fix(ci): disable PyPI attestations for reusable workflow

.github/workflows/publish-wren-core-py.yml

@@ -135,3 +135,4 @@ jobs:
         with:
           repository-url: ${{ inputs.pypi_target == 'testpypi' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}
           packages-dir: dist/
+          attestations: false

.github/workflows/publish-wren-core-wasm.yml

@@ -0,0 +1,90 @@
+name: Publish wren-core-wasm to npm
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "Version number (e.g. 0.2.0)"
+        required: true
+        type: string
+      tag_name:
+        description: "Git tag to checkout (e.g. wren-core-wasm-v0.2.0)"
+        required: true
+        type: string
+      npm_tag:
+        description: "npm dist-tag (latest or rc)"
+        required: false
+        type: string
+        default: "latest"
+    secrets:
+      NPM_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-publish:
+    name: Build WASM + publish to npm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag_name }}
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Cache Cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            wren-core-wasm/target/
+          key: wasm-cargo-${{ hashFiles('wren-core-wasm/Cargo.toml', 'wren-core-wasm/Cargo.lock') }}
+          restore-keys: wasm-cargo-
+
+      - name: Install wasm-pack
+        uses: taiki-e/install-action@v2
+        with:
+          tool: wasm-pack@0.14.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+
+      - name: Install npm dependencies
+        working-directory: wren-core-wasm
+        run: npm install
+
+      - name: Set version in package.json
+        working-directory: wren-core-wasm
+        env:
+          VERSION: ${{ inputs.version }}
+        run: npm version "$VERSION" --no-git-tag-version
+
+      - name: Build WASM (wasm-pack)
+        working-directory: wren-core-wasm
+        run: wasm-pack build --target web --release
+
+      - name: Build dist (TypeScript + copy)
+        working-directory: wren-core-wasm
+        run: npm run build:dist
+
+      - name: Run integration tests
+        working-directory: wren-core-wasm
+        run: npm test
+
+      - name: Publish to npm
+        working-directory: wren-core-wasm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TAG: ${{ inputs.npm_tag }}
+        run: npm publish --tag "$NPM_TAG" --access public

.github/workflows/rc-release.yml

@@ -12,6 +12,7 @@ on:
           - mcp-server
           - wren-core-py
           - wren
+          - wren-core-wasm
       rc_version:
         description: "RC version override (e.g. 0.25.0-rc.2). Leave empty to auto-increment."
         required: false
@@ -138,8 +139,19 @@ jobs:
       contents: read
       id-token: write
 
+  publish-wren-core-wasm:
+    needs: create-rc
+    if: inputs.component == 'wren-core-wasm'
+    uses: ./.github/workflows/publish-wren-core-wasm.yml
+    with:
+      version: ${{ needs.create-rc.outputs.version }}
+      tag_name: ${{ needs.create-rc.outputs.tag_name }}
+      npm_tag: rc
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
   create-release:
-    needs: [create-rc, publish-ibis-server, publish-mcp-server, publish-wren-core-py, publish-wren]
+    needs: [create-rc, publish-ibis-server, publish-mcp-server, publish-wren-core-py, publish-wren, publish-wren-core-wasm]
     if: always() && needs.create-rc.result == 'success' && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
     runs-on: ubuntu-latest
     permissions:

.github/workflows/release-please.yml

@@ -25,6 +25,9 @@ jobs:
       wren--release_created: ${{ steps.release.outputs['wren--release_created'] }}
       wren--tag_name: ${{ steps.release.outputs['wren--tag_name'] }}
       wren--version: ${{ steps.release.outputs['wren--version'] }}
+      wren-core-wasm--release_created: ${{ steps.release.outputs['wren-core-wasm--release_created'] }}
+      wren-core-wasm--tag_name: ${{ steps.release.outputs['wren-core-wasm--tag_name'] }}
+      wren-core-wasm--version: ${{ steps.release.outputs['wren-core-wasm--version'] }}
     steps:
       - uses: googleapis/release-please-action@v4
         id: release
@@ -72,3 +75,13 @@ jobs:
     permissions:
       contents: read
       id-token: write
+
+  publish-wren-core-wasm:
+    needs: release-please
+    if: needs.release-please.outputs['wren-core-wasm--release_created'] == 'true'
+    uses: ./.github/workflows/publish-wren-core-wasm.yml
+    with:
+      version: ${{ needs.release-please.outputs['wren-core-wasm--version'] }}
+      tag_name: ${{ needs.release-please.outputs['wren-core-wasm--tag_name'] }}
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/wasm-ci.yml

@@ -0,0 +1,99 @@
+name: WASM SDK
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'wren-core-wasm/**'
+      - 'wren-core/core/**'
+      - 'wren-core-base/**'
+  pull_request:
+    paths:
+      - 'wren-core-wasm/**'
+      - 'wren-core/core/**'
+      - 'wren-core-base/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build WASM + TypeScript SDK
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Cache Cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            wren-core-wasm/target/
+          key: wasm-cargo-${{ hashFiles('wren-core-wasm/Cargo.toml', 'wren-core-wasm/Cargo.lock') }}
+          restore-keys: wasm-cargo-
+
+      - name: Install wasm-pack
+        uses: taiki-e/install-action@v2
+        with:
+          tool: wasm-pack@0.14.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install npm dependencies
+        working-directory: wren-core-wasm
+        run: npm install
+
+      - name: Build WASM (wasm-pack)
+        working-directory: wren-core-wasm
+        run: wasm-pack build --target web --release
+
+      - name: Build dist (TypeScript + copy)
+        working-directory: wren-core-wasm
+        run: npm run build:dist
+
+      - name: TypeScript typecheck
+        working-directory: wren-core-wasm
+        run: npm run typecheck
+
+      - name: WASM binary size check
+        working-directory: wren-core-wasm
+        run: |
+          raw_size=$(stat -c%s dist/wren_core_wasm_bg.wasm)
+          gzip_size=$(gzip -c dist/wren_core_wasm_bg.wasm | wc -c)
+          raw_mb=$(echo "scale=1; $raw_size / 1048576" | bc)
+          gzip_mb=$(echo "scale=1; $gzip_size / 1048576" | bc)
+          echo "WASM binary: ${raw_mb} MB raw, ${gzip_mb} MB gzip"
+
+          # Fail if gzip > 15 MB
+          max_gzip=$((15 * 1048576))
+          if [ "$gzip_size" -gt "$max_gzip" ]; then
+            echo "::error::WASM binary gzip size (${gzip_mb} MB) exceeds 15 MB limit"
+            exit 1
+          fi
+
+      - name: Run integration tests
+        working-directory: wren-core-wasm
+        run: npm test
+
+      - name: Upload dist artifact
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v4
+        with:
+          name: wasm-sdk-dist
+          path: wren-core-wasm/dist/
+          retention-days: 30

.release-please-manifest.json

@@ -2,5 +2,6 @@
   "ibis-server": "0.25.0",
   "mcp-server": "0.25.0",
   "wren-core-py": "0.3.0",
-  "wren": "0.2.0"
+  "wren": "0.2.0",
+  "wren-core-wasm": "0.1.0"
 }

RELEASING.md

@@ -10,6 +10,7 @@ Wren Engine uses [release-please](https://github.com/googleapis/release-please)
 | mcp-server | — (bundled in ibis-server image) | `mcp-server-v0.25.0` | Version verify only |
 | wren-core-py | `wren-core-py` on PyPI | `wren-core-py-v0.2.0` | PyPI |
 | wren | `wren-engine` on PyPI | `wren-v0.3.0` | PyPI |
+| wren-core-wasm | `wren-core-wasm` on npm | `wren-core-wasm-v0.2.0` | npm |
 
 ## How it works
 
@@ -49,6 +50,7 @@ Merging a Release PR triggers:
   - ibis-server → multi-arch Docker image pushed to GHCR (tagged `<version>` + `latest`)
   - wren-core-py → multi-platform wheels + sdist published to PyPI
   - wren → sdist + wheel published to PyPI
+  - wren-core-wasm → WASM package published to npm
   - mcp-server → version verification
 
 ## RC (pre-release) workflow
@@ -113,6 +115,7 @@ Note: while on 0.x with `bump-minor-pre-major`, this only bumps minor. Use `Rele
 | `.github/workflows/publish-ibis-server.yml` | Docker multi-arch build + push |
 | `.github/workflows/publish-wren-core-py.yml` | Multi-platform wheel build + PyPI publish |
 | `.github/workflows/publish-wren.yml` | sdist + wheel build + PyPI publish |
+| `.github/workflows/publish-wren-core-wasm.yml` | WASM build + npm publish |
 | `.github/workflows/publish-mcp-server.yml` | Version verification |
 
 ## Continuous builds (unchanged)

ibis-server/README.md

@@ -1,6 +1,8 @@
-# Ibis Server Module
+# Ibis Server Module (Deprecated)
 This module is the API server of Wren Engine. It's built on top of [FastAPI](https://fastapi.tiangolo.com/). It provides several APIs for SQL queries. A SQL query will be planned by [wren-core](../wren-core/), transpiled by [sqlglot](https://github.com/tobymao/sqlglot), and then executed by [ibis](https://github.com/ibis-project/ibis) to query the database.
 
+## Note: This module is deprecated and will be removed in the future. We are migrating to a CLI tool with the same query capabilities. Please refer to [wren](../wren/) for the new CLI tool.
+
 ## Quick Start
 
 ### Building the Docker Image

ibis-server/justfile

@@ -13,7 +13,6 @@ install-core:
 
 install *args:
     poetry install {{ args }}
-    just install-core
 
 pre-commit-install:
     poetry run pre-commit install

ibis-server/pyproject.toml

@@ -1,5 +1,5 @@
 [tool.poetry]
-name = "wren-engine"
+name = "wren-engine-server"
 version = "0.25.0"
 description = ""
 authors = ["Canner <dev@cannerdata.com>"]
@@ -57,6 +57,7 @@ pyasn1 = ">=0.6.3"
 pyopenssl = ">=26.0.0"
 PyJWT = ">=2.12.0"
 tornado = ">=6.5.5"
+wren-engine = "0.1.0"
 
 [tool.poetry.group.jupyter]
 optional = true

release-please-config.json

@@ -28,6 +28,14 @@
       "extra-files": [
         "src/wren/__init__.py"
       ]
+    },
+    "wren-core-wasm": {
+      "component": "wren-core-wasm",
+      "release-type": "node",
+      "bump-minor-pre-major": true,
+      "extra-files": [
+        "Cargo.toml"
+      ]
     }
   }
 }