@caltho/site-kit 0.1.0 → 0.1.1

package/README.md

@@ -75,8 +75,8 @@ To try a change in a site before releasing it: `bun pm pack`, then in the site
 `bun add file:/path/to/caltho-site-kit-<version>.tgz`.
 
 **Releasing**: raise `version` in package.json and merge to main. The Publish workflow sees a version
-that isn't on npm yet, checks and builds it, publishes it with npm's trusted publishing (no token is
-stored anywhere) and tags the commit. The package is public, so a site installs it with no token.
-First publish, once: from a laptop logged in to npm (`npm login`), `npm publish`; then on npmjs.com,
-the package's Settings › Trusted publisher › GitHub Actions: organization `trycaltho`, repository
-`site-kit`, workflow `publish.yml`.
+that isn't on npm yet, checks and builds it, and **stages** it with npm's trusted publishing (no token is
+stored anywhere). A person then approves it, which is the 2FA step: `npm stage list`, then
+`npm stage approve <id>` (or approve on npmjs.com). Only then is it live, and a site's Dependabot picks it up.
+Set on the package once: Settings › Trusted publisher › GitHub Actions: organization `trycaltho`,
+repository `site-kit`, workflow `publish.yml`, permission "stage publish".

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caltho/site-kit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "What every Caltho site is built with: the contract with CalOS (content, and how a site declares what is editable), images, search and security, and the checks",
   "license": "MIT",
   "type": "module",