From c92210a6843cededcac4b1f4e1ee7e48534ff8f4 Mon Sep 17 00:00:00 2001
From: Alex-Wengg <hanweng9@gmail.com>
Date: Tue, 27 Oct 2026 18:22:48 -0400
Subject: [PATCH 1/2] ci(npm): publish through npm trusted publishing

Every npm-publish run failed at npm publish with E404, npm's answer to
an unauthenticated scoped publish: the NPM_TOKEN secret was never set.
npm has since revoked classic tokens and is restricting 2FA-bypass
granular tokens, so authenticate with trusted publishing instead: give
the job id-token: write and npm 11.5.1+ (Node 22 ships npm 10), and
drop the token.

Skip the publish when the version is already on npm, so a re-run, or a
release published by hand (the first one has to be: npm only accepts a
trusted publisher for a package that already exists), passes.
---
 .github/workflows/npm-publish.yml | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index ae4ebcc..7ad3c9b 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      # npm trusted publishing authenticates with the job's OIDC token.
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -18,10 +20,22 @@ jobs:
           node-version: 22
           registry-url: "https://registry.npmjs.org"
 
+      # Trusted publishing needs npm 11.5.1 or newer; Node 22 ships npm 10.
+      - run: npm install -g npm@latest
+
       - uses: jetli/wasm-pack-action@v0.4.0
 
       - run: rustup target add wasm32-unknown-unknown
       - run: npm run wasm:ci
-      - run: npm run wasm:publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      # Authenticates through npm trusted publishing, configured for this
+      # workflow on npmjs.com. A version already on npm is skipped, so a
+      # re-run, or a release published by hand, doesn't fail the job.
+      - name: Publish
+        run: |
+          name=$(node -p "require('./pkg-web/package.json').name")
+          version=$(node -p "require('./pkg-web/package.json').version")
+          if npm view "$name@$version" version >/dev/null 2>&1; then
+            echo "$name@$version is already on npm; nothing to publish."
+          else
+            npm run wasm:publish
+          fi

From d9d599b30057cbb4c20d973ebef2ac4d8e261a4b Mon Sep 17 00:00:00 2001
From: Alex-Wengg <hanweng9@gmail.com>
Date: Tue, 27 Oct 2026 18:22:48 -0400
Subject: [PATCH 2/2] chore: release 0.3.2

---
 Cargo.lock | 2 +-
 Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 9502b59..c2cd45f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -459,7 +459,7 @@ dependencies = [
 
 [[package]]
 name = "text-processing-rs"
-version = "0.3.0"
+version = "0.3.2"
 dependencies = [
  "console_error_panic_hook",
  "flate2",
diff --git a/Cargo.toml b/Cargo.toml
index 2a6825f..3302749 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "text-processing-rs"
-version = "0.3.0"
+version = "0.3.2"
 edition = "2021"
 license = "Apache-2.0"
 description = "Inverse Text Normalization (ITN) — convert spoken-form ASR output to written form"