diff --git a/.github/cross-repo-pins.json b/.github/cross-repo-pins.json index 536aa79..0caafd3 100644 --- a/.github/cross-repo-pins.json +++ b/.github/cross-repo-pins.json @@ -5,16 +5,16 @@ "data-connect": { "owner": "PDP-Connect", "repo": "data-connect", - "sha": "9ef24d461dab0ee536abf4a15685c4b896d0d5be", + "sha": "9155e57ae47ab145214eb10551ed2c2185d7098a", "branch": "main", - "note": "Post-activation head of PDP-Connect/data-connect main as of 2026-08-20, verified via `gh api repos/PDP-Connect/data-connect/branches/main` at pin time. This is the merge commit of the activation PR (#29) that flipped consumer_pin_required false -> true in .github/consumer-drift-signal-config.json. Supersedes the prior b31bf312 pin (PR #26, move-r-collector-runtime): the branch field now points at main because the coordinated cutover is live and the consumer-side enforcement this pin backs (data-connect's own pin-required check) is active. Source of truth for drift jobs (a) collector-definitions snapshot, (b) vendored connector sources, (c) tarball digests." + "note": "Head of PDP-Connect/data-connect main as of 2026-08-20, verified via `gh api repos/PDP-Connect/data-connect/branches/main` at pin time. This is the merge commit of PR #30, which ports three hunks pdpp's own rebase of fix/preservation-fixes-0819 had dropped (bare-specifier package validation, iMessage fixture date fix, connector-spawn tsx-resolution hardening). Supersedes the prior 9ef24d46 pin (PR #29, consumer-pin-required activation): only packages/collector-runtime changed between the two pins (see this repo's vendor/SHA256SUMS refresh in the same PR that updated this field). Source of truth for drift jobs (a) collector-definitions snapshot, (b) vendored connector sources, (c) tarball digests." }, "pdpp": { "owner": "PDP-Connect", "repo": "pdpp", - "sha": "a0924e9a4338550f945bd50a02fa1cf0cd4e8cec", + "sha": "5eacd82e2f9822b555bda869429b842be66b1ff7", "branch": "main", - "note": "Post-activation head of PDP-Connect/pdpp main as of 2026-08-20, verified via `gh api repos/PDP-Connect/pdpp/branches/main` at pin time. This is the merge commit of the activation PR (#170) that flipped consumer_pin_required false -> true in .github/consumer-drift-signal-config.json. Supersedes the prior dc5c878e pin (PR #155, move-r-pdpp-removal): the branch field now points at main because the coordinated cutover is live and the consumer-side enforcement this pin backs (pdpp's own pin-required check) is active. Source of truth for drift job (d) reference-contract stand-in comparison, and for the integration job's RI-server checkout." + "note": "Head of PDP-Connect/pdpp main as of 2026-08-20, verified via `gh api repos/PDP-Connect/pdpp/branches/main` at pin time. This is the merge commit of PR #171, which refreshed pdpp's own vendor/pdpp-collector-runtime-0.0.1.tgz to match data-connect's new pin above (both moves are part of the same coordinated data-connect PR #30 repin). Required here: drift job (c) (vendored tarball digests) checks pdpp's vendor/SHA256SUMS against a fresh repack from the data-connect pin too, and pdpp's tarball at the PRIOR a0924e9a pin predates PR #171, so it would fail that comparison without this move. packages/reference-contract (what this pin otherwise backs, for drift job (d)) did not change in PR #171. Supersedes the prior a0924e9a pin (PR #170, consumer-pin-required activation)." } } } diff --git a/packages/polyfill-connectors/package-lock.json b/packages/polyfill-connectors/package-lock.json index f2f9a8a..c5d3fda 100644 --- a/packages/polyfill-connectors/package-lock.json +++ b/packages/polyfill-connectors/package-lock.json @@ -38,6 +38,9 @@ "@types/ws": "^8.18.1", "tsx": "^4.23.11", "ultracite": "7.10.2" + }, + "engines": { + "node": ">=24.15.0 <25" } }, "node_modules/@babel/helper-string-parser": { @@ -939,7 +942,7 @@ "node_modules/@pdpp/collector-runtime": { "version": "0.0.1", "resolved": "file:vendor/pdpp-collector-runtime-0.0.1.tgz", - "integrity": "sha512-90OO8/HPXf4m7LiU8Tw1goJlzxgWsnhOa5ypI4rmCGBdyQHSUCMQ9H75gpq1lQ93VkQz8no2Z3FLb5pX1RPKUQ==", + "integrity": "sha512-r8wGrqsjE2fpwVLswAn6GyX2CO1uTBWA9iueICfUrAmpnUopTWBWB9XS2MSwVfPRPbDVvKVEC2tPWltS3LU9Iw==", "license": "Apache-2.0", "dependencies": { "@pdpp/connector-protocol": "*", diff --git a/packages/polyfill-connectors/vendor/README.md b/packages/polyfill-connectors/vendor/README.md index 1947728..6c12661 100644 --- a/packages/polyfill-connectors/vendor/README.md +++ b/packages/polyfill-connectors/vendor/README.md @@ -2,7 +2,7 @@ `@pdpp/collector-runtime` and `@pdpp/connector-protocol` live in [PDP-Connect/data-connect](https://github.com/PDP-Connect/data-connect), pinned at commit -`177adedcf169a03c3bd75c315304238aa1ccc181` (see `.github/cross-repo-pins.json`). This package +`9155e57ae47ab145214eb10551ed2c2185d7098a` (see `.github/cross-repo-pins.json`). This package needs them at build/test time, but they are not published to any registry yet. ## Why a checked-in `.tgz`, not a git dependency @@ -22,12 +22,12 @@ rejected outright rather than treated as a partial win. - `pdpp-collector-runtime-0.0.1.tgz` / `pdpp-connector-protocol-0.0.1.tgz`: built with `npm run build` then packed with `npm pack` from a clean checkout of - `PDP-Connect/data-connect@177adedcf169a03c3bd75c315304238aa1ccc181`, workspace packages - `packages/collector-runtime` and `packages/connector-protocol`. Resynced 2026-08-18 after - `check-tarball-digest-drift.sh`'s new content-manifest comparison (see that script's own - comment for why raw tarball digest equality across npm versions was replaced) caught the - previously-committed tarballs still carrying a stale `"prepare": "npm run build"` package.json - field that data-connect's own `ab2146c` removed before the pin above was set. + `PDP-Connect/data-connect@9155e57ae47ab145214eb10551ed2c2185d7098a`, workspace packages + `packages/collector-runtime` and `packages/connector-protocol`. Resynced 2026-08-20 to pick up + data-connect PR #30 (port of pdpp's dropped preservation-fixes-0819 hunks: bare-specifier + package validation, iMessage fixture date fix, connector-spawn tsx-resolution hardening). + Only collector-runtime's contents changed; connector-protocol's tarball is byte-identical to + the prior vendored copy. - `pdpp-reference-contract-0.0.1.tgz`: **not** the real `@pdpp/reference-contract` package. `@pdpp/collector-runtime`'s own `package.json` (inherited from the pnpm monorepo) declares `@pdpp/connector-protocol` and `@pdpp/reference-contract` as dependencies at bare `"*"`, which @@ -79,7 +79,7 @@ rejected outright rather than treated as a partial win. `package-lock.json` once installed): ``` - 34443a3576f16c48049922fe53438e890cdfbbde67c0725a3a7fdca17ded042e pdpp-collector-runtime-0.0.1.tgz + e78fecd8c4ef74860cbeb3eb356b6c738e396f8d00fee21d5fdb8269604215e5 pdpp-collector-runtime-0.0.1.tgz 0173b91526c4ee5a8ebe8c8c67848758b4112d46cadbd72bb7cf1c90f5389905 pdpp-connector-protocol-0.0.1.tgz b636fbddb849ea17d66c7e010d9773e97b922de653c54ab4d9d9ba0db53e0c9e pdpp-reference-contract-0.0.1.tgz ``` diff --git a/packages/polyfill-connectors/vendor/SHA256SUMS b/packages/polyfill-connectors/vendor/SHA256SUMS index d56fed7..48dd092 100644 --- a/packages/polyfill-connectors/vendor/SHA256SUMS +++ b/packages/polyfill-connectors/vendor/SHA256SUMS @@ -1,3 +1,3 @@ -34443a3576f16c48049922fe53438e890cdfbbde67c0725a3a7fdca17ded042e pdpp-collector-runtime-0.0.1.tgz +e78fecd8c4ef74860cbeb3eb356b6c738e396f8d00fee21d5fdb8269604215e5 pdpp-collector-runtime-0.0.1.tgz 0173b91526c4ee5a8ebe8c8c67848758b4112d46cadbd72bb7cf1c90f5389905 pdpp-connector-protocol-0.0.1.tgz b636fbddb849ea17d66c7e010d9773e97b922de653c54ab4d9d9ba0db53e0c9e pdpp-reference-contract-0.0.1.tgz diff --git a/packages/polyfill-connectors/vendor/pdpp-collector-runtime-0.0.1.tgz b/packages/polyfill-connectors/vendor/pdpp-collector-runtime-0.0.1.tgz index be7aecb..d99358b 100644 Binary files a/packages/polyfill-connectors/vendor/pdpp-collector-runtime-0.0.1.tgz and b/packages/polyfill-connectors/vendor/pdpp-collector-runtime-0.0.1.tgz differ