featHttpOnly server sessions, framework adapters, and typed client

Author: akosidencio

.github/workflows/ci.yml

@@ -2,11 +2,12 @@ name: CI
 on:
   push:
     branches:
-      # `main` must stay here: release.yml is gated on a successful CI run for
-      # main, so dropping it would leave releases unable to ever fire.
       - main
       - dev
   pull_request:
+  # Note: releases are triggered by tag pushes, not by this workflow. A broken
+  # tree still cannot reach npm — `prepublishOnly` re-runs lint, typecheck,
+  # tests and build during the publish itself.
 
 jobs:
   verify:

.github/workflows/release.yml

@@ -1,32 +1,32 @@
 name: Release
 
-# Gated on CI. `needs:` only works inside a single workflow, so this waits for
-# the CI run on main to finish and refuses to publish unless it went green.
+# Releases are cut by pushing a tag, never automatically on a merge:
+#
+#   1. bump "version" in package.json, update CHANGELOG.md, commit, push
+#   2. git tag -a v1.2.3 -m "Release v1.2.3" && git push origin v1.2.3
+#
+# The tag is the trigger and the version in package.json is the source of truth;
+# the two must agree or this workflow refuses to run.
 on:
-  workflow_run:
-    workflows: ['CI']
-    types:
-      - completed
-    branches:
-      - main
+  push:
+    tags:
+      - 'v*'
+  # Manual re-run, for finishing a release that partly failed.
+  workflow_dispatch:
 
 permissions:
   contents: write
   issues: write
-  pull-requests: write
   id-token: write
 
 jobs:
   release:
-    if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
-          # Full history and tags: the guard below needs to see existing tags,
-          # and the changelog is generated from commit history.
+          # Full history: release notes are generated from the commit range.
           fetch-depth: 0
-          ref: main
 
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
@@ -36,37 +36,53 @@ jobs:
           cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
 
-      # This workflow fires on every successful CI run on main, but the version
-      # only changes when someone bumps it. Without this guard every later merge
-      # would try to republish the same version and fail.
-      - name: Has this version already been released?
+      # A tag that disagrees with package.json would publish a version nobody
+      # asked for, so fail before anything reaches the registry.
+      - name: Check the tag matches package.json
         id: check
         run: |
+          set -euo pipefail
+          NAME="$(node -p "require('./package.json').name")"
           VERSION="$(node -p "require('./package.json').version")"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
-            echo "released=true" >> "$GITHUB_OUTPUT"
-            echo "v$VERSION is already tagged — nothing to release."
+
+          if [ "${GITHUB_REF_TYPE:-}" = "tag" ]; then
+            TAG_VERSION="${GITHUB_REF_NAME#v}"
+            if [ "$TAG_VERSION" != "$VERSION" ]; then
+              echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $VERSION."
+              exit 1
+            fi
+            echo "Tag $GITHUB_REF_NAME matches package.json."
+          else
+            echo "Manual run — releasing version $VERSION from package.json."
+          fi
+
+          # Re-running a tag must not fail on a publish that already succeeded.
+          if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+            echo "$NAME@$VERSION is already on npm — the publish step will be skipped."
           else
-            echo "released=false" >> "$GITHUB_OUTPUT"
-            echo "v$VERSION is not tagged yet — releasing."
+            echo "published=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Configure git identity
-        if: steps.check.outputs.released == 'false'
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
-      # `--no-increment` publishes exactly the version in package.json rather
-      # than deriving one from commit messages, so the released version is
-      # whatever the committed manifest says and nothing else.
+      # release-it neither commits nor tags here — the tag already exists and is
+      # what triggered this run. It publishes and creates the GitHub release.
       #
-      # `prepublishOnly` re-runs lint, typecheck, tests and build before the
-      # tarball is uploaded, so a broken tree cannot reach npm.
+      # `prepublishOnly` runs lint, typecheck, tests and build before the tarball
+      # is uploaded, so a broken tree cannot reach npm.
       - name: Release v${{ steps.check.outputs.version }}
-        if: steps.check.outputs.released == 'false'
-        run: pnpm release-it --ci --no-increment
+        run: |
+          set -euo pipefail
+          FLAGS="--ci --no-increment"
+          if [ "${{ steps.check.outputs.published }}" = "true" ]; then
+            FLAGS="$FLAGS --no-npm.publish"
+          fi
+          pnpm release-it $FLAGS
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.release-it.json

@@ -1,8 +1,10 @@
 {
   "git": {
-    "commitMessage": "chore: release v${version}",
-    "tagName": "v${version}",
-    "tagAnnotation": "Release v${version}"
+    "//": "Releases are triggered by pushing a tag, so the tag already exists and the version bump is already committed. release-it must not commit, tag or push — it only publishes and creates the GitHub release. requireUpstream is off because a tag checkout is a detached HEAD.",
+    "commit": false,
+    "tag": false,
+    "push": false,
+    "requireUpstream": false
   },
   "npm": {
     "publish": true