Skip to content

sync with main#10

Merged
rohanharikr merged 6 commits into
httsig-changesfrom
main
May 22, 2026
Merged

sync with main#10
rohanharikr merged 6 commits into
httsig-changesfrom
main

Conversation

@rohanharikr
Copy link
Copy Markdown
Contributor

No description provided.

rohanharikr and others added 6 commits May 21, 2026 09:38
bootstrap: `--ps`/`--person-server` with no URL now binds the default
person server (https://person.hello.coop) instead of requiring a URL.
Fix getting-started + README guidance to the runnable `generate --agent
<url> --ps` form (bare `--ps` errors with no agent configured).

Bump all packages to 0.11.2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The 0.11.2 platform packages weren't on the registry when the lockfile
was first generated, leaving empty version entries that broke `npm ci`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Regenerating the lockfile on macOS pruned the non-darwin keyring native
bindings (npm optional-deps bug #4828), breaking `npm ci` on Linux CI.
Re-add all 12 platform entries so CI can load the native module.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Remove NPM_TOKEN/NODE_AUTH_TOKEN from release.yml and hardware-keys.yml;
publishing now authenticates via the GitHub OIDC id-token (trusted
publishers are configured per-package on npmjs.com). Bump the publish
jobs to node 24 for npm >= 11.5.1, which is required for OIDC.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Patch bump to exercise the new OIDC trusted-publishing release flow.
Lockfile regenerated with --package-lock-only, which keeps the
cross-platform @napi-rs/keyring entries intact and omits the not-yet-
published @aauth/hardware-keys-* 0.11.3 platform entries (optional, so
npm ci stays in sync).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The 0.11.3 bump regenerated the lockfile with --package-lock-only before
the platform packages were published, which stripped their node entries.
With the packages now on the registry, npm 11's npm ci tries to place
them fresh and crashes in arborist dedup (Invalid Version, comparing
against the versionless hardware-keys workspace link). Rebuild the
lockfile from the known-good v0.11.2 one, bumped to 0.11.3 with the real
published integrity hashes, so npm ci reifies the nodes instead of
placing them. Verified: npm ci + build pass on npm 11.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@rohanharikr rohanharikr merged commit e4b648b into httsig-changes May 22, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant