SK-3041:Spilt Skyflow-js SDK in skyflow-js & skyflow-flowvault-js packages.

.eslintignore

@@ -1,9 +1,11 @@
 
 dist
-types
+/types
+packages/*/types
 coverage
 tests
 
 babel.config.js
 webpack.*
+jest.config.js
 samples

.eslintrc.json

@@ -5,7 +5,7 @@
     ],
     "parser": "@typescript-eslint/parser",
     "parserOptions": {
-        "project": "./tsconfig.json"
+        "project": "./tsconfig.eslint.json"
     },
     "plugins": [
         "@typescript-eslint"
@@ -23,6 +23,23 @@
         }
     },
     "rules": {
+        "import/no-restricted-paths": [
+            "error",
+            {
+                "zones": [
+                    {
+                        "target": "./core",
+                        "from": "./packages",
+                        "message": "core/ must not import from packages/ — the @core boundary points downward only. Move shared code into core/ instead of importing up."
+                    },
+                    {
+                        "target": "./packages/skyflow-flowvault-js",
+                        "from": "./packages/skyflow-js",
+                        "message": "skyflow-flowvault-js must not import from skyflow-js — the two SDK packages are independent. Share code via @core only."
+                    }
+                ]
+            }
+        ],
         "import/no-cycle": "off",
         "prefer-promise-reject-errors": "off",
         "max-classes-per-file": [
@@ -32,5 +49,16 @@
         "no-param-reassign": "off",
         "prefer-destructuring": "off",
         "@typescript-eslint/no-implied-eval": "off"
-    }
+    },
+    "overrides": [
+        {
+            "files": ["core/**/*.ts", "core/**/*.js"],
+            "rules": {
+                "import/no-extraneous-dependencies": [
+                    "error",
+                    { "packageDir": ["./", "./packages/skyflow-js"] }
+                ]
+            }
+        }
+    ]
 }

.github/workflows/beta-release.yml

@@ -2,7 +2,11 @@ name: Public Beta Release
 
 on:
  push:
-    tags: '*.*.*-beta.*'
+    # The '!flowvault-*' negation excludes the flowvault namespace: a glob '*'
+    # matches '-', so a plain '*.*.*-beta.*' would also match a flowvault beta
+    # tag (flowvault-v1.0.0-beta.3) and fire this skyflow-js workflow with a
+    # garbage version. flowvault betas are handled by flowvault-beta-release.yml.
+    tags: ['*.*.*-beta.*', '!flowvault-*']
     paths-ignore:
       - "package.json"
       - "package-lock.json"
@@ -15,6 +19,12 @@ jobs:
     with:
       REGISTRY_URL: "https://registry.npmjs.org"
       TAG: "beta"
+      PACKAGE_DIR: "packages/skyflow-js"
+      PACKAGE_NAME: "skyflow-js"
+      DIST_DIR: "packages/skyflow-js/dist/v1"
+      S3_PREFIX: ""
+      TAG_PREFIX: ""
+      INVALIDATION_PATH: "/*"
     secrets:
       IFRAME_SECURE_ORIGIN: ${{ secrets.SANDBOX_IFRAME_SECURE_ORIGIN }}
       IFRAME_SECURE_SITE: ${{ secrets.SANDBOX_IFRAME_SECURE_SITE }}

.github/workflows/common-release.yml

@@ -9,6 +9,39 @@ on:
       REGISTRY_URL:
         required: false
         type: string
+      # --- Package targeting (defaults preserve skyflow-js behavior) ---
+      PACKAGE_DIR:
+        required: false
+        type: string
+        default: packages/skyflow-js
+      PACKAGE_NAME:
+        required: false
+        type: string
+        default: skyflow-js
+      # Tag namespace for this package. Empty => bare-semver tags (skyflow-js,
+      # e.g. "2.7.9"); "flowvault-" => "flowvault-v1.0.0". Stripped (along with
+      # an optional leading "v") from the triggering tag to get the version.
+      TAG_PREFIX:
+        required: false
+        type: string
+        default: ''
+      DIST_DIR:
+        required: false
+        type: string
+        default: packages/skyflow-js/dist/v1
+      # S3 key prefix placed BEFORE the version segment (e.g. "flowvault/").
+      # Empty => s3://bucket/v<version>/ (skyflow-js, unchanged).
+      S3_PREFIX:
+        required: false
+        type: string
+        default: ''
+      # CloudFront invalidation path. "/*" preserves current behavior; a
+      # package can scope it (e.g. "/flowvault/*") to avoid churning the
+      # other package's cache.
+      INVALIDATION_PATH:
+        required: false
+        type: string
+        default: '/*'
     secrets:
         PAT_ACTIONS:
             required: true
@@ -42,29 +75,59 @@ jobs:
           token: ${{ secrets.PAT_ACTIONS }}
           fetch-depth: 0
 
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@v4
         with:
-          node-version: 14.17.6
+          node-version: '20.x'
           registry-url: ${{ inputs.REGISTRY_URL }}
 
       - run: npm install --ignore-scripts
 
-      - name: Get Previous Tag
-        run: |
-          echo "TAG=$(git describe --abbrev=0 --tags $(git rev-list --tags --max-count=1))" >> $GITHUB_ENV
-
       - name: Set RELEASE_VERSION
         run: |
+          PREFIX="${{ inputs.TAG_PREFIX }}"
           if [ "${{ inputs.TAG }}" == "internal" ]; then
-            echo "RELEASE_VERSION=${{ env.TAG }}-dev.$(git rev-parse --short $GITHUB_SHA)" >> $GITHUB_ENV
+            # Branch-triggered (release/*): github.ref_name is a branch, not a
+            # version tag. Derive the base version from the latest tag in THIS
+            # package's namespace, then append the -dev.<sha> suffix.
+            # `|| true` so a namespace with no tag yet doesn't abort the step
+            # under `set -e` (GitHub runs `run:` with `bash -eo pipefail`); the
+            # empty result is handled by the package.json fallback below.
+            if [ -n "$PREFIX" ]; then
+              PREV_TAG=$(git describe --tags --abbrev=0 --match "${PREFIX}*" 2>/dev/null || true)
+            else
+              # Bare-semver tags only (skyflow-js). Must EXCLUDE the flowvault-*
+              # namespace, otherwise once a flowvault-v* tag is the newest tag
+              # in the repo this would resolve the skyflow-js base version to
+              # "flowvault-v1.0.0" and produce an invalid -dev.<sha> version.
+              PREV_TAG=$(git describe --tags --abbrev=0 --match '[0-9]*' --exclude 'flowvault-*' 2>/dev/null || true)
+            fi
+            if [ -z "$PREV_TAG" ]; then
+              # No tag in this package's namespace yet (e.g. flowvault's first
+              # internal build, before any flowvault-* tag exists). Seed the base
+              # from the package's own package.json version so the -dev.<sha>
+              # build still gets a valid semver base instead of failing the run.
+              # Once the package cuts its first real tag, the describe branch
+              # above takes over automatically.
+              BASE_VERSION=$(node -p "require('./${{ inputs.PACKAGE_DIR }}/package.json').version")
+            else
+              BASE_VERSION="${PREV_TAG#$PREFIX}"
+              BASE_VERSION="${BASE_VERSION#v}"
+            fi
+            echo "RELEASE_VERSION=${BASE_VERSION}-dev.$(git rev-parse --short $GITHUB_SHA)" >> $GITHUB_ENV
           else
-            echo "RELEASE_VERSION=${{ env.TAG }}" >> $GITHUB_ENV
+            # Tag-triggered (beta/public): the version IS the triggering tag,
+            # minus the package prefix and an optional leading "v"
+            # (e.g. flowvault-v1.0.0 -> 1.0.0; 2.7.9-beta.1 -> 2.7.9-beta.1).
+            BASE_VERSION="${{ github.ref_name }}"
+            BASE_VERSION="${BASE_VERSION#$PREFIX}"
+            BASE_VERSION="${BASE_VERSION#v}"
+            echo "RELEASE_VERSION=${BASE_VERSION}" >> $GITHUB_ENV
           fi
 
       - name: Bump Version
         run: |
           chmod +x ./scripts/bump_version.sh
-          ./scripts/bump_version.sh "${{ env.RELEASE_VERSION }}"
+          ./scripts/bump_version.sh "${{ env.RELEASE_VERSION }}" "${{ inputs.PACKAGE_DIR }}"
 
       - name: Resolve Branch for the Tagged Commit
         id: resolve-branch
@@ -83,25 +146,30 @@ jobs:
           echo "branch_name=$BRANCH_NAME" >> $GITHUB_ENV
 
       - name: Commit Changes
+        # Only beta/public commit the version bump back to the release branch.
+        # Internal (-dev.<sha>) builds must NOT — branch_name is unset for them
+        # (Resolve Branch is skipped), and with two internal jobs running in
+        # parallel an unguarded commit-back would race on the git push.
+        if: ${{ inputs.tag == 'beta' || inputs.tag == 'public' }}
         run: |
           git config user.name ${{ github.actor }}
           git config user.email ${{ github.actor }}@users.noreply.github.com
           git checkout ${{ env.branch_name }}
-          git add package.json
+          git add ${{ inputs.PACKAGE_DIR }}/package.json
           git commit -m "[AUTOMATED] Release - ${{ env.RELEASE_VERSION }}"
           git push origin ${{ env.branch_name }} -f
 
       - name: Build Browser SDK
-        run: npm run build-browser-sdk
+        run: npm run build-browser-sdk -w ${{ inputs.PACKAGE_NAME }}
         env:
           IFRAME_SECURE_ORIGIN: ${{ secrets.IFRAME_SECURE_ORIGIN }}
-          IFRAME_SECURE_SITE: "v${{  env.RELEASE_VERSION }}/${{ secrets.IFRAME_SECURE_SITE }}"
+          IFRAME_SECURE_SITE: "${{ inputs.S3_PREFIX }}v${{  env.RELEASE_VERSION }}/${{ secrets.IFRAME_SECURE_SITE }}"
 
       - name: Build Iframe
-        run: npm run build-iframe
+        run: npm run build-iframe -w ${{ inputs.PACKAGE_NAME }}
         env:
           IFRAME_SECURE_ORIGIN: ${{ secrets.IFRAME_SECURE_ORIGIN }}
-          IFRAME_SECURE_SITE: "v${{  env.RELEASE_VERSION }}/${{ secrets.IFRAME_SECURE_SITE }}"
+          IFRAME_SECURE_SITE: "${{ inputs.S3_PREFIX }}v${{  env.RELEASE_VERSION }}/${{ secrets.IFRAME_SECURE_SITE }}"
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -110,49 +178,56 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ secrets.AWS_REGION }}
 
-      # - name: Set Latest Tag
-      #   run: |
-      #     mkdir tags
-      #     echo "v${{ env.RELEASE_VERSION }}" > tags/latest
-
-      # - name: Deploy Latest Tag to S3
-      #   run: aws s3 cp --recursive tags s3://${{ secrets.AWS_BUCKET_NAME }}/
-
-      # - name: Remove Latest Tag
-      #   run: rm -rf tags
-
       - name: Deploy to S3
         run: |
-          aws s3 cp --recursive dist/v1 s3://${{ secrets.AWS_BUCKET_NAME }}/v${{ env.RELEASE_VERSION }}/
+          aws s3 cp --recursive ${{ inputs.DIST_DIR }} s3://${{ secrets.AWS_BUCKET_NAME }}/${{ inputs.S3_PREFIX }}v${{ env.RELEASE_VERSION }}/
+
+      # Publish the unversioned "latest" pointer AFTER the versioned artifacts are
+      # uploaded, so a consumer resolving `latest` never gets a version whose files
+      # aren't in the bucket yet. Scoped by S3_PREFIX so skyflow-js -> `latest` and
+      # flowvault -> `flowvault/latest`; without the prefix both packages (which share
+      # a bucket per environment) would clobber the same object. The trailing
+      # CloudFront invalidation (INVALIDATION_PATH) already covers these keys.
+      - name: Update latest pointer in S3
+        run: |
+          printf 'v%s' "${{ env.RELEASE_VERSION }}" > latest
+          aws s3 cp latest \
+            "s3://${{ secrets.AWS_BUCKET_NAME }}/${{ inputs.S3_PREFIX }}latest" \
+            --content-type text/plain \
+            --cache-control no-cache
+          rm -f latest
 
       - name: Build Node SDK
         run: |
-          npm run build:types 
-          npm run build-node-sdk
+          npm run build:types -w ${{ inputs.PACKAGE_NAME }}
+          npm run build-node-sdk -w ${{ inputs.PACKAGE_NAME }}
         env:
           IFRAME_SECURE_ORIGIN: ${{ secrets.IFRAME_SECURE_ORIGIN }}
-          IFRAME_SECURE_SITE: "v${{  env.RELEASE_VERSION }}/${{ secrets.IFRAME_SECURE_SITE }}"
+          IFRAME_SECURE_SITE: "${{ inputs.S3_PREFIX }}v${{  env.RELEASE_VERSION }}/${{ secrets.IFRAME_SECURE_SITE }}"
 
       - name: Publish SDK
         run: |
           if [ "${{ inputs.TAG }}" == "beta" ]; then
-            npm publish --tag v${{  env.RELEASE_VERSION }}
+            npm publish -w ${{ inputs.PACKAGE_NAME }} --tag v${{  env.RELEASE_VERSION }}
           elif [ "${{ inputs.TAG }}" == "internal" ]; then
-            curl -u ${{ secrets.JFROG_USERNAME }}:${{ secrets.JFROG_PASSWORD }} https://prekarilabs.jfrog.io/prekarilabs/api/npm/auth/ > ~/.npmrc
+            JFROG_AUTH=$(echo -n "$JFROG_USERNAME:$JFROG_PASSWORD" | base64 -w 0)
+            echo "::add-mask::${JFROG_AUTH}"
             npm config set registry https://prekarilabs.jfrog.io/prekarilabs/api/npm/npm/
-            npm config set unsafe-perm true
-            npm publish
+            npm config set //prekarilabs.jfrog.io/prekarilabs/api/npm/npm/:_auth "$JFROG_AUTH"
+            npm publish -w ${{ inputs.PACKAGE_NAME }}
           else
-            npm publish
+            npm publish -w ${{ inputs.PACKAGE_NAME }}
           fi
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
+          JFROG_USERNAME: ${{ secrets.JFROG_USERNAME }}
+          JFROG_PASSWORD: ${{ secrets.JFROG_PASSWORD }}
 
       - name: Invalidate CloudFront cache 10 times
         run: |
           for i in {1..10}; do
             aws cloudfront create-invalidation \
               --distribution-id ${{ secrets.CF_DISTRIBUTION_ID }} \
-              --paths "/*"
+              --paths "${{ inputs.INVALIDATION_PATH }}"
             sleep 10
           done

.github/workflows/flowvault-beta-release.yml

@@ -0,0 +1,45 @@
+name: FlowVault Public Beta Release
+
+# Release entry point for skyflow-flowvault-js (flowDB). Triggered by a
+# flowvault-namespaced beta tag so it never collides with skyflow-js's bare
+# semver tags. Calls the shared reusable workflow with flowvault's package
+# targeting (S3_PREFIX/TAG_PREFIX/INVALIDATION_PATH), landing in the SAME
+# sandbox bucket + CloudFront distribution under the flowvault/ prefix.
+on:
+  push:
+    tags: 'flowvault-v*.*.*-beta.*'
+    paths-ignore:
+      - "package.json"
+      - "package-lock.json"
+      - "*.md"
+
+
+jobs:
+  flowvault-beta-release:
+    uses: ./.github/workflows/common-release.yml
+    with:
+      REGISTRY_URL: "https://registry.npmjs.org"
+      TAG: "beta"
+      PACKAGE_DIR: "packages/skyflow-flowvault-js"
+      PACKAGE_NAME: "skyflow-flowvault-js"
+      DIST_DIR: "packages/skyflow-flowvault-js/dist/v1"
+      S3_PREFIX: "flowvault/"
+      TAG_PREFIX: "flowvault-"
+      INVALIDATION_PATH: "/flowvault/*"
+    secrets:
+      # Same sandbox bucket / distribution / CDN origin as skyflow-js — flowDB
+      # just lands under the flowvault/ key prefix, so the shared SANDBOX_*
+      # secrets are reused as-is.
+      IFRAME_SECURE_ORIGIN: ${{ secrets.SANDBOX_IFRAME_SECURE_ORIGIN }}
+      # Reuses skyflow-js's shared trailing-path secret ("elements/index.html").
+      # Both packages build the same dist/v1/elements/index.html artifact, and
+      # this value is origin-/prefix-independent — the workflow prepends
+      # "flowvault/v<version>/" — so no flowvault-specific secret is needed.
+      IFRAME_SECURE_SITE: ${{ secrets.SANDBOX_IFRAME_SECURE_SITE }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.SANDBOX_AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.SANDBOX_AWS_ACCESS_KEY_SECRET }}
+      AWS_REGION: ${{ secrets.SANDBOX_AWS_REGION }}
+      AWS_BUCKET_NAME: ${{ secrets.SANDBOX_AWS_BUCKET_NAME }}
+      CF_DISTRIBUTION_ID: ${{ secrets.SANDBOX_CF_DISTRIBUTION_ID }}
+      PAT_ACTIONS: ${{ secrets.PAT_ACTIONS }}
+      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}