fix(release): scope sqlrite-engine crate with include allowlist (fixes crates.io 413)

[joaoh82]

Problem

The v0.11.0 publish run failed at Publish sqlrite crate to crates.io (run 26738895572):

error: failed to publish sqlrite-engine v0.11.0 to registry at https://crates.io
the remote server responded with an error (status 413 Payload Too Large): max upload size is: 10485760

That cascaded: sqlrite-mcp (needs the engine) and the umbrella finalize were skipped.

Root cause

The engine [package] is the workspace root and had no include/exclude, so cargo publish packaged the entire repo tree. Uncompressed it was ~25 MiB, dominated by files that have no business in the library crate:

file	size	from
examples/desktop-journal/docs/demo.gif	9.0 MiB	SQLR-43
examples/desktop-journal/docs/demo.mp4	8.7 MiB	SQLR-43
web/public/playground/pkg/sqlrite_wasm_bg.wasm	2.1 MiB	SQLR-42
screenshots, lockfiles, images/, …	rest	—

SQLR-42 and SQLR-43 are exactly the two PRs merged since v0.10.2, which is why the previous (patch) releases stayed under the 10 MiB cap and this minor release was the first to trip it.

Fix

Add an include allowlist to the engine [package] — ship only src/**, the three declared [[example]] targets, README, and LICENSE. An allowlist (vs. a fragile exclude list) means future large files anywhere in the repo can't silently re-bloat the crate.

The three [[example]] .rs files are included deliberately: their paths are declared as targets in Cargo.toml, so they must exist in the tarball or cargo publish's verify step fails to parse the manifest.

Verification (local)

• cargo package -p sqlrite-engine → 376 KiB .crate (was ~25 MiB uncompressed) and the packaged crate compiles clean against the already-published sqlrite-ask 0.11.0.
• Packaged file list is src/** + the 3 example targets + README/LICENSE (+ cargo's auto Cargo.toml/Cargo.lock). No media, no web/, no images/.

How the v0.11.0 release gets completed after this merges

sqlrite-ask, @joaoh82/sqlrite, @joaoh82/sqlrite-wasm, Python wheels (PyPI), C FFI, the Go SDK, and the desktop apps already published at 0.11.0. Only sqlrite-engine + sqlrite-mcp are missing. A full release.yml re-dispatch would collide with those already-published artifacts (the npm/PyPI/etc. jobs have no already-exists guard), so the missing two are published surgically from fixed main:

cargo publish -p sqlrite-engine      # now 376 KiB → accepted
# wait for the crates.io index to carry 0.11.0, then:
cargo publish -p sqlrite-mcp

Follow-ups filed separately: make release.yml publish jobs idempotent (skip-if-already-published) so partial-failure recovery is a clean re-dispatch; set up the sqlrite-notes npm trusted publisher; consider moving the journal demo media out of the repo.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
rust-sqlite	Ready	Preview, Comment	Jun 1, 2026 6:40am