mikser-io-layouts 3.1.0 → 11.1.0

package/.github/workflows/publish.yml

@@ -0,0 +1,73 @@
+# Publish to npm without a stored token.
+#
+# npm is retiring tokens that skip the second factor — its own token page says
+# "Publish new versions directly (deprecated — ends January 2027)". This is the
+# replacement: the job proves who it is at publish time with a short-lived
+# credential GitHub issues and npm verifies, so npm trusts "the publish.yml
+# workflow in this repository" rather than a string.
+#
+# There is no NODE_AUTH_TOKEN and no secret to configure. Nothing to leak,
+# expire or rotate — the two ways publishing broke in September 2026.
+#
+# Link it once on npm: the package → Settings → Trusted Publisher → GitHub
+# Actions, naming this repository and this filename. Until that exists the
+# publish step fails rather than falling back to something weaker.
+
+name: Publish
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # The whole mechanism. Without it npm has nothing to verify.
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      # Trusted publishing landed in npm 11.5.1.
+      - name: Use an npm that can do trusted publishing
+        run: npm install -g npm@latest
+
+      # `npm install`, not `npm ci`: these packages are developed in a
+      # workspace, so dependencies hoist to its root and each package's own
+      # lockfile is never read locally. They drift silently, and CI is the only
+      # thing that would ever read them.
+      - run: npm install --no-audit --no-fund
+        env:
+          # puppeteer downloads a browser on install; nothing in the release
+          # path renders a page.
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+
+      # The tag is the release. A tag that disagrees with package.json would
+      # publish a version nobody asked for.
+      - name: Tag must match package.json
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG="$(node -p 'require("./package.json").version')"
+          if [ "$TAG" != "$PKG" ]; then
+            echo "tag v$TAG does not match package.json $PKG"
+            exit 1
+          fi
+          echo "publishing $PKG"
+
+      # The suite runs here now. It did not before: these packages declared
+      # mikser-io only as a peerDependency (npm does not install a package's
+      # own peers) or as file:../mikser-io (a path that exists on a laptop and
+      # nowhere else), so a standalone clone could not resolve the engine it
+      # tests against. Both are now real devDependencies with version ranges,
+      # which npm still satisfies from the workspace locally.
+      - run: npm test
+
+      - run: npm publish --access public

package/index.js

@@ -19,7 +19,7 @@ import _ from 'lodash'
 import {
     gateChecksum, sweepDeleted, scanSummary,
     checksumsByCollection,
-    checksum as fileChecksum, checksumOf,
+    checksum as fileChecksum, checksumOf, registerSourceChecksum,
     useDatabase,
     writeOutput, reportUnchanged,
     provideService,
@@ -283,13 +283,27 @@ export function layouts(userOptions = {}) {
         // non-entity, which is why it is a rule and not a guess.
         const isSidecarScript = (rel) => path.extname(rel.replace(/\.js$/, '')) === ''
 
+        // The folder, resolved the same way the onLoaded below resolves it.
+        //
+        // That onLoaded is where `runtime.options.layoutsFolder` gets set, and
+        // a report-only command — mikser_explain, --audit-output — runs in an
+        // onLoaded too. Which of the two runs first is plugin order, so a
+        // recompute that read the option directly worked or threw depending on
+        // it. Derived here instead, so the answer does not depend on the
+        // question's timing.
+        function layoutsFolderNow() {
+            if (runtime.options.layoutsFolder) return runtime.options.layoutsFolder
+            const name = runtime.options.layouts ?? options.layoutsFolder ?? collection
+            return path.isAbsolute(name) ? name : path.join(runtime.options.workingFolder, name)
+        }
+
         async function sidecarInputs() {
-            const scriptPaths = (await globby('**/*.js', { cwd: runtime.options.layoutsFolder }))
+            const scriptPaths = (await globby('**/*.js', { cwd: layoutsFolderNow() }))
                 .filter(isSidecarScript)
             const own = new Map()
             const shared = []
             for (const rel of scriptPaths.sort()) {
-                const sum = await fileChecksum(path.join(runtime.options.layoutsFolder, rel))
+                const sum = await fileChecksum(path.join(layoutsFolderNow(), rel))
                 own.set(rel.replace(/\.js$/, ''), sum)
                 shared.push(`${rel}:${sum}`)
             }
@@ -305,6 +319,29 @@ export function layouts(userOptions = {}) {
             return Buffer.from(`${template}:${sidecar}:${inputs.sharedDigest}`, 'utf8')
         }
 
+        // Tell core how to recompute what it stored.
+        //
+        // The catalog holds the composed value above, not a file hash, so
+        // anything comparing it against a fresh md5 of the template compares
+        // two recipes and always finds them different. mikser_explain did
+        // exactly that and reported `differs: true` for every layout on every
+        // site — a permanent false alarm about files nobody had edited.
+        //
+        // The recipe belongs here, so the recomputation does too. One
+        // function, the same one the gate uses, so the two cannot drift apart.
+        registerSourceChecksum(collection, async (entity) => {
+            // A sidecar is in this collection but is NOT composed: it is
+            // gated on its own bytes above, because it has no template and no
+            // sidecar of its own. Answering with a composed value here would
+            // report every sidecar as diverged — the same false alarm this
+            // registration exists to remove, pointed the other way.
+            //
+            // null means "nothing composed here, use the file hash", which is
+            // exactly right for it.
+            if (entity.type === 'sidecar') return null
+            return checksumOf(await layoutInputBytes(entity.uri, entity.name, await sidecarInputs()))
+        })
+
         // Named so onSync can re-run it when a sidecar changes. A function
         // declaration, so it is hoisted above the onSync registration above.
         async function rescanLayouts() {
@@ -584,6 +621,7 @@ export function layouts(userOptions = {}) {
         return {
             collection,
             type,
+            module: import.meta.url,
         }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io-layouts",
-  "version": "3.1.0",
+  "version": "11.1.0",
   "description": "SSG-flavor task-production policy for mikser-io. Multi-match layout assignment, per-layout destinations, postprocess chain attachment, layout inspection.",
   "main": "index.js",
   "type": "module",
@@ -18,7 +18,7 @@
   },
   "homepage": "https://github.com/almero-digital-marketing/mikser-io-layouts#readme",
   "peerDependencies": {
-    "mikser-io": "^10.0.0",
+    "mikser-io": "^11.1.0",
     "zod": "^4.0.0"
   },
   "dependencies": {
@@ -27,7 +27,8 @@
     "lodash": "^4.17.0"
   },
   "devDependencies": {
-    "mikser-io": "file:../mikser-io",
+    "mikser-io": "^11.1.0",
+    "mikser-io-render-liquid": "^11.0.1",
     "zod": "^4.0.0"
   }
 }