@base44/app-plugin-commerce 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +4 -2
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -112,6 +112,8 @@ If you build on Base44's hosted platform, use the Base44 agent/MCP to write the
112
112
 
113
113
  Publishing is manual: **Actions → Manual Package Publish → Run workflow** ([`.github/workflows/manual-publish.yml`](./.github/workflows/manual-publish.yml)).
114
114
 
115
- Inputs: `version` (`patch`/`minor`/`major` or an explicit `0.1.0`), `npm_tag` (`latest`, `beta`, …) and `dry_run`. The workflow bumps `package.json`, prints the tarball contents, runs `npm publish`, then commits the bump, tags `v<version>` and cuts a GitHub release. A dry run publishes nothing and leaves no tag or commit.
115
+ Inputs: `version` (`patch`/`minor`/`major` or an explicit `0.2.0`), `npm_tag` (`latest`, `beta`, …) and `dry_run`. The workflow bumps `package.json`, prints the tarball contents, runs `npm publish`, then commits the bump, tags `v<version>` and cuts a GitHub release. A dry run publishes nothing and leaves no tag or commit.
116
116
 
117
- The first release needs an explicit version (the repo sits at `0.0.0`). Requirements: the repo secret/org secret **`NPM_TOKEN`** (an npm automation token with publish rights on the `@base44` scope), plus the org's `BASE44_GITHUB_ACTIONS_APP_ID` variable and `BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY` secret used to push the release commit.
117
+ Registry auth uses **npm trusted publishing** — the workflow holds no npm token. It authenticates over OIDC (`id-token: write` plus `npm install -g npm@latest`, which needs npm ≥ 11.5.1), which also signs a provenance attestation for each release. This requires a trusted publisher on the npm package (**Settings → Trusted Publisher → GitHub Actions**, repository `base44/app-plugin-commerce`, workflow `manual-publish.yml`, no environment); if that config is missing or the workflow filename changes, publishing fails with `ENEEDAUTH`.
118
+
119
+ Pushing the release commit and tag additionally needs the org's `BASE44_GITHUB_ACTIONS_APP_ID` variable and `BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY` secret.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@base44/app-plugin-commerce",
3
- "version": "0.1.0",
3
+ "version": "0.1.1",
4
4
  "description": "Base44 Commerce plugin — entities, backend functions, shared commerce engine, admin UI and the commerce skill, shipped as copyable source",
5
5
  "keywords": [
6
6
  "base44",