@dumbmice/pi-deepseek-websearch 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.2 — 2026-10-30
+
+- README: document the release path in full — trusted publishing via GitHub OIDC, no
+  `NPM_TOKEN`, automatic provenance, the tag/version guard, and the option to disallow
+  token publishing once trusted publishing is proven.
+
 ## 0.1.1 — 2026-10-30
 
 Documentation-only release: npm snapshots the README at publish time, so this

package/README.md

@@ -167,8 +167,11 @@ The suite covers query trimming order and the 128 cap, caller-spacing preservati
 
 ## Releasing
 
-Versions are published from CI with npm [trusted publishing](https://docs.npmjs.com/trusted-publishers)
-(OIDC, no long-lived token, provenance attached):
+Versions are published from CI with npm [trusted publishing](https://docs.npmjs.com/trusted-publishers):
+the workflow exchanges a GitHub OIDC token for a short-lived publish credential, so the repository
+holds **no `NPM_TOKEN` secret** and no long-lived write credential (including a 2FA-bypass token)
+is needed or permitted. Because the repository is public, npm attaches a **provenance attestation**
+automatically — no `--provenance` flag.
 
 ```bash
 npm version patch --no-git-tag-version   # or minor/major
@@ -177,6 +180,12 @@ git tag "v$(node -p "require('./package.json').version")"
 git push origin main --follow-tags        # .github/workflows/publish.yml runs test + typecheck, then publishes
 ```
 
+`.github/workflows/publish.yml` runs the 68 tests and the typecheck, and refuses to publish when the
+pushed tag and `package.json` version disagree, so a mis-versioned tag fails the build instead of
+shipping the wrong number. For maximum safety the package's *Publishing access* can then be set to
+"Require two-factor authentication and disallow tokens": trusted publishing keeps working, token
+publishing stops.
+
 ## License
 
 MIT. Issues and source: <https://github.com/DumbMice/pi-deepseek-websearch>.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dumbmice/pi-deepseek-websearch",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Web search and page fetch for pi via DeepSeek's Search & Fetch APIs: publication dates, authority, rerank score, ori_question, count up to 50, and graceful 128-char handling. Coexists with pi-web-access.",
   "type": "module",
   "license": "MIT",