sqlrite 0.1.5__tar.gz → 0.1.6__tar.gz

{sqlrite-0.1.5 → sqlrite-0.1.6}/.github/workflows/release.yml

@@ -778,10 +778,32 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # NOTE: deliberately NO `registry-url:` here. setting that
+      # makes setup-node generate an `.npmrc` with
+      # `_authToken=${NODE_AUTH_TOKEN}`, which forces npm into
+      # token-based auth and *bypasses* the trusted-publisher
+      # OIDC pathway entirely. The v0.1.5 canary blew up on this
+      # exact issue: `404 Not Found - PUT ... is not in this
+      # registry` because npm sent an empty/missing
+      # NODE_AUTH_TOKEN instead of minting an OIDC token.
+      #
+      # With registry-url omitted, no `.npmrc` is generated, and
+      # npm CLI ≥ 11.5 auto-detects the GitHub Actions OIDC
+      # environment (via ACTIONS_ID_TOKEN_REQUEST_URL +
+      # permissions: id-token: write below), mints an OIDC token,
+      # and exchanges it at npm for a one-time publish token. The
+      # public default registry is fine — that's where
+      # registry.npmjs.org lives anyway.
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
+
+      # Node 20 LTS ships with npm 10.x, but trusted publishing
+      # auto-detection landed in npm 11.5. Force-upgrade so we
+      # don't depend on the runner image happening to ship a
+      # recent-enough npm.
+      - name: Upgrade npm to latest (need 11.5+ for trusted publishing)
+        run: npm install -g npm@latest
 
       # Pull every platform's `.node` binary plus the JS
       # dispatcher into sdk/nodejs/, overlaying them on top of
@@ -804,24 +826,27 @@ jobs:
         run: |
           ls -la
           echo "---"
+          npm --version
+          echo "---"
           # Dry-run the pack to see exactly what ends up in the
           # published tarball. A missing .node file or a stray
           # devDep pulled in by accident would be visible here.
           npm pack --dry-run
 
-      # Single atomic publish. `--provenance` signs the package
-      # with a sigstore-backed attestation linking it to this
-      # workflow run. `--access public` is REQUIRED because
-      # `@joaoh82/sqlrite` is a scoped package and scoped
-      # packages default to private; without the flag, npm
-      # would reject the upload for a free-tier account that
-      # can't host private packages.
+      # Single atomic publish via OIDC trusted publisher. No
+      # `--provenance` flag and no env block — npm 11.5+ adds
+      # provenance automatically when the publish runs over OIDC,
+      # and an explicit `--provenance` flag combined with no
+      # auth token would actually error out under the older
+      # token-auth pathway.
+      #
+      # `--access public` is REQUIRED because `@joaoh82/sqlrite`
+      # is a scoped package and scoped packages default to
+      # private; without the flag, npm rejects the upload for a
+      # free-tier account that can't host private packages.
       - name: Publish to npm
         working-directory: sdk/nodejs
-        run: npm publish --provenance --access public
-        env:
-          # OIDC trusted publisher — no static token.
-          NPM_CONFIG_PROVENANCE: "true"
+        run: npm publish --access public
 
       - name: GitHub Release
         uses: softprops/action-gh-release@v2

{sqlrite-0.1.5 → sqlrite-0.1.6}/Cargo.lock

@@ -3736,7 +3736,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-desktop"
-version = "0.1.5"
+version = "0.1.6"
 dependencies = [
  "serde",
  "serde_json",
@@ -3748,7 +3748,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-engine"
-version = "0.1.5"
+version = "0.1.6"
 dependencies = [
  "clap",
  "env_logger",
@@ -3763,7 +3763,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-ffi"
-version = "0.1.5"
+version = "0.1.6"
 dependencies = [
  "cbindgen",
  "sqlrite-engine",
@@ -3771,7 +3771,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-nodejs"
-version = "0.1.5"
+version = "0.1.6"
 dependencies = [
  "napi",
  "napi-build",
@@ -3781,7 +3781,7 @@ dependencies = [
 
 [[package]]
 name = "sqlrite-python"
-version = "0.1.5"
+version = "0.1.6"
 dependencies = [
  "pyo3",
  "sqlrite-engine",

{sqlrite-0.1.5 → sqlrite-0.1.6}/Cargo.toml

@@ -27,7 +27,7 @@ resolver = "3"
 # `package =` key so the import name stays `sqlrite` internally:
 #     sqlrite = { package = "sqlrite-engine", path = "…" }
 name = "sqlrite-engine"
-version = "0.1.5"
+version = "0.1.6"
 authors = ["Joao Henrique Machado Silva <joaoh82@gmail.com>"]
 edition = "2024"
 rust-version = "1.85"

{sqlrite-0.1.5 → sqlrite-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sqlrite
-Version: 0.1.5
+Version: 0.1.6
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{sqlrite-0.1.5 → sqlrite-0.1.6}/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sqlrite-desktop-frontend",
   "private": true,
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "scripts": {
     "dev": "vite",

{sqlrite-0.1.5 → sqlrite-0.1.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "sqlrite"
-version = "0.1.5"
+version = "0.1.6"
 description = "Python bindings for SQLRite — a small, embeddable SQLite clone written in Rust."
 authors = [{ name = "Joao Henrique Machado Silva", email = "joaoh82@gmail.com" }]
 license = { text = "MIT" }

{sqlrite-0.1.5 → sqlrite-0.1.6}/sdk/python/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sqlrite-python"
-version = "0.1.5"
+version = "0.1.6"
 authors = ["Joao Henrique Machado Silva <joaoh82@gmail.com>"]
 edition = "2024"
 rust-version = "1.85"