Repository navigation
Publish @blockcast/mabr-route-proxy@0.1.1 through npm trusted publisher #25
Description
Blocker
@blockcast/mabr-route-proxy@0.1.1 is the public browser library used by the PMG Shaka integration, but the package is still absent from registry.npmjs.org.
The merged publish workflow and mabr-route-proxy-v0.1.1 tag build the exact tarball, but npm OIDC exchange returns:
POST https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/@blockcast%2fmabr-route-proxy
404 package not found
The package must be created/claimed under the blockcast npm scope and the Beacon publish-npm.yml GitHub trusted publisher configured for the publish-mabr job. Then rerun the mabr-route-proxy-v0.1.1 workflow (or publish the immutable tarball once) and verify:
npm view @blockcast/mabr-route-proxy@0.1.1 version dist.integrity
# sha512-qYs3K+qr9ZFGBcIy1aePCkau7KUr2AqTUetZ5QAST2v/kUgF0LJK24r9JSelsDNWd3ioJmhhGTlczIz3DFc3yQ==
This blocks PMG PR #4176 frozen installs; do not replace it with an expiring GitHub release URL.
Activity
kkroo commentedon Oct 26, 2026
Current verification (2026-10-26):
npm run typecheck,npm run build, and all 33 package tests pass.69.25.95.198 -> 232.254.0.12:1024and production69.25.95.61 -> 232.1.1.66:8000.npm view @blockcast/mabr-route-proxy@0.1.1still returns E404.kkroo commentedon Oct 26, 2026
Paperclip tracking is now BLO-49295. It owns the first-publish/trusted-publisher action, exact integrity verification, PMG #4176 frozen-install rerun, and the downstream staging/prod acceptance gates.
Current registry check remains E404 for
@blockcast/mabr-route-proxy@0.1.1; no code or registry workaround was introduced.