@faable/auth-sdk 2.6.2 → 2.6.4

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.6.2";
+export const version = "2.6.4";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "6d035ad";
+export const commit = "6b995b1";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.6.2",
+  "version": "2.6.4",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.11.0",
+    "version": "2.12.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"

package/tests/pack/verify-published.mjs

@@ -28,27 +28,39 @@ const sentinels = JSON.parse(readFileSync(join(ROOT, ".releaserc"), "utf8"))
   .plugins.find((p) => Array.isArray(p) && p[0] === "semantic-release-replace-plugin")[1]
   .replacements.map((r) => r.from);
 
-const tmp = mkdtempSync(join(tmpdir(), "faable-auth-sdk-published-"));
-try {
-  // The registry needs a moment to serve a brand-new version.
-  let tarball;
-  for (let attempt = 1; attempt <= 10; attempt++) {
+// Ask the registry itself rather than `npm pack`: the packument is what
+// propagates first, and npm's own cache on a runner can report a
+// just-published version as missing for a while (2.6.2 was live and this
+// guard still called it "never available"). Up to 5 minutes, because
+// propagation is the only thing being waited on here.
+const fetchTarballUrl = async () => {
+  const url = `https://registry.npmjs.org/${pkg.name.replace("/", "%2F")}`;
+  for (let attempt = 1; attempt <= 30; attempt++) {
     try {
-      tarball = execSync(`npm pack ${pkg.name}@${version} --silent`, {
-        cwd: tmp,
-        encoding: "utf8",
-      }).trim();
-      break;
+      const res = await fetch(url, { headers: { "cache-control": "no-cache" } });
+      if (res.ok) {
+        const doc = await res.json();
+        const tarball = doc.versions?.[version]?.dist?.tarball;
+        if (tarball) return tarball;
+      }
     } catch {
-      console.log(`→ ${pkg.name}@${version} not served yet (attempt ${attempt}/10)`);
-      execSync("sleep 10");
+      // network blip — keep waiting
     }
+    console.log(`→ ${pkg.name}@${version} not served yet (attempt ${attempt}/30)`);
+    await new Promise((r) => setTimeout(r, 10_000));
   }
-  if (!tarball) {
+  return undefined;
+};
+
+const tmp = mkdtempSync(join(tmpdir(), "faable-auth-sdk-published-"));
+try {
+  const tarballUrl = await fetchTarballUrl();
+  if (!tarballUrl) {
     console.error(`✖ ${pkg.name}@${version} never became available on the registry`);
     process.exit(1);
   }
-
+  const tarball = "published.tgz";
+  execSync(`curl -sfL "${tarballUrl}" -o ${tarball}`, { cwd: tmp });
   execSync(`tar xzf ${tarball}`, { cwd: tmp });
   const published = readFileSync(join(tmp, "package/dist/version.js"), "utf8");
   for (const sentinel of sentinels) {