@nhtio/adk 0.1.0-master-f633fe0d → 0.1.0-master-e6c58205

package/CHANGELOG.md

@@ -19,6 +19,16 @@ upgrading.
 
 ### Security
 
+- **npm trusted publishing is live — releases no longer use a long-lived token.** Completing
+  the groundwork below: the package's Trusted Publisher is configured on npmjs.com (GitLab
+  CI/CD → this project's `.gitlab-ci.yml`, `npm publish` only), and both npm deploy jobs now
+  authenticate exclusively with the short-lived OIDC `id_token` — every `NPM_TOKEN` reference
+  is gone from this repository's CI. Verified live twice before removal: npm preferred the
+  OIDC exchange even with the token fallback still present (publisher identity
+  `GitLab CI/CD <npm-oidc-no-reply@github.com>`), and the first fully tokenless publish
+  succeeded with the same identity. A stolen CI token — the credential class behind most of
+  the recent registry-compromise worms — can no longer publish this package; publish rights
+  are bound to this repository's pipeline identity instead of a bearer secret.
 - **Supply-chain hardening across the build and dependency pipeline** (prompted by the recent
   npm worm campaigns; none of these change the published API):
   - **Release cooldown**: pnpm now refuses to resolve any dependency version published less

package/batteries/media/lint.cjs

@@ -306,7 +306,7 @@ var rules = {
 var plugin = {
 	meta: {
 		name: "@nhtio/adk/batteries/media/lint",
-		version: "0.1.0-master-f633fe0d"
+		version: "0.1.0-master-e6c58205"
 	},
 	rules
 };

package/batteries/media/lint.mjs

@@ -302,7 +302,7 @@ var rules = {
 var plugin = {
 	meta: {
 		name: "@nhtio/adk/batteries/media/lint",
-		version: "0.1.0-master-f633fe0d"
+		version: "0.1.0-master-e6c58205"
 	},
 	rules
 };

package/eslint/rules.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../chunk-Cek0wNdY.js");
-const require_eslint_rules_require_validator_any_required = require("./rules/require_validator_any_required.cjs");
 const require_eslint_rules_no_model_in_tool_handler = require("./rules/no_model_in_tool_handler.cjs");
+const require_eslint_rules_require_validator_any_required = require("./rules/require_validator_any_required.cjs");
 const require_eslint_rules_thought_payload_requires_replay_tag = require("./rules/thought_payload_requires_replay_tag.cjs");
 const require_eslint_rules_token_encoding_requires_context_window = require("./rules/token_encoding_requires_context_window.cjs");
 const require_eslint_rules_artifact_tool_forbids_artifact_constructor = require("./rules/artifact_tool_forbids_artifact_constructor.cjs");

package/eslint/rules.mjs

@@ -1,5 +1,5 @@
-import requireValidatorAnyRequiredRule from "./rules/require_validator_any_required.mjs";
 import noModelInToolHandlerRule from "./rules/no_model_in_tool_handler.mjs";
+import requireValidatorAnyRequiredRule from "./rules/require_validator_any_required.mjs";
 import thoughtPayloadRequiresReplayTagRule from "./rules/thought_payload_requires_replay_tag.mjs";
 import tokenEncodingRequiresContextWindowRule from "./rules/token_encoding_requires_context_window.mjs";
 import artifactToolForbidsArtifactConstructorRule from "./rules/artifact_tool_forbids_artifact_constructor.mjs";

package/eslint.cjs

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("./chunk-Cek0wNdY.js");
-const require_eslint_rules_require_validator_any_required = require("./eslint/rules/require_validator_any_required.cjs");
 const require_eslint_rules_no_model_in_tool_handler = require("./eslint/rules/no_model_in_tool_handler.cjs");
+const require_eslint_rules_require_validator_any_required = require("./eslint/rules/require_validator_any_required.cjs");
 const require_eslint_rules_thought_payload_requires_replay_tag = require("./eslint/rules/thought_payload_requires_replay_tag.cjs");
 const require_eslint_rules_token_encoding_requires_context_window = require("./eslint/rules/token_encoding_requires_context_window.cjs");
 const require_eslint_rules_artifact_tool_forbids_artifact_constructor = require("./eslint/rules/artifact_tool_forbids_artifact_constructor.cjs");
@@ -49,7 +49,7 @@ var rules = {
 var plugin = {
 	meta: {
 		name: "@nhtio/adk/eslint",
-		version: "0.1.0-master-f633fe0d"
+		version: "0.1.0-master-e6c58205"
 	},
 	rules
 };

package/eslint.mjs

@@ -1,5 +1,5 @@
-import requireValidatorAnyRequiredRule from "./eslint/rules/require_validator_any_required.mjs";
 import noModelInToolHandlerRule from "./eslint/rules/no_model_in_tool_handler.mjs";
+import requireValidatorAnyRequiredRule from "./eslint/rules/require_validator_any_required.mjs";
 import thoughtPayloadRequiresReplayTagRule from "./eslint/rules/thought_payload_requires_replay_tag.mjs";
 import tokenEncodingRequiresContextWindowRule from "./eslint/rules/token_encoding_requires_context_window.mjs";
 import artifactToolForbidsArtifactConstructorRule from "./eslint/rules/artifact_tool_forbids_artifact_constructor.mjs";
@@ -44,7 +44,7 @@ var rules = {
 var plugin = {
 	meta: {
 		name: "@nhtio/adk/eslint",
-		version: "0.1.0-master-f633fe0d"
+		version: "0.1.0-master-e6c58205"
 	},
 	rules
 };

package/index.cjs

@@ -13,8 +13,8 @@ const require_tool_call = require("./tool_call-BxL3eU1k.js");
 const require_spooled_markdown_artifact = require("./spooled_markdown_artifact-Dj3fNowz.js");
 require("./exceptions.cjs");
 const require_turn_runner = require("./turn_runner-M2I8G2ok.js");
-require("./turn_runner.cjs");
 const require_guards = require("./guards.cjs");
+require("./turn_runner.cjs");
 //#region src/index.ts
 /**
 * Root convenience barrel for the ADK's core runtime values and public TypeScript contracts.
@@ -26,7 +26,7 @@ const require_guards = require("./guards.cjs");
 *
 * @tip This is a constant that is replaced during the build process with the actual version of the package.
 */
-var version = "0.1.0-master-f633fe0d";
+var version = "0.1.0-master-e6c58205";
 //#endregion
 exports.ArtifactTool = require_spooled_artifact.ArtifactTool;
 exports.DispatchRunner = require_dispatch_runner.DispatchRunner;

package/index.mjs

@@ -11,8 +11,8 @@ import { a as mediaReaderSchema, i as implementsMediaReader, n as Media, r as is
 import { n as SpooledJsonArtifact, t as SpooledMarkdownArtifact } from "./spooled_markdown_artifact-DIYzbQv8.mjs";
 import "./exceptions.mjs";
 import { t as TurnRunner } from "./turn_runner-BV4BaZK9.mjs";
-import "./turn_runner.mjs";
 import { isArtifactTool, isBaseException, isDispatchContext, isDispatchRunner, isIdentity, isMemory, isMessage, isRegistry, isSpooledArtifact, isSpooledArtifactConstructor, isSpooledJsonArtifact, isSpooledMarkdownArtifact, isThought, isTokenizable, isTool, isToolCall, isToolRegistry, isTurnContext, isTurnGate, isTurnRunner } from "./guards.mjs";
+import "./turn_runner.mjs";
 //#region src/index.ts
 /**
 * Root convenience barrel for the ADK's core runtime values and public TypeScript contracts.
@@ -24,7 +24,7 @@ import { isArtifactTool, isBaseException, isDispatchContext, isDispatchRunner, i
 *
 * @tip This is a constant that is replaced during the build process with the actual version of the package.
 */
-var version = "0.1.0-master-f633fe0d";
+var version = "0.1.0-master-e6c58205";
 //#endregion
 export { ArtifactTool, DispatchRunner, E_DISPATCH_PIPELINE_ERROR, E_INPUT_PIPELINE_ERROR, E_INVALID_INITIAL_IDENTITY_VALUE, E_INVALID_INITIAL_MEMORY_VALUE, E_INVALID_INITIAL_MESSAGE_VALUE, E_INVALID_INITIAL_REGISTRY_VALUE, E_INVALID_INITIAL_THOUGHT_VALUE, E_INVALID_INITIAL_TOOL_CALL_VALUE, E_INVALID_INITIAL_TOOL_VALUE, E_INVALID_INITIAL_TURN_GATE_VALUE, E_INVALID_LLM_DISPATCH_INPUT, E_INVALID_LLM_EXECUTION_CONTEXT, E_INVALID_TOOL_ARGS, E_INVALID_TURN_CONTEXT, E_INVALID_TURN_GATE_RESOLUTION, E_INVALID_TURN_RUNNER_CONFIG, E_LLM_EXECUTION_ALREADY_SIGNALLED, E_LLM_EXECUTION_EXECUTOR_ERROR, E_LLM_EXECUTION_GATE_NOT_SUPPORTED, E_NOT_A_SPOOL_READER, E_OUTPUT_PIPELINE_ERROR, E_PIPELINE_SHORT_CIRCUITED, E_TOOL_ALREADY_REGISTERED, E_TOOL_DOWNSTREAM_ERROR, E_TURN_GATE_ABORTED, E_TURN_GATE_TIMEOUT, Identity, Media, Memory, Message, Registry, Retrievable, SpooledArtifact, SpooledJsonArtifact, SpooledMarkdownArtifact, Thought, TokenEncoding, Tokenizable, Tool, ToolCall, ToolRegistry, TurnRunner, ValidationException, fromFetch, fromWebFile, implementsMediaReader, implementsSpoolReader, inMemoryMediaReader, isArtifactTool, isBaseException, isDispatchContext, isDispatchRunner, isError, isIdentity, isInstanceOf, isMedia, isMemory, isMessage, isObject, isRegistry, isSpooledArtifact, isSpooledArtifactConstructor, isSpooledJsonArtifact, isSpooledMarkdownArtifact, isThought, isTokenizable, isTool, isToolCall, isToolRegistry, isTurnContext, isTurnGate, isTurnRunner, mediaReaderSchema, version };