@crvouga/personal 0.1.1 → 0.1.3

package/cli.mjs

@@ -4133,7 +4133,7 @@ function commandError(error, output) {
 
 // packages/personal-cli/src/app.ts
 import { parseArgs } from "node:util";
-var VERSION = "0.1.1";
+var VERSION = "0.1.3";
 function wantsInteractive(args, terminal, ci) {
   if (args.includes("--json") || args.includes("--non-interactive"))
     return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/personal",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Interactive, agent-friendly developer fleet command center",
   "type": "module",
   "bin": {
@@ -37,8 +37,8 @@
     "registry": "https://registry.npmjs.org/"
   },
   "personalCli": {
-    "contentHash": "ea1b56a73b42a40199a781f58611e4eca3abe4edd20f212930090b34c8e198e5",
-    "sourceCommit": "1b40b2d5457c28c7276f20c7a59f606db6f62e53",
+    "contentHash": "1ac1f6314fac17a14b6d62ca5f7ef6d567813c1fbe1e5e9b53a7580790a9b076",
+    "sourceCommit": "a241493b1e75735369bab9ca2bbcd575f80c5053",
     "dirty": false
   }
 }

package/releasing.md

@@ -47,6 +47,12 @@ permission. The publishing job runs directly in `ci.yml` so the registered
 workflow and executing workflow have the same identity. Do not move publication
 into a reusable workflow: its OIDC identity can differ from the registered publisher.
 
+npm may require a separate browser approval when reading trusted-publisher
+settings after login. Interactive verification keeps a terminal attached and
+uses npm's readable output so those approval URLs appear immediately; npm's JSON
+mode buffers browser URLs until completion. Open approval URLs in your normal
+local browser with access to your security key/passkey.
+
 Bootstrap is retryable: if content is already published, it only checks/configures
 the publisher. Existing publishers are preserved; no connection is revoked or
 replaced. npm account authorization uses an isolated temporary 0600 npmrc, which
@@ -75,7 +81,7 @@ publish-time web 2FA and trusted-publisher setup. npm update notices/progress ar
 disabled too; keep npm versions owned by the shared mise lock, not a global
 `npm install -g`. After cancellation or expiry, rerun the command and use its new
 URL, not an earlier session's URL. Treat approval links as private; never paste
-them into reports or shared logs. Registry verification retries version and latest-tag propagation with 100 seconds of bounded propagation waits without republishing. Transient read failures are retried within that same bound. The browser approval is not proof of publication;
+them into reports or shared logs. Registry verification retries version and latest-tag propagation with 310 seconds of bounded propagation waits without republishing. Transient read failures are retried within that same bound. The browser approval is not proof of publication;
 wait for registry-integrity and trusted-publisher verification to finish.
 
 ## Vault username/password login
@@ -124,7 +130,8 @@ with anonymous registry configuration and running it on real Node. The required
 4. Builds, allowlist-checks, packs and consumer-tests the exact tarball.
 5. Publishes using npm's **GitHub OIDC trusted publishing**, without npm secrets.
 6. Confirms the content hash, SHA-512 integrity and latest tag, with bounded
-   read-only retries for registry propagation. Unconfirmed outcomes fail rather
+   read-only retries for registry propagation. Registry reads bypass stale CDN
+   cache entries and verification waits for matching content and integrity. Unconfirmed outcomes fail rather
    than blindly republish.
 
 Publishing is serialized with non-cancelling concurrency. Dispatch **CI** on main