Summary
@zvndev/powdb-client on npm is stuck at 0.3.3. Local clients/ts/package.json shows 0.3.4 (never published). The TS client's versioning has not tracked the server crates through 0.4.0 or 0.4.1.
Root cause
.github/workflows/publish.yml has no npm publish step — it only publishes Rust crates to crates.io. The earlier 0.3.x npm publishes must have been done manually or via a now-removed workflow.
Needs decision (before fixing)
- Should
@zvndev/powdb-client versioning track the server crates (e.g. publish a 0.4.x to match the wire protocol version), or be independent? If independent, document the policy.
- If tracking: bump
clients/ts/package.json from 0.3.4 → 0.4.x and add an npm publish step to publish.yml.
- If independent: bump to 0.3.4 (already at that version locally), add npm publish step, document the policy in
clients/ts/README.md.
Recommended fix
- Add a
publish-npm job to publish.yml that runs after the crates.io publish succeeds, gated by a checkbox input so accidental triggers don't republish.
- Use
actions/setup-node@v4 + npm publish --provenance --access public with NPM_TOKEN secret.
- Either tie the version to the workflow input (single source of truth) or read it from
package.json.
Discovered by
Post-release audit of v0.4.1.
Summary
@zvndev/powdb-clienton npm is stuck at 0.3.3. Localclients/ts/package.jsonshows 0.3.4 (never published). The TS client's versioning has not tracked the server crates through 0.4.0 or 0.4.1.Root cause
.github/workflows/publish.ymlhas no npm publish step — it only publishes Rust crates to crates.io. The earlier 0.3.x npm publishes must have been done manually or via a now-removed workflow.Needs decision (before fixing)
@zvndev/powdb-clientversioning track the server crates (e.g. publish a 0.4.x to match the wire protocol version), or be independent? If independent, document the policy.clients/ts/package.jsonfrom 0.3.4 → 0.4.x and add an npm publish step topublish.yml.clients/ts/README.md.Recommended fix
publish-npmjob topublish.ymlthat runs after the crates.io publish succeeds, gated by a checkbox input so accidental triggers don't republish.actions/setup-node@v4+npm publish --provenance --access publicwithNPM_TOKENsecret.package.json.Discovered by
Post-release audit of v0.4.1.