@ancplua/qyl-api-schema 0.2.0 → 0.2.2

package/README.md

@@ -84,6 +84,10 @@ npm run compile
 
 ## Publishing
 
-During normal operation, GitHub Releases publish npm and NuGet artifacts in lockstep. When GitHub
-Actions is unavailable, publish manually from locally verified artifacts using package tokens passed
-through environment variables. Never print tokens and never commit credentials.
+Publishing is fully automated via GitHub Actions OIDC **trusted publishing** — no stored secrets, no
+API keys. Publish a GitHub Release whose tag is `vMAJOR.MINOR.PATCH[-prerelease]`; `publish.yml` then,
+all-or-nothing, packs and validates the artifacts, stamps that single tag-derived version onto both,
+pushes `Qyl.Api.Contracts` to nuget.org (NuGet/login OIDC) and publishes `@ancplua/qyl-api-schema` to
+npmjs.org (npm trusted publishing + provenance). NuGet pushes first (idempotent) and npm last
+(immutable), so a partial failure re-runs cleanly. See [VERSIONING.md](VERSIONING.md) for how the
+version is derived from the tag. There are no long-lived publish tokens to manage or rotate.

package/VERSIONING.md

@@ -2,6 +2,16 @@
 
 This repository uses `@typespec/versioning` to record when schema elements were added or removed across qyl API versions and OpenTelemetry compatibility-model pins. The annotations live in TypeSpec so schema evolution is reviewable at the contract source.
 
+## Release versioning (the package version)
+
+Separate from the `@typespec/versioning` schema annotations below: the published **package** version
+(npm `@ancplua/qyl-api-schema` and NuGet `Qyl.Api.Contracts`) is **CI-owned and tag-derived** — no
+hand-bumped version lives in any committed file. To cut a release, publish a GitHub Release whose tag
+is `vMAJOR.MINOR.PATCH[-prerelease]`; `publish.yml` strips the leading `v` and stamps that single
+version onto both npm and NuGet (no build metadata — npm rejects it and NuGet strips it), so the two
+registries are lockstep by construction. The committed `package.json` version is the non-authoritative
+placeholder `0.0.0-development`, and `packaging/Qyl.Api.Contracts.csproj` carries no `<Version>`.
+
 ## Where it is used
 
 - `models/genai.tsp` for GenAI semantic-convention shaped models

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ancplua/qyl-api-schema",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "TypeSpec source of truth for qyl API contracts. Emits OpenAPI, JSON Schema, Qyl.Api.Contracts DTOs, and TypeScript contract types; not an OpenTelemetry package, storage schema, or server implementation.",
   "license": "Apache-2.0",
   "repository": {
@@ -59,7 +59,16 @@
     "lint:public": "tsp compile index.tsp --no-emit --warn-as-error"
   },
   "peerDependencies": {
-    "@typespec/compiler": "^1.13.0 || >=1.13.0-dev.0"
+    "@typespec/compiler": "^1.13.0 || >=1.13.0-dev.0",
+    "@typespec/events": "^0.83.0",
+    "@typespec/http": "^1.13.0",
+    "@typespec/json-schema": "^1.13.0",
+    "@typespec/openapi": "^1.13.0",
+    "@typespec/openapi3": "^1.13.0",
+    "@typespec/rest": "^0.83.0",
+    "@typespec/sse": "^0.83.0",
+    "@typespec/streams": "^0.83.0",
+    "@typespec/versioning": "^0.83.0"
   },
   "devDependencies": {
     "@ancplua/typespec-emit-csharp": "file:./emitters/csharp",
@@ -80,9 +89,5 @@
     "typescript": "6.0.3",
     "vitest": "4.1.9",
     "@qyl/telemetry-control-graph": "file:./emitters/telemetry-control-graph"
-  },
-  "dependencies": {
-    "@azure-tools/typespec-azure-core": "^0.69.0",
-    "@typespec/xml": "^0.83.0"
   }
 }