@liminis/editor 0.1.0-rc.1 → 0.1.0

package/README.md

@@ -28,10 +28,14 @@ travelled with the code, are recorded in [`docs/provenance.md`](./docs/provenanc
 
 ## Install
 
-> **This package is not published.** It is `private: true` and `@liminis/editor`
-> does not exist on the npm registry, so `pnpm add @liminis/editor` will fail.
-> That is deliberate — see [Consuming it](#consuming-it) below for the mechanism
-> that actually works, and `docs/decisions/adr-078.md` for why.
+```bash
+pnpm add @liminis/editor
+```
+
+> **This is `0.x`.** Minor versions may contain breaking changes; patch versions
+> will not. The seven declared subpath exports are the public API — anything
+> reachable by a deeper path is private and may move without notice. Breaking
+> changes are listed in the changelog with a migration note.
 
 React and Lexical are **peer dependencies**, so your app resolves exactly one
 copy of each. Two React copies produce `Invalid hook call`; two Lexical copies
@@ -259,8 +263,9 @@ inert).
 
 ## Consuming it
 
-Because the package is unpublished, consumers install a **packed tarball** rather
-than a registry version:
+The registry is the normal route (`pnpm add @liminis/editor`). The
+**packed tarball** below remains the way to consume an unreleased change — a
+local build, or a commit that has not been tagged:
 
 ```bash
 # in this repository
@@ -271,9 +276,10 @@ pnpm add /tmp/liminis-editor-0.1.0.tgz
 ```
 
 Applications that do this commit the tarball into their own tree (typically under
-`vendor/`) and pin it by filename, so the install is reproducible and needs no
-credentials for this private repository. `pnpm pack` works on a private package;
-only `npm publish` is blocked, which is exactly the guard intended.
+`vendor/`) and pin it by filename, so the install is reproducible and pinned to
+an exact build. `pnpm pack` is unaffected by the publish guard — that guard runs
+from `prepublishOnly`, so packing, installing and vendoring all work normally
+while publishing stays a deliberate act.
 
 A git dependency on this repository does **not** work, and the reasons are
 measured rather than assumed: `files` excludes the directory `main` points at, so

package/docs/decisions/adr-078.md

@@ -89,6 +89,16 @@ the built path is exercised only in CI — which is what SC-005 mandates anyway.
 `private: true` is kept: publishing is out of scope for #940, and `private`
 blocks `publish` without blocking `pack`.
 
+> **Amended 2026-08-16 — this clause no longer holds.** The package was
+> published as `0.1.0-rc.1`, so `private: true` is gone. It was also a weaker
+> guard than assumed: `npm publish --dry-run` (npm 10.8.2) builds, packs every
+> file and reports it would publish, exiting 0 without mentioning that the
+> package is private. The guard is now `prepublishOnly` →
+> `scripts/guard-publish.mjs`, which refuses unless `LIMINIS_ALLOW_PUBLISH=1`
+> is set — a script rather than a flag precisely so that it can be tested, and
+> it is, in `tests/package-manifest-contract.test.ts`. The rest of this ADR is
+> unaffected: `publishConfig` and the non-bundling `tsc` emit stand as decided.
+
 ### 3. `mdast-util-wiki-link` is vendored, not merely un-patched.
 
 The upstream package is vendored under

package/package.json

@@ -1,9 +1,21 @@
 {
   "name": "@liminis/editor",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0",
   "//publishing": "Publishing is deliberate, never incidental. `private: true` was this package's guard until verveguy/liminis-editor#39 took the publish decision; it is gone because that decision was taken, not because it was tidied away. The guard is now `prepublishOnly` -> scripts/guard-publish.mjs, which refuses unless LIMINIS_ALLOW_PUBLISH=1 is set explicitly. That variable is set at step scope in .github/workflows/publish.yml and nowhere else, so a release is the only path that publishes. Note that `npm publish --dry-run` does NOT report a private package as blocked (npm 10.8.2), which is why the guard is a script rather than a flag.",
   "license": "MIT",
   "description": "Lexical-based markdown WYSIWYG editor with mdast round-trip and a host-injection seam",
+  "keywords": [
+    "markdown",
+    "markdown-editor",
+    "wysiwyg",
+    "rich-text",
+    "editor",
+    "lexical",
+    "react",
+    "mdast",
+    "round-trip",
+    "annotations"
+  ],
   "//packageManager": "Not cosmetic. This field used to live in the monorepo root manifest and did not travel with the package, so `pnpm/action-setup` had no version to read and CI failed before installing anything. It is also what pins the pnpm that resolves the lockfile.",
   "packageManager": "pnpm@10.33.0",
   "type": "module",