release: @parity/truapi 0.15.0, @parity/truapi-host 0.12.0

[justraman]

Release: @parity/truapi 0.15.0, @parity/truapi-host 0.12.0

Important

The PR title must start with release: for the publish workflow to fire.
Don't rewrite the squash commit subject in the merge dialog — the
release: prefix has to land on main.

Summary

Ships wire codec version 2 to the protocol package and the WASM host:

• feat(wire): address every frame with a (trait, method, message_type) envelope
  -> feat(wire): split the frame discriminant into trait and method bytes #357
• fix: bound iframe bootstrap and requests
  -> fix(truapi): bound iframe bootstrap and requests #665

Every frame is addressed by a two-byte (trait, method) discriminant plus a message_type byte naming which leg of
the exchange the frame carries; the payload is the plain SCALE encoding of that leg's type. TrUApiTransport.codecVersion,
CreateTransportOptions.codecVersion and GeneratedClientTransport are gone, and generated handshake calls read
TRUAPI_CODEC_VERSION directly. The client retries iframe readiness until the host transfers a channel and rejects
unanswered requests after a configurable bounded deadline.

Why minor. A codec version 1 peer cannot exchange frames with a codec version 2 peer in either direction: the
handshake itself rides the changed envelope, so the mismatch cannot be negotiated in band. Hosts and products must move
together, which is breaking in the way 0.x signals with a minor.

About 0.14.0 / 0.11.0. The previous release commit (#722) never reached npm: its Release run failed at
Verify release manifests because .changeset/reliable-iframe-bootstrap.md from #665 had merged minutes before the
release branch was cut and was never consumed. The registry stops at @parity/truapi@0.13.1 and
@parity/truapi-host@0.10.1, and no 0.14.0 / 0.11.0 tags exist. This PR consumes both pending changesets, so the
package changelogs carry a 0.15.0 / 0.12.0 entry above the unpublished 0.14.0 / 0.11.0 ones, and the generated root
CHANGELOG.md folds the 0.14.0 entries into 0.15.0 because it keys sections off tags. The release-cli job publishes
the prebuilt truapi-host binaries under 0.15.0 for the same reason.

Not in this subject. @parity/ios-host 0.14.0 and @parity/android-host 0.1.0 were also named in #722 and were
never published either. They are left out here because this release covers the npm packages only; a follow-up
release: PR naming them is the way to cut them. @parity/truapi-debugger is deliberately absent: changesets bumped
its manifest to 0.1.2 as an internal-dependency side effect, and it stays unpublished.

Verified locally: npm run check-release-versions, no files left under .changeset/, cargo check -p truapi -p truapi-host-cli --locked --offline after ./scripts/codegen.sh, and a cut-version.sh snapshot under 0.15.0.

Checklist

• Ran npm run changeset and selected the package + bump type (patch / minor / major) — both changesets were already on main (wire-trait-method-split.md, reliable-iframe-bootstrap.md)
• Ran npm run version-packages to consume the changeset
• js/packages/truapi/package.json version is bumped
• js/packages/truapi-host/package.json version is bumped when releasing the host
• The PR title includes @parity/ios-host <version> when publishing the iOS host — n/a, npm packages only
• Regenerated iOS bindings and container outputs are committed; CI builds and simulator-tests the XCFramework, publishes it, then commits Package.swift — n/a
• The PR title includes @parity/android-host <version> when publishing the Android host AAR; nothing in the tree records that version, so there is no manifest to bump — n/a
• @parity/truapi-host depends on ^<current @parity/truapi version>
• js/packages/truapi/CHANGELOG.md has the new entry
• js/packages/truapi-host/CHANGELOG.md has the new entry when releasing the host
• rust/crates/truapi/Cargo.toml and rust/crates/truapi-host-cli/Cargo.toml versions match js/packages/truapi/package.json (npm run check-release-versions), and Cargo.lock records them
• Releasing @parity/truapi also publishes the prebuilt truapi-host binaries; no extra title entry is needed
• No leftover files under .changeset/ (other than config.json)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​parity/​truapi@​0.14.0 ⏵ 0.15.0	N/A	N/A	N/A	N/A	N/A

View full report

[github-actions]

CI Status: 14 required jobs green, 13 passed and 1 skipped by path filter.

All job results

job	result
android-bindings	success
changes	success
codegen	success
e2e	skipped
explorer	success
ios-bindings	success
ios-swift	success
licenses	success
playground	success
rust	success
ts-client	success
ts-debugger	success
ts-host	success
wasm-provider	success

_{Commit 46810cda · run log}