Ship the diffr binary as per-platform npm packages

.github/workflows/release.yml

@@ -168,3 +168,73 @@ jobs:
         run: |
           gh release create "$RELEASE_TAG" dist/* --verify-tag --draft --title "$RELEASE_TAG" --generate-notes
           gh release edit "$RELEASE_TAG" --draft=false --latest
+
+  npm:
+    needs: publish
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.10
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: release
+          path: dist
+      - name: Publish platform packages, then @dev.fast/diffr
+        env:
+          VERSION: ${{ github.ref_name }}
+          # Unset once npm trusted publishing is configured for every package.
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          (cd diffr-ts && bun install --frozen-lockfile)
+          python3 scripts/release.py npm --version "$VERSION" --dist dist --output npm
+          for package in npm/*/ diffr-ts/; do
+            name=$(node -p "require('./${package}package.json').name")
+            if npm view "$name@$VERSION" version >/dev/null 2>&1; then
+              echo "$name@$VERSION is already published"
+            else
+              npm publish "$package" --provenance --access public
+            fi
+          done
+
+  npm-smoke:
+    needs: npm
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-14, macos-15-intel, ubuntu-22.04, ubuntu-22.04-arm, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+      - name: Install from npm and run the platform binary
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: |
+          cd "$RUNNER_TEMP"
+          npm init -y >/dev/null
+          for _ in 1 2 3 4 5 6; do
+            npm install --no-audit --no-fund "@dev.fast/diffr@$VERSION" zod && break
+            sleep 20
+          done
+          node --input-type=module -e "
+            import { execFileSync } from 'node:child_process';
+            import { diffrBinaryPath } from '@dev.fast/diffr';
+            const binary = diffrBinaryPath();
+            if (!binary) throw new Error('no platform package installed');
+            const version = execFileSync(binary, ['--version'], { encoding: 'utf8' }).trim();
+            if (version !== 'diffr $VERSION') throw new Error(version);
+            console.log(binary, version);
+          "

diffr-ts/README.md

@@ -1,20 +1,17 @@
 # @dev.fast/diffr
 
-TypeScript types, zod validators, and a binary fetcher for diffr's NDJSON protocol.
-The package version matches the diffr release.
+TypeScript types and zod validators for diffr's NDJSON protocol, plus the diffr
+executable. The package version matches the diffr release.
 
 ```ts
 import { decodeStructuralDiffEvent } from "@dev.fast/diffr";
 const event = decodeStructuralDiffEvent(line);
 ```
 
-```sh
-npx --package @dev.fast/diffr@0.1.6 diffr-fetch --into ./bin --required
-```
-
-Supports macOS arm64, macOS x64, Linux arm64, Linux x64, and Windows x64 (`diffr.exe`). `--check` verifies an existing install without
-network access. Downloads warn on network failure unless `--required`; invalid
-hashes or archives always fail.
+`diffrBinaryPath()` returns the executable from the `@dev.fast/diffr-<platform>-<arch>`
+optional dependency npm installed for this machine, or `undefined` when there is none
+(musl Linux, Windows arm64, or `--omit=optional`). Platforms: macOS arm64 and x64,
+glibc Linux arm64 and x64, Windows x64.
 
 ## Wire changes
 
@@ -29,13 +26,5 @@ Keep these files in sync:
 
 ## Release
 
-After tagging the matching Rust release and building with `cargo build --locked`,
-run from `diffr-ts`. New pins select the CLI-only release archive;
-older pins continue to use the combined archive:
-
-```sh
-bun install --frozen-lockfile
-npm run pin
-bun run typecheck && bun test
-npm publish --access public
-```
+Bump `diffr-ts/package.json` with `Cargo.toml`. The release workflow publishes the
+platform packages and this package from the tag, using npm trusted publishing.

diffr-ts/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dev.fast/diffr",
   "version": "0.1.10",
-  "description": "diffr's NDJSON wire contract, validators, and release binary fetcher",
+  "description": "diffr's NDJSON wire contract, validators, and the diffr binary for this platform",
   "repository": "https://github.com/devdotfast/diffr",
   "license": "MIT",
   "type": "module",
@@ -14,23 +14,17 @@
     "./package.json": "./package.json",
     "./src/*": "./src/*"
   },
-  "bin": {
-    "diffr-fetch": "bin/fetch.mjs"
-  },
   "files": [
     "dist",
     "src",
     "!src/*.test.ts",
     "!src/test-binary.ts",
-    "bin",
-    "pins.json",
     "README.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
     "test": "bun test",
-    "pin": "node scripts/pin.mjs",
     "prepack": "npm run build"
   },
   "peerDependencies": {

diffr-ts/src/binary.ts

@@ -0,0 +1,13 @@
+import { createRequire } from "node:module";
+
+/** The diffr executable from the installed platform package, if npm installed one for this machine. */
+export function diffrBinaryPath(): string | undefined {
+  const name = process.platform === "win32" ? "diffr.exe" : "diffr";
+  try {
+    // Resolve from this package's own directory, which also holds when a bundler inlines it.
+    const self = createRequire(import.meta.url).resolve("@dev.fast/diffr/package.json");
+    return createRequire(self).resolve(`@dev.fast/diffr-${process.platform}-${process.arch}/${name}`);
+  } catch {
+    return undefined;
+  }
+}