fix: update dependencies

.github/actions/install-npm/action.yml

@@ -0,0 +1,14 @@
+name: Install NPM
+description: >
+  Installs the NPM version required by the `engines.npm` directive in
+  package.json, which is required for the project to build correctly.
+
+runs:
+  using: composite
+  steps:
+    - name: Install NPM
+      shell: bash
+      run: |
+        npmVersion="$(node -p 'require(`${process.env.GITHUB_WORKSPACE}/package.json`).engines.npm')"
+        echo "Installing npm@${npmVersion}"
+        npm install -g "npm@${npmVersion}"

.github/workflows/bootstrap.yaml

@@ -33,9 +33,12 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: "22.x"
+          node-version: ">=24.18.1 <25"
           cache: "npm"
 
+      - name: Install NPM version specified in package.json
+        uses: ./.github/actions/install-npm
+
       - name: Install dependencies
         run: npm ci --no-audit
 

.github/workflows/deploy.yaml

@@ -26,9 +26,12 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: "22.x"
+          node-version: ">=24.18.1 <25"
           cache: "npm"
 
+      - name: Install NPM version specified in package.json
+        uses: ./.github/actions/install-npm
+
       - name: Install dependencies
         run: npm ci --no-audit
 

.github/workflows/test-and-release.yaml

@@ -3,13 +3,13 @@ name: Test and Release
 permissions:
   contents: write
   issues: write
+  id-token: write
 
 on:
   push:
 
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
 jobs:
   test:
@@ -20,9 +20,12 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: "22.x"
+          node-version: ">=24.18.1 <25"
           cache: "npm"
 
+      - name: Install NPM version specified in package.json
+        uses: ./.github/actions/install-npm
+
       - name: Install dependencies
         run: npm ci --no-audit
 

.npm/compile.ts

@@ -0,0 +1,47 @@
+/*
+ * Compile source for NPM
+ */
+
+import swc from '@swc/core'
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { glob } from 'node:fs/promises'
+import path, { dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { updateImports } from './updateImports.ts'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+
+const outDir = path.join(__dirname, '..', 'dist')
+
+try {
+	rmSync(outDir, { recursive: true, force: true })
+} catch {
+	// pass
+}
+
+for await (const file of glob(`./cdk/*.ts`)) {
+	if (file.endsWith('.spec.ts')) continue
+	let compiled = (
+		await swc.transformFile(file, {
+			jsc: {
+				parser: {
+					syntax: 'typescript',
+				},
+				target: 'es2024',
+			},
+			module: {
+				type: 'es6',
+			},
+		})
+	).code
+
+	compiled = updateImports(compiled)
+
+	const targetFile = path.join(outDir, file.replace(/\.ts$/, '.js'))
+
+	mkdirSync(dirname(targetFile), { recursive: true })
+
+	writeFileSync(targetFile, compiled, 'utf8')
+
+	console.log(file)
+}

.npm/tsconfig.npm.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "emitDeclarationOnly": true,
+    "declaration": true,
+    "noEmit": false
+  },
+  "include": ["../cdk"]
+}

.npm/updateImports.spec.ts

@@ -0,0 +1,11 @@
+import assert from 'node:assert'
+import { describe, it } from 'node:test'
+import { updateImports } from './updateImports.ts'
+
+void describe('updateImports', () => {
+	void it('replaces .ts with .js in relative imports', () => {
+		const input = `import { foo } from './bar.ts';`
+		const expected = `import { foo } from './bar.js';`
+		assert.equal(updateImports(input), expected)
+	})
+})

.npm/updateImports.ts

@@ -0,0 +1,2 @@
+export const updateImports = (source: string): string =>
+	source.replace(/from ['"](.+?)\.ts['"]/g, "from '$1.js'")

LICENSE

@@ -1,6 +1,6 @@
 PBSD 3-Clause License
 
-Copyright (c) 2023-2025, Nordic Semiconductor ASA | nordicsemi.no
+Copyright (c) 2023-2026, Nordic Semiconductor ASA | nordicsemi.no
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

cdk.json

@@ -1,3 +1,3 @@
 {
-  "app": "npx tsx --no-warnings cdk/ci.ts"
+  "app": "node --experimental-transform-types --no-warnings cdk/ci.ts"
 }

cdk/CIApp.ts

@@ -1,5 +1,5 @@
 import { App } from 'aws-cdk-lib'
-import { CIStack } from './CIStack.js'
+import { CIStack } from './CIStack.ts'
 
 export class CIApp extends App {
 	public constructor(

cdk/CIStack.ts

@@ -1,7 +1,7 @@
 import type { App } from 'aws-cdk-lib'
 import { CfnOutput, Stack } from 'aws-cdk-lib'
-import { RepoPermission } from './RepoPermission.js'
-import type { Repos } from './listRepos.js'
+import { RepoPermission } from './RepoPermission.ts'
+import type { Repos } from './listRepos.ts'
 
 export class CIStack extends Stack {
 	public constructor(

cdk/RepoPermission.ts

@@ -1,7 +1,7 @@
 import { Duration, aws_iam as IAM, Stack } from 'aws-cdk-lib'
 import { Construct } from 'constructs'
-import type { Repository } from './listRepos.js'
-import { sanitize } from './sanitize.js'
+import type { Repository } from './listRepos.ts'
+import { sanitize } from './sanitize.ts'
 
 export class RepoPermission extends Construct {
 	public readonly role: IAM.IRole

cdk/ci.ts

@@ -1,9 +1,9 @@
 import { IAMClient } from '@aws-sdk/client-iam'
 import { fromEnv } from '@bifravst/from-env'
-import { CIApp } from './CIApp.js'
-import { ensureGitHubOIDCProvider } from './ensureGitHubOIDCProvider.js'
-import { listRepos } from './listRepos.js'
-import { loadRepoList } from './loadRepoList.js'
+import { CIApp } from './CIApp.ts'
+import { ensureGitHubOIDCProvider } from './ensureGitHubOIDCProvider.ts'
+import { listRepos } from './listRepos.ts'
+import { loadRepoList } from './loadRepoList.ts'
 
 const { token } = fromEnv({
 	token: 'GITHUB_TOKEN',

cdk/index.ts

@@ -1,3 +1,3 @@
-export * from './ContinuousDeployment.js'
-export * from './ensureGitHubOIDCProvider.js'
-export * from './RepoPermission.js'
+export * from './ContinuousDeployment.ts'
+export * from './ensureGitHubOIDCProvider.ts'
+export * from './RepoPermission.ts'

cdk/loadRepoList.spec.ts

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict'
 import path from 'node:path'
 import { describe, it } from 'node:test'
-import { loadRepoList } from './loadRepoList.js'
+import { loadRepoList } from './loadRepoList.ts'
 
 void describe('loadRepoList()', () => {
 	void it('should load the list of repos', async () => {

cdk/loadRepoList.ts

@@ -1,5 +1,5 @@
 import { readFile } from 'node:fs/promises'
-import type { Repository } from './listRepos.js'
+import type { Repository } from './listRepos.ts'
 
 export const loadRepoList = async (
 	location: string,