@stinkycomputing/cachearoo 1.0.25 → 1.0.26

package/.github/workflows/build_and_test.yml

@@ -9,7 +9,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [16.x]
+        node-version: [24.x]
     
     steps:
     - uses: actions/checkout@v3

package/.github/workflows/npm-publish.yml

@@ -1,5 +1,7 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
+# This workflow runs when a tag starting with "v" is pushed and publishes the
+# package to the npm registry using npm trusted publishing (OIDC) — no npm
+# token secret is required, GitHub authenticates to npm via the id-token.
+# For more information see: https://docs.npmjs.com/trusted-publishers
 
 name: Node.js Package
 
@@ -10,19 +12,22 @@ on:
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write   # allow the release step to create a GitHub release
+      id-token: write   # required for npm trusted publishing (OIDC) + provenance
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: 16
+          node-version: 24
           registry-url: https://registry.npmjs.org/
-      - name: Build, test and publish
+      - name: Build and publish
         run: |
+          # Trusted publishing requires npm >= 11.5.1
+          npm install -g npm@latest
           npm ci
           npm run build
           npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.STINKYDEV_NPM_TOKEN}}
       - name: Release
         uses: "marvinpinto/action-automatic-releases@latest"
         with:

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stinky Computing AB
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -398,3 +398,16 @@ consumer.onJobQuery = (job, callback) => {
   }
 };
 ```
+
+## Requirements
+
+This library relies on platform-native `fetch` and `WebSocket` and has no
+runtime dependencies. It requires **Node.js >= 22** (for the native global
+`WebSocket`) or a modern browser.
+
+## License
+
+MIT © Stinky Computing AB. See [LICENSE](LICENSE).
+
+This package has no third-party runtime dependencies; see
+[THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for details.

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,17 @@
+# Third-Party Notices
+
+This package has **no third-party runtime dependencies**. The published code
+under `dist/` is wholly owned by Stinky Computing AB and distributed under the
+MIT License (see `LICENSE`).
+
+Networking is provided entirely by platform-native APIs:
+
+- HTTP requests use the global `fetch` (available in browsers and Node.js >= 18).
+- The persistent connection uses the global `WebSocket` (available in browsers
+  and Node.js >= 22).
+
+Build- and test-time tooling (TypeScript, Vite, Vitest, type definitions, etc.)
+is listed under `devDependencies` in `package.json`. These tools are not
+included in the published package and impose no attribution requirements on
+distributed artifacts. Their respective licenses apply only within this
+repository's development environment.

package/dist/cachearoo-node.js

@@ -1,8 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AlreadyExistsError = exports.TimeoutError = exports.ReplyError = exports.RequestOptions = exports.CachearooSettings = exports.Cachearoo = exports.Replier = exports.Requestor = exports.Messaging = void 0;
-const fetch = require("node-fetch-commonjs");
-global.fetch = fetch;
 const cro_1 = require("./libs/cro");
 Object.defineProperty(exports, "Cachearoo", { enumerable: true, get: function () { return cro_1.Cachearoo; } });
 Object.defineProperty(exports, "CachearooSettings", { enumerable: true, get: function () { return cro_1.CachearooSettings; } });