@dumbmice/pi-deepseek-websearch 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.1.2 — 2026-10-30
+
+- README: document the release path in full — trusted publishing via GitHub OIDC, no
+  `NPM_TOKEN`, automatic provenance, the tag/version guard, and the option to disallow
+  token publishing once trusted publishing is proven.
+
+## 0.1.1 — 2026-10-30
+
+Documentation-only release: npm snapshots the README at publish time, so this
+republishes the corrected text.
+
+- Install command moved directly under the intro and no longer says "once the
+  package is published".
+- The sample-output block no longer overflows horizontally; the per-result
+  fields it used to cram into a comment are described in the prose below it.
+- README badges: npm version, license, Node engine, CI status, and a
+  "coexists with pi-web-access" badge (a downloads badge is deferred until the
+  package has statistics).
+
 ## 0.1.0 — 2026-10-30
 
 First release. Package name: `@dumbmice/pi-deepseek-websearch` (web search and page fetch over

package/README.md

@@ -1,11 +1,17 @@
 # @dumbmice/pi-deepseek-websearch
 
+[![npm version](https://img.shields.io/npm/v/@dumbmice/pi-deepseek-websearch)](https://www.npmjs.com/package/@dumbmice/pi-deepseek-websearch)
+[![license](https://img.shields.io/npm/l/@dumbmice/pi-deepseek-websearch)](LICENSE)
+[![node](https://img.shields.io/node/v/@dumbmice/pi-deepseek-websearch)](package.json)
+[![tests](https://github.com/DumbMice/pi-deepseek-websearch/actions/workflows/test.yml/badge.svg)](https://github.com/DumbMice/pi-deepseek-websearch/actions/workflows/test.yml)
+[![coexists with pi-web-access](https://img.shields.io/badge/coexists%20with-pi--web--access-2ea44f)](#why)
+
 DeepSeek **Search** and **Fetch** API tools for the [pi coding agent](https://pi.dev) — direct access to the fields and parameters that generic web-search wrappers throw away.
 
 Two tools, no dependencies, and it **coexists with `pi-web-access`**: different tool names, no web-search.json keys of its own, no settings to migrate.
 
 ```text
-DeepSeek search · 2 results                       ← abridged; each result also carries site, date, authority and score
+DeepSeek search · 2 results     ← abridged
 query: DeepSeek V4 Pro release
 
 1. DeepSeek-V4-Pro GA Release | DeepSeek API Docs
@@ -15,6 +21,8 @@ query: DeepSeek V4 Pro release
    We're launching DeepSeek-V4-Pro today! …
 ```
 
+Every result also carries site, publication date, authority tier and rerank score; `details` holds the full set.
+
 ## Why
 
 `pi-web-access` maps DeepSeek's Search API onto its generic provider interface (compared against `pi-web-access@0.44.0`, verified 2026-10-30). That is the right shape for a 40-provider router, but it loses what makes DeepSeek's API useful:
@@ -34,7 +42,7 @@ Use it when you need DeepSeek's ranking, publication dates, or a specific `count
 ## Install
 
 ```bash
-# from npm, once the package is published
+# from npm
 pi install npm:@dumbmice/pi-deepseek-websearch
 
 # straight from GitHub
@@ -157,6 +165,27 @@ npm run pack:check    # tarball contents (no tests, no devDependencies)
 
 The suite covers query trimming order and the 128 cap, caller-spacing preservation, documented validation rules, metadata rendering (`authority: -1`, score annotation, summary/snippet/content precedence, malformed fields), retry classification for every documented status, key redaction, URL safety including encoding bypasses, abort handling, and both tool call shapes.
 
+## Releasing
+
+Versions are published from CI with npm [trusted publishing](https://docs.npmjs.com/trusted-publishers):
+the workflow exchanges a GitHub OIDC token for a short-lived publish credential, so the repository
+holds **no `NPM_TOKEN` secret** and no long-lived write credential (including a 2FA-bypass token)
+is needed or permitted. Because the repository is public, npm attaches a **provenance attestation**
+automatically — no `--provenance` flag.
+
+```bash
+npm version patch --no-git-tag-version   # or minor/major
+git commit -am "chore: release v$(node -p "require('./package.json').version")"
+git tag "v$(node -p "require('./package.json').version")"
+git push origin main --follow-tags        # .github/workflows/publish.yml runs test + typecheck, then publishes
+```
+
+`.github/workflows/publish.yml` runs the 68 tests and the typecheck, and refuses to publish when the
+pushed tag and `package.json` version disagree, so a mis-versioned tag fails the build instead of
+shipping the wrong number. For maximum safety the package's *Publishing access* can then be set to
+"Require two-factor authentication and disallow tokens": trusted publishing keeps working, token
+publishing stops.
+
 ## License
 
 MIT. Issues and source: <https://github.com/DumbMice/pi-deepseek-websearch>.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dumbmice/pi-deepseek-websearch",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Web search and page fetch for pi via DeepSeek's Search & Fetch APIs: publication dates, authority, rerank score, ori_question, count up to 50, and graceful 128-char handling. Coexists with pi-web-access.",
   "type": "module",
   "license": "MIT",