@liminis/editor 0.1.0-rc.1 → 0.1.0-rc.2

package/README.md

@@ -28,10 +28,16 @@ travelled with the code, are recorded in [`docs/provenance.md`](./docs/provenanc
 
 ## Install
 
-> **This package is not published.** It is `private: true` and `@liminis/editor`
-> does not exist on the npm registry, so `pnpm add @liminis/editor` will fail.
-> That is deliberate — see [Consuming it](#consuming-it) below for the mechanism
-> that actually works, and `docs/decisions/adr-078.md` for why.
+> **This package is published as a prerelease.** `0.1.0-rc.1` is on npm under the
+> `next` tag, so `pnpm add @liminis/editor` resolves nothing — ask for the tag:
+>
+> ```bash
+> pnpm add @liminis/editor@next
+> ```
+>
+> The prerelease exists to prove the registry install path, which nothing had
+> exercised: both consuming applications resolved this package locally. `latest`
+> stays unset until `0.1.0`.
 
 React and Lexical are **peer dependencies**, so your app resolves exactly one
 copy of each. Two React copies produce `Invalid hook call`; two Lexical copies
@@ -259,8 +265,9 @@ inert).
 
 ## Consuming it
 
-Because the package is unpublished, consumers install a **packed tarball** rather
-than a registry version:
+The registry is now the normal route (`pnpm add @liminis/editor@next`). The
+**packed tarball** below remains the way to consume an unreleased change — a
+local build, or a commit that has not been tagged:
 
 ```bash
 # in this repository
@@ -271,9 +278,10 @@ pnpm add /tmp/liminis-editor-0.1.0.tgz
 ```
 
 Applications that do this commit the tarball into their own tree (typically under
-`vendor/`) and pin it by filename, so the install is reproducible and needs no
-credentials for this private repository. `pnpm pack` works on a private package;
-only `npm publish` is blocked, which is exactly the guard intended.
+`vendor/`) and pin it by filename, so the install is reproducible and pinned to
+an exact build. `pnpm pack` is unaffected by the publish guard — that guard runs
+from `prepublishOnly`, so packing, installing and vendoring all work normally
+while publishing stays a deliberate act.
 
 A git dependency on this repository does **not** work, and the reasons are
 measured rather than assumed: `files` excludes the directory `main` points at, so

package/docs/decisions/adr-078.md

@@ -89,6 +89,16 @@ the built path is exercised only in CI — which is what SC-005 mandates anyway.
 `private: true` is kept: publishing is out of scope for #940, and `private`
 blocks `publish` without blocking `pack`.
 
+> **Amended 2026-08-16 — this clause no longer holds.** The package was
+> published as `0.1.0-rc.1`, so `private: true` is gone. It was also a weaker
+> guard than assumed: `npm publish --dry-run` (npm 10.8.2) builds, packs every
+> file and reports it would publish, exiting 0 without mentioning that the
+> package is private. The guard is now `prepublishOnly` →
+> `scripts/guard-publish.mjs`, which refuses unless `LIMINIS_ALLOW_PUBLISH=1`
+> is set — a script rather than a flag precisely so that it can be tested, and
+> it is, in `tests/package-manifest-contract.test.ts`. The rest of this ADR is
+> unaffected: `publishConfig` and the non-bundling `tsc` emit stand as decided.
+
 ### 3. `mdast-util-wiki-link` is vendored, not merely un-patched.
 
 The upstream package is vendored under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liminis/editor",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0-rc.2",
   "//publishing": "Publishing is deliberate, never incidental. `private: true` was this package's guard until verveguy/liminis-editor#39 took the publish decision; it is gone because that decision was taken, not because it was tidied away. The guard is now `prepublishOnly` -> scripts/guard-publish.mjs, which refuses unless LIMINIS_ALLOW_PUBLISH=1 is set explicitly. That variable is set at step scope in .github/workflows/publish.yml and nowhere else, so a release is the only path that publishes. Note that `npm publish --dry-run` does NOT report a private package as blocked (npm 10.8.2), which is why the guard is a script rather than a flag.",
   "license": "MIT",
   "description": "Lexical-based markdown WYSIWYG editor with mdast round-trip and a host-injection seam",