Installing the SDKs

The SDKs are not on a public registry. Each release is a set of npm tarballs attached to a release of the Talkline repository on GitHub, and your app keeps the ones it uses in its own repository. The operator of your deployment gives you read access to those releases.

What each release holds

Release tag	Tarballs	Who needs it
js-v<version>	talkline-core-<version>.tgz, talkline-react-<version>.tgz	A web app; react only in a React app
protocol-v<version>	talkline-protocol-<version>.tgz	Every web app: @talkline/core depends on it
server-sdk-v<version>	talkline-server-sdk-<version>.tgz	A backend in Node; it depends on nothing else of Talkline's

@talkline/core names the @talkline/protocol versions it works with in its package.json, as a range such as ^1.1.0. Take the newest protocol-v1.x release: a protocol tarball outside that range fails the install, rather than giving you a client that cannot speak to it.

A web app

1. Download the tarballs into a vendor/talkline/ folder of your app — from each release's page, or with GitHub's CLI, TALKLINE_REPO set to the repository the releases are on (owner/name):

gh release download js-v1.2.0 --repo "$TALKLINE_REPO" --pattern '*.tgz' --dir vendor/talkline
gh release download protocol-v1.1.0 --repo "$TALKLINE_REPO" --pattern '*.tgz' --dir vendor/talkline

2. Name each one in package.json, @talkline/protocol too, and make it the one @talkline/core gets. Core depends on the protocol by version range, and without the override npm asks a registry for that range before it settles on your copy:

{
  "dependencies": {
    "@talkline/protocol": "file:vendor/talkline/talkline-protocol-1.1.0.tgz",
    "@talkline/core": "file:vendor/talkline/talkline-core-1.2.0.tgz",
    "@talkline/react": "file:vendor/talkline/talkline-react-1.2.0.tgz"
  },
  "overrides": {
    "@talkline/protocol": "$@talkline/protocol"
  }
}

3. Give @talkline no registry, in the app's .npmrc:

@talkline:registry=https://talkline.invalid/

The .invalid name never resolves, so a Talkline package missing from vendor/ fails the install, after npm's retries, instead of being looked up on npm, where a package of the same name could belong to anyone.

4. Install, and commit vendor/talkline/, package.json, .npmrc and package-lock.json:

npm install

The lockfile records each tarball's hash, and npm ci refuses a tarball that does not match it.

A backend in Node

The same, with one tarball:

gh release download server-sdk-v1.2.0 --repo "$TALKLINE_REPO" --pattern '*.tgz' --dir vendor/talkline

{
  "dependencies": {
    "@talkline/server-sdk": "file:vendor/talkline/talkline-server-sdk-1.2.0.tgz"
  }
}

with the same line in .npmrc, then npm install and commit. The server SDK depends on no other Talkline package, so it needs no override.

Upgrading

Download the new release's tarballs into vendor/talkline/, change the file names in package.json, run npm install, and delete the old tarballs. Each release's notes list what changed in it, and Compatibility says what a minor or a patch release may change.