sallytest

The typed, live npm acceptance fixture for sallyport.

Important

sallytest is release infrastructure, not a package for applications to depend on. Its public versions are disposable acceptance canaries.

Purpose

sallytest exercises Sallyport from a real downstream repository:

signed tag → pack once → typecheck and run exact bytes → stage with OIDC
           → approve with 2FA → verify public bytes → immutable prerelease

The package stays deliberately small so a failure points at the release path, not at application behavior. The repository supplies the parts Sallyport does not invent for consumers: release checks, an exact-tarball smoke, signed tags, and release notes.

Contract

The published package is compiled ESM with TypeScript declarations:

import { fixture, type SallytestFixture } from 'sallytest';

const accepted: SallytestFixture = fixture;
// { name: 'sallytest', protocol: 'sallyport/0.1' }

The release smoke installs the candidate tarball into an isolated project, compiles a typed consumer against its declarations, and executes the compiled consumer. It never substitutes source-tree output for the candidate.

Acceptance

Public canaries use 0.0.N-fixture.M versions and the fixture npm dist-tag. The inert manual bootstrap remains on latest. Rejection drills use 0.0.N-reject.M and must never be approved.

The complete operator procedure and evidence requirements live in Acceptance. Historical results live in Acceptance runs.

Development

npm ci
npm run release:check

To smoke a locally packed tarball:

npm pack
SALLYPORT_TARBALL="$PWD/sallytest-<version>.tgz" npm run release:smoke

Security

Report vulnerabilities privately as described in Security. Sallyport's threat model defines the release protocol's trust boundaries.

License

MIT