ci(release): setup Node 24 + npm 11 for trusted publishing (OIDC)

.github/workflows/release.yml

@@ -29,6 +29,16 @@ jobs:
       - name: Setup Bun and install
         uses: ./.github/actions/setup
 
+      # npm trusted publishing (OIDC) needs npm ≥ 11.5.1 + Node ≥ 22.14
+      # (docs.npmjs.com/trusted-publishers). setup-bun leaves the runner's
+      # npm 10.x in PATH → `npm publish` can't detect OIDC → ENEEDAUTH.
+      # Node 24 ships npm 11.x; npm then auto-authenticates via OIDC (no token).
+      - name: Setup Node + npm for trusted publishing
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9f7362e8dae4041e # v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
       # Opens/updates the Version PR when `.changeset/*.md` exist. When there are none, the action
       # can still run `publish` (see changesets/action) so a just-merged Version PR can ship.
       # `changeset publish` should exit 0 when there is nothing new to publish. If this job fails,

src/adapters/backends/compressed.test.ts

@@ -61,7 +61,18 @@ describe("createCompressedStorage", () => {
     await waitForHydration(persist.hasHydrated);
 
     source.setState(() => ({ count: 7 }));
-    await new Promise((resolve) => setTimeout(resolve, 0));
+    // Async backend (CompressionStream) — the subscribe-write settles on a
+    // macrotask; a single `setTimeout 0` may race it on CI. Poll until it lands.
+    await new Promise<void>((resolve, reject) => {
+      let ticks = 0;
+      const tick = () => {
+        if (memory.getItem(name) !== null) return resolve();
+        if (++ticks > 1000)
+          return reject(new Error("compressed write never landed"));
+        setTimeout(tick, 0);
+      };
+      tick();
+    });
 
     const stored = memory.getItem(name)!;
     const plaintext = serovalCodec<{ count: number }>().encode({

src/adapters/backends/encrypted.test.ts

@@ -74,7 +74,18 @@ describe("createEncryptedStorage", () => {
     await waitForHydration(persist.hasHydrated);
 
     source.setState(() => ({ count: 7 }));
-    await new Promise((resolve) => setTimeout(resolve, 0));
+    // Async backend (crypto.subtle) — the subscribe-write settles on a
+    // macrotask; a single `setTimeout 0` may race it on CI. Poll until it lands.
+    await new Promise<void>((resolve, reject) => {
+      let ticks = 0;
+      const tick = () => {
+        if (memory.getItem(name) !== null) return resolve();
+        if (++ticks > 1000)
+          return reject(new Error("encrypted write never landed"));
+        setTimeout(tick, 0);
+      };
+      tick();
+    });
 
     const rawStored = memory.getItem(name);
     expect(rawStored).not.toBeNull();