ci(node): publish the npm package with cross-platform prebuilds on release

Add .github/workflows/npm-publish.yml: on each `v*` release tag (pushed by
scripts/release.sh), build the native addon on a matrix of native runners —
Linux x64 (ubuntu-22.04), Linux arm64 (ubuntu-24.04-arm), macOS x64 (macos-13),
macOS arm64 (macos-14), Windows x64 — then a publish job assembles the main
`fleischwolf` package plus per-platform `fleischwolf-<triple>` packages
(optionalDependencies) via napi-rs and publishes them all to npm. The version
is taken from the tag so it tracks the crate release; already-published
versions are skipped for idempotent re-runs.

Configure the package for the napi-rs v2 multi-platform flow: napi.name +
napi.triples for the five targets, and prepublishOnly / artifacts / version
scripts. The main package ships only the JS loader + types (~50 kB); the
prebuilt .node binaries ride in the platform packages. README documents
`npm install fleischwolf` (prebuilt) alongside build-from-source.

Requires an NPM_TOKEN repository secret with publish rights.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L7XwjsWSHWjrh39JxMLuB3

Author: claude

.github/workflows/npm-publish.yml

@@ -0,0 +1,173 @@
+# Publish the `fleischwolf` npm package (Node.js / Bun native bindings) on each
+# release. The package is a native N-API addon, so it can't be a one-line
+# `npm publish`: it's built on a matrix of native runners (one per OS/arch),
+# each producing a platform `.node`, then a publish job assembles the main
+# package plus per-platform `optionalDependencies` (fleischwolf-<triple>) via
+# napi-rs and publishes them all.
+#
+# Trigger: the `v*` tag that scripts/release.sh pushes for a crates.io release
+# (pushed with RELEASE_PAT, so it triggers this workflow). The npm version is
+# taken from the tag, so it tracks the crate version. Can also be dispatched
+# manually with an explicit version.
+#
+# Requires one repository secret: NPM_TOKEN — an npm automation token with
+# publish rights to `fleischwolf` and the `fleischwolf-*` platform packages.
+
+name: npm publish
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish (e.g. 0.7.0). Blank = derive from the tag."
+        required: false
+        default: ""
+
+concurrency:
+  group: npm-publish-${{ github.ref }}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    working-directory: crates/fleischwolf-node
+
+jobs:
+  build:
+    name: build ${{ matrix.target }}
+    runs-on: ${{ matrix.host }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            host: ubuntu-22.04
+          # GitHub-hosted ARM64 Linux runner (native — avoids cross-compiling the
+          # ONNX/ort build). Requires the arm64 runner image to be available.
+          - target: aarch64-unknown-linux-gnu
+            host: ubuntu-24.04-arm
+          - target: x86_64-apple-darwin
+            host: macos-13
+          - target: aarch64-apple-darwin
+            host: macos-14
+          - target: x86_64-pc-windows-msvc
+            host: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # One workspace, key the cache per target so the 5 jobs don't collide.
+          key: ${{ matrix.target }}
+          workspaces: "."
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install napi CLI
+        run: npm install
+
+      # Native addon + the JS loader / d.ts. `--strip` keeps the (ONNX-linked)
+      # binary as small as possible; strip isn't available under MSVC, so the
+      # Windows build omits it.
+      - name: Build (unix)
+        if: runner.os != 'Windows'
+        run: npx napi build --platform --release --strip --target ${{ matrix.target }} --js native.js --dts native.d.ts
+
+      - name: Build (windows)
+        if: runner.os == 'Windows'
+        run: npx napi build --platform --release --target ${{ matrix.target }} --js native.js --dts native.d.ts
+
+      - name: Upload prebuilt binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: bindings-${{ matrix.target }}
+          path: crates/fleischwolf-node/fleischwolf.*.node
+          if-no-files-found: error
+
+      # The JS loader + types are platform-agnostic; upload them once (from the
+      # linux-x64 build) for the publish job to include in the main package.
+      - name: Upload JS binding
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        uses: actions/upload-artifact@v4
+        with:
+          name: js-binding
+          path: |
+            crates/fleischwolf-node/native.js
+            crates/fleischwolf-node/native.d.ts
+          if-no-files-found: error
+
+  publish:
+    name: publish to npm
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install napi CLI
+        run: npm install
+
+      # Prebuilt binaries → artifacts/<name>/fleischwolf.<triple>.node
+      - name: Download prebuilt binaries
+        uses: actions/download-artifact@v4
+        with:
+          pattern: bindings-*
+          path: crates/fleischwolf-node/artifacts
+
+      # The JS loader + types → the package root.
+      - name: Download JS binding
+        uses: actions/download-artifact@v4
+        with:
+          name: js-binding
+          path: crates/fleischwolf-node
+
+      - name: Resolve version
+        id: ver
+        run: |
+          v="${{ github.event.inputs.version }}"
+          if [ -z "$v" ]; then v="${GITHUB_REF_NAME#v}"; fi
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+
+      # Skip cleanly if this version is already on npm (idempotent re-runs).
+      - name: Check if already published
+        id: check
+        run: |
+          v="${{ steps.ver.outputs.version }}"
+          if npm view "fleischwolf@$v" version >/dev/null 2>&1; then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+            echo "fleischwolf@$v is already on npm — skipping."
+          else
+            echo "published=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set package version
+        if: steps.check.outputs.published == 'false'
+        run: npm version "${{ steps.ver.outputs.version }}" --no-git-tag-version --allow-same-version
+
+      # Create the per-platform package dirs and move each prebuilt .node into
+      # its dir. `npm publish` then runs `prepublishOnly` (napi prepublish), which
+      # publishes the fleischwolf-<triple> packages and wires them into the main
+      # package's optionalDependencies before the main package is published.
+      - name: Assemble platform packages
+        if: steps.check.outputs.published == 'false'
+        run: |
+          npx napi create-npm-dir -t .
+          npx napi artifacts --dir artifacts
+
+      - name: Publish
+        if: steps.check.outputs.published == 'false'
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

crates/fleischwolf-node/.gitignore

@@ -11,3 +11,8 @@ native.d.ts
 
 # Example scratch output
 examples/artifacts/
+
+# Cross-platform publish scaffolding, generated in CI by `napi create-npm-dir`
+# and `napi artifacts` (per-platform packages + downloaded prebuilt binaries)
+npm/
+artifacts/

crates/fleischwolf-node/README.md

@@ -10,15 +10,30 @@ Built with [napi-rs](https://napi.rs), so it ships a real native addon (`.node`)
 that loads in both Node.js and Bun (Bun implements N-API) — the same binary, no
 rebuild between runtimes.
 
-## Install & build
+## Install
 
-This package lives in the Fleischwolf Cargo workspace and builds the addon from
-the Rust source. You need a Rust toolchain (1.82+) and Node.js 14+ (or Bun).
+Released versions ship **prebuilt** native binaries, so no Rust toolchain is
+needed to use the package:
+
+```bash
+npm install fleischwolf   # or: bun add fleischwolf
+```
+
+Prebuilt platforms: Linux x64 / arm64 (glibc), macOS x64 / arm64, Windows x64.
+The right binary is pulled in automatically as a platform-specific
+`optionalDependency` (`fleischwolf-<triple>`). Each release is published to npm
+from CI (`.github/workflows/npm-publish.yml`) on the version tag.
+
+## Build from source
+
+This package lives in the Fleischwolf Cargo workspace and can also build the
+addon from Rust source — needed for local development or an unsupported
+platform. You need a Rust toolchain (1.82+) and Node.js 14+ (or Bun).
 
 ```bash
 cd crates/fleischwolf-node
 npm install          # installs @napi-rs/cli
-npm run build        # release build → index.<platform>.node + native.js/.d.ts
+npm run build        # release build → fleischwolf.<platform>.node + native.js/.d.ts
 # npm run build:debug  # faster, unoptimized
 ```
 

crates/fleischwolf-node/package.json

@@ -29,14 +29,17 @@
     }
   },
   "napi": {
-    "binaryName": "fleischwolf",
-    "targets": [
-      "x86_64-unknown-linux-gnu",
-      "aarch64-unknown-linux-gnu",
-      "x86_64-apple-darwin",
-      "aarch64-apple-darwin",
-      "x86_64-pc-windows-msvc"
-    ]
+    "name": "fleischwolf",
+    "triples": {
+      "defaults": false,
+      "additional": [
+        "x86_64-unknown-linux-gnu",
+        "aarch64-unknown-linux-gnu",
+        "x86_64-apple-darwin",
+        "aarch64-apple-darwin",
+        "x86_64-pc-windows-msvc"
+      ]
+    }
   },
   "engines": {
     "node": ">= 14"
@@ -47,12 +50,14 @@
     "deps.js",
     "native.js",
     "native.d.ts",
-    "index.*.node",
     "README.md"
   ],
   "scripts": {
-    "build": "napi build --platform --release --js native.js --dts native.d.ts",
+    "build": "napi build --platform --release --strip --js native.js --dts native.d.ts",
     "build:debug": "napi build --platform --js native.js --dts native.d.ts",
+    "artifacts": "napi artifacts",
+    "prepublishOnly": "napi prepublish -t npm --skip-gh-release",
+    "version": "napi version",
     "test": "node test/smoke.mjs",
     "example": "node examples/node-basic.mjs",
     "example:bun": "bun run examples/bun-basic.ts"