@faable/auth-sdk 2.6.1 → 2.6.3

package/.github/workflows/release.yml

@@ -31,3 +31,8 @@ jobs:
       - run: npm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Proves the RESULT: downloads what was just published and fails if the
+      # sentinels survived. test:pack checks they are present before the
+      # release; only this catches something rebuilding dist/ in between —
+      # which is exactly how 2.6.0 shipped as `auth-sdk/0.0.0-dev`.
+      - run: npm run verify:published

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "0.0.0-dev";
+export const version = "2.6.3";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "0000000dev";
+export const commit = "d9f3c35";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.6.1",
+  "version": "2.6.3",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -30,10 +30,10 @@
     "gentypes": "openapi-typescript ${AUTH_OPENAPI:-spec/openapi.json} -o src/api/types.ts && node scripts/gen-client.mjs",
     "build": "rimraf dist && tsc",
     "prebuild": "npm run gentypes",
-    "prepublishOnly": "npm run build",
     "test": "ava",
     "release": "semantic-release",
-    "test:pack": "node tests/pack/verify-pack.mjs"
+    "test:pack": "node tests/pack/verify-pack.mjs",
+    "verify:published": "node tests/pack/verify-published.mjs"
   },
   "resolutions": {
     "npm/chalk": "^4.1.2"

package/tests/pack/verify-pack.mjs

@@ -30,6 +30,7 @@ console.log("→ Building dist/");
 run("npm run build", { cwd: ROOT });
 
 // 1. Sentinels, verbatim, straight from .releaserc so the two cannot drift.
+const pkgScripts = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).scripts ?? {};
 const releaserc = JSON.parse(readFileSync(join(ROOT, ".releaserc"), "utf8"));
 const replacePlugin = releaserc.plugins.find(
   (p) => Array.isArray(p) && p[0] === "semantic-release-replace-plugin",
@@ -43,6 +44,23 @@ for (const { from } of replacePlugin[1].replacements) {
 }
 console.log("✓ sentinels present in dist/version.js");
 
+// The sentinels being here is only half the story: anything that rebuilds
+// dist/ AFTER semantic-release's replacement and BEFORE the upload undoes it.
+// `npm pack` fires `prepack`, never `prepublishOnly`, so this guard cannot
+// observe that hook — it refuses to let one exist instead. (2.6.0 shipped
+// anonymous exactly this way.) The release workflow builds explicitly, so no
+// publish-time rebuild hook is needed.
+const REBUILD_HOOKS = ["prepublishOnly", "prepublish", "prepack", "prepare"];
+const offending = REBUILD_HOOKS.filter((hook) => pkgScripts[hook]);
+if (offending.length) {
+  fail(
+    `package.json defines ${offending.join(", ")} — npm runs these around publish, ` +
+      "and a rebuild there would overwrite the version semantic-release just injected. " +
+      "Build in the workflow instead.",
+  );
+}
+console.log("✓ no publish-time rebuild hook");
+
 // 2. Browser-safety: no node: specifiers anywhere in the published JS.
 const jsFiles = (dir) =>
   readdirSync(dir, { withFileTypes: true }).flatMap((e) =>

package/tests/pack/verify-published.mjs

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+// Post-publish guard: download the version that was just published and fail if
+// it still carries the release sentinels.
+//
+// `verify-pack.mjs` checks the OPPOSITE — that the sentinels ARE in dist/, so
+// the replacement has something to hit. Both are needed, and only this one
+// proves the result: 2.6.0 shipped anonymous because `prepublishOnly` ran
+// `rimraf dist && tsc` between the replacement and the upload, and `npm pack`
+// (which the pre-publish guard uses) never fires that hook.
+import { execSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = resolve(fileURLToPath(import.meta.url), "../../..");
+const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
+const version = pkg.version;
+
+// semantic-release writes the released version into package.json during
+// `prepare`. Still the dev placeholder ⇒ no release was cut on this run.
+if (version === "0.0.0-dev") {
+  console.log("→ No release cut on this run; nothing to verify.");
+  process.exit(0);
+}
+
+const sentinels = JSON.parse(readFileSync(join(ROOT, ".releaserc"), "utf8"))
+  .plugins.find((p) => Array.isArray(p) && p[0] === "semantic-release-replace-plugin")[1]
+  .replacements.map((r) => r.from);
+
+// Ask the registry itself rather than `npm pack`: the packument is what
+// propagates first, and npm's own cache on a runner can report a
+// just-published version as missing for a while (2.6.2 was live and this
+// guard still called it "never available"). Up to 5 minutes, because
+// propagation is the only thing being waited on here.
+const fetchTarballUrl = async () => {
+  const url = `https://registry.npmjs.org/${pkg.name.replace("/", "%2F")}`;
+  for (let attempt = 1; attempt <= 30; attempt++) {
+    try {
+      const res = await fetch(url, { headers: { "cache-control": "no-cache" } });
+      if (res.ok) {
+        const doc = await res.json();
+        const tarball = doc.versions?.[version]?.dist?.tarball;
+        if (tarball) return tarball;
+      }
+    } catch {
+      // network blip — keep waiting
+    }
+    console.log(`→ ${pkg.name}@${version} not served yet (attempt ${attempt}/30)`);
+    await new Promise((r) => setTimeout(r, 10_000));
+  }
+  return undefined;
+};
+
+const tmp = mkdtempSync(join(tmpdir(), "faable-auth-sdk-published-"));
+try {
+  const tarballUrl = await fetchTarballUrl();
+  if (!tarballUrl) {
+    console.error(`✖ ${pkg.name}@${version} never became available on the registry`);
+    process.exit(1);
+  }
+  const tarball = "published.tgz";
+  execSync(`curl -sfL "${tarballUrl}" -o ${tarball}`, { cwd: tmp });
+  execSync(`tar xzf ${tarball}`, { cwd: tmp });
+  const published = readFileSync(join(tmp, "package/dist/version.js"), "utf8");
+  for (const sentinel of sentinels) {
+    if (published.includes(sentinel)) {
+      console.error(
+        `✖ ${pkg.name}@${version} was published with the sentinel "${sentinel}" intact — ` +
+          "every consumer will report as that. Something between the replacement and the " +
+          "upload rebuilt dist/ (a `prepublishOnly`/`prepack` hook is the usual culprit).",
+      );
+      process.exit(1);
+    }
+  }
+  if (!published.includes(version)) {
+    console.error(`✖ ${pkg.name}@${version} does not carry its own version in dist/version.js`);
+    process.exit(1);
+  }
+  console.log(`✓ ${pkg.name}@${version} reports itself correctly on the wire`);
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}