From 3a7a910924f4dd8100f9e20597e761669e9125b3 Mon Sep 17 00:00:00 2001 From: CodeMash Date: Sat, 3 Oct 2026 11:32:51 +0300 Subject: [PATCH 1/4] =?UTF-8?q?[1]=20docs(tasks):=20published=20SDK=20pack?= =?UTF-8?q?ages=20=E2=80=94=20plan=20and=20findings?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- docs/tasks/published-sdks.md | 65 ++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 docs/tasks/published-sdks.md diff --git a/docs/tasks/published-sdks.md b/docs/tasks/published-sdks.md new file mode 100644 index 0000000..fc706b5 --- /dev/null +++ b/docs/tasks/published-sdks.md @@ -0,0 +1,65 @@ +# Admin uses the published SDK packages (tracker step 29b) + +## Goal + +Admin builds from the published `@norbix.ai/ts` and `@norbix.ai/react-redux` +packages instead of the sibling `../sdks` checkouts, so `main` CI (which has no +`../sdks`) is green: lint, format, typecheck, test, build, audit. + +Not in scope: new features, the format debt in other repos, the Docker image +workflows (they build from this folder only and get the same fix for free). + +## Plan + +1. done — react-redux: lock and dev dependency on `@norbix.ai/ts` 4.4.0, drop + the three campaign-message hooks the SDK removed (react-redux + `fix/lock-norbix-ts`), so its Release job can publish 1.4.0 with the AI hooks. +2. done — `package.json`: `file:../sdks/…` → `"@norbix.ai/ts": "^4.4.0"`, + `"@norbix.ai/react-redux": "^1.4.0"`; the old name `@norbix/react-redux` + is gone (it was never on npm; the package is published as + `@norbix.ai/react-redux`). +3. done — imports and comments: `@norbix/react-redux` → `@norbix.ai/react-redux`. +4. done — `tsconfig.json`, `tsconfig.app.json`: remove the `../sdks` source + paths. `next.config.mjs`: remove `transpilePackages` and the `.js` → + `.ts` extension alias (both only existed for SDK source). +5. done — `vite.config.ts` (legacy `_vite:*` scripts): source linking only on + demand (`NORBIX_LINK=1`), for both packages. +6. done — docs: `README.md`, `docs/sdk-local-development.md` (published + packages by default; how to try an unpublished SDK change locally), + `docs/agreements.md`, `docs/implementation-plan.md`. +7. todo — after react-redux 1.4.0 is on npm: `npm install` against the + registry, run every CI step, commit, PR. + +## Changes + +| file | what changed | plan step | +|---|---|---| +| `package.json`, `package-lock.json` | published SDK versions | 2, 7 | +| `src/App.tsx`, `src/services/norbix.ts`, `src/app/store.ts` | package name | 3 | +| `tsconfig.json`, `tsconfig.app.json`, `next.config.mjs` | no `../sdks` wiring | 4 | +| `vite.config.ts` | source linking on demand only | 5 | +| `README.md`, `docs/sdk-local-development.md`, `docs/agreements.md`, `docs/implementation-plan.md` | published packages | 6 | + +## Findings + +- `tsconfig.tsbuildinfo` is tracked in git (a build cache). Left open. +- react-redux: `npm run format:check` fails on ~20 files on `main`; its CI does + not run it. Left open. +- react-redux: Dependabot bumped the `@norbix.ai/ts` dev dependency to + `^4.2.0`, below the `>=4.3.0` peer range, and broke `main`. A Dependabot + `ignore` or a grouped rule for `@norbix.ai/*` would stop this. Left open. +- react-redux: no hook yet for `hub.email.getEmailPreferencesByLink` + (added in `@norbix.ai/ts` 4.3.0). Left open. + +## Rejected / moved out + +- (none) + +## Needs you + +- [ ] Commit, push and merge the react-redux fix (command in the chat). +- [ ] Tell me when `@norbix.ai/react-redux` 1.4.0 is on npm. + +## Open questions + +- (none) From bd834a9bb3622000b2a46f84f6bfd811618a0398 Mon Sep 17 00:00:00 2001 From: CodeMash Date: Sat, 3 Oct 2026 11:32:51 +0300 Subject: [PATCH 2/4] [2-5] build(deps): use the published @norbix.ai/ts and @norbix.ai/react-redux instead of ../sdks package.json: @norbix.ai/ts ^4.4.0, @norbix.ai/react-redux ^1.4.0 (the old name @norbix/react-redux was never on npm). Imports follow the new name. The ../sdks source paths leave both tsconfig files; next.config drops transpilePackages and the .js->.ts alias, which only existed for SDK source. vite.config links SDK source only with NORBIX_LINK=1. The lock follows in step 7, once react-redux 1.4.0 is on npm. Co-Authored-By: Claude Opus 5.5 --- next.config.mjs | 11 ----------- package.json | 4 ++-- src/App.tsx | 2 +- src/app/store.ts | 2 +- src/services/norbix.ts | 4 ++-- tsconfig.app.json | 12 +----------- tsconfig.json | 7 +------ vite.config.ts | 39 ++++++++++++++------------------------- 8 files changed, 22 insertions(+), 59 deletions(-) diff --git a/next.config.mjs b/next.config.mjs index 2966fd5..bc9dc11 100644 --- a/next.config.mjs +++ b/next.config.mjs @@ -18,17 +18,6 @@ const nextConfig = { .filter(Boolean), } : {}), - // The SDK is consumed from source in the monorepo dev loop; transpile it so - // Next compiles its TS rather than expecting a prebuilt dist. - transpilePackages: ['@norbix.ai/ts', '@norbix/react-redux'], - // SDK source uses ESM-style `.js` specifiers (e.g. `./client/Norbix.js`) that - // map to `.ts` files — webpack needs this alias to resolve them. - webpack: (config) => { - config.resolve.extensionAlias = { - '.js': ['.ts', '.tsx', '.js'], - }; - return config; - }, eslint: { // Lint is run separately in CI; don't fail the production build on it. ignoreDuringBuilds: true, diff --git a/package.json b/package.json index 4b07791..522e34c 100644 --- a/package.json +++ b/package.json @@ -25,8 +25,8 @@ }, "dependencies": { "@headlessui/react": "^2.2.0", - "@norbix.ai/ts": "file:../sdks/norbix-js", - "@norbix/react-redux": "file:../sdks/norbix-react-redux", + "@norbix.ai/react-redux": "^1.4.0", + "@norbix.ai/ts": "^4.4.0", "@reduxjs/toolkit": "^2.12.0", "final-form": "^5.0.1", "next": "^15.5.0", diff --git a/src/App.tsx b/src/App.tsx index 4f10afd..6617db3 100644 --- a/src/App.tsx +++ b/src/App.tsx @@ -1,6 +1,6 @@ import { useEffect, useState } from 'react'; import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom'; -import { NorbixProvider } from '@norbix/react-redux'; +import { NorbixProvider } from '@norbix.ai/react-redux'; import { ROUTES } from '@/routes'; import { resolveProjectIdAsync } from '@/config/project'; import { loadProjectConfig, applyBranding } from '@/config/projectConfig'; diff --git a/src/app/store.ts b/src/app/store.ts index 5987478..e934cf1 100644 --- a/src/app/store.ts +++ b/src/app/store.ts @@ -42,7 +42,7 @@ import { listenerMiddleware } from '@/app/middlewares/listener'; import { rtkQueryErrorLogger } from '@/app/middlewares/errorCatching'; // ── combine all reducers ──────────────────────────────────────────── -// Data-plane endpoints come from the Norbix SDK slice (@norbix/react-redux): +// Data-plane endpoints come from the Norbix SDK slice (@norbix.ai/react-redux): // login, logout, profile, preferences. The app-owned `api` slice still backs // the endpoints the SDK does NOT yet expose (password change/reset, 2FA, // compliance) — these move to the SDK once @norbix.ai/ts adds them, with no diff --git a/src/services/norbix.ts b/src/services/norbix.ts index da183f9..dd6e4ac 100644 --- a/src/services/norbix.ts +++ b/src/services/norbix.ts @@ -1,6 +1,6 @@ // The Norbix SDK wiring for the admin portal. // -// We use @norbix/react-redux (RTK Query over the typed @norbix.ai/ts client) +// We use @norbix.ai/react-redux (RTK Query over the typed @norbix.ai/ts client) // instead of hand-written services. The client is project-scoped (projectId // from the subdomain) and points at the API URL discovered from /echo. The // bearer token comes from the auth slice after sign-in. @@ -10,7 +10,7 @@ // recreating the API slice. import { Norbix } from '@norbix.ai/ts'; -import { createNorbixApi } from '@norbix/react-redux'; +import { createNorbixApi } from '@norbix.ai/react-redux'; import { API_VERSION, API_PROXY_BASE, HUB_PROXY_BASE } from '@/config/env'; interface ClientParams { diff --git a/tsconfig.app.json b/tsconfig.app.json index 9d8d77d..eb83a26 100644 --- a/tsconfig.app.json +++ b/tsconfig.app.json @@ -3,17 +3,7 @@ "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo", "baseUrl": ".", "paths": { - "@/*": ["./src/*"], - // The RTK lib is consumed from source (not published, no dist). Point - // tsc at its source so types resolve, matching the Vite alias. - "@norbix/react-redux": ["../sdks/norbix-react-redux/src/index.ts"], - // Resolve the core SDK to SOURCE for both the admin's `@norbix.ai/ts` - // import and the lib's internal `import ... from 'norbix'`. This way - // tsc sees the same code the Vite dev loop runs, so new SDK endpoints - // type-check without first rebuilding the SDK's dist. (Matches the - // `@norbix/react-redux` source mapping above.) - "norbix": ["../sdks/norbix-js/src/index.ts"], - "@norbix.ai/ts": ["../sdks/norbix-js/src/index.ts"] + "@/*": ["./src/*"] }, "target": "ES2022", "useDefineForClassFields": true, diff --git a/tsconfig.json b/tsconfig.json index 5876102..b381df2 100644 --- a/tsconfig.json +++ b/tsconfig.json @@ -18,12 +18,7 @@ "plugins": [{ "name": "next" }], "baseUrl": ".", "paths": { - "@/*": ["./src/*"], - "@norbix/react-redux": ["../sdks/norbix-react-redux/src/index.ts"], - "norbix": ["../sdks/norbix-js/src/index.ts"], - "@norbix.ai/ts": ["../sdks/norbix-js/src/index.ts"], - "@norbix.ai/ts/types/hub": ["../sdks/norbix-js/src/types/hub2.dtos.ts"], - "@norbix.ai/ts/types/api": ["../sdks/norbix-js/src/types/api2.dtos.ts"] + "@/*": ["./src/*"] } }, "include": [ diff --git a/vite.config.ts b/vite.config.ts index 252c6f6..a304b9d 100644 --- a/vite.config.ts +++ b/vite.config.ts @@ -3,46 +3,35 @@ import react from '@vitejs/plugin-react-swc'; import { fileURLToPath } from 'node:url'; import { existsSync } from 'node:fs'; -// ── Local SDK resolution ──────────────────────────────────────────── -// `@norbix/react-redux` is developed in the sibling monorepo checkout and is -// NOT published to npm yet, and it ships no prebuilt dist/. So we always -// resolve it to its TypeScript SOURCE — Vite transforms it and HMR fires on -// every edit. No build, no publish, no version bump, no reinstall. +// ── SDK resolution ────────────────────────────────────────────────── +// `@norbix.ai/ts` and `@norbix.ai/react-redux` come from npm. Set +// NORBIX_LINK=1 (npm run _vite:dev:link) to resolve both to the TypeScript +// source of the sibling monorepo checkouts instead, e.g. while changing an SDK: // // norbix/ // admin/ ← this app // sdks/ -// norbix-react-redux/ ← aliased to its src/index.ts (always) -// norbix-js/ ← @norbix.ai/ts; has a built dist/, resolved normally -// -// Set NORBIX_LINK=1 (npm run dev:link) to ALSO resolve the core SDK -// (@norbix.ai/ts) to its local source, e.g. when changing the SDK too. +// norbix-react-redux/ ← @norbix.ai/react-redux +// norbix-js/ ← @norbix.ai/ts const resolvePath = (rel: string) => fileURLToPath(new URL(rel, import.meta.url)); const libSrc = resolvePath('../sdks/norbix-react-redux/src/index.ts'); -const sdkDir = resolvePath('../sdks/norbix-js'); +const sdkSrc = resolvePath('../sdks/norbix-js/src/index.ts'); -const linkSdkSource = process.env.NORBIX_LINK === '1'; +const linkSdkSource = process.env.NORBIX_LINK === '1' && existsSync(libSrc) && existsSync(sdkSrc); const alias: Record = { '@': '/src' }; -// Always resolve the lib to source (it has no published artifact / dist). -if (existsSync(libSrc)) { - alias['@norbix/react-redux'] = libSrc; - // The lib imports the core SDK as 'norbix'; point it at the local SDK. - alias['norbix'] = sdkDir; -} - -// Optionally resolve the core SDK to its local checkout too. -if (linkSdkSource && existsSync(sdkDir)) { - alias['@norbix.ai/ts'] = sdkDir; +if (linkSdkSource) { + alias['@norbix.ai/react-redux'] = libSrc; + alias['@norbix.ai/ts'] = sdkSrc; } export default defineConfig({ resolve: { alias }, - // The local lib is ESM TS source; let Vite transform it (don't pre-bundle). - optimizeDeps: existsSync(libSrc) - ? { exclude: ['@norbix/react-redux', 'norbix', '@norbix.ai/ts'] } + // The linked SDKs are ESM TS source; let Vite transform them (don't pre-bundle). + optimizeDeps: linkSdkSource + ? { exclude: ['@norbix.ai/react-redux', '@norbix.ai/ts'] } : undefined, css: { devSourcemap: true }, plugins: [react()], From 91ad1f8b61e1b03d10144a011ab95e0847390197 Mon Sep 17 00:00:00 2001 From: CodeMash Date: Sat, 3 Oct 2026 11:32:51 +0300 Subject: [PATCH 3/4] [6] docs: the SDK packages come from npm; how to try an unpublished SDK change Co-Authored-By: Claude Opus 5.5 --- README.md | 14 ++-- docs/agreements.md | 7 +- docs/implementation-plan.md | 2 +- docs/sdk-local-development.md | 120 ++++++++++------------------------ 4 files changed, 45 insertions(+), 98 deletions(-) diff --git a/README.md b/README.md index d9896b4..a6bf522 100644 --- a/README.md +++ b/README.md @@ -33,10 +33,9 @@ features, implementation plan, and devops. ```bash npm install cp .env.example .env # set VITE_ADMIN_HUB_BASE_URL etc. -npm run dev # http://localhost:3100 (uses published SDK packages) -npm run dev:link # same, but resolves @norbix/react-redux + @norbix.ai/ts - # to LOCAL SOURCE for instant lib development (HMR) -npm run build # tsc -b + vite build +npm run dev # http://localhost:3100 (uses the published SDK packages) +npm run build # next build +npm run typecheck # tsc npm run lint # eslint npm test # vitest ``` @@ -45,12 +44,11 @@ Requires Node ≥ 22.12 (Vite 7). ### Data access via the Norbix SDK -The portal uses **`@norbix/react-redux`** (RTK Query hooks over the typed +The portal uses **`@norbix.ai/react-redux`** (RTK Query hooks over the typed **`@norbix.ai/ts`** SDK) for data access instead of hand-written services (`createNorbixApi` + `NorbixProvider`, wired in `src/services/norbix.ts`). -To develop the lib and the portal together with no publish/install cycle, see -[`docs/sdk-local-development.md`](./docs/sdk-local-development.md) and use -`npm run dev:link`. +Both come from npm. To try an SDK change before it is published, see +[`docs/sdk-local-development.md`](./docs/sdk-local-development.md). For local dev without a `pr_` subdomain, pin a project with `VITE_ADMIN_PROJECT_ID` in `.env`, or add a static config at diff --git a/docs/agreements.md b/docs/agreements.md index 188d7ca..7f05fa2 100644 --- a/docs/agreements.md +++ b/docs/agreements.md @@ -49,10 +49,11 @@ All three produce the same shape. Full design: ## 4. SDK + dev loop -- Data access uses **`@norbix/react-redux`** (RTK Query over the typed +- Data access uses **`@norbix.ai/react-redux`** (RTK Query over the typed `@norbix.ai/ts` SDK), not hand-written services. -- Local development links the SDK from source for instant HMR — no publish - cycle. See [`sdk-local-development.md`](./sdk-local-development.md). +- Both packages come from npm (since 2026-10-03). An SDK change is tried + locally before it is published — see + [`sdk-local-development.md`](./sdk-local-development.md). ## 5. Legal documents (Terms & Conditions, Privacy Policy) diff --git a/docs/implementation-plan.md b/docs/implementation-plan.md index 9fdef72..4191609 100644 --- a/docs/implementation-plan.md +++ b/docs/implementation-plan.md @@ -10,7 +10,7 @@ techniques** from Cloud while keeping the result safe to **open source**. | Build | Vite + React 18 + TS, `@` → `/src` alias, SWC plugin | Copy `vite.config.ts` (trimmed: no Storybook/vitest browser stuff for v1). | | State | Redux Toolkit, `configureStore`, feature **slices**, typed `useAppSelector/useAppDispatch` hooks | Same pattern as Cloud's `src/app/store.ts` + `src/app/hooks`. | | Data fetching | RTK Query services that call the gateway | Cloud has `services/hub` + `services/api`. Admin keeps **only `services/api`** (end-user data plane) + a tiny **public** service for login config & legal docs. | -| SDK | `@norbix/react-redux` (RTK Query over the typed Norbix TS SDK) | Use its API-side hooks where they exist instead of hand-writing services. | +| SDK | `@norbix.ai/react-redux` (RTK Query over the typed Norbix TS SDK) | Use its API-side hooks where they exist instead of hand-writing services. | | Styling | Tailwind CSS + the project color tokens | Copy `tailwind.config.cjs` color palette + `postcss.config.cjs`. | | Routing | `react-router-dom`, central `routes.ts` constants | Smaller route map (see `features.md`). | | Layouts | The *structure* of `authLayout` / content layout, menu, shell | **Rewritten** clean-room (see §3). | diff --git a/docs/sdk-local-development.md b/docs/sdk-local-development.md index a2e48a5..0a4556a 100644 --- a/docs/sdk-local-development.md +++ b/docs/sdk-local-development.md @@ -1,90 +1,52 @@ -# Developing against @norbix/react-redux locally +# The Norbix SDK packages in the admin portal -The admin portal uses **`@norbix/react-redux`** (RTK Query hooks over the typed -**`@norbix.ai/ts`** SDK) instead of hand-written API services. This doc explains -how to develop the lib and the portal together with an instant feedback loop — -no publish, no version bump, no reinstall. +The admin portal uses **`@norbix.ai/react-redux`** (RTK Query hooks over the +typed **`@norbix.ai/ts`** SDK) instead of hand-written API services. Since +2026-10-03 both come **from npm** (`package.json` has version ranges), so a +fresh clone, a worktree and CI all build without the sibling `../sdks` +checkouts. -## The problem we avoid +## Using a new SDK version -Without local linking, every lib change is a painful cycle: +When an SDK release adds what the portal needs: -1. change the portal, realize the lib needs a change -2. change `@norbix/react-redux` -3. `npm publish` it -4. bump + `npm install` the new version in admin -5. finally use the new functionality - -## The loop we have instead - -``` -edit norbix-react-redux/src/*.ts → admin hot-reloads instantly +```bash +npm install @norbix.ai/ts@^ @norbix.ai/react-redux@^ +npm run typecheck && npm test && npm run build ``` -When you're happy, you publish the lib **once**, and other consumers install it -normally. The portal keeps working because in production it uses the published -package — the local link is dev-only. +Commit `package.json` and `package-lock.json` together. -## Expected folder layout +## Trying an SDK change before it is published -The link assumes the sibling monorepo checkout: +Folder layout this assumes: ``` norbix/ admin/ ← this app sdks/ - norbix-react-redux/ ← the RTK lib (@norbix/react-redux) - norbix-js/ ← the core SDK (published as @norbix.ai/ts) + norbix-react-redux/ ← @norbix.ai/react-redux + norbix-js/ ← @norbix.ai/ts ``` -## How it's wired (neither package is on npm yet) - -`@norbix/react-redux` and `@norbix.ai/ts` are **not published yet**, so the -portal consumes them from the local checkouts. Two pieces make that work: - -1. **`package.json` uses `file:` deps**, so `npm install` resolves them from - disk (no npm 404): - - ```jsonc - "@norbix.ai/ts": "file:../sdks/norbix-js", - "@norbix/react-redux": "file:../sdks/norbix-react-redux" - ``` - -2. **`vite.config.ts` always aliases the lib to its TypeScript source** - (the lib ships no built `dist/`), and `tsconfig.app.json` has matching - `paths`. So both Vite and `tsc` resolve: - - | import | resolves to | - | --- | --- | - | `@norbix/react-redux` | `../sdks/norbix-react-redux/src/index.ts` (always) | - | `norbix` (lib's internal import) | `../sdks/norbix-js/src/index.ts` | - | `@norbix.ai/ts` | `../sdks/norbix-js/src/index.ts` | - - Both the lib and the core SDK resolve to **source** for type-checking, so a - new SDK endpoint type-checks in the portal **without** first rebuilding the - SDK's `dist/`. (Vite's runtime alias still follows `NORBIX_LINK` for the core - SDK — see `dev:link` below — but `tsc` always sees source.) - -Because the lib resolves to **source**, editing `norbix-react-redux/src/*.ts` -hot-reloads the portal instantly — no `tsup` build, no publish, no reinstall. +Pack the changed SDK(s) and install the tarballs **without saving** them: ```bash -npm install # installs the file: deps from the sibling checkouts -npm run dev # http://localhost:3100 — lib already resolves from source -npm run dev:link # ALSO resolve the core SDK (@norbix.ai/ts) from source, - # for when you're editing norbix-js too (sets NORBIX_LINK=1) +(cd ../sdks/norbix-js && npm run build && npm pack --pack-destination /tmp) +(cd ../sdks/norbix-react-redux && npm run build && npm pack --pack-destination /tmp) +npm install --no-save /tmp/norbix.ai-ts-*.tgz /tmp/norbix.ai-react-redux-*.tgz +npm run dev ``` -> The core SDK (`@norbix.ai/ts`) has a built `dist/`, so the **runtime** `file:` -> install works without `dev:link`. But a `dist/` that predates an SDK change is -> stale — so after editing `norbix-js` (or syncing its DTOs), rebuild it once: -> -> ```bash -> cd ../sdks/norbix-js && npm run build # refreshes dist/ for the non-link path -> ``` -> -> `dev:link` (and the `tsc` source paths above) let you skip this while -> developing; the rebuild matters for the default `npm run dev` / `npm run build`. +Repeat the pack + install after each SDK edit. `npm ci` puts the published +versions back. Never commit a `file:` or tarball dependency — CI has no +`../sdks`, and that is what kept `main` red until 2026-10-03. + +The order of a change that touches both: merge the SDK pull request, wait for +its release on npm, then raise the version range here. + +(The legacy Vite dev server, `npm run _vite:dev:link`, still resolves both +packages to their `../sdks` TypeScript source when `NORBIX_LINK=1`.) ## Refreshing the SDK DTOs after an API change @@ -106,9 +68,8 @@ gateway adds or changes an endpoint: 2. If the endpoint needs a typed hook in the portal, add a small SDK module (e.g. `norbix-js/src/api/.ts`, wired in `src/api/index.ts`) and a matching RTK hook factory in `norbix-react-redux/src/hooks/...`, then spread - it in `hooks/index.ts`. The portal picks it up from source immediately. -3. `cd ../sdks/norbix-js && npm run build` to refresh `dist/` for the - non-link runtime path. + it in `hooks/index.ts`. Try it in the portal with the pack + install above. +3. Release the SDK(s), then raise the version range here (see above). > The **Admin-Portal public endpoints** (`GET /public/projects/{id}/config` and > `.../legal/{kind}`) already ship as `norbix.api.public.config(...)` / @@ -116,19 +77,6 @@ gateway adds or changes an endpoint: > `useGetPublicProjectLegalQuery` hooks. They use the `unauthenticated` transport > scope (no bearer token) since they run before sign-in. -## When the packages are published to npm - -Once `@norbix/react-redux` (and `@norbix.ai/ts`) are on npm: - -1. In `../sdks/norbix-react-redux`: `npm run build && npm test`, then publish - (the repo's semantic-release pipeline handles versioning). Publishing also - produces the `dist/` the package's `main`/`types` point at. -2. In this repo, swap the `file:` deps for version ranges, e.g. - `"@norbix/react-redux": "^0.1.0"`, and remove the always-on lib alias / - tsconfig path (keep `dev:link` if you still want source linking on demand). -3. `npm install` — the portal now uses the published artifacts. Nothing in the - portal's own code changes; it only ever imported `@norbix/react-redux`. - ## What the portal still owns (not in the SDK yet) The SDK covers **login, logout, profile (getUser/updateUser), preferences @@ -139,5 +87,5 @@ It does **not** yet expose password change/reset, 2FA (TOTP), or compliance (data export / account deletion). Those screens use a small app-owned service (`src/services/authService.ts`, `complianceService.ts`) **temporarily**. The plan is to add these to `@norbix.ai/ts` first; once they -exist, delete those services and switch the screens to SDK hooks — with the -local link, you'll see it working in the portal immediately. +exist, delete those services and switch the screens to SDK hooks — try it +locally with the pack + install above before the SDK release. From 5e5f7fc944bedc4d77f204c97f560e98ad2a106c Mon Sep 17 00:00:00 2001 From: CodeMash Date: Sat, 3 Oct 2026 11:52:19 +0300 Subject: [PATCH 4/4] [7] build(deps): lock @norbix.ai/react-redux 1.4.0 and @norbix.ai/ts 4.4.0 from npm The stale extraneous ../sdks/norbix-react-redux lock entry is removed. npm ci, lint, format check, typecheck, test (80), build and the production audit pass locally with no ../sdks folder next to the worktree. Co-Authored-By: Claude Opus 5.5 --- docs/tasks/published-sdks.md | 26 +++++--- package-lock.json | 111 ++++++++--------------------------- 2 files changed, 43 insertions(+), 94 deletions(-) diff --git a/docs/tasks/published-sdks.md b/docs/tasks/published-sdks.md index fc706b5..23b3212 100644 --- a/docs/tasks/published-sdks.md +++ b/docs/tasks/published-sdks.md @@ -1,4 +1,5 @@ # Admin uses the published SDK packages (tracker step 29b) +This file: /Users/djovaisas/Projects/norbix/worktrees/admin/ci/published-sdks/docs/tasks/published-sdks.md (branch ci/published-sdks) ## Goal @@ -12,8 +13,10 @@ workflows (they build from this folder only and get the same fix for free). ## Plan 1. done — react-redux: lock and dev dependency on `@norbix.ai/ts` 4.4.0, drop - the three campaign-message hooks the SDK removed (react-redux - `fix/lock-norbix-ts`), so its Release job can publish 1.4.0 with the AI hooks. + the three campaign-message hooks the SDK removed, so its Release job can + publish the AI hooks — merged (rebase) as + https://github.com/norbix-code/react-redux/pull/34, released as + `@norbix.ai/react-redux` 1.4.0; react-redux `main` CI, CodeQL and Release green. 2. done — `package.json`: `file:../sdks/…` → `"@norbix.ai/ts": "^4.4.0"`, `"@norbix.ai/react-redux": "^1.4.0"`; the old name `@norbix/react-redux` is gone (it was never on npm; the package is published as @@ -27,14 +30,17 @@ workflows (they build from this folder only and get the same fix for free). 6. done — docs: `README.md`, `docs/sdk-local-development.md` (published packages by default; how to try an unpublished SDK change locally), `docs/agreements.md`, `docs/implementation-plan.md`. -7. todo — after react-redux 1.4.0 is on npm: `npm install` against the - registry, run every CI step, commit, PR. +7. done — lock from the npm registry (`@norbix.ai/react-redux` 1.4.0, + `@norbix.ai/ts` 4.4.0); the stale extraneous `../sdks/norbix-react-redux` + lock entry removed. Every CI step green locally: `npm ci`, lint, format + check, typecheck, test (80 passed), build, production audit. Shipped with + `nbx-ship` (squash). ## Changes | file | what changed | plan step | |---|---|---| -| `package.json`, `package-lock.json` | published SDK versions | 2, 7 | +| `package.json`, `package-lock.json` | published SDK versions; stale `../sdks` lock entry removed | 2, 7 | | `src/App.tsx`, `src/services/norbix.ts`, `src/app/store.ts` | package name | 3 | | `tsconfig.json`, `tsconfig.app.json`, `next.config.mjs` | no `../sdks` wiring | 4 | | `vite.config.ts` | source linking on demand only | 5 | @@ -50,6 +56,13 @@ workflows (they build from this folder only and get the same fix for free). `ignore` or a grouped rule for `@norbix.ai/*` would stop this. Left open. - react-redux: no hook yet for `hub.email.getEmailPreferencesByLink` (added in `@norbix.ai/ts` 4.3.0). Left open. +- SDK repos (react-redux, sdk-ts, likely all npm SDKs): the CI Security scan + (OSV) was red on every branch, `main` included, on 12 advisories no update + can fix — packages bundled inside the npm CLI that semantic-release runs, + and braces 3.0.3. Fixed in react-redux only, by an `osv-scanner.toml` with + exact ids, reasons and `ignoreUntil = 2026-11-03` (react-redux pull request + 34, second commit). sdk-ts and the other npm SDKs still need the same file. + Left open. ## Rejected / moved out @@ -57,8 +70,7 @@ workflows (they build from this folder only and get the same fix for free). ## Needs you -- [ ] Commit, push and merge the react-redux fix (command in the chat). -- [ ] Tell me when `@norbix.ai/react-redux` 1.4.0 is on npm. +- (none) ## Open questions diff --git a/package-lock.json b/package-lock.json index 9312cbd..420ac7a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,8 +10,8 @@ "license": "MIT", "dependencies": { "@headlessui/react": "^2.2.0", - "@norbix.ai/ts": "file:../sdks/norbix-js", - "@norbix/react-redux": "file:../sdks/norbix-react-redux", + "@norbix.ai/react-redux": "^1.4.0", + "@norbix.ai/ts": "^4.4.0", "@reduxjs/toolkit": "^2.12.0", "final-form": "^5.0.1", "next": "^15.5.0", @@ -50,85 +50,6 @@ "node": ">=22.12" } }, - "../sdks/norbix-js": { - "name": "@norbix.ai/ts", - "version": "1.2.0", - "license": "MIT", - "devDependencies": { - "@commitlint/cli": "^21.0.2", - "@commitlint/config-conventional": "^19.5.0", - "@semantic-release/changelog": "^6.0.3", - "@semantic-release/commit-analyzer": "^13.0.0", - "@semantic-release/git": "^10.0.1", - "@semantic-release/github": "^11.0.0", - "@semantic-release/npm": "^12.0.1", - "@semantic-release/release-notes-generator": "^14.0.1", - "@types/node": "^22.7.0", - "@typescript-eslint/eslint-plugin": "^8.10.0", - "@typescript-eslint/parser": "^8.10.0", - "@vitest/coverage-v8": "^4.1.8", - "eslint": "^9.13.0", - "eslint-config-prettier": "^9.1.0", - "eslint-plugin-import": "^2.31.0", - "eslint-plugin-prettier": "^5.2.1", - "husky": "^9.1.6", - "prettier": "^3.3.3", - "semantic-release": "^24.1.2", - "tsup": "^8.5.1", - "typescript": "^5.6.3", - "vitest": "^4.1.8" - }, - "engines": { - "node": ">=18" - } - }, - "../sdks/norbix-react-redux": { - "name": "@norbix/react-redux", - "version": "0.0.0-development", - "license": "MIT", - "devDependencies": { - "@commitlint/cli": "^19.5.0", - "@commitlint/config-conventional": "^19.5.0", - "@reduxjs/toolkit": "^2.2.7", - "@semantic-release/changelog": "^6.0.3", - "@semantic-release/commit-analyzer": "^13.0.0", - "@semantic-release/git": "^10.0.1", - "@semantic-release/github": "^11.0.0", - "@semantic-release/npm": "^12.0.1", - "@semantic-release/release-notes-generator": "^14.0.1", - "@testing-library/react": "^16.0.1", - "@types/node": "^22.7.0", - "@types/react": "^18.3.11", - "@typescript-eslint/eslint-plugin": "^8.10.0", - "@typescript-eslint/parser": "^8.10.0", - "@vitest/coverage-v8": "^2.1.3", - "eslint": "^9.13.0", - "eslint-config-prettier": "^9.1.0", - "eslint-plugin-import": "^2.31.0", - "eslint-plugin-prettier": "^5.2.1", - "eslint-plugin-react-hooks": "^5.0.0", - "happy-dom": "^15.7.4", - "husky": "^9.1.6", - "norbix": "file:../norbix-js", - "prettier": "^3.3.3", - "react": "^18.3.1", - "react-dom": "^18.3.1", - "react-redux": "^9.1.2", - "semantic-release": "^24.1.2", - "tsup": "^8.3.0", - "typescript": "^5.6.3", - "vitest": "^2.1.3" - }, - "engines": { - "node": ">=18" - }, - "peerDependencies": { - "@reduxjs/toolkit": ">=2.0.0", - "norbix": ">=0.1.0", - "react": ">=18.0.0", - "react-redux": ">=9.0.0" - } - }, "node_modules/@alloc/quick-lru": { "version": "5.2.0", "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz", @@ -2085,13 +2006,29 @@ "node": ">= 8" } }, - "node_modules/@norbix.ai/ts": { - "resolved": "../sdks/norbix-js", - "link": true + "node_modules/@norbix.ai/react-redux": { + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/@norbix.ai/react-redux/-/react-redux-1.4.0.tgz", + "integrity": "sha512-FyxVnfDGnzyxabrgquHL0C+fDJNXKG3NrRQIkbAAWlBjAgsjiLTCK9duivVMDjIXBI7VNzQivRp0SnYlrbRSaA==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "@norbix.ai/ts": ">=4.3.0", + "@reduxjs/toolkit": ">=2.0.0", + "react": ">=18.0.0", + "react-redux": ">=9.0.0" + } }, - "node_modules/@norbix/react-redux": { - "resolved": "../sdks/norbix-react-redux", - "link": true + "node_modules/@norbix.ai/ts": { + "version": "4.4.0", + "resolved": "https://registry.npmjs.org/@norbix.ai/ts/-/ts-4.4.0.tgz", + "integrity": "sha512-h2mTx2aiZodHrHBJCXuNoLx46n0weFTzcjegEpXUh9KANa7qZWR04brhOz0V6yVopoRNUVZKeHSoWvKy/rjXTw==", + "license": "MIT", + "engines": { + "node": ">=18" + } }, "node_modules/@playwright/test": { "version": "1.61.1",