e2e(claude-code): enable Zstd via pkg config; bump pkg → ~6.19.0

pkg v6.19.0 (yao-pkg/pkg#263, closes #262) landed config support for
the CLI-only build flags, and ships the SEA-mode detector fix
(yao-pkg/pkg#268) that caused the prior OOM at bytecode-compile time.

- claude-code-smoke: add `compress: 'Zstd'` alongside `sea: true` in
  package.json#pkg; bump pkg-version input ~6.18.0 → ~6.19.0.
- Default `pkg-version` input bumped ~6.16.0 → ~6.19.0 — the whole
  config-as-source-of-truth direction of this branch requires it.
- Regenerated action.yml / packages/build/action.yml / docs/inputs.md.
- STATUS.yaml: upstream-dependency RESOLVED; Zstd gap dropped;
  e2e-status lists claude-code-smoke; ci-status bumped to 227 tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Author: robertsLando

.github/workflows/e2e.yml

@@ -253,22 +253,18 @@ jobs:
 
   # ──────────────────────────────────────────────────────────────────────
   # Real-world smoke: pull @anthropic-ai/claude-code from npm, build a
-  # native binary per runner OS/arch in SEA mode, tar.gz archive, execute
-  # the binary with --version, then verify the archive round-trips and
-  # the sha256 sidecar matches the archive bytes.
+  # native binary per runner OS/arch in SEA mode with Zstd-compressed
+  # bundled sources, tar.gz archive, execute the binary with --version,
+  # then verify the archive round-trips and the sha256 sidecar matches
+  # the archive bytes.
   #
   # claude-code is ESM, so SEA mode is required (standard pkg can't
-  # bytecode-compile ESM). SEA is expressed via `sea: true` in the pkg
-  # config (package.json#pkg). Each matrix entry builds for the runner's
-  # native target so the produced binary can be launched in-place,
-  # giving real cross-OS + cross-arch coverage (x64 and arm64 on Linux,
-  # arm64 on macOS, x64 on Windows).
-  #
-  # NOTE: Zstd bundled-binary compression (`--compress Zstd`) is a
-  # CLI-only flag on @yao-pkg/pkg today; there is no pkg-config key for
-  # it yet. Since this branch doesn't mirror CLI-only flags as action
-  # inputs, the job can't exercise Zstd until the upstream pkg issue
-  # lands config support. See docs/upstream-pkg-config-issue.md.
+  # bytecode-compile ESM). Both `sea: true` and `compress: 'Zstd'` are
+  # declared in the pkg config (package.json#pkg) — expressible in
+  # config starting @yao-pkg/pkg v6.19.0 (yao-pkg/pkg#263). Each matrix
+  # entry builds for the runner's native target so the produced binary
+  # can be launched in-place, giving real cross-OS + cross-arch
+  # coverage (x64 and arm64 on Linux, arm64 on macOS, x64 on Windows).
   claude-code-smoke:
     name: claude-code-smoke / ${{ matrix.os }} / ${{ matrix.target }}
     runs-on: ${{ matrix.os }}
@@ -338,13 +334,13 @@ jobs:
             const p = './package.json';
             const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
             pkg.bin = './' + process.argv[1];
-            // SEA mode is expressible in pkg config (sea: true). Other pkg
-            // build knobs (compress, fallbackToSource, …) are CLI-only
-            // today — this branch waits on upstream config support rather
-            // than mirror them as action inputs.
+            // Full pkg-layer config lives here — no CLI-mirror inputs.
+            // Requires @yao-pkg/pkg >= 6.19.0 for \`compress\` in config
+            // (yao-pkg/pkg#263).
             pkg.pkg = {
               assets: ['node_modules/@anthropic-ai/claude-code/**/*'],
               sea: true,
+              compress: 'Zstd',
             };
             fs.writeFileSync(p, JSON.stringify(pkg, null, 2));
           " "$entry"
@@ -361,10 +357,10 @@ jobs:
         with:
           config: ${{ steps.fix.outputs.fixture }}/package.json
           targets: ${{ matrix.target }}
-          # Pin a recent pkg — 6.18 line is what main's e2e was validated
-          # against. SEA (`sea: true`) is set in the package.json#pkg field,
-          # not as an action input.
-          pkg-version: ~6.18.0
+          # 6.19.0+ is required for the `compress` key in pkg config.
+          # SEA (`sea: true`) and Zstd (`compress: 'Zstd'`) live in the
+          # package.json#pkg field, not as action inputs.
+          pkg-version: ~6.19.0
           compress: tar.gz
           checksum: sha256
           filename: 'claude-{version}-{os}-{arch}'

STATUS.yaml

@@ -10,13 +10,14 @@
 meta:
   repo: yao-pkg/pkg-action
   branch: main
-  last-updated: '2026-04-23'
+  last-updated: '2026-04-24'
   action-status: ALPHA — ready for early adopters to try in their own workflows
-  ci-status: green (222 unit tests)
+  ci-status: green (227 unit tests)
   e2e-status: |
-    6 jobs after the scope cut — tiny-cjs (ubuntu/macos/windows), codegen-drift,
-    matrix plan→fanout, multi-target-linux, windows-metadata. Signing e2e still
-    deferred until live credentials are available.
+    7 jobs after the scope cut — tiny-cjs (ubuntu/macos/windows), codegen-drift,
+    matrix plan→fanout, multi-target-linux, windows-metadata, claude-code-smoke
+    (SEA + Zstd, 4 OS/arch combos). Signing e2e still deferred until live
+    credentials are available.
 
 # ─── Scope decision (2026-04-23) ─────────────────────────────────────────
 #
@@ -68,16 +69,16 @@ input-surface-slim:
     - extra-args
   migration: 'Move each value into .pkgrc / pkg.config.{js,ts,json} or the `pkg` field of package.json. `buildPkgArgs` forwards the config path to pkg.'
   breaking: 'yes — users setting any dropped input will see the unknown-input warning and the value will be ignored. Release note required.'
+  minimum-pkg-version: |
+    @yao-pkg/pkg >= 6.19.0 is required for the full build-flag surface in
+    pkg config. The default `pkg-version` input is pinned to `~6.19.0`.
   upstream-dependency: |
-    @yao-pkg/pkg currently accepts only a subset of build flags in its config
-    file (scripts, assets, ignore, targets, outputPath, patches, sea,
-    seaConfig, deployAssets). The rest (--compress, --fallback-to-source,
-    --public, --public-packages, --options, --no-bytecode, --no-dict,
-    --debug, --signature) are CLI-only. Until pkg lands config support for
-    those, users of this action lose access to them.
-    Tracking upstream: https://github.com/yao-pkg/pkg/issues/262.
-  known-gaps:
-    - 'Zstd bundled-binary compression — unreachable without the --compress CLI flag. The claude-code-smoke e2e job exercises SEA + tar.gz only until upstream lands pkg-config `compress` support.'
+    RESOLVED in @yao-pkg/pkg v6.19.0 (2026-04-24) via yao-pkg/pkg#263 —
+    closes yao-pkg/pkg#262. All CLI-only build flags now have config
+    equivalents: compress, fallbackToSource, public, publicPackages,
+    options, bytecode (inverts --no-bytecode), nativeBuild (inverts
+    --no-native-build), noDictionary (renamed from --no-dict), debug,
+    signature.
 
 # ─── Removed (2026-04-23) ────────────────────────────────────────────────
 # Distribution scope reset. Use dedicated downstream actions instead.

action.yml

@@ -18,8 +18,8 @@ inputs:
   targets:
     description: 'Comma- or newline-separated pkg target triples, e.g. node22-linux-x64,node22-macos-arm64. Defaults to the host target.'
   pkg-version:
-    description: 'npm version specifier for @yao-pkg/pkg (e.g. ~6.16.0). Bypassed when pkg-path is set.'
-    default: '~6.16.0'
+    description: 'npm version specifier for @yao-pkg/pkg (e.g. ~6.19.0). 6.19.0+ is required for the full build-flag surface in pkg config (compress, fallbackToSource, public, publicPackages, options, bytecode, nativeBuild, noDictionary, debug, signature). Bypassed when pkg-path is set.'
+    default: '~6.19.0'
   pkg-path:
     description: 'Absolute path to a pre-installed pkg binary. Skips the implicit npm i -g.'
   strip:

docs/inputs.md

@@ -12,7 +12,7 @@ Every `pkg-action` input, grouped by category.
 | `config-inline` | — | no | no | Pkg config as a JSON string. Written to a temp file and passed to pkg via --config. Mutually exclusive with config. Do not embed secrets — this input is not masked. |
 | `entry` | — | no | no | Entry script when not specified in the config. |
 | `targets` | — | no | no | Comma- or newline-separated pkg target triples, e.g. node22-linux-x64,node22-macos-arm64. Defaults to the host target. |
-| `pkg-version` | `~6.16.0` | no | no | npm version specifier for @yao-pkg/pkg (e.g. ~6.16.0). Bypassed when pkg-path is set. |
+| `pkg-version` | `~6.19.0` | no | no | npm version specifier for @yao-pkg/pkg (e.g. ~6.19.0). 6.19.0+ is required for the full build-flag surface in pkg config (compress, fallbackToSource, public, publicPackages, options, bytecode, nativeBuild, noDictionary, debug, signature). Bypassed when pkg-path is set. |
 | `pkg-path` | — | no | no | Absolute path to a pre-installed pkg binary. Skips the implicit npm i -g. |
 
 ## Post-build

packages/build/action.yml

@@ -15,8 +15,8 @@ inputs:
   targets:
     description: 'Comma- or newline-separated pkg target triples, e.g. node22-linux-x64,node22-macos-arm64. Defaults to the host target.'
   pkg-version:
-    description: 'npm version specifier for @yao-pkg/pkg (e.g. ~6.16.0). Bypassed when pkg-path is set.'
-    default: '~6.16.0'
+    description: 'npm version specifier for @yao-pkg/pkg (e.g. ~6.19.0). 6.19.0+ is required for the full build-flag surface in pkg config (compress, fallbackToSource, public, publicPackages, options, bytecode, nativeBuild, noDictionary, debug, signature). Bypassed when pkg-path is set.'
+    default: '~6.19.0'
   pkg-path:
     description: 'Absolute path to a pre-installed pkg binary. Skips the implicit npm i -g.'
   strip:

packages/core/src/inputs.ts

@@ -59,8 +59,8 @@ export const INPUT_SPECS: readonly InputSpec[] = [
     name: 'pkg-version',
     category: 'build',
     description:
-      'npm version specifier for @yao-pkg/pkg (e.g. ~6.16.0). Bypassed when pkg-path is set.',
-    default: '~6.16.0',
+      'npm version specifier for @yao-pkg/pkg (e.g. ~6.19.0). 6.19.0+ is required for the full build-flag surface in pkg config (compress, fallbackToSource, public, publicPackages, options, bytecode, nativeBuild, noDictionary, debug, signature). Bypassed when pkg-path is set.',
+    default: '~6.19.0',
   },
   {
     name: 'pkg-path',
@@ -494,7 +494,7 @@ export function parseInputs(opts: ParseInputsOptions = {}): ActionInputs {
     configInline,
     entry: readInput(env, 'entry'),
     targets,
-    pkgVersion: readInput(env, 'pkg-version') ?? '~6.16.0',
+    pkgVersion: readInput(env, 'pkg-version') ?? '~6.19.0',
     pkgPath: readInput(env, 'pkg-path'),
   };
 

packages/core/test/unit/inputs.test.ts

@@ -64,7 +64,7 @@ test('parseInputs with no env uses defaults', () => {
   strictEqual(inputs.build.config, undefined);
   strictEqual(inputs.build.configInline, undefined);
   strictEqual(inputs.build.entry, undefined);
-  strictEqual(inputs.build.pkgVersion, '~6.16.0');
+  strictEqual(inputs.build.pkgVersion, '~6.19.0');
   strictEqual(inputs.build.pkgPath, undefined);
 
   strictEqual(inputs.postBuild.compress, 'none');