feat: configure semantic-release for Artifactory hybrid versioning

.gitignore

@@ -3,3 +3,5 @@ npm-debug.log
 .idea/
 sandbox/
 v8.log
+junit.xml
+jintegration.xml

.releaserc.js

@@ -0,0 +1,18 @@
+const UPSTREAM_VERSION = '5.0.1';
+
+module.exports = {
+  repositoryUrl: 'https://github.com/auth0/oauth2orize-mfa.git',
+  tagFormat: `${UPSTREAM_VERSION}-auth0-\${version}`,
+  branches: ['master'],
+  plugins: [
+    '@semantic-release/commit-analyzer',
+    '@semantic-release/release-notes-generator',
+    '@semantic-release/npm',
+    [
+      '@semantic-release/exec',
+      {
+        prepareCmd: `npm version --no-git-tag-version ${UPSTREAM_VERSION}-auth0-\${nextRelease.version}`,
+      },
+    ],
+  ],
+};

Makefile

@@ -0,0 +1,20 @@
+SHELL := /bin/bash
+.SHELLFLAGS = -ec
+.ONESHELL:
+
+install:
+	npm i
+
+install-dev:
+	npm i
+
+test:
+	npx vows --xunit > junit.xml
+
+lint:
+	echo "No lint command defined."
+
+integration:
+	echo '<testsuite name="integration" tests="0"></testsuite>' > jintegration.xml
+
+.PHONY: test install install-dev lint integration

README.md

@@ -1,5 +1,12 @@
 ![protobuf.js - Protocol Buffers for JavaScript. Finally.](https://raw.github.com/dcodeIO/protobuf.js/master/protobuf.png)
 =====================================
+
+## Versioning
+
+This fork is published to Artifactory using the hybrid format: `5.0.1-auth0-{internal-version}` (e.g., `5.0.1-auth0-1.0.0`).
+
+---
+
 **Protocol Buffers** are a language-neutral, platform-neutral, extensible way of serializing structured data for use
 in communications protocols, data storage, and more, originally designed at Google ([see](https://developers.google.com/protocol-buffers/docs/overview)).
 

RELEASING.md

@@ -0,0 +1,77 @@
+# Releasing
+
+This package uses [semantic-release](https://github.com/semantic-release/semantic-release) to automate versioning and publishing to JFrog Artifactory via the **Auth0 Library Pipeline (LP)**.
+
+## Versioning Scheme
+
+Versions follow the hybrid format: `5.0.1-auth0-<semver>` (e.g., `5.0.1-auth0-1.0.0`).
+
+- `5.0.1` is the upstream Mozilla version this fork is based on.
+- The `-auth0-<semver>` suffix tracks internal changes using semantic versioning.
+
+## How Releases Work
+
+Releases are triggered by conventional commit messages on the `master` branch:
+
+| Commit prefix | Version bump |
+|---|---|
+| `fix:` | Patch (e.g., 1.0.0 -> 1.0.1) |
+| `feat:` | Minor (e.g., 1.0.0 -> 1.1.0) |
+| `BREAKING CHANGE:` in body | Major (e.g., 1.0.0 -> 2.0.0) |
+
+## CI Pipeline: Library Pipeline (LP)
+
+Publishing is handled by the standardized [Library Pipeline](https://oktainc.atlassian.net/wiki/spaces/L0CTRL/pages/710574528) maintained by the Platform Build Services (PBS) team.
+
+### How it works
+
+1. Jenkins detects pushes to `master` via the multibranch pipeline job.
+2. LP runs `pipeline-cli stage publish-library`, which invokes `npx semantic-release`.
+3. Artifactory credentials are injected automatically by Jenkins (via the `artifactory` credential).
+4. The package is published to Artifactory's npm repository.
+
+### Configuration files
+
+| File | Purpose |
+|---|---|
+| `project.yaml` | LP metadata: language, node version, team channel |
+| `Makefile` | Build targets: `install`, `test`, `lint`, `integration` |
+| `opslevel.yml` | Tags repo with `cic.ci.pipeline: lp` |
+| `.releaserc.js` | Semantic-release config (tag format, plugins) |
+
+### Setting up the Jenkins job
+
+Per [LP documentation](https://oktainc.atlassian.net/wiki/spaces/L0CTRL/pages/710574528#Setting-up-a-new-project), open an ESD ticket for the Platform Build Services team to create the Jenkins multibranch pipeline job:
+
+- Portal: https://auth0team.atlassian.net/servicedesk/customer/portal/34/group/189/create/432
+- Request: "Create Jenkins LP job for `atko-cic/node-client-sessions`"
+
+### Reference repos using LP
+
+- [`atko-cic/limitd-redis`](https://github.com/atko-cic/limitd-redis) — `@a0/limitd-redis`
+- [`atko-cic/token-replay-lib`](https://github.com/atko-cic/token-replay-lib) — `@a0/token-replay-lib`
+- [`atko-cic/dadjokes-library`](https://github.com/atko-cic/dadjokes-library)
+
+## Running Locally (Dry Run)
+
+```bash
+export GITHUB_TOKEN="$(ocm auth github --scope atko-cic --type access-token)"
+export NPM_TOKEN="$(ocm auth artifactory)"
+
+npx semantic-release --dry-run
+```
+
+## Verifying a Release
+
+```bash
+# Check the tag was created
+git ls-remote --tags origin | grep auth0
+
+# Check the artifact in Artifactory
+curl -s -H "Authorization: Bearer $(ocm auth artifactory)" \
+  "https://a0us.jfrog.io/a0us/api/npm/npm-forks-local/client-sessions" | jq '.versions | keys'
+```
+
+## Current Status
+
+The git tag `5.0.1-auth0-1.0.0` has been created on `master`. Once the Jenkins LP job is provisioned (via ESD ticket), it will publish the artifact automatically.

opslevel.yml

@@ -0,0 +1,9 @@
+---
+version: 1
+repository:
+  owner: iam_mfa
+  tier:
+  tags:
+  tags:
+  - key: cic.ci.pipeline
+    value: lp

package.json

@@ -12,12 +12,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/dcodeIO/protobuf.js.git"
+    "url": "https://github.com/auth0/protobuf.js.git"
   },
   "bugs": {
-    "url": "https://github.com/dcodeIO/protobuf.js/issues"
+    "url": "https://github.com/auth0/protobuf.js/issues"
   },
-  "homepage": "https://github.com/dcodeIO/protobuf.js",
+  "homepage": "https://github.com/auth0/protobuf.js",
   "keywords": [
     "net",
     "buffer",
@@ -34,11 +34,16 @@
     "yargs": "^3.10.0"
   },
   "devDependencies": {
-    "testjs": "~1 >=1.0.4",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/exec": "^7.1.0",
+    "@semantic-release/npm": "^13.1.5",
+    "@semantic-release/release-notes-generator": "^14.0.3",
+    "closurecompiler": "~1",
     "fixture-stdout": "^0.2.1",
+    "jsdoc": "~3.3.0-alpha10",
     "metascript": ">=0.18 <1",
-    "closurecompiler": "~1",
-    "jsdoc": "~3.3.0-alpha10"
+    "semantic-release": "^25.0.3",
+    "testjs": "~1 >=1.0.4"
   },
   "license": "Apache-2.0",
   "engines": {

project.yaml

@@ -0,0 +1,12 @@
+name: protobufjs
+description: Protocol Buffers for JavaScript.
+team_channel: "#authn-b2c-mfa-release-notifs"
+type: library
+
+build:
+  notification_channel: "#authn-b2c-mfa-release-notifs"
+  language:
+    node:
+      version: v22
+      ignore_scripts: true
+      unsafe_eval: false