From 962fdc2f6477f84d0c985549af82d7dfbd0ff19f Mon Sep 17 00:00:00 2001
From: John Watson <john@familywatson.co.uk>
Date: Fri, 27 Mar 2026 18:50:30 +0000
Subject: [PATCH 1/2] ci: add JSR publish workflow for @systeminit/swamp-lib

Publishes packages/client to JSR on merge to main when files in
packages/client/ change. Uses OIDC token auth (no secrets needed).
Version is auto-generated from date + commit count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish-client.yml | 67 ++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 .github/workflows/publish-client.yml

diff --git a/.github/workflows/publish-client.yml b/.github/workflows/publish-client.yml
new file mode 100644
index 00000000..c0595366
--- /dev/null
+++ b/.github/workflows/publish-client.yml
@@ -0,0 +1,67 @@
+name: Publish Client Library
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+    paths:
+      - "packages/client/**"
+  workflow_dispatch:
+
+concurrency:
+  group: publish-client
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish to JSR
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: main
+
+      - name: Setup Deno
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+
+      - name: Generate version
+        id: version
+        run: |
+          # Semantic version derived from date: MAJOR.YYYYMMDD.PATCH
+          VERSION="0.$(date -u +%Y%m%d).$(git rev-list --count HEAD -- packages/client)"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Version: $VERSION"
+
+      - name: Stamp version
+        working-directory: packages/client
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          # Update version in deno.json
+          deno eval "
+            const config = JSON.parse(await Deno.readTextFile('deno.json'));
+            config.version = '${VERSION}';
+            await Deno.writeTextFile('deno.json', JSON.stringify(config, null, 2) + '\n');
+          "
+          echo "Updated deno.json:"
+          cat deno.json
+
+      - name: Type check
+        working-directory: packages/client
+        run: deno check mod.ts
+
+      - name: Run tests
+        working-directory: packages/client
+        run: deno test -A
+
+      - name: Publish to JSR
+        working-directory: packages/client
+        run: deno publish --allow-dirty

From 0953db2a4f9fc8e0c7a66d0f7d6e4ab2a3878fee Mon Sep 17 00:00:00 2001
From: John Watson <john@familywatson.co.uk>
Date: Fri, 27 Mar 2026 18:59:22 +0000
Subject: [PATCH 2/2] =?UTF-8?q?fix:=20address=20review=20=E2=80=94=20full?=
 =?UTF-8?q?=20clone=20for=20version=20count,=20pin=20setup-deno=20SHA,=20j?=
 =?UTF-8?q?ob-level=20perms?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish-client.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/publish-client.yml b/.github/workflows/publish-client.yml
index c0595366..62b1d48e 100644
--- a/.github/workflows/publish-client.yml
+++ b/.github/workflows/publish-client.yml
@@ -12,31 +12,34 @@ concurrency:
   group: publish-client
   cancel-in-progress: false
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   publish:
     name: Publish to JSR
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
 
+    permissions:
+      contents: read
+      id-token: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           ref: main
+          fetch-depth: 0
 
       - name: Setup Deno
-        uses: denoland/setup-deno@v2
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
         with:
           deno-version: v2.x
 
       - name: Generate version
         id: version
         run: |
-          # Semantic version derived from date: MAJOR.YYYYMMDD.PATCH
+          # Version: 0.YYYYMMDD.N where N is the total commit count touching
+          # packages/client. This produces a monotonically increasing semver
+          # since N never resets (it's a lifetime count, not per-day).
           VERSION="0.$(date -u +%Y%m%d).$(git rev-list --count HEAD -- packages/client)"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Version: $VERSION"
@@ -45,7 +48,6 @@ jobs:
         working-directory: packages/client
         run: |
           VERSION="${{ steps.version.outputs.version }}"
-          # Update version in deno.json
           deno eval "
             const config = JSON.parse(await Deno.readTextFile('deno.json'));
             config.version = '${VERSION}';