chore(ci): inject npm versions at publish time + add hyperdb-api-node to CI

.github/workflows/ci.yml

@@ -151,6 +151,52 @@ jobs:
       - name: hyperdb-bootstrap tests
         run: cargo test -p hyperdb-bootstrap
 
+  node-bindings:
+    # Build the napi-rs Node.js bindings and run the smoke test on every
+    # PR. Without this, regressions in hyperdb-api-node (TS surface, napi
+    # glue, build script) only surface during npm-build-publish at release
+    # time and block the publish mid-flight. Linux-only is sufficient —
+    # cross-platform napi compatibility is exercised by the per-platform
+    # build matrix in npm-build-publish.yml when a release ships.
+    name: hyperdb-api-node (build + smoke)
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install system libraries
+        run: sudo apt-get update -q && sudo apt-get install -y libfontconfig1-dev mold protobuf-compiler
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          # Reuse the test job's Linux cache so the Cargo deps are warm
+          # when both jobs run on the same SHA.
+          cache-key: test-ubuntu-latest
+          # See fmt job for rationale.
+          rustflags: ""
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+      - name: Cache hyperd binary
+        id: hyperd-cache
+        uses: actions/cache@v5
+        with:
+          path: .hyperd
+          key: hyperd-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('hyperdb-bootstrap/hyperd-version.toml') }}
+      - name: Download hyperd
+        if: steps.hyperd-cache.outputs.cache-hit != 'true'
+        run: cargo run --release -p hyperdb-bootstrap --bin hyperdb-bootstrap -- download
+      - name: Build native addon (debug)
+        run: |
+          cd hyperdb-api-node
+          npm install --ignore-scripts
+          npm run build:debug
+      - name: Smoke test
+        env:
+          HYPERD_PATH: ${{ github.workspace }}/.hyperd/current
+        run: |
+          cd hyperdb-api-node
+          npm test
+
   publish-dry-run:
     # Catches Cargo.toml metadata regressions (missing license, bad
     # include paths, etc.) on the subset of crates that have no
@@ -228,3 +274,41 @@ jobs:
             echo "::error::version.txt ($TXT_VERSION) does not match Cargo.toml workspace version ($CARGO_VERSION)"
             exit 1
           fi
+
+      - name: Check npm package.json files have no in-source version
+        # The platform and umbrella npm package.json files have their
+        # `version` field stripped from source — npm-build-publish.yml
+        # injects it at publish time from the git tag. This guard
+        # catches anyone (or any tool) re-introducing a `version` field
+        # and reviving the original "platform versions stuck at 0.1.3"
+        # bug. assemble-npm.sh writes versions transiently with a
+        # restore-on-EXIT trap, so a clean checkout never has them.
+        run: |
+          set -euo pipefail
+          FILES=(
+            hyperdb-mcp/npm/package.json
+            hyperdb-mcp/npm/darwin-arm64/package.json
+            hyperdb-mcp/npm/darwin-x64/package.json
+            hyperdb-mcp/npm/linux-x64-gnu/package.json
+            hyperdb-mcp/npm/win32-x64-msvc/package.json
+            hyperdb-api-node/package.json
+            hyperdb-api-node/npm/darwin-arm64/package.json
+            hyperdb-api-node/npm/darwin-x64/package.json
+            hyperdb-api-node/npm/linux-arm64-gnu/package.json
+            hyperdb-api-node/npm/linux-x64-gnu/package.json
+            hyperdb-api-node/npm/linux-x64-musl/package.json
+            hyperdb-api-node/npm/win32-x64-msvc/package.json
+          )
+          OFFENDERS=()
+          for f in "${FILES[@]}"; do
+            if node -e "process.exit(JSON.parse(require('fs').readFileSync('$f', 'utf8')).version === undefined ? 0 : 1)"; then
+              :
+            else
+              OFFENDERS+=("$f")
+            fi
+          done
+          if (( ${#OFFENDERS[@]} > 0 )); then
+            echo "::error::The following npm package.json files have a 'version' field, which must not be tracked in source (it's injected at publish time by npm-build-publish.yml):"
+            printf '  - %s\n' "${OFFENDERS[@]}"
+            exit 1
+          fi

.github/workflows/npm-build-publish.yml

@@ -46,7 +46,7 @@ jobs:
           # verify-ci job from this workflow (it would self-reference).
           MAX_ATTEMPTS=30
           SLEEP_SECONDS=60
-          REQUIRED='rustfmt|clippy|cargo-audit|cargo-deny|version consistency|publish dry-run|test \(ubuntu-latest\)|test \(macos-14\)|test \(windows-latest\)'
+          REQUIRED='rustfmt|clippy|cargo-audit|cargo-deny|version consistency|publish dry-run|test \(ubuntu-latest\)|test \(macos-14\)|test \(windows-latest\)|hyperdb-api-node \(build \+ smoke\)'
           for i in $(seq 1 "$MAX_ATTEMPTS"); do
             RUNS=$(gh api "repos/$REPO/commits/$SHA/check-runs?per_page=100" \
               --jq "[.check_runs[] | select(.name | test(\"$REQUIRED\"))]")
@@ -288,26 +288,109 @@ jobs:
       - name: Copy README into hyperdb-mcp npm publish directory
         run: cp hyperdb-mcp/README.md hyperdb-mcp/npm/README.md
 
-      - name: Determine npm dist-tag
-        id: dist-tag
+      - name: Resolve version and dist-tag from event
+        id: version
+        # Source-of-truth: the git tag that triggered the workflow.
+        # release events carry it in github.event.release.tag_name;
+        # workflow_dispatch carries it in inputs.tag. Neither path
+        # reads from package.json, so the platform/umbrella package
+        # files don't need to track the version in source control.
+        env:
+          RAW_VERSION: ${{ github.event.inputs.tag || github.event.release.tag_name }}
         run: |
           set -euo pipefail
-          VERSION=$(node -p "require('./hyperdb-mcp/npm/package.json').version")
-          if [[ "$VERSION" == *-rc.* ]]; then
-            echo "tag=rc" >> "$GITHUB_OUTPUT"
-          elif [[ "$VERSION" == *-alpha.* ]]; then
-            echo "tag=alpha" >> "$GITHUB_OUTPUT"
-          elif [[ "$VERSION" == *-beta.* ]]; then
-            echo "tag=beta" >> "$GITHUB_OUTPUT"
-          else
-            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          if [[ -z "${RAW_VERSION:-}" ]]; then
+            echo "::error::No tag/version available; refusing to publish."
+            exit 1
+          fi
+          VERSION="${RAW_VERSION#v}"
+          # Defense in depth: tags from workflow_dispatch are user-supplied.
+          # Enforce strict vX.Y.Z / vX.Y.Z-rc.N shape before the value
+          # flows into npm pkg set / npm publish commands.
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-(rc|alpha|beta)\.[0-9]+)?$ ]]; then
+            echo "::error::Invalid version: $VERSION (expected X.Y.Z or X.Y.Z-rc.N)"
+            exit 1
+          fi
+          case "$VERSION" in
+            *-rc.*)    TAG=rc ;;
+            *-alpha.*) TAG=alpha ;;
+            *-beta.*)  TAG=beta ;;
+            *)         TAG=latest ;;
+          esac
+          {
+            echo "version=$VERSION"
+            echo "tag=$TAG"
+          } >> "$GITHUB_OUTPUT"
+          echo "Resolved version=$VERSION dist-tag=$TAG"
+
+      - name: Verify tag matches workspace Cargo.toml version
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        # Defense against a tag that doesn't match what `cargo publish`
+        # will publish in release.yml. If they diverge, npm and crates.io
+        # would ship at different versions. Match the same field
+        # release-please patches: [workspace.package].version.
+        run: |
+          set -euo pipefail
+          CARGO_VERSION=$(awk '
+            /^\[workspace\.package\]/ { in_section = 1; next }
+            /^\[/ { in_section = 0 }
+            in_section && /^version[[:space:]]*=/ {
+              gsub(/[[:space:]"]/, "", $0)
+              sub(/^version=/, "", $0)
+              print
+              exit
+            }
+          ' Cargo.toml)
+          if [[ "$VERSION" != "$CARGO_VERSION" ]]; then
+            echo "::error::Tag version ($VERSION) does not match Cargo.toml workspace version ($CARGO_VERSION). Refusing to publish to avoid registry skew between npm and crates.io."
+            exit 1
           fi
-          echo "Publishing with dist-tag: $(grep tag "$GITHUB_OUTPUT" | tail -1)"
+
+      - name: Inject version into all npm package.json files
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        # The platform and umbrella package.json files are stripped of
+        # `version` and `optionalDependencies` in source. We materialize
+        # them here from the tag-derived $VERSION just before publish.
+        #
+        # PLATFORMS is the SINGLE source of truth for which platforms
+        # ship. It must match (a) the build-npm matrix above, (b) the
+        # publish loops below, and (c) the `napi.targets` array in
+        # hyperdb-api-node/package.json. hyperdb-mcp and hyperdb-api-node
+        # currently ship the same 3 platforms; if that ever diverges,
+        # split into MCP_PLATFORMS / NODE_PLATFORMS arrays here AND
+        # below in the publish steps.
+        run: |
+          set -euo pipefail
+          PLATFORMS=(darwin-arm64 linux-x64-gnu win32-x64-msvc)
+
+          for p in "${PLATFORMS[@]}"; do
+            (cd "hyperdb-mcp/npm/$p" && npm pkg set "version=$VERSION")
+            (cd "hyperdb-api-node/npm/$p" && npm pkg set "version=$VERSION")
+          done
+
+          # Umbrellas: own version + every optionalDependency exact-pinned
+          # to ==VERSION so installs resolve to the matching platform tarball.
+          (
+            cd hyperdb-mcp/npm
+            npm pkg set "version=$VERSION"
+            for p in "${PLATFORMS[@]}"; do
+              npm pkg set "optionalDependencies.hyperdb-mcp-$p=$VERSION"
+            done
+          )
+          (
+            cd hyperdb-api-node
+            npm pkg set "version=$VERSION"
+            for p in "${PLATFORMS[@]}"; do
+              npm pkg set "optionalDependencies.hyperdb-api-node-$p=$VERSION"
+            done
+          )
 
       - name: Publish hyperdb-mcp platform packages
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TAG: ${{ steps.dist-tag.outputs.tag }}
+          NPM_TAG: ${{ steps.version.outputs.tag }}
         run: |
           set -euo pipefail
           for dir in hyperdb-mcp/npm/darwin-arm64 hyperdb-mcp/npm/linux-x64-gnu hyperdb-mcp/npm/win32-x64-msvc; do
@@ -321,15 +404,15 @@ jobs:
       - name: Publish hyperdb-mcp main package
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TAG: ${{ steps.dist-tag.outputs.tag }}
+          NPM_TAG: ${{ steps.version.outputs.tag }}
         run: |
           cd hyperdb-mcp/npm
           npm publish --access public --tag "$NPM_TAG"
 
       - name: Publish hyperdb-api-node platform packages
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TAG: ${{ steps.dist-tag.outputs.tag }}
+          NPM_TAG: ${{ steps.version.outputs.tag }}
         run: |
           set -euo pipefail
           for dir in hyperdb-api-node/npm/darwin-arm64 hyperdb-api-node/npm/linux-x64-gnu hyperdb-api-node/npm/win32-x64-msvc; do
@@ -343,7 +426,7 @@ jobs:
       - name: Publish hyperdb-api-node main package
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TAG: ${{ steps.dist-tag.outputs.tag }}
+          NPM_TAG: ${{ steps.version.outputs.tag }}
         # --ignore-scripts skips the prepublishOnly hook (`napi prepublish`),
         # which would try to re-orchestrate the platform packages our CI
         # has already built and published independently.

.release-please-manifest.json

@@ -1,13 +1,3 @@
 {
-  ".": "0.2.1",
-  "hyperdb-api-node": "0.1.3",
-  "hyperdb-mcp/npm": "0.1.3",
-  "hyperdb-mcp/npm/darwin-arm64": "0.1.3",
-  "hyperdb-mcp/npm/linux-x64-gnu": "0.1.3",
-  "hyperdb-mcp/npm/win32-x64-msvc": "0.1.3",
-  "hyperdb-api-node/npm/darwin-arm64": "0.1.3",
-  "hyperdb-api-node/npm/linux-arm64-gnu": "0.1.3",
-  "hyperdb-api-node/npm/linux-x64-gnu": "0.1.3",
-  "hyperdb-api-node/npm/linux-x64-musl": "0.1.3",
-  "hyperdb-api-node/npm/win32-x64-msvc": "0.1.3"
+  ".": "0.2.1"
 }

hyperdb-api-node/npm/darwin-arm64/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-api-node-darwin-arm64",
-  "version": "0.1.3",
   "os": [
     "darwin"
   ],

hyperdb-api-node/npm/darwin-x64/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-api-node-darwin-x64",
-  "version": "0.1.2",
   "os": [
     "darwin"
   ],

hyperdb-api-node/npm/linux-arm64-gnu/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-api-node-linux-arm64-gnu",
-  "version": "0.1.3",
   "os": [
     "linux"
   ],

hyperdb-api-node/npm/linux-x64-gnu/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-api-node-linux-x64-gnu",
-  "version": "0.1.3",
   "os": [
     "linux"
   ],

hyperdb-api-node/npm/linux-x64-musl/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-api-node-linux-x64-musl",
-  "version": "0.1.3",
   "os": [
     "linux"
   ],

hyperdb-api-node/npm/win32-x64-msvc/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-api-node-win32-x64-msvc",
-  "version": "0.1.3",
   "os": [
     "win32"
   ],

hyperdb-api-node/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-api-node",
-  "version": "0.1.3",
   "description": "Node.js bindings for the Hyper database API, powered by napi-rs",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,8 +8,6 @@
     "targets": [
       "aarch64-apple-darwin",
       "x86_64-unknown-linux-gnu",
-      "x86_64-unknown-linux-musl",
-      "aarch64-unknown-linux-gnu",
       "x86_64-pc-windows-msvc"
     ]
   },
@@ -29,13 +26,6 @@
     "apache-arrow": "^21.1.0",
     "tsx": "^4.22.0"
   },
-  "optionalDependencies": {
-    "hyperdb-api-node-darwin-arm64": "0.2.1",
-    "hyperdb-api-node-linux-arm64-gnu": "0.2.1",
-    "hyperdb-api-node-linux-x64-gnu": "0.2.1",
-    "hyperdb-api-node-linux-x64-musl": "0.2.1",
-    "hyperdb-api-node-win32-x64-msvc": "0.2.1"
-  },
   "keywords": [
     "hyper",
     "database",

hyperdb-mcp/npm/darwin-arm64/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-mcp-darwin-arm64",
-  "version": "0.1.3",
   "description": "HyperDB MCP server binary for macOS ARM64",
   "os": [
     "darwin"

hyperdb-mcp/npm/darwin-x64/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-mcp-darwin-x64",
-  "version": "0.1.2",
   "description": "HyperDB MCP server binary for macOS x64",
   "os": ["darwin"],
   "cpu": ["x64"],

hyperdb-mcp/npm/linux-x64-gnu/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-mcp-linux-x64-gnu",
-  "version": "0.1.3",
   "description": "HyperDB MCP server binary for Linux x64 (glibc)",
   "os": [
     "linux"

hyperdb-mcp/npm/package.json

@@ -1,15 +1,9 @@
 {
   "name": "hyperdb-mcp",
-  "version": "0.1.3",
   "description": "HyperDB MCP server — instant SQL analytics for LLM workflows",
   "bin": {
     "hyperdb-mcp": "bin.js"
   },
-  "optionalDependencies": {
-    "hyperdb-mcp-darwin-arm64": "0.2.1",
-    "hyperdb-mcp-linux-x64-gnu": "0.2.1",
-    "hyperdb-mcp-win32-x64-msvc": "0.2.1"
-  },
   "files": [
     "bin.js",
     "README.md"

hyperdb-mcp/npm/win32-x64-msvc/package.json

@@ -1,6 +1,5 @@
 {
   "name": "hyperdb-mcp-win32-x64-msvc",
-  "version": "0.1.3",
   "description": "HyperDB MCP server binary for Windows x64",
   "os": [
     "win32"