From 37a167ac1a6f8572aee5c4fcf70e18abc74fc68a Mon Sep 17 00:00:00 2001
From: cultron <mscullerton@gmail.com>
Date: Tue, 27 Oct 2026 14:28:03 -0500
Subject: [PATCH 1/2] chore: bundle Node 24.22.1 LTS in standalone tarballs and
 smoke test them

Node 18.20.4 reached end of life in April 2025. The tarballs now bundle
Node 24.22.1 (LTS, supported until April 2028), and CI builds and tests on
24, with unit tests also run on 22.

scripts/tarball-smoke.sh unpacks a tarball and checks the bundled Node
version, --help, schema validate and the PGlite migrate sandbox. It runs on
PRs that change the bundle and in the release job before any upload.
---
 .github/workflows/onPushToMain.yml   | 10 +++++--
 .github/workflows/scaffold-smoke.yml |  2 +-
 .github/workflows/tarball-smoke.yml  | 31 ++++++++++++++++++++++
 .github/workflows/unitTests.yml      |  7 ++++-
 package.json                         |  2 +-
 scripts/tarball-smoke.sh             | 39 ++++++++++++++++++++++++++++
 6 files changed, 86 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/tarball-smoke.yml
 create mode 100755 scripts/tarball-smoke.sh

diff --git a/.github/workflows/onPushToMain.yml b/.github/workflows/onPushToMain.yml
index b60d14f..8f12bc4 100644
--- a/.github/workflows/onPushToMain.yml
+++ b/.github/workflows/onPushToMain.yml
@@ -18,7 +18,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v3
       with:
-        node-version: '18'  # Set to your Node.js version
+        node-version: '24'  # Same line as the Node bundled in the tarballs
         registry-url: 'https://registry.npmjs.org/'
       
     - name: Install dependencies
@@ -83,7 +83,7 @@ jobs:
     # Configured on npmjs.com: @apso/cli > Settings > Trusted Publisher
     # (GitHub Actions, apsoai/cli, onPushToMain.yml, environment blank,
     # "Allow npm publish" checked; without it only `npm stage publish` works).
-    # Build stays on Node 18 (what CI tests); publish needs npm >= 11.5.1,
+    # Build runs on Node 24 (what CI tests); publish needs npm >= 11.5.1,
     # which needs Node 22.
     # No registry-url: with it, setup-node writes an .npmrc that sends the
     # NODE_AUTH_TOKEN placeholder (XXXXX-...) as the auth token, and npm then
@@ -111,6 +111,12 @@ jobs:
       run: |
         npx oclif pack tarballs --targets darwin-x64,darwin-arm64,linux-x64
 
+    # Run the linux tarball before anything is uploaded, so a broken bundle
+    # never reaches the GitHub Release or the Homebrew formula.
+    - name: Smoke test the linux tarball
+      if: steps.bump_version.outputs.newTag != ''
+      run: bash scripts/tarball-smoke.sh linux-x64
+
     - name: Rename tarballs and compute checksums
       if: steps.bump_version.outputs.newTag != ''
       id: tarballs
diff --git a/.github/workflows/scaffold-smoke.yml b/.github/workflows/scaffold-smoke.yml
index 8c9beef..6b660cc 100644
--- a/.github/workflows/scaffold-smoke.yml
+++ b/.github/workflows/scaffold-smoke.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "18"
+          node-version: "24"
           registry-url: "https://npm.pkg.github.com"
           scope: "@mavric"
 
diff --git a/.github/workflows/tarball-smoke.yml b/.github/workflows/tarball-smoke.yml
new file mode 100644
index 0000000..24b9efe
--- /dev/null
+++ b/.github/workflows/tarball-smoke.yml
@@ -0,0 +1,31 @@
+name: tarball smoke test
+
+# Packs the linux standalone tarball (the Homebrew/curl bundle with its own
+# Node) and runs it. Only on PRs that change what goes into the bundle, since
+# packing downloads a Node binary.
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - package.json
+      - npm-shrinkwrap.json
+      - scripts/tarball-smoke.sh
+      - .github/workflows/tarball-smoke.yml
+
+permissions:
+  contents: read
+
+jobs:
+  tarball-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - run: npm ci
+      - run: npm run build
+      - run: bash scripts/tarball-smoke.sh linux-x64
diff --git a/.github/workflows/unitTests.yml b/.github/workflows/unitTests.yml
index ca74c3f..036c309 100644
--- a/.github/workflows/unitTests.yml
+++ b/.github/workflows/unitTests.yml
@@ -10,6 +10,11 @@ permissions:
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # 24 is the Node bundled in the Homebrew tarballs; 22 is the oldest
+        # supported line, kept for npm installs on older machines.
+        node: ['22', '24']
     steps:
     - uses: actions/checkout@v3
       with:
@@ -18,7 +23,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v3
       with:
-        node-version: '18'  # Set to your Node.js version
+        node-version: ${{ matrix.node }}
         registry-url: 'https://npm.pkg.github.com'
         scope: '@mavric'
       
diff --git a/package.json b/package.json
index 937cd42..682ab41 100644
--- a/package.json
+++ b/package.json
@@ -108,7 +108,7 @@
     },
     "update": {
       "node": {
-        "version": "18.20.4",
+        "version": "24.22.1",
         "targets": [
           "darwin-x64",
           "darwin-arm64",
diff --git a/scripts/tarball-smoke.sh b/scripts/tarball-smoke.sh
new file mode 100755
index 0000000..97d74a3
--- /dev/null
+++ b/scripts/tarball-smoke.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Run the standalone tarball the way a Homebrew user gets it: the bundled Node
+# must be the pinned version, and the CLI must start, validate a schema and
+# run the PGlite migrate sandbox. Packs the tarball first unless one exists.
+#
+# Usage: scripts/tarball-smoke.sh [target]   (default: linux-x64)
+set -euo pipefail
+
+target="${1:-linux-x64}"
+cd "$(dirname "$0")/.."
+root="$PWD"
+want="v$(node -p "require('./package.json').oclif.update.node.version")"
+
+tarball="$(ls dist/apso-v*-"$target".tar.gz 2>/dev/null | head -1 || true)"
+if [ -z "$tarball" ]; then
+  npx oclif pack tarballs --targets "$target" --no-xz
+  tarball="$(ls dist/apso-v*-"$target".tar.gz | head -1)"
+fi
+
+work="$(mktemp -d)"
+tar -xzf "$tarball" -C "$work"
+apso="$work/apso/bin/apso"
+export APSO_TELEMETRY_DISABLED=1
+
+got="$("$work/apso/bin/node" --version)"
+if [ "$got" != "$want" ]; then
+  echo "bundled node is $got, want $want" >&2
+  exit 1
+fi
+"$apso" --version
+"$apso" --help >/dev/null
+
+proj="$(mktemp -d)"
+cp "$root/test/fixtures/inventory-multi-fk.apsorc" "$proj/.apsorc"
+cd "$proj"
+"$apso" schema validate >/dev/null
+"$apso" migrate
+
+echo "tarball smoke passed: $(basename "$tarball") on node $got"

From 53c60308e28717f8f28c54069d6c9f36ed035521 Mon Sep 17 00:00:00 2001
From: cultron <mscullerton@gmail.com>
Date: Tue, 27 Oct 2026 15:43:44 -0500
Subject: [PATCH 2/2] docs: install apso by its full Homebrew name for Homebrew
 6 tap trust

Homebrew 6 ignores untrusted third-party taps. brew install apsoai/tap/apso
trusts just that formula; the short name fails until the user runs
brew trust. Existing installs need brew trust --formula apsoai/tap/apso.
---
 README.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 0bb19f8..7762c2d 100644
--- a/README.md
+++ b/README.md
@@ -9,8 +9,9 @@ Apso generates production-ready backend services from a JSON schema file. You ge
 **Homebrew** (macOS / Linux)
 
 ```bash
-brew tap apsoai/tap
-brew install apso
+brew install apsoai/tap/apso
+# Installed before Homebrew 6? Trust the formula so upgrades work:
+# brew trust --formula apsoai/tap/apso
 ```
 
 **npm**