@catalystiq/test-kit 0.3.1 → 0.3.2

package/README.md

@@ -1,6 +1,6 @@
 # @catalystiq/test-kit
 
-Shared test helpers: one package, added to part by part. Pin an exact version (`"@catalystiq/test-kit": "0.3.1"`);
+Shared test helpers: one package, added to part by part. Pin an exact version (`"@catalystiq/test-kit": "0.3.2"`);
 Dependabot raises it.
 
 | Part | Import | What |
@@ -21,5 +21,10 @@ failing (`test/support/run-fixture.ts`). `npm run test:browser` runs the Playwri
 
 ## Releasing
 
-Raise `version` in `package.json` in a pull request. After it merges, publish a GitHub release tagged `v<version>`;
-`.github/workflows/publish.yml` checks the tag matches, runs the checks, and publishes to npm.
+Raise the version in a pull request (`npm version <x> --no-git-tag-version`, which also updates `package-lock.json`)
+and the pin above. After it merges, publish a GitHub release tagged `v<version>`;
+`.github/workflows/publish.yml` checks the tag matches, runs typecheck, lint, the unit suite (one Node version) and the
+package smoke check, not the browser lane, and publishes to npm through npm's trusted publishing (OIDC), so no npm
+token is needed. npmjs.com's settings for the package name this repository, `publish.yml` and the GitHub environment
+`npm` (which admits `main` and `v*` tags only) as its trusted publisher, so renaming the workflow file or the
+environment breaks publishing until that entry is recreated.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catalystiq/test-kit",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Shared test setup for Vitest, a fake MCP Apps host for jsdom and Playwright, the local Neon test-database run, and the local environment guard.",
   "type": "module",
   "license": "MIT",