@voxgig/sdkgen-infrapack 0.0.6 → 0.0.8

package/.sdk/model/target/seneca-provider.aon

@@ -65,20 +65,32 @@ main: kit: target: 'seneca-provider': {
   # `repo` defaults to the SDK's own repository, so normally only the ref is
   # stated.
   #
-  # `path` is the SUBDIRECTORY the SDK package sits in, because npm resolves
-  # a git dependency against the repository root and sdkgen generates the
-  # TypeScript SDK into `ts/`. It therefore defaults to `ts` — the layout
-  # this toolchain produces — and npm spells it `#<ref>::path:<path>`. Set it
-  # to `.` for an SDK whose package.json IS the repository root.
+  # WHICH KIND TO USE DEPENDS ON WHERE THE PACKAGE SITS. npm resolves a git
+  # dependency against the repository ROOT, and sdkgen generates the
+  # TypeScript SDK into `ts/` — so `git` suits an SDK that IS its repository
+  # root, and `release` suits this toolchain's own layout:
+  #
+  #   kind: 'git'      github:owner/repo#<ref>
+  #   kind: 'release'  https://github.com/owner/repo/releases/download/
+  #                      <ref>/<asset>.tgz
+  #
+  # A release asset is `npm pack` output attached to the tag; npm installs an
+  # https tarball natively and never looks at the repository layout. `asset`
+  # names the file when it is not the usual `<scope>-<name>-<version>.tgz`.
+  #
+  # There is no subdirectory option, deliberately. npm's spec parser accepts
+  # `#<ref>::path:ts` and reports a gitSubdir, so it reads as supported — but
+  # the INSTALLER ignores it and fails with ENOENT, on linux, macOS and
+  # Windows alike. A knob that produces an uninstallable dependency is worse
+  # than no knob.
   #
   # `spec` states the whole dependency value outright and wins over
-  # everything, for anything the shorthand cannot express — a release-tarball
-  # URL, say.
+  # everything.
   sdk: dep: {
-    kind: *'npm' | 'git'
+    kind: *'npm' | 'git' | 'release'
     ref: *'' | string
     repo: *'' | string
-    path: *'ts' | string
+    asset: *'' | string
     spec: *'' | string
   }
 

package/.sdk/src/cmp/seneca-provider/Extras_seneca-provider.ts

@@ -1741,14 +1741,30 @@ ${!provider.liveApp ? '' : `
 # lets npm exchange a GitHub OIDC token for a short-lived publish credential,
 # and provenance is attached automatically.
 #
+# TWO JOBS, BECAUSE THEY NEED DIFFERENT PRIVILEGES.
+#
+#   verify   contents: read, and nothing else. Runs npm install, the build
+#            and the tests — i.e. dependency lifecycle scripts and project
+#            code. It holds no publish credential.
+#   publish  id-token: write, contents: read. Installs NO project
+#            dependencies and runs NO project code: this package ships
+#            \`dist\`, which is committed, so nothing needs building to pack.
+#
+# THE SPLIT IS THE POINT. A compromised dependency lifecycle script can ask
+# the runner for any OIDC token the JOB is permitted to mint, so a job that
+# both installs dependencies and holds \`id-token: write\` can be made to
+# publish as this package before its own gates finish. Keeping the install in
+# a job with no id-token, and the credential in a job that installs nothing,
+# is what makes the isolation real rather than nominal.
+#
 # The trusted publisher must be registered on npmjs.com for this package
 # against THIS filename (publish.yml); renaming this file breaks publishing
 # until the npm-side config is updated to match.
 #
-# npm cannot publish a package's FIRST version this way — the settings page
-# that configures a trusted publisher only exists once a version is there. So
-# release ${provider.version} by hand once, configure the publisher, and every
-# release after that is a tag push.
+# npm cannot configure a trusted publisher for a package that does not exist
+# yet — the settings page appears once a version is on the registry. So the
+# FIRST version of a new package is published by hand, once, with an
+# authenticated npm; every release after that is a tag push.
 #
 # Release flow: bump the version in the SDK model
 # (\`main: kit: target: 'seneca-provider': publish: version\`), regenerate,
@@ -1762,25 +1778,24 @@ on:
   workflow_dispatch:
 
 jobs:
-  publish:
-    name: npm publish
+  verify:
+    name: verify
     runs-on: ubuntu-latest
     timeout-minutes: 15
+
+    # Deliberately the default-minimum. This job runs third-party code.
     permissions:
-      id-token: write
       contents: read
 
+    outputs:
+      version: \${{ steps.version.outputs.version }}
+
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 24.x
-          registry-url: 'https://registry.npmjs.org'
-
-      # Trusted publishing requires npm >= 11.5.1.
-      - name: Use a trusted-publishing capable npm
-        run: npm install -g npm@latest
 
       # install, not ci: this package does not commit a lockfile.
       - run: npm install
@@ -1789,11 +1804,10 @@ jobs:
       # needs it installed explicitly.
       #
       # --no-save IS LOAD-BEARING. Without it npm rewrites the peer ranges in
-      # package.json to carets on whatever it resolved, and \`npm publish\`
-      # below then ships that rewritten manifest — so an authored \`>=26\`
-      # reaches consumers as \`^28.1.0\` and the package refuses to install for
-      # anyone on a newer major. The repo looks fine; only the artifact is
-      # narrowed. Install into node_modules, leave the manifest alone.
+      # package.json to carets on whatever it resolved, and a later publish
+      # ships that rewritten manifest — so an authored \`>=26\` reaches
+      # consumers as \`^28.1.0\` and the package refuses to install for anyone
+      # on a newer major. The repo looks fine; only the artifact is narrowed.
       - run: npm i --no-save seneca seneca-entity seneca-promisify @seneca/provider @seneca/env
 
       - run: npm run build
@@ -1802,15 +1816,75 @@ jobs:
       # The tag must match what the manifest declares, or a tag push silently
       # republishes whatever version happens to be in package.json.
       - name: Check the tag matches the manifest version
+        id: version
+        run: |
+          set -euo pipefail
+          PKG=\$(node -p "require('./package.json').version")
+          if [ "\${GITHUB_REF_TYPE:-}" = "tag" ]; then
+            TAG="\${GITHUB_REF_NAME#v}"
+            if [ "\$TAG" != "\$PKG" ]; then
+              echo "::error::tag v\$TAG does not match package.json \$PKG"
+              exit 1
+            fi
+          fi
+          echo "version=\$PKG" >> "\$GITHUB_OUTPUT"
+
+      # WHAT THE PUBLISH JOB WILL PACK, checked HERE where the code already
+      # ran. That job builds nothing, so a missing or stale \`dist\` would
+      # otherwise be discovered by consumers rather than by this workflow.
+      - name: The committed dist matches the source
         run: |
-          TAG="\${GITHUB_REF_NAME#v}"
-          PKG=$(node -p "require('./package.json').version")
-          if [ "$TAG" != "$PKG" ]; then
-            echo "tag v$TAG does not match package.json $PKG"
+          set -euo pipefail
+          if ! git diff --quiet -- dist; then
+            echo "::error::dist/ is not up to date with src/ -- rebuild and commit it"
+            git diff --stat -- dist
             exit 1
           fi
 
+  publish:
+    name: npm publish
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    # The ONLY job holding the publish credential — and it installs no
+    # project dependencies and runs no project code. See the header.
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24.x
+          registry-url: 'https://registry.npmjs.org'
+
+      # Trusted publishing requires npm >= 11.5.1. This is npm itself, not a
+      # project dependency: no package.json here is consulted.
+      - name: Use a trusted-publishing capable npm
+        run: npm install -g npm@latest
+
+      # THE REGISTRY IS THE SOURCE OF TRUTH FOR "IS THIS RELEASED", not the
+      # tag. A re-run of a workflow that already published would otherwise
+      # fail on a version conflict and report a red release that in fact
+      # succeeded.
+      - name: Is this version already on npm?
+        id: registry
+        env:
+          VERSION: \${{ needs.verify.outputs.version }}
+        run: |
+          set -euo pipefail
+          if npm view "${provider.pkgName}@\$VERSION" version >/dev/null 2>&1; then
+            echo "published=true" >> "\$GITHUB_OUTPUT"
+            echo "\$VERSION is already on npm — skipping publish"
+          else
+            echo "published=false" >> "\$GITHUB_OUTPUT"
+          fi
+
       - name: Publish to npm
+        if: steps.registry.outputs.published == 'false'
         run: npm publish --access public
 `)
       })

package/.sdk/src/cmp/seneca-provider/Main_seneca-provider.ts

@@ -708,14 +708,21 @@ const Main = cmp(function Main(props: any) {
   // into every generated provider's CI.
   const liveApp = true === live.app || (loopback(specBase) && '' === (live.base || ''))
 
+  const sdkDep = sdkDependency(model, target, {
+    sdkPkg, sdkVersion, sdkRepoUrl: repoInfo(model).repoUrl,
+  })
+
   const provider = {
     Name, lower, ENV, sdkClass, pluginName, fileBase,
     sdkPkg, sdkVersion, entities,
-    // Whether the SDK dependency is a git tag rather than a registry
-    // package. The generated CI note says which, because "npm install is all
-    // you need" stops being true the moment git is in the path.
-    sdkGit: sdkDependency(model, target, { sdkVersion, sdkRepoUrl: repoInfo(model).repoUrl })
-      .startsWith('github:'),
+    // The SDK dependency, resolved ONCE. PackageJson emits it and the CI
+    // note describes it, and computing it twice is how the second caller
+    // came to pass a half-built provider object into it.
+    sdkDep,
+    // Whether that dependency comes from outside a registry. The generated
+    // CI note says so, because "npm install is all you need" stops being
+    // true the moment git or a tarball URL is in the path.
+    sdkGit: !sdkDep.startsWith('^'),
     repoUrl: repo.url,
     // The SDK's own repo, for pointing at the companion test server which is
     // only distributed in source.
@@ -790,13 +797,21 @@ const Main = cmp(function Main(props: any) {
 // `kind: 'git'` points at a GIT TAG instead, which needs no registry.
 //
 // NPM RESOLVES A GIT DEPENDENCY AGAINST THE REPOSITORY ROOT, and sdkgen
-// generates the TypeScript SDK into `ts/` — so the bare
-// `github:owner/repo#ref` every example shows would install a directory with
-// no package.json in it. npm spells the subdirectory `#<ref>::path:<sub>`
-// (npm-package-arg resolves that to gitSubdir), and `path` therefore
-// defaults to `ts` rather than to nothing: the default has to match the
-// layout this toolchain actually produces, or the shorthand is a trap. `.`
-// means the package IS the repository root.
+// generates the TypeScript SDK into `ts/`. So `kind: 'git'` suits an SDK
+// whose package.json IS the repository root, and NOT the layout this
+// toolchain produces.
+//
+// THE `::path:` SUBDIRECTORY SYNTAX DOES NOT WORK, and it looks like it
+// does. npm-package-arg parses `#<ref>::path:ts` and reports
+// `gitSubdir: /ts`, so a spec built that way reads as correct — but the
+// INSTALLER ignores it: npm clones the repository and opens package.json at
+// the clone root, failing with ENOENT on linux, macOS and Windows alike.
+// That was measured, on all three, after the parser had said otherwise.
+//
+// `kind: 'release'` is the form that works for a package in a subdirectory:
+// a GitHub release asset, which is `npm pack` output attached to the tag.
+// npm installs an https tarball natively and never looks at the repository
+// layout at all.
 //
 // `spec` still wins over all of it, for anything the shorthand cannot say.
 function sdkDependency(model: any, target: any, provider: any): string {
@@ -807,7 +822,8 @@ function sdkDependency(model: any, target: any, provider: any): string {
     return spec
   }
 
-  if ('git' !== String(dep.kind || 'npm')) {
+  const kind = String(dep.kind || 'npm')
+  if ('git' !== kind && 'release' !== kind) {
     return `^${provider.sdkVersion}`
   }
 
@@ -837,11 +853,17 @@ function sdkDependency(model: any, target: any, provider: any): string {
       'on, e.g. `sdk.dep.ref: "v' + provider.sdkVersion + '"`.')
   }
 
-  // `.` (and empty) mean the repository root, which needs no path segment.
-  const sub = String(dep.path ?? 'ts').trim().replace(/^\/+|\/+$/g, '')
+  if ('release' === kind) {
+    // The asset `npm pack` produces: scope and name flattened, then the
+    // version. `asset` overrides it for a project that names its own.
+    const asset = String(dep.asset || '').trim() || (
+      provider.sdkPkg.replace(/^@/, '').replace(/\//g, '-') +
+      '-' + provider.sdkVersion + '.tgz')
+
+    return `https://github.com/${repo}/releases/download/${ref}/${asset}`
+  }
 
-  return `github:${repo}#${ref}` +
-    ('' === sub || '.' === sub ? '' : `::path:${sub}`)
+  return `github:${repo}#${ref}`
 }
 
 
@@ -948,7 +970,7 @@ const PackageJson = cmp(function PackageJson(props: any) {
       // The SDK this plugin wraps. Published-and-pinned by default; a git
       // tag when the project says so, because an unpublished SDK otherwise
       // leaves this package unable to install at all. See sdkDependency.
-      [provider.sdkPkg]: sdkDependency(model, target, provider),
+      [provider.sdkPkg]: provider.sdkDep,
       ...dep('prod'),
     },
     peerDependencies: dep('peer'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voxgig/sdkgen-infrapack",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Infrastructure-provider targets for the Voxgig SDK Generator: Seneca provider.",
   "type": "commonjs",
   "license": "MIT",

package/sdkgen-package.json

@@ -3,7 +3,7 @@
     "package": 1
   },
   "name": "@voxgig/sdkgen-infrapack",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "engines": {
     "sdkgen": ">=4.12.0"
   },