test-command: "npm ci --no-audit --no-fund && npm test"

package/CHANGELOG.md

@@ -1,5 +1,87 @@
 # Changelog
 
+## 0.5.0 — 2026-07-05
+
+### Minor
+
+- read + bump `deno.json` (not just `package.json`/`jsr.json`) — unblocks every Deno/JSR package in the org from adopting mint (fixes #13; unblocks gh-project-room#47)
+
+### Patch
+
+- docs: document the minimumDependencyAge 24h JSR/npm cooldown for consumers and its batch-rollout ripple (#11)
+
+## 0.4.15 — 2026-06-29
+
+### Patch
+
+- add repository field to package.json — required by npm provenance verification to match the GitHub repo URL in the OIDC claims
+
+## 0.4.14 — 2026-06-29
+
+### Patch
+
+- revert _authToken strip — the empty NODE_AUTH_TOKEN reference in .npmrc is what triggers npm's OIDC exchange; stripping it causes ENEEDAUTH; trusted publisher config (no environment, publish allowed) is the real fix
+
+## 0.4.13 — 2026-06-29
+
+### Patch
+
+- fix npm OIDC auth — restore registry-url and strip the injected empty _authToken before publishing so npm can fall through to its OIDC trusted-publishing exchange
+
+## 0.4.12 — 2026-06-29
+
+### Patch
+
+- remove registry-url from npm job setup-node — injected NODE_AUTH_TOKEN conflicts with OIDC trusted publishing auth exchange
+
+## 0.4.11 — 2026-06-29
+
+### Patch
+
+- split publish into approve (gate) + npm + jsr as independent parallel jobs — one approval unblocks all deploys, each target has its own job log and can be retried independently
+
+## 0.4.10 — 2026-06-29
+
+### Patch
+
+- unify npm + JSR behind a single publish job gated by the npm-publish GitHub Environment — one approval deploys to all registries
+
+## 0.4.9 — 2026-06-29
+
+### Patch
+
+- replace npm staged publishing with direct npm publish gated behind the GitHub Environment approval — same human gate, no dependency on unfinished npm staging OIDC support
+
+## 0.4.8 — 2026-06-29
+
+### Patch
+
+- fix npm stage publish OIDC scope — move npm stage publish into the npm-approve job (environment: npm-publish) so the OIDC token carries the environment claim required by the trusted publisher
+
+## 0.4.7 — 2026-06-29
+
+### Patch
+
+- retry staged npm publish — trusted publisher now has stage action + environment scoped to npm-publish
+
+## 0.4.6 — 2026-06-29
+
+### Patch
+
+- bump actions/attest-build-provenance to v4.1.1 (Node 24, clears deprecation warnings); add npm-publish GitHub Environment gate with required reviewer before surfacing the npm stage approve command
+
+## 0.4.5 — 2026-06-29
+
+### Patch
+
+- fix registry existence check — use curl instead of `npm view` (NODE_AUTH_TOKEN in .npmrc was causing the lookup to fail, always falling through to first-publish path)
+
+## 0.4.4 — 2026-06-29
+
+### Patch
+
+- first staged npm release — package now seeded, all future releases go through `npm stage publish` with human 2FA approval
+
 ## 0.4.3 — 2026-06-29
 
 ### Patch

package/README.md

@@ -106,16 +106,15 @@ mint ships from `release.yml` on each `v*` tag via **OIDC trusted publishing**
 no `NPM_TOKEN`, no JSR token, ever. The package manifests are kept in lockstep by
 `mint version` (it bumps `package.json`, `package-lock.json`, **and** `jsr.json`).
 
-**npm uses staged publishing** — `npm stage publish` submits the package to a
-staging area rather than making it live immediately. A maintainer must approve it
-with 2FA before it appears on the registry:
+**npm uses a GitHub Environment gate** — the `npm-approve` job is blocked by the
+`npm-publish` environment, which requires a designated reviewer to approve in the
+GitHub Actions UI before `npm publish` runs. Approve at:
 
-```sh
-npm stage approve <stage-id>   # CLI, 2FA required
-# or: npmjs.com → Staged Packages tab → Approve
+```
+https://github.com/bounded-systems/mint/actions
 ```
 
-The stage ID is surfaced in the GitHub Actions job summary after each release run.
+Once approved, the package publishes immediately via OIDC trusted publishing (no token).
 
 **JSR publishes immediately** on the same tag (no staging concept on JSR).
 
@@ -138,6 +137,54 @@ JSR type-checker resolves mint's `node:` imports.
 > authorizes the keyless OIDC publish; after it, every tagged release publishes
 > with no token.
 
+### Consumers: the 24h JSR/npm cooldown after a release
+
+Every fresh JSR/npm publish immediately hits Deno's
+[`minimumDependencyAge`](https://docs.deno.com/runtime/packages/supply_chain/)
+in any consumer running Deno 2.9+: since 2.9 it defaults to **24 hours** — Deno
+refuses to resolve a version published inside that window, full stop, no
+config needed to trigger it. It's a real supply-chain guard (malicious
+versions are usually caught/yanked within days), but it applies to first-party
+`@bounded-systems/*` releases exactly the same as to a random third party.
+
+Concretely: `baobab@0.2.0` published, and every downstream consumer's CI
+(e.g. a `check-contrast.yml` caller) hard-failed for the next 24h trying to
+resolve it — not a flake, a guaranteed wait baked into every release
+([bounded-systems/mint#11](https://github.com/bounded-systems/mint/issues/11)).
+For one package that's a wait; for a coordinated rollout of several
+interdependent `@bounded-systems/*` packages in one sitting, it ripples —
+every consumer of every package in the batch eats the same 24h, and chains of
+dependencies compound it.
+
+**The fix does NOT live in a consumer's `deno.json`.** An earlier version of
+this doc claimed a `minimumDependencyAge.exclude` list there would work —
+that was wrong, and only looked right because it was tested against Deno
+2.8.3 (which doesn't enforce the 24h default at all; the default only started
+in 2.9). Verified against the real `2.9.1` binary: `deno.json` is never even
+read when `deno run`'s entrypoint is a bare `jsr:...` specifier — config-file
+discovery only applies in normal "project mode." Planting invalid JSON in a
+`deno.json` and confirming Deno never complained is what exposed this.
+
+**What actually works:** the `--minimum-dependency-age` CLI flag on the
+invocation itself. That means the fix has to live wherever the `deno run`
+command is composed — for a reusable GitHub Actions workflow like
+`check-contrast.yml`, that's an input on the workflow, not something a caller
+can override from its own repo
+([bounded-systems/baobab#7](https://github.com/bounded-systems/baobab/pull/7)
+adds `minimum-dependency-age`, defaulting to `"0"`, since the only thing that
+workflow ever resolves from the network is `@bounded-systems/baobab` itself —
+a first-party package the caller already trust-bounds via its own version
+range input, so the age gate adds no real protection there). Any other
+reusable workflow or script that shells out to `deno run jsr:...`/`npm:...`
+directly needs the same treatment: an explicit `--minimum-dependency-age`
+(or `--minimum-dependency-age=0` if every dependency it touches is
+first-party) on the command, not a config file a caller drops in.
+
+This still doesn't scale past a handful of hand-fixed workflows — #11 is the
+open ask for mint to own generating this consistently across every
+`@bounded-systems/*` reusable workflow, rather than fixing each one by hand
+as it's hit.
+
 ## Library
 
 ```js
@@ -167,7 +214,7 @@ releaseStatement({
 - [x] `mint release` — signed tag + in-toto release provenance, keyless-signed in CI (cosign/Sigstore; anchored-chain-shaped)
 - [ ] verbspec-typed CLI + MCP surface
 - [x] Reusable `workflow_call` Action (`version.yml` + `release-provenance.yml`)
-- [x] Publish to npm (staged, human 2FA approval gate) + JSR
+- [x] Publish to npm (GitHub Environment approval gate) + JSR
 
 Tracking: [bounded-systems/string-audit#43](https://github.com/bounded-systems/string-audit/issues/43).
 

package/jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/mint",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "license": "PolyForm-Noncommercial-1.0.0",
   "exports": {
     ".": "./plan.mjs",

package/mint.mjs

@@ -34,10 +34,23 @@ async function readJson(path) {
   return JSON.parse(await readFile(path, "utf8"));
 }
 
+// The version lives in whichever manifest a repo uses: deno.json (Deno),
+// jsr.json (JSR-from-npm), or package.json (npm). A repo may carry several kept
+// in lockstep. Detect the first present one that declares a version.
+const MANIFESTS = ["deno.json", "jsr.json", "package.json"];
+
 async function currentVersion() {
-  const pkg = await readJson("package.json");
-  if (!pkg.version) throw new Error("package.json has no version field");
-  return pkg.version;
+  for (const path of MANIFESTS) {
+    try {
+      const m = await readJson(path);
+      if (m.version) return m.version;
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  throw new Error(
+    `no manifest with a version field (looked for: ${MANIFESTS.join(", ")})`,
+  );
 }
 
 async function cmdPlan() {
@@ -63,10 +76,25 @@ async function cmdVersion() {
     return;
   }
 
-  // Bump the manifest (+ lockfile if present), preserving 2-space JSON.
-  const pkg = await readJson("package.json");
-  pkg.version = p.nextVersion;
-  await writeFile("package.json", JSON.stringify(pkg, null, 2) + "\n");
+  // Bump every manifest present (deno.json / jsr.json / package.json) in
+  // lockstep, preserving 2-space JSON.
+  const bumped = [];
+  for (const path of MANIFESTS) {
+    try {
+      const m = await readJson(path);
+      m.version = p.nextVersion;
+      await writeFile(path, JSON.stringify(m, null, 2) + "\n");
+      bumped.push(path);
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+  }
+  if (bumped.length === 0) {
+    throw new Error(
+      `no manifest to bump (looked for: ${MANIFESTS.join(", ")})`,
+    );
+  }
+  // Keep an npm lockfile in lockstep if present.
   try {
     const lock = await readJson("package-lock.json");
     lock.version = p.nextVersion;
@@ -75,14 +103,6 @@ async function cmdVersion() {
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
-  // Keep jsr.json in lockstep (JSR has its own manifest version).
-  try {
-    const jsr = await readJson("jsr.json");
-    jsr.version = p.nextVersion;
-    await writeFile("jsr.json", JSON.stringify(jsr, null, 2) + "\n");
-  } catch (e) {
-    if (e.code !== "ENOENT") throw e;
-  }
 
   // Prepend the entry to CHANGELOG.md (create with a header if absent).
   let changelog = "";
@@ -95,7 +115,7 @@ async function cmdVersion() {
   // Consume the intents.
   for (const i of intents) if (i.file) await unlink(i.file);
 
-  console.log(`mint: ${p.currentVersion} → ${p.nextVersion} (${p.bump}). Updated package.json + CHANGELOG.md, consumed ${intents.length} intent(s).`);
+  console.log(`mint: ${p.currentVersion} → ${p.nextVersion} (${p.bump}). Updated ${bumped.join(" + ")} + CHANGELOG.md, consumed ${intents.length} intent(s).`);
   console.log(`Next: commit, then \`mint release\` to cut the tag + emit release provenance.`);
 }
 
@@ -122,9 +142,7 @@ function ciBuilder() {
 // (reads package.json + CHANGELOG + git HEAD + CI env); delegates the pure shape
 // to release.mjs. Throws with a CLI-friendly message on a missing changelog entry.
 async function gatherStatement() {
-  const pkg = await readJson("package.json");
-  const version = pkg.version;
-  if (!version) throw new Error("package.json has no version");
+  const version = await currentVersion();
   const tag = `v${version}`;
 
   let changelog = "";

package/mint.test.mjs

@@ -177,3 +177,37 @@ test("DSSE pre-authentication encoding wraps the canonical statement", () => {
   assert.ok(pae.startsWith(`DSSEv1 ${DSSE_PAYLOAD_TYPE.length} ${DSSE_PAYLOAD_TYPE} ${Buffer.byteLength(payload)} `));
   assert.ok(pae.endsWith(payload));
 });
+
+// ── CLI manifest handling: mint reads/bumps deno.json, not just package.json (#13)
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const MINT = fileURLToPath(new URL("./mint.mjs", import.meta.url));
+
+function bumpIn(manifestName) {
+  const d = mkdtempSync(join(tmpdir(), "mint-cli-"));
+  try {
+    writeFileSync(
+      join(d, manifestName),
+      JSON.stringify({ name: "@x/y", version: "0.1.0", exports: "./m.ts" }, null, 2) + "\n",
+    );
+    mkdirSync(join(d, ".release"));
+    writeFileSync(join(d, ".release", "i.md"), "---\nbump: minor\n---\nx\n");
+    execFileSync("node", [MINT, "version"], { cwd: d, stdio: "pipe" });
+    return JSON.parse(readFileSync(join(d, manifestName), "utf8")).version;
+  } finally {
+    rmSync(d, { recursive: true, force: true });
+  }
+}
+
+test("mint version bumps a deno.json-only repo (#13)", () => {
+  assert.equal(bumpIn("deno.json"), "0.2.0");
+});
+
+test("mint version still bumps a jsr.json / package.json repo", () => {
+  assert.equal(bumpIn("jsr.json"), "0.2.0");
+  assert.equal(bumpIn("package.json"), "0.2.0");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/mint",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "Deterministic versioning capability — intent files in, signed release out. A seam over semver: own the flow, delegate the arithmetic.",
   "type": "module",
   "bin": {
@@ -15,6 +15,10 @@
     "test": "node --test",
     "plan": "node mint.mjs plan"
   },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bounded-systems/mint.git"
+  },
   "license": "PolyForm-Noncommercial-1.0.0",
   "dependencies": {
     "semver": "^7.6.0",

package/.github/workflows/ci.yml

@@ -1,20 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
-        with:
-          node-version: "22"
-      - run: npm ci --no-audit --no-fund
-      - run: npm test