@brignano/design 0.1.0 → 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anthony Brignano
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -22,8 +22,8 @@ Distinctiveness lives in the brand layer; conventionality lives in the control l
 
 ## Consuming it
 
-```jsonc
-"dependencies": { "@brignano/design": "github:brignano/design#v1.0.0" }
+```sh
+npm install @brignano/design
 ```
 
 ```css
@@ -43,6 +43,45 @@ outside `tokens.css`** — a literal survives a theme change silently, which is
 
 ## Status
 
-Pre-1.0. Not yet published to npm — install from the git tag above. Publishing
-`v1.0.0` waits until `brignano.io` is actually consuming it, so the first published
-version isn't one that's immediately superseded.
+`0.x`, and deliberately so. `brignano.io` consumes it; `life`, `homelab` and
+`driftwood` don't yet. Token *names* may still move while those land, and a `0.x`
+range says that out loud — a caret on `0.x` pins the minor, so `^0.1.1` won't
+silently take a breaking rename the way `^1.1.0` would. `1.0.0` gets cut when the
+names stop changing, not on a date.
+
+Versions track the *tokens*, not the plumbing. A release that changes only
+packaging or docs is a patch; the minor is reserved for the first release where
+something actually looks different.
+
+## Releasing
+
+The tag is the trigger. `.github/workflows/publish.yml` publishes to npm on any
+`v*` tag, after checking the tag agrees with `package.json` — npm versions are
+immutable, so a mismatch is caught before it's permanent.
+
+```sh
+npm version minor   # bumps package.json, commits, tags
+git push --follow-tags
+```
+
+Publishing is done by CI, never from a laptop. There is no npm token anywhere in
+this repo and there should never be one — the runner exchanges its OIDC identity
+for a short-lived credential via npm [trusted publishing][tp], which is also what
+produces the provenance attestation. A laptop has no such identity.
+
+**The workflow is called `publish.yml` in every repo that publishes a package,
+and that is not cosmetic.** npm's Trusted Publisher form takes the workflow
+filename as part of the OIDC claim, and offers `publish.yml` as its example. Any
+other name is a value you have to remember correctly, from the GitHub side, while
+filling in a form on the npm side. Getting it wrong fails as `ENEEDAUTH` — npm
+declines the exchange, `npm publish` falls back to token auth, and there is no
+token — which names neither the workflow nor the mismatch. Matching the tool's
+default is cheaper than being right every time.
+
+Setting up a new package: create `.github/workflows/publish.yml` from this one,
+then add the Trusted Publisher on npmjs.com — publisher GitHub Actions, the org
+and repo, workflow filename `publish.yml`, and **environment name blank**, since
+these workflows declare no `environment:`. Configure it before the first tag, or
+the first publish fails the way this one did.
+
+[tp]: https://docs.npmjs.com/trusted-publishers/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brignano/design",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Shared design system for brignano surfaces \u2014 colour, type, space, shape, motion.",
   "license": "MIT",
   "repository": {