[notme-18450e] feat(dpop): publish to npmjs.org as notme-dpop (anonymous install)#45
Merged
Merged
Conversation
…ous install) Moves the SDK off GitHub Packages, where it briefly shipped as @agentic-research/dpop@0.1.0. The problem with that registry: it requires authentication to INSTALL even for public packages — 401 anonymous, verified directly against the endpoint. That put a token requirement on every consumer: cloister CI, canonical-hours, every local dev machine, and any external resource server verifying notme tokens. For a public identity provider's verifier SDK, that is the wrong trade — the package's whole reason to exist is being easy to depend on. npmjs.org installs anonymously and needs no consumer .npmrc at all. Unscoped `notme-dpop` rather than `@notme/dpop` deliberately: an unscoped name needs no npm org to exist first, which removes the last piece of setup. Both names were confirmed unregistered. Publishing now uses --provenance with id-token: write, so npm attaches an attestation binding the tarball to this workflow and commit — consumers can verify it was built here rather than uploaded from a laptop. That is strictly better than what GitHub Packages was giving us, so the forced move bought something. The GitHub Packages copy is left in place, frozen at 0.1.0. Nothing consumes it. Verified: worker 339 pass, worker tsc clean, package build clean, and the packed tarball inspected rather than assumed — name notme-dpop, main ./dist/index.js, types ./dist/index.d.ts, LICENSE included. Remaining manual step: an NPM_TOKEN repo secret. That is the one thing that cannot be automated from here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the SDK off GitHub Packages, where it briefly shipped as
@agentic-research/dpop@0.1.0.Why
GitHub Packages requires authentication to install even public packages — verified directly:
401anonymous,403with a token lackingread:packages. npmjs.org returns200unauthenticated for contrast.That put a token requirement on every consumer: cloister CI, canonical-hours, every local dev machine, and any external resource server verifying notme tokens. For a public identity provider's verifier SDK, that's the wrong trade — the package's whole reason to exist is being easy to depend on.
Name
Unscoped
notme-dpop, not@notme/dpop. An unscoped name needs no npm org to exist first, removing the last piece of setup. Both were confirmed unregistered on npmjs.org.Provenance
Publishing now uses
--provenancewithid-token: write, so npm attaches an attestation binding the tarball to this workflow and commit — consumers can verify it was built here rather than uploaded from a laptop. Strictly better than what GitHub Packages was giving us, so the forced move bought something.Verification
tsc --noEmit— cleanname: notme-dpop,main: ./dist/index.js,types: ./dist/index.d.ts, LICENSE includedThe GitHub Packages copy is left in place, frozen at 0.1.0. Nothing consumes it.
One manual step before release
An
NPM_TOKENrepo secret (npm automation token, publish scope). That's the one thing that can't be automated from here. Once it's set:Then cloister and canonical-hours delete their vendored copies —
cloister-195e47.🤖 Generated with Claude Code
https://claude.ai/code/session_01UNahXs8dda3vttpWrVwVaA