SK-3225: Split SDK into common / skyvault / flowvault; add FlowVault Node SDK

.github/workflows/beta-release.yml

@@ -12,5 +12,7 @@ jobs:
   build-and-deploy:
     uses: ./.github/workflows/common-release.yml
     with:
-      tag: beta
+      product: skyflow-node
+      package-dir: skyvault
+      release-type: beta
     secrets: inherit

.github/workflows/common-ci.yml

@@ -22,6 +22,11 @@ jobs:
       - name: Run ESLint
         run: npm run eslint
 
+      # One command builds BOTH SDKs (common -> skyvault/flowvault via project references).
+      - name: Build all packages
+        run: npm run build
+
+      # Fans out `npm test` across every workspace (common, skyvault, flowvault).
       - name: Run Tests
         env:
           SA_WITHOUT_CONTEXT: ${{ secrets.SA_WITHOUT_CONTEXT }}
@@ -33,6 +38,6 @@ jobs:
         uses: codecov/codecov-action@v2.1.0
         with:
           token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
-          files: coverage/lcov.info
+          files: skyvault/coverage/lcov.info,flowvault/coverage/lcov.info
           name: codecov-skyflow-node
           verbose: true

.github/workflows/common-release.yml

@@ -1,16 +1,30 @@
 name: Common Release Workflow
 
+# Reusable release pipeline, parameterized per product.
+#   product      npm package name  (skyflow-node | skyflow-flowvault-node)
+#   package-dir  workspace dir      (skyvault     | flowvault)
+#   release-type public | beta | internal
+#   version      semver to release  (caller strips any tag prefix, e.g. flowvault/1.0.0 -> 1.0.0)
+
 on:
   workflow_call:
     inputs:
-      tag:
+      product:
+        required: true
+        type: string
+      package-dir:
+        required: true
+        type: string
+      release-type:
+        required: true
+        type: string
+      version:
         required: false
         type: string
 
 jobs:
   build-sdk:
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v4
         with:
@@ -24,68 +38,68 @@ jobs:
       - name: Install Packages
         run: npm install --ignore-scripts
 
-      - name: Build
-        run: npm run build
+      - name: Resolve Version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> $GITHUB_OUTPUT
+          else
+            # Fallback: strip an optional "<dir>/" prefix from the pushed tag.
+            echo "value=${GITHUB_REF_NAME##*/}" >> $GITHUB_OUTPUT
+          fi
 
-      - name: Get Previous Tag
-        id: previoustag
-        uses: WyriHaximus/github-action-get-previous-tag@v1
-        with:
-          fallback: 1.0.0
+      - name: Bump Version (${{ inputs.product }})
+        run: |
+          chmod +x ./scripts/bump_version.sh
+          if [[ "${{ inputs.release-type }}" == "internal" ]]; then
+            ./scripts/bump_version.sh "${{ inputs.product }}" "${{ steps.version.outputs.value }}" "$(git rev-parse --short "$GITHUB_SHA")"
+          else
+            ./scripts/bump_version.sh "${{ inputs.product }}" "${{ steps.version.outputs.value }}"
+          fi
+
+      # Build everything (common -> layers) then bundle the published package
+      # (inlines skyflow-common into a self-contained dist/).
+      - name: Build
+        run: |
+          npm run build
+          npm run build:dist --workspace ${{ inputs.package-dir }}
 
       - name: Resolve Branch Name
         id: resolve-branch
-        if: ${{ inputs.tag == 'beta' || inputs.tag == 'public' }}
+        if: ${{ inputs.release-type == 'beta' || inputs.release-type == 'public' }}
         run: |
           TAG_COMMIT=$(git rev-list -n 1 ${{ github.ref_name }})
-
           BRANCH_NAME=$(git branch -r --contains $TAG_COMMIT | grep -o 'origin/.*' | sed 's|origin/||' | head -n 1)
-
           if [ -z "$BRANCH_NAME" ]; then
             echo "Error: Could not resolve branch for the tag."
             exit 1
           fi
-
-          echo "Resolved Branch Name: $BRANCH_NAME"
           echo "branch_name=$BRANCH_NAME" >> $GITHUB_ENV
 
-      - name: Bump Version
-        run: |
-          chmod +x ./scripts/bump_version.sh
-          if ${{ inputs.tag == 'internal' }}; then
-            ./scripts/bump_version.sh "${{ steps.previoustag.outputs.tag }}" "$(git rev-parse --short "$GITHUB_SHA")"
-          else
-            ./scripts/bump_version.sh "${{ steps.previoustag.outputs.tag }}"
-          fi
-
       - name: Commit Changes
         run: |
           git config user.name ${{ github.actor }}
           git config user.email ${{ github.actor }}@users.noreply.github.com
-          if [[ "${{ inputs.tag }}" == "beta" || "${{ inputs.tag }}" == "public" ]]; then
+          if [[ "${{ inputs.release-type }}" == "beta" || "${{ inputs.release-type }}" == "public" ]]; then
             git checkout ${{ env.branch_name }}
           fi
-          git add package.json
-          if [[ "${{ inputs.tag }}" == "beta" || "${{ inputs.tag }}" == "public" ]]; then
-            git commit -m "[AUTOMATED] Release - ${{ steps.previoustag.outputs.tag }}"
+          git add ${{ inputs.package-dir }}/package.json ${{ inputs.package-dir }}/src/version.ts
+          if [[ "${{ inputs.release-type }}" == "beta" || "${{ inputs.release-type }}" == "public" ]]; then
+            git commit -m "[AUTOMATED] Release ${{ inputs.product }} - ${{ steps.version.outputs.value }}" || echo "nothing to commit"
             git push origin ${{ env.branch_name }}
-          elif [[ "${{ inputs.tag }}" == "internal" ]]; then
-            git commit -m "[AUTOMATED] Private Release ${{ steps.previoustag.outputs.tag }}-dev.$(git rev-parse --short $GITHUB_SHA)"
+          elif [[ "${{ inputs.release-type }}" == "internal" ]]; then
+            git commit -m "[AUTOMATED] Private Release ${{ inputs.product }} ${{ steps.version.outputs.value }}-dev.$(git rev-parse --short $GITHUB_SHA)" || echo "nothing to commit"
             git push origin ${{ github.ref_name }} -f
           fi
 
       - name: Publish
+        working-directory: ${{ inputs.package-dir }}
         run: |
-          if [[ "${{ inputs.tag }}" == "beta" ]]; then
+          if [[ "${{ inputs.release-type }}" == "beta" ]]; then
             npm publish --tag beta
-          elif [[ "${{ inputs.tag }}" == "public" ]]; then
-            MAJOR_VERSION=$(node -p "require('./package.json').version.split('.')[0]")
-            if [[ "$MAJOR_VERSION" == "1" ]]; then
-              npm publish --tag v1
-            else
-              npm publish
-            fi
-          elif [[ "${{ inputs.tag }}" == "internal" ]]; then
+          elif [[ "${{ inputs.release-type }}" == "public" ]]; then
+            npm publish
+          elif [[ "${{ inputs.release-type }}" == "internal" ]]; then
             JFROG_AUTH=$(echo -n "$JFROG_USERNAME:$JFROG_PASSWORD" | base64 -w 0)
             npm config set registry https://prekarilabs.jfrog.io/prekarilabs/api/npm/npm/
             npm config set //prekarilabs.jfrog.io/prekarilabs/api/npm/npm/:_auth "$JFROG_AUTH"

.github/workflows/contract-tests.yml

@@ -24,7 +24,9 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
-      - name: Verify API surface snapshot
+      # Builds every package, bundles the two published dist/ surfaces, then
+      # verifies BOTH SDKs' public-API snapshots (skyflow-node + skyflow-flowvault-node).
+      - name: Verify API surface snapshots (both SDKs)
         run: npm run contract-snapshot-verify
 
       - name: Show API surface diff
@@ -34,12 +36,18 @@ jobs:
           echo "Lines prefixed with '-' were REMOVED from the public API."
           echo "Lines prefixed with '+' were ADDED to the public API."
           echo ""
-          diff -u api-report/skyflow-node.api.md temp/skyflow-node.api.md || true
+          echo "===== skyflow-node (skyvault) ====="
+          diff -u skyvault/api-report/skyflow-node.api.md skyvault/temp/skyflow-node.api.md || true
+          echo ""
+          echo "===== skyflow-flowvault-node (flowvault) ====="
+          diff -u flowvault/api-report/skyflow-flowvault-node.api.md flowvault/temp/skyflow-flowvault-node.api.md || true
 
-      - name: Upload API surface diff on failure
+      - name: Upload API surface diffs on failure
         if: failure()
         uses: actions/upload-artifact@v4
         with:
-          name: api-surface-diff
-          path: temp/skyflow-node.api.md
+          name: api-surface-diffs
+          path: |
+            skyvault/temp/skyflow-node.api.md
+            flowvault/temp/skyflow-flowvault-node.api.md
           retention-days: 7

.github/workflows/flowvault-beta-release.yml

@@ -0,0 +1,18 @@
+name: FlowVault Public Beta Release
+
+on:
+  push:
+    tags: 'flowvault/*.*.*-beta.*'
+    paths-ignore:
+      - "package.json"
+      - "package-lock.json"
+      - "*.md"
+
+jobs:
+  build-and-deploy:
+    uses: ./.github/workflows/common-release.yml
+    with:
+      product: skyflow-flowvault-node
+      package-dir: flowvault
+      release-type: beta
+    secrets: inherit

.github/workflows/flowvault-release.yml

@@ -0,0 +1,19 @@
+name: FlowVault Public Release
+
+# Prefixed tags select the FlowVault product: flowvault/x.y.z -> skyflow-flowvault-node.
+on:
+  push:
+    tags: 'flowvault/[0-9]+.[0-9]+.[0-9]+'
+    paths-ignore:
+      - "package.json"
+      - "package-lock.json"
+      - "*.md"
+
+jobs:
+  call-common-workflow:
+    uses: ./.github/workflows/common-release.yml
+    with:
+      product: skyflow-flowvault-node
+      package-dir: flowvault
+      release-type: public
+    secrets: inherit

.github/workflows/internal-release.yml

@@ -1,5 +1,8 @@
 name: Internal Release
 
+# Branch-namespaced internal (JFrog) builds, routed per product:
+#   flowvault-release/*            -> skyflow-flowvault-node
+#   skyvault-release/* | release/* -> skyflow-node (legacy release/* kept for skyvault)
 on:
   push:
     tags-ignore:
@@ -10,10 +13,14 @@ on:
       - '*.md'
     branches:
       - release/*
+      - skyvault-release/*
+      - flowvault-release/*
 
 jobs:
   call-common-workflow:
     uses: ./.github/workflows/common-release.yml
     with:
-      tag: internal
+      product: ${{ startsWith(github.ref_name, 'flowvault-release/') && 'skyflow-flowvault-node' || 'skyflow-node' }}
+      package-dir: ${{ startsWith(github.ref_name, 'flowvault-release/') && 'flowvault' || 'skyvault' }}
+      release-type: internal
     secrets: inherit

.github/workflows/release.yml

@@ -12,5 +12,7 @@ jobs:
   call-common-workflow:
     uses: ./.github/workflows/common-release.yml
     with:
-      tag: public
+      product: skyflow-node
+      package-dir: skyvault
+      release-type: public
     secrets: inherit

.gitignore

@@ -1,4 +1,7 @@
 node_modules
 lib
+dist
+*.tsbuildinfo
 .vscode
-coverage
+coverage
+temp

Rule/gitleaks.toml

@@ -55,6 +55,13 @@ paths = [
     '''\.gem$''',
     '''verification-metadata\.xml''',
     '''Database.refactorlog''',
+    # Maintainer-owned generated (Fern) clients contain example JWTs/tokens in
+    # their doc comments. Allowlist every generated dir across the workspaces
+    # (both the plain and the legacy leading-space directory names).
+    '''(?:^|/)_generated_(?:/|$)''',
+    '''(?:^|/) _generated_(?:/|$)''',
+    # Bundled publish output inlines the generated clients (example JWTs).
+    '''(?:^|/)dist/''',
 ]
 stopwords = [
     "abcdefghijklmnopqrstuvwxyz",

common/.babelrc

@@ -0,0 +1,14 @@
+{
+  "presets": [
+    ["@babel/preset-env", {
+     "targets": {
+        "browsers": ["last 2 versions", "ie >= 10"]
+      }
+    }]
+  ],
+  "sourceType": "unambiguous",
+  "plugins": [
+    "@babel/plugin-transform-object-assign",
+    "@babel/plugin-transform-runtime"
+  ]
+}

common/babel.config.js

@@ -0,0 +1,32 @@
+/*
+	Copyright (c) 2022 Skyflow, Inc. 
+*/
+module.exports = function (api) {
+  api.cache(false);
+  const presets = [
+    ['@babel/preset-typescript'],
+    [
+      '@babel/preset-env',
+      {
+        corejs: { version: 3 },
+        useBuiltIns: 'usage',
+        targets: {
+          edge: '17',
+          firefox: '60',
+          chrome: '67',
+          safari: '11.1',
+          ie: '11',
+        },
+      },
+    ],
+  ];
+  const plugins = [
+    ['@babel/plugin-proposal-decorators', { decoratorsBeforeExport: true }],
+    ['@babel/plugin-transform-class-properties'],
+    ['@babel/transform-runtime'],
+  ];
+  return {
+    presets,
+    plugins,
+  };
+};