From b76a99ef50408eed40345c51ff83dfdbc5ec9bae Mon Sep 17 00:00:00 2001
From: Justin Trantham <takescake@outlook.com>
Date: Wed, 29 Jul 2026 20:02:47 -0500
Subject: [PATCH 1/2] ci: finalize trusted npm publishing workflow

---
 .github/workflows/publish.yml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4cfbfc3..3e7a03e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,12 +4,6 @@ on:
   release:
     types: [published]
   workflow_dispatch:
-  # One-time trigger used to validate trusted publishing for v3.0.0.
-  # Remove after the first successful OIDC publish.
-  push:
-    branches: [master]
-    paths:
-      - .github/workflows/publish.yml
 
 permissions:
   contents: read
@@ -18,7 +12,7 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
-    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'push'
+    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
 
     steps:
       - uses: actions/checkout@v6
@@ -34,7 +28,7 @@ jobs:
         run: |
           node --version
           npm --version
-          node -e "const [major, minor, patch] = process.versions.node.split('.').map(Number); if (major < 22 || (major === 22 && minor < 14)) process.exit(1)"
+          node -e "const [major, minor] = process.versions.node.split('.').map(Number); if (major < 22 || (major === 22 && minor < 14)) process.exit(1)"
           npm install --global npm@latest
           npm --version
           node -e "const { execSync } = require('child_process'); const version = execSync('npm --version', { encoding: 'utf8' }).trim().split('.').map(Number); if (version[0] < 11 || (version[0] === 11 && version[1] < 5) || (version[0] === 11 && version[1] === 5 && version[2] < 1)) process.exit(1)"

From 3026ffa080f77ad9448eec20982749911b9d2e12 Mon Sep 17 00:00:00 2001
From: Justin Trantham <takescake@outlook.com>
Date: Wed, 29 Jul 2026 20:02:51 -0500
Subject: [PATCH 2/2] ci: remove obsolete v3 release workflow

---
 .github/workflows/release-v3.yml | 81 --------------------------------
 1 file changed, 81 deletions(-)
 delete mode 100644 .github/workflows/release-v3.yml

diff --git a/.github/workflows/release-v3.yml b/.github/workflows/release-v3.yml
deleted file mode 100644
index 67fa5d4..0000000
--- a/.github/workflows/release-v3.yml
+++ /dev/null
@@ -1,81 +0,0 @@
-name: Release v3.0.0
-
-on:
-  push:
-    branches: [master]
-    paths:
-      - .github/workflows/release-v3.yml
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  release-and-publish:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Use Node.js 22
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          registry-url: https://registry.npmjs.org
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Validate version alignment
-        run: |
-          PACKAGE_VERSION=$(node -p "require('./package.json').version")
-          SERVER_VERSION=$(node -p "require('./server.json').version")
-          CONFIG_VERSION=$(node -e "const fs=require('fs'); const s=fs.readFileSync('./src/config.ts','utf8'); const m=s.match(/export const SERVER_VERSION = \"([^\"]+)\";/); if(!m){process.exit(1)}; console.log(m[1]);")
-
-          echo "package.json version: ${PACKAGE_VERSION}"
-          echo "server.json version: ${SERVER_VERSION}"
-          echo "src/config.ts version: ${CONFIG_VERSION}"
-
-          test "${PACKAGE_VERSION}" = "3.0.0"
-          test "${PACKAGE_VERSION}" = "${SERVER_VERSION}"
-          test "${PACKAGE_VERSION}" = "${CONFIG_VERSION}"
-
-      - name: Build
-        run: npm run build
-
-      - name: Test
-        run: npm test
-
-      - name: Check if version already exists on npm
-        id: npm_check
-        run: |
-          PACKAGE_NAME=$(node -p "require('./package.json').name")
-          PACKAGE_VERSION=$(node -p "require('./package.json').version")
-
-          if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
-            echo "already_published=true" >> "$GITHUB_OUTPUT"
-            echo "Version ${PACKAGE_VERSION} is already published."
-          else
-            echo "already_published=false" >> "$GITHUB_OUTPUT"
-            echo "Version ${PACKAGE_VERSION} is not published yet."
-          fi
-
-      - name: Publish to npm
-        if: steps.npm_check.outputs.already_published == 'false'
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Create GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          if gh release view v3.0.0 >/dev/null 2>&1; then
-            echo "Release v3.0.0 already exists."
-          else
-            gh release create v3.0.0 \
-              --target "$GITHUB_SHA" \
-              --title "v3.0.0" \
-              --notes "Major security-focused release. password_read is now metadata-only unless reveal: true is explicitly supplied. Adds op_run and op_check_ref so agents can use and validate 1Password references without exposing plaintext secrets."
-          fi