Files
Shade/scripts/Deprecated/publish-all.ts
Sterister e6fdf31b49
Some checks failed
Test / test (push) Has been cancelled
Cross-platform vectors / TypeScript vectors (bun) (push) Has been cancelled
Cross-platform vectors / Kotlin vectors (gradle) (push) Has been cancelled
Docker build and publish / docker (push) Has been cancelled
Publish / publish (push) Has been cancelled
release(v4.0.0): Shade GA — V3.x consolidation + audit prep
V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-03 18:35:35 +02:00

172 lines
5.8 KiB
TypeScript

#!/usr/bin/env bun
/**
* Publish all @shade/* packages to the Gitea npm registry.
*
* Expects these env vars:
* GITEA_TOKEN — publish token from Gitea (Settings → Applications)
* GITEA_USER — Gitea username that owns the registry (e.g. "Stian")
*
* Optional:
* DRY_RUN=1 — build tarballs but don't publish
*
* Usage:
* bun run scripts/publish-all.ts
*/
import { readFileSync, writeFileSync, existsSync } from 'fs';
import { join } from 'path';
import { $ } from 'bun';
// Order matters: each package only depends on packages above it. Publishing
// in this order means a consumer fetching mid-publish never sees a manifest
// pointing at an unpublished version.
const PACKAGES = [
'shade-core',
'shade-proto',
'shade-crypto-web',
'shade-storage-sqlite',
'shade-storage-postgres',
'shade-streams',
'shade-transport',
'shade-server',
'shade-transfer',
'shade-files',
'shade-recovery',
'shade-observer',
'shade-sdk',
'shade-widgets',
'shade-cli',
];
const REGISTRY_HOST = 'gt.zyon.no';
const ROOT = join(import.meta.dir, '..');
async function main() {
const token = process.env.GITEA_TOKEN;
const user = process.env.GITEA_USER ?? 'Stian';
const dryRun = process.env.DRY_RUN === '1';
if (!token && !dryRun) {
console.error('GITEA_TOKEN is required (or set DRY_RUN=1)');
process.exit(1);
}
const registryUrl = `https://${REGISTRY_HOST}/api/packages/${user}/npm/`;
console.log(`Target registry: ${registryUrl}`);
console.log(`Dry run: ${dryRun ? 'yes' : 'no'}`);
console.log();
// Write a temporary .npmrc at the root
const npmrcPath = join(ROOT, '.npmrc.publish');
const npmrc = [
`@shade:registry=${registryUrl}`,
dryRun ? '' : `//${REGISTRY_HOST}/api/packages/${user}/npm/:_authToken=${token}`,
].filter(Boolean).join('\n');
writeFileSync(npmrcPath, npmrc);
// Build a name → version map across all workspace packages so we can rewrite
// `workspace:*` (and friends) into concrete `^<version>` specifiers before
// publishing. Without this, the registry stores the literal `workspace:*`
// string in published package.json, which then fails to resolve in any
// consumer (e.g. Dispatch) outside the Shade monorepo.
const versionByName = new Map<string, string>();
for (const pkg of PACKAGES) {
const pkgDir = join(ROOT, 'packages', pkg);
if (!existsSync(join(pkgDir, 'package.json'))) continue;
const json = JSON.parse(readFileSync(join(pkgDir, 'package.json'), 'utf-8'));
versionByName.set(json.name, json.version);
}
let published = 0;
let skipped = 0;
let alreadyPublished = 0;
let failed = 0;
for (const pkg of PACKAGES) {
const pkgDir = join(ROOT, 'packages', pkg);
const pkgJsonPath = join(pkgDir, 'package.json');
if (!existsSync(pkgJsonPath)) {
console.log(`${pkg} — package.json not found, skipping`);
skipped++;
continue;
}
const originalPkgJson = readFileSync(pkgJsonPath, 'utf-8');
const pkgJson = JSON.parse(originalPkgJson);
console.log(`${pkgJson.name}@${pkgJson.version}`);
rewriteWorkspaceSpecs(pkgJson, versionByName);
writeFileSync(pkgJsonPath, `${JSON.stringify(pkgJson, null, 2)}\n`);
try {
if (dryRun) {
await $`cd ${pkgDir} && bun pm pack --dry-run`.quiet();
} else {
await $`cd ${pkgDir} && npm publish --registry=${registryUrl} --userconfig ${npmrcPath}`.quiet();
}
published++;
console.log(`${dryRun ? 'packed' : 'published'}`);
} catch (err) {
const out = `${err instanceof Error ? err.message : String(err)} ${
(err as { stderr?: { toString(): string } }).stderr?.toString() ?? ''
} ${(err as { stdout?: { toString(): string } }).stdout?.toString() ?? ''}`;
// Gitea (and npm) report already-published versions as 409 / EPUBLISHCONFLICT.
// Skip silently rather than failing the whole run — bumping the version
// is the user's explicit decision via `bun run version <new>`.
if (/409|EPUBLISHCONFLICT|already exists|already been published/i.test(out)) {
alreadyPublished++;
console.log(` ⊙ already published — skipping`);
} else {
failed++;
console.error(` ✗ failed: ${(err as Error).message}`);
process.exitCode = 1;
}
} finally {
// Always restore the original package.json so the workspace stays usable
// for `bun install` after publish, regardless of success or failure.
writeFileSync(pkgJsonPath, originalPkgJson);
}
}
// Clean up temp npmrc
try {
await $`rm ${npmrcPath}`.quiet();
} catch {}
console.log();
console.log(
`Done: ${published} ${dryRun ? 'packed' : 'published'}, ${alreadyPublished} already published, ${skipped} skipped, ${failed} failed`,
);
}
/**
* Rewrite `workspace:*` (and `workspace:^`, `workspace:~`, `workspace:<v>`)
* specifiers in dependency sections to concrete `^<version>` specifiers.
* Mutates the passed-in object.
*/
function rewriteWorkspaceSpecs(
pkgJson: Record<string, unknown>,
versionByName: Map<string, string>,
): void {
const sections = ['dependencies', 'peerDependencies', 'optionalDependencies'] as const;
for (const section of sections) {
const deps = pkgJson[section];
if (!deps || typeof deps !== 'object') continue;
for (const [name, spec] of Object.entries(deps as Record<string, string>)) {
if (typeof spec !== 'string' || !spec.startsWith('workspace:')) continue;
const version = versionByName.get(name);
if (!version) {
throw new Error(
`No workspace version known for ${name} (referenced from ${pkgJson.name as string}). ` +
`Add it to PACKAGES or remove the workspace dependency.`,
);
}
(deps as Record<string, string>)[name] = `^${version}`;
}
}
}
main().catch((err) => {
console.error(err);
process.exit(1);
});