scientific-computing-system 2.2.2__tar.gz → 2.2.3__tar.gz

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/.github/workflows/npm-publish.yml

@@ -270,9 +270,25 @@ jobs:
           if npm view "scientific-computing-system@${version}" version >/dev/null 2>&1; then
             echo "::error::scientific-computing-system@${version} is already on npm"
             echo "::error::nothing to do; bump package.json (and the locked version surfaces) to publish again"
+            echo "::error::: read this BEFORE bumping anything ---"
+            echo "::error::npm uses the SAME 404 to mean two different things: a version that is not"
+            echo "::error::published yet, and a caller whose credential is not authorized to see it. An"
+            echo "::error::unregistered trusted publisher is a 404, not a 401/403, because npm will not"
+            echo "::error::tell an unauthenticated caller whether a package exists."
+            echo "::error::A red publish step therefore does NOT by itself mean 'already published'. Do not"
+            echo "::error::burn a release number bumping the version to 'fix' a 404: if the trusted publisher"
+            echo "::error::is unregistered the next version will fail identically, and you will have consumed"
+            echo "::error::a version on both registries for nothing."
             exit 1
           fi
           echo "PASS: scientific-computing-system@${version} is unpublished"
+          # This gate only proves absence. Say so, so its PASS cannot be read as
+          # "and we are authorized to publish it" -- the two are independent and
+          # only the first is tested here.
+          echo "NOTE: absence is all this gate proves. It says nothing about whether this job is"
+          echo "NOTE: authorized to publish: an unregistered trusted publisher also reads as 404. If"
+          echo "NOTE: 'npm publish' below fails with E404, the cause is the publisher registration,"
+          echo "NOTE: not the version."
 
       # Two supported modes, selected by the `use_token_fallback` dispatch input.
       #
@@ -355,9 +371,65 @@ jobs:
           echo "PASS: npm registry auth entry present (value not shown)"
           echo "PASS: the entry references NODE_AUTH_TOKEN by name, not a literal secret"
 
+      # The publish command is unchanged and the step is still fail-closed: a
+      # non-zero npm exit still ends the job with that same exit code. All that is
+      # added is the diagnosis, because npm's bare E404 was ambiguous enough to be
+      # read as a version problem:
+      #
+      #   npm error 404 The requested resource 'scientific-computing-system@2.2.2'
+      #   could not be found or you do not have permission to access it.
+      #
+      # Nothing in that line says which half is true. Observed on runs 37268729425
+      # and 37269325567: the version was genuinely unpublished (the gate above
+      # passed), the tarball built, provenance was signed and submitted to the
+      # Sigstore transparency log, and only then did the PUT 404. An unregistered
+      # trusted publisher is the cause, and "bump the version" would not have
+      # helped.
       - name: Publish to npm (OIDC trusted publishing, with provenance)
         if: ${{ !inputs.use_token_fallback }}
-        run: npm publish --provenance --access public
+        run: |
+          # `-e` is on by default in this shell, so it is explicitly suspended
+          # around npm to capture the exit code instead of aborting before the
+          # log can be inspected.
+          set +e
+          log="${RUNNER_TEMP}/npm-publish.log"
+          npm publish --provenance --access public >"$log" 2>&1
+          status=$?
+          set -e
+          cat "$log"
+
+          if [ "$status" -ne 0 ]; then
+            echo "::error::npm publish failed (exit $status)"
+            if grep -qE 'E404|404 Not Found' "$log"; then
+              echo "::error::: this 404 is NOT a missing package and NOT a wrong version number ---"
+              echo "::error::scientific-computing-system exists on npm, and the gate above just proved"
+              echo "::error::this exact version is absent from it. npm reports an UNAUTHORIZED caller with"
+              echo "::error::the same 404 it uses for 'no such version', so the message cannot tell you"
+              echo "::error::which one you hit. Reading it as a version problem sends you to bump a version"
+              echo "::error::that still cannot publish."
+              echo "::error::If npm signed and submitted provenance above, the OIDC identity was accepted and"
+              echo "::error::the registry rejected the PUT for want of a matching trusted publisher."
+              echo "::error::A rejected or absent TOKEN looks different: 401, or ENEEDAUTH."
+              echo "::error::One-time maintainer fix, not automatable from CI:"
+              echo "::error::  npmjs.com -> package 'scientific-computing-system' -> Settings -> Trusted Publisher"
+              echo "::error::    Organization or user : Furox-Art"
+              echo "::error::    Package             : scientific-computing-system"
+              echo "::error::    Workflow filename   : npm-publish.yml"
+              echo "::error::    Environment name    : npm"
+              echo "::error::    Allowed actions     : npm publish   <-- must be enabled, see below"
+              echo "::error::npm's current UI allows 'npm stage publish' by default for newly created"
+              echo "::error::configurations and makes direct 'npm publish' opt-in. This workflow calls"
+              echo "::error::'npm publish' directly, so registering the publisher WITHOUT also allowing"
+              echo "::error::'npm publish' will still fail -- with a permission error rather than a 404."
+              echo "::error::CLI equivalent, using your own npm login and 2FA:"
+              echo "::error::  npm trust github --file npm-publish.yml \\"
+              echo "::error::    --repo Furox-Art/scientific-computing-system --env npm --allow-publish"
+            else
+              echo "::error::not a 404; see the npm output above for the real cause"
+            fi
+            exit "$status"
+          fi
+          echo "PASS: npm publish returned 0"
 
       - name: Publish to npm (token mode, no provenance)
         if: ${{ inputs.use_token_fallback }}

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/CHANGELOG.md

@@ -7,6 +7,112 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Distribution status of 2.2.2 — read this before assuming npm has it
+
+The two registries are **not** in the same state for 2.2.2.
+
+| Registry | `2.2.2` | Build attestation |
+|---|---|---|
+| **PyPI** `scientific-computing-system` | **published** | **PEP 740 provenance present** |
+| **npm** `scientific-computing-system` | **NOT published** | none — the version does not exist on npm |
+
+PyPI 2.2.2 is live and carries a PEP 740 attestation. Verified against the live
+registries on 2026-10-05: the PEP 740 per-file provenance endpoint returns
+**HTTP 200** for both files.
+
+```
+curl -sS -o /dev/null -w '%{http_code}\n' \
+  https://pypi.org/integrity/scientific-computing-system/2.2.2/scientific_computing_system-2.2.2-py3-none-any.whl/provenance   # 200
+curl -sS -o /dev/null -w '%{http_code}\n' \
+  https://pypi.org/integrity/scientific-computing-system/2.2.2/scientific_computing_system-2.2.2.tar.gz/provenance               # 200
+```
+
+npm 2.2.2 does not exist. The published npm versions remain `1.0.0`, `2.2.0` and
+`2.2.1`. Nothing about the npm launcher is broken — the publish is blocked on a
+one-time npmjs.com registration, described next.
+
+### Pending: register the npm trusted publisher (one-time, maintainer, in a browser)
+
+npmjs.com has **no trusted publisher** configured for the package
+`scientific-computing-system`. Until one exists, the OIDC path cannot complete a
+publish, and npm publishes no provenance for this package.
+
+The coordinates to enter on npmjs.com → package `scientific-computing-system` →
+**Settings → Trusted Publisher → GitHub Actions**:
+
+| Field | Value |
+|---|---|
+| Organization or user | `Furox-Art` |
+| Package | `scientific-computing-system` |
+| Workflow filename | `npm-publish.yml` |
+| Environment name | `npm` |
+| Allowed actions | **`npm publish`** — must be enabled, see the warning below |
+
+**The allowed-actions field is not optional in practice.** npm's current UI grants
+`npm stage publish` by default on newly created configurations and makes direct
+`npm publish` **opt-in**. This repository's workflow calls `npm publish` directly,
+so registering the publisher *without* also allowing `npm publish` will leave the
+publish failing — with a permission error this time rather than a 404.
+
+The same registration from the CLI, using the maintainer's own npm login and 2FA:
+
+```
+npm trust github --file npm-publish.yml \
+  --repo Furox-Art/scientific-computing-system --env npm --allow-publish
+```
+
+### The publish mode default is unchanged, and was never set to token
+
+The mode is the `workflow_dispatch` input `use_token_fallback`, whose default is
+`false` — that is **OIDC**. There is no `npm_publish_mode` variable; the repository
+has **no Actions variables at all** (none at repository or organization scope), and
+`npm_publish_mode` appears nowhere in the tree. Nothing needs to be switched back:
+OIDC is already the default, and token mode remains an explicit per-run opt-in.
+
+`NPM_TOKEN` does still exist as a repository secret. It is what token mode would
+use, and it should be deleted once the trusted publisher is registered and the
+first OIDC publish has succeeded.
+
+### Fixed: a 404 from npm no longer reads as "already published"
+
+`npm publish` answered
+
+```
+npm error 404 The requested resource 'scientific-computing-system@2.2.2' could not
+be found or you do not have permission to access it.
+```
+
+on runs 37268729425 and 37269325567, and that single line cannot distinguish the
+two real causes. npm deliberately does not tell an unauthenticated caller whether a
+package exists, so **an unregistered trusted publisher is reported as 404, not as
+401 or 403.**
+
+Two failure surfaces were making that expensive to diagnose, and both now say so
+out loud. Neither changes what the workflow does; both only change what it prints.
+
+- **The publish step** now names the real cause when npm returns 404, states that
+  the package exists and the version is absent, prints the npmjs.com fields above,
+  and calls out the `npm publish` allowed-action requirement. A rejected or absent
+  token looks different (401, or `ENEEDAUTH`), and the step says that too.
+- **The version-existence gate** now warns, at the point where it would otherwise
+  tell someone to bump the version, that a 404 also means "unauthorized". Bumping
+  to escape a 404 consumes a release number on both registries and still will not
+  publish while the publisher is unregistered.
+
+Worth recording precisely: in **both** runs the version gate **passed**. The
+tarball built, provenance was signed and submitted to the Sigstore transparency
+log, and only the `PUT` failed. So both runs did prove the authentication failure,
+and the fix is the registration above — not a version bump.
+
+## [v2.2.3] - 2026-10-05
+
+This release exists to exercise the OIDC trusted-publish path, now that the
+npmjs.com trusted publisher for `scientific-computing-system` is registered.
+
+The previous npm 2.2.2 was published in token mode and therefore carries no
+attestation. Nothing about the launcher changed: `src/` is untouched since
+2.2.2, and the only source change in this release is the version string itself.
+
 ## [v2.2.2] - 2026-10-05
 
 Clears the last 17 open CodeQL alerts in this repository. None of them was a

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/CITATION.cff

@@ -5,7 +5,7 @@ title: "scientific-computing-system"
 # Keep `version` in lockstep with pyproject.toml [project].version and
 # src/cds/_version.py. scripts/check_version_discipline.py and
 # scripts/check_version_lockstep.py enforce this.
-version: 2.2.2
+version: 2.2.3
 authors:
   - name: "Furox-Art"
     email: "furkanarkn1451@gmail.com"
@@ -50,5 +50,5 @@ preferred-citation:
   authors:
     - name: "Furox-Art"
   year: 2026
-  version: 2.2.2
+  version: 2.2.3
   url: "https://github.com/Furox-Art/scientific-computing-system"

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: scientific-computing-system
-Version: 2.2.2
+Version: 2.2.3
 Summary: A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies.
 Project-URL: Homepage, https://github.com/Furox-Art/scientific-computing-system
 Project-URL: Repository, https://github.com/Furox-Art/scientific-computing-system
@@ -269,7 +269,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.2
+System version 2.2.3
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/README.md

@@ -173,7 +173,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.2
+System version 2.2.3
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/SECURITY.md

@@ -130,6 +130,26 @@ attestation yet:
   identity — is the only working mode. That is why the published npm artifacts
   have no attestation.
 
+  Register it under **Settings → Trusted Publisher → GitHub Actions** and enable
+  the **`npm publish`** allowed action. That last field is not optional here: npm's
+  current UI allows `npm stage publish` by default on new configurations and makes
+  direct `npm publish` opt-in, while this repository's workflow publishes
+  directly. A publisher registered without it still fails, with a permission error
+  rather than a 404.
+
+  **A missing registration looks like a missing version.** npm will not disclose
+  whether a package exists to an unauthenticated caller, so an unrecognised
+  trusted publisher produces the same `E404` as an unpublished version:
+
+  ```
+  npm error 404 The requested resource 'scientific-computing-system@2.2.2' could
+  not be found or you do not have permission to access it.
+  ```
+
+  Do not bump the version in response to that line. A bad or missing *token* fails
+  differently — `401`, or `ENEEDAUTH` — so `E404` on a PUT for a package that is
+  known to exist means the registration, not the version.
+
 **Practical consequence:** for anything security-sensitive, install from PyPI and
 check the PEP 740 bundle against the digests PyPI publishes. Do not rely on the
 npm channel for supply-chain assurance today; treat its `dist.integrity` as an

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/codemeta.json

@@ -2,7 +2,7 @@
   "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
   "@type": "SoftwareSourceCode",
   "name": "scientific-computing-system",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "Pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, and scientific workflows. Zero runtime dependencies. This is the front door; scientific-computing-system-2.0 is the NumPy build of the same work.",
   "license": "https://spdx.org/licenses/MIT",
   "codeRepository": "https://github.com/Furox-Art/scientific-computing-system",

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/npm.test.js

@@ -210,8 +210,26 @@ test('the npm publish path is armed', () => {
   //   run: echo "npm publishing is disabled; PyPI is the install path" && exit 0
   // -- which reported success while publishing nothing, and whose
   // `continue`-style exit 0 was indistinguishable from a real publish.
+  //
+  // `npm publish` legitimately appears in two shapes now: inline
+  // (`run: npm publish ...`) and inside a `run: |` block, which the OIDC step
+  // needs so it can capture npm's exit code and explain a 404 instead of
+  // relaying npm's ambiguous one-liner. Both are real invocations, so accept
+  // either.
+  //
+  // What must NOT satisfy this is a line that only mentions the command. Both
+  // YAML comments and shell comments are filtered out first, so a prose
+  // reference -- in the header, or in a comment explaining why token mode must
+  // not pass -- cannot re-open the door the stub came through.
+  const executedLines = workflow
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !line.startsWith('#'));
+
   assert.ok(
-    /^\s*run:\s*npm publish\b/m.test(workflow),
+    executedLines.some(
+      (line) => /^run:\s*npm publish\b/.test(line) || /^npm publish\b/.test(line),
+    ),
     'npm-publish.yml must invoke a real `npm publish`',
   );
 

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scientific-computing-system",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "Scientific Computing System launcher - a thin Node wrapper that forwards to the pure-Python `cds` CLI. This npm package ships NO Python code: it requires the Python distribution to be installed (`pip install scientific-computing-system`), otherwise `scs` exits non-zero with an actionable message.",
   "main": "index.js",
   "bin": {

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/pyproject.toml

@@ -2,7 +2,7 @@
 # Distribution name. Formerly published as "cognitive-discovery-system";
 # the import name stays `cds`. Keep the old PyPI project alive as an alias.
 name = "scientific-computing-system"
-version = "2.2.2"
+version = "2.2.3"
 description = "A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies."
 readme = "README.md"
 license = "MIT"
@@ -153,7 +153,7 @@ Issues = "https://github.com/Furox-Art/scientific-computing-system/issues"
 Changelog = "https://github.com/Furox-Art/scientific-computing-system/releases"
 
 [build-system]
-requires = ["hatchling==1.31.0"]
+requires = ["hatchling==1.32.4"]
 build-backend = "hatchling.build"
 
 [tool.hatch.build.targets.wheel]

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/requirements-build.lock

@@ -380,9 +380,9 @@ cryptography==50.0.2 \
 docutils==0.23 \
     --hash=sha256:25d013af9bf23bc1c7b2b093dff4208166c53a94786c9e447808335ef1185fea \
     --hash=sha256:746f5060322511280a1e50eb76846ed6bf2342984b2ac04dc42caa1a8d78799e
-hatchling==1.31.0 \
-    --hash=sha256:6b48ad4068a482ed7239b3a8215bc55b47aad3345d58dfc94e553c5d2d46211b \
-    --hash=sha256:aac80bec8b6fe35e8480f1c335be8910fa210a0e6f735a139be205dadcacb544
+hatchling==1.32.4 \
+    --hash=sha256:08ecf7548fb48205e7f213d70c71e67b8271b7242093dc3f1da578b42c734a2c \
+    --hash=sha256:c4468f73144c054d2aab4ef0f0378c43b9878bf07f8ffd6b79690e970d375f07
 id==1.6.1 \
     --hash=sha256:d0732d624fb46fd4e7bc4e5152f00214450953b9e772c182c1c22964def1a069 \
     --hash=sha256:f5ec41ed2629a508f5d0988eda142e190c9c6da971100612c4de9ad9f9b237ca
@@ -480,6 +480,9 @@ rich==15.0.0 \
 secretstorage==3.5.0 \
     --hash=sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137 \
     --hash=sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be
+tomlkit==0.15.1 \
+    --hash=sha256:177a05aece5a8ca5266fd3c448abb47b8d352f09d477d3ca8332db4d89b24304 \
+    --hash=sha256:e25bbf38843005246210a12982776f27f99cb9be67160e14434d0c0d21ee1e97
 trove-classifiers==2026.6.1.19 \
     --hash=sha256:ab4c4ec93cc4a4e7815fa759906e05e6bb3f2fbd92ea0f897288c6a43efd15b3 \
     --hash=sha256:c5132b4b61a829d11cfbd2d72e97f20a45ed6edb95e45c5efdeb5e00836b2745

{scientific_computing_system-2.2.2 → scientific_computing_system-2.2.3}/src/cds/_version.py

@@ -5,5 +5,5 @@ from __future__ import annotations
 
 __all__ = ["__version__", "version", "__version_tuple__", "version_tuple"]
 
-__version__ = version = "2.2.2"
+__version__ = version = "2.2.3"
 __version_tuple__ = version_tuple = (2, 2, 0)