skein-js 0.5.0 → 0.7.0

package/README.md

@@ -52,15 +52,19 @@ LangGraph Studio — any Agent Protocol client works with only a URL change. See
 
 ## Commands
 
-| Command            | What it does                                                   | LangGraph CLI equivalent | Key flags                                      |
-| ------------------ | -------------------------------------------------------------- | ------------------------ | ---------------------------------------------- |
-| `skein dev`        | In-process dev server, hot reload, `.skein/` state, no Docker. | `langgraph dev`          | see [`skein dev` flags](#skein-dev-flags)      |
-| `skein up`         | Self-hosted stack via Docker Compose (app + Postgres + Redis). | `langgraph up`           | `-p, --port` (8123) · `--host` (0.0.0.0)       |
-| `skein build`      | Build a deployable Docker image from the config.               | `langgraph build`        | `-t, --tag` (defaults to the project dir name) |
-| `skein dockerfile` | Emit a standalone Dockerfile (stdout by default).              | `langgraph dockerfile`   | `-o, --output <path>`                          |
+| Command            | What it does                                                   | LangGraph CLI equivalent | Key flags                                                             |
+| ------------------ | -------------------------------------------------------------- | ------------------------ | --------------------------------------------------------------------- |
+| `skein dev`        | In-process dev server, hot reload, `.skein/` state, no Docker. | `langgraph dev`          | see [`skein dev` flags](#skein-dev-flags)                             |
+| `skein up`         | Self-hosted stack via Docker Compose (app + Postgres + Redis). | `langgraph up`           | `-p, --port` (8123) · `--host` (0.0.0.0) · `-n, --npmrc <path>`       |
+| `skein build`      | Build a deployable Docker image from the config.               | `langgraph build`        | `-t, --tag` (defaults to the project dir name) · `-n, --npmrc <path>` |
+| `skein dockerfile` | Emit a standalone Dockerfile (stdout by default).              | `langgraph dockerfile`   | `-o, --output <path>`                                                 |
 
 All commands take `-c, --config <path>` (default `langgraph.json`).
 
+`--npmrc <path>` (on `build`/`up`) mounts an `.npmrc` as a BuildKit secret so the image's dependency
+install can authenticate against a **private/authenticated npm registry** without baking a token into
+any layer. Public-registry builds don't need it.
+
 ## `skein dev` flags
 
 | Flag               | Values               | Default     | Notes                                                          |

package/dist/index.js

@@ -359,7 +359,7 @@ async function runDev(options) {
 
 // src/docker/commands.ts
 import { spawn, spawnSync } from "child_process";
-import { writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, writeFileSync as writeFileSync2 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import path5 from "path";
 import { loadConfig as loadConfig3 } from "@skein-js/config";
@@ -370,7 +370,7 @@ import { mkdir, writeFile } from "fs/promises";
 import { createRequire, isBuiltin } from "module";
 import path4 from "path";
 import { loadConfig as loadConfig2, parseGraphSpec } from "@skein-js/config";
-import { embedRuntimePackage, isCustomFunctionPath } from "@skein-js/runtime";
+import { providerEmbedPackage, isCustomFunctionPath } from "@skein-js/runtime";
 
 // src/bundle/precompute-schemas.ts
 async function precomputeSchemas(graphs) {
@@ -535,7 +535,7 @@ async function bundleProject(options) {
   for (const peer of SKEIN_RUNTIME_PEERS) {
     dependencies[peer] = resolveInstalledVersion(peer, workspaceRoot);
   }
-  const embedPkg = config.store?.index?.embed && embedRuntimePackage(config.store.index.embed);
+  const embedPkg = config.store?.index?.embed && providerEmbedPackage(config.store.index.embed);
   if (embedPkg) dependencies[embedPkg] = resolveInstalledVersion(embedPkg, workspaceRoot);
   for (const dep of config.dependencies ?? []) {
     if (dep.startsWith(".") || dep.startsWith("/")) continue;
@@ -568,10 +568,19 @@ function portMapping(options) {
 }
 function generateCompose(options) {
   const ports = portMapping(options);
+  const appBuild = options.npmrcPath ? `build:
+      context: .
+      secrets:
+        - npmrc` : `build: .`;
+  const secretsBlock = options.npmrcPath ? `
+secrets:
+  npmrc:
+    file: ${JSON.stringify(options.npmrcPath)}
+` : "";
   return `# Generated by skein \u2014 regenerated by \`skein up\`. Edit with care.
 services:
   app:
-    build: .
+    ${appBuild}
     # Reap zombies + forward signals with an init process (PID 1), so graph-spawned children don't
     # accumulate; the app itself still handles SIGTERM for graceful shutdown.
     init: true
@@ -616,7 +625,7 @@ services:
 
 volumes:
   skein-pgdata:
-`;
+${secretsBlock}`;
 }
 
 // src/docker/dockerfile.ts
@@ -631,6 +640,9 @@ function generateDockerignore() {
     "node_modules",
     ".env",
     ".env.*",
+    // Never bake a registry credential into a layer — it's supplied via a BuildKit secret at install.
+    ".npmrc",
+    ".npmrc.*",
     "Dockerfile",
     "compose.yaml",
     ".dockerignore",
@@ -653,10 +665,15 @@ function generateDockerfile(options) {
     ``,
     // Install prod deps first for layer caching: the artifact's pinned package.json changes rarely,
     // so this layer is reused across rebuilds while only the bundle layer below re-runs. The BuildKit
-    // cache mount keeps the npm cache out of the committed layer.
+    // cache mount keeps the npm cache out of the committed layer. The `npmrc` secret mount lets private
+    // scoped deps authenticate against a private/authenticated registry without baking a token into any
+    // layer; it is optional (BuildKit secrets are not required by default), so a public-registry build
+    // that passes no secret is unaffected. Supply it via `skein build --npmrc <path>` or, for the
+    // standalone Dockerfile, `docker build --secret id=npmrc,src=<path>`.
     `# Install the artifact's pinned production dependencies (exact versions \u2014 deterministic).`,
     `COPY package.json ./`,
     `RUN --mount=type=cache,target=/root/.npm \\`,
+    `    --mount=type=secret,id=npmrc,target=/app/.npmrc \\`,
     `    npm install --omit=dev --omit=optional --no-audit --no-fund`,
     ``,
     `# Copy the pre-built artifact (bundled JS graphs, production langgraph.json, baked schemas).`,
@@ -723,6 +740,16 @@ function defaultImageTag(configDir) {
   const trimmed = base.replace(/^[-.]+|[-.]+$/g, "");
   return trimmed.length > 0 ? trimmed : "skein-app";
 }
+function resolveNpmrcSecret(npmrc) {
+  if (npmrc === void 0) return void 0;
+  const resolved = path5.resolve(process.cwd(), npmrc);
+  if (!existsSync4(resolved)) {
+    console.error(`skein: --npmrc file not found: ${resolved}`);
+    process.exitCode = 1;
+    return null;
+  }
+  return resolved;
+}
 function dockerAvailable() {
   const probe = spawnSync("docker", ["--version"], { stdio: "ignore" });
   return probe.status === 0;
@@ -768,6 +795,8 @@ async function runDockerfile(options) {
 }
 async function runBuild(options) {
   const context = await loadConfigContext(options.config);
+  const npmrcPath = resolveNpmrcSecret(options.npmrc);
+  if (npmrcPath === null) return;
   if (!requireDocker()) return;
   let artifactDir;
   try {
@@ -778,10 +807,11 @@ async function runBuild(options) {
     return;
   }
   const tag = options.tag ?? defaultImageTag(context.configDir);
+  const secretArgs = npmrcPath !== void 0 ? ["--secret", `id=npmrc,src=${npmrcPath}`] : [];
   console.log(`skein: building image "${tag}"\u2026`);
   const result = await runToCompletion(
     "docker",
-    ["build", "-t", tag, "-f", path5.join(artifactDir, DOCKERFILE_NAME), "."],
+    ["build", "-t", tag, "-f", path5.join(artifactDir, DOCKERFILE_NAME), ...secretArgs, "."],
     artifactDir
   );
   if (!succeeded(result)) {
@@ -793,6 +823,8 @@ async function runBuild(options) {
 }
 async function runUp(options) {
   const context = await loadConfigContext(options.config);
+  const npmrcPath = resolveNpmrcSecret(options.npmrc);
+  if (npmrcPath === null) return;
   if (!requireDocker()) return;
   let artifactDir;
   try {
@@ -802,7 +834,8 @@ async function runUp(options) {
         contents: generateCompose({
           hostPort: options.port,
           host: options.host,
-          containerPort: CONTAINER_PORT
+          containerPort: CONTAINER_PORT,
+          npmrcPath
         })
       }
     ]);
@@ -826,7 +859,7 @@ async function runUp(options) {
 }
 
 // src/import-command.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import path6 from "path";
 import { loadConfig as loadConfig4 } from "@skein-js/config";
 import {
@@ -850,7 +883,7 @@ async function runImportLanggraph(options) {
   const counts = describeSnapshot2(snapshot);
   if (options.store === "memory") {
     const stateFile = devStateFile(configDir);
-    if (existsSync4(stateFile) && !options.force) {
+    if (existsSync5(stateFile) && !options.force) {
       console.error(
         `skein: ${path6.relative(process.cwd(), stateFile)} already exists. Re-run with --force to overwrite it (or delete it first).`
       );
@@ -885,7 +918,7 @@ async function runImportLanggraph(options) {
 }
 
 // src/start-command.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
 import path7 from "path";
 import { loadConfig as loadConfig5 } from "@skein-js/config";
 import { createExpressServer as createExpressServer2 } from "@skein-js/express";
@@ -896,7 +929,7 @@ var FORCE_EXIT_MS2 = 5e3;
 var logger = createDevLogger();
 function readBakedSchemas(configDir) {
   const schemasFile = path7.join(configDir, "schemas.json");
-  if (!existsSync5(schemasFile)) {
+  if (!existsSync6(schemasFile)) {
     throw new Error(
       `no schemas.json next to the config \u2014 \`skein start\` expects a built artifact. Run \`skein build\` (or \`skein up\`), or use \`skein dev\` for a source project.`
     );
@@ -1000,8 +1033,14 @@ program.command("start").description("Serve a pre-built .skein/build artifact (t
     hostExplicit: command.getOptionValueSource("host") === "cli"
   })
 );
-program.command("up").description("Bring up the production stack (Docker Compose: app + Postgres + Redis).").option("-c, --config <path>", "Path to langgraph.json", "langgraph.json").option("-p, --port <port>", "Port to expose", parsePort, 8123).option("--host <host>", "Host to bind", "0.0.0.0").action((options) => runUp(options));
-program.command("build").description("Build a deployable Docker image from the config.").option("-c, --config <path>", "Path to langgraph.json", "langgraph.json").option("-t, --tag <tag>", "Image tag (defaults to the project directory name)").action((options) => runBuild(options));
+program.command("up").description("Bring up the production stack (Docker Compose: app + Postgres + Redis).").option("-c, --config <path>", "Path to langgraph.json", "langgraph.json").option("-p, --port <port>", "Port to expose", parsePort, 8123).option("--host <host>", "Host to bind", "0.0.0.0").option(
+  "-n, --npmrc <path>",
+  "Path to an .npmrc for authenticating private-registry installs (wired in as a build secret)"
+).action((options) => runUp(options));
+program.command("build").description("Build a deployable Docker image from the config.").option("-c, --config <path>", "Path to langgraph.json", "langgraph.json").option("-t, --tag <tag>", "Image tag (defaults to the project directory name)").option(
+  "-n, --npmrc <path>",
+  "Path to an .npmrc for authenticating private-registry installs (passed to docker build as a BuildKit secret)"
+).action((options) => runBuild(options));
 program.command("dockerfile").description("Emit a standalone Dockerfile from the config.").option("-c, --config <path>", "Path to langgraph.json", "langgraph.json").option("-o, --output <path>", "Write the Dockerfile here instead of stdout").action((options) => runDockerfile(options));
 program.command("import-langgraph").description("Import an existing LangGraph in-memory dev state (.langgraph_api/) into skein.").option("-c, --config <path>", "Path to langgraph.json", "langgraph.json").option(
   "--store <driver>",

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "skein-js",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "The skein-js CLI — a drop-in replacement for the LangGraph CLI (dev/up/build/dockerfile).",
   "license": "Apache-2.0",
   "author": "Maina Wycliffe <wmmaina7@gmail.com>",
-  "homepage": "https://github.com/mainawycliffe/skein-js/tree/main/packages/cli#readme",
+  "homepage": "https://github.com/skein-js/skein-js/tree/main/packages/cli#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/mainawycliffe/skein-js.git",
+    "url": "git+https://github.com/skein-js/skein-js.git",
     "directory": "packages/cli"
   },
   "bugs": {
-    "url": "https://github.com/mainawycliffe/skein-js/issues"
+    "url": "https://github.com/skein-js/skein-js/issues"
   },
   "keywords": [
     "typescript",
@@ -47,10 +47,10 @@
     "@commander-js/extra-typings": "~13.1.0",
     "@langchain/langgraph-checkpoint-postgres": "^1.0.4",
     "commander": "~13.1.0",
-    "@skein-js/core": "0.5.0",
-    "@skein-js/express": "0.5.0",
-    "@skein-js/config": "0.5.0",
-    "@skein-js/runtime": "0.5.0"
+    "@skein-js/config": "0.7.0",
+    "@skein-js/core": "0.7.0",
+    "@skein-js/runtime": "0.7.0",
+    "@skein-js/express": "0.7.0"
   },
   "optionalDependencies": {
     "vite": "^8.1.0"