@voxgig/sdkgen-infrapack 0.0.8 → 0.0.10

package/.sdk/model/target/seneca-provider.aon

@@ -84,6 +84,17 @@ main: kit: target: 'seneca-provider': {
   # Windows alike. A knob that produces an uninstallable dependency is worse
   # than no knob.
   #
+  # NPM 12 REFUSES BOTH BY DEFAULT. `allow-git` and `allow-remote` default to
+  # "none", so a git or tarball dependency is rejected before anything is
+  # fetched (EALLOWGIT / EALLOWREMOTE). The generated CI passes the matching
+  # `--allow-*=all` for whichever kind is configured, because the project
+  # opting into what it declared is reasonable — but a CONSUMER of the
+  # published provider gets no such flag, and will hit the same wall.
+  #
+  # So this is a stopgap for an SDK that is not published YET, not a
+  # substitute for publishing it. An SDK on a registry needs none of it, and
+  # the default `npm` kind is the one that works everywhere.
+  #
   # `spec` states the whole dependency value outright and wins over
   # everything.
   sdk: dep: {

package/.sdk/src/cmp/seneca-provider/Extras_seneca-provider.ts

@@ -1621,14 +1621,26 @@ const Workflow = cmp(function Workflow(props: any) {
       File({ name: 'build.yml' }, () => {
         Content(`# Generated by @voxgig/sdkgen. Do not edit.
 #
-${provider.sdkGit ?
+${'git' === provider.sdkDepKind ?
           `# The ${provider.api} SDK is depended on by GIT TAG rather than taken from a\n` +
           '# registry, so `npm install` resolves the tag named in package.json and\n' +
-          '# needs git on PATH — every GitHub runner has it. Nothing else is needed\n' +
-          '# to build and run the offline tests on any platform.' :
-          `# The ${provider.api} SDK is a normal published dependency, so \`npm install\`\n` +
-          '# is all that is needed to build and run the offline tests on every\n' +
-          '# platform.'}
+          '# needs git on PATH — every GitHub runner has it.\n' +
+          '#\n' +
+          '# npm 12 refuses a git dependency by default (allow-git defaults to\n' +
+          '# "none"), which is what --allow-git=all below opts back into. Nothing\n' +
+          '# else is needed to build and run the offline tests on any platform.' :
+          'release' === provider.sdkDepKind ?
+            `# The ${provider.api} SDK is depended on by GITHUB RELEASE ASSET rather than\n` +
+            '# taken from a registry: an npm-pack tarball attached to the tag, which\n' +
+            '# npm installs without looking at the repository layout.\n' +
+            '#\n' +
+            '# npm 12 refuses a remote tarball by default (allow-remote defaults to\n' +
+            '# "none"), which is what --allow-remote=all below opts back into. That\n' +
+            '# flag does not travel to consumers of this package, so publishing the\n' +
+            '# SDK remains the durable answer.' :
+            `# The ${provider.api} SDK is a normal published dependency, so \`npm install\`\n` +
+            '# is all that is needed to build and run the offline tests on every\n' +
+            '# platform.'}
 ${!provider.liveApp ? '' : `#
 # The live tests additionally need the companion server, which is only
 # distributed in the SDK's source repository (it is not published). That repo
@@ -1699,7 +1711,7 @@ ${!provider.liveApp ? '' : `
           done
           echo "server did not start; live tests will skip"
 `}
-      - run: npm install
+      - run: npm install${provider.sdkInstallFlag}
 
       # The Seneca host framework is a PEER dependency, so the test suite needs
       # it installed explicitly. --no-save keeps npm from rewriting the peer
@@ -1798,7 +1810,7 @@ jobs:
           node-version: 24.x
 
       # install, not ci: this package does not commit a lockfile.
-      - run: npm install
+      - run: npm install${provider.sdkInstallFlag}
 
       # The Seneca host framework is a PEER dependency, so the test suite
       # needs it installed explicitly.

package/.sdk/src/cmp/seneca-provider/Main_seneca-provider.ts

@@ -723,6 +723,26 @@ const Main = cmp(function Main(props: any) {
     // CI note says so, because "npm install is all you need" stops being
     // true the moment git or a tarball URL is in the path.
     sdkGit: !sdkDep.startsWith('^'),
+    // WHICH non-registry kind, because the CI note has to be true: a git
+    // dependency needs git on PATH and a release asset does not, and a note
+    // that says the wrong one is worse than no note.
+    sdkDepKind: sdkDep.startsWith('github:') ? 'git' :
+      (sdkDep.startsWith('http') ? 'release' : 'npm'),
+    // THE OPT-IN A NON-REGISTRY DEPENDENCY NEEDS, or ''.
+    //
+    // npm 12 defaults `allow-git` and `allow-remote` to "none" and REFUSES
+    // such a dependency outright — EALLOWGIT / EALLOWREMOTE, before it
+    // fetches anything. Older npm allowed both, so a workflow that passes
+    // today fails the moment its runner image updates; this provider's own
+    // publish run failed that way within hours of the build run passing,
+    // because publishing upgrades npm first.
+    //
+    // Emitted ONLY where the project chose such a dependency: it is the
+    // project opting into what it already declared, not a default weakened
+    // for everyone. Publishing the SDK remains the durable answer, and this
+    // flag exists so an unpublished one is workable meanwhile.
+    sdkInstallFlag: sdkDep.startsWith('github:') ? ' --allow-git=all' :
+      (sdkDep.startsWith('http') ? ' --allow-remote=all' : ''),
     repoUrl: repo.url,
     // The SDK's own repo, for pointing at the companion test server which is
     // only distributed in source.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voxgig/sdkgen-infrapack",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Infrastructure-provider targets for the Voxgig SDK Generator: Seneca provider.",
   "type": "commonjs",
   "license": "MIT",

package/sdkgen-package.json

@@ -3,7 +3,7 @@
     "package": 1
   },
   "name": "@voxgig/sdkgen-infrapack",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "engines": {
     "sdkgen": ">=4.12.0"
   },