SQLR-64: publish sqlrite-notes example to npm

[joaoh82]

Closes SQLR-64. Follow-up from SQLR-40 / #141 — gets the example to the original DoD of npx sqlrite-notes init <dir> on a fresh machine, no clone, no Rust toolchain.

Summary

• Drops "private": true and adds files + publishConfig (OIDC provenance, public access) to examples/nodejs-notes/package.json; bumps to 0.10.1 + engine pin to ^0.10.1 so the package ships in lockstep with the engine.
• Adds a publish-notes-example job to release.yml mirroring publish-nodejs (OIDC trusted publishing, sigstore provenance, --access public). Sequenced after publish-nodejs so the example resolves its @joaoh82/sqlrite pin against the version just put on npm.
• Extends scripts/bump-version.sh with the example's package.json and a new @joaoh82/sqlrite caret-pin sweep + verification, symmetric to the existing inter-workspace Cargo path-dep sweep.
• Switches the README to lead with npx sqlrite-notes init <dir>; keeps the clone path documented under Development.
• Adds the bootstrap docs (docs/release-secrets.md §3c) for the one-time npm placeholder + trusted-publisher setup. Documents the @joaoh82/sqlrite-notes fallback if the unscoped name is rejected.

Package name

Going with unscoped sqlrite-notes per the ticket — notes isn't a confusable suffix of any existing popular package. If the npm publish of the bootstrap placeholder is rejected by the similarity check, fall back to @joaoh82/sqlrite-notes; the docs spell that out.

Out of scope

• The one-time bootstrap publish + trusted-publisher wiring (§3c in docs/release-secrets.md).
• Republishing @joaoh82/sqlrite itself — unchanged.
• Publishing sqlrite-mcp to npm — stays a Rust binary on crates.io + GitHub Releases.

Test plan

• bash -n scripts/bump-version.sh
• yaml.safe_load on .github/workflows/release.yml
• ./scripts/bump-version.sh 0.99.0 dry-run → all 13 manifests bump + @joaoh82/sqlrite pin moves to ^0.99.0; verification ✓; reverted.
• npm test in examples/nodejs-notes/ → 40/40 pass.
• npm pack --dry-run → 13 files, 23.1 kB packed (README.md + bin/ + src/ + package.json). No test fixtures, no node_modules.
• node bin/sqlrite-notes.mjs help prints 0.10.1 (VERSION reads from package.json).
• End-to-end: npm install ./sqlrite-notes-0.10.1.tgz into a scratch dir, ./node_modules/.bin/sqlrite-notes help runs.
• npx sqlrite-notes@latest init <dir> end-to-end — needs the package on npm (post-merge smoke).
• npm audit signatures against a published version — same.
• CI workflow fires for real on the next release wave.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
rust-sqlite	Ready	Preview, Comment	May 25, 2026 8:53pm