From 1e11b3234bbccb21bc03ffdd0f0c3a9c9f869795 Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Wed, 24 Jun 2026 02:35:05 +0100
Subject: [PATCH 01/12] =?UTF-8?q?release:=20terra-react=201.9.6=20?=
 =?UTF-8?q?=E2=80=94=20link=20latest=20native=20SDKs=20(TerraiOS=201.7.9,?=
 =?UTF-8?q?=20terra-android=201.7.1)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 android/build.gradle | 2 +-
 package.json         | 2 +-
 terra-react.podspec  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/android/build.gradle b/android/build.gradle
index 714d216..4fdd833 100644
--- a/android/build.gradle
+++ b/android/build.gradle
@@ -56,7 +56,7 @@ repositories {
 dependencies {
     //noinspection GradleDynamicVersion
     implementation "com.facebook.react:react-native:+"  // From node_modules
-    implementation 'co.tryterra:terra-android:1.6.3'
+    implementation 'co.tryterra:terra-android:1.7.1'
     implementation 'org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.7.1'
     implementation 'com.google.code.gson:gson:2.9.1'
 }
diff --git a/package.json b/package.json
index de29237..70a4d24 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "terra-react",
-  "version": "1.9.5",
+  "version": "1.9.6",
   "description": "React Native SDK mapping for Terra API",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
diff --git a/terra-react.podspec b/terra-react.podspec
index cf95bb4..639b819 100644
--- a/terra-react.podspec
+++ b/terra-react.podspec
@@ -16,6 +16,6 @@ Pod::Spec.new do |s|
   s.source_files = "ios/**/*.{h,m,mm,swift}"
 
   s.frameworks = ['HealthKit']
-  s.dependency "TerraiOS", "1.7.8"
+  s.dependency "TerraiOS", "1.7.9"
   s.dependency "React-Core"
 end

From 19e673cb85e0514deff6e5c5bba38030822a7b2a Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Wed, 24 Jun 2026 13:10:14 +0100
Subject: [PATCH 02/12] ci: reliable npm publish on release (no self-bump, skip
 broken lint gate)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the self-bumping workflow (it npm-version-bumped on top of master,
required a CHANGELOG [Unreleased] section, and git-pushed to protected master —
its last run failed). New flow: bump version in a PR, merge, create a GitHub
Release tagged with the version -> publishes that version. Skips the failing
prepublishOnly lint via --ignore-scripts; build still runs via npm ci (prepare).
---
 .github/workflows/release_package.yml | 107 +++++---------------------
 1 file changed, 20 insertions(+), 87 deletions(-)

diff --git a/.github/workflows/release_package.yml b/.github/workflows/release_package.yml
index 8e01d07..03b50af 100644
--- a/.github/workflows/release_package.yml
+++ b/.github/workflows/release_package.yml
@@ -1,97 +1,30 @@
-# author: https://superface.ai/blog/npm-publish-gh-actions-changelog
-
 name: Release package
+
+# Publishes terra-react to npm at the version already in package.json. Bump the
+# version (and native SDK pins) in a PR first, merge, then create a GitHub
+# Release whose tag is the version (e.g. 1.9.7) — this workflow publishes it.
+#
+# This does NOT bump the version itself (the previous workflow did, which
+# double-bumped and pushed to protected master). It skips the package's
+# prepublishOnly lint gate via --ignore-scripts (lint has pre-existing errors);
+# the build still runs through `npm ci` (the `prepare` script).
 on:
+  release:
+    types: [published]
   workflow_dispatch:
-    inputs:
-      release-type:
-        description: 'Release type (one of): patch, minor, major, prepatch, preminor, premajor, prerelease'
-        required: true
+
 jobs:
-  release:
+  publish:
     runs-on: ubuntu-latest
     steps:
-      # Checkout project repository
-      - name: Checkout
-        uses: actions/checkout@v2.3.4
-
-      # Setup Node.js environment
-      - name: Setup Node.js
-        uses: actions/setup-node@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
+          node-version: '18'
           registry-url: https://registry.npmjs.org/
-          node-version: '14'
-
-      # Configure Git
-      - name: Git configuration
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "GitHub Actions"
-
-      # Bump package version
-      # Use tag latest
-      - name: Bump release version
-        if: startsWith(github.event.inputs.release-type, 'pre') != true
-        run: |
-          echo "NEW_VERSION=$(npm --no-git-tag-version version $RELEASE_TYPE)" >> $GITHUB_ENV
-          echo "RELEASE_TAG=latest" >> $GITHUB_ENV
-        env:
-          RELEASE_TYPE: ${{ github.event.inputs.release-type }}
-
-      # Bump package pre-release version
-      # Use tag beta for pre-release versions
-      - name: Bump pre-release version
-        if: startsWith(github.event.inputs.release-type, 'pre')
-        run: |
-          echo "NEW_VERSION=$(npm --no-git-tag-version --preid=beta version $RELEASE_TYPE
-          echo "RELEASE_TAG=beta" >> $GITHUB_ENV
-        env:
-          RELEASE_TYPE: ${{ github.event.inputs.release-type }}
-
-      # Update changelog unreleased section with new version
-      - name: Update changelog
-        uses: superfaceai/release-changelog-action@v1
-        with:
-          path-to-changelog: CHANGELOG.md
-          version: ${{ env.NEW_VERSION }}
-          operation: release
-
-      # Commit changes
-      - name: Commit CHANGELOG.md and package.json changes and create tag
-        run: |
-          git add "package.json"
-          git add "CHANGELOG.md"
-          git commit -m "chore: release ${{ env.NEW_VERSION }}"
-          git tag ${{ env.NEW_VERSION }}
-
-     # Push repository changes
-      - name: Push changes to repository
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git push origin && git push --tags
-
-      # Read version changelog
-      - id: get-changelog
-        name: Get version changelog
-        uses: superfaceai/release-changelog-action@v1
-        with:
-          path-to-changelog: CHANGELOG.md
-          version: ${{ env.NEW_VERSION }}
-          operation: read
-
-      # Update GitHub release with changelog
-      - name: Update GitHub release documentation
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: ${{ env.NEW_VERSION }}
-          body: ${{ steps.get-changelog.outputs.changelog }}
-          prerelease: ${{ startsWith(github.event.inputs.release-type, 'pre') }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      # Publish version to public repository
-      - name: Publish
-        run: npm publish --verbose --access public --tag ${{ env.RELEASE_TAG }}
+      - name: Install + build
+        run: npm ci
+      - name: Publish to npm
+        run: npm publish --ignore-scripts --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPMJS_ACCESS_TOKEN }}

From aeb901fde22cb714477ebf23b2376d69c39f0e43 Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Wed, 24 Jun 2026 13:20:47 +0100
Subject: [PATCH 03/12] ci: use npm trusted publishing (OIDC) instead of
 NPMJS_ACCESS_TOKEN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drops the stored npm token entirely — id-token: write + a Trusted Publisher
configured on npmjs.com lets npm publish via OIDC (short-lived, per-run, with
provenance). Requires npm >= 11.5.1, so bump npm in the runner.
---
 .github/workflows/release_package.yml | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release_package.yml b/.github/workflows/release_package.yml
index 03b50af..00a60ec 100644
--- a/.github/workflows/release_package.yml
+++ b/.github/workflows/release_package.yml
@@ -1,18 +1,22 @@
 name: Release package
 
-# Publishes terra-react to npm at the version already in package.json. Bump the
-# version (and native SDK pins) in a PR first, merge, then create a GitHub
-# Release whose tag is the version (e.g. 1.9.7) — this workflow publishes it.
+# Publishes terra-react to npm via npm "trusted publishing" (OIDC) — no stored
+# token. Bump the version (+ native SDK pins) in a PR, merge, then create a
+# GitHub Release tagged with the version to publish it.
 #
-# This does NOT bump the version itself (the previous workflow did, which
-# double-bumped and pushed to protected master). It skips the package's
-# prepublishOnly lint gate via --ignore-scripts (lint has pre-existing errors);
+# Requires a Trusted Publisher configured on npmjs.com for this package
+# (org tryterra, repo terra-react, workflow release_package.yml). Skips the
+# package's prepublishOnly lint gate via --ignore-scripts (pre-existing errors);
 # the build still runs through `npm ci` (the `prepare` script).
 on:
   release:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  id-token: write # mint the OIDC token npm exchanges for a short-lived publish credential
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -20,11 +24,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '18'
-          registry-url: https://registry.npmjs.org/
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org/'
+      - name: Ensure npm supports trusted publishing (>= 11.5.1)
+        run: npm install -g npm@latest
       - name: Install + build
         run: npm ci
-      - name: Publish to npm
+      - name: Publish to npm (OIDC trusted publishing, no token)
         run: npm publish --ignore-scripts --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_ACCESS_TOKEN }}

From 420695136467c69a8e529775dc992fb0d0344ff9 Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Fri, 26 Jun 2026 00:39:22 +0100
Subject: [PATCH 04/12] =?UTF-8?q?release:=20terra-react=201.9.7-beta.1=20?=
 =?UTF-8?q?=E2=80=94=20pin=20TerraiOS=201.7.10-beta.1=20(ZD=205587=20worko?=
 =?UTF-8?q?utActivities=20beta)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package-lock.json   | 4 ++--
 package.json        | 2 +-
 terra-react.podspec | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 2d8bcec..5cd06d6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "terra-react",
-  "version": "1.7.9",
+  "version": "1.9.6",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "terra-react",
-      "version": "1.7.9",
+      "version": "1.9.6",
       "license": "MIT",
       "devDependencies": {
         "@commitlint/config-conventional": "^11.0.0",
diff --git a/package.json b/package.json
index 70a4d24..7277082 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "terra-react",
-  "version": "1.9.6",
+  "version": "1.9.7-beta.1",
   "description": "React Native SDK mapping for Terra API",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
diff --git a/terra-react.podspec b/terra-react.podspec
index 639b819..d631ba7 100644
--- a/terra-react.podspec
+++ b/terra-react.podspec
@@ -16,6 +16,6 @@ Pod::Spec.new do |s|
   s.source_files = "ios/**/*.{h,m,mm,swift}"
 
   s.frameworks = ['HealthKit']
-  s.dependency "TerraiOS", "1.7.9"
+  s.dependency "TerraiOS", "1.7.10-beta.1"
   s.dependency "React-Core"
 end

From 2b5ce418093181fa506a82c68fa3f80a75704a60 Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Fri, 26 Jun 2026 00:50:55 +0100
Subject: [PATCH 05/12] ci: publish prereleases under the beta dist-tag (don't
 clobber latest)

---
 .github/workflows/release_package.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release_package.yml b/.github/workflows/release_package.yml
index 00a60ec..30402c6 100644
--- a/.github/workflows/release_package.yml
+++ b/.github/workflows/release_package.yml
@@ -31,4 +31,10 @@ jobs:
       - name: Install + build
         run: npm ci
       - name: Publish to npm (OIDC trusted publishing, no token)
-        run: npm publish --ignore-scripts --access public
+        # Prerelease versions (e.g. 1.9.7-beta.1) publish under the `beta` dist-tag
+        # so they never become the default `latest`; stable versions go to `latest`.
+        run: |
+          VER=$(node -p "require('./package.json').version")
+          if [[ "$VER" == *-* ]]; then TAG=beta; else TAG=latest; fi
+          echo "Publishing $VER under dist-tag: $TAG"
+          npm publish --ignore-scripts --access public --tag "$TAG"

From 489ff62207f05491895296d06c2dde58df1eaaaf Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Fri, 26 Jun 2026 00:55:10 +0100
Subject: [PATCH 06/12] ci: drop setup-node registry-url so OIDC trusted
 publishing engages (empty authToken was 404ing)

---
 .github/workflows/release_package.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release_package.yml b/.github/workflows/release_package.yml
index 30402c6..8abc82d 100644
--- a/.github/workflows/release_package.yml
+++ b/.github/workflows/release_package.yml
@@ -25,7 +25,10 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org/'
+      # NB: no registry-url here on purpose. setup-node's registry-url writes an
+      # .npmrc with `_authToken=${NODE_AUTH_TOKEN}`; with no token that empty
+      # value shadows OIDC and npm publish 404s. Omitting it lets npm's trusted
+      # publishing (OIDC) engage against the default registry.npmjs.org.
       - name: Ensure npm supports trusted publishing (>= 11.5.1)
         run: npm install -g npm@latest
       - name: Install + build

From b0e9240bfcb6c97a621e45206515729b543d429a Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Fri, 26 Jun 2026 00:57:42 +0100
Subject: [PATCH 07/12] ci: log npm version before publish (diagnose OIDC
 engagement)

---
 .github/workflows/release_package.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release_package.yml b/.github/workflows/release_package.yml
index 8abc82d..54bfee3 100644
--- a/.github/workflows/release_package.yml
+++ b/.github/workflows/release_package.yml
@@ -37,6 +37,7 @@ jobs:
         # Prerelease versions (e.g. 1.9.7-beta.1) publish under the `beta` dist-tag
         # so they never become the default `latest`; stable versions go to `latest`.
         run: |
+          echo "npm version: $(npm --version)"
           VER=$(node -p "require('./package.json').version")
           if [[ "$VER" == *-* ]]; then TAG=beta; else TAG=latest; fi
           echo "Publishing $VER under dist-tag: $TAG"

From ff20753a909507512b6f630724b0560aa1c37e39 Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Fri, 26 Jun 2026 01:05:23 +0100
Subject: [PATCH 08/12] ci: drop npm-version debug echo (diagnosis done)

---
 .github/workflows/release_package.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/release_package.yml b/.github/workflows/release_package.yml
index 54bfee3..8abc82d 100644
--- a/.github/workflows/release_package.yml
+++ b/.github/workflows/release_package.yml
@@ -37,7 +37,6 @@ jobs:
         # Prerelease versions (e.g. 1.9.7-beta.1) publish under the `beta` dist-tag
         # so they never become the default `latest`; stable versions go to `latest`.
         run: |
-          echo "npm version: $(npm --version)"
           VER=$(node -p "require('./package.json').version")
           if [[ "$VER" == *-* ]]; then TAG=beta; else TAG=latest; fi
           echo "Publishing $VER under dist-tag: $TAG"

From 4dcefd87c934a5d9e77fa5f0e2ae8574b8e9da97 Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Fri, 26 Jun 2026 15:56:16 +0100
Subject: [PATCH 09/12] =?UTF-8?q?release:=20terra-react=201.9.7-beta.2=20?=
 =?UTF-8?q?=E2=80=94=20pin=20TerraiOS=201.7.10-beta.2=20(marker-segment=20?=
 =?UTF-8?q?fix)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json        | 2 +-
 terra-react.podspec | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 7277082..89515c5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "terra-react",
-  "version": "1.9.7-beta.1",
+  "version": "1.9.7-beta.2",
   "description": "React Native SDK mapping for Terra API",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
diff --git a/terra-react.podspec b/terra-react.podspec
index d631ba7..bc3f4fd 100644
--- a/terra-react.podspec
+++ b/terra-react.podspec
@@ -16,6 +16,6 @@ Pod::Spec.new do |s|
   s.source_files = "ios/**/*.{h,m,mm,swift}"
 
   s.frameworks = ['HealthKit']
-  s.dependency "TerraiOS", "1.7.10-beta.1"
+  s.dependency "TerraiOS", "1.7.10-beta.2"
   s.dependency "React-Core"
 end

From 3fae09dc986d3642f655854e3956c55d0332fd20 Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Fri, 26 Jun 2026 19:03:29 +0100
Subject: [PATCH 10/12] =?UTF-8?q?release:=20terra-react=201.9.7-beta.3=20?=
 =?UTF-8?q?=E2=80=94=20pin=20TerraiOS=201.7.10-beta.3=20(per-segment=20spe?=
 =?UTF-8?q?ed=20+=20workoutEvents)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json        | 2 +-
 terra-react.podspec | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 89515c5..9aa3b98 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "terra-react",
-  "version": "1.9.7-beta.2",
+  "version": "1.9.7-beta.3",
   "description": "React Native SDK mapping for Terra API",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
diff --git a/terra-react.podspec b/terra-react.podspec
index bc3f4fd..53b275b 100644
--- a/terra-react.podspec
+++ b/terra-react.podspec
@@ -16,6 +16,6 @@ Pod::Spec.new do |s|
   s.source_files = "ios/**/*.{h,m,mm,swift}"
 
   s.frameworks = ['HealthKit']
-  s.dependency "TerraiOS", "1.7.10-beta.2"
+  s.dependency "TerraiOS", "1.7.10-beta.3"
   s.dependency "React-Core"
 end

From c315dcfa0884274e659a8bbcbeebdec28a72710d Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Mon, 29 Jun 2026 13:09:15 +0100
Subject: [PATCH 11/12] =?UTF-8?q?release:=20terra-react=201.9.7-beta.4=20?=
 =?UTF-8?q?=E2=80=94=20pin=20TerraiOS=201.7.10-beta.4=20(event=20metadata?=
 =?UTF-8?q?=20capture)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json        | 2 +-
 terra-react.podspec | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 9aa3b98..a6c0093 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "terra-react",
-  "version": "1.9.7-beta.3",
+  "version": "1.9.7-beta.4",
   "description": "React Native SDK mapping for Terra API",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
diff --git a/terra-react.podspec b/terra-react.podspec
index 53b275b..e24b91b 100644
--- a/terra-react.podspec
+++ b/terra-react.podspec
@@ -16,6 +16,6 @@ Pod::Spec.new do |s|
   s.source_files = "ios/**/*.{h,m,mm,swift}"
 
   s.frameworks = ['HealthKit']
-  s.dependency "TerraiOS", "1.7.10-beta.3"
+  s.dependency "TerraiOS", "1.7.10-beta.4"
   s.dependency "React-Core"
 end

From 59576e3d765d995c4316e08dcd0b890fcc0a9462 Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Tue, 30 Jun 2026 16:40:11 +0100
Subject: [PATCH 12/12] =?UTF-8?q?release:=20terra-react=201.9.7=20(stable)?=
 =?UTF-8?q?=20=E2=80=94=20pin=20TerraiOS=201.7.10=20[ZD=205587]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json        | 2 +-
 terra-react.podspec | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index a6c0093..2e9de49 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "terra-react",
-  "version": "1.9.7-beta.4",
+  "version": "1.9.7",
   "description": "React Native SDK mapping for Terra API",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
diff --git a/terra-react.podspec b/terra-react.podspec
index e24b91b..7f0bfa8 100644
--- a/terra-react.podspec
+++ b/terra-react.podspec
@@ -16,6 +16,6 @@ Pod::Spec.new do |s|
   s.source_files = "ios/**/*.{h,m,mm,swift}"
 
   s.frameworks = ['HealthKit']
-  s.dependency "TerraiOS", "1.7.10-beta.4"
+  s.dependency "TerraiOS", "1.7.10"
   s.dependency "React-Core"
 end