From ab1bb1b28c0ee48d14f1dc9fb637b5c96be682da Mon Sep 17 00:00:00 2001 From: Ned Twigg Date: Tue, 22 Sep 2026 22:40:06 -0700 Subject: [PATCH] Prepare the packages for their first npm release as 0.2.0 Drop private, publish the scoped packages publicly, and give each an npm README with its peers and a no-stability-promise disclaimer. 0.2.0 because 0.1.0 archives predate the peer-dependency change. The auth description now lists Microsoft, which it supports. Co-Authored-By: Claude Opus 5.5 (1M context) --- PACKAGES.md | 4 ++-- README.md | 2 +- packages/auth/README.md | 11 +++++++++++ packages/auth/package.json | 6 +++--- packages/pgstencil/README.md | 11 +++++++++++ packages/pgstencil/package.json | 4 ++-- packages/stripe/README.md | 11 +++++++++++ packages/stripe/package.json | 4 ++-- 8 files changed, 43 insertions(+), 10 deletions(-) create mode 100644 packages/auth/README.md create mode 100644 packages/pgstencil/README.md create mode 100644 packages/stripe/README.md diff --git a/PACKAGES.md b/PACKAGES.md index 20709fb..e8ce107 100644 --- a/PACKAGES.md +++ b/PACKAGES.md @@ -1,10 +1,10 @@ # Consuming pgstencil -Three packages share version 0.1.0: `pgstencil` (infrastructure and test primitives), `@pgstencil/auth` (email/OAuth/session services and a JSON HTTP adapter), and `@pgstencil/stripe` (SaaS billing and StripeDev). They are private workspace packages for now; no registry account is needed to consume their tarballs. +Three packages share version 0.2.0: `pgstencil` (infrastructure and test primitives), `@pgstencil/auth` (email/OAuth/session services and a JSON HTTP adapter), and `@pgstencil/stripe` (SaaS billing and StripeDev). They are published to npm as 0.x releases, so a minor release may break compatibility. Run `pnpm packages:pack` to produce the three archives in `dist/packages`. They contain ESM JavaScript, TypeScript declarations, the MIT license, and required SQL/Compose assets. Workspace development uses source exports; packing switches the exports to compiled files. Nothing runs migrations during install. -Copy the tarballs to a consumer's `vendor/` directory, depend on them using `file:` paths, and override all three package names to those same paths in the consumer's pnpm configuration. The override for `pgstencil` ensures auth and billing's peer also resolves locally. `packages:pack` refuses a modified build input tree, because an untracked file under `migrations` would otherwise ship in the archive; `--allow-dirty` overrides that for a local experiment. Commit the archives and lockfile together for a reproducible temporary distribution. Once public npm is configured, replace these paths with exact registry versions and remove the overrides. +Copy the tarballs to a consumer's `vendor/` directory, depend on them using `file:` paths, and override all three package names to those same paths in the consumer's pnpm configuration. The override for `pgstencil` ensures auth and billing's peer also resolves locally. `packages:pack` refuses a modified build input tree, because an untracked file under `migrations` would otherwise ship in the archive; `--allow-dirty` overrides that for a local experiment. Commit the archives and lockfile together for a reproducible temporary distribution. An application that installs a released version from npm uses an ordinary version range instead, with no overrides. Every archive carries `package/dist/provenance.json`, holding the 40-character `commit` it was packed from plus `"dirty": true` when `--allow-dirty` packed a modified tree. Read it without unpacking the archive: `tar -xOf vendor/pgstencil-0.1.0.tgz package/dist/provenance.json`. That path is the contract; nothing else in the archive identifies its source, since npm's `gitHead` is absent from a `pnpm pack` of a private package. A consumer should record the commit it vendored, re-derive it from the archive on every build, and refuse an archive whose commit differs or that is marked dirty. `pnpm packages:verify` makes the same assertion against this checkout's `HEAD`, so a stale archive fails CI here. Having recovered the commit, a consumer confirms it was audited by reading its check run — `gh api repos/diffplug/pgstencil/commits//check-runs` lists `security-audit`, which succeeds only when that commit's audit against [SECURITY.md](SECURITY.md) reached `VERDICT: PASS`. diff --git a/README.md b/README.md index cc58eb7..a86574c 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ Use `PORT=3000 pnpm dev` for a fixed port. Development uses real time so cooldow | Email | Injected `EmailSender`, with `EmailDev` capture, waiting, unread checks and preview routes | | Snapshots | Vitest file snapshots plus local JSON, response, HTML, Markdown and email captures | -The workspace contains `pgstencil`, `@pgstencil/auth`, and `@pgstencil/stripe`. They are not yet published to npm; [PACKAGES.md](PACKAGES.md) explains consumption through compiled local tarballs. The core package's `pgstencil/postgres` export is the runtime connection layer; `pgstencil/database` and `pgstencil/testing` include local Docker infrastructure. `examples/login` is a complete consumer, using Node's HTTP server and native HTML forms. No frontend framework is required. +The workspace contains `pgstencil`, `@pgstencil/auth`, and `@pgstencil/stripe`. They are published to npm as 0.x releases; [PACKAGES.md](PACKAGES.md) explains installing them and consuming unreleased changes through compiled local tarballs. The core package's `pgstencil/postgres` export is the runtime connection layer; `pgstencil/database` and `pgstencil/testing` include local Docker infrastructure. `examples/login` is a complete consumer, using Node's HTTP server and native HTML forms. No frontend framework is required. Hono and Cloudflare Workers are supported through the shared Fetch adapter and request-scoped Hyperdrive connections. See [WORKERS.md](WORKERS.md) for the deployable example, local runtime tests, and deployment preparation. diff --git a/packages/auth/README.md b/packages/auth/README.md new file mode 100644 index 0000000..8f133d1 --- /dev/null +++ b/packages/auth/README.md @@ -0,0 +1,11 @@ +# @pgstencil/auth + +Email, Google, Apple, Microsoft, Facebook and GitHub authentication for Node, Hono and Cloudflare Workers. + +> **Built for our own applications.** pgstencil is developed alongside DiffPlug's products and published so they can share it. It is 0.x: a minor release may break compatibility, and there is no support promise. + +```sh +pnpm add @pgstencil/auth pgstencil kysely hono +``` + +The packages after the first are peer dependencies: your application owns their versions and shares one copy with pgstencil. See [PACKAGES.md](https://github.com/diffplug/pgstencil/blob/main/PACKAGES.md) for usage and the dependency policy, and [SECURITY.md](https://github.com/diffplug/pgstencil/blob/main/SECURITY.md) for the audited security rules. Source: [diffplug/pgstencil](https://github.com/diffplug/pgstencil). diff --git a/packages/auth/package.json b/packages/auth/package.json index 173635b..f0a964f 100644 --- a/packages/auth/package.json +++ b/packages/auth/package.json @@ -1,7 +1,6 @@ { "name": "@pgstencil/auth", - "version": "0.1.0", - "private": true, + "version": "0.2.0", "type": "module", "exports": { ".": "./src/index.ts", @@ -48,6 +47,7 @@ "better-auth-migrations" ], "publishConfig": { + "access": "public", "exports": { ".": { "types": "./dist/index.d.ts", @@ -123,7 +123,7 @@ } } }, - "description": "Email, Google, Apple, Facebook and GitHub authentication for Node, Hono and Cloudflare Workers.", + "description": "Email, Google, Apple, Microsoft, Facebook and GitHub authentication for Node, Hono and Cloudflare Workers.", "license": "MIT", "homepage": "https://github.com/diffplug/pgstencil#readme", "repository": { diff --git a/packages/pgstencil/README.md b/packages/pgstencil/README.md new file mode 100644 index 0000000..375b813 --- /dev/null +++ b/packages/pgstencil/README.md @@ -0,0 +1,11 @@ +# pgstencil + +Postgres schema migrations, isolated test databases, and deterministic snapshot testing for TypeScript. + +> **Built for our own applications.** pgstencil is developed alongside DiffPlug's products and published so they can share it. It is 0.x: a minor release may break compatibility, and there is no support promise. + +```sh +pnpm add pgstencil kysely +``` + +`kysely` is a peer dependency: your application owns its version and shares one copy with pgstencil. See [PACKAGES.md](https://github.com/diffplug/pgstencil/blob/main/PACKAGES.md) for usage and the dependency policy, and [SECURITY.md](https://github.com/diffplug/pgstencil/blob/main/SECURITY.md) for the audited security rules. Source: [diffplug/pgstencil](https://github.com/diffplug/pgstencil). diff --git a/packages/pgstencil/package.json b/packages/pgstencil/package.json index c24c253..716c562 100644 --- a/packages/pgstencil/package.json +++ b/packages/pgstencil/package.json @@ -1,7 +1,6 @@ { "name": "pgstencil", - "version": "0.1.0", - "private": true, + "version": "0.2.0", "type": "module", "exports": { ".": "./src/index.ts", @@ -33,6 +32,7 @@ "LICENSE" ], "publishConfig": { + "access": "public", "exports": { ".": { "types": "./dist/index.d.ts", diff --git a/packages/stripe/README.md b/packages/stripe/README.md new file mode 100644 index 0000000..2feba6d --- /dev/null +++ b/packages/stripe/README.md @@ -0,0 +1,11 @@ +# @pgstencil/stripe + +Stripe SaaS subscriptions, card-required trials, durable webhooks, and a local payment simulator for pgstencil. + +> **Built for our own applications.** pgstencil is developed alongside DiffPlug's products and published so they can share it. It is 0.x: a minor release may break compatibility, and there is no support promise. + +```sh +pnpm add @pgstencil/stripe pgstencil kysely stripe +``` + +The packages after the first are peer dependencies: your application owns their versions and shares one copy with pgstencil. See [PACKAGES.md](https://github.com/diffplug/pgstencil/blob/main/PACKAGES.md) for usage and the dependency policy, and [SECURITY.md](https://github.com/diffplug/pgstencil/blob/main/SECURITY.md) for the audited security rules. Source: [diffplug/pgstencil](https://github.com/diffplug/pgstencil). diff --git a/packages/stripe/package.json b/packages/stripe/package.json index cd947e0..00b24af 100644 --- a/packages/stripe/package.json +++ b/packages/stripe/package.json @@ -1,7 +1,6 @@ { "name": "@pgstencil/stripe", - "version": "0.1.0", - "private": true, + "version": "0.2.0", "type": "module", "exports": { ".": "./src/index.ts", @@ -27,6 +26,7 @@ "LICENSE" ], "publishConfig": { + "access": "public", "exports": { ".": { "types": "./dist/index.d.ts",