fix(audience): add @imtbl/audience to publish workflow version-seeding filter

[ImmutableJeffrey]

Summary

PR #2838 shipped the build fixes that make @imtbl/audience installable as a standalone npm package. However, the first publish run after merge (workflow run 24182647672) was unable to actually publish the fixed artifact because of a version collision:

Skipped package "@imtbl/audience" because v0.0.1-alpha.0 already exists in https://registry.npmjs.org/ with tag "alpha"

Evidence the npm copy is still the pre-2838 broken artifact

$ npm view @imtbl/audience@0.0.1-alpha.0 dependencies --json
{
  "@imtbl/audience-core": "0.0.1-alpha.0"
}

$ npm view @imtbl/audience@0.0.1-alpha.0 time.created
"2026-04-08T04:43:20.487Z"   # one day before PR #2838 merged

$ npm view @imtbl/audience-core versions
# E404 Not Found — @imtbl/audience-core is private and never published

$ cd /tmp/fresh && npm init -y && npm install @imtbl/audience@0.0.1-alpha.0
# E404 on @imtbl/audience-core@0.0.1-alpha.0

• Dependencies still reference @imtbl/audience-core — the prepack strip-deps script from PR build(audience): make @imtbl/audience publishable on npm #2838 never ran on this artifact.
• Timestamp: 2026-04-08 — one day before PR build(audience): make @imtbl/audience publishable on npm #2838 merged on 2026-04-09.
• Install fails with E404 in any fresh project because @imtbl/audience-core is "private": true.

Root cause

The Initialize current versions step in .github/workflows/publish.yaml seeds package versions from @imtbl/metrics for packages inside the @imtbl/sdk... and @imtbl/checkout-widgets... dependency trees. This is the canonical pattern — every SDK-family package.json has "version": "0.0.0" committed in source as a template; the Initialize step is the source of truth at publish time (confirmed: sdk/package.json, packages/checkout/widgets-lib/package.json, packages/internal/metrics/package.json, packages/blockchain-data/sdk/package.json all have "version": "0.0.0" on main).

@imtbl/audience isn't in either of the filtered dependency trees, so it never gets seeded. nx release version --specifier prerelease reads the committed template value 0.0.0 from disk and computes 0.0.1-alpha.0 — the slot that was burned on 2026-04-08 by an earlier publish attempt. The registry refuses to overwrite, and nx release skips. This would recur on every publish indefinitely until the gap is closed.

PR #2838's body explicitly flagged this as unverified:

nx release should bump it to match the rest (since projectsRelationship is fixed) — but this hasn't been independently verified.

Verified now: projectsRelationship: fixed does not reconcile different starting disk versions. It just means all projects bump under the same release cycle with the same specifier. Without an explicit filter entry in the Initialize step, audience's disk 0.0.0 is read as-is and bumps to 0.0.1-alpha.0.

The fix

One line, one file — add --filter @imtbl/audience... to the Initialize current versions step:

-        run: pnpm --filter @imtbl/sdk... --filter @imtbl/checkout-widgets... exec sh -c "..."
+        run: pnpm --filter @imtbl/sdk... --filter @imtbl/checkout-widgets... --filter @imtbl/audience... exec sh -c "..."

The ... transitive-deps suffix means this filter also includes @imtbl/audience-core (audience's workspace dep), so both packages get seeded to the metrics version on every publish run — in lockstep with the rest of the SDK family.

Audience source versions intentionally stay at 0.0.0 to match the established SDK-family convention. No package.json version bumps needed; the Initialize step is and remains the canonical version writer.

Expected publish behaviour post-merge

1. Initialize current versions: reads latest @imtbl/metrics version from npm array tail (currently e.g. 2.15.0-alpha.20) → writes it to all SDK-family package.json files including packages/audience/sdk/package.json and packages/audience/core/package.json.
2. Setup new package versions (nx release version --specifier prerelease): bumps every seeded package from the metrics version to the next prerelease (e.g. 2.15.0-alpha.21) — audience + audience-core in lockstep with @imtbl/sdk, @imtbl/checkout-widgets, @imtbl/blockchain-data, etc.
3. Pack: prepack strips @imtbl/audience-core from audience's dependencies, postpack restores, producing imtbl-audience-<new-version>.tgz with no workspace references.
4. Release to NPM: publishes @imtbl/audience at the new version slot — no collision, because this slot has not been burned.
5. Clean install: npm install @imtbl/audience@<new-version> in a fresh project resolves and installs cleanly, with both runtime JS and bundled dist/types/index.d.ts resolving correctly.

Why not also bump the disk version

An earlier revision of this PR (force-pushed away) set packages/audience/sdk/package.json and packages/audience/core/package.json to "version": "2.15.0-alpha.19" as a belt-and-suspenders defense. That was wrong:

• It broke the SDK-family convention. All SDK-family packages (sdk/package.json, packages/checkout/widgets-lib/package.json, packages/internal/metrics/package.json, packages/blockchain-data/sdk/package.json, etc.) have "version": "0.0.0" committed on main. I had pattern-matched on the transient values I saw in the workflow log, which are the Initialize step's overrides — never committed back per the nx release config's git.commit: false.
• It was stale by construction. 2.15.0-alpha.19 was the snapshot value during the 2026-04-09 publish run; by the time this PR merges, metrics will be at alpha.20 or beyond and the committed value becomes meaningless.
• It was redundant. With the Initialize filter fix, audience's disk version is overwritten at every publish run anyway. The source bump added noise without any functional benefit.

Leaving audience at 0.0.0 keeps the convention consistent: disk is a template, Initialize is the source of truth.

Test plan

• Confirmed via git show origin/main:<path> that all SDK-family package.json files on main have "version": "0.0.0".
• Diff is 1 file, 1 line — no other scope creep.
• Verified the pnpm --filter @imtbl/audience... glob expands to include @imtbl/audience-core via the transitive-deps suffix.
• Post-merge: trigger publish.yaml via workflow_dispatch with dry_run: true, release_type: prerelease; confirm the @imtbl/audience version in the Setup new package versions log output matches the other SDK-family packages' new version (e.g. all at 2.15.0-alpha.21), not the burned 0.0.1-alpha.0 slot.
• Post-merge real publish: verify npm view @imtbl/audience@latest dependencies returns {} (no @imtbl/audience-core) and time.created is post-merge.
• Clean install verification: cd /tmp/fresh && npm init -y && npm install @imtbl/audience@latest && node -e "console.log(require('@imtbl/audience'))" — no errors.

Unblocks

• SDK-66 (publish WebSDK on npm) — PR build(audience): make @imtbl/audience publishable on npm #2838 merged the build fixes; this PR unblocks the publish path itself.
• SDK-63 (integrate audience into Play) — Play's integration PR immutable/play#5151 is currently vendoring imtbl-audience-0.0.0.tgz locally because no installable npm version exists yet. Once this PR merges and a fresh version is published, Play can swap package.json to a version range and delete vendor/.

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 7fbed63

Command	Status	Duration	Result
nx affected -t build,lint,test	✅ Succeeded	<1s	View ↗
nx run-many -p @imtbl/sdk,@imtbl/checkout-widge...	✅ Succeeded	1s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-04-09 10:33:16 UTC

[github-actions]

✅ Pixel Bundle Size — @imtbl/pixel

Metric	Size	Delta vs main
Gzipped	4897 bytes (4.78 KB)	0 bytes
Raw (minified)	13268 bytes	0 bytes

Budget: 10.00 KB gzipped (warn at 8.00 KB)