release(db): prepare 0.10.0 npm json dependency

Author: PatrickJS

.async-pipeline/tasks.lock.json

@@ -223,5 +223,5 @@
     }
   ],
   "hash": "sha256:5f179042f0de7a5e090c0f234980b53f348f793f702a72c0b7f9fe287f87236e",
-  "generatedAt": "2026-06-15T00:58:38.512Z"
+  "generatedAt": "2026-06-15T07:20:08.795Z"
 }

.github/async-pipeline.lock.json

@@ -3,8 +3,8 @@
   "generator": "@async/pipeline",
   "config": "pipeline.ts",
   "workflow": ".github/workflows/async-pipeline.yml",
-  "hash": "sha256:205c87f8bfd6e77a11e27cc598263a16e75f2f1abb08c33384fc06802b1928d6",
-  "generatedAt": "2026-06-15T00:58:38.474Z",
+  "hash": "sha256:aaab0227d98ee39492e0b669ca496b173c8f627026dbc8c90b48b5f6fcd982ce",
+  "generatedAt": "2026-06-15T07:20:08.762Z",
   "triggers": {
     "pull_request": {},
     "push": {
@@ -72,7 +72,7 @@
       "env": {
         "NODE_AUTH_TOKEN": {
           "kind": "async-pipeline.env.secret",
-          "name": "NPM_TOKEN"
+          "name": "npm_token"
         },
         "GITHUB_TOKEN": {
           "kind": "async-pipeline.env.secret",

.github/workflows/async-pipeline.yml

@@ -182,7 +182,7 @@ jobs:
         env:
           CI: true
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.npm_token }}
 
   publish-github:
     name: publish-github

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.9.0"
+  ".": "0.10.0"
 }

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## Unreleased
 
+## [0.10.0](https://github.com/async/db/releases/tag/v0.10.0) - 2026-06-15
+
+### Added
+
+- Added normalized resource identity metadata across schema builders, generated
+  TypeScript, schema manifests, viewer manifests, REST metadata, GraphQL SDL,
+  API surface ledgers, SQL adapters, and inspectors.
+- Added compound object-key runtime support across package APIs, REST `__key`
+  routes, GraphQL resource key inputs, WAL replay, audit payloads, and
+  SQLite/Postgres existing-table adapters.
+- Added append-only log policy handling and `field.bytes(...)` metadata with
+  encoded payload validation.
+
+### Changed
+
+- Delegated JSON-backed identity behavior through the standalone `@async/json`
+  engine while preserving the `@async/db/json` compatibility export.
+- Replaced the GitHub release tarball dependency on `@async/json` with the npm
+  package dependency `@async/json@^0.2.0`; GitHub Packages remain preview/mirror
+  install surfaces, not the default dependency source.
+
 ## [0.9.0](https://github.com/async/db/releases/tag/v0.9.0) - 2026-06-15
 
 ### Added

docs/ci-and-release.md

@@ -174,7 +174,7 @@ pipeline npm publish command:
 pnpm run pipeline:publish:npm
 ```
 
-The generated publish job maps `NPM_TOKEN` to `NODE_AUTH_TOKEN` and requires
+The generated publish job maps the org-level `npm_token` secret to `NODE_AUTH_TOKEN` and requires
 GitHub OIDC provenance. Keep `package.json` `repository.url` exactly aligned with
 `https://github.com/async/db`, because npm validates trusted
 publishing against the GitHub repository identity.
@@ -184,7 +184,7 @@ and verify the package, but npm publish will fail until npm trusts this
 repository and workflow.
 
 If Trusted Publishing is not configured and the npm publish step fails, fix the
-`npm-publish` environment or `NPM_TOKEN` setup and rerun the generated GitHub
+`npm-publish` environment or `npm_token` setup and rerun the generated GitHub
 Actions publish job. Do not publish `@async/db` from the local machine.
 
 ## Actions Release

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@async/db",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "The Async data workflow package for fixtures, generated types, local APIs, runtime stores, and database-backed graduation.",
   "packageManager": "pnpm@10.20.0",
   "scripts": {
@@ -55,7 +55,7 @@
     "async-db": "./dist/cli.js"
   },
   "dependencies": {
-    "@async/json": "https://github.com/async/json/releases/download/v0.1.0/async-json-0.1.0.tgz"
+    "@async/json": "^0.2.0"
   },
   "devDependencies": {
     "@async/api-contract": "0.1.0",

pipeline.ts

@@ -226,7 +226,7 @@ export default definePipeline({
         provenance: true
       },
       env: {
-        NODE_AUTH_TOKEN: env.secret("NPM_TOKEN"),
+        NODE_AUTH_TOKEN: env.secret("npm_token"),
         GITHUB_TOKEN: env.secret("GITHUB_TOKEN")
       },
       github: {

pnpm-lock.yaml

@@ -49,7 +49,7 @@ test('consumer projects can import package APIs through the @async/db package',
   await writeFile(path.join(cwd, 'check-package.mjs'), `import { createDbOperationHandler, createDbRequestHandler, createDbRuntime, createIndexedDbCacheStorage, createMemoryFs, inspectSchemaMigration, loadDbSchema, openDb, reloadDb, watchDbSources } from '@async/db';
 import { createDbClient, createIndexedDbCacheStorage as createClientIndexedDbCacheStorage } from '@async/db/client';
 import { defineConfig } from '@async/db/config';
-import { fileStorage, jsonStore, jsonStoreCapabilities, readJsonState, s3Storage, writeJsonState } from '@async/db/json';
+import { fileStorage, json, jsonStore, jsonStoreCapabilities, readJsonState, s3Storage, writeJsonState } from '@async/db/json';
 import { sqliteStore } from '@async/db/sqlite';
 import { compoundKeyId, defineSqliteImportPlan, openLegacySqlite } from '@async/db/sqlite/compat';
 import { openPostgresDb, postgresStore } from '@async/db/postgres';
@@ -73,6 +73,7 @@ if (typeof createIndexedDbCacheStorage !== 'function') throw new Error('missing
 if (typeof createClientIndexedDbCacheStorage !== 'function') throw new Error('missing client indexeddb cache API');
 if (typeof defineConfig !== 'function') throw new Error('missing config API');
 if (jsonStoreCapabilities.persistence !== 'local-file') throw new Error('missing json store capabilities');
+if (typeof json !== 'function') throw new Error('missing json standalone API');
 if (typeof jsonStore !== 'function') throw new Error('missing json store helper');
 if (typeof fileStorage !== 'function') throw new Error('missing json file storage helper');
 if (typeof s3Storage !== 'function') throw new Error('missing json s3 storage helper');
@@ -162,6 +163,7 @@ import {
   atomicWriteJson,
   atomicWriteJsonVersioned,
   fileStorage,
+  json,
   jsonStateVersionsDir,
   jsonStore,
   jsonStatePathForResource,
@@ -173,6 +175,7 @@ import {
   s3Storage,
   withJsonStateWrite,
   writeJsonState,
+  type JsonOpenOptions,
   type JsonStoreCapabilities,
 } from '@async/db/json';
 import { kvStore } from '@async/db/kv';
@@ -309,6 +312,7 @@ void recoverJsonStateDir('.db/state');
 void jsonStateVersionsDir(jsonStatePath);
 void jsonStore({ durability: 'versioned', maxVersions: 5, encryption: { key: () => 'k' } });
 void jsonStore();
+void json('./db/package-versions.json', { identity: { fields: ['name', 'version'] } } satisfies JsonOpenOptions);
 void s3Storage({
   bucket: 'app-json-db',
   prefix: 'prod',
@@ -485,7 +489,7 @@ test('generated async-pipeline workflow owns release, preview, snapshot, and Pag
   assert.match(workflow, /id-token: write/);
   assert.match(workflow, /packages: write/);
   assert.match(workflow, /pull-requests: write/);
-  assert.match(workflow, /NODE_AUTH_TOKEN: \$\{\{ secrets\.NPM_TOKEN \}\}/);
+  assert.match(workflow, /NODE_AUTH_TOKEN: \$\{\{ secrets\.npm_token \}\}/);
   const releaseDoctorJob = workflow.match(/  release-doctor:[\s\S]*?\n\n  snapshot:/)?.[0] ?? '';
   assert.match(releaseDoctorJob, /contents: read/);
   assert.match(releaseDoctorJob, /packages: read/);
@@ -631,6 +635,12 @@ test('public JSON declarations expose file database helpers', async () => {
   assert.match(declarations, /export function restoreJsonStateVersion\(/);
   assert.match(declarations, /export function listJsonStateVersions\(/);
   assert.match(declarations, /export function recoverJsonStateDir\(/);
+  assert.match(declarations, /export type JsonIdentityDefinition = \{/);
+  assert.match(declarations, /export type JsonOpenOptions = \{/);
+  assert.match(declarations, /identity\?: JsonIdentityDefinition;/);
+  assert.match(declarations, /writePolicy\?: 'append-only' \| string;/);
+  assert.match(declarations, /export type JsonKey = string \| number \| boolean \| Record<string, unknown>;/);
+  assert.match(declarations, /export function json\(target: string, options\?: JsonOpenOptions\): Promise<JsonOpenResult>;/);
   assert.match(declarations, /export type JsonStoreEncryptionOptions = \{/);
   assert.match(declarations, /export type JsonStateWriteOptions = \{/);
   assert.match(declarations, /crossProcessLock\?: boolean;/);