ci: use OIDC trusted publisher, drop npm token

- Make readme clearer

.github/workflows/ci.yml

@@ -12,6 +12,8 @@ env:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
 

.github/workflows/publish.yml

@@ -4,10 +4,6 @@ on:
   release:
     types: [ published ]
 
-permissions:
-  id-token: write
-  contents: read
-
 env:
   CARGO_TERM_COLOR: always
 
@@ -33,7 +29,7 @@ jobs:
 
       - name: Install wasm-opt
         run: |
-          curl -L https://github.com/WebAssembly/binaryen/releases/latest/download/binaryen-version_129-x86_64-linux.tar.gz | tar xz
+          curl -L https://github.com/WebAssembly/binaryen/releases/download/version_129/binaryen-version_129-x86_64-linux.tar.gz | tar xz
           sudo mv binaryen-*/bin/wasm-opt /usr/local/bin/
 
       - name: Rust tests
@@ -47,8 +43,5 @@ jobs:
 
       - name: Publish to npm
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
           cd pkg
           npm publish --access public --provenance
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

Cargo.lock

@@ -19,6 +19,9 @@ name = "arrayvec"
 version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
+dependencies = [
+ "zeroize",
+]
 
 [[package]]
 name = "async-trait"
@@ -39,9 +42,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "blake3"
-version = "1.8.4"
+version = "1.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d2d5991425dfd0785aed03aedcf0b321d61975c9b5b3689c774a2610ae0b51e"
+checksum = "0aa83c34e62843d924f905e0f5c866eb1dd6545fc4d719e803d9ba6030371fce"
 dependencies = [
  "arrayref",
  "arrayvec",
@@ -49,11 +52,12 @@ dependencies = [
  "cfg-if",
  "constant_time_eq",
  "cpufeatures",
+ "zeroize",
 ]
 
 [[package]]
 name = "blake3-wasm-rs"
-version = "0.6.1"
+version = "0.6.2"
 dependencies = [
  "blake3",
  "hex",
@@ -482,6 +486,12 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
 [[package]]
 name = "zmij"
 version = "1.0.21"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "blake3-wasm-rs"
-version = "0.6.1"
+version = "0.6.2"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 authors = ["Thomas <[email protected]>"]
@@ -17,6 +17,7 @@ crate-type = ["cdylib", "rlib"]
 default = []
 wasm = ["dep:wasm-bindgen"]
 talc = ["dep:talc"]
+zeroize = ["blake3/zeroize"]
 
 [dependencies]
 blake3 = { version = "1", features = ["wasm32_simd"] }

Makefile

@@ -20,7 +20,7 @@ build: build-all node-esm
 
 build-all:
 	@echo "Building all target..."
-	RUSTFLAGS='-C opt-level=3 -C target-feature=+simd128' $(CARGO) build --target $(WASM_TARGET) --release --features wasm,talc
+	RUSTFLAGS='-C opt-level=3 -C target-feature=+simd128' $(CARGO) build --target $(WASM_TARGET) --release --features wasm,talc,zeroize
 	@mkdir -p $(ROOT)/bundler $(ROOT)/web $(ROOT)/node
 	$(WASM_BINDGEN) --target bundler --out-dir $(ROOT)/bundler $(TARGET_DIR)/$(CRATE).wasm
 	$(WASM_BINDGEN) --target web --out-dir $(ROOT)/web $(TARGET_DIR)/$(CRATE).wasm

README.md

@@ -35,7 +35,7 @@ blake3.deriveKey('my context', key);
 
 // Conctruct for Streaming
 {
-    using h = new blake3.Hasher();
+    const h = new blake3.Hasher();
     h.update(data.slice(0, 5));
     h.update(data.slice(5));
     h.finalize();
@@ -45,23 +45,19 @@ blake3.deriveKey('my context', key);
 
 // Streaming
 // Keyed (MAC mode)
-{
-    using mac = blake3.Hasher.newKeyed(key);
-    mac.update(data);
-    mac.finalize();
-}
+const mac = blake3.Hasher.newKeyed(key);
+mac.update(data);
+mac.finalize();
 
 // Streaming
 // Key derivation mode
-{
-    using kdf = blake3.Hasher.newDeriveKey('my app v1 :: subkey');
-    kdf.update(key);
-    kdf.finalize();
-}
+const kdf = blake3.Hasher.newDeriveKey('my app v1 :: subkey');
+kdf.update(key);
+kdf.finalize();
 
 // Batch hashing without re-allocating
 {
-    using h = new blake3.Hasher();
+    const h = new blake3.Hasher();
     h.update(chunk1);
     const first = h.finalizeAndReset();
     h.update(chunk2);
@@ -73,48 +69,6 @@ blake3.deriveKey('my context', key);
 
 ```ts
 import { hash, hashXof, keyedHash, deriveKey, Hasher } from 'blake3-wasm-rs';
-
-const data = new TextEncoder().encode('hello world');
-const key = new Uint8Array(32).fill(1);
-
-// One-shot hashing
-hash(data);
-hashXof(data, 64);          // variable output length
-keyedHash(data, key);       // key must be exactly 32 bytes
-deriveKey('my context', key);
-
-// Streaming
-{
-    using h = new Hasher();
-    h.update(data.slice(0, 5));
-    h.update(data.slice(5));
-    h.finalize();
-    h.finalizeXof(64);
-    h.reset();
-}
-
-// Keyed (MAC mode)
-{
-    using mac = Hasher.newKeyed(key);
-    mac.update(data);
-    mac.finalize();
-}
-
-// Key derivation mode
-{
-    using kdf = Hasher.newDeriveKey('my app v1 :: subkey');
-    kdf.update(key);
-    kdf.finalize();
-}
-
-// Batch hashing without re-allocating
-{
-    using h = new Hasher();
-    h.update(chunk1);
-    const first = h.finalizeAndReset();
-    h.update(chunk2);
-    const second = h.finalizeAndReset();
-}
 ```
 
 ## API

scripts/tpl/index.d.ts

@@ -1,5 +1,4 @@
 // SPDX-License-Identifier: MIT OR Apache-2.0
 // Copyright 2026 Thomas <[email protected]>
 // @ts-nocheck
-
 export { Hasher, deriveKey, hash, hashXof, keyedHash } from './bundler/blake3_wasm_rs';