@wenathlan/saddle 1.8.2 → 1.8.5

package/docs/platformpipelineaudit.md

@@ -0,0 +1,18 @@
+# Platform pipeline audit
+
+This document records the platform facts used by the 1.8.4 pipeline work. The workflows remain caller-configured: repository owners provide runner availability, deployment secrets and target repository names.
+
+## verified platform facts
+
+| Platform | Verified contract | Source |
+| --- | --- | --- |
+| GitHub Pages | A custom workflow uses `actions/configure-pages@v5`, uploads a static artifact with `actions/upload-pages-artifact@v4`, then deploys with `actions/deploy-pages@v4`. The deployment job needs `pages: write` and `id-token: write`, depends on the build job and uses the `github-pages` environment. | [GitHub Pages custom workflows](https://docs.github.com/en/pages/getting-started-with-github-pages/using-custom-workflows-with-github-pages) |
+| Codeberg Pages | Forgejo Actions can deploy with `https://codeberg.org/git-pages/action@v2`, using `site`, `source` and the injected `${{ forge.token }}`. Publishing the repository subdomain should be restricted to the default branch. Codeberg is migrating its legacy Pages v2 flow; custom domains still have separate constraints. | [Codeberg Pages via Forgejo Actions](https://docs.codeberg.org/codeberg-pages/forgejo-actions/), [Codeberg Pages output](https://docs.codeberg.org/codeberg-pages/pushing-output/) |
+| GitLab Pages | A job with `pages: true` publishes the default `public` directory; the job can also use a `pages` hash for a `path_prefix`. Static HTML, CSS and JavaScript are supported through GitLab CI/CD. | [GitLab Pages](https://docs.gitlab.com/user/project/pages/) |
+| Woodpecker CI | A workflow is a serial list of container steps with `image` and `commands`; branch/event filters belong in `when`, and secrets are injected through the pipeline environment rather than committed YAML. | [Woodpecker workflow syntax](https://woodpecker-ci.org/docs/usage/workflow-syntax) |
+| Forgejo Actions | Fully qualified actions are recommended; the official checkout reference is `https://data.forgejo.org/actions/checkout@v6`. Short `actions/checkout@v6` resolves through the instance `DEFAULT_ACTIONS_URL`, which can vary. | [Forgejo Actions: Using Actions](https://forgejo.org/docs/v15.0/user/actions/actions/) |
+| Gitea Actions | Gitea Actions is mostly compatible with GitHub Actions and requires a separately installed Gitea Runner. The official documentation lists `actions/checkout@v4` as a supported action reference and warns that runner trust matters for public instances. | [Gitea Actions overview](https://docs.gitea.com/usage/actions/overview) |
+
+## boundary
+
+GitHub Pages has a first-party artifact/deploy contract. Codeberg Pages has a git-pages Forgejo Action contract. Forgejo, Gitea and GitLab workflow files can build the same static output, but their hosting destination and token names are instance-specific. Woodpecker can build and publish artifacts, but a Pages deploy step requires the target host's configured service or a caller-owned token. No workflow in this release hardcodes credentials, hostnames or a private deployment target.

package/docs/platformpipelines.md

@@ -0,0 +1,13 @@
+# Cross-forge pipelines
+
+The library keeps GitHub Actions as the release-authoritative workflow because its six registry publishers already share the release-tag action and validation action. Forgejo, Gitea, GitLab and Woodpecker now execute the same deterministic gates with Node.js 26.7.0, but they do not assume a shared package registry, release API or secret name.
+
+| Forge | File | Current role | Required caller configuration |
+| --- | --- | --- | --- |
+| GitLab | `.gitlab-ci.yml` | verify and package dry-run | runner, optional package registry credentials and artifact retention |
+| Forgejo | `.forgejo/workflows/saddle.yml` | verify and package dry-run | trusted Forgejo runner and action source policy |
+| Gitea | `.gitea/workflows/saddle.yml` | verify and package dry-run | Gitea Runner and instance action policy |
+| Codeberg | Forgejo workflow files | verify plus optional Codeberg Pages action | Codeberg repository, `forge.token` and default-branch policy |
+| Woodpecker | `.woodpecker/deploy.yml` | verify and package dry-run | trusted agent, image pull policy and optional artifact plugin |
+
+These files intentionally do not invent a cross-forge release token or hardcode a host. A caller can add a publish step for the target forge after configuring its own secret and package endpoint. The public site has its own platform workflow set in the `saddle-pages` repository.

package/docs/registryresearch.md

@@ -48,6 +48,10 @@ The active package identity on main is now `@wenathlan/saddle`. The repository h
 
 Release `v1.8.1` was created from the identity migration commit `efcbb02`. The npmjs workflow `31557618590` authenticated as `wenathlan`, generated `@wenathlan/saddle@1.8.1`, and ended with npm's `+ @wenathlan/saddle@1.8.1` success line. A later independent `npm view` returned `1.8.1`, and the direct registry metadata endpoint returned HTTP 200 with the same version record, confirming public visibility. The other v1.8.1 registry workflows also completed successfully: GitHub npm `31557618600`, GHCR `31557618571`, Maven `31557618597`, NuGet `31557618573` and RubyGems `31557618575`.
 
+Release `v1.8.2` was created from commit `ac7c355` after the repository transfer to `wenathlan`. All release jobs succeeded: GitHub npm `31559770092` logged the owner-derived `@wenathlan/saddle` package, npmjs `31559770096` published the same public package, GHCR `31559770016` pushed `ghcr.io/wenathlan/saddle:1.8.2` and `latest`, Maven `31559770216` deployed `io.wenathlan:saddle:1.8.2`, NuGet `31559770142` created and pushed `Saddle.1.8.2.nupkg`, RubyGems `31559770023` registered `saddle (1.8.2)`, and extension build `31559769740` attached `saddle-extension-1.8.2.zip`. Release validation `31559770059` also succeeded. Independent checks confirmed npmjs `@wenathlan/saddle@1.8.2` and the GitHub release asset. The GitHub organization package-list API returned 403 for the available integration, while unauthenticated GHCR, Maven and NuGet endpoints returned 401; these protected visibility boundaries do not contradict the successful authenticated workflow logs.
+
+Release `v1.8.4` was created from commit `d64a7bc` and the complete release matrix succeeded: engine CI `31561276824`, cross-runtime compatibility `31561276811`, release validation `31561278178`, extension build `31561278220`, GitHub npm `31561278174`, npmjs `31561278155`, GHCR `31561278152`, Maven `31561278161`, NuGet `31561278165` and RubyGems `31561278131`. The release therefore published `@wenathlan/saddle@1.8.4`, `ghcr.io/wenathlan/saddle:1.8.4`, `io.wenathlan:saddle:1.8.4`, `Saddle.1.8.4.nupkg`, `saddle (1.8.4)` and `saddle-extension-1.8.4.zip`. The legacy package metadata endpoint confirmed the public package `io.devthink.saddle` under `wenathlan`, but both version listing and deletion returned HTTP 403 because the current GitHub App token lacks package-management deletion permission; no deletion is claimed.
+
 ## sources
 
 1. GitHub Docs — About permissions for GitHub Packages: https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages

package/docs/release.md

@@ -1,4 +1,4 @@
-# saddle release 1.8.2
+# saddle release 1.8.5
 
 ## release path
 
@@ -6,10 +6,10 @@ The release path is intentionally split into source validation, package validati
 
 | step | owner | condition |
 |---|---|---|
-| package version | repository | `package.json` is `1.8.2` |
+| package version | repository | `package.json` is `1.8.5` |
 | quality gate | GitHub Actions | `npm run pack:check` passes |
-| tag | repository owner | tag `v1.8.2` points to the validated release commit |
-| GitHub release | repository owner | release `v1.8.2` is created from the validated tag |
+| tag | repository owner | tag `v1.8.5` points to the validated release commit |
+| GitHub release | repository owner | release `v1.8.5` is created from the validated tag |
 | GitHub Packages | GitHub Actions | `publishgithubnpm.yml`, `publishghcr.yml`, `publishmaven.yml`, `publishnuget.yml`, and `publishrubygems.yml` use `GITHUB_TOKEN` |
 | public npmjs | owner-managed GitHub Actions secret | `publishnpmjs.yml` uses `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` and derives the version from the release tag or latest release in manual maintenance runs |
 | extension zip | GitHub Actions | `buildextension.yml` derives the version from the release tag, validates the unpacked artifact and attaches `saddle-extension-<version>.zip` |

package/docs/release182notes.md

@@ -23,3 +23,5 @@ This release includes the minimal extension permission policy, deterministic ext
 ## validation boundary
 
 The release must pass `npm run check`, `npm run formatcheck`, `npm test`, `npm run pack:check` and `git diff --check` before the tag is created. Each registry workflow remains isolated because its package protocol and credential boundary differ. Publication evidence is reported only after the workflow succeeds and the target registry can be queried independently.
+
+The `v1.8.2` release and all publication workflows completed successfully. Public npm and the extension asset were independently visible. GitHub Package registries returned their expected protected-access responses to unauthenticated probes, so their workflow logs remain the authoritative evidence available to the authenticated publisher context.

package/docs/release184notes.md

@@ -0,0 +1,7 @@
+# Saddle 1.8.4
+
+Saddle 1.8.4 updates every active library and forge pipeline to Node.js 26.7.0 and adds deterministic package gates to GitLab, Forgejo, Gitea and Woodpecker workflows. GitHub Actions remains the authoritative multi-registry release path; the other forge files are caller-configured validation and artifact paths because their runners, secrets and package registries differ.
+
+The legacy public Maven package `io.devthink.saddle` was identified under the `wenathlan` organization. Its deletion request was attempted through the GitHub Packages API, but the authenticated GitHub App integration returned HTTP 403 because it lacks package-management deletion permission. The new owner-aligned Maven coordinate is `io.wenathlan:saddle` and was published successfully; it must not be removed.
+
+The companion Saddle Pages repository is public at `https://github.com/wenathlan/saddle-pages` and contains the GitHub Pages workflow using `actions/configure-pages@v5`, `actions/upload-pages-artifact@v4` and `actions/deploy-pages@v4`, plus caller-configured GitLab Pages, Forgejo, Codeberg Pages, Gitea and Woodpecker pipelines. The site builds only `dist/public` with `VITE_BASE_PATH=/saddle-pages/` and uses Node.js 26.7.0. The initial source push omitted `.github/workflows/pages.yml` because the current GitHub App token lacks the `workflow` scope; the workflow remains prepared in the local project checkpoint for the required reauthorization.

package/docs/release185notes.md

@@ -0,0 +1,7 @@
+# Saddle 1.8.5
+
+Saddle 1.8.5 extends the published 1.8.4 engine without rewriting its immutable tag. The package metadata now declares Node.js `>=26.7.0`, npm `>=10.9.2`, the reproducible package manager `npm@12.0.2`, `main`/`module`/`browser` entry hints and `sideEffects: false` for bundlers.
+
+The release adds `playwright` as an optional peer at `^1.62.1` and exposes `@wenathlan/saddle/browser-playwright`. The adapter dynamically loads the caller-installed provider and reports `OPTIONAL_DEPENDENCY_MISSING` when Playwright is not installed. No browser binary, credential, host or runtime dependency is forced into the transport-neutral root.
+
+The package remains root-based JavaScript ESM. `trustedDependencies` and patch metadata were intentionally not added: the package has no install-time dependency requiring trust escalation and no active package patch to describe. The pnpm documentation also states that pnpm 11 no longer reads settings from the `pnpm` field in `package.json`, so no stale `pnpm.patchedDependencies` field was introduced.

package/docs/sources/farm.py

@@ -0,0 +1,117 @@
+# farm.py - Orquestra N repos para multiplicar storage ilimitado
+# Ideia: 1 repo = 500MB artifact free. 10 repos = 5GB, 100 repos = 50GB ilimitado
+
+import os, requests
+
+# Lista de repos workers (você cria via API)
+WORKER_REPOS = [
+    "seuuser/opencode-worker-1",
+    "seuuser/opencode-worker-2",
+    "seuuser/opencode-worker-3",
+    # ... adicione 100
+]
+
+TOKEN = os.getenv("GITHUB_TOKEN")
+
+def dispatch_to_farm(filename, job_id):
+    for repo in WORKER_REPOS:
+        owner, name = repo.split("/")
+        url = f"https://api.github.com/repos/{owner}/{name}/actions/workflows/process-binary.yml/dispatches"
+        payload = {
+            "ref": "main",
+            "inputs": {"job_id": job_id, "filename": filename, "action": "run"}
+        }
+        r = requests.post(url, json=payload, headers={
+            "Authorization": f"Bearer {TOKEN}",
+            "Accept": "application/vnd.github+json"
+        })
+        print(f"{repo}: {r.status_code}")
+        if r.status_code == 204:
+            break # conseguiu um worker
+
+if __name__ == "__main__":
+    dispatch_to_farm("binary.wasm", "job-123")
+
+#!/bin/bash
+# Script: Transforma Armazenamento em RAM / Processamento
+# Uso: ./scripts/storage-as-ram.sh
+
+echo "=== Transformando Storage em Processamento ==="
+echo "Antes:" && free -h
+
+# 1. Swap file - transforma disco em RAM virtual
+echo "[1] Criando swap 16GB em /mnt/swapfile..."
+sudo fallocate -l 16G /mnt/swapfile 2>/dev/null || sudo dd if=/dev/zero of=/mnt/swapfile bs=1G count=16
+sudo chmod 600 /mnt/swapfile
+sudo mkswap /mnt/swapfile
+sudo swapon /mnt/swapfile
+
+# 2. tmpfs RAM disk - RAM que parece storage
+echo "[2] Criando RAM disk 8GB em /mnt/ramdisk..."
+sudo mkdir -p /mnt/ramdisk
+sudo mount -t tmpfs -o size=8G tmpfs /mnt/ramdisk
+
+# 3. ZRAM - comprime RAM para caber mais
+echo "[3] Ativando ZRAM..."
+sudo modprobe zram 2>/dev/null || true
+echo 2G | sudo tee /sys/block/zram0/disksize 2>/dev/null || true
+
+# 4. Usar /dev/shm (já é tmpfs) como workspace ultra rápido
+echo "[4] Usando /dev/shm como workspace..."
+mkdir -p /dev/shm/opencode-workspace
+
+echo "Depois:" && free -h && swapon --show && df -h /mnt/ramdisk /dev/shm
+
+echo "Pronto: Storage virou RAM. Use /mnt/ramdisk e /dev/shm para processar binários sem pesar disco."
+
+# buckets/huggingface_upload.py - Usa Hugging Face como bucket ilimitado de terceiros
+from huggingface_hub import HfApi, upload_folder
+import os
+
+# Free: public best-effort ilimitado, private 100GB
+# PRO $9/mo: 10TB public + 1TB private
+# Cada arquivo até 500GB com Xet backend
+
+api = HfApi(token=os.getenv("HF_TOKEN"))
+
+REPO_ID = "seuuser/opencode-storage" # dataset repo
+REPO_TYPE = "dataset" # dataset tem viewer, melhor para binários
+
+# Cria repo se não existe
+api.create_repo(REPO_ID, repo_type=REPO_TYPE, exist_ok=True, private=False)
+
+# Upload pasta dumps como dataset
+upload_folder(
+    folder_path="docs/results",
+    repo_id=REPO_ID,
+    repo_type=REPO_TYPE,
+    commit_message="feat: dump from browser via third-party"
+)
+
+print(f"Upload feito: https://huggingface.co/datasets/{REPO_ID}")
+# Acesso via CDN: https://huggingface.co/datasets/{REPO_ID}/resolve/main/arquivo.bin
+
+# buckets/kaggle_upload.py - Kaggle como bucket 200GB por dataset, público ilimitado
+# Limite: 200GB por dataset, 50 arquivos top-level, privado total 200GB, público ilimitado
+
+import os, json, subprocess, pathlib
+
+DATASET_NAME = "seuuser-opencode-storage-part-001" # cada dataset 200GB
+DATASET_PATH = pathlib.Path("docs/results")
+
+# dataset-metadata.json
+meta = {
+    "title": "opencode-storage-part-001",
+    "id": f"seuuser/{DATASET_NAME}",
+    "licenses": [{"name": "mit"}],
+    "resources": [{"path": "results", "description": "binários processados"}]
+}
+
+(DATASET_PATH / "dataset-metadata.json").write_text(json.dumps(meta, indent=2))
+
+# Cria ou versiona
+# kaggle datasets create -p docs/results --dir-mode tar
+# kaggle datasets version -p docs/results -m "add more bins"
+
+print("Kaggle: cada dataset público = 200GB free ilimitado. Crie N datasets para N*200GB")
+print("10 datasets = 2TB free, 100 datasets = 20TB")