rusteerio 0.1.0 → 1.0.0

package/Cargo.lock

@@ -686,7 +686,7 @@ dependencies = [
 
 [[package]]
 name = "rusteerio"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "ego-tree",
  "html5ever",

package/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rusteerio"
-version = "0.1.0"
+version = "1.0.0"
 edition = "2021"
 description = "Rust HTML5 parser and CSS selector engine for the rusteerio Node.js package"
 license = "MIT"

package/README.md

@@ -147,6 +147,13 @@ Fresh Rust-backed nodes have Rusteerio's constructors: an `instanceof` check
 against an independently installed `domhandler.Element` requires importing those
 nodes or supplying a tree adapter that creates that class.
 
+Each document reports its approximate native size to V8, so the garbage
+collector reclaims unreachable documents under native memory pressure. Node.js
+frees native memory after the current task completes. A long synchronous loop,
+or a chain of already-resolved `await`s, that loads many large documents should
+yield to the event loop periodically, for example with `await setImmediate()`
+from `node:timers/promises`.
+
 ## Benchmarks
 
 These measurements compare **Cheerio 1.2.0** against rusteerio on a Linux x64

package/RELEASING.md

@@ -5,44 +5,14 @@ team. Releases include all eight native binaries, self-contained TypeScript
 declarations, source files and license notices. Consumers install no additional
 npm packages and need no Rust toolchain on supported platforms.
 
-## First release setup
+## Trusted publishing
 
 The repository must be publicly visible for the publishing workflow's
-provenance checks. The package name was unpublished when this release setup was
-prepared; a registry lookup does not reserve ownership.
+provenance checks. The workflow publishes exclusively through npm trusted
+publishing with OIDC; it has no token-authentication or bootstrap path.
 
-For the first release, use the workflow's explicit bootstrap mode to establish
-ownership of `rusteerio@0.1.0`. It requires the package to be absent from the npm
-registry before any builds start. The default mode uses OIDC and remains token
-free.
-
-Create a granular npm token with **Read and write (publish and stage)** access,
-**Bypass two-factor authentication**, and a one-day expiration. Select only
-`rusteerio` if npm permits it; an unpublished package may require temporary
-**All Packages** access. Organization-management access is unnecessary. Store
-the value only in the GitHub `npm` environment's `NPM_BOOTSTRAP_TOKEN` secret. Never commit the
-token or put its value in commands or logs. See [npm's token
-documentation](https://docs.npmjs.com/creating-and-viewing-access-tokens/).
-
-Prepare and tag the exact release commit as described below, then dispatch:
-
-```sh
-gh workflow run publish.yml \
-  --repo context-dot-dev/rusteerio \
-  --ref main \
-  -f version=0.1.0 \
-  -f npm_tag=latest \
-  -f bootstrap=true
-```
-
-Bootstrap mode runs the same fresh eight-platform matrix, manifest/source
-checks and clean-consumer tests as OIDC mode. Only its final publish step
-receives the token. Both modes publish the exact tested tarball with GitHub
-Actions provenance. A locally built tarball may contain only one platform's
-binary and is not the release artifact.
-
-After the package exists, configure its GitHub Actions trusted publisher in npm
-package settings:
+Configure the GitHub Actions trusted publisher in the existing npm package's
+settings:
 
 | Field | Value |
 | --- | --- |
@@ -52,17 +22,23 @@ package settings:
 | Environment | `npm` |
 | Allowed action | Direct publishing with `npm publish` |
 
-After configuring the trusted publisher, revoke the bootstrap token in npm and
-delete `NPM_BOOTSTRAP_TOKEN` from the GitHub environment. Leave `bootstrap` false
-for subsequent releases; the registry-existence guard prevents its reuse.
-
 Configure the GitHub `npm` environment for maintainers and permit releases from
 `main`. The workflow uses GitHub-hosted runners, Node 24, npm 11.5.1 or newer,
-and OIDC authentication. A new trusted-publisher configuration must complete
-its first publish within two days. See [npm's trusted-publishing
+and OIDC authentication. It requires no stored npm token.
+
+A new trusted-publisher configuration must complete its first successful
+publication within two days. Prepare and publish a new version within that
+window; an existing npm version cannot be republished to validate the
+configuration. If it expires, delete and recreate it when the next release is
+ready. See [npm's trusted-publishing
 documentation](https://docs.npmjs.com/trusted-publishers/) for configuration and
 expiry details.
 
+After the first successful OIDC release, revoke the obsolete bootstrap token
+in npm and delete `NPM_BOOTSTRAP_TOKEN` from the GitHub `npm` environment. That
+credential was used only to establish initial package ownership and is not
+needed by this workflow.
+
 ## Prepare a version
 
 Update `package.json`, `package-lock.json`, `Cargo.toml` and `Cargo.lock` to the
@@ -75,15 +51,15 @@ Create a version tag on the current `main` commit:
 ```sh
 git switch main
 git pull --ff-only
-git tag v0.1.0
-git push origin v0.1.0
+git tag v0.1.1
+git push origin v0.1.1
 ```
 
-Replace `0.1.0` with the intended version. Dispatch publication before making
+Replace `0.1.1` with the intended version. Dispatch publication before making
 another commit to `main`: the tag, package version, Cargo version and the
 workflow's `main` commit must identify the same release.
 
-## Publish a subsequent release
+## Publish a release
 
 Run the **Publish to npm** workflow from `main`, with the exact package version
 and npm dist-tag:
@@ -92,7 +68,7 @@ and npm dist-tag:
 gh workflow run publish.yml \
   --repo context-dot-dev/rusteerio \
   --ref main \
-  -f version=0.1.0 \
+  -f version=0.1.1 \
   -f npm_tag=latest
 ```
 

package/THIRD_PARTY_NOTICES.md

@@ -4,7 +4,7 @@ This file preserves third-party license and attribution notices for the Rust nat
 
 Generated by `node scripts/generate-notices.mjs` from `cargo metadata --locked`, crate license files, and the pinned supplemental sources recorded in `scripts/notices/sources.json`. It includes build dependencies and dependencies for all target platforms; a particular binary may use a subset. Identical notice texts are reproduced once and referenced below. The html5ever, markup5ever and html5gum crates contain local observer-hook and opt-in UTF-16 transport patches; their complete patched source and original notices are included in `native/vendor`. Other dependency source files are unmodified.
 
-Cargo.lock SHA-256: `40e06a68078b531dc581ee78ebed58095cc69a2c632e02c05a31bbd5f347571a`.
+Cargo.lock SHA-256: `972c2efc036e05a48803d6631cfd4f6026989898043bbd9aaf68bb52449c1716`.
 
 ## Source availability
 

package/dist/{chunk-DKULX6VO.mjs → chunk-DMRD3FGC.mjs}

@@ -3182,4 +3182,4 @@ export {
   loadAll,
   extractAll
 };
-//# sourceMappingURL=chunk-DKULX6VO.mjs.map
+//# sourceMappingURL=chunk-DMRD3FGC.mjs.map